From: Sasha Levin Date: Sat, 27 Jul 2024 14:04:17 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v6.1.103~100 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3fab3e2d9224914d90b12f414f4a07f74888baa2;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/arm64-dts-rockchip-increase-vop-clk-rate-on-rk3328.patch b/queue-4.19/arm64-dts-rockchip-increase-vop-clk-rate-on-rk3328.patch new file mode 100644 index 00000000000..8efae84c1dc --- /dev/null +++ b/queue-4.19/arm64-dts-rockchip-increase-vop-clk-rate-on-rk3328.patch @@ -0,0 +1,42 @@ +From c7f03f3dbc823f869bc522f54c1fd56c1dbccbd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jun 2024 17:03:52 +0000 +Subject: arm64: dts: rockchip: Increase VOP clk rate on RK3328 + +From: Jonas Karlman + +[ Upstream commit 0f2ddb128fa20f8441d903285632f2c69e90fae1 ] + +The VOP on RK3328 needs to run at a higher rate in order to produce a +proper 3840x2160 signal. + +Change to use 300MHz for VIO clk and 400MHz for VOP clk, same rates used +by vendor 4.4 kernel. + +Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20240615170417.3134517-2-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index f6931f8d36f6d..ab870b9043967 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -649,8 +649,8 @@ cru: clock-controller@ff440000 { + <0>, <24000000>, + <24000000>, <24000000>, + <15000000>, <15000000>, +- <100000000>, <100000000>, +- <100000000>, <100000000>, ++ <300000000>, <100000000>, ++ <400000000>, <100000000>, + <50000000>, <100000000>, + <100000000>, <100000000>, + <50000000>, <50000000>, +-- +2.43.0 + diff --git a/queue-4.19/bna-adjust-name-buf-size-of-bna_tcb-and-bna_ccb-stru.patch b/queue-4.19/bna-adjust-name-buf-size-of-bna_tcb-and-bna_ccb-stru.patch new file mode 100644 index 00000000000..438b8cda364 --- /dev/null +++ b/queue-4.19/bna-adjust-name-buf-size-of-bna_tcb-and-bna_ccb-stru.patch @@ -0,0 +1,77 @@ +From 301793101d3a9c176c580c5a0f0d2ab0b2fb9968 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 10:50:08 +0000 +Subject: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures + +From: Alexey Kodanev + +[ Upstream commit c9741a03dc8e491e57b95fba0058ab46b7e506da ] + +To have enough space to write all possible sprintf() args. Currently +'name' size is 16, but the first '%s' specifier may already need at +least 16 characters, since 'bnad->netdev->name' is used there. + +For '%d' specifiers, assume that they require: + * 1 char for 'tx_id + tx_info->tcb[i]->id' sum, BNAD_MAX_TXQ_PER_TX is 8 + * 2 chars for 'rx_id + rx_info->rx_ctrl[i].ccb->id', BNAD_MAX_RXP_PER_RX + is 16 + +And replace sprintf with snprintf. + +Detected using the static analysis tool - Svace. + +Fixes: 8b230ed8ec96 ("bna: Brocade 10Gb Ethernet device driver") +Signed-off-by: Alexey Kodanev +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/brocade/bna/bna_types.h | 2 +- + drivers/net/ethernet/brocade/bna/bnad.c | 11 ++++++----- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/brocade/bna/bna_types.h b/drivers/net/ethernet/brocade/bna/bna_types.h +index c438d032e8bff..1af883c849ad9 100644 +--- a/drivers/net/ethernet/brocade/bna/bna_types.h ++++ b/drivers/net/ethernet/brocade/bna/bna_types.h +@@ -418,7 +418,7 @@ struct bna_ib { + /* Tx object */ + + /* Tx datapath control structure */ +-#define BNA_Q_NAME_SIZE 16 ++#define BNA_Q_NAME_SIZE (IFNAMSIZ + 6) + struct bna_tcb { + /* Fast path */ + void **sw_qpt; +diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c +index 1e25c3b5f563b..9773901ea6907 100644 +--- a/drivers/net/ethernet/brocade/bna/bnad.c ++++ b/drivers/net/ethernet/brocade/bna/bnad.c +@@ -1543,8 +1543,9 @@ bnad_tx_msix_register(struct bnad *bnad, struct bnad_tx_info *tx_info, + + for (i = 0; i < num_txqs; i++) { + vector_num = tx_info->tcb[i]->intr_vector; +- sprintf(tx_info->tcb[i]->name, "%s TXQ %d", bnad->netdev->name, +- tx_id + tx_info->tcb[i]->id); ++ snprintf(tx_info->tcb[i]->name, BNA_Q_NAME_SIZE, "%s TXQ %d", ++ bnad->netdev->name, ++ tx_id + tx_info->tcb[i]->id); + err = request_irq(bnad->msix_table[vector_num].vector, + (irq_handler_t)bnad_msix_tx, 0, + tx_info->tcb[i]->name, +@@ -1594,9 +1595,9 @@ bnad_rx_msix_register(struct bnad *bnad, struct bnad_rx_info *rx_info, + + for (i = 0; i < num_rxps; i++) { + vector_num = rx_info->rx_ctrl[i].ccb->intr_vector; +- sprintf(rx_info->rx_ctrl[i].ccb->name, "%s CQ %d", +- bnad->netdev->name, +- rx_id + rx_info->rx_ctrl[i].ccb->id); ++ snprintf(rx_info->rx_ctrl[i].ccb->name, BNA_Q_NAME_SIZE, ++ "%s CQ %d", bnad->netdev->name, ++ rx_id + rx_info->rx_ctrl[i].ccb->id); + err = request_irq(bnad->msix_table[vector_num].vector, + (irq_handler_t)bnad_msix_rx, 0, + rx_info->rx_ctrl[i].ccb->name, +-- +2.43.0 + diff --git a/queue-4.19/bnxt_re-fix-imm_data-endianness.patch b/queue-4.19/bnxt_re-fix-imm_data-endianness.patch new file mode 100644 index 00000000000..9ae3ad27ace --- /dev/null +++ b/queue-4.19/bnxt_re-fix-imm_data-endianness.patch @@ -0,0 +1,105 @@ +From 554df6d4e5d9cd9201defd15289efc14813aaf33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 14:21:02 +0200 +Subject: bnxt_re: Fix imm_data endianness + +From: Jack Wang + +[ Upstream commit 95b087f87b780daafad1dbb2c84e81b729d5d33f ] + +When map a device between servers with MLX and BCM RoCE nics, RTRS +server complain about unknown imm type, and can't map the device, + +After more debug, it seems bnxt_re wrongly handle the +imm_data, this patch fixed the compat issue with MLX for us. + +In off list discussion, Selvin confirmed HW is working in little endian format +and all data needs to be converted to LE while providing. + +This patch fix the endianness for imm_data + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Signed-off-by: Jack Wang +Link: https://lore.kernel.org/r/20240710122102.37569-1-jinpu.wang@ionos.com +Acked-by: Selvin Xavier +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++---- + drivers/infiniband/hw/bnxt_re/qplib_fp.h | 6 +++--- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index e365fa8251c16..e2c93a50fe762 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -2112,7 +2112,7 @@ static int bnxt_re_build_send_wqe(struct bnxt_re_qp *qp, + break; + case IB_WR_SEND_WITH_IMM: + wqe->type = BNXT_QPLIB_SWQE_TYPE_SEND_WITH_IMM; +- wqe->send.imm_data = wr->ex.imm_data; ++ wqe->send.imm_data = be32_to_cpu(wr->ex.imm_data); + break; + case IB_WR_SEND_WITH_INV: + wqe->type = BNXT_QPLIB_SWQE_TYPE_SEND_WITH_INV; +@@ -2142,7 +2142,7 @@ static int bnxt_re_build_rdma_wqe(const struct ib_send_wr *wr, + break; + case IB_WR_RDMA_WRITE_WITH_IMM: + wqe->type = BNXT_QPLIB_SWQE_TYPE_RDMA_WRITE_WITH_IMM; +- wqe->rdma.imm_data = wr->ex.imm_data; ++ wqe->rdma.imm_data = be32_to_cpu(wr->ex.imm_data); + break; + case IB_WR_RDMA_READ: + wqe->type = BNXT_QPLIB_SWQE_TYPE_RDMA_READ; +@@ -3110,7 +3110,7 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *qp, + wc->byte_len = orig_cqe->length; + wc->qp = &qp1_qp->ib_qp; + +- wc->ex.imm_data = orig_cqe->immdata; ++ wc->ex.imm_data = cpu_to_be32(le32_to_cpu(orig_cqe->immdata)); + wc->src_qp = orig_cqe->src_qp; + memcpy(wc->smac, orig_cqe->smac, ETH_ALEN); + if (bnxt_re_is_vlan_pkt(orig_cqe, &vlan_id, &sl)) { +@@ -3231,7 +3231,7 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc) + continue; + } + wc->qp = &qp->ib_qp; +- wc->ex.imm_data = cqe->immdata; ++ wc->ex.imm_data = cpu_to_be32(le32_to_cpu(cqe->immdata)); + wc->src_qp = cqe->src_qp; + memcpy(wc->smac, cqe->smac, ETH_ALEN); + wc->port_num = 1; +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +index 72352ca80ace7..d0b24e961511a 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +@@ -145,7 +145,7 @@ struct bnxt_qplib_swqe { + /* Send, with imm, inval key */ + struct { + union { +- __be32 imm_data; ++ u32 imm_data; + u32 inv_key; + }; + u32 q_key; +@@ -163,7 +163,7 @@ struct bnxt_qplib_swqe { + /* RDMA write, with imm, read */ + struct { + union { +- __be32 imm_data; ++ u32 imm_data; + u32 inv_key; + }; + u64 remote_va; +@@ -349,7 +349,7 @@ struct bnxt_qplib_cqe { + u32 length; + u64 wr_id; + union { +- __be32 immdata; ++ __le32 immdata; + u32 invrkey; + }; + u64 qp_handle; +-- +2.43.0 + diff --git a/queue-4.19/drm-etnaviv-fix-dma-direction-handling-for-cached-rw.patch b/queue-4.19/drm-etnaviv-fix-dma-direction-handling-for-cached-rw.patch new file mode 100644 index 00000000000..b0bf67dbcef --- /dev/null +++ b/queue-4.19/drm-etnaviv-fix-dma-direction-handling-for-cached-rw.patch @@ -0,0 +1,42 @@ +From 5786c5c07acbf3666a3908ad7c9f2c9701bbb5c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 19:11:06 +0200 +Subject: drm/etnaviv: fix DMA direction handling for cached RW buffers + +From: Lucas Stach + +[ Upstream commit 58979ad6330a70450ed78837be3095107d022ea9 ] + +The dma sync operation needs to be done with DMA_BIDIRECTIONAL when +the BO is prepared for both read and write operations. + +Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver") +Signed-off-by: Lucas Stach +Reviewed-by: Philipp Zabel +Reviewed-by: Christian Gmeiner +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_gem.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +index 1fa74226db91f..69f91662ba236 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +@@ -370,9 +370,11 @@ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj) + + static inline enum dma_data_direction etnaviv_op_to_dma_dir(u32 op) + { +- if (op & ETNA_PREP_READ) ++ op &= ETNA_PREP_READ | ETNA_PREP_WRITE; ++ ++ if (op == ETNA_PREP_READ) + return DMA_FROM_DEVICE; +- else if (op & ETNA_PREP_WRITE) ++ else if (op == ETNA_PREP_WRITE) + return DMA_TO_DEVICE; + else + return DMA_BIDIRECTIONAL; +-- +2.43.0 + diff --git a/queue-4.19/ext4-avoid-writing-unitialized-memory-to-disk-in-ea-.patch b/queue-4.19/ext4-avoid-writing-unitialized-memory-to-disk-in-ea-.patch new file mode 100644 index 00000000000..63aecc37729 --- /dev/null +++ b/queue-4.19/ext4-avoid-writing-unitialized-memory-to-disk-in-ea-.patch @@ -0,0 +1,46 @@ +From 4cf945f0484141e00623c2d7159b98ca28d2442c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 17:02:34 +0200 +Subject: ext4: avoid writing unitialized memory to disk in EA inodes + +From: Jan Kara + +[ Upstream commit 65121eff3e4c8c90f8126debf3c369228691c591 ] + +If the extended attribute size is not a multiple of block size, the last +block in the EA inode will have uninitialized tail which will get +written to disk. We will never expose the data to userspace but still +this is not a good practice so just zero out the tail of the block as it +isn't going to cause a noticeable performance overhead. + +Fixes: e50e5129f384 ("ext4: xattr-in-inode support") +Reported-by: syzbot+9c1fe13fcb51574b249b@syzkaller.appspotmail.com +Reported-by: Hugh Dickins +Signed-off-by: Jan Kara +Link: https://patch.msgid.link/20240613150234.25176-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/xattr.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index dc42a8fba0d22..e9299f769dbfe 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1420,6 +1420,12 @@ static int ext4_xattr_inode_write(handle_t *handle, struct inode *ea_inode, + goto out; + + memcpy(bh->b_data, buf, csize); ++ /* ++ * Zero out block tail to avoid writing uninitialized memory ++ * to disk. ++ */ ++ if (csize < blocksize) ++ memset(bh->b_data + csize, 0, blocksize - csize); + set_buffer_uptodate(bh); + ext4_handle_dirty_metadata(handle, ea_inode, bh); + +-- +2.43.0 + diff --git a/queue-4.19/fs-nilfs2-remove-some-unused-macros-to-tame-gcc.patch b/queue-4.19/fs-nilfs2-remove-some-unused-macros-to-tame-gcc.patch new file mode 100644 index 00000000000..29c22e25f92 --- /dev/null +++ b/queue-4.19/fs-nilfs2-remove-some-unused-macros-to-tame-gcc.patch @@ -0,0 +1,48 @@ +From 23d92c009b73daefc07201a5c76b95d15488f724 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Dec 2020 20:45:27 -0800 +Subject: fs/nilfs2: remove some unused macros to tame gcc + +From: Alex Shi + +[ Upstream commit e7920b3e9d9f5470d5ff7d883e72a47addc0a137 ] + +There some macros are unused and cause gcc warning. Remove them. + + fs/nilfs2/segment.c:137:0: warning: macro "nilfs_cnt32_gt" is not used [-Wunused-macros] + fs/nilfs2/segment.c:144:0: warning: macro "nilfs_cnt32_le" is not used [-Wunused-macros] + fs/nilfs2/segment.c:143:0: warning: macro "nilfs_cnt32_lt" is not used [-Wunused-macros] + +Link: https://lkml.kernel.org/r/1607552733-24292-1-git-send-email-konishi.ryusuke@gmail.com +Signed-off-by: Ryusuke Konishi +Signed-off-by: Alex Shi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: 0f3819e8c483 ("nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro") +Signed-off-by: Sasha Levin +--- + fs/nilfs2/segment.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c +index 23b24ec79527c..62c83193a5bb8 100644 +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -134,14 +134,9 @@ static void nilfs_segctor_do_flush(struct nilfs_sc_info *, int); + static void nilfs_segctor_do_immediate_flush(struct nilfs_sc_info *); + static void nilfs_dispose_list(struct the_nilfs *, struct list_head *, int); + +-#define nilfs_cnt32_gt(a, b) \ +- (typecheck(__u32, a) && typecheck(__u32, b) && \ +- ((__s32)(b) - (__s32)(a) < 0)) + #define nilfs_cnt32_ge(a, b) \ + (typecheck(__u32, a) && typecheck(__u32, b) && \ + ((__s32)(a) - (__s32)(b) >= 0)) +-#define nilfs_cnt32_lt(a, b) nilfs_cnt32_gt(b, a) +-#define nilfs_cnt32_le(a, b) nilfs_cnt32_ge(b, a) + + static int nilfs_prepare_segment_lock(struct super_block *sb, + struct nilfs_transaction_info *ti) +-- +2.43.0 + diff --git a/queue-4.19/hfsplus-fix-to-avoid-false-alarm-of-circular-locking.patch b/queue-4.19/hfsplus-fix-to-avoid-false-alarm-of-circular-locking.patch new file mode 100644 index 00000000000..06fe07df4f1 --- /dev/null +++ b/queue-4.19/hfsplus-fix-to-avoid-false-alarm-of-circular-locking.patch @@ -0,0 +1,211 @@ +From 7d702e18fdd91d0d489679455cf60da3622a4ed2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 22:23:04 +0800 +Subject: hfsplus: fix to avoid false alarm of circular locking +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chao Yu + +[ Upstream commit be4edd1642ee205ed7bbf66edc0453b1be1fb8d7 ] + +Syzbot report potential ABBA deadlock as below: + +loop0: detected capacity change from 0 to 1024 +====================================================== +WARNING: possible circular locking dependency detected +6.9.0-syzkaller-10323-g8f6a15f095a6 #0 Not tainted +------------------------------------------------------ +syz-executor171/5344 is trying to acquire lock: +ffff88807cb980b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595 + +but task is already holding lock: +ffff88807a930108 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x2da/0xb50 fs/hfsplus/extents.c:576 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}: + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __mutex_lock_common kernel/locking/mutex.c:608 [inline] + __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752 + hfsplus_file_extend+0x21b/0x1b70 fs/hfsplus/extents.c:457 + hfsplus_bmap_reserve+0x105/0x4e0 fs/hfsplus/btree.c:358 + hfsplus_rename_cat+0x1d0/0x1050 fs/hfsplus/catalog.c:456 + hfsplus_rename+0x12e/0x1c0 fs/hfsplus/dir.c:552 + vfs_rename+0xbdb/0xf00 fs/namei.c:4887 + do_renameat2+0xd94/0x13f0 fs/namei.c:5044 + __do_sys_rename fs/namei.c:5091 [inline] + __se_sys_rename fs/namei.c:5089 [inline] + __x64_sys_rename+0x86/0xa0 fs/namei.c:5089 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +-> #0 (&tree->tree_lock){+.+.