From: Sasha Levin Date: Mon, 21 Nov 2022 05:02:40 +0000 (-0500) Subject: Fixes for 6.0 X-Git-Tag: v4.19.266~50 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3ca0e65aa4ae8d13f080055775c004eaafcea7fe;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.0 Signed-off-by: Sasha Levin --- diff --git a/queue-6.0/arm-at91-pm-avoid-soft-resetting-ac-dll.patch b/queue-6.0/arm-at91-pm-avoid-soft-resetting-ac-dll.patch new file mode 100644 index 00000000000..99298f8df0d --- /dev/null +++ b/queue-6.0/arm-at91-pm-avoid-soft-resetting-ac-dll.patch @@ -0,0 +1,62 @@ +From 17d2dbc68d13f23d3fca3e5a33d6823635e3ab53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 15:41:04 +0300 +Subject: ARM: at91: pm: avoid soft resetting AC DLL + +From: Claudiu Beznea + +[ Upstream commit cef8cdc0d0e7c701fe4dcfba4ed3fd25d28a6020 ] + +Do not soft reset AC DLL as controller is buggy and this operation my +introduce glitches in the controller leading to undefined behavior. + +Fixes: f0bbf17958e8 ("ARM: at91: pm: add self-refresh support for sama7g5") +Depends-on: a02875c4cbd6 ("ARM: at91: pm: fix self-refresh for sama7g5") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20221026124114.985876-2-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm_suspend.S | 7 ++++++- + include/soc/at91/sama7-ddr.h | 5 ++++- + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index ffed4d949042..e4904faf1753 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -169,10 +169,15 @@ sr_ena_2: + cmp tmp1, #UDDRC_STAT_SELFREF_TYPE_SW + bne sr_ena_2 + +- /* Put DDR PHY's DLL in bypass mode for non-backup modes. */ ++ /* Disable DX DLLs for non-backup modes. */ + cmp r7, #AT91_PM_BACKUP + beq sr_ena_3 + ++ /* Do not soft reset the AC DLL. */ ++ ldr tmp1, [r3, DDR3PHY_ACDLLCR] ++ bic tmp1, tmp1, DDR3PHY_ACDLLCR_DLLSRST ++ str tmp1, [r3, DDR3PHY_ACDLLCR] ++ + /* Disable DX DLLs. */ + ldr tmp1, [r3, #DDR3PHY_DX0DLLCR] + orr tmp1, tmp1, #DDR3PHY_DXDLLCR_DLLDIS +diff --git a/include/soc/at91/sama7-ddr.h b/include/soc/at91/sama7-ddr.h +index 6ce3bd22f6c6..5ad7ac2e3a7c 100644 +--- a/include/soc/at91/sama7-ddr.h ++++ b/include/soc/at91/sama7-ddr.h +@@ -26,7 +26,10 @@ + #define DDR3PHY_PGSR (0x0C) /* DDR3PHY PHY General Status Register */ + #define DDR3PHY_PGSR_IDONE (1 << 0) /* Initialization Done */ + +-#define DDR3PHY_ACIOCR (0x24) /* DDR3PHY AC I/O Configuration Register */ ++#define DDR3PHY_ACDLLCR (0x14) /* DDR3PHY AC DLL Control Register */ ++#define DDR3PHY_ACDLLCR_DLLSRST (1 << 30) /* DLL Soft Reset */ ++ ++#define DDR3PHY_ACIOCR (0x24) /* DDR3PHY AC I/O Configuration Register */ + #define DDR3PHY_ACIOCR_CSPDD_CS0 (1 << 18) /* CS#[0] Power Down Driver */ + #define DDR3PHY_ACIOCR_CKPDD_CK0 (1 << 8) /* CK[0] Power Down Driver */ + #define DDR3PHY_ACIORC_ACPDD (1 << 3) /* AC Power Down Driver */ +-- +2.35.1 + diff --git a/queue-6.0/arm-dts-at91-sama7g5-fix-signal-name-of-pin-pb2.patch b/queue-6.0/arm-dts-at91-sama7g5-fix-signal-name-of-pin-pb2.patch new file mode 100644 index 00000000000..a20ffc0da8f --- /dev/null +++ b/queue-6.0/arm-dts-at91-sama7g5-fix-signal-name-of-pin-pb2.patch @@ -0,0 +1,39 @@ +From f99f1cb264161b6e989b1706e70cb25d912626fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 11:31:19 +0300 +Subject: ARM: dts: at91: sama7g5: fix signal name of pin PB2 + +From: Mihai Sain + +[ Upstream commit 2b4337c8409b4e9e5aed15c597e4031dd567bdd8 ] + +The signal name of pin PB2 with function F is FLEXCOM11_IO1 +as it is defined in the datasheet. + +Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek") +Signed-off-by: Mihai Sain +Reviewed-by: Tudor Ambarus +Acked-by: Nicolas Ferre +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20221017083119.1643-1-mihai.sain@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sama7g5-pinfunc.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sama7g5-pinfunc.h b/arch/arm/boot/dts/sama7g5-pinfunc.h +index 4eb30445d205..6e87f0d4b8fc 100644 +--- a/arch/arm/boot/dts/sama7g5-pinfunc.h ++++ b/arch/arm/boot/dts/sama7g5-pinfunc.h +@@ -261,7 +261,7 @@ + #define PIN_PB2__FLEXCOM6_IO0 PINMUX_PIN(PIN_PB2, 2, 1) + #define PIN_PB2__ADTRG PINMUX_PIN(PIN_PB2, 3, 1) + #define PIN_PB2__A20 PINMUX_PIN(PIN_PB2, 4, 1) +-#define PIN_PB2__FLEXCOM11_IO0 PINMUX_PIN(PIN_PB2, 6, 3) ++#define PIN_PB2__FLEXCOM11_IO1 PINMUX_PIN(PIN_PB2, 6, 3) + #define PIN_PB3 35 + #define PIN_PB3__GPIO PINMUX_PIN(PIN_PB3, 0, 0) + #define PIN_PB3__RF1 PINMUX_PIN(PIN_PB3, 1, 1) +-- +2.35.1 + diff --git a/queue-6.0/arm-dts-imx7-fix-nand-controller-size-cells.patch b/queue-6.0/arm-dts-imx7-fix-nand-controller-size-cells.patch new file mode 100644 index 00000000000..c472adb1dae --- /dev/null +++ b/queue-6.0/arm-dts-imx7-fix-nand-controller-size-cells.patch @@ -0,0 +1,45 @@ +From 6389325430ebb73bebcb54c7eb9ac4c7450b639f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 20:19:45 +0100 +Subject: ARM: dts: imx7: Fix NAND controller size-cells + +From: Marek Vasut + +[ Upstream commit 753395ea1e45c724150070b5785900b6a44bd5fb ] + +The NAND controller size-cells should be 0 per DT bindings. +Fix the following warning produces by DT bindings check: +" +nand-controller@33002000: #size-cells:0:0: 0 was expected +nand-controller@33002000: Unevaluated properties are not allowed ('#address-cells', '#size-cells' were unexpected) +" +Fix the missing space in node name too. + +Fixes: e7495a45a76de ("ARM: dts: imx7: add GPMI NAND and APBH DMA") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx7s.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi +index 29148285f9fc..1dc3bfac30b6 100644 +--- a/arch/arm/boot/dts/imx7s.dtsi ++++ b/arch/arm/boot/dts/imx7s.dtsi +@@ -1270,10 +1270,10 @@ dma_apbh: dma-apbh@33000000 { + clocks = <&clks IMX7D_NAND_USDHC_BUS_RAWNAND_CLK>; + }; + +- gpmi: nand-controller@33002000{ ++ gpmi: nand-controller@33002000 { + compatible = "fsl,imx7d-gpmi-nand"; + #address-cells = <1>; +- #size-cells = <1>; ++ #size-cells = <0>; + reg = <0x33002000 0x2000>, <0x33004000 0x4000>; + reg-names = "gpmi-nand", "bch"; + interrupts = ; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-imx8mm-fix-nand-controller-size-cells.patch b/queue-6.0/arm64-dts-imx8mm-fix-nand-controller-size-cells.patch new file mode 100644 index 00000000000..24af59de20c --- /dev/null +++ b/queue-6.0/arm64-dts-imx8mm-fix-nand-controller-size-cells.patch @@ -0,0 +1,45 @@ +From 560fd13671d52a76c05e62b02a1b52ff22e56486 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 20:19:46 +0100 +Subject: arm64: dts: imx8mm: Fix NAND controller size-cells + +From: Marek Vasut + +[ Upstream commit 1610233bc2c2cae2dff9e101e6ea5ef69cceb0e9 ] + +The NAND controller size-cells should be 0 per DT bindings. +Fix the following warning produces by DT bindings check: +" +nand-controller@33002000: #size-cells:0:0: 0 was expected +nand-controller@33002000: Unevaluated properties are not allowed ('#address-cells', '#size-cells' were unexpected) +" +Fix the missing space in node name too. + +Fixes: a05ea40eb384e ("arm64: dts: imx: Add i.mx8mm dtsi support") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +index dabd94dc30c4..50ef92915c67 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +@@ -1244,10 +1244,10 @@ dma_apbh: dma-controller@33000000 { + clocks = <&clk IMX8MM_CLK_NAND_USDHC_BUS_RAWNAND_CLK>; + }; + +- gpmi: nand-controller@33002000{ ++ gpmi: nand-controller@33002000 { + compatible = "fsl,imx8mm-gpmi-nand", "fsl,imx7d-gpmi-nand"; + #address-cells = <1>; +- #size-cells = <1>; ++ #size-cells = <0>; + reg = <0x33002000 0x2000>, <0x33004000 0x4000>; + reg-names = "gpmi-nand", "bch"; + interrupts = ; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-imx8mm-tqma8mqml-mba8mx-fix-usb-dr.patch b/queue-6.0/arm64-dts-imx8mm-tqma8mqml-mba8mx-fix-usb-dr.patch new file mode 100644 index 00000000000..ac751eda778 --- /dev/null +++ b/queue-6.0/arm64-dts-imx8mm-tqma8mqml-mba8mx-fix-usb-dr.patch @@ -0,0 +1,88 @@ +From 938f6239c08e209453e0c005673c8e8a484581bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 10:30:31 +0100 +Subject: arm64: dts: imx8mm-tqma8mqml-mba8mx: Fix USB DR + +From: Alexander Stein + +[ Upstream commit 63fd9437ec81899fc36bb642d558378bc89aa4f9 ] + +Using extcon USB host mode works properly on DR interface, e.g. +enabling/disabling VBUS. But USB device mode is not working. +Fix this by switching to usb-role-switch instead. + +Fixes: dfcd1b6f7620 ("arm64: dts: freescale: add initial device tree for TQMa8MQML with i.MX8MM") +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../dts/freescale/imx8mm-tqma8mqml-mba8mx.dts | 32 +++++++++++++++---- + 1 file changed, 26 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts b/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts +index 7e0aeb2db305..a0aeac619929 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts +@@ -34,11 +34,25 @@ reg_usdhc2_vmmc: regulator-vmmc { + off-on-delay-us = <12000>; + }; + +- extcon_usbotg1: extcon-usbotg1 { +- compatible = "linux,extcon-usb-gpio"; ++ connector { ++ compatible = "gpio-usb-b-connector", "usb-b-connector"; ++ type = "micro"; ++ label = "X19"; + pinctrl-names = "default"; +- pinctrl-0 = <&pinctrl_usb1_extcon>; +- id-gpio = <&gpio1 10 GPIO_ACTIVE_HIGH>; ++ pinctrl-0 = <&pinctrl_usb1_connector>; ++ id-gpios = <&gpio1 10 GPIO_ACTIVE_HIGH>; ++ ++ ports { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ port@0 { ++ reg = <0>; ++ usb_dr_connector: endpoint { ++ remote-endpoint = <&usb1_drd_sw>; ++ }; ++ }; ++ }; + }; + }; + +@@ -105,13 +119,19 @@ &usbotg1 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usbotg1>; + dr_mode = "otg"; +- extcon = <&extcon_usbotg1>; + srp-disable; + hnp-disable; + adp-disable; + power-active-high; + over-current-active-low; ++ usb-role-switch; + status = "okay"; ++ ++ port { ++ usb1_drd_sw: endpoint { ++ remote-endpoint = <&usb_dr_connector>; ++ }; ++ }; + }; + + &usbotg2 { +@@ -231,7 +251,7 @@ pinctrl_usbotg1: usbotg1grp { + ; + }; + +- pinctrl_usb1_extcon: usb1-extcongrp { ++ pinctrl_usb1_connector: usb1-connectorgrp { + fsl,pins = ; + }; + +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-imx8mn-fix-nand-controller-size-cells.patch b/queue-6.0/arm64-dts-imx8mn-fix-nand-controller-size-cells.patch new file mode 100644 index 00000000000..e897e3f644c --- /dev/null +++ b/queue-6.0/arm64-dts-imx8mn-fix-nand-controller-size-cells.patch @@ -0,0 +1,40 @@ +From f2a6d133d5b59d92d239282992d36c20d2ff7248 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 20:19:47 +0100 +Subject: arm64: dts: imx8mn: Fix NAND controller size-cells + +From: Marek Vasut + +[ Upstream commit 5468e93b5b1083eaa729f98e59da18c85d9c4126 ] + +The NAND controller size-cells should be 0 per DT bindings. +Fix the following warning produces by DT bindings check: +" +nand-controller@33002000: #size-cells:0:0: 0 was expected +nand-controller@33002000: Unevaluated properties are not allowed ('#address-cells', '#size-cells' were unexpected) +" + +Fixes: 6c3debcbae47a ("arm64: dts: freescale: Add i.MX8MN dtsi support") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mn.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +index ad0b99adf691..67b554ba690c 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +@@ -1102,7 +1102,7 @@ dma_apbh: dma-controller@33000000 { + gpmi: nand-controller@33002000 { + compatible = "fsl,imx8mn-gpmi-nand", "fsl,imx7d-gpmi-nand"; + #address-cells = <1>; +- #size-cells = <1>; ++ #size-cells = <0>; + reg = <0x33002000 0x2000>, <0x33004000 0x4000>; + reg-names = "gpmi-nand", "bch"; + interrupts = ; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-imx93-pinfunc-drop-execution-permission.patch b/queue-6.0/arm64-dts-imx93-pinfunc-drop-execution-permission.patch new file mode 100644 index 00000000000..610ef6a68c7 --- /dev/null +++ b/queue-6.0/arm64-dts-imx93-pinfunc-drop-execution-permission.patch @@ -0,0 +1,26 @@ +From 8ec43a2b83f2bc1aa3489798a28efe5a88072487 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 13:49:42 +0800 +Subject: arm64: dts: imx93-pinfunc: drop execution permission + +From: Peng Fan + +[ Upstream commit 2db1fdb25d209a88112fd82eb493976d66057d10 ] + +Drop the header file execution permission + +Signed-off-by: Peng Fan +Fixes: ec8b5b5058ea ("arm64: dts: freescale: Add i.MX93 dtsi support") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx93-pinfunc.h | 0 + 1 file changed, 0 insertions(+), 0 deletions(-) + mode change 100755 => 100644 arch/arm64/boot/dts/freescale/imx93-pinfunc.h + +diff --git a/arch/arm64/boot/dts/freescale/imx93-pinfunc.h b/arch/arm64/boot/dts/freescale/imx93-pinfunc.h +old mode 100755 +new mode 100644 +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-ipq8074-correct-apcs-register-space-s.patch b/queue-6.0/arm64-dts-qcom-ipq8074-correct-apcs-register-space-s.patch new file mode 100644 index 00000000000..411081b1057 --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-ipq8074-correct-apcs-register-space-s.patch @@ -0,0 +1,42 @@ +From 5beebf4805184f12ba2a2c34d72de66aceb1bb57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Aug 2022 00:06:27 +0200 +Subject: arm64: dts: qcom: ipq8074: correct APCS register space size + +From: Robert Marko + +[ Upstream commit 40b21d466a86bd5b10d24f59746ed41283a9b3f6 ] + +APCS DTS addition that was merged, was not supposed to get merged as it +was part of patch series that was superseded by 2 more patch series +that resolved issues with this one and greatly simplified things. + +Since it already got merged, start by correcting the register space +size as APCS will not be providing regmap for PLL and it will conflict +with the standalone A53 PLL node. + +Fixes: 50ed9fffec3a ("arm64: dts: qcom: ipq8074: add APCS node") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220818220628.339366-8-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index b9bf43215ada..79351c6157ea 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -668,7 +668,7 @@ watchdog: watchdog@b017000 { + + apcs_glb: mailbox@b111000 { + compatible = "qcom,ipq8074-apcs-apps-global"; +- reg = <0x0b111000 0x6000>; ++ reg = <0x0b111000 0x1000>; + + #clock-cells = <1>; + #mbox-cells = <1>; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sa8155p-adp-specify-which-ldo-modes-a.patch b/queue-6.0/arm64-dts-qcom-sa8155p-adp-specify-which-ldo-modes-a.patch new file mode 100644 index 00000000000..7b5d2971932 --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sa8155p-adp-specify-which-ldo-modes-a.patch @@ -0,0 +1,92 @@ +From 0452862f7460d42b5fb489eea7341dccf58f365b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 09:49:47 -0700 +Subject: arm64: dts: qcom: sa8155p-adp: Specify which LDO modes are allowed + +From: Douglas Anderson + +[ Upstream commit bd9f3dcf42d943b53190f99bcdbcfe98a56ac4cd ] + +This board uses RPMH, specifies "regulator-allow-set-load" for LDOs, +but doesn't specify any modes with "regulator-allowed-modes". + +Prior to commit efb0cb50c427 ("regulator: qcom-rpmh: Implement +get_optimum_mode(), not set_load()") the above meant that we were able +to set either LPM or HPM mode. After that commit (and fixes [1]) we'll +be stuck at the initial mode. Discussion of this has resulted in the +decision that the old dts files were wrong and should be fixed to +fully restore old functionality. + +Let's re-enable the old functionality by fixing the dts. + +NOTE: while here, let's also remove the nonsensical +"regulator-allow-set-load" on the fixed regulator "vreg_s4a_1p8". + +[1] https://lore.kernel.org/r/20220824142229.RFT.v2.2.I6f77860e5cd98bf5c67208fa9edda4a08847c304@changeid + +Fixes: 5b85e8f2225c ("arm64: dts: qcom: sa8155p-adp: Add base dts file") +Signed-off-by: Douglas Anderson +Reviewed-by: Andrew Halaney +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220829094903.v2.1.Id59c32b560c4662d8b3697de2bd494d08d654806@changeid +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sa8155p-adp.dts | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sa8155p-adp.dts b/arch/arm64/boot/dts/qcom/sa8155p-adp.dts +index ba547ca9fc6b..ddb9cb182152 100644 +--- a/arch/arm64/boot/dts/qcom/sa8155p-adp.dts ++++ b/arch/arm64/boot/dts/qcom/sa8155p-adp.dts +@@ -43,7 +43,6 @@ vreg_s4a_1p8: smps4 { + + regulator-always-on; + regulator-boot-on; +- regulator-allow-set-load; + + vin-supply = <&vreg_3p3>; + }; +@@ -137,6 +136,9 @@ vreg_l5a_0p88: ldo5 { + regulator-max-microvolt = <880000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l7a_1p8: ldo7 { +@@ -152,6 +154,9 @@ vreg_l10a_2p96: ldo10 { + regulator-max-microvolt = <2960000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l11a_0p8: ldo11 { +@@ -258,6 +263,9 @@ vreg_l5c_1p2: ldo5 { + regulator-max-microvolt = <1200000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l7c_1p8: ldo7 { +@@ -273,6 +281,9 @@ vreg_l8c_1p2: ldo8 { + regulator-max-microvolt = <1200000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l10c_3p3: ldo10 { +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sa8295p-adp-specify-which-ldo-modes-a.patch b/queue-6.0/arm64-dts-qcom-sa8295p-adp-specify-which-ldo-modes-a.patch new file mode 100644 index 00000000000..abbd2987afb --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sa8295p-adp-specify-which-ldo-modes-a.patch @@ -0,0 +1,82 @@ +From 9e92744f2e2a3b982e768fdfd321fa2c42896a2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 09:49:48 -0700 +Subject: arm64: dts: qcom: sa8295p-adp: Specify which LDO modes are allowed + +From: Douglas Anderson + +[ Upstream commit 09a1710b3e12e7ac8d871506bc395a9e8a0f63d6 ] + +This board uses RPMH, specifies "regulator-allow-set-load" for LDOs, +but doesn't specify any modes with "regulator-allowed-modes". + +Prior to commit efb0cb50c427 ("regulator: qcom-rpmh: Implement +get_optimum_mode(), not set_load()") the above meant that we were able +to set either LPM or HPM mode. After that commit (and fixes [1]) we'll +be stuck at the initial mode. Discussion of this has resulted in the +decision that the old dts files were wrong and should be fixed to +fully restore old functionality. + +Let's re-enable the old functionality by fixing the dts. + +[1] https://lore.kernel.org/r/20220824142229.RFT.v2.2.I6f77860e5cd98bf5c67208fa9edda4a08847c304@changeid + +Fixes: 519183af39b2 ("arm64: dts: qcom: add SA8540P and ADP") +Signed-off-by: Douglas Anderson +Reviewed-by: Andrew Halaney +Reviewed-by: Konrad Dybcio +Reviewed-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220829094903.v2.2.I430a56702ab0af65244e62667bb7743107de0c96@changeid +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sa8295p-adp.dts | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sa8295p-adp.dts b/arch/arm64/boot/dts/qcom/sa8295p-adp.dts +index ca5f5ad32ce5..5b16ac76fefb 100644 +--- a/arch/arm64/boot/dts/qcom/sa8295p-adp.dts ++++ b/arch/arm64/boot/dts/qcom/sa8295p-adp.dts +@@ -83,6 +83,9 @@ vreg_l3c: ldo3 { + regulator-max-microvolt = <1200000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l4c: ldo4 { +@@ -98,6 +101,9 @@ vreg_l6c: ldo6 { + regulator-max-microvolt = <1200000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l7c: ldo7 { +@@ -113,6 +119,9 @@ vreg_l10c: ldo10 { + regulator-max-microvolt = <2504000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l17c: ldo17 { +@@ -121,6 +130,9 @@ vreg_l17c: ldo17 { + regulator-max-microvolt = <2504000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + }; + +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sc7280-add-the-reset-reg-for-lpass-au.patch b/queue-6.0/arm64-dts-qcom-sc7280-add-the-reset-reg-for-lpass-au.patch new file mode 100644 index 00000000000..5a4883fe677 --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sc7280-add-the-reset-reg-for-lpass-au.patch @@ -0,0 +1,39 @@ +From 9ba4969043b0001bcce30e2ebcf141229bcdb297 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 17:18:15 +0530 +Subject: arm64: dts: qcom: sc7280: Add the reset reg for lpass audiocc on + SC7280 + +From: Satya Priya + +[ Upstream commit cb1d0aaa674e99957b85af570cb2730145af01df ] + +Add the reset register offset for clock gating. + +Fixes: 9499240d15f2 ("arm64: dts: qcom: sc7280: Add lpasscore & lpassaudio clock controllers") +Signed-off-by: Satya Priya +Reviewed-by: Neil Armstrong +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1663674495-25748-1-git-send-email-quic_c_skakit@quicinc.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index 51ed691075ad..b3c3844f97a0 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -2177,7 +2177,8 @@ lpasscc: lpasscc@3000000 { + + lpass_audiocc: clock-controller@3300000 { + compatible = "qcom,sc7280-lpassaudiocc"; +- reg = <0 0x03300000 0 0x30000>; ++ reg = <0 0x03300000 0 0x30000>, ++ <0 0x032a9000 0 0x1000>; + clocks = <&rpmhcc RPMH_CXO_CLK>, + <&lpass_aon LPASS_AON_CC_MAIN_RCG_CLK_SRC>; + clock-names = "bi_tcxo", "lpass_aon_cc_main_rcg_clk_src"; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sc8280xp-correct-ref-clock-for-ufs_me.patch b/queue-6.0/arm64-dts-qcom-sc8280xp-correct-ref-clock-for-ufs_me.patch new file mode 100644 index 00000000000..72c5ebcad25 --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sc8280xp-correct-ref-clock-for-ufs_me.patch @@ -0,0 +1,56 @@ +From 4920acd959ffe1d44eb28878df4c65de50894ebb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Oct 2022 10:55:29 -0400 +Subject: arm64: dts: qcom: sc8280xp: correct ref clock for ufs_mem_phy + +From: Brian Masney + +[ Upstream commit f3aa975e230e060c07dcfdf3fe92b59809422c13 ] + +The first UFS host controller fails to start on the SA8540P automotive +board (QDrive3) due to the following errors: + + ufshcd-qcom 1d84000.ufs: ufshcd_query_flag: Sending flag query for idn 18 failed, err = 253 + ufshcd-qcom 1d84000.ufs: ufshcd_query_flag: Sending flag query for idn 18 failed, err = 253 + ufshcd-qcom 1d84000.ufs: ufshcd_query_flag: Sending flag query for idn 18 failed, err = 253 + ufshcd-qcom 1d84000.ufs: ufshcd_query_flag_retry: query attribute, opcode 5, idn 18, failed + with error 253 after 3 retries + +The system eventually fails to boot with the warning: + + gcc_ufs_phy_axi_clk status stuck at 'off' + +This issue can be worked around by adding clk_ignore_unused to the +kernel command line since the system firmware sets up this clock for us. + +Let's fix this issue by updating the ref clock on ufs_mem_phy. Note +that the downstream MSM 5.4 sources list this as ref_clk_parent. With +this patch, the SA8540P is able to be booted without clk_ignore_unused. + +Signed-off-by: Brian Masney +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Tested-by: Johan Hovold +Reviewed-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221006145529.755521-1-bmasney@redhat.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index 92cbe84de0e5..cdc395d53c5a 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -891,7 +891,7 @@ ufs_mem_phy: phy@1d87000 { + ranges; + clock-names = "ref", + "ref_aux"; +- clocks = <&rpmhcc RPMH_CXO_CLK>, ++ clocks = <&gcc GCC_UFS_REF_CLKREF_CLK>, + <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; + + resets = <&ufs_mem_hc 0>; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sc8280xp-crd-specify-which-ldo-modes-.patch b/queue-6.0/arm64-dts-qcom-sc8280xp-crd-specify-which-ldo-modes-.patch new file mode 100644 index 00000000000..8e88eddbca4 --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sc8280xp-crd-specify-which-ldo-modes-.patch @@ -0,0 +1,62 @@ +From 9f598e84e7f8ef4cda024c673d178f0b1bf26c39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 09:49:49 -0700 +Subject: arm64: dts: qcom: sc8280xp-crd: Specify which LDO modes are allowed + +From: Douglas Anderson + +[ Upstream commit a4543e21ae363f4f094fb3c3503d77029e0c5d90 ] + +This board uses RPMH, specifies "regulator-allow-set-load" for LDOs, +but doesn't specify any modes with "regulator-allowed-modes". + +Prior to commit efb0cb50c427 ("regulator: qcom-rpmh: Implement +get_optimum_mode(), not set_load()") the above meant that we were able +to set either LPM or HPM mode. After that commit (and fixes [1]) we'll +be stuck at the initial mode. Discussion of this has resulted in the +decision that the old dts files were wrong and should be fixed to +fully restore old functionality. + +Let's re-enable the old functionality by fixing the dts. + +[1] https://lore.kernel.org/r/20220824142229.RFT.v2.2.I6f77860e5cd98bf5c67208fa9edda4a08847c304@changeid + +Fixes: ccd3517faf18 ("arm64: dts: qcom: sc8280xp: Add reference device") +Signed-off-by: Douglas Anderson +Reviewed-by: Andrew Halaney +Reviewed-by: Konrad Dybcio +Reviewed-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220829094903.v2.3.Ie7d2c50d2b42ef2d364f3a0c8e300e5ce1875b79@changeid +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp-crd.dts | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts b/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts +index 6792e88b2c6c..a3796502d425 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts ++++ b/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts +@@ -124,6 +124,9 @@ vreg_l7c: ldo7 { + regulator-max-microvolt = <2504000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l13c: ldo13 { +@@ -146,6 +149,9 @@ vreg_l3d: ldo3 { + regulator-max-microvolt = <1200000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l4d: ldo4 { +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sc8280xp-drop-broken-dp-phy-nodes.patch b/queue-6.0/arm64-dts-qcom-sc8280xp-drop-broken-dp-phy-nodes.patch new file mode 100644 index 00000000000..bad5e9d8f30 --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sc8280xp-drop-broken-dp-phy-nodes.patch @@ -0,0 +1,68 @@ +From fb20d916f161aaf8796de5de374ce02a788f4796 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Sep 2022 11:44:54 +0200 +Subject: arm64: dts: qcom: sc8280xp: drop broken DP PHY nodes + +From: Johan Hovold + +[ Upstream commit 7cdfb7a54ac88f7cb6d830ebb78bdbcbcb44bb4c ] + +The DP PHY register layout of the current binding do not apply to the +newer USB4/USB3/DP PHY which uses a different register layout entirely. + +Drop the DP PHY subnodes until the binding has been updated to prevent +the driver from corrupting unrelated registers. + +Note that this is also needed in order to not break USB with an upcoming +PHY driver change that checks for overlapping register regions. + +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220919094454.1574-5-johan+linaro@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 20 -------------------- + 1 file changed, 20 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index cf6d1063bb84..2a702abcf51e 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -1191,16 +1191,6 @@ usb_0_ssphy: usb3-phy@88eb400 { + clock-names = "pipe0"; + clock-output-names = "usb0_phy_pipe_clk_src"; + }; +- +- usb_0_dpphy: dp-phy@88ed200 { +- reg = <0 0x088ed200 0 0x200>, +- <0 0x088ed400 0 0x200>, +- <0 0x088eda00 0 0x200>, +- <0 0x088ea600 0 0x200>, +- <0 0x088ea800 0 0x200>; +- #clock-cells = <1>; +- #phy-cells = <0>; +- }; + }; + + usb_1_hsphy: phy@8902000 { +@@ -1253,16 +1243,6 @@ usb_1_ssphy: usb3-phy@8903400 { + clock-names = "pipe0"; + clock-output-names = "usb1_phy_pipe_clk_src"; + }; +- +- usb_1_dpphy: dp-phy@8904200 { +- reg = <0 0x08904200 0 0x200>, +- <0 0x08904400 0 0x200>, +- <0 0x08904a00 0 0x200>, +- <0 0x08904600 0 0x200>, +- <0 0x08904800 0 0x200>; +- #clock-cells = <1>; +- #phy-cells = <0>; +- }; + }; + + system-cache-controller@9200000 { +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sc8280xp-fix-ufs-phy-serdes-size.patch b/queue-6.0/arm64-dts-qcom-sc8280xp-fix-ufs-phy-serdes-size.patch new file mode 100644 index 00000000000..e0a7480899c --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sc8280xp-fix-ufs-phy-serdes-size.patch @@ -0,0 +1,50 @@ +From a55b7fb5ffafe452050003962662ee91670dfa52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 16:16:01 +0200 +Subject: arm64: dts: qcom: sc8280xp: fix UFS PHY serdes size + +From: Johan Hovold + +[ Upstream commit 8703d55bd5eac642275fe91b34ac62ad0ad312b5 ] + +The size of the UFS PHY serdes register region is 0x1c8 and the +corresponding 'reg' property should specifically not include the +adjacent regions that are defined in the child node (e.g. tx and rx). + +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Johan Hovold +Tested-by: Andrew Halaney #Qdrive3/sa8540p-adp-ride +Reviewed-by: Brian Masney +Reviewed-by: Bjorn Andersson +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220915141601.18435-1-johan+linaro@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index 2a702abcf51e..6d82dea3675b 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -885,7 +885,7 @@ ufs_mem_hc: ufs@1d84000 { + + ufs_mem_phy: phy@1d87000 { + compatible = "qcom,sc8280xp-qmp-ufs-phy"; +- reg = <0 0x01d87000 0 0xe10>; ++ reg = <0 0x01d87000 0 0x1c8>; + #address-cells = <2>; + #size-cells = <2>; + ranges; +@@ -953,7 +953,7 @@ ufs_card_hc: ufs@1da4000 { + + ufs_card_phy: phy@1da7000 { + compatible = "qcom,sc8280xp-qmp-ufs-phy"; +- reg = <0 0x01da7000 0 0xe10>; ++ reg = <0 0x01da7000 0 0x1c8>; + #address-cells = <2>; + #size-cells = <2>; + ranges; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sc8280xp-fix-ufs_card_phy-ref-clock.patch b/queue-6.0/arm64-dts-qcom-sc8280xp-fix-ufs_card_phy-ref-clock.patch new file mode 100644 index 00000000000..fbafc08bd3a --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sc8280xp-fix-ufs_card_phy-ref-clock.patch @@ -0,0 +1,50 @@ +From c3dd7c6b6c98f7e8b3e58e9df26af8598e87149c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Oct 2022 16:33:05 +0200 +Subject: arm64: dts: qcom: sc8280xp: fix ufs_card_phy ref clock + +From: Johan Hovold + +[ Upstream commit 8d6b458ce6e93286a607e54f787f7a86067f58bd ] + +The GCC_UFS_REF_CLKREF_CLK must be enabled or the second UFS controller +fails to enumerate on sa8295p-adp. + +Note that the vendor kernel enables both GCC_UFS_REF_CLKREF_CLK and +GCC_UFS_1_CARD_CLKREF_CLK and it is possible that the former should be +modelled as a parent of the latter. The clock driver also has a +GCC_UFS_CARD_CLKREF_CLK clock which the firmware appears to enable on +the ADP. + +The usual lack of documentation for Qualcomm SoCs makes this a highly +annoying guessing game, but as the second controller works on the ADP +without either card reference clock enabled, only enable +GCC_UFS_REF_CLKREF_CLK for now. + +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Johan Hovold +Reviewed-by: Konrad Dybcio +Reviewed-by: Brian Masney +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221005143305.388-1-johan+linaro@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index 49ea8b5612fc..92cbe84de0e5 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -959,7 +959,7 @@ ufs_card_phy: phy@1da7000 { + ranges; + clock-names = "ref", + "ref_aux"; +- clocks = <&gcc GCC_UFS_1_CARD_CLKREF_CLK>, ++ clocks = <&gcc GCC_UFS_REF_CLKREF_CLK>, + <&gcc GCC_UFS_CARD_PHY_AUX_CLK>; + + resets = <&ufs_card_hc 0>; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sc8280xp-fix-usb-phy-pcs-registers.patch b/queue-6.0/arm64-dts-qcom-sc8280xp-fix-usb-phy-pcs-registers.patch new file mode 100644 index 00000000000..2f979bdd682 --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sc8280xp-fix-usb-phy-pcs-registers.patch @@ -0,0 +1,46 @@ +From 81331d86ba49d8592a0fe8693474b0a3d25bad18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Sep 2022 11:44:53 +0200 +Subject: arm64: dts: qcom: sc8280xp: fix USB PHY PCS registers + +From: Johan Hovold + +[ Upstream commit 8723c3f290c7b798c0cbd89998576e6b365bda3a ] + +With the current binding, the PCS register block (0x1400) needs to +include the PCS_USB registers (0x1700). + +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220919094454.1574-4-johan+linaro@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index 2b8eea373163..cf6d1063bb84 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -1181,7 +1181,7 @@ usb_0_qmpphy: phy-wrapper@88ec000 { + usb_0_ssphy: usb3-phy@88eb400 { + reg = <0 0x088eb400 0 0x100>, + <0 0x088eb600 0 0x3ec>, +- <0 0x088ec400 0 0x1f0>, ++ <0 0x088ec400 0 0x364>, + <0 0x088eba00 0 0x100>, + <0 0x088ebc00 0 0x3ec>, + <0 0x088ec200 0 0x18>; +@@ -1243,7 +1243,7 @@ usb_1_qmpphy: phy-wrapper@8904000 { + usb_1_ssphy: usb3-phy@8903400 { + reg = <0 0x08903400 0 0x100>, + <0 0x08903600 0 0x3ec>, +- <0 0x08904400 0 0x1f0>, ++ <0 0x08904400 0 0x364>, + <0 0x08903a00 0 0x100>, + <0 0x08903c00 0 0x3ec>, + <0 0x08904200 0 0x18>; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sc8280xp-fix-usb0-phy-pcs_misc-regist.patch b/queue-6.0/arm64-dts-qcom-sc8280xp-fix-usb0-phy-pcs_misc-regist.patch new file mode 100644 index 00000000000..f562cbc0f99 --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sc8280xp-fix-usb0-phy-pcs_misc-regist.patch @@ -0,0 +1,37 @@ +From bacb6ebbd43ab51e6af1c76707b2c354f2e9ec23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Sep 2022 11:44:51 +0200 +Subject: arm64: dts: qcom: sc8280xp: fix USB0 PHY PCS_MISC registers + +From: Johan Hovold + +[ Upstream commit 31b3b3059791be536e2ec0c6830767b596af340f ] + +The USB0 SS PHY node had the PCS_MISC register block (0x1200) replaced +with PCS_USB (0x1700). + +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220919094454.1574-2-johan+linaro@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index cdc395d53c5a..e3e192877a88 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -1184,7 +1184,7 @@ usb_0_ssphy: usb3-phy@88eb400 { + <0 0x088ec400 0 0x1f0>, + <0 0x088eba00 0 0x100>, + <0 0x088ebc00 0 0x3ec>, +- <0 0x088ec700 0 0x64>; ++ <0 0x088ec200 0 0x18>; + #phy-cells = <0>; + #clock-cells = <0>; + clocks = <&gcc GCC_USB3_PRIM_PHY_PIPE_CLK>; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sc8280xp-fix-usb1-phy-rx1-registers.patch b/queue-6.0/arm64-dts-qcom-sc8280xp-fix-usb1-phy-rx1-registers.patch new file mode 100644 index 00000000000..bc0a78e0383 --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sc8280xp-fix-usb1-phy-rx1-registers.patch @@ -0,0 +1,37 @@ +From a2258b3acf0c9cdbacf07c51a20b9ee8e3bfc18d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Sep 2022 11:44:52 +0200 +Subject: arm64: dts: qcom: sc8280xp: fix USB1 PHY RX1 registers + +From: Johan Hovold + +[ Upstream commit 81cad26c6c3984d01b0612069c70ffd820f62dfa ] + +The USB1 SS PHY node had the RX1 register block (0x600) replaced with +RX2 (0xc00). + +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220919094454.1574-3-johan+linaro@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index e3e192877a88..2b8eea373163 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -1242,7 +1242,7 @@ usb_1_qmpphy: phy-wrapper@8904000 { + + usb_1_ssphy: usb3-phy@8903400 { + reg = <0 0x08903400 0 0x100>, +- <0 0x08903c00 0 0x3ec>, ++ <0 0x08903600 0 0x3ec>, + <0 0x08904400 0 0x1f0>, + <0 0x08903a00 0 0x100>, + <0 0x08903c00 0 0x3ec>, +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sm8150-xperia-kumano-specify-which-ld.patch b/queue-6.0/arm64-dts-qcom-sm8150-xperia-kumano-specify-which-ld.patch new file mode 100644 index 00000000000..a347e7f7650 --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sm8150-xperia-kumano-specify-which-ld.patch @@ -0,0 +1,62 @@ +From 1d90e0ea4e97b8f64b3432c7511352b551822362 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 09:49:50 -0700 +Subject: arm64: dts: qcom: sm8150-xperia-kumano: Specify which LDO modes are + allowed + +From: Douglas Anderson + +[ Upstream commit aa30e786202e4ed1df980442d305658441f65859 ] + +This board uses RPMH, specifies "regulator-allow-set-load" for LDOs, +but doesn't specify any modes with "regulator-allowed-modes". + +Prior to commit efb0cb50c427 ("regulator: qcom-rpmh: Implement +get_optimum_mode(), not set_load()") the above meant that we were able +to set either LPM or HPM mode. After that commit (and fixes [1]) we'll +be stuck at the initial mode. Discussion of this has resulted in the +decision that the old dts files were wrong and should be fixed to +fully restore old functionality. + +Let's re-enable the old functionality by fixing the dts. + +[1] https://lore.kernel.org/r/20220824142229.RFT.v2.2.I6f77860e5cd98bf5c67208fa9edda4a08847c304@changeid + +Fixes: d0a6ce59ea4e ("arm64: dts: qcom: sm8150: Add support for SONY Xperia 1 / 5 (Kumano platform)") +Signed-off-by: Douglas Anderson +Reviewed-by: Andrew Halaney +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220829094903.v2.4.I51d60414a42ba9e3008e208d60a04c9ffc425fa7@changeid +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi +index 014fe3a31548..fb6e5a140c9f 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi +@@ -348,6 +348,9 @@ vreg_l6c_2p9: ldo6 { + regulator-max-microvolt = <2960000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l7c_3p0: ldo7 { +@@ -367,6 +370,9 @@ vreg_l9c_2p9: ldo9 { + regulator-max-microvolt = <2960000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l10c_3p3: ldo10 { +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sm8250-disable-the-not-yet-supported-.patch b/queue-6.0/arm64-dts-qcom-sm8250-disable-the-not-yet-supported-.patch new file mode 100644 index 00000000000..8f81ede2cfb --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sm8250-disable-the-not-yet-supported-.patch @@ -0,0 +1,50 @@ +From 96ffcc0fca5586fb96bcb114729c4e941ca03923 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 13:57:45 +0200 +Subject: arm64: dts: qcom: sm8250: Disable the not yet supported cluster idle + state + +From: Ulf Hansson + +[ Upstream commit cadaa773bcf161184fa428180516bae33a7bc667 ] + +To support the deeper cluster idle state for sm8250 platforms, some +additional synchronization is needed between the rpmh-rsc device and the +CPU cluster PM domain. Until that is supported, let's disable the cluster +idle state. + +This fixes a problem that has been reported for the Qcom RB5 platform (see +below), but most likely other sm8250 platforms suffers from similar issues, +so let's make the fix generic for sm8250. + +vreg_l11c_3p3: failed to enable: -ETIMEDOUT +qcom-rpmh-regulator 18200000.rsc:pm8150l-rpmh-regulators: ldo11: devm_regulator_register() failed, ret=-110 +qcom-rpmh-regulator: probe of 18200000.rsc:pm8150l-rpmh-regulators failed with error -110 + +Reported-by: Amit Pundir +Fixes: 32bc936d7321 ("arm64: dts: qcom: sm8250: Add cpuidle states") +Signed-off-by: Ulf Hansson +Tested-by: Amit Pundir +Reviewed-by: Sudeep Holla +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221027115745.240516-1-ulf.hansson@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index bc773e210023..052b4dbc1ee4 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -334,6 +334,7 @@ CLUSTER_SLEEP_0: cluster-sleep-0 { + exit-latency-us = <6562>; + min-residency-us = <9987>; + local-timer-stop; ++ status = "disabled"; + }; + }; + }; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sm8250-xperia-edo-specify-which-ldo-m.patch b/queue-6.0/arm64-dts-qcom-sm8250-xperia-edo-specify-which-ldo-m.patch new file mode 100644 index 00000000000..f6626cefb27 --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sm8250-xperia-edo-specify-which-ldo-m.patch @@ -0,0 +1,62 @@ +From be746d4f83de0bb2a237f5c9f061069c16dd11c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 09:49:51 -0700 +Subject: arm64: dts: qcom: sm8250-xperia-edo: Specify which LDO modes are + allowed + +From: Douglas Anderson + +[ Upstream commit b7870d460c05ce31e2311036d91de1e2e0b32cea ] + +This board uses RPMH, specifies "regulator-allow-set-load" for LDOs, +but doesn't specify any modes with "regulator-allowed-modes". + +Prior to commit efb0cb50c427 ("regulator: qcom-rpmh: Implement +get_optimum_mode(), not set_load()") the above meant that we were able +to set either LPM or HPM mode. After that commit (and fixes [1]) we'll +be stuck at the initial mode. Discussion of this has resulted in the +decision that the old dts files were wrong and should be fixed to +fully restore old functionality. + +Let's re-enable the old functionality by fixing the dts. + +[1] https://lore.kernel.org/r/20220824142229.RFT.v2.2.I6f77860e5cd98bf5c67208fa9edda4a08847c304@changeid + +Fixes: 69cdb97ef652 ("arm64: dts: qcom: sm8250: Add support for SONY Xperia 1 II / 5 II (Edo platform)") +Signed-off-by: Douglas Anderson +Reviewed-by: Andrew Halaney +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220829094903.v2.5.Ie446d5183d8b1e9ec4e32228ca300e604e3315eb@changeid +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi +index 549e0a2aa9fe..5428aab3058d 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi +@@ -317,6 +317,9 @@ vreg_l6c_2p9: ldo6 { + regulator-max-microvolt = <2960000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l7c_2p85: ldo7 { +@@ -339,6 +342,9 @@ vreg_l9c_2p9: ldo9 { + regulator-max-microvolt = <2960000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l10c_3p3: ldo10 { +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-qcom-sm8350-hdk-specify-which-ldo-modes-ar.patch b/queue-6.0/arm64-dts-qcom-sm8350-hdk-specify-which-ldo-modes-ar.patch new file mode 100644 index 00000000000..78cec62aa9c --- /dev/null +++ b/queue-6.0/arm64-dts-qcom-sm8350-hdk-specify-which-ldo-modes-ar.patch @@ -0,0 +1,82 @@ +From 3b62ffade119c6ef078e23f1538e723782df5e8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 09:49:52 -0700 +Subject: arm64: dts: qcom: sm8350-hdk: Specify which LDO modes are allowed + +From: Douglas Anderson + +[ Upstream commit 1ce8aaf6abdc35cde555924418b3d4516b4ec871 ] + +This board uses RPMH, specifies "regulator-allow-set-load" for LDOs, +but doesn't specify any modes with "regulator-allowed-modes". + +Prior to commit efb0cb50c427 ("regulator: qcom-rpmh: Implement +get_optimum_mode(), not set_load()") the above meant that we were able +to set either LPM or HPM mode. After that commit (and fixes [1]) we'll +be stuck at the initial mode. Discussion of this has resulted in the +decision that the old dts files were wrong and should be fixed to +fully restore old functionality. + +Let's re-enable the old functionality by fixing the dts. + +[1] https://lore.kernel.org/r/20220824142229.RFT.v2.2.I6f77860e5cd98bf5c67208fa9edda4a08847c304@changeid + +Fixes: 9208c19f2124 ("arm64: dts: qcom: Introduce SM8350 HDK") +Signed-off-by: Douglas Anderson +Reviewed-by: Andrew Halaney +Reviewed-by: Vinod Koul +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220829094903.v2.6.I6799be85cf36d3b494f803cba767a569080624f5@changeid +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8350-hdk.dts | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350-hdk.dts b/arch/arm64/boot/dts/qcom/sm8350-hdk.dts +index 0fcf5bd88fc7..69ae6503c2f6 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350-hdk.dts ++++ b/arch/arm64/boot/dts/qcom/sm8350-hdk.dts +@@ -107,6 +107,9 @@ vreg_l5b_0p88: ldo5 { + regulator-max-microvolt = <888000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l6b_1p2: ldo6 { +@@ -115,6 +118,9 @@ vreg_l6b_1p2: ldo6 { + regulator-max-microvolt = <1208000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l7b_2p96: ldo7 { +@@ -123,6 +129,9 @@ vreg_l7b_2p96: ldo7 { + regulator-max-microvolt = <2504000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + + vreg_l9b_1p2: ldo9 { +@@ -131,6 +140,9 @@ vreg_l9b_1p2: ldo9 { + regulator-max-microvolt = <1200000>; + regulator-initial-mode = ; + regulator-allow-set-load; ++ regulator-allowed-modes = ++ ; + }; + }; + +-- +2.35.1 + diff --git a/queue-6.0/arm64-fix-bit-shifting-ub-in-the-midr_cpu_model-macr.patch b/queue-6.0/arm64-fix-bit-shifting-ub-in-the-midr_cpu_model-macr.patch new file mode 100644 index 00000000000..59aec971887 --- /dev/null +++ b/queue-6.0/arm64-fix-bit-shifting-ub-in-the-midr_cpu_model-macr.patch @@ -0,0 +1,50 @@ +From 0f7d76518a7db6629c9a508288902af5699b169a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 09:01:06 -0700 +Subject: arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro + +From: D Scott Phillips + +[ Upstream commit 8ec8490a1950efeccb00967698cf7cb2fcd25ca7 ] + +CONFIG_UBSAN_SHIFT with gcc-5 complains that the shifting of +ARM_CPU_IMP_AMPERE (0xC0) into bits [31:24] by MIDR_CPU_MODEL() is +undefined behavior. Well, sort of, it actually spells the error as: + + arch/arm64/kernel/proton-pack.c: In function 'spectre_bhb_loop_affected': + arch/arm64/include/asm/cputype.h:44:2: error: initializer element is not constant + (((imp) << MIDR_IMPLEMENTOR_SHIFT) | \ + ^ + +This isn't an issue for other Implementor codes, as all the other codes +have zero in the top bit and so are representable as a signed int. + +Cast the implementor code to unsigned in MIDR_CPU_MODEL to remove the +undefined behavior. + +Fixes: 0e5d5ae837c8 ("arm64: Add AMPERE1 to the Spectre-BHB affected list") +Reported-by: Geert Uytterhoeven +Signed-off-by: D Scott Phillips +Link: https://lore.kernel.org/r/20221102160106.1096948-1-scott@os.amperecomputing.