}-{3:3}: + check_prev_add kernel/locking/lockdep.c:3134 [inline] + check_prevs_add kernel/locking/lockdep.c:3253 [inline] + validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 + __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __mutex_lock_common kernel/locking/mutex.c:608 [inline] + __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752 + hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595 + hfsplus_setattr+0x1ce/0x280 fs/hfsplus/inode.c:265 + notify_change+0xb9d/0xe70 fs/attr.c:497 + do_truncate+0x220/0x310 fs/open.c:65 + handle_truncate fs/namei.c:3308 [inline] + do_open fs/namei.c:3654 [inline] + path_openat+0x2a3d/0x3280 fs/namei.c:3807 + do_filp_open+0x235/0x490 fs/namei.c:3834 + do_sys_openat2+0x13e/0x1d0 fs/open.c:1406 + do_sys_open fs/open.c:1421 [inline] + __do_sys_creat fs/open.c:1497 [inline] + __se_sys_creat fs/open.c:1491 [inline] + __x64_sys_creat+0x123/0x170 fs/open.c:1491 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&HFSPLUS_I(inode)->extents_lock); + lock(&tree->tree_lock); + lock(&HFSPLUS_I(inode)->extents_lock); + lock(&tree->tree_lock); + +This is a false alarm as tree_lock mutex are different, one is +from sbi->cat_tree, and another is from sbi->ext_tree: + +Thread A Thread B +- hfsplus_rename + - hfsplus_rename_cat + - hfs_find_init + - mutext_lock(cat_tree->tree_lock) + - hfsplus_setattr + - hfsplus_file_truncate + - mutex_lock(hip->extents_lock) + - hfs_find_init + - mutext_lock(ext_tree->tree_lock) + - hfs_bmap_reserve + - hfsplus_file_extend + - mutex_lock(hip->extents_lock) + +So, let's call mutex_lock_nested for tree_lock mutex lock, and pass +correct lock class for it. + +Fixes: 31651c607151 ("hfsplus: avoid deadlock on file truncation") +Reported-by: syzbot+6030b3b1b9bf70e538c4@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-fsdevel/000000000000e37a4005ef129563@google.com +Cc: Ernesto A. Fernández +Signed-off-by: Chao Yu +Link: https://lore.kernel.org/r/20240607142304.455441-1-chao@kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/hfsplus/bfind.c | 15 ++------------- + fs/hfsplus/extents.c | 9 ++++++--- + fs/hfsplus/hfsplus_fs.h | 21 +++++++++++++++++++++ + 3 files changed, 29 insertions(+), 16 deletions(-) + +diff --git a/fs/hfsplus/bfind.c b/fs/hfsplus/bfind.c +index ca2ba8c9f82ef..901e83d65d202 100644 +--- a/fs/hfsplus/bfind.c ++++ b/fs/hfsplus/bfind.c +@@ -25,19 +25,8 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) + fd->key = ptr + tree->max_key_len + 2; + hfs_dbg(BNODE_REFS, "find_init: %d (%p)\n", + tree->cnid, __builtin_return_address(0)); +- switch (tree->cnid) { +- case HFSPLUS_CAT_CNID: +- mutex_lock_nested(&tree->tree_lock, CATALOG_BTREE_MUTEX); +- break; +- case HFSPLUS_EXT_CNID: +- mutex_lock_nested(&tree->tree_lock, EXTENTS_BTREE_MUTEX); +- break; +- case HFSPLUS_ATTR_CNID: +- mutex_lock_nested(&tree->tree_lock, ATTR_BTREE_MUTEX); +- break; +- default: +- BUG(); +- } ++ mutex_lock_nested(&tree->tree_lock, ++ hfsplus_btree_lock_class(tree)); + return 0; + } + +diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c +index 7054a542689f9..c95a2f0ed4a74 100644 +--- a/fs/hfsplus/extents.c ++++ b/fs/hfsplus/extents.c +@@ -430,7 +430,8 @@ int hfsplus_free_fork(struct super_block *sb, u32 cnid, + hfsplus_free_extents(sb, ext_entry, total_blocks - start, + total_blocks); + total_blocks = start; +- mutex_lock(&fd.tree->tree_lock); ++ mutex_lock_nested(&fd.tree->tree_lock, ++ hfsplus_btree_lock_class(fd.tree)); + } while (total_blocks > blocks); + hfs_find_exit(&fd); + +@@ -592,7 +593,8 @@ void hfsplus_file_truncate(struct inode *inode) + alloc_cnt, alloc_cnt - blk_cnt); + hfsplus_dump_extent(hip->first_extents); + hip->first_blocks = blk_cnt; +- mutex_lock(&fd.tree->tree_lock); ++ mutex_lock_nested(&fd.tree->tree_lock, ++ hfsplus_btree_lock_class(fd.tree)); + break; + } + res = __hfsplus_ext_cache_extent(&fd, inode, alloc_cnt); +@@ -606,7 +608,8 @@ void hfsplus_file_truncate(struct inode *inode) + hfsplus_free_extents(sb, hip->cached_extents, + alloc_cnt - start, alloc_cnt - blk_cnt); + hfsplus_dump_extent(hip->cached_extents); +- mutex_lock(&fd.tree->tree_lock); ++ mutex_lock_nested(&fd.tree->tree_lock, ++ hfsplus_btree_lock_class(fd.tree)); + if (blk_cnt > start) { + hip->extent_state |= HFSPLUS_EXT_DIRTY; + break; +diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h +index db2e1c750199a..e9b13f771990b 100644 +--- a/fs/hfsplus/hfsplus_fs.h ++++ b/fs/hfsplus/hfsplus_fs.h +@@ -537,6 +537,27 @@ int hfsplus_read_wrapper(struct super_block *sb); + #define __hfsp_mt2ut(t) (be32_to_cpu(t) - 2082844800U) + #define __hfsp_ut2mt(t) (cpu_to_be32(t + 2082844800U)) + ++static inline enum hfsplus_btree_mutex_classes ++hfsplus_btree_lock_class(struct hfs_btree *tree) ++{ ++ enum hfsplus_btree_mutex_classes class; ++ ++ switch (tree->cnid) { ++ case HFSPLUS_CAT_CNID: ++ class = CATALOG_BTREE_MUTEX; ++ break; ++ case HFSPLUS_EXT_CNID: ++ class = EXTENTS_BTREE_MUTEX; ++ break; ++ case HFSPLUS_ATTR_CNID: ++ class = ATTR_BTREE_MUTEX; ++ break; ++ default: ++ BUG(); ++ } ++ return class; ++} ++ + /* compatibility */ + #define hfsp_mt2ut(t) (struct timespec){ .tv_sec = __hfsp_mt2ut(t) } + #define hfsp_ut2mt(t) __hfsp_ut2mt((t).tv_sec) +-- +2.43.0 + diff --git a/queue-4.19/hwmon-adt7475-fix-default-duty-on-fan-is-disabled.patch b/queue-4.19/hwmon-adt7475-fix-default-duty-on-fan-is-disabled.patch new file mode 100644 index 00000000000..940323bdc69 --- /dev/null +++ b/queue-4.19/hwmon-adt7475-fix-default-duty-on-fan-is-disabled.patch @@ -0,0 +1,38 @@ +From e29edfc222bb109ffa2ff26ff690c430a4256c53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2024 15:32:52 +0800 +Subject: hwmon: (adt7475) Fix default duty on fan is disabled + +From: Wayne Tung + +[ Upstream commit 39b24cced70fdc336dbc0070f8b3bde61d8513a8 ] + +According to the comments on fan is disabled, we change to manual mode +and set the duty cycle to 0. +For setting the duty cycle part, the register is wrong. Fix it. + +Fixes: 1c301fc5394f ("hwmon: Add a driver for the ADT7475 hardware monitoring chip") +Signed-off-by: Wayne Tung +Link: https://lore.kernel.org/r/20240701073252.317397-1-chineweff@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/adt7475.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c +index 2db2665dcd4dc..6406520f39150 100644 +--- a/drivers/hwmon/adt7475.c ++++ b/drivers/hwmon/adt7475.c +@@ -1785,7 +1785,7 @@ static void adt7475_read_pwm(struct i2c_client *client, int index) + data->pwm[CONTROL][index] &= ~0xE0; + data->pwm[CONTROL][index] |= (7 << 5); + +- i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index), ++ i2c_smbus_write_byte_data(client, PWM_REG(index), + data->pwm[INPUT][index]); + + i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index), +-- +2.43.0 + diff --git a/queue-4.19/hwmon-introduce-sensor_device_attr_-ro-rw-wo-and-var.patch b/queue-4.19/hwmon-introduce-sensor_device_attr_-ro-rw-wo-and-var.patch new file mode 100644 index 00000000000..5e27fb54c84 --- /dev/null +++ b/queue-4.19/hwmon-introduce-sensor_device_attr_-ro-rw-wo-and-var.patch @@ -0,0 +1,135 @@ +From d665e816e0a3d4c10a17eca4d7760d3cc715c150 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Dec 2016 15:28:19 -0800 +Subject: hwmon: Introduce SENSOR_DEVICE_ATTR_{RO, RW, WO} and variants + +From: Guenter Roeck + +[ Upstream commit a5c47c0d388b939dd578fd466aa804b7f2445390 ] + +Introduce SENSOR_DEVICE_ATTR_{RO,RW,WO} and SENSOR_DEVICE_ATTR_2_{RO,RW,WO} +as simplified variants of SENSOR_DEVICE_ATTR and SENSOR_DEVICE_ATTR_2 to +simplify the source code, improve readbility, and reduce the chance of +inconsistencies. + +Signed-off-by: Guenter Roeck +Stable-dep-of: 1ea3fd1eb986 ("hwmon: (max6697) Fix swapped temp{1,8} critical alarms") +Signed-off-by: Sasha Levin +--- + Documentation/hwmon/hwmon-kernel-api.txt | 24 ++++++++++----- + include/linux/hwmon-sysfs.h | 39 ++++++++++++++++++++++++ + 2 files changed, 55 insertions(+), 8 deletions(-) + +diff --git a/Documentation/hwmon/hwmon-kernel-api.txt b/Documentation/hwmon/hwmon-kernel-api.txt +index eb7a78aebb380..8bdefb41be307 100644 +--- a/Documentation/hwmon/hwmon-kernel-api.txt ++++ b/Documentation/hwmon/hwmon-kernel-api.txt +@@ -299,17 +299,25 @@ functions is used. + The header file linux/hwmon-sysfs.h provides a number of useful macros to + declare and use hardware monitoring sysfs attributes. + +-In many cases, you can use the exsting define DEVICE_ATTR to declare such +-attributes. This is feasible if an attribute has no additional context. However, +-in many cases there will be additional information such as a sensor index which +-will need to be passed to the sysfs attribute handling function. ++In many cases, you can use the exsting define DEVICE_ATTR or its variants ++DEVICE_ATTR_{RW,RO,WO} to declare such attributes. This is feasible if an ++attribute has no additional context. However, in many cases there will be ++additional information such as a sensor index which will need to be passed ++to the sysfs attribute handling function. + + SENSOR_DEVICE_ATTR and SENSOR_DEVICE_ATTR_2 can be used to define attributes + which need such additional context information. SENSOR_DEVICE_ATTR requires + one additional argument, SENSOR_DEVICE_ATTR_2 requires two. + +-SENSOR_DEVICE_ATTR defines a struct sensor_device_attribute variable. +-This structure has the following fields. ++Simplified variants of SENSOR_DEVICE_ATTR and SENSOR_DEVICE_ATTR_2 are available ++and should be used if standard attribute permissions and function names are ++feasible. Standard permissions are 0644 for SENSOR_DEVICE_ATTR[_2]_RW, ++0444 for SENSOR_DEVICE_ATTR[_2]_RO, and 0200 for SENSOR_DEVICE_ATTR[_2]_WO. ++Standard functions, similar to DEVICE_ATTR_{RW,RO,WO}, have _show and _store ++appended to the provided function name. ++ ++SENSOR_DEVICE_ATTR and its variants define a struct sensor_device_attribute ++variable. This structure has the following fields. + + struct sensor_device_attribute { + struct device_attribute dev_attr; +@@ -320,8 +328,8 @@ You can use to_sensor_dev_attr to get the pointer to this structure from the + attribute read or write function. Its parameter is the device to which the + attribute is attached. + +-SENSOR_DEVICE_ATTR_2 defines a struct sensor_device_attribute_2 variable, +-which is defined as follows. ++SENSOR_DEVICE_ATTR_2 and its variants define a struct sensor_device_attribute_2 ++variable, which is defined as follows. + + struct sensor_device_attribute_2 { + struct device_attribute dev_attr; +diff --git a/include/linux/hwmon-sysfs.h b/include/linux/hwmon-sysfs.h +index 1c7b89ae6bdcb..473897bbd898a 100644 +--- a/include/linux/hwmon-sysfs.h ++++ b/include/linux/hwmon-sysfs.h +@@ -33,10 +33,28 @@ struct sensor_device_attribute{ + { .dev_attr = __ATTR(_name, _mode, _show, _store), \ + .index = _index } + ++#define SENSOR_ATTR_RO(_name, _func, _index) \ ++ SENSOR_ATTR(_name, 0444, _func##_show, NULL, _index) ++ ++#define SENSOR_ATTR_RW(_name, _func, _index) \ ++ SENSOR_ATTR(_name, 0644, _func##_show, _func##_store, _index) ++ ++#define SENSOR_ATTR_WO(_name, _func, _index) \ ++ SENSOR_ATTR(_name, 0200, NULL, _func##_store, _index) ++ + #define SENSOR_DEVICE_ATTR(_name, _mode, _show, _store, _index) \ + struct sensor_device_attribute sensor_dev_attr_##_name \ + = SENSOR_ATTR(_name, _mode, _show, _store, _index) + ++#define SENSOR_DEVICE_ATTR_RO(_name, _func, _index) \ ++ SENSOR_DEVICE_ATTR(_name, 0444, _func##_show, NULL, _index) ++ ++#define SENSOR_DEVICE_ATTR_RW(_name, _func, _index) \ ++ SENSOR_DEVICE_ATTR(_name, 0644, _func##_show, _func##_store, _index) ++ ++#define SENSOR_DEVICE_ATTR_WO(_name, _func, _index) \ ++ SENSOR_DEVICE_ATTR(_name, 0200, NULL, _func##_store, _index) ++ + struct sensor_device_attribute_2 { + struct device_attribute dev_attr; + u8 index; +@@ -50,8 +68,29 @@ struct sensor_device_attribute_2 { + .index = _index, \ + .nr = _nr } + ++#define SENSOR_ATTR_2_RO(_name, _func, _nr, _index) \ ++ SENSOR_ATTR_2(_name, 0444, _func##_show, NULL, _nr, _index) ++ ++#define SENSOR_ATTR_2_RW(_name, _func, _nr, _index) \ ++ SENSOR_ATTR_2(_name, 0644, _func##_show, _func##_store, _nr, _index) ++ ++#define SENSOR_ATTR_2_WO(_name, _func, _nr, _index) \ ++ SENSOR_ATTR_2(_name, 0200, NULL, _func##_store, _nr, _index) ++ + #define SENSOR_DEVICE_ATTR_2(_name,_mode,_show,_store,_nr,_index) \ + struct sensor_device_attribute_2 sensor_dev_attr_##_name \ + = SENSOR_ATTR_2(_name, _mode, _show, _store, _nr, _index) + ++#define SENSOR_DEVICE_ATTR_2_RO(_name, _func, _nr, _index) \ ++ SENSOR_DEVICE_ATTR_2(_name, 0444, _func##_show, NULL, \ ++ _nr, _index) ++ ++#define SENSOR_DEVICE_ATTR_2_RW(_name, _func, _nr, _index) \ ++ SENSOR_DEVICE_ATTR_2(_name, 0644, _func##_show, _func##_store, \ ++ _nr, _index) ++ ++#define SENSOR_DEVICE_ATTR_2_WO(_name, _func, _nr, _index) \ ++ SENSOR_DEVICE_ATTR_2(_name, 0200, NULL, _func##_store, \ ++ _nr, _index) ++ + #endif /* _LINUX_HWMON_SYSFS_H */ +-- +2.43.0 + diff --git a/queue-4.19/hwmon-max6697-auto-convert-to-use-sensor_device_attr.patch b/queue-4.19/hwmon-max6697-auto-convert-to-use-sensor_device_attr.patch new file mode 100644 index 00000000000..c9e6ae28a4d --- /dev/null +++ b/queue-4.19/hwmon-max6697-auto-convert-to-use-sensor_device_attr.patch @@ -0,0 +1,205 @@ +From cb5461f976c4d88a3cec381e9b51046d0d34150b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Dec 2018 10:54:38 -0800 +Subject: hwmon: (max6697) Auto-convert to use SENSOR_DEVICE_ATTR_{RO, RW, WO} + +From: Guenter Roeck + +[ Upstream commit 740c2f2b86a71ad673f329241ac25cfe647aacd4 ] + +Conversion was done done using the coccinelle script at +https://github.com/groeck/coccinelle-patches/raw/master/hwmon/sensor-devattr-w6.cocci + +Signed-off-by: Guenter Roeck +Stable-dep-of: 1ea3fd1eb986 ("hwmon: (max6697) Fix swapped temp{1,8} critical alarms") +Signed-off-by: Sasha Levin +--- + drivers/hwmon/max6697.c | 144 ++++++++++++++++++---------------------- + 1 file changed, 64 insertions(+), 80 deletions(-) + +diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c +index 7e7f59c68ce6e..2103ba45de745 100644 +--- a/drivers/hwmon/max6697.c ++++ b/drivers/hwmon/max6697.c +@@ -251,7 +251,7 @@ static struct max6697_data *max6697_update_device(struct device *dev) + return ret; + } + +-static ssize_t show_temp_input(struct device *dev, ++static ssize_t temp_input_show(struct device *dev, + struct device_attribute *devattr, char *buf) + { + int index = to_sensor_dev_attr(devattr)->index; +@@ -267,8 +267,8 @@ static ssize_t show_temp_input(struct device *dev, + return sprintf(buf, "%d\n", temp * 125); + } + +-static ssize_t show_temp(struct device *dev, +- struct device_attribute *devattr, char *buf) ++static ssize_t temp_show(struct device *dev, struct device_attribute *devattr, ++ char *buf) + { + int nr = to_sensor_dev_attr_2(devattr)->nr; + int index = to_sensor_dev_attr_2(devattr)->index; +@@ -284,7 +284,7 @@ static ssize_t show_temp(struct device *dev, + return sprintf(buf, "%d\n", temp * 1000); + } + +-static ssize_t show_alarm(struct device *dev, struct device_attribute *attr, ++static ssize_t alarm_show(struct device *dev, struct device_attribute *attr, + char *buf) + { + int index = to_sensor_dev_attr(attr)->index; +@@ -299,9 +299,9 @@ static ssize_t show_alarm(struct device *dev, struct device_attribute *attr, + return sprintf(buf, "%u\n", (data->alarms >> index) & 0x1); + } + +-static ssize_t set_temp(struct device *dev, +- struct device_attribute *devattr, +- const char *buf, size_t count) ++static ssize_t temp_store(struct device *dev, ++ struct device_attribute *devattr, const char *buf, ++ size_t count) + { + int nr = to_sensor_dev_attr_2(devattr)->nr; + int index = to_sensor_dev_attr_2(devattr)->index; +@@ -327,79 +327,63 @@ static ssize_t set_temp(struct device *dev, + return ret < 0 ? ret : count; + } + +-static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, show_temp_input, NULL, 0); +-static SENSOR_DEVICE_ATTR_2(temp1_max, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 0, MAX6697_TEMP_MAX); +-static SENSOR_DEVICE_ATTR_2(temp1_crit, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 0, MAX6697_TEMP_CRIT); +- +-static SENSOR_DEVICE_ATTR(temp2_input, S_IRUGO, show_temp_input, NULL, 1); +-static SENSOR_DEVICE_ATTR_2(temp2_max, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 