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/cputype.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index abc418650fec..65e53ef5a396 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -41,7 +41,7 @@ + (((midr) & MIDR_IMPLEMENTOR_MASK) >> MIDR_IMPLEMENTOR_SHIFT) + + #define MIDR_CPU_MODEL(imp, partnum) \ +- (((imp) << MIDR_IMPLEMENTOR_SHIFT) | \ ++ ((_AT(u32, imp) << MIDR_IMPLEMENTOR_SHIFT) | \ + (0xf << MIDR_ARCHITECTURE_SHIFT) | \ + ((partnum) << MIDR_PARTNUM_SHIFT)) + +-- +2.35.1 + diff --git a/queue-6.0/asoc-core-fix-use-after-free-in-snd_soc_exit.patch b/queue-6.0/asoc-core-fix-use-after-free-in-snd_soc_exit.patch new file mode 100644 index 00000000000..5631e9bc921 --- /dev/null +++ b/queue-6.0/asoc-core-fix-use-after-free-in-snd_soc_exit.patch @@ -0,0 +1,89 @@ +From 701ce85a422cd8a8606b5a511ae7a77e8d3e9988 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 11:16:03 +0800 +Subject: ASoC: core: Fix use-after-free in snd_soc_exit() + +From: Chen Zhongjin + +[ Upstream commit 6ec27c53886c8963729885bcf2dd996eba2767a7 ] + +KASAN reports a use-after-free: + +BUG: KASAN: use-after-free in device_del+0xb5b/0xc60 +Read of size 8 at addr ffff888008655050 by task rmmod/387 +CPU: 2 PID: 387 Comm: rmmod +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) +Call Trace: + +dump_stack_lvl+0x79/0x9a +print_report+0x17f/0x47b +kasan_report+0xbb/0xf0 +device_del+0xb5b/0xc60 +platform_device_del.part.0+0x24/0x200 +platform_device_unregister+0x2e/0x40 +snd_soc_exit+0xa/0x22 [snd_soc_core] +__do_sys_delete_module.constprop.0+0x34f/0x5b0 +do_syscall_64+0x3a/0x90 +entry_SYSCALL_64_after_hwframe+0x63/0xcd +... + + +It's bacause in snd_soc_init(), snd_soc_util_init() is possble to fail, +but its ret is ignored, which makes soc_dummy_dev unregistered twice. + +snd_soc_init() + snd_soc_util_init() + platform_device_register_simple(soc_dummy_dev) + platform_driver_register() # fail + platform_device_unregister(soc_dummy_dev) + platform_driver_register() # success +... +snd_soc_exit() + snd_soc_util_exit() + # soc_dummy_dev will be unregistered for second time + +To fix it, handle error and stop snd_soc_init() when util_init() fail. +Also clean debugfs when util_init() or driver_register() fail. + +Fixes: fb257897bf20 ("ASoC: Work around allmodconfig failure") +Signed-off-by: Chen Zhongjin +Link: https://lore.kernel.org/r/20221028031603.59416-1-chenzhongjin@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-core.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index e824ff1a9fc0..3d057784cbd5 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -3472,10 +3472,23 @@ EXPORT_SYMBOL_GPL(snd_soc_of_get_dai_link_cpus); + + static int __init snd_soc_init(void) + { ++ int ret; ++ + snd_soc_debugfs_init(); +- snd_soc_util_init(); ++ ret = snd_soc_util_init(); ++ if (ret) ++ goto err_util_init; + +- return platform_driver_register(&soc_driver); ++ ret = platform_driver_register(&soc_driver); ++ if (ret) ++ goto err_register; ++ return 0; ++ ++err_register: ++ snd_soc_util_exit(); ++err_util_init: ++ snd_soc_debugfs_exit(); ++ return ret; + } + module_init(snd_soc_init); + +-- +2.35.1 + diff --git a/queue-6.0/asoc-fsl_asrc-fsl_esai-fsl_sai-allow-config_pm-n.patch b/queue-6.0/asoc-fsl_asrc-fsl_esai-fsl_sai-allow-config_pm-n.patch new file mode 100644 index 00000000000..fc7114e92e0 --- /dev/null +++ b/queue-6.0/asoc-fsl_asrc-fsl_esai-fsl_sai-allow-config_pm-n.patch @@ -0,0 +1,74 @@ +From a7ed1133758142ee44c3e2ffd3debec5b3af7359 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 16:11:28 +0200 +Subject: ASoC: fsl_asrc fsl_esai fsl_sai: allow CONFIG_PM=N + +From: Maarten Zanders + +[ Upstream commit 6a564338a23cefcfc29c4a535b98402d13efdda6 ] + +When CONFIG_PM=N, pm_runtime_put_sync() returns -ENOSYS +which breaks the probe function of these drivers. + +Other users of pm_runtime_put_sync() typically don't check +the return value. In order to keep the program flow as +intended, check for -ENOSYS. + +This commit is similar to commit 0434d3f (omap-mailbox.c). + +Fixes: cab04ab5900f ("ASoC: fsl_asrc: Don't use devm_regmap_init_mmio_clk") +Fixes: 203773e39347 ("ASoC: fsl_esai: Don't use devm_regmap_init_mmio_clk") +Fixes: 2277e7e36b4b ("ASoC: fsl_sai: Don't use devm_regmap_init_mmio_clk") +Signed-off-by: Maarten Zanders +Reviewed-by: Daniel Baluta +Link: https://lore.kernel.org/r/20221028141129.100702-1-maarten.zanders@mind.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_asrc.c | 2 +- + sound/soc/fsl/fsl_esai.c | 2 +- + sound/soc/fsl/fsl_sai.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/fsl/fsl_asrc.c b/sound/soc/fsl/fsl_asrc.c +index aa5edf32d988..d90adb6ee43d 100644 +--- a/sound/soc/fsl/fsl_asrc.c ++++ b/sound/soc/fsl/fsl_asrc.c +@@ -1224,7 +1224,7 @@ static int fsl_asrc_probe(struct platform_device *pdev) + } + + ret = pm_runtime_put_sync(&pdev->dev); +- if (ret < 0) ++ if (ret < 0 && ret != -ENOSYS) + goto err_pm_get_sync; + + ret = devm_snd_soc_register_component(&pdev->dev, &fsl_asrc_component, +diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c +index 5c21fc490fce..17fefd27ec90 100644 +--- a/sound/soc/fsl/fsl_esai.c ++++ b/sound/soc/fsl/fsl_esai.c +@@ -1069,7 +1069,7 @@ static int fsl_esai_probe(struct platform_device *pdev) + regmap_write(esai_priv->regmap, REG_ESAI_RSMB, 0); + + ret = pm_runtime_put_sync(&pdev->dev); +- if (ret < 0) ++ if (ret < 0 && ret != -ENOSYS) + goto err_pm_get_sync; + + /* +diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c +index d430eece1d6b..887063f9cbea 100644 +--- a/sound/soc/fsl/fsl_sai.c ++++ b/sound/soc/fsl/fsl_sai.c +@@ -1415,7 +1415,7 @@ static int fsl_sai_probe(struct platform_device *pdev) + } + + ret = pm_runtime_put_sync(dev); +- if (ret < 0) ++ if (ret < 0 && ret != -ENOSYS) + goto err_pm_get_sync; + + /* +-- +2.35.1 + diff --git a/queue-6.0/asoc-rt5514-fix-legacy-dai-naming.patch b/queue-6.0/asoc-rt5514-fix-legacy-dai-naming.patch new file mode 100644 index 00000000000..77f3c1e61a9 --- /dev/null +++ b/queue-6.0/asoc-rt5514-fix-legacy-dai-naming.patch @@ -0,0 +1,57 @@ +From 49ded87c27a777ad882d066dc8d42e7b7efb8731 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 10:46:11 -0400 +Subject: ASoC: rt5514: fix legacy dai naming + +From: Jason Montleon + +[ Upstream commit 392cc13c5ec72ccd6bbfb1bc2339502cc59dd285 ] + +Starting with 6.0-rc1 these messages are logged and the sound card +is unavailable. Adding legacy_dai_naming to the rt5514-spi causes +it to function properly again. + +[ 16.928454] kbl_r5514_5663_max kbl_r5514_5663_max: ASoC: CPU DAI +spi-PRP0001:00 not registered +[ 16.928561] platform kbl_r5514_5663_max: deferred probe pending + +Fixes: fc34ece41f71 ("ASoC: Refactor non_legacy_dai_naming flag") +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216641 +Signed-off-by: Jason Montleon +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20221103144612.4431-1-jmontleo@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5514-spi.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/codecs/rt5514-spi.c b/sound/soc/codecs/rt5514-spi.c +index 1a25a3787935..362663abcb89 100644 +--- a/sound/soc/codecs/rt5514-spi.c ++++ b/sound/soc/codecs/rt5514-spi.c +@@ -298,13 +298,14 @@ static int rt5514_spi_pcm_new(struct snd_soc_component *component, + } + + static const struct snd_soc_component_driver rt5514_spi_component = { +- .name = DRV_NAME, +- .probe = rt5514_spi_pcm_probe, +- .open = rt5514_spi_pcm_open, +- .hw_params = rt5514_spi_hw_params, +- .hw_free = rt5514_spi_hw_free, +- .pointer = rt5514_spi_pcm_pointer, +- .pcm_construct = rt5514_spi_pcm_new, ++ .name = DRV_NAME, ++ .probe = rt5514_spi_pcm_probe, ++ .open = rt5514_spi_pcm_open, ++ .hw_params = rt5514_spi_hw_params, ++ .hw_free = rt5514_spi_hw_free, ++ .pointer = rt5514_spi_pcm_pointer, ++ .pcm_construct = rt5514_spi_pcm_new, ++ .legacy_dai_naming = 1, + }; + + /** +-- +2.35.1 + diff --git a/queue-6.0/asoc-rt5677-fix-legacy-dai-naming.patch b/queue-6.0/asoc-rt5677-fix-legacy-dai-naming.patch new file mode 100644 index 00000000000..5e176b4ca9c --- /dev/null +++ b/queue-6.0/asoc-rt5677-fix-legacy-dai-naming.patch @@ -0,0 +1,56 @@ +From 05557a9c62afdcd33fa9bfb8ea31135f6a65d40a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 10:46:12 -0400 +Subject: ASoC: rt5677: fix legacy dai naming + +From: Jason Montleon + +[ Upstream commit a1dca8774faf3f77eb34fa0ac6f3e2b82290b1e4 ] + +Starting with 6.0-rc1 the CPU DAI is not registered and the sound +card is unavailable. Adding legacy_dai_naming causes it to function +properly again. + +Fixes: fc34ece41f71 ("ASoC: Refactor non_legacy_dai_naming flag") +Signed-off-by: Jason Montleon +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20221103144612.4431-2-jmontleo@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5677-spi.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/sound/soc/codecs/rt5677-spi.c b/sound/soc/codecs/rt5677-spi.c +index 8f3993a4c1cc..d25703dd7499 100644 +--- a/sound/soc/codecs/rt5677-spi.c ++++ b/sound/soc/codecs/rt5677-spi.c +@@ -396,15 +396,16 @@ static int rt5677_spi_pcm_probe(struct snd_soc_component *component) + } + + static const struct snd_soc_component_driver rt5677_spi_dai_component = { +- .name = DRV_NAME, +- .probe = rt5677_spi_pcm_probe, +- .open = rt5677_spi_pcm_open, +- .close = rt5677_spi_pcm_close, +- .hw_params = rt5677_spi_hw_params, +- .hw_free = rt5677_spi_hw_free, +- .prepare = rt5677_spi_prepare, +- .pointer = rt5677_spi_pcm_pointer, +- .pcm_construct = rt5677_spi_pcm_new, ++ .name = DRV_NAME, ++ .probe = rt5677_spi_pcm_probe, ++ .open = rt5677_spi_pcm_open, ++ .close = rt5677_spi_pcm_close, ++ .hw_params = rt5677_spi_hw_params, ++ .hw_free = rt5677_spi_hw_free, ++ .prepare = rt5677_spi_prepare, ++ .pointer = rt5677_spi_pcm_pointer, ++ .pcm_construct = rt5677_spi_pcm_new, ++ .legacy_dai_naming = 1, + }; + + /* Select a suitable transfer command for the next transfer to ensure +-- +2.35.1 + diff --git a/queue-6.0/asoc-soc-utils-remove-__exit-for-snd_soc_util_exit.patch b/queue-6.0/asoc-soc-utils-remove-__exit-for-snd_soc_util_exit.patch new file mode 100644 index 00000000000..89678ddea47 --- /dev/null +++ b/queue-6.0/asoc-soc-utils-remove-__exit-for-snd_soc_util_exit.patch @@ -0,0 +1,39 @@ +From e7d9e839a2c9f49e84c552e684b1076fbb0f85de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Oct 2022 21:40:31 +0800 +Subject: ASoC: soc-utils: Remove __exit for snd_soc_util_exit() + +From: Chen Zhongjin + +[ Upstream commit 314d34fe7f0a5836cb0472950c1f17744b4efde8 ] + +snd_soc_util_exit() is called in __init snd_soc_init() for cleanup. +Remove the __exit annotation for it to fix the build warning: + +WARNING: modpost: sound/soc/snd-soc-core.o: section mismatch in reference: init_module (section: .init.text) -> snd_soc_util_exit (section: .exit.text) + +Fixes: 6ec27c53886c ("ASoC: core: Fix use-after-free in snd_soc_exit()") +Signed-off-by: Chen Zhongjin +Link: https://lore.kernel.org/r/20221031134031.256511-1-chenzhongjin@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-utils.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-utils.c b/sound/soc/soc-utils.c +index 70c380c0ac7b..d1308904e6e0 100644 +--- a/sound/soc/soc-utils.c ++++ b/sound/soc/soc-utils.c +@@ -263,7 +263,7 @@ int __init snd_soc_util_init(void) + return ret; + } + +-void __exit snd_soc_util_exit(void) ++void snd_soc_util_exit(void) + { + platform_driver_unregister(&soc_dummy_driver); + platform_device_unregister(soc_dummy_dev); +-- +2.35.1 + diff --git a/queue-6.0/asoc-tas2764-fix-set_tdm_slot-in-case-of-single-slot.patch b/queue-6.0/asoc-tas2764-fix-set_tdm_slot-in-case-of-single-slot.patch new file mode 100644 index 00000000000..486b085bfe8 --- /dev/null +++ b/queue-6.0/asoc-tas2764-fix-set_tdm_slot-in-case-of-single-slot.patch @@ -0,0 +1,68 @@ +From 9fd11bb1e0b40ba84ebcdbc7c482755cee0ec34a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 11:57:59 +0200 +Subject: ASoC: tas2764: Fix set_tdm_slot in case of single slot +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Povišer + +[ Upstream commit faac764ea1ea6898d93e46c403271fb105c0906e ] + +There's a special branch in the set_tdm_slot op for the case of nslots +being 1, but: + + (1) That branch can never work (there's a check for tx_mask being + non-zero, later there's another check for it *being* zero; one or + the other always throws -EINVAL). + + (2) The intention of the branch seems to be what the general other + branch reduces to in case of nslots being 1. + +For those reasons remove the 'nslots being 1' special case. + +Fixes: 827ed8a0fa50 ("ASoC: tas2764: Add the driver for the TAS2764") +Suggested-by: Jos Dehaes +Signed-off-by: Martin Povišer +Link: https://lore.kernel.org/r/20221027095800.16094-2-povik+lin@cutebit.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2764.c | 19 ++++++------------- + 1 file changed, 6 insertions(+), 13 deletions(-) + +diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c +index 39902f77a2e0..6c87c3cf5ef7 100644 +--- a/sound/soc/codecs/tas2764.c ++++ b/sound/soc/codecs/tas2764.c +@@ -386,20 +386,13 @@ static int tas2764_set_dai_tdm_slot(struct snd_soc_dai *dai, + if (tx_mask == 0 || rx_mask != 0) + return -EINVAL; + +- if (slots == 1) { +- if (tx_mask != 1) +- return -EINVAL; +- left_slot = 0; +- right_slot = 0; ++ left_slot = __ffs(tx_mask); ++ tx_mask &= ~(1 << left_slot); ++ if (tx_mask == 0) { ++ right_slot = left_slot; + } else { +- left_slot = __ffs(tx_mask); +- tx_mask &= ~(1 << left_slot); +- if (tx_mask == 0) { +- right_slot = left_slot; +- } else { +- right_slot = __ffs(tx_mask); +- tx_mask &= ~(1 << right_slot); +- } ++ right_slot = __ffs(tx_mask); ++ tx_mask &= ~(1 << right_slot); + } + + if (tx_mask != 0 || left_slot >= slots || right_slot >= slots) +-- +2.35.1 + diff --git a/queue-6.0/asoc-tas2770-fix-set_tdm_slot-in-case-of-single-slot.patch b/queue-6.0/asoc-tas2770-fix-set_tdm_slot-in-case-of-single-slot.patch new file mode 100644 index 00000000000..1e4ff6c02ee --- /dev/null +++ b/queue-6.0/asoc-tas2770-fix-set_tdm_slot-in-case-of-single-slot.patch @@ -0,0 +1,69 @@ +From d6d3b534a98b90af5e893d51e57813690cb09611 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 11:57:58 +0200 +Subject: ASoC: tas2770: Fix set_tdm_slot in case of single slot +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Povišer + +[ Upstream commit e59bf547a7dd366f93bfebb7487959580ca6c0ec ] + +There's a special branch in the set_tdm_slot op for the case of nslots +being 1, but: + + (1) That branch can never work (there's a check for tx_mask being + non-zero, later there's another check for it *being* zero; one or + the other always throws -EINVAL). + + (2) The intention of the branch seems to be what the general other + branch reduces to in case of nslots being 1. + +For those reasons remove the 'nslots being 1' special case. + +Fixes: 1a476abc723e ("tas2770: add tas2770 smart PA kernel driver") +Suggested-by: Jos Dehaes +Signed-off-by: Martin Povišer +Link: https://lore.kernel.org/r/20221027095800.16094-1-povik+lin@cutebit.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2770.c | 20 ++++++-------------- + 1 file changed, 6 insertions(+), 14 deletions(-) + +diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c +index b6765235a4b3..8557759acb1f 100644 +--- a/sound/soc/codecs/tas2770.c ++++ b/sound/soc/codecs/tas2770.c +@@ -395,21 +395,13 @@ static int tas2770_set_dai_tdm_slot(struct snd_soc_dai *dai, + if (tx_mask == 0 || rx_mask != 0) + return -EINVAL; + +- if (slots == 1) { +- if (tx_mask != 1) +- return -EINVAL; +- +- left_slot = 0; +- right_slot = 0; ++ left_slot = __ffs(tx_mask); ++ tx_mask &= ~(1 << left_slot); ++ if (tx_mask == 0) { ++ right_slot = left_slot; + } else { +- left_slot = __ffs(tx_mask); +- tx_mask &= ~(1 << left_slot); +- if (tx_mask == 0) { +- right_slot = left_slot; +- } else { +- right_slot = __ffs(tx_mask); +- tx_mask &= ~(1 << right_slot); +- } ++ right_slot = __ffs(tx_mask); ++ tx_mask &= ~(1 << right_slot); + } + + if (tx_mask != 0 || left_slot >= slots || right_slot >= slots) +-- +2.35.1 + diff --git a/queue-6.0/asoc-tas2780-fix-set_tdm_slot-in-case-of-single-slot.patch b/queue-6.0/asoc-tas2780-fix-set_tdm_slot-in-case-of-single-slot.patch new file mode 100644 index 00000000000..55ea8d9c4dd --- /dev/null +++ b/queue-6.0/asoc-tas2780-fix-set_tdm_slot-in-case-of-single-slot.patch @@ -0,0 +1,68 @@ +From 1bf9c515f46d247ec46c58d7645038b3e0e021f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 11:58:00 +0200 +Subject: ASoC: tas2780: Fix set_tdm_slot in case of single slot +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Povišer + +[ Upstream commit 6f934afa6a980bb8d3ce73836b1a9922685e50d7 ] + +There's a special branch in the set_tdm_slot op for the case of nslots +being 1, but: + + (1) That branch can never work (there's a check for tx_mask being + non-zero, later there's another check for it *being* zero; one or + the other always throws -EINVAL). + + (2) The intention of the branch seems to be what the general other + branch reduces to in case of nslots being 1. + +For those reasons remove the 'nslots being 1' special case. + +Fixes: eae9f9ce181b ("ASoC: add tas2780 driver") +Suggested-by: Jos Dehaes +Signed-off-by: Martin Povišer +Link: https://lore.kernel.org/r/20221027095800.16094-3-povik+lin@cutebit.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2780.c | 19 ++++++------------- + 1 file changed, 6 insertions(+), 13 deletions(-) + +diff --git a/sound/soc/codecs/tas2780.c b/sound/soc/codecs/tas2780.c +index a6db6f0e5431..afdf0c863aa1 100644 +--- a/sound/soc/codecs/tas2780.c ++++ b/sound/soc/codecs/tas2780.c +@@ -380,20 +380,13 @@ static int tas2780_set_dai_tdm_slot(struct snd_soc_dai *dai, + if (tx_mask == 0 || rx_mask != 0) + return -EINVAL; + +- if (slots == 1) { +- if (tx_mask != 1) +- return -EINVAL; +- left_slot = 0; +- right_slot = 0; ++ left_slot = __ffs(tx_mask); ++ tx_mask &= ~(1 << left_slot); ++ if (tx_mask == 0) { ++ right_slot = left_slot; + } else { +- left_slot = __ffs(tx_mask); +- tx_mask &= ~(1 << left_slot); +- if (tx_mask == 0) { +- right_slot = left_slot; +- } else { +- right_slot = __ffs(tx_mask); +- tx_mask &= ~(1 << right_slot); +- } ++ right_slot = __ffs(tx_mask); ++ tx_mask &= ~(1 << right_slot); + } + + if (tx_mask != 0 || left_slot >= slots || right_slot >= slots) +-- +2.35.1 + diff --git a/queue-6.0/ata-libata-core-do-not-issue-non-internal-commands-o.patch b/queue-6.0/ata-libata-core-do-not-issue-non-internal-commands-o.patch new file mode 100644 index 00000000000..14a9fd458d5 --- /dev/null +++ b/queue-6.0/ata-libata-core-do-not-issue-non-internal-commands-o.patch @@ -0,0 +1,87 @@ +From 2fb66d298304759813799d2bac678e29a3211a54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 00:15:34 +0100 +Subject: ata: libata-core: do not issue non-internal commands once EH is + pending + +From: Niklas Cassel + +[ Upstream commit e20e81a24a4d58744a29715aac2f795cd1651955 ] + +While the ATA specification states that a device should return command +aborted for all commands queued after the device has entered error state, +since ATA only keeps the sense data for the latest command (in non-NCQ +case), we really don't want to send block layer commands to the device +after it has entered error state. (Only ATA EH commands should be sent, +to read the sense data etc.) + +Currently, scsi_queue_rq() will check if scsi_host_in_recovery() +(state is SHOST_RECOVERY), and if so, it will _not_ issue a command via: +scsi_dispatch_cmd() -> host->hostt->queuecommand() (ata_scsi_queuecmd()) +-> __ata_scsi_queuecmd() -> ata_scsi_translate() -> ata_qc_issue() + +Before commit e494f6a72839 ("[SCSI] improved eh timeout handler"), +when receiving a TFES error IRQ, the call chain looked like this: +ahci_error_intr() -> ata_port_abort() -> ata_do_link_abort() -> +ata_qc_complete() -> ata_qc_schedule_eh() -> blk_abort_request() -> +blk_rq_timed_out() -> q->rq_timed_out_fn() (scsi_times_out()) -> +scsi_eh_scmd_add() -> scsi_host_set_state(shost, SHOST_RECOVERY) + +Which meant that as soon as an error IRQ was serviced, SHOST_RECOVERY +would be set. + +However, after commit e494f6a72839 ("[SCSI] improved eh timeout handler"), +scsi_times_out() will instead call scsi_abort_command() which will queue +delayed work, and the worker function scmd_eh_abort_handler() will call +scsi_eh_scmd_add(), which calls scsi_host_set_state(shost, SHOST_RECOVERY). + +So now, after the TFES error IRQ has been serviced, we need to wait for +the SCSI workqueue to run its work before SHOST_RECOVERY gets set. + +It is worth noting that, even before commit e494f6a72839 ("[SCSI] improved +eh timeout handler"), we could receive an error IRQ from the time when +scsi_queue_rq() checks scsi_host_in_recovery(), to the time when +ata_scsi_queuecmd() is actually called. + +In order to handle both the delayed setting of SHOST_RECOVERY and the +window where we can receive an error IRQ, add a check against +ATA_PFLAG_EH_PENDING (which gets set when servicing the error IRQ), +inside ata_scsi_queuecmd() itself, while holding the ap->lock. +(Since the ap->lock is held while servicing IRQs.) + +Fixes: e494f6a72839 ("[SCSI] improved eh timeout handler") +Signed-off-by: Niklas Cassel +Tested-by: John Garry +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-scsi.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index b0e442a75690..d86e32b71efa 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -3966,9 +3966,19 @@ static inline ata_xlat_func_t ata_get_xlat_func(struct ata_device *dev, u8 cmd) + + int __ata_scsi_queuecmd(struct scsi_cmnd *scmd, struct ata_device *dev) + { ++ struct ata_port *ap = dev->link->ap; + u8 scsi_op = scmd->cmnd[0]; + ata_xlat_func_t xlat_func; + ++ /* ++ * scsi_queue_rq() will defer commands if scsi_host_in_recovery(). ++ * However, this check is done without holding the ap->lock (a libata ++ * specific lock), so we can have received an error irq since then, ++ * therefore we must check if EH is pending, while holding ap->lock. ++ */ ++ if (ap->pflags & (ATA_PFLAG_EH_PENDING | ATA_PFLAG_EH_IN_PROGRESS)) ++ return SCSI_MLQUEUE_DEVICE_BUSY; ++ + if (unlikely(!scmd->cmd_len)) + goto bad_cdb_len; + +-- +2.35.1 + diff --git a/queue-6.0/ata-libata-transport-fix-double-ata_host_put-in-ata_.patch b/queue-6.0/ata-libata-transport-fix-double-ata_host_put-in-ata_.patch new file mode 100644 index 00000000000..bb87b62a23d --- /dev/null +++ b/queue-6.0/ata-libata-transport-fix-double-ata_host_put-in-ata_.patch @@ -0,0 +1,66 @@ +From 35ecc9998cd347ad4f9c1323295f6fbd1d1e5cb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 21:40:01 +0800 +Subject: ata: libata-transport: fix double ata_host_put() in ata_tport_add() + +From: Yang Yingliang + +[ Upstream commit 8c76310740807ade5ecdab5888f70ecb6d35732e ] + +In the error path in ata_tport_add(), when calling put_device(), +ata_tport_release() is called, it will put the refcount of 'ap->host'. + +And then ata_host_put() is called again, the refcount is decreased +to 0, ata_host_release() is called, all ports are freed and set to +null. + +When unbinding the device after failure, ata_host_stop() is called +to release the resources, it leads a null-ptr-deref(), because all +the ports all freed and null. + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 +CPU: 7 PID: 18671 Comm: modprobe Kdump: loaded Tainted: G E 6.1.0-rc3+ #8 +pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : ata_host_stop+0x3c/0x84 [libata] +lr : release_nodes+0x64/0xd0 +Call trace: + ata_host_stop+0x3c/0x84 [libata] + release_nodes+0x64/0xd0 + devres_release_all+0xbc/0x1b0 + device_unbind_cleanup+0x20/0x70 + really_probe+0x158/0x320 + __driver_probe_device+0x84/0x120 + driver_probe_device+0x44/0x120 + __driver_attach+0xb4/0x220 + bus_for_each_dev+0x78/0xdc + driver_attach+0x2c/0x40 + bus_add_driver+0x184/0x240 + driver_register+0x80/0x13c + __pci_register_driver+0x4c/0x60 + ahci_pci_driver_init+0x30/0x1000 [ahci] + +Fix this by removing redundant ata_host_put() in the error path. + +Fixes: 2623c7a5f279 ("libata: add refcounting to ata_host") +Signed-off-by: Yang Yingliang +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-transport.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c +index a7e9a75410a3..105da3ec5eaa 100644 +--- a/drivers/ata/libata-transport.c ++++ b/drivers/ata/libata-transport.c +@@ -317,7 +317,6 @@ int ata_tport_add(struct device *parent, + tport_err: + transport_destroy_device(dev); + put_device(dev); +- ata_host_put(ap->host); + return error; + } + +-- +2.35.1 + diff --git a/queue-6.0/ata-libata-transport-fix-error-handling-in-ata_tdev_.patch b/queue-6.0/ata-libata-transport-fix-error-handling-in-ata_tdev_.patch new file mode 100644 index 00000000000..e84749ae1a3 --- /dev/null +++ b/queue-6.0/ata-libata-transport-fix-error-handling-in-ata_tdev_.patch @@ -0,0 +1,67 @@ +From b71b62dcec789108e32d6689cfdff947e9707b06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 21:40:04 +0800 +Subject: ata: libata-transport: fix error handling in ata_tdev_add() + +From: Yang Yingliang + +[ Upstream commit 1ff36351309e3eadcff297480baf4785e726de9b ] + +In ata_tdev_add(), the return value of transport_add_device() is +not checked. As a result, it causes null-ptr-deref while removing +the module, because transport_remove_device() is called to remove +the device that was not added. + +Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 +CPU: 13 PID: 13603 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc3+ #36 +pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : device_del+0x48/0x3a0 +lr : device_del+0x44/0x3a0 +Call trace: + device_del+0x48/0x3a0 + attribute_container_class_device_del+0x28/0x40 + transport_remove_classdev+0x60/0x7c + attribute_container_device_trigger+0x118/0x120 + transport_remove_device+0x20/0x30 + ata_tdev_delete+0x24/0x50 [libata] + ata_tlink_delete+0x40/0xa0 [libata] + ata_tport_delete+0x2c/0x60 [libata] + ata_port_detach+0x148/0x1b0 [libata] + ata_pci_remove_one+0x50/0x80 [libata] + ahci_remove_one+0x4c/0x8c [ahci] + +Fix this by checking and handling return value of transport_add_device() +in ata_tdev_add(). In the error path, device_del() is called to delete +the device which was added earlier in this function, and ata_tdev_free() +is called to free ata_dev. + +Fixes: d9027470b886 ("[libata] Add ATA transport class") +Signed-off-by: Yang Yingliang +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-transport.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c +index aac9336e8153..e4fb9d1b9b39 100644 +--- a/drivers/ata/libata-transport.c ++++ b/drivers/ata/libata-transport.c +@@ -713,7 +713,13 @@ static int ata_tdev_add(struct ata_device *ata_dev) + return error; + } + +- transport_add_device(dev); ++ error = transport_add_device(dev); ++ if (error) { ++ device_del(dev); ++ ata_tdev_free(ata_dev); ++ return error; ++ } ++ + transport_configure_device(dev); + return 0; + } +-- +2.35.1 + diff --git a/queue-6.0/ata-libata-transport-fix-error-handling-in-ata_tlink.patch b/queue-6.0/ata-libata-transport-fix-error-handling-in-ata_tlink.patch new file mode 100644 index 00000000000..02321891bff --- /dev/null +++ b/queue-6.0/ata-libata-transport-fix-error-handling-in-ata_tlink.patch @@ -0,0 +1,68 @@ +From 931ee766353bba3ae3649420b17b4a684b61e0b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 21:40:03 +0800 +Subject: ata: libata-transport: fix error handling in ata_tlink_add() + +From: Yang Yingliang + +[ Upstream commit cf0816f6322c5c37ee52655f928e91ecf32da103 ] + +In ata_tlink_add(), the return value of transport_add_device() is +not checked. As a result, it causes null-ptr-deref while removing +the module, because transport_remove_device() is called to remove +the device that was not added. + +Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 +CPU: 33 PID: 13850 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc3+ #12 +pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : device_del+0x48/0x39c +lr : device_del+0x44/0x39c +Call trace: + device_del+0x48/0x39c + attribute_container_class_device_del+0x28/0x40 + transport_remove_classdev+0x60/0x7c + attribute_container_device_trigger+0x118/0x120 + transport_remove_device+0x20/0x30 + ata_tlink_delete+0x88/0xb0 [libata] + ata_tport_delete+0x2c/0x60 [libata] + ata_port_detach+0x148/0x1b0 [libata] + ata_pci_remove_one+0x50/0x80 [libata] + ahci_remove_one+0x4c/0x8c [ahci] + +Fix this by checking and handling return value of transport_add_device() +in ata_tlink_add(). + +Fixes: d9027470b886 ("[libata] Add ATA transport class") +Signed-off-by: Yang Yingliang +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-transport.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c +index ef53bdfbcbb2..aac9336e8153 100644 +--- a/drivers/ata/libata-transport.c ++++ b/drivers/ata/libata-transport.c +@@ -458,7 +458,9 @@ int ata_tlink_add(struct ata_link *link) + goto tlink_err; + } + +- transport_add_device(dev); ++ error = transport_add_device(dev); ++ if (error) ++ goto tlink_transport_err; + transport_configure_device(dev); + + ata_for_each_dev(ata_dev, link, ALL) { +@@ -473,6 +475,7 @@ int ata_tlink_add(struct ata_link *link) + ata_tdev_delete(ata_dev); + } + transport_remove_device(dev); ++ tlink_transport_err: + device_del(dev); + tlink_err: + transport_destroy_device(dev); +-- +2.35.1 + diff --git a/queue-6.0/ata-libata-transport-fix-error-handling-in-ata_tport.patch b/queue-6.0/ata-libata-transport-fix-error-handling-in-ata_tport.patch new file mode 100644 index 00000000000..20cb769b6ca --- /dev/null +++ b/queue-6.0/ata-libata-transport-fix-error-handling-in-ata_tport.patch @@ -0,0 +1,67 @@ +From 0f7b67655665b906d72a2d2854ce36b86add4827 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 21:40:02 +0800 +Subject: ata: libata-transport: fix error handling in ata_tport_add() + +From: Yang Yingliang + +[ Upstream commit 3613dbe3909dcc637fe6be00e4dc43b4aa0470ee ] + +In ata_tport_add(), the return value of transport_add_device() is +not checked. As a result, it causes null-ptr-deref while removing +the module, because transport_remove_device() is called to remove +the device that was not added. + +Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 +CPU: 12 PID: 13605 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc3+ #8 +pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : device_del+0x48/0x39c +lr : device_del+0x44/0x39c +Call trace: + device_del+0x48/0x39c + attribute_container_class_device_del+0x28/0x40 + transport_remove_classdev+0x60/0x7c + attribute_container_device_trigger+0x118/0x120 + transport_remove_device+0x20/0x30 + ata_tport_delete+0x34/0x60 [libata] + ata_port_detach+0x148/0x1b0 [libata] + ata_pci_remove_one+0x50/0x80 [libata] + ahci_remove_one+0x4c/0x8c [ahci] + +Fix this by checking and handling return value of transport_add_device() +in ata_tport_add(). + +Fixes: d9027470b886 ("[libata] Add ATA transport class") +Signed-off-by: Yang Yingliang +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-transport.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c +index 105da3ec5eaa..ef53bdfbcbb2 100644 +--- a/drivers/ata/libata-transport.c ++++ b/drivers/ata/libata-transport.c +@@ -301,7 +301,9 @@ int ata_tport_add(struct device *parent, + pm_runtime_enable(dev); + pm_runtime_forbid(dev); + +- transport_add_device(dev); ++ error = transport_add_device(dev); ++ if (error) ++ goto tport_transport_add_err; + transport_configure_device(dev); + + error = ata_tlink_add(&ap->link); +@@ -312,6 +314,7 @@ int ata_tport_add(struct device *parent, + + tport_link_err: + transport_remove_device(dev); ++ tport_transport_add_err: + device_del(dev); + + tport_err: +-- +2.35.1 + diff --git a/queue-6.0/block-make-dma_alignment-a-stacking-queue_limit.patch b/queue-6.0/block-make-dma_alignment-a-stacking-queue_limit.patch new file mode 100644 index 00000000000..7cda381922d --- /dev/null +++ b/queue-6.0/block-make-dma_alignment-a-stacking-queue_limit.patch @@ -0,0 +1,121 @@ +From 2ec26c01e7fa3d6c208ba501c19120b2068b2c6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 10:44:57 -0800 +Subject: block: make dma_alignment a stacking queue_limit + +From: Keith Busch + +[ Upstream commit c964d62f5cab7b43dd0534f22a96eab386c6ec5d ] + +Device mappers had always been getting the default 511 dma mask, but +the underlying device might have a larger alignment requirement. Since +this value is used to determine alloweable direct-io alignment, this +needs to be a stackable limit. + +Signed-off-by: Keith Busch +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20221110184501.2451620-2-kbusch@meta.com +Signed-off-by: Jens Axboe +Stable-dep-of: 86e4d3e8d183 ("dm-crypt: provide dma_alignment limit in io_hints") +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 1 - + block/blk-settings.c | 8 +++++--- + include/linux/blkdev.h | 15 ++++++++------- + 3 files changed, 13 insertions(+), 11 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 651057c4146b..2fbdf17f2206 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -426,7 +426,6 @@ struct request_queue *blk_alloc_queue(int node_id, bool alloc_srcu) + PERCPU_REF_INIT_ATOMIC, GFP_KERNEL)) + goto fail_stats; + +- blk_queue_dma_alignment(q, 511); + blk_set_default_limits(&q->limits); + q->nr_requests = BLKDEV_DEFAULT_RQ; + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 8bb9eef5310e..4949ed3ce7c9 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -57,6 +57,7 @@ void blk_set_default_limits(struct queue_limits *lim) + lim->misaligned = 0; + lim->zoned = BLK_ZONED_NONE; + lim->zone_write_granularity = 0; ++ lim->dma_alignment = 511; + } + EXPORT_SYMBOL(blk_set_default_limits); + +@@ -600,6 +601,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + + t->io_min = max(t->io_min, b->io_min); + t->io_opt = lcm_not_zero(t->io_opt, b->io_opt); ++ t->dma_alignment = max(t->dma_alignment, b->dma_alignment); + + /* Set non-power-of-2 compatible chunk_sectors boundary */ + if (b->chunk_sectors) +@@ -773,7 +775,7 @@ EXPORT_SYMBOL(blk_queue_virt_boundary); + **/ + void blk_queue_dma_alignment(struct request_queue *q, int mask) + { +- q->dma_alignment = mask; ++ q->limits.dma_alignment = mask; + } + EXPORT_SYMBOL(blk_queue_dma_alignment); + +@@ -795,8 +797,8 @@ void blk_queue_update_dma_alignment(struct request_queue *q, int mask) + { + BUG_ON(mask > PAGE_SIZE); + +- if (mask > q->dma_alignment) +- q->dma_alignment = mask; ++ if (mask > q->limits.dma_alignment) ++ q->limits.dma_alignment = mask; + } + EXPORT_SYMBOL(blk_queue_update_dma_alignment); + +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index 84b13fdd34a7..79624711fda7 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -311,6 +311,13 @@ struct queue_limits { + unsigned char discard_misaligned; + unsigned char raid_partial_stripes_expensive; + enum blk_zoned_model zoned; ++ ++ /* ++ * Drivers that set dma_alignment to less than 511 must be prepared to ++ * handle individual bvec's that are not a multiple of a SECTOR_SIZE ++ * due to possible offsets. ++ */ ++ unsigned int dma_alignment; + }; + + typedef int (*report_zones_cb)(struct blk_zone *zone, unsigned int idx, +@@ -456,12 +463,6 @@ struct request_queue { + unsigned long nr_requests; /* Max # of requests */ + + unsigned int dma_pad_mask; +- /* +- * Drivers that set dma_alignment to less than 511 must be prepared to +- * handle individual bvec's that are not a multiple of a SECTOR_SIZE +- * due to possible offsets. +- */ +- unsigned int dma_alignment; + + #ifdef CONFIG_BLK_INLINE_ENCRYPTION + struct blk_crypto_profile *crypto_profile; +@@ -1311,7 +1312,7 @@ static inline sector_t bdev_zone_sectors(struct block_device *bdev) + + static inline int queue_dma_alignment(const struct request_queue *q) + { +- return q ? q->dma_alignment : 511; ++ return q ? q->limits.dma_alignment : 511; + } + + static inline unsigned int bdev_dma_alignment(struct block_device *bdev) +-- +2.35.1 + diff --git a/queue-6.0/block-sed-opal-kmalloc-the-cmd-resp-buffers.patch b/queue-6.0/block-sed-opal-kmalloc-the-cmd-resp-buffers.patch new file mode 100644 index 00000000000..df25db26668 --- /dev/null +++ b/queue-6.0/block-sed-opal-kmalloc-the-cmd-resp-buffers.patch @@ -0,0 +1,105 @@ +From bef59ea866bac1e550f39ab66e1cd8ecf2a1fdfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Nov 2022 23:39:44 +0300 +Subject: block: sed-opal: kmalloc the cmd/resp buffers + +From: Serge Semin + +[ Upstream commit f829230dd51974c1f4478900ed30bb77ba530b40 ] + +In accordance with [1] the DMA-able memory buffers must be +cacheline-aligned otherwise the cache writing-back and invalidation +performed during the mapping may cause the adjacent data being lost. It's +specifically required for the DMA-noncoherent platforms [2]. Seeing the +opal_dev.{cmd,resp} buffers are implicitly used for DMAs in the NVME and +SCSI/SD drivers in framework of the nvme_sec_submit() and sd_sec_submit() +methods respectively they must be cacheline-aligned to prevent the denoted +problem. One of the option to guarantee that is to kmalloc the buffers +[2]. Let's explicitly allocate them then instead of embedding into the +opal_dev structure instance. + +Note this fix was inspired by the commit c94b7f9bab22 ("nvme-hwmon: +kmalloc the NVME SMART log buffer"). + +[1] Documentation/core-api/dma-api.rst +[2] Documentation/core-api/dma-api-howto.rst + +Fixes: 455a7b238cd6 ("block: Add Sed-opal library") +Signed-off-by: Serge Semin +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20221107203944.31686-1-Sergey.Semin@baikalelectronics.ru +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/sed-opal.c | 32 ++++++++++++++++++++++++++++---- + 1 file changed, 28 insertions(+), 4 deletions(-) + +diff --git a/block/sed-opal.c b/block/sed-opal.c +index 9700197000f2..55cd37e868c0 100644 +--- a/block/sed-opal.c ++++ b/block/sed-opal.c +@@ -88,8 +88,8 @@ struct opal_dev { + u64 lowest_lba; + + size_t pos; +- u8 cmd[IO_BUFFER_LENGTH]; +- u8 resp[IO_BUFFER_LENGTH]; ++ u8 *cmd; ++ u8 *resp; + + struct parsed_resp parsed; + size_t prev_d_len; +@@ -2134,6 +2134,8 @@ void free_opal_dev(struct opal_dev *dev) + return; + + clean_opal_dev(dev); ++ kfree(dev->resp); ++ kfree(dev->cmd); + kfree(dev); + } + EXPORT_SYMBOL(free_opal_dev); +@@ -2146,17 +2148,39 @@ struct opal_dev *init_opal_dev(void *data, sec_send_recv *send_recv) + if (!dev) + return NULL; + ++ /* ++ * Presumably DMA-able buffers must be cache-aligned. Kmalloc makes ++ * sure the allocated buffer is DMA-safe in that regard. ++ */ ++ dev->cmd = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL); ++ if (!dev->cmd) ++ goto err_free_dev; ++ ++ dev->resp = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL); ++ if (!dev->resp) ++ goto err_free_cmd; ++ + INIT_LIST_HEAD(&dev->unlk_lst); + mutex_init(&dev->dev_lock); + dev->data = data; + dev->send_recv = send_recv; + if (check_opal_support(dev) != 0) { + pr_debug("Opal is not supported on this device\n"); +- kfree(dev); +- return NULL; ++ goto err_free_resp; + } + + return dev; ++ ++err_free_resp: ++ kfree(dev->resp); ++ ++err_free_cmd: ++ kfree(dev->cmd); ++ ++err_free_dev: ++ kfree(dev); ++ ++ return NULL; + } + EXPORT_SYMBOL(init_opal_dev); + +-- +2.35.1 + diff --git a/queue-6.0/bnxt_en-fix-the-handling-of-pcie-aer.patch b/queue-6.0/bnxt_en-fix-the-handling-of-pcie-aer.patch new file mode 100644 index 00000000000..148adeb7a91 --- /dev/null +++ b/queue-6.0/bnxt_en-fix-the-handling-of-pcie-aer.patch @@ -0,0 +1,107 @@ +From 268fc001e13232ddd6fbc61e4783236030cee4c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 19:33:25 -0400 +Subject: bnxt_en: fix the handling of PCIE-AER + +From: Vikas Gupta + +[ Upstream commit 0cf736a18a1e804037839bd8df9e36f0efdb8745 ] + +Fix the sequence required for PCIE-AER. While slot reset occurs, firmware +might not be ready and the driver needs to check for its recovery. We +also need to remap the health registers for some chips and clear the +resource reservations. The resources will be allocated again during +bnxt_io_resume(). + +Fixes: fb1e6e562b37 ("bnxt_en: Fix AER recovery.") +Signed-off-by: Vikas Gupta +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 29 ++++++++++++++++++- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + + .../net/ethernet/broadcom/bnxt/bnxt_hwrm.c | 3 +- + 3 files changed, 31 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 72915f40c7a0..55d4efbb8614 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -13922,7 +13922,9 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev) + pci_ers_result_t result = PCI_ERS_RESULT_DISCONNECT; + struct net_device *netdev = pci_get_drvdata(pdev); + struct bnxt *bp = netdev_priv(netdev); +- int err = 0, off; ++ int retry = 0; ++ int err = 0; ++ int off; + + netdev_info(bp->dev, "PCI Slot Reset\n"); + +@@ -13950,11 +13952,36 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev) + pci_restore_state(pdev); + pci_save_state(pdev); + ++ bnxt_inv_fw_health_reg(bp); ++ bnxt_try_map_fw_health_reg(bp); ++ ++ /* In some PCIe AER scenarios, firmware may take up to ++ * 10 seconds to become ready in the worst case. ++ */ ++ do { ++ err = bnxt_try_recover_fw(bp); ++ if (!err) ++ break; ++ retry++; ++ } while (retry < BNXT_FW_SLOT_RESET_RETRY); ++ ++ if (err) { ++ dev_err(&pdev->dev, "Firmware not ready\n"); ++ goto reset_exit; ++ } ++ + err = bnxt_hwrm_func_reset(bp); + if (!err) + result = PCI_ERS_RESULT_RECOVERED; ++ ++ bnxt_ulp_irq_stop(bp); ++ bnxt_clear_int_mode(bp); ++ err = bnxt_init_int_mode(bp); ++ bnxt_ulp_irq_restart(bp, err); + } + ++reset_exit: ++ bnxt_clear_reservations(bp, true); + rtnl_unlock(); + + return result; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index b1b17f911300..d5fa43cfe524 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1621,6 +1621,7 @@ struct bnxt_fw_health { + + #define BNXT_FW_RETRY 5 + #define BNXT_FW_IF_RETRY 10 ++#define BNXT_FW_SLOT_RESET_RETRY 4 + + enum board_idx { + BCM57301, +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c +index b01d42928a53..132442f16fe6 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c +@@ -476,7 +476,8 @@ static int __hwrm_send(struct bnxt *bp, struct bnxt_hwrm_ctx *ctx) + memset(ctx->resp, 0, PAGE_SIZE); + + req_type = le16_to_cpu(ctx->req->req_type); +- if (BNXT_NO_FW_ACCESS(bp) && req_type != HWRM_FUNC_RESET) { ++ if (BNXT_NO_FW_ACCESS(bp) && ++ (req_type != HWRM_FUNC_RESET && req_type != HWRM_VER_GET)) { + netdev_dbg(bp->dev, "hwrm req_type 0x%x skipped, FW channel down\n", + req_type); + goto exit; +-- +2.35.1 + diff --git a/queue-6.0/bnxt_en-refactor-bnxt_cancel_reservations.patch b/queue-6.0/bnxt_en-refactor-bnxt_cancel_reservations.patch new file mode 100644 index 00000000000..522157f937a --- /dev/null +++ b/queue-6.0/bnxt_en-refactor-bnxt_cancel_reservations.patch @@ -0,0 +1,69 @@ +From f305bc387af1357aed41a181827611d12ef33014 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 19:33:24 -0400 +Subject: bnxt_en: refactor bnxt_cancel_reservations() + +From: Vikas Gupta + +[ Upstream commit b4c66425771ddb910316c7b4cd7fa0614098ec45 ] + +Introduce bnxt_clear_reservations() to clear the reserved attributes only. +This will be used in the next patch to fix PCI AER handling. + +Signed-off-by: Vikas Gupta +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Stable-dep-of: 0cf736a18a1e ("bnxt_en: fix the handling of PCIE-AER") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index be5df8fca264..72915f40c7a0 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -9983,17 +9983,12 @@ static int bnxt_try_recover_fw(struct bnxt *bp) + return -ENODEV; + } + +-int bnxt_cancel_reservations(struct bnxt *bp, bool fw_reset) ++static void bnxt_clear_reservations(struct bnxt *bp, bool fw_reset) + { + struct bnxt_hw_resc *hw_resc = &bp->hw_resc; +- int rc; + + if (!BNXT_NEW_RM(bp)) +- return 0; /* no resource reservations required */ +- +- rc = bnxt_hwrm_func_resc_qcaps(bp, true); +- if (rc) +- netdev_err(bp->dev, "resc_qcaps failed\n"); ++ return; /* no resource reservations required */ + + hw_resc->resv_cp_rings = 0; + hw_resc->resv_stat_ctxs = 0; +@@ -10006,6 +10001,20 @@ int bnxt_cancel_reservations(struct bnxt *bp, bool fw_reset) + bp->tx_nr_rings = 0; + bp->rx_nr_rings = 0; + } ++} ++ ++int bnxt_cancel_reservations(struct bnxt *bp, bool fw_reset) ++{ ++ int rc; ++ ++ if (!BNXT_NEW_RM(bp)) ++ return 0; /* no resource reservations required */ ++ ++ rc = bnxt_hwrm_func_resc_qcaps(bp, true); ++ if (rc) ++ netdev_err(bp->dev, "resc_qcaps failed\n"); ++ ++ bnxt_clear_reservations(bp, fw_reset); + + return rc; + } +-- +2.35.1 + diff --git a/queue-6.0/bnxt_en-remove-debugfs-when-pci_register_driver-fail.patch b/queue-6.0/bnxt_en-remove-debugfs-when-pci_register_driver-fail.patch new file mode 100644 index 00000000000..20063655480 --- /dev/null +++ b/queue-6.0/bnxt_en-remove-debugfs-when-pci_register_driver-fail.patch @@ -0,0 +1,50 @@ +From 9f346810127652e29e332921a9cc54f28eeba49e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 15:04:33 +0800 +Subject: bnxt_en: Remove debugfs when pci_register_driver failed + +From: Gaosheng Cui + +[ Upstream commit 991aef4ee4f6eb999924f429b943441a32835c8f ] + +When pci_register_driver failed, we need to remove debugfs, +which will caused a resource leak, fix it. + +Resource leak logs as follows: +[ 52.184456] debugfs: Directory 'bnxt_en' with parent '/' already present! + +Fixes: cabfb09d87bd ("bnxt_en: add debugfs support for DIM") +Signed-off-by: Gaosheng Cui +Reviewed-by: Leon Romanovsky +Reviewed-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 55d4efbb8614..57cabe20aa12 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -14037,8 +14037,16 @@ static struct pci_driver bnxt_pci_driver = { + + static int __init bnxt_init(void) + { ++ int err; ++ + bnxt_debug_init(); +- return pci_register_driver(&bnxt_pci_driver); ++ err = pci_register_driver(&bnxt_pci_driver); ++ if (err) { ++ bnxt_debug_exit(); ++ return err; ++ } ++ ++ return 0; + } + + static void __exit bnxt_exit(void) +-- +2.35.1 + diff --git a/queue-6.0/bpf-fix-memory-leaks-in-__check_func_call.patch b/queue-6.0/bpf-fix-memory-leaks-in-__check_func_call.patch new file mode 100644 index 00000000000..4c4c95f0c1d --- /dev/null +++ b/queue-6.0/bpf-fix-memory-leaks-in-__check_func_call.patch @@ -0,0 +1,101 @@ +From f2cfcbd3403c4a7e7321b5108102e881717ea2f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 13:11:31 +0800 +Subject: bpf: Fix memory leaks in __check_func_call + +From: Wang Yufen + +[ Upstream commit eb86559a691cea5fa63e57a03ec3dc9c31e97955 ] + +kmemleak reports this issue: + +unreferenced object 0xffff88817139d000 (size 2048): + comm "test_progs", pid 33246, jiffies 4307381979 (age 45851.820s) + hex dump (first 32 bytes): + 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<0000000045f075f0>] kmalloc_trace+0x27/0xa0 + [<0000000098b7c90a>] __check_func_call+0x316/0x1230 + [<00000000b4c3c403>] check_helper_call+0x172e/0x4700 + [<00000000aa3875b7>] do_check+0x21d8/0x45e0 + [<000000001147357b>] do_check_common+0x767/0xaf0 + [<00000000b5a595b4>] bpf_check+0x43e3/0x5bc0 + [<0000000011e391b1>] bpf_prog_load+0xf26/0x1940 + [<0000000007f765c0>] __sys_bpf+0xd2c/0x3650 + [<00000000839815d6>] __x64_sys_bpf+0x75/0xc0 + [<00000000946ee250>] do_syscall_64+0x3b/0x90 + [<0000000000506b7f>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +The root case here is: In function prepare_func_exit(), the callee is +not released in the abnormal scenario after "state->curframe--;". To +fix, move "state->curframe--;" to the very bottom of the function, +right when we free callee and reset frame[] pointer to NULL, as Andrii +suggested. + +In addition, function __check_func_call() has a similar problem. In +the abnormal scenario before "state->curframe++;", the callee also +should be released by free_func_state(). + +Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper") +Fixes: fd978bf7fd31 ("bpf: Add reference tracking to verifier") +Signed-off-by: Wang Yufen +Link: https://lore.kernel.org/r/1667884291-15666-1-git-send-email-wangyufen@huawei.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 69fb46fdf763..b781075dd510 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -6674,11 +6674,11 @@ static int __check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn + /* Transfer references to the callee */ + err = copy_reference_state(callee, caller); + if (err) +- return err; ++ goto err_out; + + err = set_callee_state_cb(env, caller, callee, *insn_idx); + if (err) +- return err; ++ goto err_out; + + clear_caller_saved_regs(env, caller->regs); + +@@ -6695,6 +6695,11 @@ static int __check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn + print_verifier_state(env, callee, true); + } + return 0; ++ ++err_out: ++ free_func_state(callee); ++ state->frame[state->curframe + 1] = NULL; ++ return err; + } + + int map_set_for_each_callback_args(struct bpf_verifier_env *env, +@@ -6880,8 +6885,7 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx) + return -EINVAL; + } + +- state->curframe--; +- caller = state->frame[state->curframe]; ++ caller = state->frame[state->curframe - 1]; + if (callee->in_callback_fn) { + /* enforce R0 return value range [0, 1]. */ + struct tnum range = tnum_range(0, 1); +@@ -6920,7 +6924,7 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx) + } + /* clear everything in the callee */ + free_func_state(callee); +- state->frame[state->curframe + 1] = NULL; ++ state->frame[state->curframe--] = NULL; + return 0; + } + +-- +2.35.1 + diff --git a/queue-6.0/bpf-initialize-same-number-of-free-nodes-for-each-pc.patch b/queue-6.0/bpf-initialize-same-number-of-free-nodes-for-each-pc.patch new file mode 100644 index 00000000000..952341881e7 --- /dev/null +++ b/queue-6.0/bpf-initialize-same-number-of-free-nodes-for-each-pc.patch @@ -0,0 +1,71 @@ +From 90c4292d94519c4f6379371b76fb34ea4532316e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 07:21:28 -0500 +Subject: bpf: Initialize same number of free nodes for each pcpu_freelist + +From: Xu Kuohai + +[ Upstream commit 4b45cd81f737d79d0fbfc0d320a1e518e7f0bbf0 ] + +pcpu_freelist_populate() initializes nr_elems / num_possible_cpus() + 1 +free nodes for some CPUs, and then possibly one CPU with fewer nodes, +followed by remaining cpus with 0 nodes. For example, when nr_elems == 256 +and num_possible_cpus() == 32, CPU 0~27 each gets 9 free nodes, CPU 28 gets +4 free nodes, CPU 29~31 get 0 free nodes, while in fact each CPU should get +8 nodes equally. + +This patch initializes nr_elems / num_possible_cpus() free nodes for each +CPU firstly, then allocates the remaining free nodes by one for each CPU +until no free nodes left. + +Fixes: e19494edab82 ("bpf: introduce percpu_freelist") +Signed-off-by: Xu Kuohai +Signed-off-by: Andrii Nakryiko +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20221110122128.105214-1-xukuohai@huawei.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/percpu_freelist.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +diff --git a/kernel/bpf/percpu_freelist.c b/kernel/bpf/percpu_freelist.c +index 00b874c8e889..2ffb741eee8d 100644 +--- a/kernel/bpf/percpu_freelist.c ++++ b/kernel/bpf/percpu_freelist.c +@@ -102,22 +102,21 @@ void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size, + u32 nr_elems) + { + struct pcpu_freelist_head *head; +- int i, cpu, pcpu_entries; ++ unsigned int cpu, cpu_idx, i, j, n, m; + +- pcpu_entries = nr_elems / num_possible_cpus() + 1; +- i = 0; ++ n = nr_elems / num_possible_cpus(); ++ m = nr_elems % num_possible_cpus(); + ++ cpu_idx = 0; + for_each_possible_cpu(cpu) { +-again: + head = per_cpu_ptr(s->freelist, cpu); +- /* No locking required as this is not visible yet. */ +- pcpu_freelist_push_node(head, buf); +- i++; +- buf += elem_size; +- if (i == nr_elems) +- break; +- if (i % pcpu_entries) +- goto again; ++ j = n + (cpu_idx < m ? 1 : 0); ++ for (i = 0; i < j; i++) { ++ /* No locking required as this is not visible yet. */ ++ pcpu_freelist_push_node(head, buf); ++ buf += elem_size; ++ } ++ cpu_idx++; + } + } + +-- +2.35.1 + diff --git a/queue-6.0/bpf-test_run-fix-alignment-problem-in-bpf_prog_test_.patch b/queue-6.0/bpf-test_run-fix-alignment-problem-in-bpf_prog_test_.patch new file mode 100644 index 00000000000..991b10ce6fd --- /dev/null +++ b/queue-6.0/bpf-test_run-fix-alignment-problem-in-bpf_prog_test_.patch @@ -0,0 +1,74 @@ +From bce6e94a778cbd9739f208e8574d34f280d8663f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 16:16:20 +0800 +Subject: bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() + +From: Baisong Zhong + +[ Upstream commit d3fd203f36d46aa29600a72d57a1b61af80e4a25 ] + +We got a syzkaller problem because of aarch64 alignment fault +if KFENCE enabled. When the size from user bpf program is an odd +number, like 399, 407, etc, it will cause the struct skb_shared_info's +unaligned access. As seen below: + + BUG: KFENCE: use-after-free read in __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032 + + Use-after-free read at 0xffff6254fffac077 (in kfence-#213): + __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:26 [inline] + arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline] + arch_atomic_inc include/linux/atomic-arch-fallback.h:270 [inline] + atomic_inc include/asm-generic/atomic-instrumented.h:241 [inline] + __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032 + skb_clone+0xf4/0x214 net/core/skbuff.c:1481 + ____bpf_clone_redirect net/core/filter.c:2433 [inline] + bpf_clone_redirect+0x78/0x1c0 net/core/filter.c:2420 + bpf_prog_d3839dd9068ceb51+0x80/0x330 + bpf_dispatcher_nop_func include/linux/bpf.h:728 [inline] + bpf_test_run+0x3c0/0x6c0 net/bpf/test_run.c:53 + bpf_prog_test_run_skb+0x638/0xa7c net/bpf/test_run.c:594 + bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline] + __do_sys_bpf kernel/bpf/syscall.c:4441 [inline] + __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381 + + kfence-#213: 0xffff6254fffac000-0xffff6254fffac196, size=407, cache=kmalloc-512 + + allocated by task 15074 on cpu 0 at 1342.585390s: + kmalloc include/linux/slab.h:568 [inline] + kzalloc include/linux/slab.h:675 [inline] + bpf_test_init.isra.0+0xac/0x290 net/bpf/test_run.c:191 + bpf_prog_test_run_skb+0x11c/0xa7c net/bpf/test_run.c:512 + bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline] + __do_sys_bpf kernel/bpf/syscall.c:4441 [inline] + __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381 + __arm64_sys_bpf+0x50/0x60 kernel/bpf/syscall.c:4381 + +To fix the problem, we adjust @size so that (@size + @hearoom) is a +multiple of SMP_CACHE_BYTES. So we make sure the struct skb_shared_info +is aligned to a cache line. + +Fixes: 1cf1cae963c2 ("bpf: introduce BPF_PROG_TEST_RUN command") +Signed-off-by: Baisong Zhong +Signed-off-by: Daniel Borkmann +Cc: Eric Dumazet +Link: https://lore.kernel.org/bpf/20221102081620.1465154-1-zhongbaisong@huawei.com +Signed-off-by: Sasha Levin +--- + net/bpf/test_run.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c +index d11209367dd0..b422238f9f86 100644 +--- a/net/bpf/test_run.c ++++ b/net/bpf/test_run.c +@@ -733,6 +733,7 @@ static void *bpf_test_init(const union bpf_attr *kattr, u32 user_size, + if (user_size > size) + return ERR_PTR(-EMSGSIZE); + ++ size = SKB_DATA_ALIGN(size); + data = kzalloc(size + headroom + tailroom, GFP_USER); + if (!data) + return ERR_PTR(-ENOMEM); +-- +2.35.1 + diff --git a/queue-6.0/bridge-switchdev-fix-memory-leaks-when-changing-vlan.patch b/queue-6.0/bridge-switchdev-fix-memory-leaks-when-changing-vlan.patch new file mode 100644 index 00000000000..b48256e0150 --- /dev/null +++ b/queue-6.0/bridge-switchdev-fix-memory-leaks-when-changing-vlan.patch @@ -0,0 +1,120 @@ +From 45b600dacc856cfb24cc0f54409068bf81d9a05f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 10:45:09 +0200 +Subject: bridge: switchdev: Fix memory leaks when changing VLAN protocol + +From: Ido Schimmel + +[ Upstream commit 9d45921ee4cb364910097e7d1b7558559c2f9fd2 ] + +The bridge driver can offload VLANs to the underlying hardware either +via switchdev or the 8021q driver. When the former is used, the VLAN is +marked in the bridge driver with the 'BR_VLFLAG_ADDED_BY_SWITCHDEV' +private flag. + +To avoid the memory leaks mentioned in the cited commit, the bridge +driver will try to delete a VLAN via the 8021q driver if the VLAN is not +marked with the previously mentioned flag. + +When the VLAN protocol of the bridge changes, switchdev drivers are +notified via the 'SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL' attribute, but +the 8021q driver is also called to add the existing VLANs with the new +protocol and delete them with the old protocol. + +In case the VLANs were offloaded via switchdev, the above behavior is +both redundant and buggy. Redundant because the VLANs are already +programmed in hardware and drivers that support VLAN protocol change +(currently only mlx5) change the protocol upon the switchdev attribute +notification. Buggy because the 8021q driver is called despite these +VLANs being marked with 'BR_VLFLAG_ADDED_BY_SWITCHDEV'. This leads to +memory leaks [1] when the VLANs are deleted. + +Fix by not calling the 8021q driver for VLANs that were already +programmed via switchdev. + +[1] +unreferenced object 0xffff8881f6771200 (size 256): + comm "ip", pid 446855, jiffies 4298238841 (age 55.240s) + hex dump (first 32 bytes): + 00 00 7f 0e 83 88 ff ff 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000012819ac>] vlan_vid_add+0x437/0x750 + [<00000000f2281fad>] __br_vlan_set_proto+0x289/0x920 + [<000000000632b56f>] br_changelink+0x3d6/0x13f0 + [<0000000089d25f04>] __rtnl_newlink+0x8ae/0x14c0 + [<00000000f6276baf>] rtnl_newlink+0x5f/0x90 + [<00000000746dc902>] rtnetlink_rcv_msg+0x336/0xa00 + [<000000001c2241c0>] netlink_rcv_skb+0x11d/0x340 + [<0000000010588814>] netlink_unicast+0x438/0x710 + [<00000000e1a4cd5c>] netlink_sendmsg+0x788/0xc40 + [<00000000e8992d4e>] sock_sendmsg+0xb0/0xe0 + [<00000000621b8f91>] ____sys_sendmsg+0x4ff/0x6d0 + [<000000000ea26996>] ___sys_sendmsg+0x12e/0x1b0 + [<00000000684f7e25>] __sys_sendmsg+0xab/0x130 + [<000000004538b104>] do_syscall_64+0x3d/0x90 + [<0000000091ed9678>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Fixes: 279737939a81 ("net: bridge: Fix VLANs memory leak") +Reported-by: Vlad Buslov +Tested-by: Vlad Buslov +Signed-off-by: Ido Schimmel +Acked-by: Nikolay Aleksandrov +Link: https://lore.kernel.org/r/20221114084509.860831-1-idosch@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/bridge/br_vlan.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index 6e53dc991409..9ffd40b8270c 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -959,6 +959,8 @@ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto, + list_for_each_entry(p, &br->port_list, list) { + vg = nbp_vlan_group(p); + list_for_each_entry(vlan, &vg->vlan_list, vlist) { ++ if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV) ++ continue; + err = vlan_vid_add(p->dev, proto, vlan->vid); + if (err) + goto err_filt; +@@ -973,8 +975,11 @@ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto, + /* Delete VLANs for the old proto from the device filter. */ + list_for_each_entry(p, &br->port_list, list) { + vg = nbp_vlan_group(p); +- list_for_each_entry(vlan, &vg->vlan_list, vlist) ++ list_for_each_entry(vlan, &vg->vlan_list, vlist) { ++ if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV) ++ continue; + vlan_vid_del(p->dev, oldproto, vlan->vid); ++ } + } + + return 0; +@@ -983,13 +988,19 @@ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto, + attr.u.vlan_protocol = ntohs(oldproto); + switchdev_port_attr_set(br->dev, &attr, NULL); + +- list_for_each_entry_continue_reverse(vlan, &vg->vlan_list, vlist) ++ list_for_each_entry_continue_reverse(vlan, &vg->vlan_list, vlist) { ++ if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV) ++ continue; + vlan_vid_del(p->dev, proto, vlan->vid); ++ } + + list_for_each_entry_continue_reverse(p, &br->port_list, list) { + vg = nbp_vlan_group(p); +- list_for_each_entry(vlan, &vg->vlan_list, vlist) ++ list_for_each_entry(vlan, &vg->vlan_list, vlist) { ++ if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV) ++ continue; + vlan_vid_del(p->dev, proto, vlan->vid); ++ } + } + + return err; +-- +2.35.1 + diff --git a/queue-6.0/cifs-add-check-for-returning-value-of-smb2_close_ini.patch b/queue-6.0/cifs-add-check-for-returning-value-of-smb2_close_ini.patch new file mode 100644 index 00000000000..ecb6dee55ee --- /dev/null +++ b/queue-6.0/cifs-add-check-for-returning-value-of-smb2_close_ini.patch @@ -0,0 +1,39 @@ +From 52eaa2cbe2d18e9bedd9ee377d2267520a99cfa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Nov 2022 17:27:01 +0300 +Subject: cifs: add check for returning value of SMB2_close_init + +From: Anastasia Belova + +[ Upstream commit d520de6cb42e88a1d008b54f935caf9fc05951da ] + +If the returning value of SMB2_close_init is an error-value, +exit the function. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 352d96f3acc6 ("cifs: multichannel: move channel selection above transport layer") + +Signed-off-by: Anastasia Belova +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2ops.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index c258a7b122b6..86a1f282c8b4 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -1133,6 +1133,8 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, + rqst[2].rq_nvec = 1; + rc = SMB2_close_init(tcon, server, + &rqst[2], COMPOUND_FID, COMPOUND_FID, false); ++ if (rc) ++ goto sea_exit; + smb2_set_related(&rqst[2]); + + rc = compound_send_recv(xid, ses, server, +-- +2.35.1 + diff --git a/queue-6.0/cifs-add-check-for-returning-value-of-smb2_set_info_.patch b/queue-6.0/cifs-add-check-for-returning-value-of-smb2_set_info_.patch new file mode 100644 index 00000000000..97a92002821 --- /dev/null +++ b/queue-6.0/cifs-add-check-for-returning-value-of-smb2_set_info_.patch @@ -0,0 +1,39 @@ +From acee8fab49e2823c491c7eda801952cdcb5aeee8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Nov 2022 17:10:27 +0300 +Subject: cifs: add check for returning value of SMB2_set_info_init + +From: Anastasia Belova + +[ Upstream commit a51e5d293dd1c2e7bf6f7be788466cd9b5d280fb ] + +If the returning value of SMB2_set_info_init is an error-value, +exit the function. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 0967e5457954 ("cifs: use a compound for setting an xattr") + +Signed-off-by: Anastasia Belova +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2ops.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 86a1f282c8b4..b724bf42b540 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -1123,6 +1123,8 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, + COMPOUND_FID, current->tgid, + FILE_FULL_EA_INFORMATION, + SMB2_O_INFO_FILE, 0, data, size); ++ if (rc) ++ goto sea_exit; + smb2_set_next_command(tcon, &rqst[1]); + smb2_set_related(&rqst[1]); + +-- +2.35.1 + diff --git a/queue-6.0/cifs-fix-connections-leak-when-tlink-setup-failed.patch b/queue-6.0/cifs-fix-connections-leak-when-tlink-setup-failed.patch new file mode 100644 index 00000000000..419ccdee8b0 --- /dev/null +++ b/queue-6.0/cifs-fix-connections-leak-when-tlink-setup-failed.patch @@ -0,0 +1,64 @@ +From 0537529314e35192b1c113acc0d56204bde38058 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 15:12:12 +0800 +Subject: cifs: Fix connections leak when tlink setup failed + +From: Zhang Xiaoxu + +[ Upstream commit 1dcdf5f5b2137185cbdd5385f29949ab3da4f00c ] + +If the tlink setup failed, lost to put the connections, then +the module refcnt leak since the cifsd kthread not exit. + +Also leak the fscache info, and for next mount with fsc, it will +print the follow errors: + CIFS: Cache volume key already in use (cifs,127.0.0.1:445,TEST) + +Let's check the result of tlink setup, and do some cleanup. + +Fixes: 56c762eb9bee ("cifs: Refactor out cifs_mount()") +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/connect.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index c2c36451a883..317ca1be9c4c 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -3846,9 +3846,13 @@ int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx) + uuid_copy(&cifs_sb->dfs_mount_id, &mnt_ctx.mount_id); + + out: +- free_xid(mnt_ctx.xid); + cifs_try_adding_channels(cifs_sb, mnt_ctx.ses); +- return mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon); ++ rc = mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon); ++ if (rc) ++ goto error; ++ ++ free_xid(mnt_ctx.xid); ++ return rc; + + error: + dfs_cache_put_refsrv_sessions(&mnt_ctx.mount_id); +@@ -3875,8 +3879,12 @@ int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx) + goto error; + } + ++ rc = mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon); ++ if (rc) ++ goto error; ++ + free_xid(mnt_ctx.xid); +- return mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon); ++ return rc; + + error: + mount_put_conns(&mnt_ctx); +-- +2.35.1 + diff --git a/queue-6.0/cifs-fix-wrong-return-value-checking-when-getflags.patch b/queue-6.0/cifs-fix-wrong-return-value-checking-when-getflags.patch new file mode 100644 index 00000000000..7d2b0be792e --- /dev/null +++ b/queue-6.0/cifs-fix-wrong-return-value-checking-when-getflags.patch @@ -0,0 +1,45 @@ +From 734edc668c631d48bd4ec61a2a45c8cbff9078a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Nov 2022 18:39:34 +0800 +Subject: cifs: Fix wrong return value checking when GETFLAGS + +From: Zhang Xiaoxu + +[ Upstream commit 92bbd67a55fee50743b42825d1c016e7fd5c79f9 ] + +The return value of CIFSGetExtAttr is negative, should be checked +with -EOPNOTSUPP rather than EOPNOTSUPP. + +Fixes: 64a5cfa6db94 ("Allow setting per-file compression via SMB2/3") +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/ioctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c +index b6e6e5d6c8dd..baccda02deab 100644 +--- a/fs/cifs/ioctl.c ++++ b/fs/cifs/ioctl.c +@@ -343,7 +343,7 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg) + rc = put_user(ExtAttrBits & + FS_FL_USER_VISIBLE, + (int __user *)arg); +- if (rc != EOPNOTSUPP) ++ if (rc != -EOPNOTSUPP) + break; + } + #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */ +@@ -373,7 +373,7 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg) + * pSMBFile->fid.netfid, + * extAttrBits, + * &ExtAttrMask); +- * if (rc != EOPNOTSUPP) ++ * if (rc != -EOPNOTSUPP) + * break; + */ + +-- +2.35.1 + diff --git a/queue-6.0/dm-crypt-provide-dma_alignment-limit-in-io_hints.patch b/queue-6.0/dm-crypt-provide-dma_alignment-limit-in-io_hints.patch new file mode 100644 index 00000000000..777af8e8bb1 --- /dev/null +++ b/queue-6.0/dm-crypt-provide-dma_alignment-limit-in-io_hints.patch @@ -0,0 +1,41 @@ +From e6bb09b02e87cbde45c6d2692fb710579a08c366 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 10:44:58 -0800 +Subject: dm-crypt: provide dma_alignment limit in io_hints + +From: Keith Busch + +[ Upstream commit 86e4d3e8d1838ca88fb9267e669c36f6c8f7c6cd ] + +This device mapper needs bio vectors to be sized and memory aligned to +the logical block size. Set the minimum required queue limit +accordingly. + +Link: https://lore.kernel.org/linux-block/20221101001558.648ee024@xps.demsh.org/ +Fixes: b1a000d3b8ec5 ("block: relax direct io memory alignment") +Reportred-by: Eric Biggers +Reported-by: Dmitrii Tcvetkov +Signed-off-by: Keith Busch +Reviewed-by: Mike Snitzer +Link: https://lore.kernel.org/r/20221110184501.2451620-3-kbusch@meta.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/dm-crypt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 159c6806c19b..2653516bcdef 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -3630,6 +3630,7 @@ static void crypt_io_hints(struct dm_target *ti, struct queue_limits *limits) + limits->physical_block_size = + max_t(unsigned, limits->physical_block_size, cc->sector_size); + limits->io_min = max_t(unsigned, limits->io_min, cc->sector_size); ++ limits->dma_alignment = limits->logical_block_size - 1; + } + + static struct target_type crypt_target = { +-- +2.35.1 + diff --git a/queue-6.0/drbd-use-after-free-in-drbd_create_device.patch b/queue-6.0/drbd-use-after-free-in-drbd_create_device.patch new file mode 100644 index 00000000000..d11d9ff111e --- /dev/null +++ b/queue-6.0/drbd-use-after-free-in-drbd_create_device.patch @@ -0,0 +1,50 @@ +From ea43f58b02d4fa89d95bb64b383ba3bc2f3cc059 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Nov 2022 16:16:43 +0300 +Subject: drbd: use after free in drbd_create_device() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit a7a1598189228b5007369a9622ccdf587be0730f ] + +The drbd_destroy_connection() frees the "connection" so use the _safe() +iterator to prevent a use after free. + +Fixes: b6f85ef9538b ("drbd: Iterate over all connections") +Signed-off-by: Dan Carpenter +Reviewed-by: Christoph Böhmwalder +Link: https://lore.kernel.org/r/Y3Jd5iZRbNQ9w6gm@kili +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index f3e4db16fd07..8532b839a343 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -2672,7 +2672,7 @@ static int init_submitter(struct drbd_device *device) + enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsigned int minor) + { + struct drbd_resource *resource = adm_ctx->resource; +- struct drbd_connection *connection; ++ struct drbd_connection *connection, *n; + struct drbd_device *device; + struct drbd_peer_device *peer_device, *tmp_peer_device; + struct gendisk *disk; +@@ -2789,7 +2789,7 @@ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsig + return NO_ERROR; + + out_idr_remove_from_resource: +- for_each_connection(connection, resource) { ++ for_each_connection_safe(connection, n, resource) { + peer_device = idr_remove(&connection->peer_devices, vnr); + if (peer_device) + kref_put(&connection->kref, drbd_destroy_connection); +-- +2.35.1 + diff --git a/queue-6.0/drm-drv-fix-potential-memory-leak-in-drm_dev_init.patch b/queue-6.0/drm-drv-fix-potential-memory-leak-in-drm_dev_init.patch new file mode 100644 index 00000000000..611e626338c --- /dev/null +++ b/queue-6.0/drm-drv-fix-potential-memory-leak-in-drm_dev_init.patch @@ -0,0 +1,59 @@ +From ba8a4faecfd04fad95c0ccc945819bae147ff59e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 15:07:15 +0800 +Subject: drm/drv: Fix potential memory leak in drm_dev_init() + +From: Shang XiaoJing + +[ Upstream commit ff963634f7b2e0dc011349abb3fb81a0d074f443 ] + +drm_dev_init() will add drm_dev_init_release() as a callback. When +drmm_add_action() failed, the release function won't be added. As the +result, the ref cnt added by device_get() in drm_dev_init() won't be put +by drm_dev_init_release(), which leads to the memleak. Use +drmm_add_action_or_reset() instead of drmm_add_action() to prevent +memleak. + +unreferenced object 0xffff88810bc0c800 (size 2048): + comm "modprobe", pid 8322, jiffies 4305809845 (age 15.292s) + hex dump (first 32 bytes): + e8 cc c0 0b 81 88 ff ff ff ff ff ff 00 00 00 00 ................ + 20 24 3c 0c 81 88 ff ff 18 c8 c0 0b 81 88 ff ff $<............. + backtrace: + [<000000007251f72d>] __kmalloc+0x4b/0x1c0 + [<0000000045f21f26>] platform_device_alloc+0x2d/0xe0 + [<000000004452a479>] platform_device_register_full+0x24/0x1c0 + [<0000000089f4ea61>] 0xffffffffa0736051 + [<00000000235b2441>] do_one_initcall+0x7a/0x380 + [<0000000001a4a177>] do_init_module+0x5c/0x230 + [<000000002bf8a8e2>] load_module+0x227d/0x2420 + [<00000000637d6d0a>] __do_sys_finit_module+0xd5/0x140 + [<00000000c99fc324>] do_syscall_64+0x3f/0x90 + [<000000004d85aa77>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: 2cbf7fc6718b ("drm: Use drmm_ for drm_dev_init cleanup") +Signed-off-by: Shang XiaoJing +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20221101070716.9189-2-shangxiaojing@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c +index 8214a0b1ab7f..203bf8d6c34c 100644 +--- a/drivers/gpu/drm/drm_drv.c ++++ b/drivers/gpu/drm/drm_drv.c +@@ -615,7 +615,7 @@ static int drm_dev_init(struct drm_device *dev, + mutex_init(&dev->clientlist_mutex); + mutex_init(&dev->master_mutex); + +- ret = drmm_add_action(dev, drm_dev_init_release, NULL); ++ ret = drmm_add_action_or_reset(dev, drm_dev_init_release, NULL); + if (ret) + return ret; + +-- +2.35.1 + diff --git a/queue-6.0/drm-fix-potential-null-ptr-deref-in-drm_vblank_destr.patch b/queue-6.0/drm-fix-potential-null-ptr-deref-in-drm_vblank_destr.patch new file mode 100644 index 00000000000..92b66071619 --- /dev/null +++ b/queue-6.0/drm-fix-potential-null-ptr-deref-in-drm_vblank_destr.patch @@ -0,0 +1,64 @@ +From 75e66b654ae2ebc41fa6af510e6e4ace78a15c9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 15:07:16 +0800 +Subject: drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() + +From: Shang XiaoJing + +[ Upstream commit 4979524f5a2a8210e87fde2f642b0dc060860821 ] + +drm_vblank_init() call drmm_add_action_or_reset() with +drm_vblank_init_release() as action. If __drmm_add_action() failed, will +directly call drm_vblank_init_release() with the vblank whose worker is +NULL. As the resule, a null-ptr-deref will happen in +kthread_destroy_worker(). Add the NULL check before calling +drm_vblank_destroy_worker(). + +BUG: null-ptr-deref +KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] +CPU: 5 PID: 961 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf-dirty +RIP: 0010:kthread_destroy_worker+0x25/0xb0 + Call Trace: + + drm_vblank_init_release+0x124/0x220 [drm] + ? drm_crtc_vblank_restore+0x8b0/0x8b0 [drm] + __drmm_add_action_or_reset+0x41/0x50 [drm] + drm_vblank_init+0x282/0x310 [drm] + vkms_init+0x35f/0x1000 [vkms] + ? 0xffffffffc4508000 + ? lock_is_held_type+0xd7/0x130 + ? __kmem_cache_alloc_node+0x1c2/0x2b0 + ? lock_is_held_type+0xd7/0x130 + ? 