1, MAX6697_TEMP_MAX); +-static SENSOR_DEVICE_ATTR_2(temp2_crit, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 1, MAX6697_TEMP_CRIT); +- +-static SENSOR_DEVICE_ATTR(temp3_input, S_IRUGO, show_temp_input, NULL, 2); +-static SENSOR_DEVICE_ATTR_2(temp3_max, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 2, MAX6697_TEMP_MAX); +-static SENSOR_DEVICE_ATTR_2(temp3_crit, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 2, MAX6697_TEMP_CRIT); +- +-static SENSOR_DEVICE_ATTR(temp4_input, S_IRUGO, show_temp_input, NULL, 3); +-static SENSOR_DEVICE_ATTR_2(temp4_max, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 3, MAX6697_TEMP_MAX); +-static SENSOR_DEVICE_ATTR_2(temp4_crit, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 3, MAX6697_TEMP_CRIT); +- +-static SENSOR_DEVICE_ATTR(temp5_input, S_IRUGO, show_temp_input, NULL, 4); +-static SENSOR_DEVICE_ATTR_2(temp5_max, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 4, MAX6697_TEMP_MAX); +-static SENSOR_DEVICE_ATTR_2(temp5_crit, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 4, MAX6697_TEMP_CRIT); +- +-static SENSOR_DEVICE_ATTR(temp6_input, S_IRUGO, show_temp_input, NULL, 5); +-static SENSOR_DEVICE_ATTR_2(temp6_max, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 5, MAX6697_TEMP_MAX); +-static SENSOR_DEVICE_ATTR_2(temp6_crit, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 5, MAX6697_TEMP_CRIT); +- +-static SENSOR_DEVICE_ATTR(temp7_input, S_IRUGO, show_temp_input, NULL, 6); +-static SENSOR_DEVICE_ATTR_2(temp7_max, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 6, MAX6697_TEMP_MAX); +-static SENSOR_DEVICE_ATTR_2(temp7_crit, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 6, MAX6697_TEMP_CRIT); +- +-static SENSOR_DEVICE_ATTR(temp8_input, S_IRUGO, show_temp_input, NULL, 7); +-static SENSOR_DEVICE_ATTR_2(temp8_max, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 7, MAX6697_TEMP_MAX); +-static SENSOR_DEVICE_ATTR_2(temp8_crit, S_IRUGO | S_IWUSR, show_temp, set_temp, +- 7, MAX6697_TEMP_CRIT); +- +-static SENSOR_DEVICE_ATTR(temp1_max_alarm, S_IRUGO, show_alarm, NULL, 22); +-static SENSOR_DEVICE_ATTR(temp2_max_alarm, S_IRUGO, show_alarm, NULL, 16); +-static SENSOR_DEVICE_ATTR(temp3_max_alarm, S_IRUGO, show_alarm, NULL, 17); +-static SENSOR_DEVICE_ATTR(temp4_max_alarm, S_IRUGO, show_alarm, NULL, 18); +-static SENSOR_DEVICE_ATTR(temp5_max_alarm, S_IRUGO, show_alarm, NULL, 19); +-static SENSOR_DEVICE_ATTR(temp6_max_alarm, S_IRUGO, show_alarm, NULL, 20); +-static SENSOR_DEVICE_ATTR(temp7_max_alarm, S_IRUGO, show_alarm, NULL, 21); +-static SENSOR_DEVICE_ATTR(temp8_max_alarm, S_IRUGO, show_alarm, NULL, 23); +- +-static SENSOR_DEVICE_ATTR(temp1_crit_alarm, S_IRUGO, show_alarm, NULL, 14); +-static SENSOR_DEVICE_ATTR(temp2_crit_alarm, S_IRUGO, show_alarm, NULL, 8); +-static SENSOR_DEVICE_ATTR(temp3_crit_alarm, S_IRUGO, show_alarm, NULL, 9); +-static SENSOR_DEVICE_ATTR(temp4_crit_alarm, S_IRUGO, show_alarm, NULL, 10); +-static SENSOR_DEVICE_ATTR(temp5_crit_alarm, S_IRUGO, show_alarm, NULL, 11); +-static SENSOR_DEVICE_ATTR(temp6_crit_alarm, S_IRUGO, show_alarm, NULL, 12); +-static SENSOR_DEVICE_ATTR(temp7_crit_alarm, S_IRUGO, show_alarm, NULL, 13); +-static SENSOR_DEVICE_ATTR(temp8_crit_alarm, S_IRUGO, show_alarm, NULL, 15); +- +-static SENSOR_DEVICE_ATTR(temp2_fault, S_IRUGO, show_alarm, NULL, 1); +-static SENSOR_DEVICE_ATTR(temp3_fault, S_IRUGO, show_alarm, NULL, 2); +-static SENSOR_DEVICE_ATTR(temp4_fault, S_IRUGO, show_alarm, NULL, 3); +-static SENSOR_DEVICE_ATTR(temp5_fault, S_IRUGO, show_alarm, NULL, 4); +-static SENSOR_DEVICE_ATTR(temp6_fault, S_IRUGO, show_alarm, NULL, 5); +-static SENSOR_DEVICE_ATTR(temp7_fault, S_IRUGO, show_alarm, NULL, 6); +-static SENSOR_DEVICE_ATTR(temp8_fault, S_IRUGO, show_alarm, NULL, 7); ++static SENSOR_DEVICE_ATTR_RO(temp1_input, temp_input, 0); ++static SENSOR_DEVICE_ATTR_2_RW(temp1_max, temp, 0, MAX6697_TEMP_MAX); ++static SENSOR_DEVICE_ATTR_2_RW(temp1_crit, temp, 0, MAX6697_TEMP_CRIT); ++ ++static SENSOR_DEVICE_ATTR_RO(temp2_input, temp_input, 1); ++static SENSOR_DEVICE_ATTR_2_RW(temp2_max, temp, 1, MAX6697_TEMP_MAX); ++static SENSOR_DEVICE_ATTR_2_RW(temp2_crit, temp, 1, MAX6697_TEMP_CRIT); ++ ++static SENSOR_DEVICE_ATTR_RO(temp3_input, temp_input, 2); ++static SENSOR_DEVICE_ATTR_2_RW(temp3_max, temp, 2, MAX6697_TEMP_MAX); ++static SENSOR_DEVICE_ATTR_2_RW(temp3_crit, temp, 2, MAX6697_TEMP_CRIT); ++ ++static SENSOR_DEVICE_ATTR_RO(temp4_input, temp_input, 3); ++static SENSOR_DEVICE_ATTR_2_RW(temp4_max, temp, 3, MAX6697_TEMP_MAX); ++static SENSOR_DEVICE_ATTR_2_RW(temp4_crit, temp, 3, MAX6697_TEMP_CRIT); ++ ++static SENSOR_DEVICE_ATTR_RO(temp5_input, temp_input, 4); ++static SENSOR_DEVICE_ATTR_2_RW(temp5_max, temp, 4, MAX6697_TEMP_MAX); ++static SENSOR_DEVICE_ATTR_2_RW(temp5_crit, temp, 4, MAX6697_TEMP_CRIT); ++ ++static SENSOR_DEVICE_ATTR_RO(temp6_input, temp_input, 5); ++static SENSOR_DEVICE_ATTR_2_RW(temp6_max, temp, 5, MAX6697_TEMP_MAX); ++static SENSOR_DEVICE_ATTR_2_RW(temp6_crit, temp, 5, MAX6697_TEMP_CRIT); ++ ++static SENSOR_DEVICE_ATTR_RO(temp7_input, temp_input, 6); ++static SENSOR_DEVICE_ATTR_2_RW(temp7_max, temp, 6, MAX6697_TEMP_MAX); ++static SENSOR_DEVICE_ATTR_2_RW(temp7_crit, temp, 6, MAX6697_TEMP_CRIT); ++ ++static SENSOR_DEVICE_ATTR_RO(temp8_input, temp_input, 7); ++static SENSOR_DEVICE_ATTR_2_RW(temp8_max, temp, 7, MAX6697_TEMP_MAX); ++static SENSOR_DEVICE_ATTR_2_RW(temp8_crit, temp, 7, MAX6697_TEMP_CRIT); ++ ++static SENSOR_DEVICE_ATTR_RO(temp1_max_alarm, alarm, 22); ++static SENSOR_DEVICE_ATTR_RO(temp2_max_alarm, alarm, 16); ++static SENSOR_DEVICE_ATTR_RO(temp3_max_alarm, alarm, 17); ++static SENSOR_DEVICE_ATTR_RO(temp4_max_alarm, alarm, 18); ++static SENSOR_DEVICE_ATTR_RO(temp5_max_alarm, alarm, 19); ++static SENSOR_DEVICE_ATTR_RO(temp6_max_alarm, alarm, 20); ++static SENSOR_DEVICE_ATTR_RO(temp7_max_alarm, alarm, 21); ++static SENSOR_DEVICE_ATTR_RO(temp8_max_alarm, alarm, 23); ++ ++static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 14); ++static SENSOR_DEVICE_ATTR_RO(temp2_crit_alarm, alarm, 8); ++static SENSOR_DEVICE_ATTR_RO(temp3_crit_alarm, alarm, 9); ++static SENSOR_DEVICE_ATTR_RO(temp4_crit_alarm, alarm, 10); ++static SENSOR_DEVICE_ATTR_RO(temp5_crit_alarm, alarm, 11); ++static SENSOR_DEVICE_ATTR_RO(temp6_crit_alarm, alarm, 12); ++static SENSOR_DEVICE_ATTR_RO(temp7_crit_alarm, alarm, 13); ++static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 15); ++ ++static SENSOR_DEVICE_ATTR_RO(temp2_fault, alarm, 1); ++static SENSOR_DEVICE_ATTR_RO(temp3_fault, alarm, 2); ++static SENSOR_DEVICE_ATTR_RO(temp4_fault, alarm, 3); ++static SENSOR_DEVICE_ATTR_RO(temp5_fault, alarm, 4); ++static SENSOR_DEVICE_ATTR_RO(temp6_fault, alarm, 5); ++static SENSOR_DEVICE_ATTR_RO(temp7_fault, alarm, 6); ++static SENSOR_DEVICE_ATTR_RO(temp8_fault, alarm, 7); + + static DEVICE_ATTR(dummy, 0, NULL, NULL); + +-- +2.43.0 + diff --git a/queue-4.19/hwmon-max6697-fix-swapped-temp-1-8-critical-alarms.patch b/queue-4.19/hwmon-max6697-fix-swapped-temp-1-8-critical-alarms.patch new file mode 100644 index 00000000000..8b651b105d0 --- /dev/null +++ b/queue-4.19/hwmon-max6697-fix-swapped-temp-1-8-critical-alarms.patch @@ -0,0 +1,48 @@ +From 342e603404f70f5408660a9b3b5050f8c7c466fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jul 2024 12:03:53 -0700 +Subject: hwmon: (max6697) Fix swapped temp{1,8} critical alarms + +From: Guenter Roeck + +[ Upstream commit 1ea3fd1eb9869fcdcbc9c68f9728bfc47b9503f1 ] + +The critical alarm bit for the local temperature sensor (temp1) is in +bit 7 of register 0x45 (not bit 6), and the critical alarm bit for remote +temperature sensor 7 (temp8) is in bit 6 (not bit 7). + +This only affects MAX6581 since all other chips supported by this driver +do not support those critical alarms. + +Fixes: 5372d2d71c46 ("hwmon: Driver for Maxim MAX6697 and compatibles") +Reviewed-by: Tzung-Bi Shih +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/max6697.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c +index 2103ba45de745..14c34a2d36af3 100644 +--- a/drivers/hwmon/max6697.c ++++ b/drivers/hwmon/max6697.c +@@ -368,14 +368,14 @@ static SENSOR_DEVICE_ATTR_RO(temp6_max_alarm, alarm, 20); + static SENSOR_DEVICE_ATTR_RO(temp7_max_alarm, alarm, 21); + static SENSOR_DEVICE_ATTR_RO(temp8_max_alarm, alarm, 23); + +-static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 14); ++static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 15); + static SENSOR_DEVICE_ATTR_RO(temp2_crit_alarm, alarm, 8); + static SENSOR_DEVICE_ATTR_RO(temp3_crit_alarm, alarm, 9); + static SENSOR_DEVICE_ATTR_RO(temp4_crit_alarm, alarm, 10); + static SENSOR_DEVICE_ATTR_RO(temp5_crit_alarm, alarm, 11); + static SENSOR_DEVICE_ATTR_RO(temp6_crit_alarm, alarm, 12); + static SENSOR_DEVICE_ATTR_RO(temp7_crit_alarm, alarm, 13); +-static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 15); ++static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 14); + + static SENSOR_DEVICE_ATTR_RO(temp2_fault, alarm, 1); + static SENSOR_DEVICE_ATTR_RO(temp3_fault, alarm, 2); +-- +2.43.0 + diff --git a/queue-4.19/hwmon-max6697-fix-underflow-when-writing-limit-attri.patch b/queue-4.19/hwmon-max6697-fix-underflow-when-writing-limit-attri.patch new file mode 100644 index 00000000000..11a337e0fb7 --- /dev/null +++ b/queue-4.19/hwmon-max6697-fix-underflow-when-writing-limit-attri.patch @@ -0,0 +1,40 @@ +From 4b8496904fe50f6ef822afdd90a7f96f1fd0c72b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jul 2024 14:26:19 -0700 +Subject: hwmon: (max6697) Fix underflow when writing limit attributes + +From: Guenter Roeck + +[ Upstream commit cbf7467828cd4ec7ceac7a8b5b5ddb2f69f07b0e ] + +Using DIV_ROUND_CLOSEST() on an unbound value can result in underflows. +Indeed, module test scripts report: + +temp1_max: Suspected underflow: [min=0, read 255000, written -9223372036854775808] +temp1_crit: Suspected underflow: [min=0, read 255000, written -9223372036854775808] + +Fix by introducing an extra set of clamping. + +Fixes: 5372d2d71c46 ("hwmon: Driver for Maxim MAX6697 and compatibles") +Reviewed-by: Tzung-Bi Shih +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/max6697.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c +index 6df28fe0577da..7e7f59c68ce6e 100644 +--- a/drivers/hwmon/max6697.c ++++ b/drivers/hwmon/max6697.c +@@ -314,6 +314,7 @@ static ssize_t set_temp(struct device *dev, + return ret; + + mutex_lock(&data->update_lock); ++ temp = clamp_val(temp, -1000000, 1000000); /* prevent underflow */ + temp = DIV_ROUND_CLOSEST(temp, 1000) + data->temp_offset; + temp = clamp_val(temp, 0, data->type == max6581 ? 255 : 127); + data->temp[nr][index] = temp; +-- +2.43.0 + diff --git a/queue-4.19/ice-rework-flex-descriptor-programming.patch b/queue-4.19/ice-rework-flex-descriptor-programming.patch new file mode 100644 index 00000000000..222dd89f143 --- /dev/null +++ b/queue-4.19/ice-rework-flex-descriptor-programming.patch @@ -0,0 +1,206 @@ +From 94a1ecb0b9b4715ac9d349b8d1fff431958eae48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Aug 2018 06:29:44 -0700 +Subject: ice: Rework flex descriptor programming + +From: Anirudh Venkataramanan + +[ Upstream commit 22ef683b48182f4d6125a2fb2725eb8a141514ff ] + +The driver can support two flex descriptor profiles, ICE_RXDID_FLEX_NIC +and ICE_RXDID_FLEX_NIC_2. This patch reworks the current flex programming +logic to add support for the latter profile. + +Signed-off-by: Anirudh Venkataramanan +Tested-by: Tony Brelinski +Signed-off-by: Jeff Kirsher +Stable-dep-of: 782161895eb4 ("netfilter: ctnetlink: use helper function to calculate expect ID") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_common.c | 102 ++++++++++++++---- + .../net/ethernet/intel/ice/ice_lan_tx_rx.h | 24 +++-- + 2 files changed, 92 insertions(+), 34 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c +index f8d00263d9019..72a6f22ee423f 100644 +--- a/drivers/net/ethernet/intel/ice/ice_common.c ++++ b/drivers/net/ethernet/intel/ice/ice_common.c +@@ -7,16 +7,16 @@ + + #define ICE_PF_RESET_WAIT_COUNT 200 + +-#define ICE_NIC_FLX_ENTRY(hw, mdid, idx) \ +- wr32((hw), GLFLXP_RXDID_FLX_WRD_##idx(ICE_RXDID_FLEX_NIC), \ ++#define ICE_PROG_FLEX_ENTRY(hw, rxdid, mdid, idx) \ ++ wr32((hw), GLFLXP_RXDID_FLX_WRD_##idx(rxdid), \ + ((ICE_RX_OPC_MDID << \ + GLFLXP_RXDID_FLX_WRD_##idx##_RXDID_OPCODE_S) & \ + GLFLXP_RXDID_FLX_WRD_##idx##_RXDID_OPCODE_M) | \ + (((mdid) << GLFLXP_RXDID_FLX_WRD_##idx##_PROT_MDID_S) & \ + GLFLXP_RXDID_FLX_WRD_##idx##_PROT_MDID_M)) + +-#define ICE_NIC_FLX_FLG_ENTRY(hw, flg_0, flg_1, flg_2, flg_3, idx) \ +- wr32((hw), GLFLXP_RXDID_FLAGS(ICE_RXDID_FLEX_NIC, idx), \ ++#define ICE_PROG_FLG_ENTRY(hw, rxdid, flg_0, flg_1, flg_2, flg_3, idx) \ ++ wr32((hw), GLFLXP_RXDID_FLAGS(rxdid, idx), \ + (((flg_0) << GLFLXP_RXDID_FLAGS_FLEXIFLAG_4N_S) & \ + GLFLXP_RXDID_FLAGS_FLEXIFLAG_4N_M) | \ + (((flg_1) << GLFLXP_RXDID_FLAGS_FLEXIFLAG_4N_1_S) & \ +@@ -290,30 +290,85 @@ ice_aq_get_link_info(struct ice_port_info *pi, bool ena_lse, + } + + /** +- * ice_init_flex_parser - initialize rx flex parser ++ * ice_init_flex_flags + * @hw: pointer to the hardware structure ++ * @prof_id: Rx Descriptor Builder profile ID + * +- * Function to initialize flex descriptors ++ * Function to initialize Rx flex flags + */ +-static void ice_init_flex_parser(struct ice_hw *hw) ++static void ice_init_flex_flags(struct ice_hw *hw, enum ice_rxdid prof_id) + { + u8 idx = 0; + +- ICE_NIC_FLX_ENTRY(hw, ICE_RX_MDID_HASH_LOW, 0); +- ICE_NIC_FLX_ENTRY(hw, ICE_RX_MDID_HASH_HIGH, 1); +- ICE_NIC_FLX_ENTRY(hw, ICE_RX_MDID_FLOW_ID_LOWER, 2); +- ICE_NIC_FLX_ENTRY(hw, ICE_RX_MDID_FLOW_ID_HIGH, 3); +- ICE_NIC_FLX_FLG_ENTRY(hw, ICE_RXFLG_PKT_FRG, ICE_RXFLG_UDP_GRE, +- ICE_RXFLG_PKT_DSI, ICE_RXFLG_FIN, idx++); +- ICE_NIC_FLX_FLG_ENTRY(hw, ICE_RXFLG_SYN, ICE_RXFLG_RST, +- ICE_RXFLG_PKT_DSI, ICE_RXFLG_PKT_DSI, idx++); +- ICE_NIC_FLX_FLG_ENTRY(hw, ICE_RXFLG_PKT_DSI, ICE_RXFLG_PKT_DSI, +- ICE_RXFLG_EVLAN_x8100, ICE_RXFLG_EVLAN_x9100, +- idx++); +- ICE_NIC_FLX_FLG_ENTRY(hw, ICE_RXFLG_VLAN_x8100, ICE_RXFLG_TNL_VLAN, +- ICE_RXFLG_TNL_MAC, ICE_RXFLG_TNL0, idx++); +- ICE_NIC_FLX_FLG_ENTRY(hw, ICE_RXFLG_TNL1, ICE_RXFLG_TNL2, +- ICE_RXFLG_PKT_DSI, ICE_RXFLG_PKT_DSI, idx); ++ /* Flex-flag fields (0-2) are programmed with FLG64 bits with layout: ++ * flexiflags0[5:0] - TCP flags, is_packet_fragmented, is_packet_UDP_GRE ++ * flexiflags1[3:0] - Not used for flag programming ++ * flexiflags2[7:0] - Tunnel and VLAN types ++ * 2 invalid fields in last index ++ */ ++ switch (prof_id) { ++ /* Rx flex flags are currently programmed for the NIC profiles only. ++ * Different flag bit programming configurations can be added per ++ * profile as needed. ++ */ ++ case ICE_RXDID_FLEX_NIC: ++ case ICE_RXDID_FLEX_NIC_2: ++ ICE_PROG_FLG_ENTRY(hw, prof_id, ICE_RXFLG_PKT_FRG, ++ ICE_RXFLG_UDP_GRE, ICE_RXFLG_PKT_DSI, ++ ICE_RXFLG_FIN, idx++); ++ /* flex flag 1 is not used for flexi-flag programming, skipping ++ * these four FLG64 bits. ++ */ ++ ICE_PROG_FLG_ENTRY(hw, prof_id, ICE_RXFLG_SYN, ICE_RXFLG_RST, ++ ICE_RXFLG_PKT_DSI, ICE_RXFLG_PKT_DSI, idx++); ++ ICE_PROG_FLG_ENTRY(hw, prof_id, ICE_RXFLG_PKT_DSI, ++ ICE_RXFLG_PKT_DSI, ICE_RXFLG_EVLAN_x8100, ++ ICE_RXFLG_EVLAN_x9100, idx++); ++ ICE_PROG_FLG_ENTRY(hw, prof_id, ICE_RXFLG_VLAN_x8100, ++ ICE_RXFLG_TNL_VLAN, ICE_RXFLG_TNL_MAC, ++ ICE_RXFLG_TNL0, idx++); ++ ICE_PROG_FLG_ENTRY(hw, prof_id, ICE_RXFLG_TNL1, ICE_RXFLG_TNL2, ++ ICE_RXFLG_PKT_DSI, ICE_RXFLG_PKT_DSI, idx); ++ break; ++ ++ default: ++ ice_debug(hw, ICE_DBG_INIT, ++ "Flag programming for profile ID %d not supported\n", ++ prof_id); ++ } ++} ++ ++/** ++ * ice_init_flex_flds ++ * @hw: pointer to the hardware structure ++ * @prof_id: Rx Descriptor Builder profile ID ++ * ++ * Function to initialize flex descriptors ++ */ ++static void ice_init_flex_flds(struct ice_hw *hw, enum ice_rxdid prof_id) ++{ ++ enum ice_flex_rx_mdid mdid; ++ ++ switch (prof_id) { ++ case ICE_RXDID_FLEX_NIC: ++ case ICE_RXDID_FLEX_NIC_2: ++ ICE_PROG_FLEX_ENTRY(hw, prof_id, ICE_RX_MDID_HASH_LOW, 0); ++ ICE_PROG_FLEX_ENTRY(hw, prof_id, ICE_RX_MDID_HASH_HIGH, 1); ++ ICE_PROG_FLEX_ENTRY(hw, prof_id, ICE_RX_MDID_FLOW_ID_LOWER, 2); ++ ++ mdid = (prof_id == ICE_RXDID_FLEX_NIC_2) ? ++ ICE_RX_MDID_SRC_VSI : ICE_RX_MDID_FLOW_ID_HIGH; ++ ++ ICE_PROG_FLEX_ENTRY(hw, prof_id, mdid, 3); ++ ++ ice_init_flex_flags(hw, prof_id); ++ break; ++ ++ default: ++ ice_debug(hw, ICE_DBG_INIT, ++ "Field init for profile ID %d not supported\n", ++ prof_id); ++ } + } + + /** +@@ -494,7 +549,8 @@ enum ice_status ice_init_hw(struct ice_hw *hw) + if (status) + goto err_unroll_fltr_mgmt_struct; + +- ice_init_flex_parser(hw); ++ ice_init_flex_flds(hw, ICE_RXDID_FLEX_NIC); ++ ice_init_flex_flds(hw, ICE_RXDID_FLEX_NIC_2); + + return 0; + +diff --git a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h +index 068dbc740b766..94504023d86e2 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h ++++ b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h +@@ -188,23 +188,25 @@ struct ice_32b_rx_flex_desc_nic { + * with a specific metadata (profile 7 reserved for HW) + */ + enum ice_rxdid { +- ICE_RXDID_START = 0, +- ICE_RXDID_LEGACY_0 = ICE_RXDID_START, +- ICE_RXDID_LEGACY_1, +- ICE_RXDID_FLX_START, +- ICE_RXDID_FLEX_NIC = ICE_RXDID_FLX_START, +- ICE_RXDID_FLX_LAST = 63, +- ICE_RXDID_LAST = ICE_RXDID_FLX_LAST ++ ICE_RXDID_LEGACY_0 = 0, ++ ICE_RXDID_LEGACY_1 = 1, ++ ICE_RXDID_FLEX_NIC = 2, ++ ICE_RXDID_FLEX_NIC_2 = 6, ++ ICE_RXDID_HW = 7, ++ ICE_RXDID_LAST = 63, + }; + + /* Receive Flex Descriptor Rx opcode values */ + #define ICE_RX_OPC_MDID 0x01 + + /* Receive Descriptor MDID values */ +-#define ICE_RX_MDID_FLOW_ID_LOWER 5 +-#define ICE_RX_MDID_FLOW_ID_HIGH 6 +-#define ICE_RX_MDID_HASH_LOW 56 +-#define ICE_RX_MDID_HASH_HIGH 57 ++enum ice_flex_rx_mdid { ++ ICE_RX_MDID_FLOW_ID_LOWER = 5, ++ ICE_RX_MDID_FLOW_ID_HIGH, ++ ICE_RX_MDID_SRC_VSI = 19, ++ ICE_RX_MDID_HASH_LOW = 56, ++ ICE_RX_MDID_HASH_HIGH, ++}; + + /* Rx Flag64 packet flag bits */ + enum ice_rx_flg64_bits { +-- +2.43.0 + diff --git a/queue-4.19/input-elan_i2c-do-not-leave-interrupt-disabled-on-su.patch b/queue-4.19/input-elan_i2c-do-not-leave-interrupt-disabled-on-su.patch new file mode 100644 index 00000000000..b64c8b5f2f1 --- /dev/null +++ b/queue-4.19/input-elan_i2c-do-not-leave-interrupt-disabled-on-su.patch @@ -0,0 +1,36 @@ +From cee319b5e983eddba42ad8449e9ed5840b9704a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 23:02:48 -0700 +Subject: Input: elan_i2c - do not leave interrupt disabled on suspend failure + +From: Dmitry Torokhov + +[ Upstream commit 5f82c1e04721e7cd98e604eb4e58f0724d8e5a65 ] + +Make sure interrupts are not left disabled when we fail to suspend the +touch controller. + +Fixes: 6696777c6506 ("Input: add driver for Elan I2C/SMbus touchpad") +Link: https://lore.kernel.org/r/ZmKiiL-1wzKrhqBj@google.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/elan_i2c_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index cb0314acdfbd0..c02be5bf4baff 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -1270,6 +1270,8 @@ static int __maybe_unused elan_suspend(struct device *dev) + } + + err: ++ if (ret) ++ enable_irq(client->irq); + mutex_unlock(&data->sysfs_mutex); + return ret; + } +-- +2.43.0 + diff --git a/queue-4.19/ipvs-avoid-unnecessary-calls-to-skb_is_gso_sctp.patch b/queue-4.19/ipvs-avoid-unnecessary-calls-to-skb_is_gso_sctp.patch new file mode 100644 index 00000000000..5f5754e510d --- /dev/null +++ b/queue-4.19/ipvs-avoid-unnecessary-calls-to-skb_is_gso_sctp.patch @@ -0,0 +1,47 @@ +From 6df66ecbd266d80a4ad9d006e1b5520cbe4c7c69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 18:54:44 +0200 +Subject: ipvs: Avoid unnecessary calls to skb_is_gso_sctp + +From: Ismael Luceno + +[ Upstream commit 53796b03295cf7ab1fc8600016fa6dfbf4a494a0 ] + +In the context of the SCTP SNAT/DNAT handler, these calls can only +return true. + +Fixes: e10d3ba4d434 ("ipvs: Fix checksumming on GSO of SCTP packets") +Signed-off-by: Ismael Luceno +Acked-by: Julian Anastasov +Acked-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c +index 18e2e489d0e51..5005469c1732a 100644 +--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c ++++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c +@@ -123,7 +123,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, + if (sctph->source != cp->vport || payload_csum || + skb->ip_summed == CHECKSUM_PARTIAL) { + sctph->source = cp->vport; +- if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) ++ if (!skb_is_gso(skb)) + sctp_nat_csum(skb, sctph, sctphoff); + } else { + skb->ip_summed = CHECKSUM_UNNECESSARY; +@@ -172,7 +172,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, + (skb->ip_summed == CHECKSUM_PARTIAL && + !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) { + sctph->dest = cp->dport; +- if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) ++ if (!skb_is_gso(skb)) + sctp_nat_csum(skb, sctph, sctphoff); + } else if (skb->ip_summed != CHECKSUM_PARTIAL) { + skb->ip_summed = CHECKSUM_UNNECESSARY; +-- +2.43.0 + diff --git a/queue-4.19/leds-trigger-unregister-sysfs-attributes-before-call.patch b/queue-4.19/leds-trigger-unregister-sysfs-attributes-before-call.patch new file mode 100644 index 00000000000..0362afb6ecc --- /dev/null +++ b/queue-4.19/leds-trigger-unregister-sysfs-attributes-before-call.patch @@ -0,0 +1,57 @@ +From a6450a6653dc2b05eb9c734c49867c7cfd90cbc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 18:25:33 +0200 +Subject: leds: trigger: Unregister sysfs attributes before calling + deactivate() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit c0dc9adf9474ecb7106e60e5472577375aedaed3 ] + +Triggers which have trigger specific sysfs attributes typically store +related data in trigger-data allocated by the activate() callback and +freed by the deactivate() callback. + +Calling device_remove_groups() after calling deactivate() leaves a window +where the sysfs attributes show/store functions could be called after +deactivation and then operate on the just freed trigger-data. + +Move the device_remove_groups() call to before deactivate() to close +this race window. + +This also makes the deactivation path properly do things in reverse order +of the activation path which calls the activate() callback before calling +device_add_groups(). + +Fixes: a7e7a3156300 ("leds: triggers: add device attribute support") +Cc: Uwe Kleine-König +Signed-off-by: Hans de Goede +Acked-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20240504162533.76780-1-hdegoede@redhat.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/led-triggers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c +index ec4c957c36b6c..8738fc01523fd 100644 +--- a/drivers/leds/led-triggers.c ++++ b/drivers/leds/led-triggers.c +@@ -125,9 +125,9 @@ int led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trig) + flags); + cancel_work_sync(&led_cdev->set_brightness_work); + led_stop_software_blink(led_cdev); ++ device_remove_groups(led_cdev->dev, led_cdev->trigger->groups); + if (led_cdev->trigger->deactivate) + led_cdev->trigger->deactivate(led_cdev); +- device_remove_groups(led_cdev->dev, led_cdev->trigger->groups); + led_cdev->trigger = NULL; + led_cdev->trigger_data = NULL; + led_cdev->activated = false; +-- +2.43.0 + diff --git a/queue-4.19/m68k-atari-fix-tt-bootup-freeze-unexpected-scu-inter.patch b/queue-4.19/m68k-atari-fix-tt-bootup-freeze-unexpected-scu-inter.patch new file mode 100644 index 00000000000..c48f0ef13bb --- /dev/null +++ b/queue-4.19/m68k-atari-fix-tt-bootup-freeze-unexpected-scu-inter.patch @@ -0,0 +1,58 @@ +From 3972fe88f9609c43409effbab9ee55140df3a792 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 17:49:01 +0300 +Subject: m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt + messages +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Eero Tamminen + +[ Upstream commit f70065a9fd988983b2c693631b801f25a615fc04 ] + +Avoid freeze on Atari TT / MegaSTe boot with continuous messages of: + + unexpected interrupt from 112 + +Which was due to VBL interrupt being enabled in SCU sys mask, but there +being no handler for that any more. + +(Bug and fix were first verified on real Atari TT HW by Christian, + this patch later on in Hatari emulator.) + +Fixes: 1fa0b29f3a43f9dd ("fbdev: Kill Atari vblank cursor blinking") +Reported-by: Nicolas Pomarède +Closes: https://listengine.tuxfamily.org/lists.tuxfamily.org/hatari-devel/2024/06/msg00016.html +Closes: https://lore.kernel.org/all/9aa793d7-82ed-4fbd-bce5-60810d8a9119@helsinkinet.fi +Tested-by: Christian Zietz +Signed-off-by: Eero Tamminen +Reviewed-by: Michael Schmitz +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20240624144901.5236-1-oak@helsinkinet.fi +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/atari/ataints.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c +index 56f02ea2c248d..715d1e0d973e6 100644 +--- a/arch/m68k/atari/ataints.c ++++ b/arch/m68k/atari/ataints.c +@@ -302,11 +302,7 @@ void __init atari_init_IRQ(void) + + if (ATARIHW_PRESENT(SCU)) { + /* init the SCU if present */ +- tt_scu.sys_mask = 0x10; /* enable VBL (for the cursor) and +- * disable HSYNC interrupts (who +- * needs them?) MFP and SCC are +- * enabled in VME mask +- */ ++ tt_scu.sys_mask = 0x0; /* disable all interrupts */ + tt_scu.vme_mask = 0x60; /* enable MFP and SCC ints */ + } else { + /* If no SCU and no Hades, the HSYNC interrupt needs to be +-- +2.43.0 + diff --git a/queue-4.19/m68k-cmpxchg-fix-return-value-for-default-case-in-__.patch b/queue-4.19/m68k-cmpxchg-fix-return-value-for-default-case-in-__.patch new file mode 100644 index 00000000000..a1f765825b9 --- /dev/null +++ b/queue-4.19/m68k-cmpxchg-fix-return-value-for-default-case-in-__.patch @@ -0,0 +1,38 @@ +From a0a51ef2a10c00c92666c2d56bc1858749aec5cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 05:41:17 +0200 +Subject: m68k: cmpxchg: Fix return value for default case in __arch_xchg() + +From: Thorsten Blum + +[ Upstream commit 21b9e722ad28c19c2bc83f18f540b3dbd89bf762 ] + +The return value of __invalid_xchg_size() is assigned to tmp instead of +the return variable x. Assign it to x instead. + +Fixes: 2501cf768e4009a0 ("m68k: Fix xchg/cmpxchg to fail to link if given an inappropriate pointer") +Signed-off-by: Thorsten Blum +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20240702034116.140234-2-thorsten.blum@toblux.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/include/asm/cmpxchg.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/m68k/include/asm/cmpxchg.h b/arch/m68k/include/asm/cmpxchg.h +index 38e1d7acc44dc..1f996713ce876 100644 +--- a/arch/m68k/include/asm/cmpxchg.h ++++ b/arch/m68k/include/asm/cmpxchg.h +@@ -33,7 +33,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz + x = tmp; + break; + default: +- tmp = __invalid_xchg_size(x, ptr, size); ++ x = __invalid_xchg_size(x, ptr, size); + break; + } + +-- +2.43.0 + diff --git a/queue-4.19/macintosh-therm_windtunnel-fix-module-unload.patch b/queue-4.19/macintosh-therm_windtunnel-fix-module-unload.patch new file mode 100644 index 00000000000..449ea07fd99 --- /dev/null +++ b/queue-4.19/macintosh-therm_windtunnel-fix-module-unload.patch @@ -0,0 +1,48 @@ +From b5608923c8060da84d60362eacdbadd8263b90ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 23:54:17 -0400 +Subject: macintosh/therm_windtunnel: fix module unload. + +From: Nick Bowler + +[ Upstream commit fd748e177194ebcbbaf98df75152a30e08230cc6 ] + +The of_device_unregister call in therm_windtunnel's module_exit procedure +does not fully reverse the effects of of_platform_device_create in the +module_init prodedure. Once you unload this module, it is impossible +to load it ever again since only the first of_platform_device_create +call on the fan node succeeds. + +This driver predates first git commit, and it turns out back then +of_platform_device_create worked differently than it does today. +So this is actually an old regression. + +The appropriate function to undo of_platform_device_create now appears +to be of_platform_device_destroy, and switching to use this makes it +possible to unload and load the module as expected. + +Signed-off-by: Nick Bowler +Fixes: c6e126de43e7 ("of: Keep track of populated platform devices") +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240711035428.16696-1-nbowler@draconx.ca +Signed-off-by: Sasha Levin +--- + drivers/macintosh/therm_windtunnel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/macintosh/therm_windtunnel.c b/drivers/macintosh/therm_windtunnel.c +index a0d87ed9da696..63e99762a1656 100644 +--- a/drivers/macintosh/therm_windtunnel.c ++++ b/drivers/macintosh/therm_windtunnel.c +@@ -549,7 +549,7 @@ g4fan_exit( void ) + platform_driver_unregister( &therm_of_driver ); + + if( x.of_dev ) +- of_device_unregister( x.of_dev ); ++ of_platform_device_destroy(&x.of_dev->dev, NULL); + } + + module_init(g4fan_init); +-- +2.43.0 + diff --git a/queue-4.19/media-imon-fix-race-getting-ictx-lock.patch b/queue-4.19/media-imon-fix-race-getting-ictx-lock.patch new file mode 100644 index 00000000000..b7d5598dfb6 --- /dev/null +++ b/queue-4.19/media-imon-fix-race-getting-ictx-lock.patch @@ -0,0 +1,51 @@ +From 4f5088ef8b41c6edbe0ca7da47152fe97c8780b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 21:10:27 +0000 +Subject: media: imon: Fix race getting ictx->lock + +From: Ricardo Ribalda + +[ Upstream commit 24147897507cd3a7d63745d1518a638bf4132238 ] + +Lets fix a race between mutex_is_lock() and mutex_lock(). + +<-mutex is not locked +if (!mutex_is_locked(&ictx->lock)) { + unlock = true; <- mutex is locked externaly + mutex_lock(&ictx->lock); +} + +Let's use mutex_trylock() that does mutex_is_lock() and mutex_lock() +atomically. + +Fix the following cocci warning: +drivers/media/rc/imon.c:1167:1-7: preceding lock on line 1153 + +Fixes: 23ef710e1a6c ("[media] imon: add conditional locking in change_protocol") +Signed-off-by: Ricardo Ribalda +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/rc/imon.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c +index 99bb7380ee0e5..c78e1a4a10ec5 100644 +--- a/drivers/media/rc/imon.c ++++ b/drivers/media/rc/imon.c +@@ -1126,10 +1126,7 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 *rc_proto) + + memcpy(ictx->usb_tx_buf, &ir_proto_packet, sizeof(ir_proto_packet)); + +- if (!mutex_is_locked(&ictx->lock)) { +- unlock = true; +- mutex_lock(&ictx->lock); +- } ++ unlock = mutex_trylock(&ictx->lock); + + retval = send_packet(ictx); + if (retval) +-- +2.43.0 + diff --git a/queue-4.19/media-renesas-vsp1-fix-_irqsave-and-_irq-mix.patch b/queue-4.19/media-renesas-vsp1-fix-_irqsave-and-_irq-mix.patch new file mode 100644 index 00000000000..35506413f30 --- /dev/null +++ b/queue-4.19/media-renesas-vsp1-fix-_irqsave-and-_irq-mix.patch @@ -0,0 +1,117 @@ +From 3966816b9b82929cb7b86f440b7c6ca9a4341e61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 May 2024 20:22:27 +0300 +Subject: media: renesas: vsp1: Fix _irqsave and _irq mix + +From: Laurent Pinchart + +[ Upstream commit 57edbbcf5258c378a9b9d0c80d33b03a010b22c8 ] + +The histogram support mixes _irqsave and _irq, causing the following +smatch warning: + + drivers/media/platform/renesas/vsp1/vsp1_histo.c:153 histo_stop_streaming() + warn: mixing irqsave and irq + +The histo_stop_streaming() calls spin_lock_irqsave() followed by +wait_event_lock_irq(). The former hints that interrupts may be disabled +by the caller, while the latter reenables interrupts unconditionally. +This doesn't cause any real bug, as the function is always called with +interrupts enabled, but the pattern is still incorrect. + +Fix the problem by using spin_lock_irq() instead of spin_lock_irqsave() +in histo_stop_streaming(). While at it, switch to spin_lock_irq() and +spin_lock() as appropriate elsewhere. + +Fixes: 99362e32332b ("[media] v4l: vsp1: Add histogram support") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/linux-renesas-soc/164d74ff-312c-468f-be64-afa7182cd2f4@moroto.mountain/ +Reviewed-by: Kieran Bingham +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vsp1/vsp1_histo.c | 20 ++++++++------------ + 1 file changed, 8 insertions(+), 12 deletions(-) + +diff --git a/drivers/media/platform/vsp1/vsp1_histo.c b/drivers/media/platform/vsp1/vsp1_histo.c +index 5e15c8ff88d99..d1942163e650d 100644 +--- a/drivers/media/platform/vsp1/vsp1_histo.c ++++ b/drivers/media/platform/vsp1/vsp1_histo.c +@@ -36,9 +36,8 @@ struct vsp1_histogram_buffer * + vsp1_histogram_buffer_get(struct vsp1_histogram *histo) + { + struct vsp1_histogram_buffer *buf = NULL; +- unsigned long flags; + +- spin_lock_irqsave(&histo->irqlock, flags); ++ spin_lock(&histo->irqlock); + + if (list_empty(&histo->irqqueue)) + goto done; +@@ -49,7 +48,7 @@ vsp1_histogram_buffer_get(struct vsp1_histogram *histo) + histo->readout = true; + + done: +- spin_unlock_irqrestore(&histo->irqlock, flags); ++ spin_unlock(&histo->irqlock); + return buf; + } + +@@ -58,7 +57,6 @@ void vsp1_histogram_buffer_complete(struct vsp1_histogram *histo, + size_t size) + { + struct vsp1_pipeline *pipe = histo->entity.pipe; +- unsigned long flags; + + /* + * The pipeline pointer is guaranteed to be valid as this function is +@@ -70,10 +68,10 @@ void vsp1_histogram_buffer_complete(struct vsp1_histogram *histo, + vb2_set_plane_payload(&buf->buf.vb2_buf, 0, size); + vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_DONE); + +- spin_lock_irqsave(&histo->irqlock, flags); ++ spin_lock(&histo->irqlock); + histo->readout = false; + wake_up(&histo->wait_queue); +- spin_unlock_irqrestore(&histo->irqlock, flags); ++ spin_unlock(&histo->irqlock); + } + + /* ----------------------------------------------------------------------------- +@@ -124,11 +122,10 @@ static void histo_buffer_queue(struct vb2_buffer *vb) + struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb); + struct vsp1_histogram *histo = vb2_get_drv_priv(vb->vb2_queue); + struct vsp1_histogram_buffer *buf = to_vsp1_histogram_buffer(vbuf); +- unsigned long flags; + +- spin_lock_irqsave(&histo->irqlock, flags); ++ spin_lock_irq(&histo->irqlock); + list_add_tail(&buf->queue, &histo->irqqueue); +- spin_unlock_irqrestore(&histo->irqlock, flags); ++ spin_unlock_irq(&histo->irqlock); + } + + static int histo_start_streaming(struct vb2_queue *vq, unsigned int count) +@@ -140,9 +137,8 @@ static void histo_stop_streaming(struct vb2_queue *vq) + { + struct vsp1_histogram *histo = vb2_get_drv_priv(vq); + struct vsp1_histogram_buffer *buffer; +- unsigned long flags; + +- spin_lock_irqsave(&histo->irqlock, flags); ++ spin_lock_irq(&histo->irqlock); + + /* Remove all buffers from the IRQ queue. */ + list_for_each_entry(buffer, &histo->irqqueue, queue) +@@ -152,7 +148,7 @@ static void histo_stop_streaming(struct vb2_queue *vq) + /* Wait for the buffer being read out (if any) to complete. */ + wait_event_lock_irq(histo->wait_queue, !histo->readout, histo->irqlock); + +- spin_unlock_irqrestore(&histo->irqlock, flags); ++ spin_unlock_irq(&histo->irqlock); + } + + static const struct vb2_ops histo_video_queue_qops = { +-- +2.43.0 + diff --git a/queue-4.19/media-renesas-vsp1-store-rpf-partition-configuration.patch b/queue-4.19/media-renesas-vsp1-store-rpf-partition-configuration.patch new file mode 100644 index 00000000000..fab68bb8065 --- /dev/null +++ b/queue-4.19/media-renesas-vsp1-store-rpf-partition-configuration.patch @@ -0,0 +1,66 @@ +From bbe79d4e9eb8a76fb72e2359afae3de3e9bfda10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Nov 2023 03:11:51 +0200 +Subject: media: renesas: vsp1: Store RPF partition configuration per RPF + instance + +From: Laurent Pinchart + +[ Upstream commit a213bc09b1025c771ee722ee341af1d84375db8a ] + +The vsp1_partition structure stores the RPF partition configuration in a +single field for all RPF instances, while each RPF can have its own +configuration. Fix it by storing the configuration separately for each +RPF instance. + +Signed-off-by: Laurent Pinchart +Fixes: ab45e8585182 ("media: v4l: vsp1: Allow entities to participate in the partition algorithm") +Reviewed-by: Jacopo Mondi +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vsp1/vsp1_pipe.h | 2 +- + drivers/media/platform/vsp1/vsp1_rpf.c | 8 +++++--- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/vsp1/vsp1_pipe.h b/drivers/media/platform/vsp1/vsp1_pipe.h +index ae646c9ef3373..15daf35bda216 100644 +--- a/drivers/media/platform/vsp1/vsp1_pipe.h ++++ b/drivers/media/platform/vsp1/vsp1_pipe.h +@@ -73,7 +73,7 @@ struct vsp1_partition_window { + * @wpf: The WPF partition window configuration + */ + struct vsp1_partition { +- struct vsp1_partition_window rpf; ++ struct vsp1_partition_window rpf[VSP1_MAX_RPF]; + struct vsp1_partition_window uds_sink; + struct vsp1_partition_window uds_source; + struct vsp1_partition_window sru; +diff --git a/drivers/media/platform/vsp1/vsp1_rpf.c b/drivers/media/platform/vsp1/vsp1_rpf.c +index abaf4dde3802d..a61b86861c64d 100644 +--- a/drivers/media/platform/vsp1/vsp1_rpf.c ++++ b/drivers/media/platform/vsp1/vsp1_rpf.c +@@ -270,8 +270,8 @@ static void rpf_configure_partition(struct vsp1_entity *entity, + * 'width' need to be adjusted. + */ + if (pipe->partitions > 1) { +- crop.width = pipe->partition->rpf.width; +- crop.left += pipe->partition->rpf.left; ++ crop.width = pipe->partition->rpf[rpf->entity.index].width; ++ crop.left += pipe->partition->rpf[rpf->entity.index].left; + } + + if (pipe->interlaced) { +@@ -326,7 +326,9 @@ static void rpf_partition(struct vsp1_entity *entity, + unsigned int partition_idx, + struct vsp1_partition_window *window) + { +- partition->rpf = *window; ++ struct vsp1_rwpf *rpf = to_rwpf(&entity->subdev); ++ ++ partition->rpf[rpf->entity.index] = *window; + } + + static const struct vsp1_entity_operations rpf_entity_ops = { +-- +2.43.0 + diff --git a/queue-4.19/media-uvcvideo-allow-entity-defined-get_info-and-get.patch b/queue-4.19/media-uvcvideo-allow-entity-defined-get_info-and-get.patch new file mode 100644 index 00000000000..457ca1fed5b --- /dev/null +++ b/queue-4.19/media-uvcvideo-allow-entity-defined-get_info-and-get.patch @@ -0,0 +1,84 @@ +From f8b9008401f6bdf03aebdbe160d3a1420be3d2ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Dec 2020 14:35:21 +0100 +Subject: media: uvcvideo: Allow entity-defined get_info and get_cur + +From: Ricardo Ribalda + +[ Upstream commit 65900c581d014499f0f8ceabfc02c652e9a88771 ] + +Allows controls to get their properties and current value +from an entity-defined function instead of via a query to the USB +device. + +Signed-off-by: Ricardo Ribalda +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: 86419686e66d ("media: uvcvideo: Override default flags") +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_ctrl.c | 22 ++++++++++++++++++---- + drivers/media/usb/uvc/uvcvideo.h | 5 +++++ + 2 files changed, 23 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index 84b1339c2c6e3..5d437e33c5902 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -1007,10 +1007,20 @@ static int __uvc_ctrl_get(struct uvc_video_chain *chain, + return -EACCES; + + if (!ctrl->loaded) { +- ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, ctrl->entity->id, +- chain->dev->intfnum, ctrl->info.selector, ++ if (ctrl->entity->get_cur) { ++ ret = ctrl->entity->get_cur(chain->dev, ++ ctrl->entity, ++ ctrl->info.selector, + uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT), + ctrl->info.size); ++ } else { ++ ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, ++ ctrl->entity->id, ++ chain->dev->intfnum, ++ ctrl->info.selector, ++ uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT), ++ ctrl->info.size); ++ } + if (ret < 0) + return ret; + +@@ -1723,8 +1733,12 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev, + if (data == NULL) + return -ENOMEM; + +- ret = uvc_query_ctrl(dev, UVC_GET_INFO, ctrl->entity->id, dev->intfnum, +- info->selector, data, 1); ++ if (ctrl->entity->get_info) ++ ret = ctrl->entity->get_info(dev, ctrl->entity, ++ ctrl->info.selector, data); ++ else ++ ret = uvc_query_ctrl(dev, UVC_GET_INFO, ctrl->entity->id, ++ dev->intfnum, info->selector, data, 1); + if (!ret) + info->flags |= (data[0] & UVC_CONTROL_CAP_GET ? + UVC_CTRL_FLAG_GET_CUR : 0) +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index e8b06164b27ac..4df3b014dd40b 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -345,6 +345,11 @@ struct uvc_entity { + u8 bNrInPins; + u8 *baSourceID; + ++ int (*get_info)(struct uvc_device *dev, struct uvc_entity *entity, ++ u8 cs, u8 *caps); ++ int (*get_cur)(struct uvc_device *dev, struct uvc_entity *entity, ++ u8 cs, void *data, u16 size); ++ + unsigned int ncontrols; + struct uvc_control *controls; + }; +-- +2.43.0 + diff --git a/queue-4.19/media-uvcvideo-override-default-flags.patch b/queue-4.19/media-uvcvideo-override-default-flags.patch new file mode 100644 index 00000000000..20d3bc6bba5 --- /dev/null +++ b/queue-4.19/media-uvcvideo-override-default-flags.patch @@ -0,0 +1,68 @@ +From b079f06f6f40acb466c6c7056a98b2043eadd570 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Jun 2024 14:50:53 +0800 +Subject: media: uvcvideo: Override default flags + +From: Daniel Schaefer + +[ Upstream commit 86419686e66da5b90a07fb8a40ab138fe97189b5 ] + +When the UVC device has a control that is readonly it doesn't set the +SET_CUR flag. For example the privacy control has SET_CUR flag set in +the defaults in the `uvc_ctrls` variable. Even if the device does not +have it set, it's not cleared by uvc_ctrl_get_flags(). + +Originally written with assignment in commit 859086ae3636 ("media: +uvcvideo: Apply flags from device to actual properties"). But changed to +|= in commit 0dc68cabdb62 ("media: uvcvideo: Prevent setting unavailable +flags"). It would not clear the default flags. + +With this patch applied the correct flags are reported to user space. +Tested with: + +``` +> v4l2-ctl --list-ctrls | grep privacy +privacy 0x009a0910 (bool) : default=0 value=0 flags=read-only +``` + +Signed-off-by: Daniel Schaefer +Fixes: 0dc68cabdb62 ("media: uvcvideo: Prevent setting unavailable flags") +Reviewed-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20240602065053.36850-1-dhs@frame.work +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_ctrl.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index 5d437e33c5902..dee07b0572c6f 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -1739,7 +1739,13 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev, + else + ret = uvc_query_ctrl(dev, UVC_GET_INFO, ctrl->entity->id, + dev->intfnum, info->selector, data, 1); +- if (!ret) ++ ++ if (!ret) { ++ info->flags &= ~(UVC_CTRL_FLAG_GET_CUR | ++ UVC_CTRL_FLAG_SET_CUR | ++ UVC_CTRL_FLAG_AUTO_UPDATE | ++ UVC_CTRL_FLAG_ASYNCHRONOUS); ++ + info->flags |= (data[0] & UVC_CONTROL_CAP_GET ? + UVC_CTRL_FLAG_GET_CUR : 0) + | (data[0] & UVC_CONTROL_CAP_SET ? +@@ -1748,6 +1754,7 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev, + UVC_CTRL_FLAG_AUTO_UPDATE : 0) + | (data[0] & UVC_CONTROL_CAP_ASYNCHRONOUS ? + UVC_CTRL_FLAG_ASYNCHRONOUS : 0); ++ } + + kfree(data); + return ret; +-- +2.43.0 + diff --git a/queue-4.19/mfd-omap-usb-tll-use-struct_size-to-allocate-tll.patch b/queue-4.19/mfd-omap-usb-tll-use-struct_size-to-allocate-tll.patch new file mode 100644 index 00000000000..ff7a6515cf0 --- /dev/null +++ b/queue-4.19/mfd-omap-usb-tll-use-struct_size-to-allocate-tll.patch @@ -0,0 +1,69 @@ +From 3dd2cbe399b845e32ad89f25982e9028848f5547 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 21:37:03 +0200 +Subject: mfd: omap-usb-tll: Use struct_size to allocate tll + +From: Javier Carrasco + +[ Upstream commit 40176714c818b0b6a2ca8213cdb7654fbd49b742 ] + +Commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") +changed the memory allocation of 'tll' to consolidate it into a single +allocation, introducing an incorrect size calculation. + +In particular, the allocation for the array of pointers was converted +into a single-pointer allocation. + +The memory allocation used to occur in two steps: + +tll = devm_kzalloc(dev, sizeof(struct usbtll_omap), GFP_KERNEL); +tll->ch_clk = devm_kzalloc(dev, sizeof(struct clk *) * tll->nch, + GFP_KERNEL); + +And it turned that into the following allocation: + +tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]), + GFP_KERNEL); + +sizeof(tll->ch_clk[nch]) returns the size of a single pointer instead of +the expected nch pointers. + +This bug went unnoticed because the allocation size was small enough to +fit within the minimum size of a memory allocation for this particular +case [1]. + +The complete allocation can still be done at once with the struct_size +macro, which comes in handy for structures with a trailing flexible +array. + +Fix the memory allocation to obtain the original size again. + +Link: https://lore.kernel.org/all/202406261121.2FFD65647@keescook/ [1] +Fixes: 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") +Reviewed-by: Kees Cook +Signed-off-by: Javier Carrasco +Fixes: commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") +Link: https://lore.kernel.org/r/20240626-omap-usb-tll-counted_by-v2-1-4bedf20d1b51@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/omap-usb-tll.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c +index 446713dbee27a..269eeccb963bc 100644 +--- a/drivers/mfd/omap-usb-tll.c ++++ b/drivers/mfd/omap-usb-tll.c +@@ -246,8 +246,7 @@ static int usbtll_omap_probe(struct platform_device *pdev) + break; + } + +- tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]), +- GFP_KERNEL); ++ tll = devm_kzalloc(dev, struct_size(tll, ch_clk, nch), GFP_KERNEL); + if (!tll) { + pm_runtime_put_sync(dev); + pm_runtime_disable(dev); +-- +2.43.0 + diff --git a/queue-4.19/mips-octeron-remove-source-file-executable-bit.patch b/queue-4.19/mips-octeron-remove-source-file-executable-bit.patch new file mode 100644 index 00000000000..a1d5dfb7cd4 --- /dev/null +++ b/queue-4.19/mips-octeron-remove-source-file-executable-bit.patch @@ -0,0 +1,27 @@ +From 7d85f52d8366e2a6604d9d5615bc80a9e73f59ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jul 2024 16:48:30 +0900 +Subject: MIPS: Octeron: remove source file executable bit + +From: Dominique Martinet + +[ Upstream commit 89c7f5078935872cf47a713a645affb5037be694 ] + +This does not matter the least, but there is no other .