0xffffffffc4508000 + do_one_initcall+0xd0/0x4f0 + ... + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Fixes: 5e6c2b4f9161 ("drm/vblank: Add vblank works") +Signed-off-by: Shang XiaoJing +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20221101070716.9189-3-shangxiaojing@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_internal.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h +index 7bb98e6a446d..5ea5e260118c 100644 +--- a/drivers/gpu/drm/drm_internal.h ++++ b/drivers/gpu/drm/drm_internal.h +@@ -104,7 +104,8 @@ static inline void drm_vblank_flush_worker(struct drm_vblank_crtc *vblank) + + static inline void drm_vblank_destroy_worker(struct drm_vblank_crtc *vblank) + { +- kthread_destroy_worker(vblank->worker); ++ if (vblank->worker) ++ kthread_destroy_worker(vblank->worker); + } + + int drm_vblank_worker_init(struct drm_vblank_crtc *vblank); +-- +2.35.1 + diff --git a/queue-6.0/drm-lima-fix-opp-clkname-setting-in-case-of-missing-.patch b/queue-6.0/drm-lima-fix-opp-clkname-setting-in-case-of-missing-.patch new file mode 100644 index 00000000000..3611c187e8c --- /dev/null +++ b/queue-6.0/drm-lima-fix-opp-clkname-setting-in-case-of-missing-.patch @@ -0,0 +1,63 @@ +From 557f29ff0d3fb94fd4c4865a8583c8a0ace53a74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 09:32:00 +0200 +Subject: drm/lima: Fix opp clkname setting in case of missing regulator + +From: Erico Nunes + +[ Upstream commit e17a025a47c66ca8499ae88d8046c4f0d7c9c057 ] + +Commit d8c32d3971e4 ("drm/lima: Migrate to dev_pm_opp_set_config()") +introduced a regression as it may undo the clk_names setting in case +the optional regulator is missing. This resulted in test and performance +regressions with lima. + +Restore the old behavior where clk_names is set separately so it is not +undone in case of a missing optional regulator. + +Fixes: d8c32d3971e4 ("drm/lima: Migrate to dev_pm_opp_set_config()") +Acked-by: Viresh Kumar +Signed-off-by: Erico Nunes +Signed-off-by: Qiang Yu +Link: https://patchwork.freedesktop.org/patch/msgid/20221027073200.3885839-1-nunes.erico@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/lima/lima_devfreq.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/lima/lima_devfreq.c b/drivers/gpu/drm/lima/lima_devfreq.c +index 011be7ff51e1..bc8fb4e38d0a 100644 +--- a/drivers/gpu/drm/lima/lima_devfreq.c ++++ b/drivers/gpu/drm/lima/lima_devfreq.c +@@ -112,11 +112,6 @@ int lima_devfreq_init(struct lima_device *ldev) + unsigned long cur_freq; + int ret; + const char *regulator_names[] = { "mali", NULL }; +- const char *clk_names[] = { "core", NULL }; +- struct dev_pm_opp_config config = { +- .regulator_names = regulator_names, +- .clk_names = clk_names, +- }; + + if (!device_property_present(dev, "operating-points-v2")) + /* Optional, continue without devfreq */ +@@ -124,7 +119,15 @@ int lima_devfreq_init(struct lima_device *ldev) + + spin_lock_init(&ldevfreq->lock); + +- ret = devm_pm_opp_set_config(dev, &config); ++ /* ++ * clkname is set separately so it is not affected by the optional ++ * regulator setting which may return error. ++ */ ++ ret = devm_pm_opp_set_clkname(dev, "core"); ++ if (ret) ++ return ret; ++ ++ ret = devm_pm_opp_set_regulators(dev, regulator_names); + if (ret) { + /* Continue if the optional regulator is missing */ + if (ret != -ENODEV) +-- +2.35.1 + diff --git a/queue-6.0/drm-panel-simple-set-bpc-field-for-logic-technologie.patch b/queue-6.0/drm-panel-simple-set-bpc-field-for-logic-technologie.patch new file mode 100644 index 00000000000..11735f442c7 --- /dev/null +++ b/queue-6.0/drm-panel-simple-set-bpc-field-for-logic-technologie.patch @@ -0,0 +1,45 @@ +From 9fa09042c05bf82fc8e98bce2d8b799784a2ffd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 16:16:22 +0200 +Subject: drm/panel: simple: set bpc field for logic technologies displays + +From: Aishwarya Kothari + +[ Upstream commit 876153ab068b2507a19aa3ef481f5b00a2cc780f ] + +In case bpc is not set for a panel it then throws a WARN(). Add bpc to +the panels logictechno_lt170410_2whc and logictechno_lt161010_2nh. + +Fixes: 5728fe7fa539 ("drm/panel: simple: add display timings for logic technologies displays") +Signed-off-by: Aishwarya Kothari +Signed-off-by: Francesco Dolcini +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20220831141622.39605-1-francesco.dolcini@toradex.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 1e716c23019a..eb938bfb0573 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -2505,6 +2505,7 @@ static const struct display_timing logictechno_lt161010_2nh_timing = { + static const struct panel_desc logictechno_lt161010_2nh = { + .timings = &logictechno_lt161010_2nh_timing, + .num_timings = 1, ++ .bpc = 6, + .size = { + .width = 154, + .height = 86, +@@ -2534,6 +2535,7 @@ static const struct display_timing logictechno_lt170410_2whc_timing = { + static const struct panel_desc logictechno_lt170410_2whc = { + .timings = &logictechno_lt170410_2whc_timing, + .num_timings = 1, ++ .bpc = 8, + .size = { + .width = 217, + .height = 136, +-- +2.35.1 + diff --git a/queue-6.0/drm-vc4-kms-fix-is_err-vs-null-check-for-vc4_kms.patch b/queue-6.0/drm-vc4-kms-fix-is_err-vs-null-check-for-vc4_kms.patch new file mode 100644 index 00000000000..28f6919f0ec --- /dev/null +++ b/queue-6.0/drm-vc4-kms-fix-is_err-vs-null-check-for-vc4_kms.patch @@ -0,0 +1,61 @@ +From 30c903e2fe78f122fba5858430c220fee442f3c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 17:44:45 +0800 +Subject: drm/vc4: kms: Fix IS_ERR() vs NULL check for vc4_kms + +From: Gaosheng Cui + +[ Upstream commit dba9e3467425800f9d3a14e8b6a0f85c731c1650 ] + +The drm_atomic_get_new_private_obj_state() function returns NULL +on error path, drm_atomic_get_old_private_obj_state() function +returns NULL on error path, too, they does not return error pointers. + +By the way, vc4_hvs_get_new/old_global_state() should return +ERR_PTR(-EINVAL), otherwise there will be null-ptr-defer issue, +such as follows: + +In function vc4_atomic_commit_tail(): + |-- old_hvs_state = vc4_hvs_get_old_global_state(state); <-- return NULL + |-- if (WARN_ON(IS_ERR(old_hvs_state))) <-- no return + |-- unsigned long state_rate = max(old_hvs_state->core_clock_rate, + new_hvs_state->core_clock_rate); <-- null-ptr-defer + +Fixes: 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit") +Signed-off-by: Gaosheng Cui +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20221110094445.2930509-6-cuigaosheng1@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_kms.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c +index b45dcdfd7306..a3678178b022 100644 +--- a/drivers/gpu/drm/vc4/vc4_kms.c ++++ b/drivers/gpu/drm/vc4/vc4_kms.c +@@ -198,8 +198,8 @@ vc4_hvs_get_new_global_state(struct drm_atomic_state *state) + struct drm_private_state *priv_state; + + priv_state = drm_atomic_get_new_private_obj_state(state, &vc4->hvs_channels); +- if (IS_ERR(priv_state)) +- return ERR_CAST(priv_state); ++ if (!priv_state) ++ return ERR_PTR(-EINVAL); + + return to_vc4_hvs_state(priv_state); + } +@@ -211,8 +211,8 @@ vc4_hvs_get_old_global_state(struct drm_atomic_state *state) + struct drm_private_state *priv_state; + + priv_state = drm_atomic_get_old_private_obj_state(state, &vc4->hvs_channels); +- if (IS_ERR(priv_state)) +- return ERR_CAST(priv_state); ++ if (!priv_state) ++ return ERR_PTR(-EINVAL); + + return to_vc4_hvs_state(priv_state); + } +-- +2.35.1 + diff --git a/queue-6.0/erofs-clean-up-.read_folio-and-.readahead-in-fscache.patch b/queue-6.0/erofs-clean-up-.read_folio-and-.readahead-in-fscache.patch new file mode 100644 index 00000000000..bd623d26813 --- /dev/null +++ b/queue-6.0/erofs-clean-up-.read_folio-and-.readahead-in-fscache.patch @@ -0,0 +1,295 @@ +From 30d007e256e6dd8a1ec8a31266b1872428fb2194 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Sep 2022 14:24:14 +0800 +Subject: erofs: clean up .read_folio() and .readahead() in fscache mode + +From: Jingbo Xu + +[ Upstream commit 1ae9470c3e14624b0f4d8741c22b5a94062c0e33 ] + +The implementation of these two functions in fscache mode is almost the +same. Extract the same part as a generic helper to remove the code +duplication. + +Signed-off-by: Jingbo Xu +Reviewed-by: Jia Zhu +Link: https://lore.kernel.org/r/20220922062414.20437-1-jefflexu@linux.alibaba.com +Signed-off-by: Gao Xiang +Stable-dep-of: e6d9f9ba111b ("erofs: get correct count for unmapped range in fscache mode") +Signed-off-by: Sasha Levin +--- + fs/erofs/fscache.c | 213 ++++++++++++++++++--------------------------- + 1 file changed, 83 insertions(+), 130 deletions(-) + +diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c +index b5fd9d71e67f..508b1a4df15e 100644 +--- a/fs/erofs/fscache.c ++++ b/fs/erofs/fscache.c +@@ -234,113 +234,111 @@ static int erofs_fscache_meta_read_folio(struct file *data, struct folio *folio) + return ret; + } + +-static int erofs_fscache_read_folio_inline(struct folio *folio, +- struct erofs_map_blocks *map) +-{ +- struct super_block *sb = folio_mapping(folio)->host->i_sb; +- struct erofs_buf buf = __EROFS_BUF_INITIALIZER; +- erofs_blk_t blknr; +- size_t offset, len; +- void *src, *dst; +- +- /* For tail packing layout, the offset may be non-zero. */ +- offset = erofs_blkoff(map->m_pa); +- blknr = erofs_blknr(map->m_pa); +- len = map->m_llen; +- +- src = erofs_read_metabuf(&buf, sb, blknr, EROFS_KMAP); +- if (IS_ERR(src)) +- return PTR_ERR(src); +- +- dst = kmap_local_folio(folio, 0); +- memcpy(dst, src + offset, len); +- memset(dst + len, 0, PAGE_SIZE - len); +- kunmap_local(dst); +- +- erofs_put_metabuf(&buf); +- return 0; +-} +- +-static int erofs_fscache_read_folio(struct file *file, struct folio *folio) ++/* ++ * Read into page cache in the range described by (@pos, @len). ++ * ++ * On return, the caller is responsible for page unlocking if the output @unlock ++ * is true, or the callee will take this responsibility through netfs_io_request ++ * interface. ++ * ++ * The return value is the number of bytes successfully handled, or negative ++ * error code on failure. The only exception is that, the length of the range ++ * instead of the error code is returned on failure after netfs_io_request is ++ * allocated, so that .readahead() could advance rac accordingly. ++ */ ++static int erofs_fscache_data_read(struct address_space *mapping, ++ loff_t pos, size_t len, bool *unlock) + { +- struct inode *inode = folio_mapping(folio)->host; ++ struct inode *inode = mapping->host; + struct super_block *sb = inode->i_sb; ++ struct netfs_io_request *rreq; + struct erofs_map_blocks map; + struct erofs_map_dev mdev; +- struct netfs_io_request *rreq; +- erofs_off_t pos; +- loff_t pstart; ++ struct iov_iter iter; ++ size_t count; + int ret; + +- DBG_BUGON(folio_size(folio) != EROFS_BLKSIZ); ++ *unlock = true; + +- pos = folio_pos(folio); + map.m_la = pos; +- + ret = erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW); + if (ret) +- goto out_unlock; ++ return ret; + +- if (!(map.m_flags & EROFS_MAP_MAPPED)) { +- folio_zero_range(folio, 0, folio_size(folio)); +- goto out_uptodate; ++ if (map.m_flags & EROFS_MAP_META) { ++ struct erofs_buf buf = __EROFS_BUF_INITIALIZER; ++ erofs_blk_t blknr; ++ size_t offset, size; ++ void *src; ++ ++ /* For tail packing layout, the offset may be non-zero. */ ++ offset = erofs_blkoff(map.m_pa); ++ blknr = erofs_blknr(map.m_pa); ++ size = map.m_llen; ++ ++ src = erofs_read_metabuf(&buf, sb, blknr, EROFS_KMAP); ++ if (IS_ERR(src)) ++ return PTR_ERR(src); ++ ++ iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, PAGE_SIZE); ++ if (copy_to_iter(src + offset, size, &iter) != size) ++ return -EFAULT; ++ iov_iter_zero(PAGE_SIZE - size, &iter); ++ erofs_put_metabuf(&buf); ++ return PAGE_SIZE; + } + +- if (map.m_flags & EROFS_MAP_META) { +- ret = erofs_fscache_read_folio_inline(folio, &map); +- goto out_uptodate; ++ count = min_t(size_t, map.m_llen - (pos - map.m_la), len); ++ DBG_BUGON(!count || count % PAGE_SIZE); ++ ++ if (!(map.m_flags & EROFS_MAP_MAPPED)) { ++ iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, count); ++ iov_iter_zero(count, &iter); ++ return count; + } + + mdev = (struct erofs_map_dev) { + .m_deviceid = map.m_deviceid, + .m_pa = map.m_pa, + }; +- + ret = erofs_map_dev(sb, &mdev); + if (ret) +- goto out_unlock; +- +- +- rreq = erofs_fscache_alloc_request(folio_mapping(folio), +- folio_pos(folio), folio_size(folio)); +- if (IS_ERR(rreq)) { +- ret = PTR_ERR(rreq); +- goto out_unlock; +- } ++ return ret; + +- pstart = mdev.m_pa + (pos - map.m_la); +- return erofs_fscache_read_folios_async(mdev.m_fscache->cookie, +- rreq, pstart); ++ rreq = erofs_fscache_alloc_request(mapping, pos, count); ++ if (IS_ERR(rreq)) ++ return PTR_ERR(rreq); + +-out_uptodate: +- if (!ret) +- folio_mark_uptodate(folio); +-out_unlock: +- folio_unlock(folio); +- return ret; ++ *unlock = false; ++ erofs_fscache_read_folios_async(mdev.m_fscache->cookie, ++ rreq, mdev.m_pa + (pos - map.m_la)); ++ return count; + } + +-static void erofs_fscache_advance_folios(struct readahead_control *rac, +- size_t len, bool unlock) ++static int erofs_fscache_read_folio(struct file *file, struct folio *folio) + { +- while (len) { +- struct folio *folio = readahead_folio(rac); +- len -= folio_size(folio); +- if (unlock) { ++ bool unlock; ++ int ret; ++ ++ DBG_BUGON(folio_size(folio) != EROFS_BLKSIZ); ++ ++ ret = erofs_fscache_data_read(folio_mapping(folio), folio_pos(folio), ++ folio_size(folio), &unlock); ++ if (unlock) { ++ if (ret > 0) + folio_mark_uptodate(folio); +- folio_unlock(folio); +- } ++ folio_unlock(folio); + } ++ return ret < 0 ? ret : 0; + } + + static void erofs_fscache_readahead(struct readahead_control *rac) + { +- struct inode *inode = rac->mapping->host; +- struct super_block *sb = inode->i_sb; +- size_t len, count, done = 0; +- erofs_off_t pos; +- loff_t start, offset; +- int ret; ++ struct folio *folio; ++ size_t len, done = 0; ++ loff_t start, pos; ++ bool unlock; ++ int ret, size; + + if (!readahead_count(rac)) + return; +@@ -349,67 +347,22 @@ static void erofs_fscache_readahead(struct readahead_control *rac) + len = readahead_length(rac); + + do { +- struct erofs_map_blocks map; +- struct erofs_map_dev mdev; +- struct netfs_io_request *rreq; +- + pos = start + done; +- map.m_la = pos; +- +- ret = erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW); +- if (ret) ++ ret = erofs_fscache_data_read(rac->mapping, pos, ++ len - done, &unlock); ++ if (ret <= 0) + return; + +- offset = start + done; +- count = min_t(size_t, map.m_llen - (pos - map.m_la), +- len - done); +- +- if (!(map.m_flags & EROFS_MAP_MAPPED)) { +- struct iov_iter iter; +- +- iov_iter_xarray(&iter, READ, &rac->mapping->i_pages, +- offset, count); +- iov_iter_zero(count, &iter); +- +- erofs_fscache_advance_folios(rac, count, true); +- ret = count; +- continue; +- } +- +- if (map.m_flags & EROFS_MAP_META) { +- struct folio *folio = readahead_folio(rac); +- +- ret = erofs_fscache_read_folio_inline(folio, &map); +- if (!ret) { ++ size = ret; ++ while (size) { ++ folio = readahead_folio(rac); ++ size -= folio_size(folio); ++ if (unlock) { + folio_mark_uptodate(folio); +- ret = folio_size(folio); ++ folio_unlock(folio); + } +- +- folio_unlock(folio); +- continue; + } +- +- mdev = (struct erofs_map_dev) { +- .m_deviceid = map.m_deviceid, +- .m_pa = map.m_pa, +- }; +- ret = erofs_map_dev(sb, &mdev); +- if (ret) +- return; +- +- rreq = erofs_fscache_alloc_request(rac->mapping, offset, count); +- if (IS_ERR(rreq)) +- return; +- /* +- * Drop the ref of folios here. Unlock them in +- * rreq_unlock_folios() when rreq complete. +- */ +- erofs_fscache_advance_folios(rac, count, false); +- ret = erofs_fscache_read_folios_async(mdev.m_fscache->cookie, +- rreq, mdev.m_pa + (pos - map.m_la)); +- if (!ret) +- ret = count; +- } while (ret > 0 && ((done += ret) < len)); ++ } while ((done += ret) < len); + } + + static const struct address_space_operations erofs_fscache_meta_aops = { +-- +2.35.1 + diff --git a/queue-6.0/erofs-fix-missing-xas_retry-in-fscache-mode.patch b/queue-6.0/erofs-fix-missing-xas_retry-in-fscache-mode.patch new file mode 100644 index 00000000000..9d0bb5249b9 --- /dev/null +++ b/queue-6.0/erofs-fix-missing-xas_retry-in-fscache-mode.patch @@ -0,0 +1,54 @@ +From c250e490c04c28e9b939ca25d327056ff94500d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 20:19:43 +0800 +Subject: erofs: fix missing xas_retry() in fscache mode + +From: Jingbo Xu + +[ Upstream commit 37020bbb71d911431e16c2c940b97cf86ae4f2f6 ] + +The xarray iteration only holds the RCU read lock and thus may encounter +XA_RETRY_ENTRY if there's process modifying the xarray concurrently. +This will cause oops when referring to the invalid entry. + +Fix this by adding the missing xas_retry(), which will make the +iteration wind back to the root node if XA_RETRY_ENTRY is encountered. + +Fixes: d435d53228dd ("erofs: change to use asynchronous io for fscache readpage/readahead") +Suggested-by: David Howells +Reviewed-by: Gao Xiang +Reviewed-by: Jia Zhu +Signed-off-by: Jingbo Xu +Link: https://lore.kernel.org/r/20221114121943.29987-1-jefflexu@linux.alibaba.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/fscache.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c +index 79af25f0a56c..46ab2b3f9a3c 100644 +--- a/fs/erofs/fscache.c ++++ b/fs/erofs/fscache.c +@@ -69,11 +69,15 @@ static void erofs_fscache_rreq_unlock_folios(struct netfs_io_request *rreq) + + rcu_read_lock(); + xas_for_each(&xas, folio, last_page) { +- unsigned int pgpos = +- (folio_index(folio) - start_page) * PAGE_SIZE; +- unsigned int pgend = pgpos + folio_size(folio); ++ unsigned int pgpos, pgend; + bool pg_failed = false; + ++ if (xas_retry(&xas, folio)) ++ continue; ++ ++ pgpos = (folio_index(folio) - start_page) * PAGE_SIZE; ++ pgend = pgpos + folio_size(folio); ++ + for (;;) { + if (!subreq) { + pg_failed = true; +-- +2.35.1 + diff --git a/queue-6.0/erofs-get-correct-count-for-unmapped-range-in-fscach.patch b/queue-6.0/erofs-get-correct-count-for-unmapped-range-in-fscach.patch new file mode 100644 index 00000000000..18625a224ca --- /dev/null +++ b/queue-6.0/erofs-get-correct-count-for-unmapped-range-in-fscach.patch @@ -0,0 +1,59 @@ +From 3d24abab4974c3dd9b0bd5a420d8694de6db2e89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 13:40:28 +0800 +Subject: erofs: get correct count for unmapped range in fscache mode + +From: Jingbo Xu + +[ Upstream commit e6d9f9ba111b56154f1b1120252aff269cebd49c ] + +For unmapped range, the returned map.m_llen is zero, and thus the +calculated count is unexpected zero. + +Prior to the refactoring introduced by commit 1ae9470c3e14 ("erofs: +clean up .read_folio() and .readahead() in fscache mode"), only the +readahead routine suffers from this. With the refactoring of making +.read_folio() and .readahead() calling one common routine, both +read_folio and readahead have this issue now. + +Fix this by calculating count separately in unmapped condition. + +Fixes: c665b394b9e8 ("erofs: implement fscache-based data readahead") +Fixes: 1ae9470c3e14 ("erofs: clean up .read_folio() and .readahead() in fscache mode") +Signed-off-by: Jingbo Xu +Reviewed-by: Gao Xiang +Reviewed-by: Chao Yu +Link: https://lore.kernel.org/r/20221104054028.52208-3-jefflexu@linux.alibaba.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/fscache.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c +index 508b1a4df15e..8585e324298c 100644 +--- a/fs/erofs/fscache.c ++++ b/fs/erofs/fscache.c +@@ -288,15 +288,16 @@ static int erofs_fscache_data_read(struct address_space *mapping, + return PAGE_SIZE; + } + +- count = min_t(size_t, map.m_llen - (pos - map.m_la), len); +- DBG_BUGON(!count || count % PAGE_SIZE); +- + if (!(map.m_flags & EROFS_MAP_MAPPED)) { ++ count = len; + iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, count); + iov_iter_zero(count, &iter); + return count; + } + ++ count = min_t(size_t, map.m_llen - (pos - map.m_la), len); ++ DBG_BUGON(!count || count % PAGE_SIZE); ++ + mdev = (struct erofs_map_dev) { + .m_deviceid = map.m_deviceid, + .m_pa = map.m_pa, +-- +2.35.1 + diff --git a/queue-6.0/erofs-put-metabuf-in-error-path-in-fscache-mode.patch b/queue-6.0/erofs-put-metabuf-in-error-path-in-fscache-mode.patch new file mode 100644 index 00000000000..da97a86f33c --- /dev/null +++ b/queue-6.0/erofs-put-metabuf-in-error-path-in-fscache-mode.patch @@ -0,0 +1,42 @@ +From 2f1a8d4cadcdbd29e6bf38a6d16e5c4490087236 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 13:40:27 +0800 +Subject: erofs: put metabuf in error path in fscache mode + +From: Jingbo Xu + +[ Upstream commit 75e43355cbe4d5948a79bd592f2ffecb9f75f75d ] + +For tail packing layout, put metabuf when error is encountered. + +Fixes: 1ae9470c3e14 ("erofs: clean up .read_folio() and .readahead() in fscache mode") +Signed-off-by: Jingbo Xu +Reviewed-by: Gao Xiang +Reviewed-by: Jia Zhu +Reviewed-by: Chao Yu +Link: https://lore.kernel.org/r/20221104054028.52208-2-jefflexu@linux.alibaba.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/fscache.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c +index 8585e324298c..79af25f0a56c 100644 +--- a/fs/erofs/fscache.c ++++ b/fs/erofs/fscache.c +@@ -281,8 +281,10 @@ static int erofs_fscache_data_read(struct address_space *mapping, + return PTR_ERR(src); + + iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, PAGE_SIZE); +- if (copy_to_iter(src + offset, size, &iter) != size) ++ if (copy_to_iter(src + offset, size, &iter) != size) { ++ erofs_put_metabuf(&buf); + return -EFAULT; ++ } + iov_iter_zero(PAGE_SIZE - size, &iter); + erofs_put_metabuf(&buf); + return PAGE_SIZE; +-- +2.35.1 + diff --git a/queue-6.0/io_uring-calculate-cqes-from-the-user-visible-value.patch b/queue-6.0/io_uring-calculate-cqes-from-the-user-visible-value.patch new file mode 100644 index 00000000000..4c470603809 --- /dev/null +++ b/queue-6.0/io_uring-calculate-cqes-from-the-user-visible-value.patch @@ -0,0 +1,98 @@ +From 4010147f56a145a4f70e05a23ce5b47c9128dfef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 07:30:16 -0800 +Subject: io_uring: calculate CQEs from the user visible value + +From: Dylan Yudaken + +[ Upstream commit 0fc8c2acbfc789a977a50a4a9812a8e4b37958ce ] + +io_cqring_wait (and it's wake function io_has_work) used cached_cq_tail in +order to calculate the number of CQEs. cached_cq_tail is set strictly +before the user visible rings->cq.tail + +However as far as userspace is concerned, if io_uring_enter(2) is called +with a minimum number of events, they will verify by checking +rings->cq.tail. + +It is therefore possible for io_uring_enter(2) to return early with fewer +events visible to the user. + +Instead make the wait functions read from the user visible value, so there +will be no discrepency. + +This is triggered eventually by the following reproducer: + +struct io_uring_sqe *sqe; +struct io_uring_cqe *cqe; +unsigned int cqe_ready; +struct io_uring ring; +int ret, i; + +ret = io_uring_queue_init(N, &ring, 0); +assert(!ret); +while(true) { + for (i = 0; i < N; i++) { + sqe = io_uring_get_sqe(&ring); + io_uring_prep_nop(sqe); + sqe->flags |= IOSQE_ASYNC; + } + ret = io_uring_submit(&ring); + assert(ret == N); + + do { + ret = io_uring_wait_cqes(&ring, &cqe, N, NULL, NULL); + } while(ret == -EINTR); + cqe_ready = io_uring_cq_ready(&ring); + assert(!ret); + assert(cqe_ready == N); + io_uring_cq_advance(&ring, N); +} + +Fixes: ad3eb2c89fb2 ("io_uring: split overflow state into SQ and CQ side") +Signed-off-by: Dylan Yudaken +Link: https://lore.kernel.org/r/20221108153016.1854297-1-dylany@meta.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io_uring.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index d29f397f095e..f347e81e2d98 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -171,6 +171,11 @@ static inline unsigned int __io_cqring_events(struct io_ring_ctx *ctx) + return ctx->cached_cq_tail - READ_ONCE(ctx->rings->cq.head); + } + ++static inline unsigned int __io_cqring_events_user(struct io_ring_ctx *ctx) ++{ ++ return READ_ONCE(ctx->rings->cq.tail) - READ_ONCE(ctx->rings->cq.head); ++} ++ + static bool io_match_linked(struct io_kiocb *head) + { + struct io_kiocb *req; +@@ -2163,7 +2168,7 @@ struct io_wait_queue { + static inline bool io_should_wake(struct io_wait_queue *iowq) + { + struct io_ring_ctx *ctx = iowq->ctx; +- int dist = ctx->cached_cq_tail - (int) iowq->cq_tail; ++ int dist = READ_ONCE(ctx->rings->cq.tail) - (int) iowq->cq_tail; + + /* + * Wake up if we have enough events, or if a timeout occurred since we +@@ -2240,7 +2245,8 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events, + do { + io_cqring_overflow_flush(ctx); + +- if (io_cqring_events(ctx) >= min_events) ++ /* if user messes with these they will just get an early return */ ++ if (__io_cqring_events_user(ctx) >= min_events) + return 0; + if (!io_run_task_work()) + break; +-- +2.35.1 + diff --git a/queue-6.0/io_uring-poll-fix-double-poll-req-flags-races.patch b/queue-6.0/io_uring-poll-fix-double-poll-req-flags-races.patch new file mode 100644 index 00000000000..78afc54f6d7 --- /dev/null +++ b/queue-6.0/io_uring-poll-fix-double-poll-req-flags-races.patch @@ -0,0 +1,95 @@ +From 3080b51851fa522b3a9e707af4aafe549f587579 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 16:51:29 +0000 +Subject: io_uring/poll: fix double poll req->flags races + +From: Pavel Begunkov + +[ Upstream commit 30a33669fa21cd3dc7d92a00ba736358059014b7 ] + +io_poll_double_prepare() | io_poll_wake() + | poll->head = NULL +smp_load(&poll->head); /* NULL */ | +flags = req->flags; | + | req->flags &= ~SINGLE_POLL; +req->flags = flags | DOUBLE_POLL | + +The idea behind io_poll_double_prepare() is to serialise with the +first poll entry by taking the wq lock. However, it's not safe to assume +that io_poll_wake() is not running when we can't grab the lock and so we +may race modifying req->flags. + +Skip double poll setup if that happens. It's ok because the first poll +entry will only be removed when it's definitely completing, e.g. +pollfree or oneshot with a valid mask. + +Fixes: 49f1c68e048f1 ("io_uring: optimise submission side poll_refs") +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/b7fab2d502f6121a7d7b199fe4d914a43ca9cdfd.1668184658.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/poll.c | 29 +++++++++++++++++------------ + 1 file changed, 17 insertions(+), 12 deletions(-) + +diff --git a/io_uring/poll.c b/io_uring/poll.c +index 0d9f49c575e0..97c214aa688c 100644 +--- a/io_uring/poll.c ++++ b/io_uring/poll.c +@@ -394,7 +394,8 @@ static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync, + return 1; + } + +-static void io_poll_double_prepare(struct io_kiocb *req) ++/* fails only when polling is already completing by the first entry */ ++static bool io_poll_double_prepare(struct io_kiocb *req) + { + struct wait_queue_head *head; + struct io_poll *poll = io_poll_get_single(req); +@@ -403,20 +404,20 @@ static void io_poll_double_prepare(struct io_kiocb *req) + rcu_read_lock(); + head = smp_load_acquire(&poll->head); + /* +- * poll arm may not hold ownership and so race with +- * io_poll_wake() by modifying req->flags. There is only one +- * poll entry queued, serialise with it by taking its head lock. ++ * poll arm might not hold ownership and so race for req->flags with ++ * io_poll_wake(). There is only one poll entry queued, serialise with ++ * it by taking its head lock. As we're still arming the tw hanlder ++ * is not going to be run, so there are no races with it. + */ +- if (head) ++ if (head) { + spin_lock_irq(&head->lock); +- +- req->flags |= REQ_F_DOUBLE_POLL; +- if (req->opcode == IORING_OP_POLL_ADD) +- req->flags |= REQ_F_ASYNC_DATA; +- +- if (head) ++ req->flags |= REQ_F_DOUBLE_POLL; ++ if (req->opcode == IORING_OP_POLL_ADD) ++ req->flags |= REQ_F_ASYNC_DATA; + spin_unlock_irq(&head->lock); ++ } + rcu_read_unlock(); ++ return !!head; + } + + static void __io_queue_proc(struct io_poll *poll, struct io_poll_table *pt, +@@ -454,7 +455,11 @@ static void __io_queue_proc(struct io_poll *poll, struct io_poll_table *pt, + /* mark as double wq entry */ + wqe_private |= IO_WQE_F_DOUBLE; + io_init_poll_iocb(poll, first->events, first->wait.func); +- io_poll_double_prepare(req); ++ if (!io_poll_double_prepare(req)) { ++ /* the request is completing, just back off */ ++ kfree(poll); ++ return; ++ } + *poll_ptr = poll; + } else { + /* fine to modify, there is no poll queued to race with us */ +-- +2.35.1 + diff --git a/queue-6.0/kcm-close-race-conditions-on-sk_receive_queue.patch b/queue-6.0/kcm-close-race-conditions-on-sk_receive_queue.patch new file mode 100644 index 00000000000..0751841a83b --- /dev/null +++ b/queue-6.0/kcm-close-race-conditions-on-sk_receive_queue.patch @@ -0,0 +1,166 @@ +From df6138aaff655f389cade99e82a646586aad6c92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Nov 2022 16:51:19 -0800 +Subject: kcm: close race conditions on sk_receive_queue + +From: Cong Wang + +[ Upstream commit 5121197ecc5db58c07da95eb1ff82b98b121a221 ] + +sk->sk_receive_queue is protected by skb queue lock, but for KCM +sockets its RX path takes mux->rx_lock to protect more than just +skb queue. However, kcm_recvmsg() still only grabs the skb queue +lock, so race conditions still exist. + +We can teach kcm_recvmsg() to grab mux->rx_lock too but this would +introduce a potential performance regression as struct kcm_mux can +be shared by multiple KCM sockets. + +So we have to enforce skb queue lock in requeue_rx_msgs() and handle +skb peek case carefully in kcm_wait_data(). Fortunately, +skb_recv_datagram() already handles it nicely and is widely used by +other sockets, we can just switch to skb_recv_datagram() after +getting rid of the unnecessary sock lock in kcm_recvmsg() and +kcm_splice_read(). Side note: SOCK_DONE is not used by KCM sockets, +so it is safe to get rid of this check too. + +I ran the original syzbot reproducer for 30 min without seeing any +issue. + +Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") +Reported-by: syzbot+278279efdd2730dd14bf@syzkaller.appspotmail.com +Reported-by: shaozhengchao +Cc: Paolo Abeni +Cc: Tom Herbert +Signed-off-by: Cong Wang +Link: https://lore.kernel.org/r/20221114005119.597905-1-xiyou.wangcong@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/kcm/kcmsock.c | 58 +++++------------------------------------------ + 1 file changed, 6 insertions(+), 52 deletions(-) + +diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c +index befc62606cdf..9e4b40a30a72 100644 +--- a/net/kcm/kcmsock.c ++++ b/net/kcm/kcmsock.c +@@ -222,7 +222,7 @@ static void requeue_rx_msgs(struct kcm_mux *mux, struct sk_buff_head *head) + struct sk_buff *skb; + struct kcm_sock *kcm; + +- while ((skb = __skb_dequeue(head))) { ++ while ((skb = skb_dequeue(head))) { + /* Reset destructor to avoid calling kcm_rcv_ready */ + skb->destructor = sock_rfree; + skb_orphan(skb); +@@ -1085,53 +1085,17 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + return err; + } + +-static struct sk_buff *kcm_wait_data(struct sock *sk, int flags, +- long timeo, int *err) +-{ +- struct sk_buff *skb; +- +- while (!(skb = skb_peek(&sk->sk_receive_queue))) { +- if (sk->sk_err) { +- *err = sock_error(sk); +- return NULL; +- } +- +- if (sock_flag(sk, SOCK_DONE)) +- return NULL; +- +- if ((flags & MSG_DONTWAIT) || !timeo) { +- *err = -EAGAIN; +- return NULL; +- } +- +- sk_wait_data(sk, &timeo, NULL); +- +- /* Handle signals */ +- if (signal_pending(current)) { +- *err = sock_intr_errno(timeo); +- return NULL; +- } +- } +- +- return skb; +-} +- + static int kcm_recvmsg(struct socket *sock, struct msghdr *msg, + size_t len, int flags) + { + struct sock *sk = sock->sk; + struct kcm_sock *kcm = kcm_sk(sk); + int err = 0; +- long timeo; + struct strp_msg *stm; + int copied = 0; + struct sk_buff *skb; + +- timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); +- +- lock_sock(sk); +- +- skb = kcm_wait_data(sk, flags, timeo, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) + goto out; + +@@ -1162,14 +1126,11 @@ static int kcm_recvmsg(struct socket *sock, struct msghdr *msg, + /* Finished with message */ + msg->msg_flags |= MSG_EOR; + KCM_STATS_INCR(kcm->stats.rx_msgs); +- skb_unlink(skb, &sk->sk_receive_queue); +- kfree_skb(skb); + } + } + + out: +- release_sock(sk); +- ++ skb_free_datagram(sk, skb); + return copied ? : err; + } + +@@ -1179,7 +1140,6 @@ static ssize_t kcm_splice_read(struct socket *sock, loff_t *ppos, + { + struct sock *sk = sock->sk; + struct kcm_sock *kcm = kcm_sk(sk); +- long timeo; + struct strp_msg *stm; + int err = 0; + ssize_t copied; +@@ -1187,11 +1147,7 @@ static ssize_t kcm_splice_read(struct socket *sock, loff_t *ppos, + + /* Only support splice for SOCKSEQPACKET */ + +- timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); +- +- lock_sock(sk); +- +- skb = kcm_wait_data(sk, flags, timeo, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) + goto err_out; + +@@ -1219,13 +1175,11 @@ static ssize_t kcm_splice_read(struct socket *sock, loff_t *ppos, + * finish reading the message. + */ + +- release_sock(sk); +- ++ skb_free_datagram(sk, skb); + return copied; + + err_out: +- release_sock(sk); +- ++ skb_free_datagram(sk, skb); + return err; + } + +-- +2.35.1 + diff --git a/queue-6.0/l2tp-serialize-access-to-sk_user_data-with-sk_callba.patch b/queue-6.0/l2tp-serialize-access-to-sk_user_data-with-sk_callba.patch new file mode 100644 index 00000000000..b7a8b2e0ba7 --- /dev/null +++ b/queue-6.0/l2tp-serialize-access-to-sk_user_data-with-sk_callba.patch @@ -0,0 +1,122 @@ +From 87a828cfa5ce4b2075d26660756c07751648d13f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 20:16:19 +0100 +Subject: l2tp: Serialize access to sk_user_data with sk_callback_lock + +From: Jakub Sitnicki + +[ Upstream commit b68777d54fac21fc833ec26ea1a2a84f975ab035 ] + +sk->sk_user_data has multiple users, which are not compatible with each +other. Writers must synchronize by grabbing the sk->sk_callback_lock. + +l2tp currently fails to grab the lock when modifying the underlying tunnel +socket fields. Fix it by adding appropriate locking. + +We err on the side of safety and grab the sk_callback_lock also inside the +sk_destruct callback overridden by l2tp, even though there should be no +refs allowing access to the sock at the time when sk_destruct gets called. + +v4: +- serialize write to sk_user_data in l2tp sk_destruct + +v3: +- switch from sock lock to sk_callback_lock +- document write-protection for sk_user_data + +v2: +- update Fixes to point to origin of the bug +- use real names in Reported/Tested-by tags + +Cc: Tom Parkin +Fixes: 3557baabf280 ("[L2TP]: PPP over L2TP driver core") +Reported-by: Haowei Yan +Signed-off-by: Jakub Sitnicki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/sock.h | 2 +- + net/l2tp/l2tp_core.c | 19 +++++++++++++------ + 2 files changed, 14 insertions(+), 7 deletions(-) + +diff --git a/include/net/sock.h b/include/net/sock.h +index f6e6838c82df..03a4ebe3ccc8 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -323,7 +323,7 @@ struct sk_filter; + * @sk_tskey: counter to disambiguate concurrent tstamp requests + * @sk_zckey: counter to order MSG_ZEROCOPY notifications + * @sk_socket: Identd and reporting IO signals +- * @sk_user_data: RPC layer private data ++ * @sk_user_data: RPC layer private data. Write-protected by @sk_callback_lock. + * @sk_frag: cached page frag + * @sk_peek_off: current peek_offset value + * @sk_send_head: front of stuff to transmit +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index 7499c51b1850..754fdda8a5f5 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1150,8 +1150,10 @@ static void l2tp_tunnel_destruct(struct sock *sk) + } + + /* Remove hooks into tunnel socket */ ++ write_lock_bh(&sk->sk_callback_lock); + sk->sk_destruct = tunnel->old_sk_destruct; + sk->sk_user_data = NULL; ++ write_unlock_bh(&sk->sk_callback_lock); + + /* Call the original destructor */ + if (sk->sk_destruct) +@@ -1469,16 +1471,18 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + sock = sockfd_lookup(tunnel->fd, &ret); + if (!sock) + goto err; +- +- ret = l2tp_validate_socket(sock->sk, net, tunnel->encap); +- if (ret < 0) +- goto err_sock; + } + ++ sk = sock->sk; ++ write_lock(&sk->sk_callback_lock); ++ ++ ret = l2tp_validate_socket(sk, net, tunnel->encap); ++ if (ret < 0) ++ goto err_sock; ++ + tunnel->l2tp_net = net; + pn = l2tp_pernet(net); + +- sk = sock->sk; + sock_hold(sk); + tunnel->sock = sk; + +@@ -1504,7 +1508,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + + setup_udp_tunnel_sock(net, sock, &udp_cfg); + } else { +- sk->sk_user_data = tunnel; ++ rcu_assign_sk_user_data(sk, tunnel); + } + + tunnel->old_sk_destruct = sk->sk_destruct; +@@ -1518,6 +1522,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + if (tunnel->fd >= 0) + sockfd_put(sock); + ++ write_unlock(&sk->sk_callback_lock); + return 0; + + err_sock: +@@ -1525,6 +1530,8 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + sock_release(sock); + else + sockfd_put(sock); ++ ++ write_unlock(&sk->sk_callback_lock); + err: + return ret; + } +-- +2.35.1 + diff --git a/queue-6.0/mctp-i2c-don-t-count-unused-invalid-keys-for-flow-re.patch b/queue-6.0/mctp-i2c-don-t-count-unused-invalid-keys-for-flow-re.patch new file mode 100644 index 00000000000..10d99c63176 --- /dev/null +++ b/queue-6.0/mctp-i2c-don-t-count-unused-invalid-keys-for-flow-re.patch @@ -0,0 +1,117 @@ +From 692c01925ad7fffd7c22ea0ea7d3ad0fc87ff1d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 13:31:35 +0800 +Subject: mctp i2c: don't count unused / invalid keys for flow release + +From: Jeremy Kerr + +[ Upstream commit 9cbd48d5fa14e4c65f8580de16686077f7cea02b ] + +We're currently hitting the WARN_ON in mctp_i2c_flow_release: + + if (midev->release_count > midev->i2c_lock_count) { + WARN_ONCE(1, "release count overflow"); + +This may be hit if we expire a flow before sending the first packet it +contains - as we will not be pairing the increment of release_count +(performed on flow release) with the i2c lock operation (only +performed on actual TX). + +To fix this, only release a flow if we've encountered it previously (ie, +dev_flow_state does not indicate NEW), as we will mark the flow as +ACTIVE at the same time as accounting for the i2c lock operation. We +also need to add an INVALID flow state, to indicate when we've done the +release. + +Fixes: f5b8abf9fc3d ("mctp i2c: MCTP I2C binding driver") +Reported-by: Jian Zhang +Tested-by: Jian Zhang +Signed-off-by: Jeremy Kerr +Link: https://lore.kernel.org/r/20221110053135.329071-1-jk@codeconstruct.com.au +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/mctp/mctp-i2c.c | 47 +++++++++++++++++++++++++------------ + 1 file changed, 32 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/mctp/mctp-i2c.c b/drivers/net/mctp/mctp-i2c.c +index 53846c6b56ca..aca3697b0962 100644 +--- a/drivers/net/mctp/mctp-i2c.c ++++ b/drivers/net/mctp/mctp-i2c.c +@@ -43,6 +43,7 @@ + enum { + MCTP_I2C_FLOW_STATE_NEW = 0, + MCTP_I2C_FLOW_STATE_ACTIVE, ++ MCTP_I2C_FLOW_STATE_INVALID, + }; + + /* List of all struct mctp_i2c_client +@@ -374,12 +375,18 @@ mctp_i2c_get_tx_flow_state(struct mctp_i2c_dev *midev, struct sk_buff *skb) + */ + if (!key->valid) { + state = MCTP_I2C_TX_FLOW_INVALID; +- +- } else if (key->dev_flow_state == MCTP_I2C_FLOW_STATE_NEW) { +- key->dev_flow_state = MCTP_I2C_FLOW_STATE_ACTIVE; +- state = MCTP_I2C_TX_FLOW_NEW; + } else { +- state = MCTP_I2C_TX_FLOW_EXISTING; ++ switch (key->dev_flow_state) { ++ case MCTP_I2C_FLOW_STATE_NEW: ++ key->dev_flow_state = MCTP_I2C_FLOW_STATE_ACTIVE; ++ state = MCTP_I2C_TX_FLOW_NEW; ++ break; ++ case MCTP_I2C_FLOW_STATE_ACTIVE: ++ state = MCTP_I2C_TX_FLOW_EXISTING; ++ break; ++ default: ++ state = MCTP_I2C_TX_FLOW_INVALID; ++ } + } + + spin_unlock_irqrestore(&key->lock, flags); +@@ -617,21 +624,31 @@ static void mctp_i2c_release_flow(struct mctp_dev *mdev, + + { + struct mctp_i2c_dev *midev = netdev_priv(mdev->dev); ++ bool queue_release = false; + unsigned long flags; + + spin_lock_irqsave(&midev->lock, flags); +- midev->release_count++; +- spin_unlock_irqrestore(&midev->lock, flags); +- +- /* Ensure we have a release operation queued, through the fake +- * marker skb ++ /* if we have seen the flow/key previously, we need to pair the ++ * original lock with a release + */ +- spin_lock(&midev->tx_queue.lock); +- if (!midev->unlock_marker.next) +- __skb_queue_tail(&midev->tx_queue, &midev->unlock_marker); +- spin_unlock(&midev->tx_queue.lock); ++ if (key->dev_flow_state == MCTP_I2C_FLOW_STATE_ACTIVE) { ++ midev->release_count++; ++ queue_release = true; ++ } ++ key->dev_flow_state = MCTP_I2C_FLOW_STATE_INVALID; ++ spin_unlock_irqrestore(&midev->lock, flags); + +- wake_up(&midev->tx_wq); ++ if (queue_release) { ++ /* Ensure we have a release operation queued, through the fake ++ * marker skb ++ */ ++ spin_lock(&midev->tx_queue.lock); ++ if (!midev->unlock_marker.next) ++ __skb_queue_tail(&midev->tx_queue, ++ &midev->unlock_marker); ++ spin_unlock(&midev->tx_queue.lock); ++ wake_up(&midev->tx_wq); ++ } + } + + static const struct net_device_ops mctp_i2c_ops = { +-- +2.35.1 + diff --git a/queue-6.0/mips-fix-duplicate-definitions-for-exported-symbols.patch b/queue-6.0/mips-fix-duplicate-definitions-for-exported-symbols.patch new file mode 100644 index 00000000000..485782df835 --- /dev/null +++ b/queue-6.0/mips-fix-duplicate-definitions-for-exported-symbols.patch @@ -0,0 +1,81 @@ +From 5ec87988c6554e961bce8e60ce78a7ac318ad1ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 20:27:39 +0800 +Subject: MIPS: fix duplicate definitions for exported symbols + +From: Rongwei Zhang + +[ Upstream commit 612d80784fdc0c2e2ee2e2d901a55ef2f72ebf4b ] + +Building with clang-14 fails with: + +AS arch/mips/kernel/relocate_kernel.o +:0: error: symbol 'kexec_args' is already defined +:0: error: symbol 'secondary_kexec_args' is already defined +:0: error: symbol 'kexec_start_address' is already defined +:0: error: symbol 'kexec_indirection_page' is already defined +:0: error: symbol 'relocate_new_kernel_size' is already defined + +It turns out EXPORT defined in asm/asm.h expands to a symbol definition, +so there is no need to define these symbols again. Remove duplicated +symbol definitions. + +Fixes: 7aa1c8f47e7e ("MIPS: kdump: Add support") +Signed-off-by: Rongwei Zhang +Reviewed-by: Nathan Chancellor +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/relocate_kernel.S | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +diff --git a/arch/mips/kernel/relocate_kernel.S b/arch/mips/kernel/relocate_kernel.S +index cfde14b48fd8..f5b2ef979b43 100644 +--- a/arch/mips/kernel/relocate_kernel.S ++++ b/arch/mips/kernel/relocate_kernel.S +@@ -145,8 +145,7 @@ LEAF(kexec_smp_wait) + * kexec_args[0..3] are used to prepare register values. + */ + +-kexec_args: +- EXPORT(kexec_args) ++EXPORT(kexec_args) + arg0: PTR_WD 0x0 + arg1: PTR_WD 0x0 + arg2: PTR_WD 0x0 +@@ -159,8 +158,7 @@ arg3: PTR_WD 0x0 + * their registers a0-a3. secondary_kexec_args[0..3] are used + * to prepare register values. + */ +-secondary_kexec_args: +- EXPORT(secondary_kexec_args) ++EXPORT(secondary_kexec_args) + s_arg0: PTR_WD 0x0 + s_arg1: PTR_WD 0x0 + s_arg2: PTR_WD 0x0 +@@ -171,19 +169,16 @@ kexec_flag: + + #endif + +-kexec_start_address: +- EXPORT(kexec_start_address) ++EXPORT(kexec_start_address) + PTR_WD 0x0 + .size kexec_start_address, PTRSIZE + +-kexec_indirection_page: +- EXPORT(kexec_indirection_page) ++EXPORT(kexec_indirection_page) + PTR_WD 0 + .size kexec_indirection_page, PTRSIZE + + relocate_new_kernel_end: + +-relocate_new_kernel_size: +- EXPORT(relocate_new_kernel_size) ++EXPORT(relocate_new_kernel_size) + PTR_WD relocate_new_kernel_end - relocate_new_kernel + .size relocate_new_kernel_size, PTRSIZE +-- +2.35.1 + diff --git a/queue-6.0/mips-loongson64-add-warn_on-on-kexec-related-kmalloc.patch b/queue-6.0/mips-loongson64-add-warn_on-on-kexec-related-kmalloc.patch new file mode 100644 index 00000000000..d4ffcd0f1e6 --- /dev/null +++ b/queue-6.0/mips-loongson64-add-warn_on-on-kexec-related-kmalloc.patch @@ -0,0 +1,53 @@ +From f386e5f994ee04d102405207a8bfdc5c2e570daa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 09:18:15 +0800 +Subject: MIPS: Loongson64: Add WARN_ON on kexec related kmalloc failed + +From: Liao Chang + +[ Upstream commit fa706927f4722a2df723b2a28d139b1904a3e7fa ] + +Add WARN_ON on kexec related kmalloc failed, avoid to pass NULL pointer +to following memcpy and loongson_kexec_prepare. + +Fixes: 6ce48897ce47 ("MIPS: Loongson64: Add kexec/kdump support") +Signed-off-by: Liao Chang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/loongson64/reset.