[ch] file in the +repo that is executable, so clean this up. + +Fixes: 29b83a64df3b ("MIPS: Octeon: Add PCIe link status check") +Signed-off-by: Dominique Martinet +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/pci/pcie-octeon.c | 0 + 1 file changed, 0 insertions(+), 0 deletions(-) + mode change 100755 => 100644 arch/mips/pci/pcie-octeon.c + +diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c +old mode 100755 +new mode 100644 +-- +2.43.0 + diff --git a/queue-4.19/mtd-make-mtd_test.c-a-separate-module.patch b/queue-4.19/mtd-make-mtd_test.c-a-separate-module.patch new file mode 100644 index 00000000000..ae9ff5bca52 --- /dev/null +++ b/queue-4.19/mtd-make-mtd_test.c-a-separate-module.patch @@ -0,0 +1,114 @@ +From 554f20cd249dc0709e88cf9b34481cce40e7c4df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 11:50:39 +0200 +Subject: mtd: make mtd_test.c a separate module + +From: Arnd Bergmann + +[ Upstream commit a5cf054d325e6f362e82fe6d124a1871a4af8174 ] + +This file gets linked into nine different modules, which causes a warning: + +scripts/Makefile.build:236: drivers/mtd/tests/Makefile: mtd_test.o is added to multiple modules: mtd_nandbiterrs mtd_oobtest mtd_pagetest mtd_readtest mtd_speedtest mtd_stresstest mtd_subpagetest mtd_torturetest + +Make it a separate module instead. + +Fixes: a995c792280d ("mtd: tests: rename sources in order to link a helper object") +Signed-off-by: Arnd Bergmann +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20240529095049.1915393-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/mtd/tests/Makefile | 34 +++++++++++++++++----------------- + drivers/mtd/tests/mtd_test.c | 9 +++++++++ + 2 files changed, 26 insertions(+), 17 deletions(-) + +diff --git a/drivers/mtd/tests/Makefile b/drivers/mtd/tests/Makefile +index 5de0378f90dbd..7dae831ee8b6b 100644 +--- a/drivers/mtd/tests/Makefile ++++ b/drivers/mtd/tests/Makefile +@@ -1,19 +1,19 @@ + # SPDX-License-Identifier: GPL-2.0 +-obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o ++obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o mtd_test.o + +-mtd_oobtest-objs := oobtest.o mtd_test.o +-mtd_pagetest-objs := pagetest.o mtd_test.o +-mtd_readtest-objs := readtest.o mtd_test.o +-mtd_speedtest-objs := speedtest.o mtd_test.o +-mtd_stresstest-objs := stresstest.o mtd_test.o +-mtd_subpagetest-objs := subpagetest.o mtd_test.o +-mtd_torturetest-objs := torturetest.o mtd_test.o +-mtd_nandbiterrs-objs := nandbiterrs.o mtd_test.o ++mtd_oobtest-objs := oobtest.o ++mtd_pagetest-objs := pagetest.o ++mtd_readtest-objs := readtest.o ++mtd_speedtest-objs := speedtest.o ++mtd_stresstest-objs := stresstest.o ++mtd_subpagetest-objs := subpagetest.o ++mtd_torturetest-objs := torturetest.o ++mtd_nandbiterrs-objs := nandbiterrs.o +diff --git a/drivers/mtd/tests/mtd_test.c b/drivers/mtd/tests/mtd_test.c +index c84250beffdc9..f391e0300cdc9 100644 +--- a/drivers/mtd/tests/mtd_test.c ++++ b/drivers/mtd/tests/mtd_test.c +@@ -25,6 +25,7 @@ int mtdtest_erase_eraseblock(struct mtd_info *mtd, unsigned int ebnum) + + return 0; + } ++EXPORT_SYMBOL_GPL(mtdtest_erase_eraseblock); + + static int is_block_bad(struct mtd_info *mtd, unsigned int ebnum) + { +@@ -57,6 +58,7 @@ int mtdtest_scan_for_bad_eraseblocks(struct mtd_info *mtd, unsigned char *bbt, + + return 0; + } ++EXPORT_SYMBOL_GPL(mtdtest_scan_for_bad_eraseblocks); + + int mtdtest_erase_good_eraseblocks(struct mtd_info *mtd, unsigned char *bbt, + unsigned int eb, int ebcnt) +@@ -75,6 +77,7 @@ int mtdtest_erase_good_eraseblocks(struct mtd_info *mtd, unsigned char *bbt, + + return 0; + } ++EXPORT_SYMBOL_GPL(mtdtest_erase_good_eraseblocks); + + int mtdtest_read(struct mtd_info *mtd, loff_t addr, size_t size, void *buf) + { +@@ -92,6 +95,7 @@ int mtdtest_read(struct mtd_info *mtd, loff_t addr, size_t size, void *buf) + + return err; + } ++EXPORT_SYMBOL_GPL(mtdtest_read); + + int mtdtest_write(struct mtd_info *mtd, loff_t addr, size_t size, + const void *buf) +@@ -107,3 +111,8 @@ int mtdtest_write(struct mtd_info *mtd, loff_t addr, size_t size, + + return err; + } ++EXPORT_SYMBOL_GPL(mtdtest_write); ++ ++MODULE_LICENSE("GPL"); ++MODULE_DESCRIPTION("MTD function test helpers"); ++MODULE_AUTHOR("Akinobu Mita"); +-- +2.43.0 + diff --git a/queue-4.19/net-fec-fix-fec_ecr_en1588-being-cleared-on-link-dow.patch b/queue-4.19/net-fec-fix-fec_ecr_en1588-being-cleared-on-link-dow.patch new file mode 100644 index 00000000000..6f33ca4d7dc --- /dev/null +++ b/queue-4.19/net-fec-fix-fec_ecr_en1588-being-cleared-on-link-dow.patch @@ -0,0 +1,50 @@ +From 38b6cbbb9d1ad8d199c85d9a0ccf6dc29ab6ef4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 14:31:11 +0200 +Subject: net: fec: Fix FEC_ECR_EN1588 being cleared on link-down +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Csókás, Bence + +[ Upstream commit c32fe1986f27cac329767d3497986e306cad1d5e ] + +FEC_ECR_EN1588 bit gets cleared after MAC reset in `fec_stop()`, which +makes all 1588 functionality shut down, and all the extended registers +disappear, on link-down, making the adapter fall back to compatibility +"dumb mode". However, some functionality needs to be retained (e.g. PPS) +even without link. + +Fixes: 6605b730c061 ("FEC: Add time stamping code and a PTP hardware clock") +Cc: Richard Cochran +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/netdev/5fa9fadc-a89d-467a-aae9-c65469ff5fe1@lunn.ch/ +Signed-off-by: Csókás, Bence +Reviewed-by: Wei Fang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 32775326414b7..29ef84b7c9cc5 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -1202,6 +1202,12 @@ fec_stop(struct net_device *ndev) + writel(FEC_ECR_ETHEREN, fep->hwp + FEC_ECNTRL); + writel(rmii_mode, fep->hwp + FEC_R_CNTRL); + } ++ ++ if (fep->bufdesc_ex) { ++ val = readl(fep->hwp + FEC_ECNTRL); ++ val |= FEC_ECR_EN1588; ++ writel(val, fep->hwp + FEC_ECNTRL); ++ } + } + + static void +-- +2.43.0 + diff --git a/queue-4.19/net-fec-refactor-define-magic-constants.patch b/queue-4.19/net-fec-refactor-define-magic-constants.patch new file mode 100644 index 00000000000..3c3282267d6 --- /dev/null +++ b/queue-4.19/net-fec-refactor-define-magic-constants.patch @@ -0,0 +1,149 @@ +From 31c55ec45846b2ed7e9d3ead15e4b07ea2494f5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 16:37:17 +0100 +Subject: net: fec: Refactor: #define magic constants +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Csókás Bence + +[ Upstream commit ff049886671ccd4e624a30ec464cb20e4c39a313 ] + +Add defines for bits of ECR, RCR control registers, TX watermark etc. + +Signed-off-by: Csókás Bence +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20240212153717.10023-1-csokas.bence@prolan.hu +Signed-off-by: Jakub Kicinski +Stable-dep-of: c32fe1986f27 ("net: fec: Fix FEC_ECR_EN1588 being cleared on link-down") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 46 +++++++++++++++-------- + 1 file changed, 30 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 35593b41e6c12..32775326414b7 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -223,8 +223,8 @@ MODULE_PARM_DESC(macaddr, "FEC Ethernet MAC address"); + #define PKT_MINBUF_SIZE 64 + + /* FEC receive acceleration */ +-#define FEC_RACC_IPDIS (1 << 1) +-#define FEC_RACC_PRODIS (1 << 2) ++#define FEC_RACC_IPDIS BIT(1) ++#define FEC_RACC_PRODIS BIT(2) + #define FEC_RACC_SHIFT16 BIT(7) + #define FEC_RACC_OPTIONS (FEC_RACC_IPDIS | FEC_RACC_PRODIS) + +@@ -253,8 +253,23 @@ MODULE_PARM_DESC(macaddr, "FEC Ethernet MAC address"); + #define FEC_MMFR_TA (2 << 16) + #define FEC_MMFR_DATA(v) (v & 0xffff) + /* FEC ECR bits definition */ +-#define FEC_ECR_MAGICEN (1 << 2) +-#define FEC_ECR_SLEEP (1 << 3) ++#define FEC_ECR_RESET BIT(0) ++#define FEC_ECR_ETHEREN BIT(1) ++#define FEC_ECR_MAGICEN BIT(2) ++#define FEC_ECR_SLEEP BIT(3) ++#define FEC_ECR_EN1588 BIT(4) ++#define FEC_ECR_BYTESWP BIT(8) ++/* FEC RCR bits definition */ ++#define FEC_RCR_LOOP BIT(0) ++#define FEC_RCR_HALFDPX BIT(1) ++#define FEC_RCR_MII BIT(2) ++#define FEC_RCR_PROMISC BIT(3) ++#define FEC_RCR_BC_REJ BIT(4) ++#define FEC_RCR_FLOWCTL BIT(5) ++#define FEC_RCR_RMII BIT(8) ++#define FEC_RCR_10BASET BIT(9) ++/* TX WMARK bits */ ++#define FEC_TXWMRK_STRFWD BIT(8) + + #define FEC_MII_TIMEOUT 30000 /* us */ + +@@ -950,7 +965,7 @@ fec_restart(struct net_device *ndev) + u32 val; + u32 temp_mac[2]; + u32 rcntl = OPT_FRAME_SIZE | 0x04; +- u32 ecntl = 0x2; /* ETHEREN */ ++ u32 ecntl = FEC_ECR_ETHEREN; + + /* Whack a reset. We should wait for this. + * For i.MX6SX SOC, enet use AXI bus, we use disable MAC +@@ -1026,18 +1041,18 @@ fec_restart(struct net_device *ndev) + fep->phy_interface == PHY_INTERFACE_MODE_RGMII_TXID) + rcntl |= (1 << 6); + else if (fep->phy_interface == PHY_INTERFACE_MODE_RMII) +- rcntl |= (1 << 8); ++ rcntl |= FEC_RCR_RMII; + else +- rcntl &= ~(1 << 8); ++ rcntl &= ~FEC_RCR_RMII; + + /* 1G, 100M or 10M */ + if (ndev->phydev) { + if (ndev->phydev->speed == SPEED_1000) + ecntl |= (1 << 5); + else if (ndev->phydev->speed == SPEED_100) +- rcntl &= ~(1 << 9); ++ rcntl &= ~FEC_RCR_10BASET; + else +- rcntl |= (1 << 9); ++ rcntl |= FEC_RCR_10BASET; + } + } else { + #ifdef FEC_MIIGSK_ENR +@@ -1096,13 +1111,13 @@ fec_restart(struct net_device *ndev) + + if (fep->quirks & FEC_QUIRK_ENET_MAC) { + /* enable ENET endian swap */ +- ecntl |= (1 << 8); ++ ecntl |= FEC_ECR_BYTESWP; + /* enable ENET store and forward mode */ +- writel(1 << 8, fep->hwp + FEC_X_WMRK); ++ writel(FEC_TXWMRK_STRFWD, fep->hwp + FEC_X_WMRK); + } + + if (fep->bufdesc_ex) +- ecntl |= (1 << 4); ++ ecntl |= FEC_ECR_EN1588; + + #ifndef CONFIG_M5272 + /* Enable the MIB statistic event counters */ +@@ -1149,7 +1164,7 @@ static void + fec_stop(struct net_device *ndev) + { + struct fec_enet_private *fep = netdev_priv(ndev); +- u32 rmii_mode = readl(fep->hwp + FEC_R_CNTRL) & (1 << 8); ++ u32 rmii_mode = readl(fep->hwp + FEC_R_CNTRL) & FEC_RCR_RMII; + u32 val; + + /* We cannot expect a graceful transmit stop without link !!! */ +@@ -1168,7 +1183,7 @@ fec_stop(struct net_device *ndev) + if (fep->quirks & FEC_QUIRK_HAS_AVB) { + writel(0, fep->hwp + FEC_ECNTRL); + } else { +- writel(1, fep->hwp + FEC_ECNTRL); ++ writel(FEC_ECR_RESET, fep->hwp + FEC_ECNTRL); + udelay(10); + } + writel(FEC_DEFAULT_IMASK, fep->hwp + FEC_IMASK); +@@ -1184,12 +1199,11 @@ fec_stop(struct net_device *ndev) + /* We have to keep ENET enabled to have MII interrupt stay working */ + if (fep->quirks & FEC_QUIRK_ENET_MAC && + !(fep->wol_flag & FEC_WOL_FLAG_SLEEP_ON)) { +- writel(2, fep->hwp + FEC_ECNTRL); ++ writel(FEC_ECR_ETHEREN, fep->hwp + FEC_ECNTRL); + writel(rmii_mode, fep->hwp + FEC_R_CNTRL); + } + } + +- + static void + fec_timeout(struct net_device *ndev) + { +-- +2.43.0 + diff --git a/queue-4.19/net-smc-allow-smc-d-1mb-dmb-allocations.patch b/queue-4.19/net-smc-allow-smc-d-1mb-dmb-allocations.patch new file mode 100644 index 00000000000..287a5b9b6de --- /dev/null +++ b/queue-4.19/net-smc-allow-smc-d-1mb-dmb-allocations.patch @@ -0,0 +1,107 @@ +From 493ea90462d1ba2aba56c7191aefa8117e32c61b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Aug 2021 10:10:14 +0200 +Subject: net/smc: Allow SMC-D 1MB DMB allocations + +From: Stefan Raspl + +[ Upstream commit 67161779a9ea926fccee8de047ae66cbd3482b91 ] + +Commit a3fe3d01bd0d7 ("net/smc: introduce sg-logic for RMBs") introduced +a restriction for RMB allocations as used by SMC-R. However, SMC-D does +not use scatter-gather lists to back its DMBs, yet it was limited by +this restriction, still. +This patch exempts SMC, but limits allocations to the maximum RMB/DMB +size respectively. + +Signed-off-by: Stefan Raspl +Signed-off-by: Guvenc Gulce +Signed-off-by: David S. Miller +Stable-dep-of: 3ac14b9dfbd3 ("net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined") +Signed-off-by: Sasha Levin +--- + net/smc/smc_core.c | 31 ++++++++++++++++--------------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index 4d421407d6fc6..691c1d9c4c560 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -656,21 +656,30 @@ int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact, + return rc ? rc : local_contact; + } + +-/* convert the RMB size into the compressed notation - minimum 16K. ++#define SMCD_DMBE_SIZES 6 /* 0 -> 16KB, 1 -> 32KB, .. 6 -> 1MB */ ++#define SMCR_RMBE_SIZES 5 /* 0 -> 16KB, 1 -> 32KB, .. 5 -> 512KB */ ++ ++/* convert the RMB size into the compressed notation (minimum 16K, see ++ * SMCD/R_DMBE_SIZES. + * In contrast to plain ilog2, this rounds towards the next power of 2, + * so the socket application gets at least its desired sndbuf / rcvbuf size. + */ +-static u8 smc_compress_bufsize(int size) ++static u8 smc_compress_bufsize(int size, bool is_smcd, bool is_rmb) + { ++ const unsigned int max_scat = SG_MAX_SINGLE_ALLOC * PAGE_SIZE; + u8 compressed; + + if (size <= SMC_BUF_MIN_SIZE) + return 0; + +- size = (size - 1) >> 14; +- compressed = ilog2(size) + 1; +- if (compressed >= SMC_RMBE_SIZES) +- compressed = SMC_RMBE_SIZES - 1; ++ size = (size - 1) >> 14; /* convert to 16K multiple */ ++ compressed = min_t(u8, ilog2(size) + 1, ++ is_smcd ? SMCD_DMBE_SIZES : SMCR_RMBE_SIZES); ++ ++ if (!is_smcd && is_rmb) ++ /* RMBs are backed by & limited to max size of scatterlists */ ++ compressed = min_t(u8, compressed, ilog2(max_scat >> 14)); ++ + return compressed; + } + +@@ -771,17 +780,12 @@ static struct smc_buf_desc *smcr_new_buf_create(struct smc_link_group *lgr, + return buf_desc; + } + +-#define SMCD_DMBE_SIZES 6 /* 0 -> 16KB, 1 -> 32KB, .. 6 -> 1MB */ +- + static struct smc_buf_desc *smcd_new_buf_create(struct smc_link_group *lgr, + bool is_dmb, int bufsize) + { + struct smc_buf_desc *buf_desc; + int rc; + +- if (smc_compress_bufsize(bufsize) > SMCD_DMBE_SIZES) +- return ERR_PTR(-EAGAIN); +- + /* try to alloc a new DMB */ + buf_desc = kzalloc(sizeof(*buf_desc), GFP_KERNEL); + if (!buf_desc) +@@ -825,9 +829,8 @@ static int __smc_buf_create(struct smc_sock *smc, bool is_smcd, bool is_rmb) + /* use socket send buffer size (w/o overhead) as start value */ + sk_buf_size = smc->sk.sk_sndbuf / 2; + +- for (bufsize_short = smc_compress_bufsize(sk_buf_size); ++ for (bufsize_short = smc_compress_bufsize(sk_buf_size, is_smcd, is_rmb); + bufsize_short >= 0; bufsize_short--) { +- + if (is_rmb) { + lock = &lgr->rmbs_lock; + buf_list = &lgr->rmbs[bufsize_short]; +@@ -836,8 +839,6 @@ static int __smc_buf_create(struct smc_sock *smc, bool is_smcd, bool is_rmb) + buf_list = &lgr->sndbufs[bufsize_short]; + } + bufsize = smc_uncompress_bufsize(bufsize_short); +- if ((1 << get_order(bufsize)) > SG_MAX_SINGLE_ALLOC) +- continue; + + /* check for reusable slot in the link group */ + buf_desc = smc_buf_get_slot(bufsize_short, lock, buf_list); +-- +2.43.0 + diff --git a/queue-4.19/net-smc-set-rmb-s-sg_max_single_alloc-limitation-onl.patch b/queue-4.19/net-smc-set-rmb-s-sg_max_single_alloc-limitation-onl.patch new file mode 100644 index 00000000000..794abe17013 --- /dev/null +++ b/queue-4.19/net-smc-set-rmb-s-sg_max_single_alloc-limitation-onl.patch @@ -0,0 +1,57 @@ +From 81b9238ed050092d22bd302c65412674ab8066ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 11:00:18 +0800 +Subject: net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when + CONFIG_ARCH_NO_SG_CHAIN is defined + +From: Guangguan Wang + +[ Upstream commit 3ac14b9dfbd345e891d48d89f6c2fa519848f0f4 ] + +SG_MAX_SINGLE_ALLOC is used to limit maximum number of entries that +will be allocated in one piece of scatterlist. When the entries of +scatterlist exceeds SG_MAX_SINGLE_ALLOC, sg chain will be used. From +commit 7c703e54cc71 ("arch: switch the default on ARCH_HAS_SG_CHAIN"), +we can know that the macro CONFIG_ARCH_NO_SG_CHAIN is used to identify +whether sg chain is supported. So, SMC-R's rmb buffer should be limited +by SG_MAX_SINGLE_ALLOC only when the macro CONFIG_ARCH_NO_SG_CHAIN is +defined. + +Fixes: a3fe3d01bd0d ("net/smc: introduce sg-logic for RMBs") +Signed-off-by: Guangguan Wang +Co-developed-by: Wen Gu +Signed-off-by: Wen Gu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index 691c1d9c4c560..6c19cc805abc1 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -666,7 +666,6 @@ int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact, + */ + static u8 smc_compress_bufsize(int size, bool is_smcd, bool is_rmb) + { +- const unsigned int max_scat = SG_MAX_SINGLE_ALLOC * PAGE_SIZE; + u8 compressed; + + if (size <= SMC_BUF_MIN_SIZE) +@@ -676,9 +675,11 @@ static u8 smc_compress_bufsize(int size, bool is_smcd, bool is_rmb) + compressed = min_t(u8, ilog2(size) + 1, + is_smcd ? SMCD_DMBE_SIZES : SMCR_RMBE_SIZES); + ++#ifdef CONFIG_ARCH_NO_SG_CHAIN + if (!is_smcd && is_rmb) + /* RMBs are backed by & limited to max size of scatterlists */ +- compressed = min_t(u8, compressed, ilog2(max_scat >> 14)); ++ compressed = min_t(u8, compressed, ilog2((SG_MAX_SINGLE_ALLOC * PAGE_SIZE) >> 14)); ++#endif + + return compressed; + } +-- +2.43.0 + diff --git a/queue-4.19/netfilter-ctnetlink-use-helper-function-to-calculate.patch b/queue-4.19/netfilter-ctnetlink-use-helper-function-to-calculate.patch new file mode 100644 index 00000000000..98e73c4360d --- /dev/null +++ b/queue-4.19/netfilter-ctnetlink-use-helper-function-to-calculate.patch @@ -0,0 +1,38 @@ +From 1ae49c930c02a8a72091bbc0d76b247a8b782980 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jul 2024 16:47:38 +0200 +Subject: netfilter: ctnetlink: use helper function to calculate expect ID + +From: Pablo Neira Ayuso + +[ Upstream commit 782161895eb4ac45cf7cfa8db375bd4766cb8299 ] + +Delete expectation path is missing a call to the nf_expect_get_id() +helper function to calculate the expectation ID, otherwise LSB of the +expectation object address is leaked to userspace. + +Fixes: 3c79107631db ("netfilter: ctnetlink: don't use conntrack/expect object addresses as id") +Reported-by: zdi-disclosures@trendmicro.com +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_netlink.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 83e8566ec3f05..bcb72ad2c1786 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -3106,7 +3106,8 @@ static int ctnetlink_del_expect(struct net *net, struct sock *ctnl, + + if (cda[CTA_EXPECT_ID]) { + __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); +- if (ntohl(id) != (u32)(unsigned long)exp) { ++ ++ if (id != nf_expect_get_id(exp)) { + nf_ct_expect_put(exp); + return -ENOENT; + } +-- +2.43.0 + diff --git a/queue-4.19/nilfs2-avoid-undefined-behavior-in-nilfs_cnt32_ge-ma.patch b/queue-4.19/nilfs2-avoid-undefined-behavior-in-nilfs_cnt32_ge-ma.patch new file mode 100644 index 00000000000..9ea611d383e --- /dev/null +++ b/queue-4.19/nilfs2-avoid-undefined-behavior-in-nilfs_cnt32_ge-ma.patch @@ -0,0 +1,47 @@ +From acaf634101eccc06e76dab11c948dc81eeffdced Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 03:35:12 +0900 +Subject: nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro + +From: Ryusuke Konishi + +[ Upstream commit 0f3819e8c483771a59cf9d3190cd68a7a990083c ] + +According to the C standard 3.4.3p3, the result of signed integer overflow +is undefined. The macro nilfs_cnt32_ge(), which compares two sequence +numbers, uses signed integer subtraction that can overflow, and therefore +the result of the calculation may differ from what is expected due to +undefined behavior in different environments. + +Similar to an earlier change to the jiffies-related comparison macros in +commit 5a581b367b5d ("jiffies: Avoid undefined behavior from signed +overflow"), avoid this potential issue by changing the definition of the +macro to perform the subtraction as unsigned integers, then cast the +result to a signed integer for comparison. + +Link: https://lkml.kernel.org/r/20130727225828.GA11864@linux.vnet.ibm.com +Link: https://lkml.kernel.org/r/20240702183512.6390-1-konishi.ryusuke@gmail.com +Fixes: 9ff05123e3bf ("nilfs2: segment constructor") +Signed-off-by: Ryusuke Konishi +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/nilfs2/segment.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c +index 62c83193a5bb8..3c4272762779c 100644 +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -136,7 +136,7 @@ static void nilfs_dispose_list(struct the_nilfs *, struct list_head *, int); + + #define nilfs_cnt32_ge(a, b) \ + (typecheck(__u32, a) && typecheck(__u32, b) && \ +- ((__s32)(a) - (__s32)(b) >= 0)) ++ ((__s32)((a) - (b)) >= 0)) + + static int nilfs_prepare_segment_lock(struct super_block *sb, + struct nilfs_transaction_info *ti) +-- +2.43.0 + diff --git a/queue-4.19/pci-equalize-hotplug-memory-and-io-for-occupied-and-.patch b/queue-4.19/pci-equalize-hotplug-memory-and-io-for-occupied-and-.patch new file mode 100644 index 00000000000..0a3a6b89b6c --- /dev/null +++ b/queue-4.19/pci-equalize-hotplug-memory-and-io-for-occupied-and-.patch @@ -0,0 +1,122 @@ +From d1812bbc036ea102a7b8cff2ca667cd3107247bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Sep 2018 12:39:06 -0600 +Subject: PCI: Equalize hotplug memory and io for occupied and empty slots + +From: Jon Derrick + +[ Upstream commit de3ffa301142bf8802a7b0de17f9985acde5c223 ] + +Currently, a hotplug bridge will be given hpmemsize additional memory +and hpiosize additional io if available, in order to satisfy any future +hotplug allocation requirements. + +These calculations don't consider the current memory/io size of the +hotplug bridge/slot, so hotplug bridges/slots which have downstream +devices will be allocated their current allocation in addition to the +hpmemsize value. + +This makes for possibly undesirable results with a mix of unoccupied and +occupied slots (ex, with hpmemsize=2M): + + 02:03.0 PCI bridge: <-- Occupied + Memory behind bridge: d6200000-d64fffff [size=3M] + 02:04.0 PCI bridge: <-- Unoccupied + Memory behind bridge: d6500000-d66fffff [size=2M] + +This change considers the current allocation size when using the +hpmemsize/hpiosize parameters to make the reservations predictable for +the mix of unoccupied and occupied slots: + + 02:03.0 PCI bridge: <-- Occupied + Memory behind bridge: d6200000-d63fffff [size=2M] + 02:04.0 PCI bridge: <-- Unoccupied + Memory behind bridge: d6400000-d65fffff [size=2M] + +Signed-off-by: Jon Derrick +Signed-off-by: Bjorn Helgaas +Stable-dep-of: 903534fa7d30 ("PCI: Fix resource double counting on remove & rescan") +Signed-off-by: Sasha Levin +--- + drivers/pci/setup-bus.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c +index 87c8190de622f..7f58360b42b7e 100644 +--- a/drivers/pci/setup-bus.c ++++ b/drivers/pci/setup-bus.c +@@ -774,6 +774,8 @@ static struct resource *find_free_bus_resource(struct pci_bus *bus, + static resource_size_t calculate_iosize(resource_size_t size, + resource_size_t min_size, + resource_size_t size1, ++ resource_size_t add_size, ++ resource_size_t children_add_size, + resource_size_t old_size, + resource_size_t align) + { +@@ -786,15 +788,18 @@ static resource_size_t calculate_iosize(resource_size_t size, + #if defined(CONFIG_ISA) || defined(CONFIG_EISA) + size = (size & 0xff) + ((size & ~0xffUL) << 2); + #endif +- size = ALIGN(size + size1, align); ++ size = size + size1; + if (size < old_size) + size = old_size; ++ ++ size = ALIGN(max(size, add_size) + children_add_size, align); + return size; + } + + static resource_size_t calculate_memsize(resource_size_t size, + resource_size_t min_size, +- resource_size_t size1, ++ resource_size_t add_size, ++ resource_size_t children_add_size, + resource_size_t old_size, + resource_size_t align) + { +@@ -804,7 +809,8 @@ static resource_size_t calculate_memsize(resource_size_t size, + old_size = 0; + if (size < old_size) + size = old_size; +- size = ALIGN(size + size1, align); ++ ++ size = ALIGN(max(size, add_size) + children_add_size, align); + return size; + } + +@@ -893,12 +899,10 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size, + } + } + +- size0 = calculate_iosize(size, min_size, size1, ++ size0 = calculate_iosize(size, min_size, size1, 0, 0, + resource_size(b_res), min_align); +- if (children_add_size > add_size) +- add_size = children_add_size; +- size1 = (!realloc_head || (realloc_head && !add_size)) ? size0 : +- calculate_iosize(size, min_size, add_size + size1, ++ size1 = (!realloc_head || (realloc_head && !add_size && !children_add_size)) ? size0 : ++ calculate_iosize(size, min_size, size1, add_size, children_add_size, + resource_size(b_res), min_align); + if (!size0 && !size1) { + if (b_res->start || b_res->end) +@@ -1042,12 +1046,10 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask, + + min_align = calculate_mem_align(aligns, max_order); + min_align = max(min_align, window_alignment(bus, b_res->flags)); +- size0 = calculate_memsize(size, min_size, 0, resource_size(b_res), min_align); ++ size0 = calculate_memsize(size, min_size, 0, 0, resource_size(b_res), min_align); + add_align = max(min_align, add_align); +- if (children_add_size > add_size) +- add_size = children_add_size; +- size1 = (!realloc_head || (realloc_head && !add_size)) ? size0 : +- calculate_memsize(size, min_size, add_size, ++ size1 = (!realloc_head || (realloc_head && !add_size && !children_add_size)) ? size0 : ++ calculate_memsize(size, min_size, add_size, children_add_size, + resource_size(b_res), add_align); + if (!size0 && !size1) { + if (b_res->start || b_res->end) +-- +2.43.0 + diff --git a/queue-4.19/pci-fix-resource-double-counting-on-remove-rescan.patch b/queue-4.19/pci-fix-resource-double-counting-on-remove-rescan.patch new file mode 100644 index 00000000000..86348810609 --- /dev/null +++ b/queue-4.19/pci-fix-resource-double-counting-on-remove-rescan.patch @@ -0,0 +1,73 @@ +From 5285ffbebbefd5c99642ea68a5879821d6045925 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 13:25:16 +0300 +Subject: PCI: Fix resource double counting on remove & rescan +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 903534fa7d30214d8ba840ab1cd9e917e0c88e41 ] + +pbus_size_mem() keeps the size of the optional resources in +children_add_size. When calculating the PCI bridge window size, +calculate_memsize() lower bounds size by old_size before adding +children_add_size and performing the window size alignment. This +results in double counting for the resources in children_add_size +because old_size may be based on the previous size of the bridge +window after it has already included children_add_size (that is, +size1 in pbus_size_mem() from an earlier invocation of that +function). + +As a result, on repeated remove of the bus & rescan cycles the resource +size keeps increasing when children_add_size is non-zero as can be seen +from this extract: + + iomem0: 23fffd00000-23fffdfffff : PCI Bus 0000:03 # 1MiB + iomem1: 20000000000-200001fffff : PCI Bus 0000:03 # 2MiB + iomem2: 20000000000-200002fffff : PCI Bus 0000:03 # 3MiB + iomem3: 20000000000-200003fffff : PCI Bus 0000:03 # 4MiB + iomem4: 20000000000-200004fffff : PCI Bus 0000:03 # 5MiB + +Solve the double counting by moving old_size check later in +calculate_memsize() so that children_add_size is already accounted for. + +After the patch, the bridge window retains its size as expected: + + iomem0: 23fffd00000-23fffdfffff : PCI Bus 0000:03 # 1MiB + iomem1: 20000000000-200000fffff : PCI Bus 0000:03 # 1MiB + iomem2: 20000000000-200000fffff : PCI Bus 0000:03 # 1MiB + +Fixes: a4ac9fea016f ("PCI : Calculate right add_size") +Link: https://lore.kernel.org/r/20240507102523.57320-2-ilpo.jarvinen@linux.intel.com +Tested-by: Lidong Wang +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Reviewed-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pci/setup-bus.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c +index 7f58360b42b7e..7f866c3f036fe 100644 +--- a/drivers/pci/setup-bus.c ++++ b/drivers/pci/setup-bus.c +@@ -807,11 +807,9 @@ static resource_size_t calculate_memsize(resource_size_t size, + size = min_size; + if (old_size == 1) + old_size = 0; +- if (size < old_size) +- size = old_size; + +- size = ALIGN(max(size, add_size) + children_add_size, align); +- return size; ++ size = max(size, add_size) + children_add_size; ++ return ALIGN(max(size, old_size), align); + } + + resource_size_t __weak pcibios_window_alignment(struct pci_bus *bus, +-- +2.43.0 + diff --git a/queue-4.19/perf-fix-perf_aux_size-for-greater-than-32-bit-size.patch b/queue-4.19/perf-fix-perf_aux_size-for-greater-than-32-bit-size.patch new file mode 100644 index 00000000000..559ecf3f4ea --- /dev/null +++ b/queue-4.19/perf-fix-perf_aux_size-for-greater-than-32-bit-size.patch @@ -0,0 +1,37 @@ +From 6ad2c0a15a5ed2f5b3b790fa739c729bd626a93c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 23:10:58 +0300 +Subject: perf: Fix perf_aux_size() for greater-than 32-bit size + +From: Adrian Hunter + +[ Upstream commit 3df94a5b1078dfe2b0c03f027d018800faf44c82 ] + +perf_buffer->aux_nr_pages uses a 32-bit type, so a cast is needed to +calculate a 64-bit size. + +Fixes: 45bfb2e50471 ("perf: Add AUX area to ring buffer for raw data streams") +Signed-off-by: Adrian Hunter +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20240624201101.60186-5-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + kernel/events/internal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/internal.h b/kernel/events/internal.h +index 8fc0ddc38cb69..a99713a883e9d 100644 +--- a/kernel/events/internal.h ++++ b/kernel/events/internal.h +@@ -121,7 +121,7 @@ static inline unsigned long perf_data_size(struct ring_buffer *rb) + + static inline unsigned long perf_aux_size(struct ring_buffer *rb) + { +- return rb->aux_nr_pages << PAGE_SHIFT; ++ return (unsigned long)rb->aux_nr_pages << PAGE_SHIFT; + } + + #define __DEFINE_OUTPUT_COPY_BODY(advance_buf, memcpy_func, ...) \ +-- +2.43.0 + diff --git a/queue-4.19/perf-prevent-passing-zero-nr_pages-to-rb_alloc_aux.patch b/queue-4.19/perf-prevent-passing-zero-nr_pages-to-rb_alloc_aux.patch new file mode 100644 index 00000000000..7503e19ab41 --- /dev/null +++ b/queue-4.19/perf-prevent-passing-zero-nr_pages-to-rb_alloc_aux.patch @@ -0,0 +1,51 @@ +From 9c4a3a6cf8cee3a5e360f1603f06a661553a8b25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 23:10:59 +0300 +Subject: perf: Prevent passing zero nr_pages to rb_alloc_aux() + +From: Adrian Hunter + +[ Upstream commit dbc48c8f41c208082cfa95e973560134489e3309 ] + +nr_pages is unsigned long but gets passed to rb_alloc_aux() as an int, +and is stored as an int. + +Only power-of-2 values are accepted, so if nr_pages is a 64_bit value, it +will be passed to rb_alloc_aux() as zero. + +That is not ideal because: + 1. the value is incorrect + 2. rb_alloc_aux() is at risk of misbehaving, although it manages to + return -ENOMEM in that case, it is a result of passing zero to get_order() + even though the get_order() result is documented to be undefined in that + case. + +Fix by simply validating the maximum supported value in the first place. +Use -ENOMEM error code for consistency with the current error code that +is returned in that case. + +Fixes: 45bfb2e50471 ("perf: Add AUX area to ring buffer for raw data streams") +Signed-off-by: Adrian Hunter +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20240624201101.60186-6-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index c7651c30eaabf..4f1b0fc2e74d2 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -5730,6 +5730,8 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) + return -EINVAL; + + nr_pages = vma_size / PAGE_SIZE; ++ if (nr_pages > INT_MAX) ++ return -ENOMEM; + + mutex_lock(&event->mmap_mutex); + ret = -EINVAL; +-- +2.43.0 + diff --git a/queue-4.19/perf-report-fix-condition-in-sort__sym_cmp.patch b/queue-4.19/perf-report-fix-condition-in-sort__sym_cmp.patch new file mode 100644 index 00000000000..3bb04f40f28 --- /dev/null +++ b/queue-4.19/perf-report-fix-condition-in-sort__sym_cmp.patch @@ -0,0 +1,42 @@ +From 49a2a5ace6142ad85a4ee7f222671c57b03b7d77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 10:05:25 -0700 +Subject: perf report: Fix condition in sort__sym_cmp() + +From: Namhyung Kim + +[ Upstream commit cb39d05e67dc24985ff9f5150e71040fa4d60ab8 ] + +It's expected that both hist entries are in the same hists when +comparing two. But the current code in the function checks one without +dso sort key and other with the key. This would make the condition true +in any case. + +I guess the intention of the original commit was to add '!' for the +right side too. But as it should be the same, let's just remove it. + +Fixes: 69849fc5d2119 ("perf hists: Move sort__has_dso into struct perf_hpp_list") +Reviewed-by: Kan Liang +Signed-off-by: Namhyung Kim +Link: https://lore.kernel.org/r/20240621170528.608772-2-namhyung@kernel.org +Signed-off-by: Sasha Levin +--- + tools/perf/util/sort.