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/arch/mips/loongson64/reset.c b/arch/mips/loongson64/reset.c +index 758d5d26aaaa..e420800043b0 100644 +--- a/arch/mips/loongson64/reset.c ++++ b/arch/mips/loongson64/reset.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -159,8 +160,17 @@ static int __init mips_reboot_setup(void) + + #ifdef CONFIG_KEXEC + kexec_argv = kmalloc(KEXEC_ARGV_SIZE, GFP_KERNEL); ++ if (WARN_ON(!kexec_argv)) ++ return -ENOMEM; ++ + kdump_argv = kmalloc(KEXEC_ARGV_SIZE, GFP_KERNEL); ++ if (WARN_ON(!kdump_argv)) ++ return -ENOMEM; ++ + kexec_envp = kmalloc(KEXEC_ENVP_SIZE, GFP_KERNEL); ++ if (WARN_ON(!kexec_envp)) ++ return -ENOMEM; ++ + fw_arg1 = KEXEC_ARGV_ADDR; + memcpy(kexec_envp, (void *)fw_arg2, KEXEC_ENVP_SIZE); + +-- +2.35.1 + diff --git a/queue-6.0/misdn-fix-misuse-of-put_device-in-misdn_register_dev.patch b/queue-6.0/misdn-fix-misuse-of-put_device-in-misdn_register_dev.patch new file mode 100644 index 00000000000..b199514e259 --- /dev/null +++ b/queue-6.0/misdn-fix-misuse-of-put_device-in-misdn_register_dev.patch @@ -0,0 +1,35 @@ +From 75bdb224cdf0f17398694abf30aeea3ad4245bbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 19:38:23 +0800 +Subject: mISDN: fix misuse of put_device() in mISDN_register_device() + +From: Wang ShaoBo + +[ Upstream commit 2d25107e111a85c56f601a5470f1780ec054e6ac ] + +We should not release reference by put_device() before calling device_initialize(). + +Fixes: e7d1d4d9ac0d ("mISDN: fix possible memory leak in mISDN_register_device()") +Signed-off-by: Wang ShaoBo +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/mISDN/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c +index 7ea0100f218a..90ee56d07a6e 100644 +--- a/drivers/isdn/mISDN/core.c ++++ b/drivers/isdn/mISDN/core.c +@@ -222,7 +222,7 @@ mISDN_register_device(struct mISDNdevice *dev, + + err = get_free_devid(); + if (err < 0) +- goto error1; ++ return err; + dev->id = err; + + device_initialize(&dev->dev); +-- +2.35.1 + diff --git a/queue-6.0/misdn-fix-possible-memory-leak-in-misdn_dsp_element_.patch b/queue-6.0/misdn-fix-possible-memory-leak-in-misdn_dsp_element_.patch new file mode 100644 index 00000000000..65b1d11b876 --- /dev/null +++ b/queue-6.0/misdn-fix-possible-memory-leak-in-misdn_dsp_element_.patch @@ -0,0 +1,51 @@ +From e4f56dc4bb05347c903439ce20a8eddb513bec66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 21:28:32 +0800 +Subject: mISDN: fix possible memory leak in mISDN_dsp_element_register() + +From: Yang Yingliang + +[ Upstream commit 98a2ac1ca8fd6eca6867726fe238d06e75eb1acd ] + +Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's +bus_id string array"), the name of device is allocated dynamically, +use put_device() to give up the reference, so that the name can be +freed in kobject_cleanup() when the refcount is 0. + +The 'entry' is going to be freed in mISDN_dsp_dev_release(), so the +kfree() is removed. list_del() is called in mISDN_dsp_dev_release(), +so it need be initialized. + +Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221109132832.3270119-1-yangyingliang@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/isdn/mISDN/dsp_pipeline.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/isdn/mISDN/dsp_pipeline.c b/drivers/isdn/mISDN/dsp_pipeline.c +index c3b2c99b5cd5..cfbcd9e973c2 100644 +--- a/drivers/isdn/mISDN/dsp_pipeline.c ++++ b/drivers/isdn/mISDN/dsp_pipeline.c +@@ -77,6 +77,7 @@ int mISDN_dsp_element_register(struct mISDN_dsp_element *elem) + if (!entry) + return -ENOMEM; + ++ INIT_LIST_HEAD(&entry->list); + entry->elem = elem; + + entry->dev.class = elements_class; +@@ -107,7 +108,7 @@ int mISDN_dsp_element_register(struct mISDN_dsp_element *elem) + device_unregister(&entry->dev); + return ret; + err1: +- kfree(entry); ++ put_device(&entry->dev); + return ret; + } + EXPORT_SYMBOL(mISDN_dsp_element_register); +-- +2.35.1 + diff --git a/queue-6.0/mlxsw-avoid-warnings-when-not-offloaded-fdb-entry-wi.patch b/queue-6.0/mlxsw-avoid-warnings-when-not-offloaded-fdb-entry-wi.patch new file mode 100644 index 00000000000..7a778bdcdf4 --- /dev/null +++ b/queue-6.0/mlxsw-avoid-warnings-when-not-offloaded-fdb-entry-wi.patch @@ -0,0 +1,113 @@ +From b9adddf7a807f1b3ac5dbceb328820a52ae12e04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 18:03:27 +0100 +Subject: mlxsw: Avoid warnings when not offloaded FDB entry with IPv6 is + removed + +From: Amit Cohen + +[ Upstream commit 30f5312d2c722107364f266cfa98ef4f0857c1fb ] + +FDB entries that perform VXLAN encapsulation with an IPv6 underlay hold +a reference on a resource - the KVDL entry where the IPv6 underlay +destination IP is stored. For that, the driver maintains two hash tables: +1. Maps IPv6 to KVDL index +2. Maps {MAC, FID index} to IPv6 address + +When a FDB entry is removed, the second table is used to find the relevant +IPv6 address and the first table is used to remove the reference count and +free the index if is not used anymore. + +In order for a packet to be forwarded to a single remote VTEP, FDB +entries need to be configured at both the bridge and VXLAN devices' FDB +tables. Both entries are squashed into one {MAC, VLAN/VNI} -> IP entry +in the hardware. Therefore, in case one entry is removed, the entry will +be removed from the hardware and the remaining entry will be unmarked +with 'offload' flag since it is not offloaded anymore. + +For example, the two FDB entries should be added to allow packets to be +forwarded via vx10: +$ bridge fdb add dev vx10 aa:bb:cc:dd:ee:ff self static dst 2001:db8:5::1 +$ bridge fdb add dev vx10 aa:bb:cc:dd:ee:ff master static vlan 10 + +When one entry will be removed, the second one will not be offloaded +anymore. When the first entry (in VXLAN FDB) will be removed / will not be +offloaded anymore, the two mappings in IPv6 hash tables will be removed. + +In case that the second entry is removed before the first one, unexpected +warnings[1][2] will be shown in user space as a result of removing the +first entry. The issue is that not offloaded entry is removed, the driver +tries to search the relevant entries in the hash tables, does not find them +and therefore warns. + +Do not handle removing of not offloaded VXLAN FDB entries, as they were +already removed when the offload flag was removed. + +[1]: +WARNING: CPU: 1 PID: 239 at drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c:914 mlxsw_sp_nve_ipv6_addr_map_del+0x6b/0x80 [mlxsw_spectrum] +... +Hardware name: Mellanox Technologies Ltd. Mellanox switch/Mellanox switch, BIOS 4.6.5 05/21/2015 +Workqueue: mlxsw_core_ordered mlxsw_sp_switchdev_vxlan_fdb_event_work [mlxsw_spectrum] +RIP: 0010:mlxsw_sp_nve_ipv6_addr_map_del+0x6b/0x80 [mlxsw_spectrum] +... +Call Trace: + + mlxsw_sp_port_fdb_tunnel_uc_op+0x6cf/0x7b0 [mlxsw_spectrum] + mlxsw_sp_switchdev_vxlan_fdb_event_work+0x17c/0x420 [mlxsw_spectrum] + ? finish_task_switch.isra.0+0x8c/0x290 + process_one_work+0x1cd/0x390 + worker_thread+0x48/0x3c0 + ? process_one_work+0x390/0x390 + kthread+0xe0/0x110 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x1f/0x30 + + +[2]: +WARNING: CPU: 0 PID: 239 at drivers/net/ethernet/mellanox/mlxsw/spectrum.c:3035 mlxsw_sp_ipv6_addr_put+0x142/0x220 [mlxsw_spectrum] +... +Hardware name: Mellanox Technologies Ltd. Mellanox switch/Mellanox switch, BIOS 4.6.5 05/21/2015 +Workqueue: mlxsw_core_ordered mlxsw_sp_switchdev_vxlan_fdb_event_work [mlxsw_spectrum] +RIP: 0010:mlxsw_sp_ipv6_addr_put+0x142/0x220 [mlxsw_spectrum] +... +Call Trace: + + ? mlxsw_sp_port_fdb_tun_uc_op6_sfd_write+0x5c1/0x610 [mlxsw_spectrum] + mlxsw_sp_port_fdb_tunnel_uc_op+0x6ec/0x7b0 [mlxsw_spectrum] + mlxsw_sp_switchdev_vxlan_fdb_event_work+0x17c/0x420 [mlxsw_spectrum] + ? finish_task_switch.isra.0+0x8c/0x290 + process_one_work+0x1cd/0x390 + worker_thread+0x48/0x3c0 + ? process_one_work+0x390/0x390 + kthread+0xe0/0x110 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x1f/0x30 + + +Fixes: 0860c7641634 ("mlxsw: spectrum_nve: Keep track of IPv6 addresses used by FDB entries") +Signed-off-by: Amit Cohen +Reviewed-by: Ido Schimmel +Signed-off-by: Petr Machata +Link: https://lore.kernel.org/r/c186de8cbd28e3eb661e06f31f7f2f2dff30020f.1668184350.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +index 4efccd942fb8..1290b2d3eae6 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -3470,6 +3470,8 @@ mlxsw_sp_switchdev_vxlan_fdb_del(struct mlxsw_sp *mlxsw_sp, + u16 vid; + + vxlan_fdb_info = &switchdev_work->vxlan_fdb_info; ++ if (!vxlan_fdb_info->offloaded) ++ return; + + bridge_device = mlxsw_sp_bridge_device_find(mlxsw_sp->bridge, br_dev); + if (!bridge_device) +-- +2.35.1 + diff --git a/queue-6.0/mtd-onenand-omap2-add-dependency-on-gpmc.patch b/queue-6.0/mtd-onenand-omap2-add-dependency-on-gpmc.patch new file mode 100644 index 00000000000..6eaa144a255 --- /dev/null +++ b/queue-6.0/mtd-onenand-omap2-add-dependency-on-gpmc.patch @@ -0,0 +1,44 @@ +From f5a0df6e38aa061250722b21491e13b56dc230b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Nov 2022 10:15:20 +0100 +Subject: mtd: onenand: omap2: add dependency on GPMC + +From: Krzysztof Kozlowski + +[ Upstream commit c717b9b7d6de9e024e47f7cd5bbff49f581d3db9 ] + +OMAP2 OneNAND driver uses gpmc_omap_onenand_set_timings() provided by +OMAP_GPMC driver, so the latter cannot be module if OneNAND driver is +built-in: + + /usr/bin/arm-linux-gnueabi-ld: drivers/mtd/nand/onenand/onenand_omap2.o: in function `omap2_onenand_probe': + onenand_omap2.c:(.text+0x520): undefined reference to `gpmc_omap_onenand_set_timings' + +The OMAP_GPMC is also a runtime dependency. + +Reported-by: kernel test robot +Fixes: 854fd9209b20 ("memory: omap-gpmc: Allow building as a module") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Roger Quadros +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20221107091520.127053-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/onenand/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mtd/nand/onenand/Kconfig b/drivers/mtd/nand/onenand/Kconfig +index 34d9a7a82ad4..c94bf483541e 100644 +--- a/drivers/mtd/nand/onenand/Kconfig ++++ b/drivers/mtd/nand/onenand/Kconfig +@@ -26,6 +26,7 @@ config MTD_ONENAND_OMAP2 + tristate "OneNAND on OMAP2/OMAP3 support" + depends on ARCH_OMAP2 || ARCH_OMAP3 || (COMPILE_TEST && ARM) + depends on OF || COMPILE_TEST ++ depends on OMAP_GPMC + help + Support for a OneNAND flash device connected to an OMAP2/OMAP3 SoC + via the GPMC memory controller. +-- +2.35.1 + diff --git a/queue-6.0/net-ag71xx-call-phylink_disconnect_phy-if-ag71xx_hw_.patch b/queue-6.0/net-ag71xx-call-phylink_disconnect_phy-if-ag71xx_hw_.patch new file mode 100644 index 00000000000..6e84261ea64 --- /dev/null +++ b/queue-6.0/net-ag71xx-call-phylink_disconnect_phy-if-ag71xx_hw_.patch @@ -0,0 +1,48 @@ +From 7d3d2cda29c4bbd0f2b0796036ca15e8c751f110 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 17:55:49 +0800 +Subject: net: ag71xx: call phylink_disconnect_phy if ag71xx_hw_enable() fail + in ag71xx_open() + +From: Liu Jian + +[ Upstream commit c9b895c6878bdb6789dc1d7af60fd10f4a9f1937 ] + +If ag71xx_hw_enable() fails, call phylink_disconnect_phy() to clean up. +And if phylink_of_phy_connect() fails, nothing needs to be done. +Compile tested only. + +Fixes: 892e09153fa3 ("net: ag71xx: port to phylink") +Signed-off-by: Liu Jian +Reviewed-by: Russell King (Oracle) +Link: https://lore.kernel.org/r/20221114095549.40342-1-liujian56@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/atheros/ag71xx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c +index e461f4764066..e23d8734d4e4 100644 +--- a/drivers/net/ethernet/atheros/ag71xx.c ++++ b/drivers/net/ethernet/atheros/ag71xx.c +@@ -1427,7 +1427,7 @@ static int ag71xx_open(struct net_device *ndev) + if (ret) { + netif_err(ag, link, ndev, "phylink_of_phy_connect filed with err: %i\n", + ret); +- goto err; ++ return ret; + } + + max_frame_len = ag71xx_max_frame_len(ndev->mtu); +@@ -1448,6 +1448,7 @@ static int ag71xx_open(struct net_device *ndev) + + err: + ag71xx_rings_cleanup(ag); ++ phylink_disconnect_phy(ag->phylink); + return ret; + } + +-- +2.35.1 + diff --git a/queue-6.0/net-bgmac-drop-free_netdev-from-bgmac_enet_remove.patch b/queue-6.0/net-bgmac-drop-free_netdev-from-bgmac_enet_remove.patch new file mode 100644 index 00000000000..a51eae94c78 --- /dev/null +++ b/queue-6.0/net-bgmac-drop-free_netdev-from-bgmac_enet_remove.patch @@ -0,0 +1,38 @@ +From 8d3ece31d706afccbb51986a4a94d51f7b224135 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 15:01:36 +0000 +Subject: net: bgmac: Drop free_netdev() from bgmac_enet_remove() + +From: Wei Yongjun + +[ Upstream commit 6f928ab8ee9bfbcb0e631c47ea8a16c3d5116ff1 ] + +netdev is allocated in bgmac_alloc() with devm_alloc_etherdev() and will +be auto released in ->remove and ->probe failure path. Using free_netdev() +in bgmac_enet_remove() leads to double free. + +Fixes: 34a5102c3235 ("net: bgmac: allocate struct bgmac just once & don't copy it") +Signed-off-by: Wei Yongjun + +Link: https://lore.kernel.org/r/20221109150136.2991171-1-weiyongjun@huaweicloud.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bgmac.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c +index 93580484a3f4..91c054eef701 100644 +--- a/drivers/net/ethernet/broadcom/bgmac.c ++++ b/drivers/net/ethernet/broadcom/bgmac.c +@@ -1568,7 +1568,6 @@ void bgmac_enet_remove(struct bgmac *bgmac) + phy_disconnect(bgmac->net_dev->phydev); + netif_napi_del(&bgmac->napi); + bgmac_dma_free(bgmac); +- free_netdev(bgmac->net_dev); + } + EXPORT_SYMBOL_GPL(bgmac_enet_remove); + +-- +2.35.1 + diff --git a/queue-6.0/net-caif-fix-double-disconnect-client-in-chnl_net_op.patch b/queue-6.0/net-caif-fix-double-disconnect-client-in-chnl_net_op.patch new file mode 100644 index 00000000000..74b0c4e6f94 --- /dev/null +++ b/queue-6.0/net-caif-fix-double-disconnect-client-in-chnl_net_op.patch @@ -0,0 +1,37 @@ +From 3f2ccae1764a49bc15c75582001b7b9c94bcb5ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 09:47:34 +0800 +Subject: net: caif: fix double disconnect client in chnl_net_open() + +From: Zhengchao Shao + +[ Upstream commit 8fbb53c8bfd8c56ecf1f78dc821778b58f505503 ] + +When connecting to client timeout, disconnect client for twice in +chnl_net_open(). Remove one. Compile tested only. + +Fixes: 2aa40aef9deb ("caif: Use link layer MTU instead of fixed MTU") +Signed-off-by: Zhengchao Shao +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/caif/chnl_net.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c +index 4d63ef13a1fd..f35fc87c453a 100644 +--- a/net/caif/chnl_net.c ++++ b/net/caif/chnl_net.c +@@ -310,9 +310,6 @@ static int chnl_net_open(struct net_device *dev) + + if (result == 0) { + pr_debug("connect timeout\n"); +- caif_disconnect_client(dev_net(dev), &priv->chnl); +- priv->state = CAIF_DISCONNECTED; +- pr_debug("state disconnected\n"); + result = -ETIMEDOUT; + goto error; + } +-- +2.35.1 + diff --git a/queue-6.0/net-dsa-don-t-leak-tagger-owned-storage-on-switch-dr.patch b/queue-6.0/net-dsa-don-t-leak-tagger-owned-storage-on-switch-dr.patch new file mode 100644 index 00000000000..9699f64cdf2 --- /dev/null +++ b/queue-6.0/net-dsa-don-t-leak-tagger-owned-storage-on-switch-dr.patch @@ -0,0 +1,84 @@ +From 529d959e5a938c3e2acb7aaa5126231ced047677 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 16:35:51 +0200 +Subject: net: dsa: don't leak tagger-owned storage on switch driver unbind + +From: Vladimir Oltean + +[ Upstream commit 4e0c19fcb8b5323716140fa82b79aa9f60e60407 ] + +In the initial commit dc452a471dba ("net: dsa: introduce tagger-owned +storage for private and shared data"), we had a call to +tag_ops->disconnect(dst) issued from dsa_tree_free(), which is called at +tree teardown time. + +There were problems with connecting to a switch tree as a whole, so this +got reworked to connecting to individual switches within the tree. In +this process, tag_ops->disconnect(ds) was made to be called only from +switch.c (cross-chip notifiers emitted as a result of dynamic tag proto +changes), but the normal driver teardown code path wasn't replaced with +anything. + +Solve this problem by adding a function that does the opposite of +dsa_switch_setup_tag_protocol(), which is called from the equivalent +spot in dsa_switch_teardown(). The positioning here also ensures that we +won't have any use-after-free in tagging protocol (*rcv) ops, since the +teardown sequence is as follows: + +dsa_tree_teardown +-> dsa_tree_teardown_master + -> dsa_master_teardown + -> unsets master->dsa_ptr, making no further packets match the + ETH_P_XDSA packet type handler +-> dsa_tree_teardown_ports + -> dsa_port_teardown + -> dsa_slave_destroy + -> unregisters DSA net devices, there is even a synchronize_net() + in unregister_netdevice_many() +-> dsa_tree_teardown_switches + -> dsa_switch_teardown + -> dsa_switch_teardown_tag_protocol + -> finally frees the tagger-owned storage + +Fixes: 7f2973149c22 ("net: dsa: make tagging protocols connect to individual switches from a tree") +Signed-off-by: Vladimir Oltean +Reviewed-by: Saeed Mahameed +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20221114143551.1906361-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/dsa/dsa2.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c +index e537655e442b..befa954b0a47 100644 +--- a/net/dsa/dsa2.c ++++ b/net/dsa/dsa2.c +@@ -850,6 +850,14 @@ static int dsa_switch_setup_tag_protocol(struct dsa_switch *ds) + return err; + } + ++static void dsa_switch_teardown_tag_protocol(struct dsa_switch *ds) ++{ ++ const struct dsa_device_ops *tag_ops = ds->dst->tag_ops; ++ ++ if (tag_ops->disconnect) ++ tag_ops->disconnect(ds); ++} ++ + static int dsa_switch_setup(struct dsa_switch *ds) + { + struct dsa_devlink_priv *dl_priv; +@@ -953,6 +961,8 @@ static void dsa_switch_teardown(struct dsa_switch *ds) + ds->slave_mii_bus = NULL; + } + ++ dsa_switch_teardown_tag_protocol(ds); ++ + if (ds->ops->teardown) + ds->ops->teardown(ds); + +-- +2.35.1 + diff --git a/queue-6.0/net-dsa-make-dsa_master_ioctl-see-through-port_hwtst.patch b/queue-6.0/net-dsa-make-dsa_master_ioctl-see-through-port_hwtst.patch new file mode 100644 index 00000000000..650f5e518a7 --- /dev/null +++ b/queue-6.0/net-dsa-make-dsa_master_ioctl-see-through-port_hwtst.patch @@ -0,0 +1,108 @@ +From 87d4a9f78f29217db127ff9ca51939b3f9258645 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 23:10:20 +0200 +Subject: net: dsa: make dsa_master_ioctl() see through port_hwtstamp_get() + shims +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vladimir Oltean + +[ Upstream commit ed1fe1bebe18884b11e5536b5ac42e3a48960835 ] + +There are multi-generational drivers like mv88e6xxx which have code like +this: + +int mv88e6xxx_port_hwtstamp_get(struct dsa_switch *ds, int port, + struct ifreq *ifr) +{ + if (!chip->info->ptp_support) + return -EOPNOTSUPP; + + ... +} + +DSA wants to deny PTP timestamping on the master if the switch supports +timestamping too. However it currently relies on the presence of the +port_hwtstamp_get() callback to determine PTP capability, and this +clearly does not work in that case (method is present but returns +-EOPNOTSUPP). + +We should not deny PTP on the DSA master for those switches which truly +do not support hardware timestamping. + +Create a dsa_port_supports_hwtstamp() method which actually probes for +support by calling port_hwtstamp_get() and seeing whether that returned +-EOPNOTSUPP or not. + +Fixes: f685e609a301 ("net: dsa: Deny PTP on master if switch supports it") +Link: https://patchwork.kernel.org/project/netdevbpf/patch/20221110124345.3901389-1-festevam@gmail.com/ +Reported-by: Fabio Estevam +Reported-by: Steffen Bätz +Signed-off-by: Vladimir Oltean +Tested-by: Fabio Estevam +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/dsa_priv.h | 1 + + net/dsa/master.c | 3 +-- + net/dsa/port.c | 16 ++++++++++++++++ + 3 files changed, 18 insertions(+), 2 deletions(-) + +diff --git a/net/dsa/dsa_priv.h b/net/dsa/dsa_priv.h +index d9722e49864b..acea875c05e5 100644 +--- a/net/dsa/dsa_priv.h ++++ b/net/dsa/dsa_priv.h +@@ -201,6 +201,7 @@ static inline struct net_device *dsa_master_find_slave(struct net_device *dev, + } + + /* port.c */ ++bool dsa_port_supports_hwtstamp(struct dsa_port *dp, struct ifreq *ifr); + void dsa_port_set_tag_protocol(struct dsa_port *cpu_dp, + const struct dsa_device_ops *tag_ops); + int dsa_port_set_state(struct dsa_port *dp, u8 state, bool do_fast_age); +diff --git a/net/dsa/master.c b/net/dsa/master.c +index 2851e44c4cf0..46b1f0455a7b 100644 +--- a/net/dsa/master.c ++++ b/net/dsa/master.c +@@ -204,8 +204,7 @@ static int dsa_master_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + * switch in the tree that is PTP capable. + */ + list_for_each_entry(dp, &dst->ports, list) +- if (dp->ds->ops->port_hwtstamp_get || +- dp->ds->ops->port_hwtstamp_set) ++ if (dsa_port_supports_hwtstamp(dp, ifr)) + return -EBUSY; + break; + } +diff --git a/net/dsa/port.c b/net/dsa/port.c +index a8895ee3cd60..9ac87063cca8 100644 +--- a/net/dsa/port.c ++++ b/net/dsa/port.c +@@ -109,6 +109,22 @@ static bool dsa_port_can_configure_learning(struct dsa_port *dp) + return !err; + } + ++bool dsa_port_supports_hwtstamp(struct dsa_port *dp, struct ifreq *ifr) ++{ ++ struct dsa_switch *ds = dp->ds; ++ int err; ++ ++ if (!ds->ops->port_hwtstamp_get || !ds->ops->port_hwtstamp_set) ++ return false; ++ ++ /* "See through" shim implementations of the "get" method. ++ * This will clobber the ifreq structure, but we will either return an ++ * error, or the master will overwrite it with proper values. ++ */ ++ err = ds->ops->port_hwtstamp_get(ds, dp->index, ifr); ++ return err != -EOPNOTSUPP; ++} ++ + int dsa_port_set_state(struct dsa_port *dp, u8 state, bool do_fast_age) + { + struct dsa_switch *ds = dp->ds; +-- +2.35.1 + diff --git a/queue-6.0/net-ena-fix-error-handling-in-ena_init.patch b/queue-6.0/net-ena-fix-error-handling-in-ena_init.patch new file mode 100644 index 00000000000..b0c6a5784d7 --- /dev/null +++ b/queue-6.0/net-ena-fix-error-handling-in-ena_init.patch @@ -0,0 +1,52 @@ +From 1756350071f293451314a3bf577bc21665886b56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 02:56:59 +0000 +Subject: net: ena: Fix error handling in ena_init() + +From: Yuan Can + +[ Upstream commit d349e9be5a2c2d7588a2c4e4bfa0bb3dc1226769 ] + +The ena_init() won't destroy workqueue created by +create_singlethread_workqueue() when pci_register_driver() failed. +Call destroy_workqueue() when pci_register_driver() failed to prevent the +resource leak. + +Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") +Signed-off-by: Yuan Can +Acked-by: Shay Agroskin +Link: https://lore.kernel.org/r/20221114025659.124726-1-yuancan@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index 6a356a6cee15..41c821348476 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -4545,13 +4545,19 @@ static struct pci_driver ena_pci_driver = { + + static int __init ena_init(void) + { ++ int ret; ++ + ena_wq = create_singlethread_workqueue(DRV_MODULE_NAME); + if (!ena_wq) { + pr_err("Failed to create workqueue\n"); + return -ENOMEM; + } + +- return pci_register_driver(&ena_pci_driver); ++ ret = pci_register_driver(&ena_pci_driver); ++ if (ret) ++ destroy_workqueue(ena_wq); ++ ++ return ret; + } + + static void __exit ena_cleanup(void) +-- +2.35.1 + diff --git a/queue-6.0/net-hinic-fix-error-handling-in-hinic_module_init.patch b/queue-6.0/net-hinic-fix-error-handling-in-hinic_module_init.patch new file mode 100644 index 00000000000..51eeee1e8ff --- /dev/null +++ b/queue-6.0/net-hinic-fix-error-handling-in-hinic_module_init.patch @@ -0,0 +1,63 @@ +From 8c1d493b18fe5f88a2316a763b596738690b5285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 02:16:42 +0000 +Subject: net: hinic: Fix error handling in hinic_module_init() + +From: Yuan Can + +[ Upstream commit 8eab9be56cc6b702a445d2b6d0256aa0992316b3 ] + +A problem about hinic create debugfs failed is triggered with the +following log given: + + [ 931.419023] debugfs: Directory 'hinic' with parent '/' already present! + +The reason is that hinic_module_init() returns pci_register_driver() +directly without checking its return value, if pci_register_driver() +failed, it returns without destroy the newly created debugfs, resulting +the debugfs of hinic can never be created later. + + hinic_module_init() + hinic_dbg_register_debugfs() # create debugfs directory + pci_register_driver() + driver_register() + bus_add_driver() + priv = kzalloc(...) # OOM happened + # return without destroy debugfs directory + +Fix by removing debugfs when pci_register_driver() returns error. + +Fixes: 253ac3a97921 ("hinic: add support to query sq info") +Signed-off-by: Yuan Can +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20221110021642.80378-1-yuancan@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/huawei/hinic/hinic_main.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c +index c23ee2ddbce3..1a6534c35ef3 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c +@@ -1478,8 +1478,15 @@ static struct pci_driver hinic_driver = { + + static int __init hinic_module_init(void) + { ++ int ret; ++ + hinic_dbg_register_debugfs(HINIC_DRV_NAME); +- return pci_register_driver(&hinic_driver); ++ ++ ret = pci_register_driver(&hinic_driver); ++ if (ret) ++ hinic_dbg_unregister_debugfs(); ++ ++ return ret; + } + + static void __exit hinic_module_exit(void) +-- +2.35.1 + diff --git a/queue-6.0/net-hns3-fix-incorrect-hw-rss-hash-type-of-rx-packet.patch b/queue-6.0/net-hns3-fix-incorrect-hw-rss-hash-type-of-rx-packet.patch new file mode 100644 index 00000000000..72dc264b372 --- /dev/null +++ b/queue-6.0/net-hns3-fix-incorrect-hw-rss-hash-type-of-rx-packet.patch @@ -0,0 +1,342 @@ +From 05769372effe5c64fabe8fb7830d871b812aa3d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 16:20:46 +0800 +Subject: net: hns3: fix incorrect hw rss hash type of rx packet + +From: Jian Shen + +[ Upstream commit a56cad694767ebdb7d80f27ffc239db46fff64de ] + +Currently, the HNS3 driver reports the rss hash type +of each packet based on the rss hash tuples set. It +always reports PKT_HASH_TYPE_L4, without checking the +type of current packet. It's incorrect. +Fixes it by reporting it base on the packet type. + +Fixes: 796640778c26 ("net: hns3: support RXD advanced layout") +Fixes: 232fc64b6e62 ("net: hns3: Add HW RSS hash information to RX skb") +Fixes: ea4858670717 ("net: hns3: handle the BD info on the last BD of the packet") +Signed-off-by: Jian Shen +Signed-off-by: Hao Lan +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 - + .../hns3/hns3_common/hclge_comm_rss.c | 20 --- + .../hns3/hns3_common/hclge_comm_rss.h | 2 - + .../net/ethernet/hisilicon/hns3/hns3_enet.c | 163 ++++++++++-------- + .../net/ethernet/hisilicon/hns3/hns3_enet.h | 1 + + .../hisilicon/hns3/hns3pf/hclge_main.c | 1 - + 6 files changed, 94 insertions(+), 94 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +index 94f80e1c4020..bf7daab88689 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +@@ -790,7 +790,6 @@ struct hnae3_knic_private_info { + const struct hnae3_dcb_ops *dcb_ops; + + u16 int_rl_setting; +- enum pkt_hash_types rss_type; + void __iomem *io_base; + }; + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c +index e23729ac3bb8..ae2736549526 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c +@@ -191,23 +191,6 @@ u32 hclge_comm_get_rss_key_size(struct hnae3_handle *handle) + return HCLGE_COMM_RSS_KEY_SIZE; + } + +-void hclge_comm_get_rss_type(struct hnae3_handle *nic, +- struct hclge_comm_rss_tuple_cfg *rss_tuple_sets) +-{ +- if (rss_tuple_sets->ipv4_tcp_en || +- rss_tuple_sets->ipv4_udp_en || +- rss_tuple_sets->ipv4_sctp_en || +- rss_tuple_sets->ipv6_tcp_en || +- rss_tuple_sets->ipv6_udp_en || +- rss_tuple_sets->ipv6_sctp_en) +- nic->kinfo.rss_type = PKT_HASH_TYPE_L4; +- else if (rss_tuple_sets->ipv4_fragment_en || +- rss_tuple_sets->ipv6_fragment_en) +- nic->kinfo.rss_type = PKT_HASH_TYPE_L3; +- else +- nic->kinfo.rss_type = PKT_HASH_TYPE_NONE; +-} +- + int hclge_comm_parse_rss_hfunc(struct hclge_comm_rss_cfg *rss_cfg, + const u8 hfunc, u8 *hash_algo) + { +@@ -344,9 +327,6 @@ int hclge_comm_set_rss_input_tuple(struct hnae3_handle *nic, + req->ipv6_sctp_en = rss_cfg->rss_tuple_sets.ipv6_sctp_en; + req->ipv6_fragment_en = rss_cfg->rss_tuple_sets.ipv6_fragment_en; + +- if (is_pf) +- hclge_comm_get_rss_type(nic, &rss_cfg->rss_tuple_sets); +- + ret = hclge_comm_cmd_send(hw, &desc, 1); + if (ret) + dev_err(&hw->cmq.csq.pdev->dev, +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.h b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.h +index 946d166a452d..92af3d2980d3 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.h +@@ -95,8 +95,6 @@ struct hclge_comm_rss_tc_mode_cmd { + }; + + u32 hclge_comm_get_rss_key_size(struct hnae3_handle *handle); +-void hclge_comm_get_rss_type(struct hnae3_handle *nic, +- struct hclge_comm_rss_tuple_cfg *rss_tuple_sets); + void hclge_comm_rss_indir_init_cfg(struct hnae3_ae_dev *ae_dev, + struct hclge_comm_rss_cfg *rss_cfg); + int hclge_comm_get_rss_tuple(struct hclge_comm_rss_cfg *rss_cfg, int flow_type, +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 35d70041b9e8..944f36e4d66f 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -105,26 +105,28 @@ static const struct pci_device_id hns3_pci_tbl[] = { + }; + MODULE_DEVICE_TABLE(pci, hns3_pci_tbl); + +-#define HNS3_RX_PTYPE_ENTRY(ptype, l, s, t) \ ++#define HNS3_RX_PTYPE_ENTRY(ptype, l, s, t, h) \ + { ptype, \ + l, \ + CHECKSUM_##s, \ + HNS3_L3_TYPE_##t, \ +- 1 } ++ 1, \ ++ h} + + #define HNS3_RX_PTYPE_UNUSED_ENTRY(ptype) \ +- { ptype, 0, CHECKSUM_NONE, HNS3_L3_TYPE_PARSE_FAIL, 0 } ++ { ptype, 0, CHECKSUM_NONE, HNS3_L3_TYPE_PARSE_FAIL, 0, \ ++ PKT_HASH_TYPE_NONE } + + static const struct hns3_rx_ptype hns3_rx_ptype_tbl[] = { + HNS3_RX_PTYPE_UNUSED_ENTRY(0), +- HNS3_RX_PTYPE_ENTRY(1, 0, COMPLETE, ARP), +- HNS3_RX_PTYPE_ENTRY(2, 0, COMPLETE, RARP), +- HNS3_RX_PTYPE_ENTRY(3, 0, COMPLETE, LLDP), +- HNS3_RX_PTYPE_ENTRY(4, 0, COMPLETE, PARSE_FAIL), +- HNS3_RX_PTYPE_ENTRY(5, 0, COMPLETE, PARSE_FAIL), +- HNS3_RX_PTYPE_ENTRY(6, 0, COMPLETE, PARSE_FAIL), +- HNS3_RX_PTYPE_ENTRY(7, 0, COMPLETE, CNM), +- HNS3_RX_PTYPE_ENTRY(8, 0, NONE, PARSE_FAIL), ++ HNS3_RX_PTYPE_ENTRY(1, 0, COMPLETE, ARP, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(2, 0, COMPLETE, RARP, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(3, 0, COMPLETE, LLDP, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(4, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(5, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(6, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(7, 0, COMPLETE, CNM, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(8, 0, NONE, PARSE_FAIL, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_UNUSED_ENTRY(9), + HNS3_RX_PTYPE_UNUSED_ENTRY(10), + HNS3_RX_PTYPE_UNUSED_ENTRY(11), +@@ -132,36 +134,36 @@ static const struct hns3_rx_ptype hns3_rx_ptype_tbl[] = { + HNS3_RX_PTYPE_UNUSED_ENTRY(13), + HNS3_RX_PTYPE_UNUSED_ENTRY(14), + HNS3_RX_PTYPE_UNUSED_ENTRY(15), +- HNS3_RX_PTYPE_ENTRY(16, 0, COMPLETE, PARSE_FAIL), +- HNS3_RX_PTYPE_ENTRY(17, 0, COMPLETE, IPV4), +- HNS3_RX_PTYPE_ENTRY(18, 0, COMPLETE, IPV4), +- HNS3_RX_PTYPE_ENTRY(19, 0, UNNECESSARY, IPV4), +- HNS3_RX_PTYPE_ENTRY(20, 0, UNNECESSARY, IPV4), +- HNS3_RX_PTYPE_ENTRY(21, 0, NONE, IPV4), +- HNS3_RX_PTYPE_ENTRY(22, 0, UNNECESSARY, IPV4), +- HNS3_RX_PTYPE_ENTRY(23, 0, NONE, IPV4), +- HNS3_RX_PTYPE_ENTRY(24, 0, NONE, IPV4), +- HNS3_RX_PTYPE_ENTRY(25, 0, UNNECESSARY, IPV4), ++ HNS3_RX_PTYPE_ENTRY(16, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(17, 0, COMPLETE, IPV4, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(18, 0, COMPLETE, IPV4, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(19, 0, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(20, 0, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(21, 0, NONE, IPV4, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(22, 0, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(23, 0, NONE, IPV4, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(24, 0, NONE, IPV4, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(25, 0, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_UNUSED_ENTRY(26), + HNS3_RX_PTYPE_UNUSED_ENTRY(27), + HNS3_RX_PTYPE_UNUSED_ENTRY(28), +- HNS3_RX_PTYPE_ENTRY(29, 0, COMPLETE, PARSE_FAIL), +- HNS3_RX_PTYPE_ENTRY(30, 0, COMPLETE, PARSE_FAIL), +- HNS3_RX_PTYPE_ENTRY(31, 0, COMPLETE, IPV4), +- HNS3_RX_PTYPE_ENTRY(32, 0, COMPLETE, IPV4), +- HNS3_RX_PTYPE_ENTRY(33, 1, UNNECESSARY, IPV4), +- HNS3_RX_PTYPE_ENTRY(34, 1, UNNECESSARY, IPV4), +- HNS3_RX_PTYPE_ENTRY(35, 1, UNNECESSARY, IPV4), +- HNS3_RX_PTYPE_ENTRY(36, 0, COMPLETE, IPV4), +- HNS3_RX_PTYPE_ENTRY(37, 0, COMPLETE, IPV4), ++ HNS3_RX_PTYPE_ENTRY(29, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(30, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(31, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(32, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(33, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(34, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(35, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(36, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(37, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_UNUSED_ENTRY(38), +- HNS3_RX_PTYPE_ENTRY(39, 0, COMPLETE, IPV6), +- HNS3_RX_PTYPE_ENTRY(40, 0, COMPLETE, IPV6), +- HNS3_RX_PTYPE_ENTRY(41, 1, UNNECESSARY, IPV6), +- HNS3_RX_PTYPE_ENTRY(42, 1, UNNECESSARY, IPV6), +- HNS3_RX_PTYPE_ENTRY(43, 1, UNNECESSARY, IPV6), +- HNS3_RX_PTYPE_ENTRY(44, 0, COMPLETE, IPV6), +- HNS3_RX_PTYPE_ENTRY(45, 0, COMPLETE, IPV6), ++ HNS3_RX_PTYPE_ENTRY(39, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(40, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(41, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(42, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(43, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(44, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(45, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_UNUSED_ENTRY(46), + HNS3_RX_PTYPE_UNUSED_ENTRY(47), + HNS3_RX_PTYPE_UNUSED_ENTRY(48), +@@ -227,35 +229,35 @@ static const struct hns3_rx_ptype hns3_rx_ptype_tbl[] = { + HNS3_RX_PTYPE_UNUSED_ENTRY(108), + HNS3_RX_PTYPE_UNUSED_ENTRY(109), + HNS3_RX_PTYPE_UNUSED_ENTRY(110), +- HNS3_RX_PTYPE_ENTRY(111, 0, COMPLETE, IPV6), +- HNS3_RX_PTYPE_ENTRY(112, 0, COMPLETE, IPV6), +- HNS3_RX_PTYPE_ENTRY(113, 0, UNNECESSARY, IPV6), +- HNS3_RX_PTYPE_ENTRY(114, 0, UNNECESSARY, IPV6), +- HNS3_RX_PTYPE_ENTRY(115, 0, NONE, IPV6), +- HNS3_RX_PTYPE_ENTRY(116, 0, UNNECESSARY, IPV6), +- HNS3_RX_PTYPE_ENTRY(117, 0, NONE, IPV6), +- HNS3_RX_PTYPE_ENTRY(118, 0, NONE, IPV6), +- HNS3_RX_PTYPE_ENTRY(119, 0, UNNECESSARY, IPV6), ++ HNS3_RX_PTYPE_ENTRY(111, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(112, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(113, 0, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(114, 0, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(115, 0, NONE, IPV6, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(116, 0, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(117, 0, NONE, IPV6, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(118, 0, NONE, IPV6, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(119, 0, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_UNUSED_ENTRY(120), + HNS3_RX_PTYPE_UNUSED_ENTRY(121), + HNS3_RX_PTYPE_UNUSED_ENTRY(122), +- HNS3_RX_PTYPE_ENTRY(123, 0, COMPLETE, PARSE_FAIL), +- HNS3_RX_PTYPE_ENTRY(124, 0, COMPLETE, PARSE_FAIL), +- HNS3_RX_PTYPE_ENTRY(125, 0, COMPLETE, IPV4), +- HNS3_RX_PTYPE_ENTRY(126, 0, COMPLETE, IPV4), +- HNS3_RX_PTYPE_ENTRY(127, 1, UNNECESSARY, IPV4), +- HNS3_RX_PTYPE_ENTRY(128, 1, UNNECESSARY, IPV4), +- HNS3_RX_PTYPE_ENTRY(129, 1, UNNECESSARY, IPV4), +- HNS3_RX_PTYPE_ENTRY(130, 0, COMPLETE, IPV4), +- HNS3_RX_PTYPE_ENTRY(131, 0, COMPLETE, IPV4), ++ HNS3_RX_PTYPE_ENTRY(123, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(124, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), ++ HNS3_RX_PTYPE_ENTRY(125, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(126, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(127, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(128, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(129, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(130, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(131, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_UNUSED_ENTRY(132), +- HNS3_RX_PTYPE_ENTRY(133, 0, COMPLETE, IPV6), +- HNS3_RX_PTYPE_ENTRY(134, 0, COMPLETE, IPV6), +- HNS3_RX_PTYPE_ENTRY(135, 1, UNNECESSARY, IPV6), +- HNS3_RX_PTYPE_ENTRY(136, 1, UNNECESSARY, IPV6), +- HNS3_RX_PTYPE_ENTRY(137, 1, UNNECESSARY, IPV6), +- HNS3_RX_PTYPE_ENTRY(138, 0, COMPLETE, IPV6), +- HNS3_RX_PTYPE_ENTRY(139, 0, COMPLETE, IPV6), ++ HNS3_RX_PTYPE_ENTRY(133, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(134, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(135, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(136, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(137, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), ++ HNS3_RX_PTYPE_ENTRY(138, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), ++ HNS3_RX_PTYPE_ENTRY(139, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_UNUSED_ENTRY(140), + HNS3_RX_PTYPE_UNUSED_ENTRY(141), + HNS3_RX_PTYPE_UNUSED_ENTRY(142), +@@ -4129,15 +4131,35 @@ static int hns3_set_gro_and_checksum(struct hns3_enet_ring *ring, + } + + static void hns3_set_rx_skb_rss_type(struct hns3_enet_ring *ring, +- struct sk_buff *skb, u32 rss_hash) ++ struct sk_buff *skb, u32 rss_hash, ++ u32 l234info, u32 ol_info) + { +- struct hnae3_handle *handle = ring->tqp->handle; +- enum pkt_hash_types rss_type; ++ enum pkt_hash_types rss_type = PKT_HASH_TYPE_NONE; ++ struct net_device *netdev = ring_to_netdev(ring); ++ struct hns3_nic_priv *priv = netdev_priv(netdev); + +- if (rss_hash) +- rss_type = handle->kinfo.rss_type; +- else +- rss_type = PKT_HASH_TYPE_NONE; ++ if (test_bit(HNS3_NIC_STATE_RXD_ADV_LAYOUT_ENABLE, &priv->state)) { ++ u32 ptype = hnae3_get_field(ol_info, HNS3_RXD_PTYPE_M, ++ HNS3_RXD_PTYPE_S); ++ ++ rss_type = hns3_rx_ptype_tbl[ptype].hash_type; ++ } else { ++ int l3_type = hnae3_get_field(l234info, HNS3_RXD_L3ID_M, ++ HNS3_RXD_L3ID_S); ++ int l4_type = hnae3_get_field(l234info, HNS3_RXD_L4ID_M, ++ HNS3_RXD_L4ID_S); ++ ++ if (l3_type == HNS3_L3_TYPE_IPV4 || ++ l3_type == HNS3_L3_TYPE_IPV6) { ++ if (l4_type == HNS3_L4_TYPE_UDP || ++ l4_type == HNS3_L4_TYPE_TCP || ++ l4_type == HNS3_L4_TYPE_SCTP) ++ rss_type = PKT_HASH_TYPE_L4; ++ else if (l4_type == HNS3_L4_TYPE_IGMP || ++ l4_type == HNS3_L4_TYPE_ICMP) ++ rss_type = PKT_HASH_TYPE_L3; ++ } ++ } + + skb_set_hash(skb, rss_hash, rss_type); + } +@@ -4240,7 +4262,8 @@ static int hns3_handle_bdinfo(struct hns3_enet_ring *ring, struct sk_buff *skb) + + ring->tqp_vector->rx_group.total_bytes += len; + +- hns3_set_rx_skb_rss_type(ring, skb, le32_to_cpu(desc->rx.rss_hash)); ++ hns3_set_rx_skb_rss_type(ring, skb, le32_to_cpu(desc->rx.rss_hash), ++ l234info, ol_info); + return 0; + } + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +index 4a3253692dcc..408635d11a24 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +@@ -404,6 +404,7 @@ struct hns3_rx_ptype { + u32 ip_summed : 2; + u32 l3_type : 4; + u32 valid : 1; ++ u32 hash_type: 3; + }; + + struct ring_stats { +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index fae79764dc44..bd9a3b8f9e79 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -4662,7 +4662,6 @@ static int hclge_set_rss_tuple(struct hnae3_handle *handle, + return ret; + } + +- hclge_comm_get_rss_type(&vport->nic, &hdev->rss_cfg.rss_tuple_sets); + return 0; + } + +-- +2.35.1 + diff --git a/queue-6.0/net-hns3-fix-return-value-check-bug-of-rx-copybreak.patch b/queue-6.0/net-hns3-fix-return-value-check-bug-of-rx-copybreak.patch new file mode 100644 index 00000000000..905ec57c70a --- /dev/null +++ b/queue-6.0/net-hns3-fix-return-value-check-bug-of-rx-copybreak.patch @@ -0,0 +1,41 @@ +From faae1038432bc351b5fc0eb6bbe8d91decdb9a34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 16:20:47 +0800 +Subject: net: hns3: fix return value check bug of rx copybreak + +From: Jie Wang + +[ Upstream commit 29df7c695ed67a8fa32bb7805bad8fe2a76c1f88 ] + +The refactoring of rx copybreak modifies the original return logic, which +will make this feature unavailable. So this patch fixes the return logic of +rx copybreak. + +Fixes: e74a726da2c4 ("net: hns3: refactor hns3_nic_reuse_page()") +Fixes: 99f6b5fb5f63 ("net: hns3: use bounce buffer when rx page can not be reused") +Signed-off-by: Jie Wang +Signed-off-by: Hao Lan +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 944f36e4d66f..44d4265f109a 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -3736,8 +3736,8 @@ static void hns3_nic_reuse_page(struct sk_buff *skb, int i, + desc_cb->reuse_flag = 1; + } else if (frag_size <= ring->rx_copybreak) { + ret = hns3_handle_rx_copybreak(skb, i, ring, pull_len, desc_cb); +- if (ret) +- goto out; ++ if (!ret) ++ return; + } + + out: +-- +2.35.1 + diff --git a/queue-6.0/net-hns3-fix-setting-incorrect-phy-link-ksettings-fo.patch b/queue-6.0/net-hns3-fix-setting-incorrect-phy-link-ksettings-fo.patch new file mode 100644 index 00000000000..380db51f784 --- /dev/null +++ b/queue-6.0/net-hns3-fix-setting-incorrect-phy-link-ksettings-fo.patch @@ -0,0 +1,58 @@ +From ef86e0c5fedb02760882803374137893279fea3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 16:20:48 +0800 +Subject: net: hns3: fix setting incorrect phy link ksettings for firmware in + resetting process + +From: Guangbin Huang + +[ Upstream commit 510d7b6ae842e59ee00d57e5f07ac15131b6d899 ] + +Currently, if driver is in phy-imp(phy controlled by imp firmware) mode, as +driver did not update phy link ksettings after initialization process or +not update advertising when getting phy link ksettings from firmware, it +may set incorrect phy link ksettings for firmware in resetting process. +So fix it. + +Fixes: f5f2b3e4dcc0 ("net: hns3: add support for imp-controlled PHYs") +Fixes: c5ef83cbb1e9 ("net: hns3: fix for phy_addr error in hclge_mac_mdio_config") +Fixes: 2312e050f42b ("net: hns3: Fix for deadlock problem occurring when unregistering ae_algo") +Signed-off-by: Guangbin Huang +Signed-off-by: Hao Lan +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index bd9a3b8f9e79..7e8a60f2401c 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -3246,6 +3246,7 @@ static int hclge_update_tp_port_info(struct hclge_dev *hdev) + hdev->hw.mac.autoneg = cmd.base.autoneg; + hdev->hw.mac.speed = cmd.base.speed; + hdev->hw.mac.duplex = cmd.base.duplex; ++ linkmode_copy(hdev->hw.mac.advertising, cmd.link_modes.advertising); + + return 0; + } +@@ -11373,9 +11374,12 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev) + if (ret) + goto err_msi_irq_uninit; + +- if (hdev->hw.mac.media_type == HNAE3_MEDIA_TYPE_COPPER && +- !hnae3_dev_phy_imp_supported(hdev)) { +- ret = hclge_mac_mdio_config(hdev); ++ if (hdev->hw.mac.media_type == HNAE3_MEDIA_TYPE_COPPER) { ++ if (hnae3_dev_phy_imp_supported(hdev)) ++ ret = hclge_update_tp_port_info(hdev); ++ else ++ ret = hclge_mac_mdio_config(hdev); ++ + if (ret) + goto err_msi_irq_uninit; + } +-- +2.35.1 + diff --git a/queue-6.0/net-ionic-fix-error-handling-in-ionic_init_module.patch b/queue-6.0/net-ionic-fix-error-handling-in-ionic_init_module.patch new file mode 100644 index 00000000000..cf0cac780a5 --- /dev/null +++ b/queue-6.0/net-ionic-fix-error-handling-in-ionic_init_module.patch @@ -0,0 +1,63 @@ +From 42685463ece03095c0867254e7d33db43d556edd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Nov 2022 09:29:29 +0000 +Subject: net: ionic: Fix error handling in ionic_init_module() + +From: Yuan Can + +[ Upstream commit 280c0f7cd0aa4d190619b18243110e052a90775c ] + +A problem about ionic create debugfs failed is triggered with the +following log given: + + [ 415.799514] debugfs: Directory 'ionic' with parent '/' already present! + +The reason is that ionic_init_module() returns ionic_bus_register_driver() +directly without checking its return value, if ionic_bus_register_driver() +failed, it returns without destroy the newly created debugfs, resulting +the debugfs of ionic can never be created later. + + ionic_init_module() + ionic_debugfs_create() # create debugfs directory + ionic_bus_register_driver() + pci_register_driver() + driver_register() + bus_add_driver() + priv = kzalloc(...) # OOM happened + # return without destroy debugfs directory + +Fix by removing debugfs when ionic_bus_register_driver() returns error. + +Fixes: fbfb8031533c ("ionic: Add hardware init and device commands") +Signed-off-by: Yuan Can +Acked-by: Shannon Nelson +Link: https://lore.kernel.org/r/20221113092929.19161-1-yuancan@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_main.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c +index 56f93b030551..5456c2b15d9b 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c +@@ -687,8 +687,14 @@ int ionic_port_reset(struct ionic *ionic) + + static int __init ionic_init_module(void) + { ++ int ret; ++ + ionic_debugfs_create(); +- return ionic_bus_register_driver(); ++ ret = ionic_bus_register_driver(); ++ if (ret) ++ ionic_debugfs_destroy(); ++ ++ return ret; + } + + static void __exit ionic_cleanup_module(void) +-- +2.35.1 + diff --git a/queue-6.0/net-lan966x-fix-potential-null-ptr-deref-in-lan966x_.patch b/queue-6.0/net-lan966x-fix-potential-null-ptr-deref-in-lan966x_.patch new file mode 100644 index 00000000000..1d12cdf82c8 --- /dev/null +++ b/queue-6.0/net-lan966x-fix-potential-null-ptr-deref-in-lan966x_.patch @@ -0,0 +1,48 @@ +From 543af0efd315ca1a711260280e62cae0cb18fd06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 21:38:52 +0800 +Subject: net: lan966x: Fix potential null-ptr-deref in lan966x_stats_init() + +From: Shang XiaoJing + +[ Upstream commit ba86af3733aece88dbcee0dfebf7e2dcfefb2be4 ] + +lan966x_stats_init() calls create_singlethread_workqueue() and not +checked the ret value, which may return NULL. And a null-ptr-deref may +happen: + +lan966x_stats_init() + create_singlethread_workqueue() # failed, lan966x->stats_queue is NULL + queue_delayed_work() + queue_delayed_work_on() + __queue_delayed_work() # warning here, but continue + __queue_work() # access wq->flags, null-ptr-deref + +Check the ret value and return -ENOMEM if it is NULL. + +Fixes: 12c2d0a5b8e2 ("net: lan966x: add ethtool configuration and statistics") +Signed-off-by: Shang XiaoJing +Reviewed-by: Horatiu Vultur +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c b/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c +index fea42542be28..06811c60d598 100644 +--- a/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c ++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c +@@ -716,6 +716,9 @@ int lan966x_stats_init(struct lan966x *lan966x) + snprintf(queue_name, sizeof(queue_name), "%s-stats", + dev_name(lan966x->dev)); + lan966x->stats_queue = create_singlethread_workqueue(queue_name); ++ if (!lan966x->stats_queue) ++ return -ENOMEM; ++ + INIT_DELAYED_WORK(&lan966x->stats_work, lan966x_check_stats_work); + queue_delayed_work(lan966x->stats_queue, &lan966x->stats_work, + LAN966X_STATS_CHECK_DELAY); +-- +2.35.1 + diff --git a/queue-6.0/net-liquidio-release-resources-when-liquidio-driver-.patch b/queue-6.0/net-liquidio-release-resources-when-liquidio-driver-.patch new file mode 100644 index 00000000000..74732612a3b --- /dev/null +++ b/queue-6.0/net-liquidio-release-resources-when-liquidio-driver-.patch @@ -0,0 +1,84 @@ +From 6f3df62b95640288094c6edb06bfe42cf735b814 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 18:30:37 +0800 +Subject: net: liquidio: release resources when liquidio driver open failed + +From: Zhengchao Shao + +[ Upstream commit 8979f428a4afc215e390006e5ea19fd4e22c7ca9 ] + +When liquidio driver open failed, it doesn't release resources. Compile +tested only. + +Fixes: 5b07aee11227 ("liquidio: MSIX support for CN23XX") +Fixes: dbc97bfd3918 ("net: liquidio: Add missing null pointer checks") +Signed-off-by: Zhengchao Shao +Reviewed-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/cavium/liquidio/lio_main.c | 34 ++++++++++++++----- + 1 file changed, 26 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c +index bee35ce60171..bf6a72143040 100644 +--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c ++++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c +@@ -1799,13 +1799,10 @@ static int liquidio_open(struct net_device *netdev) + + ifstate_set(lio, LIO_IFSTATE_RUNNING); + +- if (OCTEON_CN23XX_PF(oct)) { +- if (!oct->msix_on) +- if (setup_tx_poll_fn(netdev)) +- return -1; +- } else { +- if (setup_tx_poll_fn(netdev)) +- return -1; ++ if (!OCTEON_CN23XX_PF(oct) || (OCTEON_CN23XX_PF(oct) && !oct->msix_on)) { ++ ret = setup_tx_poll_fn(netdev); ++ if (ret) ++ goto err_poll; + } + + netif_tx_start_all_queues(netdev); +@@ -1818,7 +1815,7 @@ static int liquidio_open(struct net_device *netdev) + /* tell Octeon to start forwarding packets to host */ + ret = send_rx_ctrl_cmd(lio, 1); + if (ret) +- return ret; ++ goto err_rx_ctrl; + + /* start periodical statistics fetch */ + INIT_DELAYED_WORK(&lio->stats_wk.work, lio_fetch_stats); +@@ -1829,6 +1826,27 @@ static int liquidio_open(struct net_device *netdev) + dev_info(&oct->pci_dev->dev, "%s interface is opened\n", + netdev->name); + ++ return 0; ++ ++err_rx_ctrl: ++ if (!OCTEON_CN23XX_PF(oct) || (OCTEON_CN23XX_PF(oct) && !oct->msix_on)) ++ cleanup_tx_poll_fn(netdev); ++err_poll: ++ if (lio->ptp_clock) { ++ ptp_clock_unregister(lio->ptp_clock); ++ lio->ptp_clock = NULL; ++ } ++ ++ if (oct->props[lio->ifidx].napi_enabled == 1) { ++ list_for_each_entry_safe(napi, n, &netdev->napi_list, dev_list) ++ napi_disable(napi); ++ ++ oct->props[lio->ifidx].napi_enabled = 0; ++ ++ if (OCTEON_CN23XX_PF(oct)) ++ oct->droq[0]->ops.poll_mode = 0; ++ } ++ + return ret; + } + +-- +2.35.1 + diff --git a/queue-6.0/net-macvlan-use-built-in-rcu-list-checking.patch b/queue-6.0/net-macvlan-use-built-in-rcu-list-checking.patch new file mode 100644 index 00000000000..86ad2c5c947 --- /dev/null +++ b/queue-6.0/net-macvlan-use-built-in-rcu-list-checking.patch @@ -0,0 +1,55 @@ +From ca9e47570bdb4028b044280cc602948b448a5575 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 09:41:30 +0800 +Subject: net: macvlan: Use built-in RCU list checking + +From: Chuang Wang + +[ Upstream commit 5df1341ea822292275c56744aab9c536d75c33be ] + +hlist_for_each_entry_rcu() has built-in RCU and lock checking. + +Pass cond argument to hlist_for_each_entry_rcu() to silence false +lockdep warning when CONFIG_PROVE_RCU_LIST is enabled. + +Execute as follow: + + ip link add link eth0 type macvlan mode source macaddr add + +The rtnl_lock is held when macvlan_hash_lookup_source() or +macvlan_fill_info_macaddr() are called in the non-RCU read side section. +So, pass lockdep_rtnl_is_held() to silence false lockdep warning. + +Fixes: 79cf79abce71 ("macvlan: add source mode") +Signed-off-by: Chuang Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/macvlan.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 9983d37ee87d..059e4ff0e510 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -141,7 +141,7 @@ static struct macvlan_source_entry *macvlan_hash_lookup_source( + u32 idx = macvlan_eth_hash(addr); + struct hlist_head *h = &vlan->port->vlan_source_hash[idx]; + +- hlist_for_each_entry_rcu(entry, h, hlist) { ++ hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) { + if (ether_addr_equal_64bits(entry->addr, addr) && + entry->vlan == vlan) + return entry; +@@ -1647,7 +1647,7 @@ static int macvlan_fill_info_macaddr(struct sk_buff *skb, + struct hlist_head *h = &vlan->port->vlan_source_hash[i]; + struct macvlan_source_entry *entry; + +- hlist_for_each_entry_rcu(entry, h, hlist) { ++ hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) { + if (entry->vlan != vlan) + continue; + if (nla_put(skb, IFLA_MACVLAN_MACADDR, ETH_ALEN, entry->addr)) +-- +2.35.1 + diff --git a/queue-6.0/net-mhi-fix-memory-leak-in-mhi_net_dellink.patch b/queue-6.0/net-mhi-fix-memory-leak-in-mhi_net_dellink.patch new file mode 100644 index 00000000000..c3cddf2dc55 --- /dev/null +++ b/queue-6.0/net-mhi-fix-memory-leak-in-mhi_net_dellink.patch @@ -0,0 +1,40 @@ +From 260c2ea112fb73d985ac235e8f6676e1944ef72e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 09:20:44 +0000 +Subject: net: mhi: Fix memory leak in mhi_net_dellink() + +From: Wei Yongjun + +[ Upstream commit f7c125bd79f50ec6094761090be81d02726ec6f4 ] + +MHI driver registers network device without setting the +needs_free_netdev flag, and does NOT call free_netdev() when +unregisters network device, which causes a memory leak. + +This patch calls free_netdev() to fix it since netdev_priv +is used after unregister. + +Fixes: 13adac032982 ("net: mhi_net: Register wwan_ops for link creation") +Signed-off-by: Wei Yongjun +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/mhi_net.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/mhi_net.c b/drivers/net/mhi_net.c +index 0b1b6f650104..0b9d37979133 100644 +--- a/drivers/net/mhi_net.c ++++ b/drivers/net/mhi_net.c +@@ -343,6 +343,8 @@ static void mhi_net_dellink(struct mhi_device *mhi_dev, struct net_device *ndev) + + kfree_skb(mhi_netdev->skbagg_head); + ++ free_netdev(ndev); ++ + dev_set_drvdata(&mhi_dev->dev, NULL); + } + +-- +2.35.1 + diff --git a/queue-6.0/net-microchip-sparx5-fix-potential-null-ptr-deref-in.patch b/queue-6.0/net-microchip-sparx5-fix-potential-null-ptr-deref-in.patch new file mode 100644 index 00000000000..9e7ec0c0829 --- /dev/null +++ b/queue-6.0/net-microchip-sparx5-fix-potential-null-ptr-deref-in.patch @@ -0,0 +1,65 @@ +From 7e0428e9a99649d618bc2f25f63868e4f109a3be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 21:38:53 +0800 +Subject: net: microchip: sparx5: Fix potential null-ptr-deref in + sparx_stats_init() and sparx5_start() + +From: Shang XiaoJing + +[ Upstream commit 639f5d006e36bb303f525d9479448c412b720c39 ] + +sparx_stats_init() calls create_singlethread_workqueue() and not +checked the ret value, which may return NULL. And a null-ptr-deref may +happen: + +sparx_stats_init() + create_singlethread_workqueue() # failed, sparx5->stats_queue is NULL + queue_delayed_work() + queue_delayed_work_on() + __queue_delayed_work() # warning here, but continue + __queue_work() # access wq->flags, null-ptr-deref + +Check the ret value and return -ENOMEM if it is NULL. So as +sparx5_start(). + +Fixes: af4b11022e2d ("net: sparx5: add ethtool configuration and statistics support") +Fixes: b37a1bae742f ("net: sparx5: add mactable support") +Signed-off-by: Shang XiaoJing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c | 3 +++ + drivers/net/ethernet/microchip/sparx5/sparx5_main.c | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c b/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c +index 6b0febcb7fa9..01f3a3a41cdb 100644 +--- a/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c ++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c +@@ -1253,6 +1253,9 @@ int sparx_stats_init(struct sparx5 *sparx5) + snprintf(queue_name, sizeof(queue_name), "%s-stats", + dev_name(sparx5->dev)); + sparx5->stats_queue = create_singlethread_workqueue(queue_name); ++ if (!sparx5->stats_queue) ++ return -ENOMEM; ++ + INIT_DELAYED_WORK(&sparx5->stats_work, sparx5_check_stats_work); + queue_delayed_work(sparx5->stats_queue, &sparx5->stats_work, + SPX5_STATS_CHECK_DELAY); +diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c +index 01be7bd84181..30815c0e3f76 100644 +--- a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c ++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c +@@ -657,6 +657,9 @@ static int sparx5_start(struct sparx5 *sparx5) + snprintf(queue_name, sizeof(queue_name), "%s-mact", + dev_name(sparx5->dev)); + sparx5->mact_queue = create_singlethread_workqueue(queue_name); ++ if (!sparx5->mact_queue) ++ return -ENOMEM; ++ + INIT_DELAYED_WORK(&sparx5->mact_work, sparx5_mact_pull_work); + queue_delayed_work(sparx5->mact_queue, &sparx5->mact_work, + SPX5_MACT_PULL_DELAY); +-- +2.35.1 + diff --git a/queue-6.0/net-phy-dp83867-fix-sgmii-fifo-depth-for-non-of-devi.patch b/queue-6.0/net-phy-dp83867-fix-sgmii-fifo-depth-for-non-of-devi.patch new file mode 100644 index 00000000000..725b1472927 --- /dev/null +++ b/queue-6.0/net-phy-dp83867-fix-sgmii-fifo-depth-for-non-of-devi.patch @@ -0,0 +1,49 @@ +From 2e7da1f2feb08607e04e95d7e9676db61f7712b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 13:49:38 +0800 +Subject: net: phy: dp83867: Fix SGMII FIFO depth for non OF devices + +From: Michael Sit Wei Hong + +[ Upstream commit e2a54350dc9642e7dfc07335ca355581caa9dbfe ] + +Current driver code will read device tree node information, +and set default values if there is no info provided. + +This is not done in non-OF devices leading to SGMII fifo depths being +set to the smallest size. + +This patch sets the value to the default value of the PHY as stated in the +PHY datasheet. + +Fixes: 4dc08dcc9f6f ("net: phy: dp83867: introduce critical chip default init for non-of platform") +Signed-off-by: Michael Sit Wei Hong +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20221110054938.925347-1-michael.wei.hong.sit@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/dp83867.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c +index 417527f8bbf5..7446d5c6c714 100644 +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -682,6 +682,13 @@ static int dp83867_of_init(struct phy_device *phydev) + */ + dp83867->io_impedance = DP83867_IO_MUX_CFG_IO_IMPEDANCE_MIN / 2; + ++ /* For non-OF device, the RX and TX FIFO depths are taken from ++ * default value. So, we init RX & TX FIFO depths here ++ * so that it is configured correctly later in dp83867_config_init(); ++ */ ++ dp83867->tx_fifo_depth = DP83867_PHYCR_FIFO_DEPTH_4_B_NIB; ++ dp83867->rx_fifo_depth = DP83867_PHYCR_FIFO_DEPTH_4_B_NIB; ++ + return 0; + } + #endif /* CONFIG_OF_MDIO */ +-- +2.35.1 + diff --git a/queue-6.0/net-stmmac-ensure-tx-function-is-not-running-in-stmm.patch b/queue-6.0/net-stmmac-ensure-tx-function-is-not-running-in-stmm.patch new file mode 100644 index 00000000000..4a2bccf5a0b --- /dev/null +++ b/queue-6.0/net-stmmac-ensure-tx-function-is-not-running-in-stmm.patch @@ -0,0 +1,45 @@ +From 653df8452802e92ed3509ea1b16128979ccaf2a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 14:45:52 +0800 +Subject: net: stmmac: ensure tx function is not running in + stmmac_xdp_release() + +From: Mohd Faizal Abdul Rahim + +[ Upstream commit 77711683a50477de39757d67ab1a3638220d6860 ] + +When stmmac_xdp_release() is called, there is a possibility that tx +function is still running on other queues which will lead to tx queue +timed out and reset adapter. + +This commit ensure that tx function is not running xdp before release +flow continue to run. + +Fixes: ac746c8520d9 ("net: stmmac: enhance XDP ZC driver level switching performance") +Signed-off-by: Song Yoong Siang +Signed-off-by: Mohd Faizal Abdul Rahim +Signed-off-by: Noor Azura Ahmad Tarmizi +Link: https://lore.kernel.org/r/20221110064552.22504-1-noor.azura.ahmad.tarmizi@linux.intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index bc060ef558d3..02827829463f 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -6564,6 +6564,9 @@ void stmmac_xdp_release(struct net_device *dev) + struct stmmac_priv *priv = netdev_priv(dev); + u32 chan; + ++ /* Ensure tx function is not running */ ++ netif_tx_disable(dev); ++ + /* Disable NAPI process */ + stmmac_disable_all_queues(priv); + +-- +2.35.1 + diff --git a/queue-6.0/net-thunderbolt-fix-error-handling-in-tbnet_init.patch b/queue-6.0/net-thunderbolt-fix-error-handling-in-tbnet_init.patch new file mode 100644 index 00000000000..1080c9ef4be --- /dev/null +++ b/queue-6.0/net-thunderbolt-fix-error-handling-in-tbnet_init.patch @@ -0,0 +1,73 @@ +From ef60f173cff356bfaaf1f5ba7a50113b1dac4976 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 14:22:25 +0000 +Subject: net: thunderbolt: Fix error handling in tbnet_init() + +From: Yuan Can + +[ Upstream commit f524b7289bbb0c8ffaa2ba3c34c146e43da54fb2 ] + +A problem about insmod thunderbolt-net failed is triggered with following +log given while lsmod does not show thunderbolt_net: + + insmod: ERROR: could not insert module thunderbolt-net.ko: File exists + +The reason is that tbnet_init() returns tb_register_service_driver() +directly without checking its return value, if tb_register_service_driver() +failed, it returns without removing property directory, resulting the +property directory can never be created later. + + tbnet_init() + tb_register_property_dir() # register property directory + tb_register_service_driver() + driver_register() + bus_add_driver() + priv = kzalloc(...) # OOM happened + # return without remove property directory + +Fix by remove property directory when tb_register_service_driver() returns +error. + +Fixes: e69b6c02b4c3 ("net: Add support for networking over Thunderbolt cable") +Signed-off-by: Yuan Can +Acked-by: Mika Westerberg +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/thunderbolt.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/thunderbolt.c b/drivers/net/thunderbolt.c +index ab3f04562980..8391f8303499 100644 +--- a/drivers/net/thunderbolt.c ++++ b/drivers/net/thunderbolt.c +@@ -1379,12 +1379,21 @@ static int __init tbnet_init(void) + TBNET_MATCH_FRAGS_ID | TBNET_64K_FRAMES); + + ret = tb_register_property_dir("network", tbnet_dir); +- if (ret) { +- tb_property_free_dir(tbnet_dir); +- return ret; +- } ++ if (ret) ++ goto err_free_dir; ++ ++ ret = tb_register_service_driver(&tbnet_driver); ++ if (ret) ++ goto err_unregister; + +- return tb_register_service_driver(&tbnet_driver); ++ return 0; ++ ++err_unregister: ++ tb_unregister_property_dir("network", tbnet_dir); ++err_free_dir: ++ tb_property_free_dir(tbnet_dir); ++ ++ return ret; + } + module_init(tbnet_init); + +-- +2.35.1 + diff --git a/queue-6.0/net-x25-fix-skb-leak-in-x25_lapb_receive_frame.patch b/queue-6.0/net-x25-fix-skb-leak-in-x25_lapb_receive_frame.patch new file mode 100644 index 00000000000..4d037287769 --- /dev/null +++ b/queue-6.0/net-x25-fix-skb-leak-in-x25_lapb_receive_frame.patch @@ -0,0 +1,39 @@ +From 513fdfbadd36418d91cb8664236c4a82e3cdda8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 11:05:19 +0000 +Subject: net/x25: Fix skb leak in x25_lapb_receive_frame() + +From: Wei Yongjun + +[ Upstream commit 2929cceb2fcf0ded7182562e4888afafece82cce ] + +x25_lapb_receive_frame() using skb_copy() to get a private copy of +skb, the new skb should be freed in the undersized/fragmented skb +error handling path. Otherwise there is a memory leak. + +Fixes: cb101ed2c3c7 ("x25: Handle undersized/fragmented skbs") +Signed-off-by: Wei Yongjun +Acked-by: Martin Schiller +Link: https://lore.kernel.org/r/20221114110519.514538-1-weiyongjun@huaweicloud.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/x25/x25_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c +index 5259ef8f5242..748d8630ab58 100644 +--- a/net/x25/x25_dev.c ++++ b/net/x25/x25_dev.c +@@ -117,7 +117,7 @@ int x25_lapb_receive_frame(struct sk_buff *skb, struct net_device *dev, + + if (!pskb_may_pull(skb, 1)) { + x25_neigh_put(nb); +- return 0; ++ goto drop; + } + + switch (skb->data[0]) { +-- +2.35.1 + diff --git a/queue-6.0/netdevsim-fix-memory-leak-of-nsim_dev-fa_cookie.patch b/queue-6.0/netdevsim-fix-memory-leak-of-nsim_dev-fa_cookie.patch new file mode 100644 index 00000000000..97abb11f951 --- /dev/null +++ b/queue-6.0/netdevsim-fix-memory-leak-of-nsim_dev-fa_cookie.patch @@ -0,0 +1,60 @@ +From 3933fd714a4c0bd53889fba8f5e0eabcd353bee1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Nov 2022 17:30:25 +0800 +Subject: netdevsim: Fix memory leak of nsim_dev->fa_cookie + +From: Wang Yufen + +[ Upstream commit 064bc7312bd09a48798418663090be0c776183db ] + +kmemleak reports this issue: + +unreferenced object 0xffff8881bac872d0 (size 8): + comm "sh", pid 58603, jiffies 4481524462 (age 68.065s) + hex dump (first 8 bytes): + 04 00 00 00 de ad be ef ........ + backtrace: + [<00000000c80b8577>] __kmalloc+0x49/0x150 + [<000000005292b8c6>] nsim_dev_trap_fa_cookie_write+0xc1/0x210 [netdevsim] + [<0000000093d78e77>] full_proxy_write+0xf3/0x180 + [<000000005a662c16>] vfs_write+0x1c5/0xaf0 + [<000000007aabf84a>] ksys_write+0xed/0x1c0 + [<000000005f1d2e47>] do_syscall_64+0x3b/0x90 + [<000000006001c6ec>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +The issue occurs in the following scenarios: + +nsim_dev_trap_fa_cookie_write() + kmalloc() fa_cookie + nsim_dev->fa_cookie = fa_cookie +.. +nsim_drv_remove() + +The fa_cookie allocked in nsim_dev_trap_fa_cookie_write() is not freed. To +fix, add kfree(nsim_dev->fa_cookie) to nsim_drv_remove(). + +Fixes: d3cbb907ae57 ("netdevsim: add ACL trap reporting cookie as a metadata") +Signed-off-by: Wang Yufen +Cc: Jiri Pirko +Link: https://lore.kernel.org/r/1668504625-14698-1-git-send-email-wangyufen@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/dev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c +index b17e4e94a060..38562ed833da 100644 +--- a/drivers/net/netdevsim/dev.c ++++ b/drivers/net/netdevsim/dev.c +@@ -1675,6 +1675,7 @@ void nsim_drv_remove(struct nsim_bus_dev *nsim_bus_dev) + ARRAY_SIZE(nsim_devlink_params)); + devl_resources_unregister(devlink); + kfree(nsim_dev->vfconfigs); ++ kfree(nsim_dev->fa_cookie); + devl_unlock(devlink); + devlink_free(devlink); + dev_set_drvdata(&nsim_bus_dev->dev, NULL); +-- +2.35.1 + diff --git a/queue-6.0/netfs-fix-dodgy-maths.patch b/queue-6.0/netfs-fix-dodgy-maths.patch new file mode 100644 index 00000000000..6ec9cf164be --- /dev/null +++ b/queue-6.0/netfs-fix-dodgy-maths.patch @@ -0,0 +1,105 @@ +From 625be603e23120fbce0eff9024603d95d4e6e8fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 15:36:49 +0000 +Subject: netfs: Fix dodgy maths + +From: David Howells + +[ Upstream commit 5e51c627c5acbcf82bb552e17533a79d2a6a2600 ] + +Fix the dodgy maths in netfs_rreq_unlock_folios(). start_page could be +inside the folio, in which case the calculation of pgpos will be come up +with a negative number (though for the moment rreq->start is rounded down +earlier and folios would have to get merged whilst locked) + +Alter how this works to just frame the tracking in terms of absolute file +positions, rather than offsets from the start of the I/O request. This +simplifies the maths and makes it easier to follow. + +Fix the issue by using folio_pos() and folio_size() to calculate the end +position of the page. + +Fixes: 3d3c95046742 ("netfs: Provide readahead and readpage netfs helpers") +Reported-by: Matthew Wilcox +Signed-off-by: David Howells +Reviewed-by: Jeff Layton +Reviewed-by: Jingbo Xu +cc: linux-cachefs@redhat.com +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/Y2SJw7w1IsIik3nb@casper.infradead.org/ +Link: https://lore.kernel.org/r/166757988611.950645.7626959069846893164.stgit@warthog.procyon.org.uk/ # v2 +Signed-off-by: Sasha Levin +--- + fs/netfs/buffered_read.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c +index baf668fb4315..7679a68e8193 100644 +--- a/fs/netfs/buffered_read.c ++++ b/fs/netfs/buffered_read.c +@@ -17,9 +17,9 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq) + { + struct netfs_io_subrequest *subreq; + struct folio *folio; +- unsigned int iopos, account = 0; + pgoff_t start_page = rreq->start / PAGE_SIZE; + pgoff_t last_page = ((rreq->start + rreq->len) / PAGE_SIZE) - 1; ++ size_t account = 0; + bool subreq_failed = false; + + XA_STATE(xas, &rreq->mapping->i_pages, start_page); +@@ -39,23 +39,23 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq) + */ + subreq = list_first_entry(&rreq->subrequests, + struct netfs_io_subrequest, rreq_link); +- iopos = 0; + subreq_failed = (subreq->error < 0); + + trace_netfs_rreq(rreq, netfs_rreq_trace_unlock); + + rcu_read_lock(); + xas_for_each(&xas, folio, last_page) { +- unsigned int pgpos, pgend; ++ loff_t pg_end; + bool pg_failed = false; + + if (xas_retry(&xas, folio)) + continue; + +- pgpos = (folio_index(folio) - start_page) * PAGE_SIZE; +- pgend = pgpos + folio_size(folio); ++ pg_end = folio_pos(folio) + folio_size(folio) - 1; + + for (;;) { ++ loff_t sreq_end; ++ + if (!subreq) { + pg_failed = true; + break; +@@ -63,11 +63,11 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq) + if (test_bit(NETFS_SREQ_COPY_TO_CACHE, &subreq->flags)) + folio_start_fscache(folio); + pg_failed |= subreq_failed; +- if (pgend < iopos + subreq->len) ++ sreq_end = subreq->start + subreq->len - 1; ++ if (pg_end < sreq_end) + break; + + account += subreq->transferred; +- iopos += subreq->len; + if (!list_is_last(&subreq->rreq_link, &rreq->subrequests)) { + subreq = list_next_entry(subreq, rreq_link); + subreq_failed = (subreq->error < 0); +@@ -75,7 +75,8 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq) + subreq = NULL; + subreq_failed = false; + } +- if (pgend == iopos) ++ ++ if (pg_end == sreq_end) + break; + } + +-- +2.35.1 + diff --git a/queue-6.0/netfs-fix-missing-xas_retry-calls-in-xarray-iteratio.patch b/queue-6.0/netfs-fix-missing-xas_retry-calls-in-xarray-iteratio.patch new file mode 100644 index 00000000000..72880b49ffa --- /dev/null +++ b/queue-6.0/netfs-fix-missing-xas_retry-calls-in-xarray-iteratio.patch @@ -0,0 +1,106 @@ +From a5816519667a4312e1ce9460c66e9726297fb62d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 16:08:14 +0000 +Subject: netfs: Fix missing xas_retry() calls in xarray iteration + +From: David Howells + +[ Upstream commit 7e043a80b5dae5c2d2cf84031501de7827fd6c00 ] + +netfslib has a number of places in which it performs iteration of an xarray +whilst being under the RCU read lock. It *should* call xas_retry() as the +first thing inside of the loop and do "continue" if it returns true in case +the xarray walker passed out a special value indicating that the walk needs +to be redone from the root[*]. + +Fix this by adding the missing retry checks. + +[*] I wonder if this should be done inside xas_find(), xas_next_node() and + suchlike, but I'm told that's not an simple change to effect. + +This can cause an oops like that below. Note the faulting address - this +is an internal value (|0x2) returned from xarray. + +BUG: kernel NULL pointer dereference, address: 0000000000000402 +... +RIP: 0010:netfs_rreq_unlock+0xef/0x380 [netfs] +... +Call Trace: + netfs_rreq_assess+0xa6/0x240 [netfs] + netfs_readpage+0x173/0x3b0 [netfs] + ? init_wait_var_entry+0x50/0x50 + filemap_read_page+0x33/0xf0 + filemap_get_pages+0x2f2/0x3f0 + filemap_read+0xaa/0x320 + ? do_filp_open+0xb2/0x150 + ? rmqueue+0x3be/0xe10 + ceph_read_iter+0x1fe/0x680 [ceph] + ? new_sync_read+0x115/0x1a0 + new_sync_read+0x115/0x1a0 + vfs_read+0xf3/0x180 + ksys_read+0x5f/0xe0 + do_syscall_64+0x38/0x90 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Changes: +======== +ver #2) + - Changed an unsigned int to a size_t to reduce the likelihood of an + overflow as per Willy's suggestion. + - Added an additional patch to fix the maths. + +Fixes: 3d3c95046742 ("netfs: Provide readahead and readpage netfs helpers") +Reported-by: George Law +Signed-off-by: David Howells +Reviewed-by: Jeff Layton +Reviewed-by: Jingbo Xu +cc: Matthew Wilcox +cc: linux-cachefs@redhat.com +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/166749229733.107206.17482609105741691452.stgit@warthog.procyon.org.uk/ # v1 +Link: https://lore.kernel.org/r/166757987929.950645.12595273010425381286.stgit@warthog.procyon.org.uk/ # v2 +Signed-off-by: Sasha Levin +--- + fs/netfs/buffered_read.c | 9 +++++++-- + fs/netfs/io.c | 3 +++ + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c +index 0ce535852151..baf668fb4315 100644 +--- a/fs/netfs/buffered_read.c ++++ b/fs/netfs/buffered_read.c +@@ -46,10 +46,15 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq) + + rcu_read_lock(); + xas_for_each(&xas, folio, last_page) { +- unsigned int pgpos = (folio_index(folio) - start_page) * PAGE_SIZE; +- unsigned int pgend = pgpos + folio_size(folio); ++ unsigned int pgpos, pgend; + bool pg_failed = false; + ++ if (xas_retry(&xas, folio)) ++ continue; ++ ++ pgpos = (folio_index(folio) - start_page) * PAGE_SIZE; ++ pgend = pgpos + folio_size(folio); ++ + for (;;) { + if (!subreq) { + pg_failed = true; +diff --git a/fs/netfs/io.c b/fs/netfs/io.c +index 428925899282..e374767d1b68 100644 +--- a/fs/netfs/io.c ++++ b/fs/netfs/io.c +@@ -121,6 +121,9 @@ static void netfs_rreq_unmark_after_write(struct netfs_io_request *rreq, + XA_STATE(xas, &rreq->mapping->i_pages, subreq->start / PAGE_SIZE); + + xas_for_each(&xas, folio, (subreq->start + subreq->len - 1) / PAGE_SIZE) { ++ if (xas_retry(&xas, folio)) ++ continue; ++ + /* We might have multiple writes from the same huge + * folio, but we mustn't unlock a folio more than once. + */ +-- +2.35.1 + diff --git a/queue-6.0/nfp-change-eeprom-length-to-max-length-enumerators.patch b/queue-6.0/nfp-change-eeprom-length-to-max-length-enumerators.patch new file mode 100644 index 00000000000..4bedc13097a --- /dev/null +++ b/queue-6.0/nfp-change-eeprom-length-to-max-length-enumerators.patch @@ -0,0 +1,58 @@ +From 74c8aee47988dec5dc12d2bf767f939138e1216c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 15:27:57 -0500 +Subject: nfp: change eeprom length to max length enumerators + +From: Jaco Coetzee + +[ Upstream commit f3a72878a3de720661b7ed0d6b7f7c506ddb8a52 ] + +Extend the size of QSFP EEPROM for types SSF8436 and SFF8636 +from 256 to 640 bytes in order to expose all the EEPROM pages by +ethtool. + +For SFF-8636 and SFF-8436 specifications, the driver exposes +256 bytes of EEPROM data for ethtool's get_module_eeprom() +callback, resulting in "netlink error: Invalid argument" when +an EEPROM read with an offset larger than 256 bytes is attempted. + +Changing the length enumerators to the _MAX_LEN +variants exposes all 640 bytes of the EEPROM allowing upper +pages 1, 2 and 3 to be read. + +Fixes: 96d971e307cc ("ethtool: Add fallback to get_module_eeprom from netlink command") +Signed-off-by: Jaco Coetzee +Reviewed-by: Louis Peens +Signed-off-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index b1b1b648e40c..b19bff0db1fd 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -1440,15 +1440,15 @@ nfp_port_get_module_info(struct net_device *netdev, + + if (data < 0x3) { + modinfo->type = ETH_MODULE_SFF_8436; +- modinfo->eeprom_len = ETH_MODULE_SFF_8436_LEN; ++ modinfo->eeprom_len = ETH_MODULE_SFF_8436_MAX_LEN; + } else { + modinfo->type = ETH_MODULE_SFF_8636; +- modinfo->eeprom_len = ETH_MODULE_SFF_8636_LEN; ++ modinfo->eeprom_len = ETH_MODULE_SFF_8636_MAX_LEN; + } + break; + case NFP_INTERFACE_QSFP28: + modinfo->type = ETH_MODULE_SFF_8636; +- modinfo->eeprom_len = ETH_MODULE_SFF_8636_LEN; ++ modinfo->eeprom_len = ETH_MODULE_SFF_8636_MAX_LEN; + break; + default: + netdev_err(netdev, "Unsupported module 0x%x detected\n", +-- +2.35.1 + diff --git a/queue-6.0/nfsd-put-the-export-reference-in-nfsd4_verify_deleg_.patch b/queue-6.0/nfsd-put-the-export-reference-in-nfsd4_verify_deleg_.patch new file mode 100644 index 00000000000..6f97ae23eae --- /dev/null +++ b/queue-6.0/nfsd-put-the-export-reference-in-nfsd4_verify_deleg_.patch @@ -0,0 +1,37 @@ +From b4a3e59db2b181f58776de146cc20d3c51d4da25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 11:23:11 -0500 +Subject: nfsd: put the export reference in nfsd4_verify_deleg_dentry + +From: Jeff Layton + +[ Upstream commit 50256e4793a5e5ab77703c82a47344ad2e774a59 ] + +nfsd_lookup_dentry returns an export reference in addition to the dentry +ref. Ensure that we put it too. + +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2138866 +Fixes: 876c553cb410 ("NFSD: verify the opened dentry after setting a delegation") +Reported-by: Yongcheng Yang +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 0bc36472f8b7..ddb2bf078fda 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -5313,6 +5313,7 @@ nfsd4_verify_deleg_dentry(struct nfsd4_open *open, struct nfs4_file *fp, + if (err) + return -EAGAIN; + ++ exp_put(exp); + dput(child); + if (child != file_dentry(fp->fi_deleg_file->nf_file)) + return -EAGAIN; +-- +2.35.1 + diff --git a/queue-6.0/nvmet-fix-a-memory-leak-in-nvmet_auth_set_key.patch b/queue-6.0/nvmet-fix-a-memory-leak-in-nvmet_auth_set_key.patch new file mode 100644 index 00000000000..e1f0a7c4607 --- /dev/null +++ b/queue-6.0/nvmet-fix-a-memory-leak-in-nvmet_auth_set_key.patch @@ -0,0 +1,56 @@ +From e68076fd9eb3dba61864cf77363560498ab06938 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 08:45:02 +0200 +Subject: nvmet: fix a memory leak in nvmet_auth_set_key + +From: Sagi Grimberg + +[ Upstream commit 0a52566279b4ee65ecd2503d7b7342851f84755c ] + +When changing dhchap secrets we need to release the old +secrets as well. + +kmemleak complaint: +-- +unreferenced object 0xffff8c7f44ed8180 (size 64): + comm "check", pid 7304, jiffies 4295686133 (age 72034.246s) + hex dump (first 32 bytes): + 44 48 48 43 2d 31 3a 30 30 3a 4c 64 4c 4f 64 71 DHHC-1:00:LdLOdq + 79 56 69 67 77 48 55 32 6d 5a 59 4c 7a 35 59 38 yVigwHU2mZYLz5Y8 + backtrace: + [<00000000b6fc5071>] kstrdup+0x2e/0x60 + [<00000000f0f4633f>] 0xffffffffc0e07ee6 + [<0000000053006c05>] 0xffffffffc0dff783 + [<00000000419ae922>] configfs_write_iter+0xb1/0x120 + [<000000008183c424>] vfs_write+0x2be/0x3c0 + [<000000009005a2a5>] ksys_write+0x5f/0xe0 + [<00000000cd495c89>] do_syscall_64+0x38/0x90 + [<00000000f2a84ac5>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication") +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/auth.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c +index c4113b43dbfe..4dcddcf95279 100644 +--- a/drivers/nvme/target/auth.c ++++ b/drivers/nvme/target/auth.c +@@ -45,9 +45,11 @@ int nvmet_auth_set_key(struct nvmet_host *host, const char *secret, + if (!dhchap_secret) + return -ENOMEM; + if (set_ctrl) { ++ kfree(host->dhchap_ctrl_secret); + host->dhchap_ctrl_secret = strim(dhchap_secret); + host->dhchap_ctrl_key_hash = key_hash; + } else { ++ kfree(host->dhchap_secret); + host->dhchap_secret = strim(dhchap_secret); + host->dhchap_key_hash = key_hash; + } +-- +2.35.1 + diff --git a/queue-6.0/nvmet-fix-a-memory-leak.patch b/queue-6.0/nvmet-fix-a-memory-leak.patch new file mode 100644 index 00000000000..28a6442649f --- /dev/null +++ b/queue-6.0/nvmet-fix-a-memory-leak.patch @@ -0,0 +1,51 @@ +From b5ade57db6d742ba919d6a0f5d51e309641d86ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 05:29:57 +0200 +Subject: nvmet: fix a memory leak + +From: Sagi Grimberg + +[ Upstream commit e65fdf530f55c5e387db14470a59a399faa29613 ] + +We need to also free the dhchap_ctrl_secret when releasing nvmet_host. +kmemleak complaint: +-- +unreferenced object 0xffff99b1cbca5140 (size 64): + comm "check", pid 4864, jiffies 4305092436 (age 2913.583s) + hex dump (first 32 bytes): + 44 48 48 43 2d 31 3a 30 30 3a 65 36 2b 41 63 44 DHHC-1:00:e6+AcD + 39 76 47 4d 52 57 59 78 67 54 47 44 51 59 47 78 9vGMRWYxgTGDQYGx + backtrace: + [<00000000c07d369d>] kstrdup+0x2e/0x60 + [<000000001372171c>] 0xffffffffc0cceec6 + [<0000000010dbf50b>] 0xffffffffc0cc6783 + [<000000007465e93c>] configfs_write_iter+0xb1/0x120 + [<0000000039c23f62>] vfs_write+0x2be/0x3c0 + [<000000002da4351c>] ksys_write+0x5f/0xe0 + [<00000000d5011e32>] do_syscall_64+0x38/0x90 + [<00000000503870cf>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication") +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/configfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c +index 2bcd60758919..7f52d9dac443 100644 +--- a/drivers/nvme/target/configfs.c ++++ b/drivers/nvme/target/configfs.c +@@ -1811,6 +1811,7 @@ static void nvmet_host_release(struct config_item *item) + + #ifdef CONFIG_NVME_TARGET_AUTH + kfree(host->dhchap_secret); ++ kfree(host->dhchap_ctrl_secret); + #endif + kfree(host); + } +-- +2.35.1 + diff --git a/queue-6.0/octeon_ep-delete-unnecessary-napi-rollback-under-set.patch b/queue-6.0/octeon_ep-delete-unnecessary-napi-rollback-under-set.patch new file mode 100644 index 00000000000..c1ede49b7f9 --- /dev/null +++ b/queue-6.0/octeon_ep-delete-unnecessary-napi-rollback-under-set.patch @@ -0,0 +1,38 @@ +From 0f11a2ec54aad23e6378718d8bff2e6eae155adf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 15:08:27 +0800 +Subject: octeon_ep: delete unnecessary napi rollback under set_queues_err in + octep_open() + +From: Ziyang Xuan + +[ Upstream commit 298b83e180d53a310f9b47e3bf13b7b583e75e9c ] + +octep_napi_add() and octep_napi_enable() are all after +netif_set_real_num_{tx,rx}_queues() in octep_open(), so it is unnecessary +napi rollback under set_queues_err. Delete them to fix it. + +Fixes: 37d79d059606 ("octeon_ep: add Tx/Rx processing and interrupt support") +Signed-off-by: Ziyang Xuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +index 97f080c66dd4..7083c995d0c1 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c ++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +@@ -527,8 +527,6 @@ static int octep_open(struct net_device *netdev) + return 0; + + set_queues_err: +- octep_napi_disable(oct); +- octep_napi_delete(oct); + octep_clean_irqs(oct); + setup_irq_err: + octep_free_oqs(oct); +-- +2.35.1 + diff --git a/queue-6.0/octeon_ep-ensure-get-mac-address-successfully-before.patch b/queue-6.0/octeon_ep-ensure-get-mac-address-successfully-before.patch new file mode 100644 index 00000000000..5ef4934a0e0 --- /dev/null +++ b/queue-6.0/octeon_ep-ensure-get-mac-address-successfully-before.patch @@ -0,0 +1,42 @@ +From 9c559d557a401691f0f3299732c95f7e40ebc931 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 15:09:35 +0800 +Subject: octeon_ep: ensure get mac address successfully before + eth_hw_addr_set() + +From: Ziyang Xuan + +[ Upstream commit 848ffce2f0c93f3481052340a919123a21f808b6 ] + +octep_get_mac_addr() can fail because send mbox message failed. If this +happens, octep_dev->mac_addr will be zero. It should not continue to +initialize. Add exception handling for octep_get_mac_addr() to fix it. + +Fixes: 862cd659a6fb ("octeon_ep: Add driver framework and device initialization") +Signed-off-by: Ziyang Xuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +index ac1e37afbe7b..8a6a81bcec5c 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c ++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +@@ -1072,7 +1072,11 @@ static int octep_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + netdev->max_mtu = OCTEP_MAX_MTU; + netdev->mtu = OCTEP_DEFAULT_MTU; + +- octep_get_mac_addr(octep_dev, octep_dev->mac_addr); ++ err = octep_get_mac_addr(octep_dev, octep_dev->mac_addr); ++ if (err) { ++ dev_err(&pdev->dev, "Failed to get mac address\n"); ++ goto register_dev_err; ++ } + eth_hw_addr_set(netdev, octep_dev->mac_addr); + + err = register_netdev(netdev); +-- +2.35.1 + diff --git a/queue-6.0/octeon_ep-ensure-octep_get_link_status-successfully-.patch b/queue-6.0/octeon_ep-ensure-octep_get_link_status-successfully-.patch new file mode 100644 index 00000000000..391c4f979f9 --- /dev/null +++ b/queue-6.0/octeon_ep-ensure-octep_get_link_status-successfully-.patch @@ -0,0 +1,41 @@ +From 6e74b4f4fc48ff898f91a361f8613a9aa6d643ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 15:08:47 +0800 +Subject: octeon_ep: ensure octep_get_link_status() successfully before + octep_link_up() + +From: Ziyang Xuan + +[ Upstream commit 9d3ff7131877fb092185c369fbb14b57ac4e7cec ] + +octep_get_link_status() can fail because send mbox message failed, then +octep_get_link_status() will return ret less than 0. Excute octep_link_up() +as long as ret is not equal to 0 in octep_open() now. That is not correct. + +The value type of link.state is enum octep_ctrl_net_state. Positive value +represents up. Excute octep_link_up() when ret is bigger than 0. + +Fixes: 862cd659a6fb ("octeon_ep: Add driver framework and device initialization") +Signed-off-by: Ziyang Xuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +index 7083c995d0c1..92ca3e502465 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c ++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +@@ -521,7 +521,7 @@ static int octep_open(struct net_device *netdev) + octep_oq_dbell_init(oct); + + ret = octep_get_link_status(oct); +- if (ret) ++ if (ret > 0) + octep_link_up(netdev); + + return 0; +-- +2.35.1 + diff --git a/queue-6.0/octeon_ep-fix-potential-memory-leak-in-octep_device_.patch b/queue-6.0/octeon_ep-fix-potential-memory-leak-in-octep_device_.patch new file mode 100644 index 00000000000..2083eb88b02 --- /dev/null +++ b/queue-6.0/octeon_ep-fix-potential-memory-leak-in-octep_device_.patch @@ -0,0 +1,49 @@ +From 8ed866ba41c7564f701cc5fa04bf29725a2b3a70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 15:09:23 +0800 +Subject: octeon_ep: fix potential memory leak in octep_device_setup() + +From: Ziyang Xuan + +[ Upstream commit e4041be97b15302ebfffda8bbd45f3b2d096048f ] + +When occur unsupported_dev and mbox init errors, it did not free oct->conf +and iounmap() oct->mmio[i].hw_addr. That would trigger memory leak problem. +Add kfree() for oct->conf and iounmap() for oct->mmio[i].hw_addr under +unsupported_dev and mbox init errors to fix the problem. + +Fixes: 862cd659a6fb ("octeon_ep: Add driver framework and device initialization") +Signed-off-by: Ziyang Xuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +index 92ca3e502465..ac1e37afbe7b 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c ++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +@@ -956,7 +956,7 @@ int octep_device_setup(struct octep_device *oct) + ret = octep_ctrl_mbox_init(ctrl_mbox); + if (ret) { + dev_err(&pdev->dev, "Failed to initialize control mbox\n"); +- return -1; ++ goto unsupported_dev; + } + oct->ctrl_mbox_ifstats_offset = OCTEP_CTRL_MBOX_SZ(ctrl_mbox->h2fq.elem_sz, + ctrl_mbox->h2fq.elem_cnt, +@@ -966,6 +966,10 @@ int octep_device_setup(struct octep_device *oct) + return 0; + + unsupported_dev: ++ for (i = 0; i < OCTEP_MMIO_REGIONS; i++) ++ iounmap(oct->mmio[i].hw_addr); ++ ++ kfree(oct->conf); + return -1; + } + +-- +2.35.1 + diff --git a/queue-6.0/parport_pc-avoid-fifo-port-location-truncation.patch b/queue-6.0/parport_pc-avoid-fifo-port-location-truncation.patch new file mode 100644 index 00000000000..3b2bd268c73 --- /dev/null +++ b/queue-6.0/parport_pc-avoid-fifo-port-location-truncation.patch @@ -0,0 +1,43 @@ +From 179c935b6f0450fa26eaff39a9eeaff9e5e94ea7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Sep 2022 19:52:08 +0100 +Subject: parport_pc: Avoid FIFO port location truncation + +From: Maciej W. Rozycki + +[ Upstream commit ab126f51c93a15093df604f661c9480854c005a3 ] + +Match the data type of a temporary holding a reference to the FIFO port +with the type of the original reference coming from `struct parport', +avoiding data truncation with LP64 ports such as SPARC64 that refer to +PCI port I/O locations via their corresponding MMIO addresses and will +therefore have non-zero bits in the high 32-bit part of the reference. +And in any case it is cleaner to have the data types matching here. + +Signed-off-by: Maciej W. Rozycki +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Link: https://lore.kernel.org/linux-pci/20220419033752.GA1101844@bhelgaas/ +Acked-by: Sudip Mukherjee +Link: https://lore.kernel.org/r/alpine.DEB.2.21.2209231912550.29493@angie.orcam.me.uk +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/parport/parport_pc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c +index eda4ded4d5e5..925be41eeebe 100644 +--- a/drivers/parport/parport_pc.c ++++ b/drivers/parport/parport_pc.c +@@ -468,7 +468,7 @@ static size_t parport_pc_fifo_write_block_pio(struct parport *port, + const unsigned char *bufp = buf; + size_t left = length; + unsigned long expire = jiffies + port->physport->cad->timeout; +- const int fifo = FIFO(port); ++ const unsigned long fifo = FIFO(port); + int poll_for = 8; /* 80 usecs */ + const struct parport_pc_private *priv = port->physport->private_data; + const int fifo_depth = priv->fifo_depth; +-- +2.35.1 + diff --git a/queue-6.0/pinctrl-devicetree-fix-null-pointer-dereferencing-in.patch b/queue-6.0/pinctrl-devicetree-fix-null-pointer-dereferencing-in.patch new file mode 100644 index 00000000000..2d4633f7a32 --- /dev/null +++ b/queue-6.0/pinctrl-devicetree-fix-null-pointer-dereferencing-in.patch @@ -0,0 +1,48 @@ +From d3aa7d023deb94facd1298a0135d04bfb1307435 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 16:20:56 +0800 +Subject: pinctrl: devicetree: fix null pointer dereferencing in + pinctrl_dt_to_map + +From: Zeng Heng + +[ Upstream commit 91d5c5060ee24fe8da88cd585bb43b843d2f0dce ] + +Here is the BUG report by KASAN about null pointer dereference: + +BUG: KASAN: null-ptr-deref in strcmp+0x2e/0x50 +Read of size 1 at addr 0000000000000000 by task python3/2640 +Call Trace: + strcmp + __of_find_property + of_find_property + pinctrl_dt_to_map + +kasprintf() would return NULL pointer when kmalloc() fail to allocate. +So directly return ENOMEM, if kasprintf() return NULL pointer. + +Fixes: 57291ce295c0 ("pinctrl: core device tree mapping table parsing support") +Signed-off-by: Zeng Heng +Link: https://lore.kernel.org/r/20221110082056.2014898-1-zengheng4@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/devicetree.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c +index ef898ee8ca6b..6e0a40962f38 100644 +--- a/drivers/pinctrl/devicetree.c ++++ b/drivers/pinctrl/devicetree.c +@@ -220,6 +220,8 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev) + for (state = 0; ; state++) { + /* Retrieve the pinctrl-* property */ + propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state); ++ if (!propname) ++ return -ENOMEM; + prop = of_find_property(np, propname, &size); + kfree(propname); + if (!prop) { +-- +2.35.1 + diff --git a/queue-6.0/pinctrl-mediatek-common-v2-fix-bias-disable-for-pull.patch b/queue-6.0/pinctrl-mediatek-common-v2-fix-bias-disable-for-pull.patch new file mode 100644 index 00000000000..0160fe72d3a --- /dev/null +++ b/queue-6.0/pinctrl-mediatek-common-v2-fix-bias-disable-for-pull.patch @@ -0,0 +1,61 @@ +From d0bd4c64c3ea275cb21c9f23fc2ec9c5bc2b2ca9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 11:56:05 +0100 +Subject: pinctrl: mediatek: common-v2: Fix bias-disable for + PULL_PU_PD_RSEL_TYPE + +From: AngeloGioacchino Del Regno + +[ Upstream commit fed74d75277da865da9ba334d3f5d5e3e327971d ] + +In pinctrl-paris we're calling the .bias_set_combo() callback when we +are asked to set the pin bias to either pull up/down or pull disable. + +On newer platforms, this callback is mtk_pinconf_bias_set_combo(), +located in pinctrl-mtk-common-v2.c: this will check the "pull type" +assigned to the requested pin and in case said pin's pull type is +MTK_PULL_PU_PD_RSEL_TYPE, this function will set RSEL first, PUPD +last, which is fine. + +The issue comes when we're requesting PIN_CONFIG_BIAS_DISABLE, as +this does *not* require setting RSEL but only PU_PD: in this case, +the arg is MTK_DISABLE (zero), which is not a supported RSEL, due +to which function mtk_pinconf_bias_set_rsel() returns a failure; +because of that, mtk_pinconf_bias_set_pu_pd() is never called, +hence the pin bias is never set to DISABLE. + +To fix this issue, add a check to mtk_pinconf_bias_set_rsel(): if +we are entering that function with no pullup requested and at the +same time the arg is MTK_DISABLE, this means that we're trying to +disable pin bias, hence it's safe to return cleanly without ever +setting any RSEL register. +This makes mtk_pinconf_bias_set_combo() happy, going on with setting +the PU_PD registers, which is the only action to actually take to +disable bias on a pin/pingroup. + +Fixes: fb34a9ae383a ("pinctrl: mediatek: support rsel feature") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221104105605.33720-1-angelogioacchino.delregno@collabora.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +index e1ae3beb9f72..b7921b59eb7b 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c ++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +@@ -709,6 +709,9 @@ static int mtk_pinconf_bias_set_rsel(struct mtk_pinctrl *hw, + { + int err, rsel_val; + ++ if (!pullup && arg == MTK_DISABLE) ++ return 0; ++ + if (hw->rsel_si_unit) { + /* find pin rsel_index from pin_rsel array*/ + err = mtk_hw_pin_rsel_lookup(hw, desc, pullup, arg, &rsel_val); +-- +2.35.1 + diff --git a/queue-6.0/pinctrl-rockchip-list-all-pins-in-a-possible-mux-rou.patch b/queue-6.0/pinctrl-rockchip-list-all-pins-in-a-possible-mux-rou.patch new file mode 100644 index 00000000000..7ece76a625e --- /dev/null +++ b/queue-6.0/pinctrl-rockchip-list-all-pins-in-a-possible-mux-rou.patch @@ -0,0 +1,99 @@ +From 970158f98becfcefb84da9c06b972e6890d69cfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 14:17:23 +0200 +Subject: pinctrl: rockchip: list all pins in a possible mux route for PX30 + +From: Quentin Schulz + +[ Upstream commit bee55f2e7a44e7a7676e264b42f026e34bd244d9 ] + +The mux routes are incomplete for the PX30. This was discovered because +we had a HW design using cif-clkoutm1 with the correct pinmux in the +Device Tree but the clock would still not work. + +There are actually two muxing required: the pin muxing (performed by the +usual Device Tree pinctrl nodes) and the "function" muxing (m0 vs m1; +performed by the mux routing inside the driver). The pin muxing was +correct but the function muxing was not. + +This adds the missing pins and their configuration for the mux routes +that are already specified in the driver. + +Note that there are some "conflicts": it is possible *in Device Tree* to +(attempt to) mux the pins for e.g. clkoutm1 and clkinm0 at the same time +but this is actually not possible in hardware (because both share the +same bit for the function muxing). Since it is an impossible hardware +design, it is not deemed necessary to prevent the user from attempting +to "misconfigure" the pins/functions. + +Fixes: 87065ca9b8e5 ("pinctrl: rockchip: Add pinctrl support for PX30") +Signed-off-by: Quentin Schulz +Link: https://lore.kernel.org/r/20221017-upstream-px30-cif-clkoutm1-v1-0-4ea1389237f7@theobroma-systems.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-rockchip.c | 40 ++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index c84bd0e1ce5a..f4d2b64c0670 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -632,14 +632,54 @@ static void rockchip_get_recalced_mux(struct rockchip_pin_bank *bank, int pin, + } + + static struct rockchip_mux_route_data px30_mux_route_data[] = { ++ RK_MUXROUTE_SAME(2, RK_PB4, 1, 0x184, BIT(16 + 7)), /* cif-d0m0 */ ++ RK_MUXROUTE_SAME(3, RK_PA1, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d0m1 */ ++ RK_MUXROUTE_SAME(2, RK_PB6, 1, 0x184, BIT(16 + 7)), /* cif-d1m0 */ ++ RK_MUXROUTE_SAME(3, RK_PA2, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d1m1 */ + RK_MUXROUTE_SAME(2, RK_PA0, 1, 0x184, BIT(16 + 7)), /* cif-d2m0 */ + RK_MUXROUTE_SAME(3, RK_PA3, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d2m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA1, 1, 0x184, BIT(16 + 7)), /* cif-d3m0 */ ++ RK_MUXROUTE_SAME(3, RK_PA5, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d3m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA2, 1, 0x184, BIT(16 + 7)), /* cif-d4m0 */ ++ RK_MUXROUTE_SAME(3, RK_PA7, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d4m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA3, 1, 0x184, BIT(16 + 7)), /* cif-d5m0 */ ++ RK_MUXROUTE_SAME(3, RK_PB0, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d5m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA4, 1, 0x184, BIT(16 + 7)), /* cif-d6m0 */ ++ RK_MUXROUTE_SAME(3, RK_PB1, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d6m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA5, 1, 0x184, BIT(16 + 7)), /* cif-d7m0 */ ++ RK_MUXROUTE_SAME(3, RK_PB4, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d7m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA6, 1, 0x184, BIT(16 + 7)), /* cif-d8m0 */ ++ RK_MUXROUTE_SAME(3, RK_PB6, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d8m1 */ ++ RK_MUXROUTE_SAME(2, RK_PA7, 1, 0x184, BIT(16 + 7)), /* cif-d9m0 */ ++ RK_MUXROUTE_SAME(3, RK_PB7, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d9m1 */ ++ RK_MUXROUTE_SAME(2, RK_PB7, 1, 0x184, BIT(16 + 7)), /* cif-d10m0 */ ++ RK_MUXROUTE_SAME(3, RK_PC6, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d10m1 */ ++ RK_MUXROUTE_SAME(2, RK_PC0, 1, 0x184, BIT(16 + 7)), /* cif-d11m0 */ ++ RK_MUXROUTE_SAME(3, RK_PC7, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d11m1 */ ++ RK_MUXROUTE_SAME(2, RK_PB0, 1, 0x184, BIT(16 + 7)), /* cif-vsyncm0 */ ++ RK_MUXROUTE_SAME(3, RK_PD1, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-vsyncm1 */ ++ RK_MUXROUTE_SAME(2, RK_PB1, 1, 0x184, BIT(16 + 7)), /* cif-hrefm0 */ ++ RK_MUXROUTE_SAME(3, RK_PD2, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-hrefm1 */ ++ RK_MUXROUTE_SAME(2, RK_PB2, 1, 0x184, BIT(16 + 7)), /* cif-clkinm0 */ ++ RK_MUXROUTE_SAME(3, RK_PD3, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-clkinm1 */ ++ RK_MUXROUTE_SAME(2, RK_PB3, 1, 0x184, BIT(16 + 7)), /* cif-clkoutm0 */ ++ RK_MUXROUTE_SAME(3, RK_PD0, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-clkoutm1 */ + RK_MUXROUTE_SAME(3, RK_PC6, 2, 0x184, BIT(16 + 8)), /* pdm-m0 */ + RK_MUXROUTE_SAME(2, RK_PC6, 1, 0x184, BIT(16 + 8) | BIT(8)), /* pdm-m1 */ ++ RK_MUXROUTE_SAME(3, RK_PD3, 2, 0x184, BIT(16 + 8)), /* pdm-sdi0m0 */ ++ RK_MUXROUTE_SAME(2, RK_PC5, 2, 0x184, BIT(16 + 8) | BIT(8)), /* pdm-sdi0m1 */ + RK_MUXROUTE_SAME(1, RK_PD3, 2, 0x184, BIT(16 + 10)), /* uart2-rxm0 */ + RK_MUXROUTE_SAME(2, RK_PB6, 2, 0x184, BIT(16 + 10) | BIT(10)), /* uart2-rxm1 */ ++ RK_MUXROUTE_SAME(1, RK_PD2, 2, 0x184, BIT(16 + 10)), /* uart2-txm0 */ ++ RK_MUXROUTE_SAME(2, RK_PB4, 2, 0x184, BIT(16 + 10) | BIT(10)), /* uart2-txm1 */ + RK_MUXROUTE_SAME(0, RK_PC1, 2, 0x184, BIT(16 + 9)), /* uart3-rxm0 */ + RK_MUXROUTE_SAME(1, RK_PB7, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-rxm1 */ ++ RK_MUXROUTE_SAME(0, RK_PC0, 2, 0x184, BIT(16 + 9)), /* uart3-txm0 */ ++ RK_MUXROUTE_SAME(1, RK_PB6, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-txm1 */ ++ RK_MUXROUTE_SAME(0, RK_PC2, 2, 0x184, BIT(16 + 9)), /* uart3-ctsm0 */ ++ RK_MUXROUTE_SAME(1, RK_PB4, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-ctsm1 */ ++ RK_MUXROUTE_SAME(0, RK_PC3, 2, 0x184, BIT(16 + 9)), /* uart3-rtsm0 */ ++ RK_MUXROUTE_SAME(1, RK_PB5, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-rtsm1 */ + }; + + static struct rockchip_mux_route_data rk3128_mux_route_data[] = { +-- +2.35.1 + diff --git a/queue-6.0/platform-surface-aggregator-do-not-check-for-repeate.patch b/queue-6.0/platform-surface-aggregator-do-not-check-for-repeate.patch new file mode 100644 index 00000000000..da77d31ebfa --- /dev/null +++ b/queue-6.0/platform-surface-aggregator-do-not-check-for-repeate.patch @@ -0,0 +1,102 @@ +From 1207ae09231c6b41e57596251a8f5a442fa70bc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Nov 2022 19:59:50 +0100 +Subject: platform/surface: aggregator: Do not check for repeated unsequenced + packets + +From: Maximilian Luz + +[ Upstream commit d9a477f643eb3de71fbea5ae6103b800ceb8f547 ] + +Currently, we check any received packet whether we have already seen it +previously, regardless of the packet type (sequenced / unsequenced). We +do this by checking the sequence number. This assumes that sequence +numbers are valid for both sequenced and unsequenced packets. However, +this assumption appears to be incorrect. + +On some devices, the sequence number field of unsequenced packets (in +particular HID input events on the Surface Pro 9) is always zero. As a +result, the current retransmission check kicks in and discards all but +the first unsequenced packet, breaking (among other things) keyboard and +touchpad input. + +Note that we have, so far, only seen packets being retransmitted in +sequenced communication. In particular, this happens when there is an +ACK timeout, causing the EC (or us) to re-send the packet waiting for an +ACK. Arguably, retransmission / duplication of unsequenced packets +should not be an issue as there is no logical condition (such as an ACK +timeout) to determine when a packet should be sent again. + +Therefore, remove the retransmission check for unsequenced packets +entirely to resolve the issue. + +Fixes: c167b9c7e3d6 ("platform/surface: Add Surface Aggregator subsystem") +Signed-off-by: Maximilian Luz +Link: https://lore.kernel.org/r/20221113185951.224759-1-luzmaximilian@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + .../surface/aggregator/ssh_packet_layer.c | 24 +++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +diff --git a/drivers/platform/surface/aggregator/ssh_packet_layer.c b/drivers/platform/surface/aggregator/ssh_packet_layer.c +index 6748fe4ac5d5..def8d7ac541f 100644 +--- a/drivers/platform/surface/aggregator/ssh_packet_layer.c ++++ b/drivers/platform/surface/aggregator/ssh_packet_layer.c +@@ -1596,16 +1596,32 @@ static void ssh_ptl_timeout_reap(struct work_struct *work) + ssh_ptl_tx_wakeup_packet(ptl); + } + +-static bool ssh_ptl_rx_retransmit_check(struct ssh_ptl *ptl, u8 seq) ++static bool ssh_ptl_rx_retransmit_check(struct ssh_ptl *ptl, const struct ssh_frame *frame) + { + int i; + ++ /* ++ * Ignore unsequenced packets. On some devices (notably Surface Pro 9), ++ * unsequenced events will always be sent with SEQ=0x00. Attempting to ++ * detect retransmission would thus just block all events. ++ * ++ * While sequence numbers would also allow detection of retransmitted ++ * packets in unsequenced communication, they have only ever been used ++ * to cover edge-cases in sequenced transmission. In particular, the ++ * only instance of packets being retransmitted (that we are aware of) ++ * is due to an ACK timeout. As this does not happen in unsequenced ++ * communication, skip the retransmission check for those packets ++ * entirely. ++ */ ++ if (frame->type == SSH_FRAME_TYPE_DATA_NSQ) ++ return false; ++ + /* + * Check if SEQ has been seen recently (i.e. packet was + * re-transmitted and we should ignore it). + */ + for (i = 0; i < ARRAY_SIZE(ptl->rx.blocked.seqs); i++) { +- if (likely(ptl->rx.blocked.seqs[i] != seq)) ++ if (likely(ptl->rx.blocked.seqs[i] != frame->seq)) + continue; + + ptl_dbg(ptl, "ptl: ignoring repeated data packet\n"); +@@ -1613,7 +1629,7 @@ static bool ssh_ptl_rx_retransmit_check(struct ssh_ptl *ptl, u8 seq) + } + + /* Update list of blocked sequence IDs. */ +- ptl->rx.blocked.seqs[ptl->rx.blocked.offset] = seq; ++ ptl->rx.blocked.seqs[ptl->rx.blocked.offset] = frame->seq; + ptl->rx.blocked.offset = (ptl->rx.blocked.offset + 1) + % ARRAY_SIZE(ptl->rx.blocked.seqs); + +@@ -1624,7 +1640,7 @@ static void ssh_ptl_rx_dataframe(struct ssh_ptl *ptl, + const struct ssh_frame *frame, + const struct ssam_span *payload) + { +- if (ssh_ptl_rx_retransmit_check(ptl, frame->seq)) ++ if (ssh_ptl_rx_retransmit_check(ptl, frame)) + return; + + ptl->ops.data_received(ptl, payload); +-- +2.35.1 + diff --git a/queue-6.0/platform-x86-intel-pmc-don-t-unconditionally-attach-.patch b/queue-6.0/platform-x86-intel-pmc-don-t-unconditionally-attach-.patch new file mode 100644 index 00000000000..c5f81875201 --- /dev/null +++ b/queue-6.0/platform-x86-intel-pmc-don-t-unconditionally-attach-.patch @@ -0,0 +1,75 @@ +From aee5a93c99be7acc1666b0df4dbc228eca8efdc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 17:31:44 +0100 +Subject: platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when + virtualized +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Roger Pau Monné + +[ Upstream commit 2dbfb3f33350e1e868d3d7ed4c176d8777150878 ] + +The current logic in the Intel PMC driver will forcefully attach it +when detecting any CPU on the intel_pmc_core_platform_ids array, +even if the matching ACPI device is not present. + +There's no checking in pmc_core_probe() to assert that the PMC device +is present, and hence on virtualized environments the PMC device +probes successfully, even if the underlying registers are not present. +Before commit 21ae43570940 ("platform/x86: intel_pmc_core: Substitute PCI +with CPUID enumeration") the driver would check for the presence of a +specific PCI device, and that prevented the driver from attaching when +running virtualized. + +Fix by only forcefully attaching the PMC device when not running +virtualized. Note that virtualized platforms can still get the device +to load if the appropriate ACPI device is present on the tables +provided to the VM. + +Make an exception for the Xen initial domain, which does have full +hardware access, and hence can attach to the PMC if present. + +Fixes: 21ae43570940 ("platform/x86: intel_pmc_core: Substitute PCI with CPUID enumeration") +Signed-off-by: Roger Pau Monné +Acked-by: David E. Box +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20221110163145.80374-1-roger.pau@citrix.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/pmc/pltdrv.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/platform/x86/intel/pmc/pltdrv.c b/drivers/platform/x86/intel/pmc/pltdrv.c +index 15ca8afdd973..ddfba38c2104 100644 +--- a/drivers/platform/x86/intel/pmc/pltdrv.c ++++ b/drivers/platform/x86/intel/pmc/pltdrv.c +@@ -18,6 +18,8 @@ + #include + #include + ++#include ++ + static void intel_pmc_core_release(struct device *dev) + { + kfree(dev); +@@ -53,6 +55,13 @@ static int __init pmc_core_platform_init(void) + if (acpi_dev_present("INT33A1", NULL, -1)) + return -ENODEV; + ++ /* ++ * Skip forcefully attaching the device for VMs. Make an exception for ++ * Xen dom0, which does have full hardware access. ++ */ ++ if (cpu_feature_enabled(X86_FEATURE_HYPERVISOR) && !xen_initial_domain()) ++ return -ENODEV; ++ + if (!x86_match_cpu(intel_pmc_core_platform_ids)) + return -ENODEV; + +-- +2.35.1 + diff --git a/queue-6.0/s390-avoid-using-global-register-for-current_stack_p.patch b/queue-6.0/s390-avoid-using-global-register-for-current_stack_p.patch new file mode 100644 index 00000000000..83e4d2a9447 --- /dev/null +++ b/queue-6.0/s390-avoid-using-global-register-for-current_stack_p.patch @@ -0,0 +1,56 @@ +From 5cf034818461de9907d4771b3c827d2f1f728004 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 12:06:47 +0100 +Subject: s390: avoid using global register for current_stack_pointer + +From: Vasily Gorbik + +[ Upstream commit e3c11025bcd2142a61abe5806b2f86a0e78118df ] + +Commit 30de14b1884b ("s390: current_stack_pointer shouldn't be a +function") made current_stack_pointer a global register variable like +on many other architectures. Unfortunately on s390 it uncovers old +gcc bug which is fixed only since gcc-9.1 [gcc commit 3ad7fed1cc87 +("S/390: Fix PR89775. Stackpointer save/restore instructions removed")] +and backported to gcc-8.4 and later. Due to this bug gcc versions prior +to 8.4 generate broken code which leads to stack corruptions. + +Current minimal gcc version required to build the kernel is declared +as 5.1. It is not possible to fix all old gcc versions, so work +around this problem by avoiding using global register variable for +current_stack_pointer. + +Fixes: 30de14b1884b ("s390: current_stack_pointer shouldn't be a function") +Reviewed-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/processor.h | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h +index bd66f8e34949..00f45d8f1efa 100644 +--- a/arch/s390/include/asm/processor.h ++++ b/arch/s390/include/asm/processor.h +@@ -202,7 +202,16 @@ unsigned long __get_wchan(struct task_struct *p); + /* Has task runtime instrumentation enabled ? */ + #define is_ri_task(tsk) (!!(tsk)->thread.ri_cb) + +-register unsigned long current_stack_pointer asm("r15"); ++/* avoid using global register due to gcc bug in versions < 8.4 */ ++#define current_stack_pointer (__current_stack_pointer()) ++ ++static __always_inline unsigned long __current_stack_pointer(void) ++{ ++ unsigned long sp; ++ ++ asm volatile("lgr %0,15" : "=d" (sp)); ++ return sp; ++} + + static __always_inline unsigned short stap(void) + { +-- +2.35.1 + diff --git a/queue-6.0/scsi-scsi_transport_sas-fix-error-handling-in-sas_ph.patch b/queue-6.0/scsi-scsi_transport_sas-fix-error-handling-in-sas_ph.patch new file mode 100644 index 00000000000..750e8a2261f --- /dev/null +++ b/queue-6.0/scsi-scsi_transport_sas-fix-error-handling-in-sas_ph.patch @@ -0,0 +1,77 @@ +From a96c4558c7e5aece7d7d69a807bb4d9620742137 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Nov 2022 20:48:28 +0800 +Subject: scsi: scsi_transport_sas: Fix error handling in sas_phy_add() + +From: Yang Yingliang + +[ Upstream commit 5d7bebf2dfb0dc97aac1fbace0910e557ecdb16f ] + +If transport_add_device() fails in sas_phy_add(), the kernel will crash +trying to delete the device in transport_remove_device() called from +sas_remove_host(). + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 +CPU: 61 PID: 42829 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc1+ #173 +pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : device_del+0x54/0x3d0 +lr : device_del+0x37c/0x3d0 +Call trace: + device_del+0x54/0x3d0 + attribute_container_class_device_del+0x28/0x38 + transport_remove_classdev+0x6c/0x80 + attribute_container_device_trigger+0x108/0x110 + transport_remove_device+0x28/0x38 + sas_phy_delete+0x30/0x60 [scsi_transport_sas] + do_sas_phy_delete+0x6c/0x80 [scsi_transport_sas] + device_for_each_child+0x68/0xb0 + sas_remove_children+0x40/0x50 [scsi_transport_sas] + sas_remove_host+0x20/0x38 [scsi_transport_sas] + hisi_sas_remove+0x40/0x68 [hisi_sas_main] + hisi_sas_v2_remove+0x20/0x30 [hisi_sas_v2_hw] + platform_remove+0x2c/0x60 + +Fix this by checking and handling return value of transport_add_device() +in sas_phy_add(). + +Fixes: c7ebbbce366c ("[SCSI] SAS transport class") +Suggested-by: John Garry +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221107124828.115557-1-yangyingliang@huawei.com +Reviewed-by: John Garry +Reviewed-by: Jason Yan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_sas.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c +index 2f88c61216ee..74b99f2b0b74 100644 +--- a/drivers/scsi/scsi_transport_sas.c ++++ b/drivers/scsi/scsi_transport_sas.c +@@ -722,12 +722,17 @@ int sas_phy_add(struct sas_phy *phy) + int error; + + error = device_add(&phy->dev); +- if (!error) { +- transport_add_device(&phy->dev); +- transport_configure_device(&phy->dev); ++ if (error) ++ return error; ++ ++ error = transport_add_device(&phy->dev); ++ if (error) { ++ device_del(&phy->dev); ++ return error; + } ++ transport_configure_device(&phy->dev); + +- return error; ++ return 0; + } + EXPORT_SYMBOL(sas_phy_add); + +-- +2.35.1 + diff --git a/queue-6.0/sctp-clear-out_curr-if-all-frag-chunks-of-current-ms.patch b/queue-6.0/sctp-clear-out_curr-if-all-frag-chunks-of-current-ms.patch new file mode 100644 index 00000000000..7b7b89c0142 --- /dev/null +++ b/queue-6.0/sctp-clear-out_curr-if-all-frag-chunks-of-current-ms.patch @@ -0,0 +1,68 @@ +From f379ed1edb698e6b058c932908dced5ce9c10b6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 17:45:16 -0400 +Subject: sctp: clear out_curr if all frag chunks of current msg are pruned + +From: Xin Long + +[ Upstream commit 2f201ae14ae0f91dbf1cffea7bb1e29e81d4d108 ] + +A crash was reported by Zhen Chen: + + list_del corruption, ffffa035ddf01c18->next is NULL + WARNING: CPU: 1 PID: 250682 at lib/list_debug.c:49 __list_del_entry_valid+0x59/0xe0 + RIP: 0010:__list_del_entry_valid+0x59/0xe0 + Call Trace: + sctp_sched_dequeue_common+0x17/0x70 [sctp] + sctp_sched_fcfs_dequeue+0x37/0x50 [sctp] + sctp_outq_flush_data+0x85/0x360 [sctp] + sctp_outq_uncork+0x77/0xa0 [sctp] + sctp_cmd_interpreter.constprop.0+0x164/0x1450 [sctp] + sctp_side_effects+0x37/0xe0 [sctp] + sctp_do_sm+0xd0/0x230 [sctp] + sctp_primitive_SEND+0x2f/0x40 [sctp] + sctp_sendmsg_to_asoc+0x3fa/0x5c0 [sctp] + sctp_sendmsg+0x3d5/0x440 [sctp] + sock_sendmsg+0x5b/0x70 + +and in sctp_sched_fcfs_dequeue() it dequeued a chunk from stream +out_curr outq while this outq was empty. + +Normally stream->out_curr must be set to NULL once all frag chunks of +current msg are dequeued, as we can see in sctp_sched_dequeue_done(). +However, in sctp_prsctp_prune_unsent() as it is not a proper dequeue, +sctp_sched_dequeue_done() is not called to do this. + +This patch is to fix it by simply setting out_curr to NULL when the +last frag chunk of current msg is dequeued from out_curr stream in +sctp_prsctp_prune_unsent(). + +Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") +Reported-by: Zhen Chen +Tested-by: Caowangbao +Signed-off-by: Xin Long +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/outqueue.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c +index c99fe3dc19bc..20831079fb09 100644 +--- a/net/sctp/outqueue.c ++++ b/net/sctp/outqueue.c +@@ -403,6 +403,11 @@ static int sctp_prsctp_prune_unsent(struct sctp_association *asoc, + sout = SCTP_SO(&asoc->stream, chk->sinfo.sinfo_stream); + sout->ext->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++; + ++ /* clear out_curr if all frag chunks are pruned */ ++ if (asoc->stream.out_curr == sout && ++ list_is_last(&chk->frag_list, &chk->msg->chunks)) ++ asoc->stream.out_curr = NULL; ++ + msg_len -= chk->skb->truesize + sizeof(struct sctp_chunk); + sctp_chunk_free(chk); + if (msg_len <= 0) +-- +2.35.1 + diff --git a/queue-6.0/sctp-remove-the-unnecessary-sinfo_stream-check-in-sc.patch b/queue-6.0/sctp-remove-the-unnecessary-sinfo_stream-check-in-sc.patch new file mode 100644 index 00000000000..0032357e04a --- /dev/null +++ b/queue-6.0/sctp-remove-the-unnecessary-sinfo_stream-check-in-sc.patch @@ -0,0 +1,53 @@ +From 944c7c9c09c95fa637a72f6e969582cf46341521 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 17:45:15 -0400 +Subject: sctp: remove the unnecessary sinfo_stream check in + sctp_prsctp_prune_unsent + +From: Xin Long + +[ Upstream commit 9f0b773210c27a8f5d98ddb2fc4ba60a42a3285f ] + +Since commit 5bbbbe32a431 ("sctp: introduce stream scheduler foundations"), +sctp_stream_outq_migrate() has been called in sctp_stream_init/update to +removes those chunks to streams higher than the new max. There is no longer +need to do such check in sctp_prsctp_prune_unsent(). + +Signed-off-by: Xin Long +Signed-off-by: Jakub Kicinski +Stable-dep-of: 2f201ae14ae0 ("sctp: clear out_curr if all frag chunks of current msg are pruned") +Signed-off-by: Sasha Levin +--- + net/sctp/outqueue.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c +index e213aaf45d67..c99fe3dc19bc 100644 +--- a/net/sctp/outqueue.c ++++ b/net/sctp/outqueue.c +@@ -384,6 +384,7 @@ static int sctp_prsctp_prune_unsent(struct sctp_association *asoc, + { + struct sctp_outq *q = &asoc->outqueue; + struct sctp_chunk *chk, *temp; ++ struct sctp_stream_out *sout; + + q->sched->unsched_all(&asoc->stream); + +@@ -398,12 +399,9 @@ static int sctp_prsctp_prune_unsent(struct sctp_association *asoc, + sctp_sched_dequeue_common(q, chk); + asoc->sent_cnt_removable--; + asoc->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++; +- if (chk->sinfo.sinfo_stream < asoc->stream.outcnt) { +- struct sctp_stream_out *streamout = +- SCTP_SO(&asoc->stream, chk->sinfo.sinfo_stream); + +- streamout->ext->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++; +- } ++ sout = SCTP_SO(&asoc->stream, chk->sinfo.sinfo_stream); ++ sout->ext->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++; + + msg_len -= chk->skb->truesize + sizeof(struct sctp_chunk); + sctp_chunk_free(chk); +-- +2.35.1 + diff --git a/queue-6.0/selftests-bpf-fix-casting-error-when-cross-compiling.patch b/queue-6.0/selftests-bpf-fix-casting-error-when-cross-compiling.patch new file mode 100644 index 00000000000..296a1a0d11c --- /dev/null +++ b/queue-6.0/selftests-bpf-fix-casting-error-when-cross-compiling.patch @@ -0,0 +1,45 @@ +From f50b1325911a00d01e5b86bb6cf858074c57b44d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 20:19:45 +0800 +Subject: selftests/bpf: Fix casting error when cross-compiling test_verifier + for 32-bit platforms + +From: Pu Lehui + +[ Upstream commit 0811664da064c6d7ca64c02f5579f758a007e52d ] + +When cross-compiling test_verifier for 32-bit platforms, the casting error is shown below: + +test_verifier.c:1263:27: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast] + 1263 | info.xlated_prog_insns = (__u64)*buf; + | ^ +cc1: all warnings being treated as errors + +Fix it by adding zero-extension for it. + +Fixes: 933ff53191eb ("selftests/bpf: specify expected instructions in test_verifier tests") +Signed-off-by: Pu Lehui +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20221108121945.4104644-1-pulehui@huaweicloud.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_verifier.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c +index f9d553fbf68a..ce97a9262698 100644 +--- a/tools/testing/selftests/bpf/test_verifier.c ++++ b/tools/testing/selftests/bpf/test_verifier.c +@@ -1260,7 +1260,7 @@ static int get_xlated_program(int fd_prog, struct bpf_insn **buf, int *cnt) + + bzero(&info, sizeof(info)); + info.xlated_prog_len = xlated_prog_len; +- info.xlated_prog_insns = (__u64)*buf; ++ info.xlated_prog_insns = (__u64)(unsigned long)*buf; + if (bpf_obj_get_info_by_fd(fd_prog, &info, &info_len)) { + perror("second bpf_obj_get_info_by_fd failed"); + goto out_free_buf; +-- +2.35.1 + diff --git a/queue-6.0/selftests-bpf-fix-test_progs-compilation-failure-in-.patch b/queue-6.0/selftests-bpf-fix-test_progs-compilation-failure-in-.patch new file mode 100644 index 00000000000..e045b5d8df6 --- /dev/null +++ b/queue-6.0/selftests-bpf-fix-test_progs-compilation-failure-in-.patch @@ -0,0 +1,50 @@ +From 5537f867cf1fca75eaa2b2ca1418ad4a36b232a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 09:58:57 +0800 +Subject: selftests/bpf: Fix test_progs compilation failure in 32-bit arch + +From: Yang Jihong + +[ Upstream commit 5704bc7e8991164b14efb748b5afa0715c25fac3 ] + +test_progs fails to be compiled in the 32-bit arch, log is as follows: + + test_progs.c:1013:52: error: format '%ld' expects argument of type 'long int', but argument 3 has type 'size_t' {aka 'unsigned int'} [-Werror=format=] + 1013 | sprintf(buf, "MSG_TEST_LOG (cnt: %ld, last: %d)", + | ~~^ + | | + | long int + | %d + 1014 | strlen(msg->test_log.log_buf), + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + | | + | size_t {aka unsigned int} + +Fix it. + +Fixes: 91b2c0afd00c ("selftests/bpf: Add parallelism to test_progs") +Signed-off-by: Yang Jihong +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20221108015857.132457-1-yangjihong1@huawei.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_progs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c +index 3561c97701f2..a07b8ae64bf8 100644 +--- a/tools/testing/selftests/bpf/test_progs.c ++++ b/tools/testing/selftests/bpf/test_progs.c +@@ -993,7 +993,7 @@ static inline const char *str_msg(const struct msg *msg, char *buf) + msg->subtest_done.have_log); + break; + case MSG_TEST_LOG: +- sprintf(buf, "MSG_TEST_LOG (cnt: %ld, last: %d)", ++ sprintf(buf, "MSG_TEST_LOG (cnt: %zu, last: %d)", + strlen(msg->test_log.log_buf), + msg->test_log.is_last); + break; +-- +2.35.1 + diff --git a/queue-6.0/serial-8250-omap-fix-missing-pm-runtime-calls-for-om.patch b/queue-6.0/serial-8250-omap-fix-missing-pm-runtime-calls-for-om.patch new file mode 100644 index 00000000000..35f718d4a4d --- /dev/null +++ b/queue-6.0/serial-8250-omap-fix-missing-pm-runtime-calls-for-om.patch @@ -0,0 +1,102 @@ +From ccef46beab3333b82a00f4cc3c2631c8f85482da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 09:36:13 +0300 +Subject: serial: 8250: omap: Fix missing PM runtime calls for + omap8250_set_mctrl() + +From: Tony Lindgren + +[ Upstream commit 93810191f5d23652c0b8a1a9b3a4a89d6fd5063e ] + +There are cases where omap8250_set_mctrl() may get called after the +UART has already autoidled causing an asynchronous external abort. + +This can happen on ttyport_open(): + +mem_serial_in from omap8250_set_mctrl+0x38/0xa0 +omap8250_set_mctrl from uart_update_mctrl+0x4c/0x58 +uart_update_mctrl from uart_dtr_rts+0x60/0xa8 +uart_dtr_rts from tty_port_block_til_ready+0xd0/0x2a8 +tty_port_block_til_ready from uart_open+0x14/0x1c +uart_open from ttyport_open+0x64/0x148 + +And on ttyport_close(): + +omap8250_set_mctrl from uart_update_mctrl+0x3c/0x48 +uart_update_mctrl from uart_dtr_rts+0x54/0x9c +uart_dtr_rts from tty_port_shutdown+0x78/0x9c +tty_port_shutdown from tty_port_close+0x3c/0x74 +tty_port_close from ttyport_close+0x40/0x58 + +It can also happen on disassociate_ctty() calling uart_shutdown() +that ends up calling omap8250_set_mctrl(). + +Let's fix the issue by adding missing PM runtime calls to +omap8250_set_mctrl(). To do this, we need to add __omap8250_set_mctrl() +that can be called from both omap8250_set_mctrl(), and from runtime PM +resume path when restoring the registers. + +Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver") +Reported-by: Merlijn Wajer +Reported-by: Romain Naour +Reported-by: Ivaylo Dimitrov +Tested-by: Ivaylo Dimitrov +Signed-off-by: Tony Lindgren +Depends-on: dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") +Link: https://lore.kernel.org/r/20221024063613.25943-1-tony@atomide.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 38ee3e42251a..03a026bdba3c 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -157,7 +157,11 @@ static u32 uart_read(struct uart_8250_port *up, u32 reg) + return readl(up->port.membase + (reg << up->port.regshift)); + } + +-static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl) ++/* ++ * Called on runtime PM resume path from omap8250_restore_regs(), and ++ * omap8250_set_mctrl(). ++ */ ++static void __omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl) + { + struct uart_8250_port *up = up_to_u8250p(port); + struct omap8250_priv *priv = up->port.private_data; +@@ -181,6 +185,20 @@ static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl) + } + } + ++static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl) ++{ ++ int err; ++ ++ err = pm_runtime_resume_and_get(port->dev); ++ if (err) ++ return; ++ ++ __omap8250_set_mctrl(port, mctrl); ++ ++ pm_runtime_mark_last_busy(port->dev); ++ pm_runtime_put_autosuspend(port->dev); ++} ++ + /* + * Work Around for Errata i202 (2430, 3430, 3630, 4430 and 4460) + * The access to uart register after MDR1 Access +@@ -341,7 +359,7 @@ static void omap8250_restore_regs(struct uart_8250_port *up) + + omap8250_update_mdr1(up, priv); + +- up->port.ops->set_mctrl(&up->port, up->port.mctrl); ++ __omap8250_set_mctrl(&up->port, up->port.mctrl); + + if (up->port.rs485.flags & SER_RS485_ENABLED) + serial8250_em485_stop_tx(up); +-- +2.35.1 + diff --git a/queue-6.0/serial-8250-omap-fix-unpaired-pm_runtime_put_sync-in.patch b/queue-6.0/serial-8250-omap-fix-unpaired-pm_runtime_put_sync-in.patch new file mode 100644 index 00000000000..bfa6e226e99 --- /dev/null +++ b/queue-6.0/serial-8250-omap-fix-unpaired-pm_runtime_put_sync-in.patch @@ -0,0 +1,45 @@ +From 0484ac24cfb4126283d63d7ecdb69fa5d4ccda7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 13:58:13 +0300 +Subject: serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in + omap8250_remove() + +From: Tony Lindgren + +[ Upstream commit e3f0c638f428fd66b5871154b62706772045f91a ] + +On remove, we get an error for "Runtime PM usage count underflow!". I guess +this driver is mostly built-in, and this issue has gone unnoticed for a +while. Somehow I did not catch this issue with my earlier fix done with +commit 4e0f5cc65098 ("serial: 8250_omap: Fix probe and remove for PM +runtime"). + +Fixes: 4e0f5cc65098 ("serial: 8250_omap: Fix probe and remove for PM runtime") +Signed-off-by: Tony Lindgren +Depends-on: dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") +Link: https://lore.kernel.org/r/20221028105813.54290-1-tony@atomide.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index c772735035b5..3ba1526ccd20 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -1461,6 +1461,11 @@ static int omap8250_probe(struct platform_device *pdev) + static int omap8250_remove(struct platform_device *pdev) + { + struct omap8250_priv *priv = platform_get_drvdata(pdev); ++ int err; ++ ++ err = pm_runtime_resume_and_get(&pdev->dev); ++ if (err) ++ return err; + + pm_runtime_dont_use_autosuspend(&pdev->dev); + pm_runtime_put_sync(&pdev->dev); +-- +2.35.1 + diff --git a/queue-6.0/serial-8250-omap-flush-pm-qos-work-on-remove.patch b/queue-6.0/serial-8250-omap-flush-pm-qos-work-on-remove.patch new file mode 100644 index 00000000000..41dbb3dc826 --- /dev/null +++ b/queue-6.0/serial-8250-omap-flush-pm-qos-work-on-remove.patch @@ -0,0 +1,39 @@ +From 7b904a04834e9fad624345461484a35cf690a48e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 14:00:44 +0300 +Subject: serial: 8250: omap: Flush PM QOS work on remove + +From: Tony Lindgren + +[ Upstream commit d0b68629bd2fb61e0171a62f2e8da3db322f5cf6 ] + +Rebinding 8250_omap in a loop will at some point produce a warning for +kernel/power/qos.c:296 cpu_latency_qos_update_request() with error +"cpu_latency_qos_update_request called for unknown object". Let's flush +the possibly pending PM QOS work scheduled from omap8250_runtime_suspend() +before we disable runtime PM. + +Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver") +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20221028110044.54719-1-tony@atomide.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 3ba1526ccd20..b96fbf8d31df 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -1469,6 +1469,7 @@ static int omap8250_remove(struct platform_device *pdev) + + pm_runtime_dont_use_autosuspend(&pdev->dev); + pm_runtime_put_sync(&pdev->dev); ++ flush_work(&priv->qos_work); + pm_runtime_disable(&pdev->dev); + serial8250_unregister_port(priv->line); + cpu_latency_qos_remove_request(&priv->pm_qos_request); +-- +2.35.1 + diff --git a/queue-6.0/serial-8250_omap-remove-wait-loop-from-errata-i202-w.patch b/queue-6.0/serial-8250_omap-remove-wait-loop-from-errata-i202-w.patch new file mode 100644 index 00000000000..da1471fbcd0 --- /dev/null +++ b/queue-6.0/serial-8250_omap-remove-wait-loop-from-errata-i202-w.patch @@ -0,0 +1,67 @@ +From 99c8ec2905c3d915faecf83c58c939407d919608 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 13:23:39 +0200 +Subject: serial: 8250_omap: remove wait loop from Errata i202 workaround +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthias Schiffer + +[ Upstream commit e828e56684d61b17317e0cfdef83791fa61cb76b ] + +We were occasionally seeing the "Errata i202: timedout" on an AM335x +board when repeatedly opening and closing a UART connected to an active +sender. As new input may arrive at any time, it is possible to miss the +"RX FIFO empty" condition, forcing the loop to wait until it times out. + +Nothing in the i202 Advisory states that such a wait is even necessary; +other FIFO clear functions like serial8250_clear_fifos() do not wait +either. For this reason, it seems safe to remove the wait, fixing the +mentioned issue. + +Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver") +Reviewed-by: Ilpo Järvinen +Signed-off-by: Matthias Schiffer +Link: https://lore.kernel.org/r/20221013112339.2540767-1-matthias.schiffer@ew.tq-group.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 17 ----------------- + 1 file changed, 17 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 03a026bdba3c..c772735035b5 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -211,27 +211,10 @@ static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl) + static void omap_8250_mdr1_errataset(struct uart_8250_port *up, + struct omap8250_priv *priv) + { +- u8 timeout = 255; +- + serial_out(up, UART_OMAP_MDR1, priv->mdr1); + udelay(2); + serial_out(up, UART_FCR, up->fcr | UART_FCR_CLEAR_XMIT | + UART_FCR_CLEAR_RCVR); +- /* +- * Wait for FIFO to empty: when empty, RX_FIFO_E bit is 0 and +- * TX_FIFO_E bit is 1. +- */ +- while (UART_LSR_THRE != (serial_in(up, UART_LSR) & +- (UART_LSR_THRE | UART_LSR_DR))) { +- timeout--; +- if (!timeout) { +- /* Should *never* happen. we warn and carry on */ +- dev_crit(up->port.dev, "Errata i202: timedout %x\n", +- serial_in(up, UART_LSR)); +- break; +- } +- udelay(1); +- } + } + + static void omap_8250_get_divisor(struct uart_port *port, unsigned int baud, +-- +2.35.1 + diff --git a/queue-6.0/serial-imx-add-missing-.thaw_noirq-hook.patch b/queue-6.0/serial-imx-add-missing-.thaw_noirq-hook.patch new file mode 100644 index 00000000000..c86f4ee684c --- /dev/null +++ b/queue-6.0/serial-imx-add-missing-.thaw_noirq-hook.patch @@ -0,0 +1,95 @@ +From 49d00dc6498bb384342b2193ab9e0fb754ab12a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2022 20:13:53 +0800 +Subject: serial: imx: Add missing .thaw_noirq hook + +From: Shawn Guo + +[ Upstream commit 4561d8008a467cb05ac632a215391d6b787f40aa ] + +The following warning is seen with non-console UART instance when +system hibernates. + +[ 37.371969] ------------[ cut here ]------------ +[ 37.376599] uart3_root_clk already disabled +[ 37.380810] WARNING: CPU: 0 PID: 296 at drivers/clk/clk.c:952 clk_core_disable+0xa4/0xb0 +... +[ 37.506986] Call trace: +[ 37.509432] clk_core_disable+0xa4/0xb0 +[ 37.513270] clk_disable+0x34/0x50 +[ 37.516672] imx_uart_thaw+0x38/0x5c +[ 37.520250] platform_pm_thaw+0x30/0x6c +[ 37.524089] dpm_run_callback.constprop.0+0x3c/0xd4 +[ 37.528972] device_resume+0x7c/0x160 +[ 37.532633] dpm_resume+0xe8/0x230 +[ 37.536036] hibernation_snapshot+0x288/0x430 +[ 37.540397] hibernate+0x10c/0x2e0 +[ 37.543798] state_store+0xc4/0xd0 +[ 37.547203] kobj_attr_store+0x1c/0x30 +[ 37.550953] sysfs_kf_write+0x48/0x60 +[ 37.554619] kernfs_fop_write_iter+0x118/0x1ac +[ 37.559063] new_sync_write+0xe8/0x184 +[ 37.562812] vfs_write+0x230/0x290 +[ 37.566214] ksys_write+0x68/0xf4 +[ 37.569529] __arm64_sys_write+0x20/0x2c +[ 37.573452] invoke_syscall.constprop.0+0x50/0xf0 +[ 37.578156] do_el0_svc+0x11c/0x150 +[ 37.581648] el0_svc+0x30/0x140 +[ 37.584792] el0t_64_sync_handler+0xe8/0xf0 +[ 37.588976] el0t_64_sync+0x1a0/0x1a4 +[ 37.592639] ---[ end trace 56e22eec54676d75 ]--- + +On hibernating, pm core calls into related hooks in sequence like: + + .freeze + .freeze_noirq + .thaw_noirq + .thaw + +With .thaw_noirq hook being absent, the clock will be disabled in a +unbalanced call which results the warning above. + + imx_uart_freeze() + clk_prepare_enable() + imx_uart_suspend_noirq() + clk_disable() + imx_uart_thaw + clk_disable_unprepare() + +Adding the missing .thaw_noirq hook as imx_uart_resume_noirq() will have +the call sequence corrected as below and thus fix the warning. + + imx_uart_freeze() + clk_prepare_enable() + imx_uart_suspend_noirq() + clk_disable() + imx_uart_resume_noirq() + clk_enable() + imx_uart_thaw + clk_disable_unprepare() + +Fixes: 09df0b3464e5 ("serial: imx: fix endless loop during suspend") +Reviewed-by: Martin Kaiser +Signed-off-by: Shawn Guo +Link: https://lore.kernel.org/r/20221012121353.2346280-1-shawn.guo@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/imx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index 278b4033a3cc..57e3fda979ea 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -2594,6 +2594,7 @@ static const struct dev_pm_ops imx_uart_pm_ops = { + .suspend_noirq = imx_uart_suspend_noirq, + .resume_noirq = imx_uart_resume_noirq, + .freeze_noirq = imx_uart_suspend_noirq, ++ .thaw_noirq = imx_uart_resume_noirq, + .restore_noirq = imx_uart_resume_noirq, + .suspend = imx_uart_suspend, + .resume = imx_uart_resume, +-- +2.35.1 + diff --git a/queue-6.0/series b/queue-6.0/series index 126a04d9798..1ee4c78eaa7 100644 --- a/queue-6.0/series +++ b/queue-6.0/series @@ -68,3 +68,129 @@ kvm-svm-remove-dead-field-from-struct-svm_cpu_data.patch kvm-svm-do-not-allocate-struct-svm_cpu_data-dynamica.patch kvm-svm-restore-host-save-area-from-assembly.patch kvm-svm-move-msr_ia32_spec_ctrl-save-restore-to-asse.patch +arm64-dts-qcom-ipq8074-correct-apcs-register-space-s.patch +arm64-dts-qcom-sa8155p-adp-specify-which-ldo-modes-a.patch +arm64-dts-qcom-sa8295p-adp-specify-which-ldo-modes-a.patch +arm64-dts-qcom-sc8280xp-crd-specify-which-ldo-modes-.patch +arm64-dts-qcom-sm8150-xperia-kumano-specify-which-ld.patch +arm64-dts-qcom-sm8250-xperia-edo-specify-which-ldo-m.patch +arm64-dts-qcom-sm8350-hdk-specify-which-ldo-modes-ar.patch +arm64-dts-qcom-sc8280xp-fix-ufs_card_phy-ref-clock.patch +arm64-dts-qcom-sc8280xp-correct-ref-clock-for-ufs_me.patch +arm64-dts-qcom-sc8280xp-fix-usb0-phy-pcs_misc-regist.patch +arm64-dts-qcom-sc8280xp-fix-usb1-phy-rx1-registers.patch +arm64-dts-qcom-sc8280xp-fix-usb-phy-pcs-registers.patch +arm64-dts-qcom-sc8280xp-drop-broken-dp-phy-nodes.patch +arm64-dts-qcom-sc8280xp-fix-ufs-phy-serdes-size.patch +arm64-dts-qcom-sc7280-add-the-reset-reg-for-lpass-au.patch +spi-stm32-print-summary-callbacks-suppressed-message.patch +arm-dts-at91-sama7g5-fix-signal-name-of-pin-pb2.patch +asoc-core-fix-use-after-free-in-snd_soc_exit.patch +asoc-fsl_asrc-fsl_esai-fsl_sai-allow-config_pm-n.patch +arm64-dts-qcom-sm8250-disable-the-not-yet-supported-.patch +asoc-tas2770-fix-set_tdm_slot-in-case-of-single-slot.patch +asoc-tas2764-fix-set_tdm_slot-in-case-of-single-slot.patch +asoc-tas2780-fix-set_tdm_slot-in-case-of-single-slot.patch +arm-at91-pm-avoid-soft-resetting-ac-dll.patch +serial-8250-omap-fix-missing-pm-runtime-calls-for-om.patch +serial-8250_omap-remove-wait-loop-from-errata-i202-w.patch +serial-8250-omap-fix-unpaired-pm_runtime_put_sync-in.patch +serial-8250-omap-flush-pm-qos-work-on-remove.patch +tty-serial-fsl_lpuart-don-t-break-the-on-going-trans.patch +serial-imx-add-missing-.thaw_noirq-hook.patch +tty-n_gsm-fix-sleep-in-atomic-context-bug-in-gsm_con.patch +asoc-rt5514-fix-legacy-dai-naming.patch +asoc-rt5677-fix-legacy-dai-naming.patch +bpf-test_run-fix-alignment-problem-in-bpf_prog_test_.patch +bnxt_en-refactor-bnxt_cancel_reservations.patch +bnxt_en-fix-the-handling-of-pcie-aer.patch +asoc-soc-utils-remove-__exit-for-snd_soc_util_exit.patch +pinctrl-rockchip-list-all-pins-in-a-possible-mux-rou.patch +mtd-onenand-omap2-add-dependency-on-gpmc.patch +scsi-scsi_transport_sas-fix-error-handling-in-sas_ph.patch +sctp-remove-the-unnecessary-sinfo_stream-check-in-sc.patch +sctp-clear-out_curr-if-all-frag-chunks-of-current-ms.patch +erofs-clean-up-.read_folio-and-.readahead-in-fscache.patch +erofs-get-correct-count-for-unmapped-range-in-fscach.patch +block-sed-opal-kmalloc-the-cmd-resp-buffers.patch +nfsd-put-the-export-reference-in-nfsd4_verify_deleg_.patch +bpf-fix-memory-leaks-in-__check_func_call.patch +io_uring-calculate-cqes-from-the-user-visible-value.patch +pinctrl-mediatek-common-v2-fix-bias-disable-for-pull.patch +arm64-fix-bit-shifting-ub-in-the-midr_cpu_model-macr.patch +nvmet-fix-a-memory-leak.patch +siox-fix-possible-memory-leak-in-siox_device_add.patch +parport_pc-avoid-fifo-port-location-truncation.patch +selftests-bpf-fix-casting-error-when-cross-compiling.patch +selftests-bpf-fix-test_progs-compilation-failure-in-.patch +pinctrl-devicetree-fix-null-pointer-dereferencing-in.patch +drm-vc4-kms-fix-is_err-vs-null-check-for-vc4_kms.patch +drm-panel-simple-set-bpc-field-for-logic-technologie.patch +drm-drv-fix-potential-memory-leak-in-drm_dev_init.patch +drm-fix-potential-null-ptr-deref-in-drm_vblank_destr.patch +arm64-dts-imx8mm-tqma8mqml-mba8mx-fix-usb-dr.patch +arm-dts-imx7-fix-nand-controller-size-cells.patch +arm64-dts-imx8mm-fix-nand-controller-size-cells.patch +erofs-put-metabuf-in-error-path-in-fscache-mode.patch +arm64-dts-imx8mn-fix-nand-controller-size-cells.patch +arm64-dts-imx93-pinfunc-drop-execution-permission.patch +ata-libata-transport-fix-double-ata_host_put-in-ata_.patch +ata-libata-transport-fix-error-handling-in-ata_tport.patch +ata-libata-transport-fix-error-handling-in-ata_tlink.patch +ata-libata-transport-fix-error-handling-in-ata_tdev_.patch +nfp-change-eeprom-length-to-max-length-enumerators.patch +mips-fix-duplicate-definitions-for-exported-symbols.patch +mips-loongson64-add-warn_on-on-kexec-related-kmalloc.patch +io_uring-poll-fix-double-poll-req-flags-races.patch +cifs-fix-connections-leak-when-tlink-setup-failed.patch +bpf-initialize-same-number-of-free-nodes-for-each-pc.patch +ata-libata-core-do-not-issue-non-internal-commands-o.patch +net-bgmac-drop-free_netdev-from-bgmac_enet_remove.patch +misdn-fix-possible-memory-leak-in-misdn_dsp_element_.patch +net-hinic-fix-error-handling-in-hinic_module_init.patch +net-phy-dp83867-fix-sgmii-fifo-depth-for-non-of-devi.patch +net-stmmac-ensure-tx-function-is-not-running-in-stmm.patch +mctp-i2c-don-t-count-unused-invalid-keys-for-flow-re.patch +soc-imx8m-enable-ocotp-clock-before-reading-the-regi.patch +net-liquidio-release-resources-when-liquidio-driver-.patch +misdn-fix-misuse-of-put_device-in-misdn_register_dev.patch +net-macvlan-use-built-in-rcu-list-checking.patch +net-caif-fix-double-disconnect-client-in-chnl_net_op.patch +bnxt_en-remove-debugfs-when-pci_register_driver-fail.patch +octeon_ep-delete-unnecessary-napi-rollback-under-set.patch +octeon_ep-ensure-octep_get_link_status-successfully-.patch +octeon_ep-fix-potential-memory-leak-in-octep_device_.patch +octeon_ep-ensure-get-mac-address-successfully-before.patch +drm-lima-fix-opp-clkname-setting-in-case-of-missing-.patch +net-mhi-fix-memory-leak-in-mhi_net_dellink.patch +net-dsa-make-dsa_master_ioctl-see-through-port_hwtst.patch +xen-pcpu-fix-possible-memory-leak-in-register_pcpu.patch +erofs-fix-missing-xas_retry-in-fscache-mode.patch +mlxsw-avoid-warnings-when-not-offloaded-fdb-entry-wi.patch +net-ionic-fix-error-handling-in-ionic_init_module.patch +kcm-close-race-conditions-on-sk_receive_queue.patch +net-ena-fix-error-handling-in-ena_init.patch +net-hns3-fix-incorrect-hw-rss-hash-type-of-rx-packet.patch +net-hns3-fix-return-value-check-bug-of-rx-copybreak.patch +net-hns3-fix-setting-incorrect-phy-link-ksettings-fo.patch +bridge-switchdev-fix-memory-leaks-when-changing-vlan.patch +drbd-use-after-free-in-drbd_create_device.patch +platform-x86-intel-pmc-don-t-unconditionally-attach-.patch +platform-surface-aggregator-do-not-check-for-repeate.patch +netfs-fix-missing-xas_retry-calls-in-xarray-iteratio.patch +netfs-fix-dodgy-maths.patch +cifs-add-check-for-returning-value-of-smb2_close_ini.patch +net-ag71xx-call-phylink_disconnect_phy-if-ag71xx_hw_.patch +net-x25-fix-skb-leak-in-x25_lapb_receive_frame.patch +net-dsa-don-t-leak-tagger-owned-storage-on-switch-dr.patch +nvmet-fix-a-memory-leak-in-nvmet_auth_set_key.patch +cifs-fix-wrong-return-value-checking-when-getflags.patch +net-lan966x-fix-potential-null-ptr-deref-in-lan966x_.patch +net-microchip-sparx5-fix-potential-null-ptr-deref-in.patch +net-thunderbolt-fix-error-handling-in-tbnet_init.patch +s390-avoid-using-global-register-for-current_stack_p.patch +l2tp-serialize-access-to-sk_user_data-with-sk_callba.patch +cifs-add-check-for-returning-value-of-smb2_set_info_.patch +netdevsim-fix-memory-leak-of-nsim_dev-fa_cookie.patch +block-make-dma_alignment-a-stacking-queue_limit.patch +dm-crypt-provide-dma_alignment-limit-in-io_hints.patch diff --git a/queue-6.0/siox-fix-possible-memory-leak-in-siox_device_add.patch b/queue-6.0/siox-fix-possible-memory-leak-in-siox_device_add.patch new file mode 100644 index 00000000000..ade1811b1f6 --- /dev/null +++ b/queue-6.0/siox-fix-possible-memory-leak-in-siox_device_add.patch @@ -0,0 +1,46 @@ +From acf348aa80ddb307ccfcca224685be14a81296f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 10:13:34 +0800 +Subject: siox: fix possible memory leak in siox_device_add() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yang Yingliang + +[ Upstream commit 6e63153db50059fb78b8a8447b132664887d24e3 ] + +If device_register() returns error in siox_device_add(), +the name allocated by dev_set_name() need be freed. As +comment of device_register() says, it should use put_device() +to give up the reference in the error path. So fix this +by calling put_device(), then the name can be freed in +kobject_cleanup(), and sdevice is freed in siox_device_release(), +set it to null in error path. + +Fixes: bbecb07fa0af ("siox: new driver framework for eckelmann SIOX") +Signed-off-by: Yang Yingliang +Reviewed-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20221104021334.618189-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/siox/siox-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/siox/siox-core.c b/drivers/siox/siox-core.c +index 7c4f32d76966..561408583b2b 100644 +--- a/drivers/siox/siox-core.c ++++ b/drivers/siox/siox-core.c +@@ -839,6 +839,8 @@ static struct siox_device *siox_device_add(struct siox_master *smaster, + + err_device_register: + /* don't care to make the buffer smaller again */ ++ put_device(&sdevice->dev); ++ sdevice = NULL; + + err_buf_alloc: + siox_master_unlock(smaster); +-- +2.35.1 + diff --git a/queue-6.0/soc-imx8m-enable-ocotp-clock-before-reading-the-regi.patch b/queue-6.0/soc-imx8m-enable-ocotp-clock-before-reading-the-regi.patch new file mode 100644 index 00000000000..fae8b40e531 --- /dev/null +++ b/queue-6.0/soc-imx8m-enable-ocotp-clock-before-reading-the-regi.patch @@ -0,0 +1,72 @@ +From 060ca32c3a095011a93240925289d4848addfe79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 12:14:18 +0800 +Subject: soc: imx8m: Enable OCOTP clock before reading the register + +From: Xiaolei Wang + +[ Upstream commit 836fb30949d9edf91d7de696a884ceeae7e426d2 ] + +Commit 7d981405d0fd ("soc: imx8m: change to use platform driver") ever +removed the dependency on bootloader for enabling OCOTP clock. It +helped to fix a kexec kernel hang issue. But unfortunately it caused +a regression on CAAM driver and got reverted. + +This is the second try to enable the OCOTP clock by directly calling +clock API instead of indirectly enabling the clock via nvmem API. + +Fixes: ac34de14ac30 ("Revert "soc: imx8m: change to use platform driver"") +Signed-off-by: Xiaolei Wang +Reviewed-by: Lucas Stach +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/soc-imx8m.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c +index cc57a384d74d..28144c699b0c 100644 +--- a/drivers/soc/imx/soc-imx8m.c ++++ b/drivers/soc/imx/soc-imx8m.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + #define REV_B1 0x21 + +@@ -56,6 +57,7 @@ static u32 __init imx8mq_soc_revision(void) + void __iomem *ocotp_base; + u32 magic; + u32 rev; ++ struct clk *clk; + + np = of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp"); + if (!np) +@@ -63,6 +65,13 @@ static u32 __init imx8mq_soc_revision(void) + + ocotp_base = of_iomap(np, 0); + WARN_ON(!ocotp_base); ++ clk = of_clk_get_by_name(np, NULL); ++ if (!clk) { ++ WARN_ON(!clk); ++ return 0; ++ } ++ ++ clk_prepare_enable(clk); + + /* + * SOC revision on older imx8mq is not available in fuses so query +@@ -79,6 +88,8 @@ static u32 __init imx8mq_soc_revision(void) + soc_uid <<= 32; + soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW); + ++ clk_disable_unprepare(clk); ++ clk_put(clk); + iounmap(ocotp_base); + of_node_put(np); + +-- +2.35.1 + diff --git a/queue-6.0/spi-stm32-print-summary-callbacks-suppressed-message.patch b/queue-6.0/spi-stm32-print-summary-callbacks-suppressed-message.patch new file mode 100644 index 00000000000..200bd5ab9b2 --- /dev/null +++ b/queue-6.0/spi-stm32-print-summary-callbacks-suppressed-message.patch @@ -0,0 +1,39 @@ +From 223d99d575a4b393287b74f4df56b03c84a2652e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 20:35:13 +0200 +Subject: spi: stm32: Print summary 'callbacks suppressed' message + +From: Marek Vasut + +[ Upstream commit 195583504be28df5d608a4677dd796117aea875f ] + +The original fix "spi: stm32: Rate-limit the 'Communication suspended' message" +still leads to "stm32h7_spi_irq_thread: 1696 callbacks suppressed" spew in the +kernel log. Since this 'Communication suspended' message is a debug print, add +RATELIMIT_MSG_ON_RELEASE flag to inhibit the "callbacks suspended" part during +normal operation and only print summary at the end. + +Fixes: ea8be08cc9358 ("spi: stm32: Rate-limit the 'Communication suspended' message") +Signed-off-by: Marek Vasut +Link: https://lore.kernel.org/r/20221018183513.206706-1-marex@denx.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 6fe617b445a5..3c2fa2e2f94a 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -886,6 +886,7 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) + static DEFINE_RATELIMIT_STATE(rs, + DEFAULT_RATELIMIT_INTERVAL * 10, + 1); ++ ratelimit_set_flags(&rs, RATELIMIT_MSG_ON_RELEASE); + if (__ratelimit(&rs)) + dev_dbg_ratelimited(spi->dev, "Communication suspended\n"); + if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0))) +-- +2.35.1 + diff --git a/queue-6.0/tty-n_gsm-fix-sleep-in-atomic-context-bug-in-gsm_con.patch b/queue-6.0/tty-n_gsm-fix-sleep-in-atomic-context-bug-in-gsm_con.patch new file mode 100644 index 00000000000..12cf1934f9f --- /dev/null +++ b/queue-6.0/tty-n_gsm-fix-sleep-in-atomic-context-bug-in-gsm_con.patch @@ -0,0 +1,49 @@ +From 7f4e8b4508a832cb66c141664f6bac4b17c9a2a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Oct 2022 12:07:09 +0800 +Subject: tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send + +From: Duoming Zhou + +[ Upstream commit 7b7dfe4833c70a11cdfa51b38705103bd31eddaa ] + +The function gsm_dlci_t1() is a timer handler that runs in an +atomic context, but it calls "kzalloc(..., GFP_KERNEL)" that +may sleep. As a result, the sleep-in-atomic-context bug will +happen. The process is shown below: + +gsm_dlci_t1() + gsm_dlci_open() + gsm_modem_update() + gsm_modem_upd_via_msc() + gsm_control_send() + kzalloc(sizeof(.., GFP_KERNEL) //may sleep + +This patch changes the gfp_t parameter of kzalloc() from GFP_KERNEL to +GFP_ATOMIC in order to mitigate the bug. + +Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20221002040709.27849-1-duoming@zju.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_gsm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 01c112e2e214..2a0de70e0be4 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -1670,7 +1670,7 @@ static struct gsm_control *gsm_control_send(struct gsm_mux *gsm, + unsigned int command, u8 *data, int clen) + { + struct gsm_control *ctrl = kzalloc(sizeof(struct gsm_control), +- GFP_KERNEL); ++ GFP_ATOMIC); + unsigned long flags; + if (ctrl == NULL) + return NULL; +-- +2.35.1 + diff --git a/queue-6.0/tty-serial-fsl_lpuart-don-t-break-the-on-going-trans.patch b/queue-6.0/tty-serial-fsl_lpuart-don-t-break-the-on-going-trans.patch new file mode 100644 index 00000000000..389f63a8988 --- /dev/null +++ b/queue-6.0/tty-serial-fsl_lpuart-don-t-break-the-on-going-trans.patch @@ -0,0 +1,137 @@ +From a6377af606c72dcc78ba51d83b85b904e667a6f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 16:58:44 +0800 +Subject: tty: serial: fsl_lpuart: don't break the on-going transfer when + global reset + +From: Sherry Sun + +[ Upstream commit 76bad3f88750f8cc465c489e6846249e0bc3d8f5 ] + +lpuart_global_reset() shouldn't break the on-going transmit engine, need +to recover the on-going data transfer after reset. + +This can help earlycon here, since commit 60f361722ad2 ("serial: +fsl_lpuart: Reset prior to registration") moved lpuart_global_reset() +before uart_add_one_port(), earlycon is writing during global reset, +as global reset will disable the TX and clear the baud rate register, +which caused the earlycon cannot work any more after reset, needs to +restore the baud rate and re-enable the transmitter to recover the +earlycon write. + +Also move the lpuart_global_reset() down, then we can reuse the +lpuart32_tx_empty() without declaration. + +Fixes: bd5305dcabbc ("tty: serial: fsl_lpuart: do software reset for imx7ulp and imx8qxp") +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20221024085844.22786-1-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 76 +++++++++++++++++++++------------ + 1 file changed, 49 insertions(+), 27 deletions(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 34990901c805..c8297102e087 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -404,33 +405,6 @@ static unsigned int lpuart_get_baud_clk_rate(struct lpuart_port *sport) + #define lpuart_enable_clks(x) __lpuart_enable_clks(x, true) + #define lpuart_disable_clks(x) __lpuart_enable_clks(x, false) + +-static int lpuart_global_reset(struct lpuart_port *sport) +-{ +- struct uart_port *port = &sport->port; +- void __iomem *global_addr; +- int ret; +- +- if (uart_console(port)) +- return 0; +- +- ret = clk_prepare_enable(sport->ipg_clk); +- if (ret) { +- dev_err(sport->port.dev, "failed to enable uart ipg clk: %d\n", ret); +- return ret; +- } +- +- if (is_imx7ulp_lpuart(sport) || is_imx8qxp_lpuart(sport)) { +- global_addr = port->membase + UART_GLOBAL - IMX_REG_OFF; +- writel(UART_GLOBAL_RST, global_addr); +- usleep_range(GLOBAL_RST_MIN_US, GLOBAL_RST_MAX_US); +- writel(0, global_addr); +- usleep_range(GLOBAL_RST_MIN_US, GLOBAL_RST_MAX_US); +- } +- +- clk_disable_unprepare(sport->ipg_clk); +- return 0; +-} +- + static void lpuart_stop_tx(struct uart_port *port) + { + unsigned char temp; +@@ -2641,6 +2615,54 @@ static const struct serial_rs485 lpuart_rs485_supported = { + /* delay_rts_* and RX_DURING_TX are not supported */ + }; + ++static int lpuart_global_reset(struct lpuart_port *sport) ++{ ++ struct uart_port *port = &sport->port; ++ void __iomem *global_addr; ++ unsigned long ctrl, bd; ++ unsigned int val = 0; ++ int ret; ++ ++ ret = clk_prepare_enable(sport->ipg_clk); ++ if (ret) { ++ dev_err(sport->port.dev, "failed to enable uart ipg clk: %d\n", ret); ++ return ret; ++ } ++ ++ if (is_imx7ulp_lpuart(sport) || is_imx8qxp_lpuart(sport)) { ++ /* ++ * If the transmitter is used by earlycon, wait for transmit engine to ++ * complete and then reset. ++ */ ++ ctrl = lpuart32_read(port, UARTCTRL); ++ if (ctrl & UARTCTRL_TE) { ++ bd = lpuart32_read(&sport->port, UARTBAUD); ++ if (read_poll_timeout(lpuart32_tx_empty, val, val, 1, 100000, false, ++ port)) { ++ dev_warn(sport->port.dev, ++ "timeout waiting for transmit engine to complete\n"); ++ clk_disable_unprepare(sport->ipg_clk); ++ return 0; ++ } ++ } ++ ++ global_addr = port->membase + UART_GLOBAL - IMX_REG_OFF; ++ writel(UART_GLOBAL_RST, global_addr); ++ usleep_range(GLOBAL_RST_MIN_US, GLOBAL_RST_MAX_US); ++ writel(0, global_addr); ++ usleep_range(GLOBAL_RST_MIN_US, GLOBAL_RST_MAX_US); ++ ++ /* Recover the transmitter for earlycon. */ ++ if (ctrl & UARTCTRL_TE) { ++ lpuart32_write(port, bd, UARTBAUD); ++ lpuart32_write(port, ctrl, UARTCTRL); ++ } ++ } ++ ++ clk_disable_unprepare(sport->ipg_clk); ++ return 0; ++} ++ + static int lpuart_probe(struct platform_device *pdev) + { + const struct lpuart_soc_data *sdata = of_device_get_match_data(&pdev->dev); +-- +2.35.1 + diff --git a/queue-6.0/xen-pcpu-fix-possible-memory-leak-in-register_pcpu.patch b/queue-6.0/xen-pcpu-fix-possible-memory-leak-in-register_pcpu.patch new file mode 100644 index 00000000000..fa75c676651 --- /dev/null +++ b/queue-6.0/xen-pcpu-fix-possible-memory-leak-in-register_pcpu.patch @@ -0,0 +1,40 @@ +From 53cb34088e28a620b0b28e76525037bbbdf7251f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 23:24:41 +0800 +Subject: xen/pcpu: fix possible memory leak in register_pcpu() + +From: Yang Yingliang + +[ Upstream commit da36a2a76b01b210ffaa55cdc2c99bc8783697c5 ] + +In device_add(), dev_set_name() is called to allocate name, if it returns +error, the name need be freed. As comment of device_register() says, it +should use put_device() to give up the reference in the error path. So fix +this by calling put_device(), then the name can be freed in kobject_cleanup(). + +Fixes: f65c9bb3fb72 ("xen/pcpu: Xen physical cpus online/offline sys interface") +Signed-off-by: Yang Yingliang +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20221110152441.401630-1-yangyingliang@huawei.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/pcpu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/xen/pcpu.c b/drivers/xen/pcpu.c +index 47aa3a1ccaf5..fd3a644b0855 100644 +--- a/drivers/xen/pcpu.c ++++ b/drivers/xen/pcpu.c +@@ -228,7 +228,7 @@ static int register_pcpu(struct pcpu *pcpu) + + err = device_register(dev); + if (err) { +- pcpu_release(dev); ++ put_device(dev); + return err; + } + +-- +2.35.1 +