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c +index 66e11e6bb7197..a9a10cba8957e 100644 +--- a/tools/perf/util/sort.c ++++ b/tools/perf/util/sort.c +@@ -256,7 +256,7 @@ sort__sym_cmp(struct hist_entry *left, struct hist_entry *right) + * comparing symbol address alone is not enough since it's a + * relative address within a dso. + */ +- if (!hists__has(left->hists, dso) || hists__has(right->hists, dso)) { ++ if (!hists__has(left->hists, dso)) { + ret = sort__dso_cmp(left, right); + if (ret != 0) + return ret; +-- +2.43.0 + diff --git a/queue-4.19/pinctrl-core-fix-possible-memory-leak-when-pinctrl_e.patch b/queue-4.19/pinctrl-core-fix-possible-memory-leak-when-pinctrl_e.patch new file mode 100644 index 00000000000..81574233395 --- /dev/null +++ b/queue-4.19/pinctrl-core-fix-possible-memory-leak-when-pinctrl_e.patch @@ -0,0 +1,59 @@ +From db3fe95e5b18928d912f13421d5b334168bd886d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:37:02 +0800 +Subject: pinctrl: core: fix possible memory leak when pinctrl_enable() fails + +From: Yang Yingliang + +[ Upstream commit ae1cf4759972c5fe665ee4c5e0c29de66fe3cf4a ] + +In devm_pinctrl_register(), if pinctrl_enable() fails in pinctrl_register(), +the "pctldev" has not been added to dev resources, so devm_pinctrl_dev_release() +can not be called, it leads memory leak. + +Introduce pinctrl_uninit_controller(), call it in the error path to free memory. + +Fixes: 5038a66dad01 ("pinctrl: core: delete incorrect free in pinctrl_enable()") +Signed-off-by: Yang Yingliang +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20240606023704.3931561-2-yangyingliang@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/core.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index 97b1fa3a5e78d..8c52bfac1cc24 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -1992,6 +1992,14 @@ pinctrl_init_controller(struct pinctrl_desc *pctldesc, struct device *dev, + return ERR_PTR(ret); + } + ++static void pinctrl_uninit_controller(struct pinctrl_dev *pctldev, struct pinctrl_desc *pctldesc) ++{ ++ pinctrl_free_pindescs(pctldev, pctldesc->pins, ++ pctldesc->npins); ++ mutex_destroy(&pctldev->mutex); ++ kfree(pctldev); ++} ++ + static int pinctrl_claim_hogs(struct pinctrl_dev *pctldev) + { + pctldev->p = create_pinctrl(pctldev->dev, pctldev); +@@ -2072,8 +2080,10 @@ struct pinctrl_dev *pinctrl_register(struct pinctrl_desc *pctldesc, + return pctldev; + + error = pinctrl_enable(pctldev); +- if (error) ++ if (error) { ++ pinctrl_uninit_controller(pctldev, pctldesc); + return ERR_PTR(error); ++ } + + return pctldev; + +-- +2.43.0 + diff --git a/queue-4.19/pinctrl-freescale-mxs-fix-refcount-of-child.patch b/queue-4.19/pinctrl-freescale-mxs-fix-refcount-of-child.patch new file mode 100644 index 00000000000..017bfa32468 --- /dev/null +++ b/queue-4.19/pinctrl-freescale-mxs-fix-refcount-of-child.patch @@ -0,0 +1,43 @@ +From 5052ea4b00408c13fe129108ec66f69ebae5f83f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 21:20:16 +0800 +Subject: pinctrl: freescale: mxs: Fix refcount of child + +From: Peng Fan + +[ Upstream commit 7f500f2011c0bbb6e1cacab74b4c99222e60248e ] + +of_get_next_child() will increase refcount of the returned node, need +use of_node_put() on it when done. + +Per current implementation, 'child' will be override by +for_each_child_of_node(np, child), so use of_get_child_count to avoid +refcount leakage. + +Fixes: 17723111e64f ("pinctrl: add pinctrl-mxs support") +Signed-off-by: Peng Fan +Link: https://lore.kernel.org/20240504-pinctrl-cleanup-v2-18-26c5f2dc1181@nxp.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/freescale/pinctrl-mxs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/freescale/pinctrl-mxs.c b/drivers/pinctrl/freescale/pinctrl-mxs.c +index a612e46ca51c0..c48b6fb5e8fe7 100644 +--- a/drivers/pinctrl/freescale/pinctrl-mxs.c ++++ b/drivers/pinctrl/freescale/pinctrl-mxs.c +@@ -405,8 +405,8 @@ static int mxs_pinctrl_probe_dt(struct platform_device *pdev, + int ret; + u32 val; + +- child = of_get_next_child(np, NULL); +- if (!child) { ++ val = of_get_child_count(np); ++ if (val == 0) { + dev_err(&pdev->dev, "no group is defined\n"); + return -ENOENT; + } +-- +2.43.0 + diff --git a/queue-4.19/pinctrl-single-fix-possible-memory-leak-when-pinctrl.patch b/queue-4.19/pinctrl-single-fix-possible-memory-leak-when-pinctrl.patch new file mode 100644 index 00000000000..055fcb02b43 --- /dev/null +++ b/queue-4.19/pinctrl-single-fix-possible-memory-leak-when-pinctrl.patch @@ -0,0 +1,60 @@ +From 154733f1cc369d708b68f4e4ccf7ce440b7a820a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:37:03 +0800 +Subject: pinctrl: single: fix possible memory leak when pinctrl_enable() fails + +From: Yang Yingliang + +[ Upstream commit 8f773bfbdd428819328a2d185976cfc6ae811cd3 ] + +This driver calls pinctrl_register_and_init() which is not +devm_ managed, it will leads memory leak if pinctrl_enable() +fails. Replace it with devm_pinctrl_register_and_init(). +And call pcs_free_resources() if pinctrl_enable() fails. + +Fixes: 5038a66dad01 ("pinctrl: core: delete incorrect free in pinctrl_enable()") +Signed-off-by: Yang Yingliang +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20240606023704.3931561-3-yangyingliang@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-single.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c +index 4143cafbf7e73..3699843e9a6e8 100644 +--- a/drivers/pinctrl/pinctrl-single.c ++++ b/drivers/pinctrl/pinctrl-single.c +@@ -1311,7 +1311,6 @@ static void pcs_irq_free(struct pcs_device *pcs) + static void pcs_free_resources(struct pcs_device *pcs) + { + pcs_irq_free(pcs); +- pinctrl_unregister(pcs->pctl); + + #if IS_BUILTIN(CONFIG_PINCTRL_SINGLE) + if (pcs->missing_nr_pinctrl_cells) +@@ -1864,7 +1863,7 @@ static int pcs_probe(struct platform_device *pdev) + if (ret < 0) + goto free; + +- ret = pinctrl_register_and_init(&pcs->desc, pcs->dev, pcs, &pcs->pctl); ++ ret = devm_pinctrl_register_and_init(pcs->dev, &pcs->desc, pcs, &pcs->pctl); + if (ret) { + dev_err(pcs->dev, "could not register single pinctrl driver\n"); + goto free; +@@ -1897,8 +1896,10 @@ static int pcs_probe(struct platform_device *pdev) + + dev_info(pcs->dev, "%i pins, size %u\n", pcs->desc.npins, pcs->size); + +- return pinctrl_enable(pcs->pctl); ++ if (pinctrl_enable(pcs->pctl)) ++ goto free; + ++ return 0; + free: + pcs_free_resources(pcs); + +-- +2.43.0 + diff --git a/queue-4.19/pinctrl-ti-ti-iodelay-drop-if-block-with-always-fals.patch b/queue-4.19/pinctrl-ti-ti-iodelay-drop-if-block-with-always-fals.patch new file mode 100644 index 00000000000..38b4006b62e --- /dev/null +++ b/queue-4.19/pinctrl-ti-ti-iodelay-drop-if-block-with-always-fals.patch @@ -0,0 +1,44 @@ +From 92d5296685e0361a8b91514a65272ece625b96f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Oct 2023 10:38:39 +0200 +Subject: pinctrl: ti: ti-iodelay: Drop if block with always false condition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 88b3f108502bc45e6ebd005702add46759f3f45a ] + +ti_iodelay_remove() is only called after ti_iodelay_probe() completed +successfully. In this case platform_set_drvdata() was called with a +non-NULL argument and so platform_get_drvdata() won't return NULL. + +Simplify by removing the if block with the always false condition. + +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20231009083856.222030-4-u.kleine-koenig@pengutronix.de +Signed-off-by: Linus Walleij +Stable-dep-of: 9b401f4a7170 ("pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails") +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c +index 4eda888b4d048..1c4196f40e8d6 100644 +--- a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c ++++ b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c +@@ -906,9 +906,6 @@ static int ti_iodelay_remove(struct platform_device *pdev) + { + struct ti_iodelay_device *iod = platform_get_drvdata(pdev); + +- if (!iod) +- return 0; +- + if (iod->pctl) + pinctrl_unregister(iod->pctl); + +-- +2.43.0 + diff --git a/queue-4.19/pinctrl-ti-ti-iodelay-fix-possible-memory-leak-when-.patch b/queue-4.19/pinctrl-ti-ti-iodelay-fix-possible-memory-leak-when-.patch new file mode 100644 index 00000000000..1e98093639e --- /dev/null +++ b/queue-4.19/pinctrl-ti-ti-iodelay-fix-possible-memory-leak-when-.patch @@ -0,0 +1,64 @@ +From 1f27781d8dd279319854e0384f3468b707750a11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:37:04 +0800 +Subject: pinctrl: ti: ti-iodelay: fix possible memory leak when + pinctrl_enable() fails + +From: Yang Yingliang + +[ Upstream commit 9b401f4a7170125365160c9af267a41ff6b39001 ] + +This driver calls pinctrl_register_and_init() which is not +devm_ managed, it will leads memory leak if pinctrl_enable() +fails. Replace it with devm_pinctrl_register_and_init(). +And add missing of_node_put() in the error path. + +Fixes: 5038a66dad01 ("pinctrl: core: delete incorrect free in pinctrl_enable()") +Signed-off-by: Yang Yingliang +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20240606023704.3931561-4-yangyingliang@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c +index 1c4196f40e8d6..e86b765141a63 100644 +--- a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c ++++ b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c +@@ -881,7 +881,7 @@ static int ti_iodelay_probe(struct platform_device *pdev) + iod->desc.name = dev_name(dev); + iod->desc.owner = THIS_MODULE; + +- ret = pinctrl_register_and_init(&iod->desc, dev, iod, &iod->pctl); ++ ret = devm_pinctrl_register_and_init(dev, &iod->desc, iod, &iod->pctl); + if (ret) { + dev_err(dev, "Failed to register pinctrl\n"); + goto exit_out; +@@ -889,7 +889,11 @@ static int ti_iodelay_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, iod); + +- return pinctrl_enable(iod->pctl); ++ ret = pinctrl_enable(iod->pctl); ++ if (ret) ++ goto exit_out; ++ ++ return 0; + + exit_out: + of_node_put(np); +@@ -906,9 +910,6 @@ static int ti_iodelay_remove(struct platform_device *pdev) + { + struct ti_iodelay_device *iod = platform_get_drvdata(pdev); + +- if (iod->pctl) +- pinctrl_unregister(iod->pctl); +- + ti_iodelay_pinconf_deinit_dev(iod); + + /* Expect other allocations to be freed by devm */ +-- +2.43.0 + diff --git a/queue-4.19/platform-chrome-cros_ec_debugfs-fix-wrong-ec-message.patch b/queue-4.19/platform-chrome-cros_ec_debugfs-fix-wrong-ec-message.patch new file mode 100644 index 00000000000..1da18c85f67 --- /dev/null +++ b/queue-4.19/platform-chrome-cros_ec_debugfs-fix-wrong-ec-message.patch @@ -0,0 +1,38 @@ +From 87257a4609a10e55c6b6013124dde02aba297dfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 11:31:10 +0000 +Subject: platform/chrome: cros_ec_debugfs: fix wrong EC message version + +From: Tzung-Bi Shih + +[ Upstream commit c2a28647bbb4e0894e8824362410f72b06ac57a4 ] + +ec_read_version_supported() uses ec_params_get_cmd_versions_v1 but it +wrongly uses message version 0. + +Fix it. + +Fixes: e86264595225 ("mfd: cros_ec: add debugfs, console log file") +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20240611113110.16955-1-tzungbi@kernel.org +Signed-off-by: Tzung-Bi Shih +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_ec_debugfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/chrome/cros_ec_debugfs.c b/drivers/platform/chrome/cros_ec_debugfs.c +index c62ee8e610a0f..5aed088371a72 100644 +--- a/drivers/platform/chrome/cros_ec_debugfs.c ++++ b/drivers/platform/chrome/cros_ec_debugfs.c +@@ -292,6 +292,7 @@ static int ec_read_version_supported(struct cros_ec_dev *ec) + if (!msg) + return 0; + ++ msg->version = 1; + msg->command = EC_CMD_GET_CMD_VERSIONS + ec->cmd_offset; + msg->outsize = sizeof(*params); + msg->insize = sizeof(*response); +-- +2.43.0 + diff --git a/queue-4.19/powerpc-xmon-fix-disassembly-cpu-feature-checks.patch b/queue-4.19/powerpc-xmon-fix-disassembly-cpu-feature-checks.patch new file mode 100644 index 00000000000..8166861bb32 --- /dev/null +++ b/queue-4.19/powerpc-xmon-fix-disassembly-cpu-feature-checks.patch @@ -0,0 +1,99 @@ +From f89f1a9787dc930f36705d45579b15a830767425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 22:12:47 +1000 +Subject: powerpc/xmon: Fix disassembly CPU feature checks + +From: Michael Ellerman + +[ Upstream commit 14196e47c5ffe32af7ed5a51c9e421c5ea5bccce ] + +In the xmon disassembly code there are several CPU feature checks to +determine what dialects should be passed to the disassembler. The +dialect controls which instructions the disassembler will recognise. + +Unfortunately the checks are incorrect, because instead of passing a +single CPU feature they are passing a mask of feature bits. + +For example the code: + + if (cpu_has_feature(CPU_FTRS_POWER5)) + dialect |= PPC_OPCODE_POWER5; + +Is trying to check if the system is running on a Power5 CPU. But +CPU_FTRS_POWER5 is a mask of *all* the feature bits that are enabled on +a Power5. + +In practice the test will always return true for any 64-bit CPU, because +at least one bit in the mask will be present in the CPU_FTRS_ALWAYS +mask. + +Similarly for all the other checks against CPU_FTRS_xx masks. + +Rather than trying to match the disassembly behaviour exactly to the +current CPU, just differentiate between 32-bit and 64-bit, and Altivec, +VSX and HTM. + +That will cause some instructions to be shown in disassembly even +on a CPU that doesn't support them, but that's OK, objdump -d output +has the same behaviour, and if anything it's less confusing than some +instructions not being disassembled. + +Fixes: 897f112bb42e ("[POWERPC] Import updated version of ppc disassembly code for xmon") +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240509121248.270878-2-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/xmon/ppc-dis.c | 33 +++++++++++---------------------- + 1 file changed, 11 insertions(+), 22 deletions(-) + +diff --git a/arch/powerpc/xmon/ppc-dis.c b/arch/powerpc/xmon/ppc-dis.c +index 27f1e64150360..8f84e6502776b 100644 +--- a/arch/powerpc/xmon/ppc-dis.c ++++ b/arch/powerpc/xmon/ppc-dis.c +@@ -133,32 +133,21 @@ int print_insn_powerpc (unsigned long insn, unsigned long memaddr) + bool insn_is_short; + ppc_cpu_t dialect; + +- dialect = PPC_OPCODE_PPC | PPC_OPCODE_COMMON +- | PPC_OPCODE_64 | PPC_OPCODE_POWER4 | PPC_OPCODE_ALTIVEC; ++ dialect = PPC_OPCODE_PPC | PPC_OPCODE_COMMON; + +- if (cpu_has_feature(CPU_FTRS_POWER5)) +- dialect |= PPC_OPCODE_POWER5; ++ if (IS_ENABLED(CONFIG_PPC64)) ++ dialect |= PPC_OPCODE_64 | PPC_OPCODE_POWER4 | PPC_OPCODE_CELL | ++ PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 | PPC_OPCODE_POWER8 | ++ PPC_OPCODE_POWER9; + +- if (cpu_has_feature(CPU_FTRS_CELL)) +- dialect |= (PPC_OPCODE_CELL | PPC_OPCODE_ALTIVEC); ++ if (cpu_has_feature(CPU_FTR_TM)) ++ dialect |= PPC_OPCODE_HTM; + +- if (cpu_has_feature(CPU_FTRS_POWER6)) +- dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_ALTIVEC); ++ if (cpu_has_feature(CPU_FTR_ALTIVEC)) ++ dialect |= PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2; + +- if (cpu_has_feature(CPU_FTRS_POWER7)) +- dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 +- | PPC_OPCODE_ALTIVEC | PPC_OPCODE_VSX); +- +- if (cpu_has_feature(CPU_FTRS_POWER8)) +- dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 +- | PPC_OPCODE_POWER8 | PPC_OPCODE_HTM +- | PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2 | PPC_OPCODE_VSX); +- +- if (cpu_has_feature(CPU_FTRS_POWER9)) +- dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 +- | PPC_OPCODE_POWER8 | PPC_OPCODE_POWER9 | PPC_OPCODE_HTM +- | PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2 +- | PPC_OPCODE_VSX | PPC_OPCODE_VSX3); ++ if (cpu_has_feature(CPU_FTR_VSX)) ++ dialect |= PPC_OPCODE_VSX | PPC_OPCODE_VSX3; + + /* Get the major opcode of the insn. */ + opcode = NULL; +-- +2.43.0 + diff --git a/queue-4.19/pwm-stm32-always-do-lazy-disabling.patch b/queue-4.19/pwm-stm32-always-do-lazy-disabling.patch new file mode 100644 index 00000000000..3e84742b9ae --- /dev/null +++ b/queue-4.19/pwm-stm32-always-do-lazy-disabling.patch @@ -0,0 +1,56 @@ +From abb76eab69d7a6f510e2a950bb19e5150e0c8dec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 13:00:06 +0200 +Subject: pwm: stm32: Always do lazy disabling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 7346e7a058a2c9aa9ff1cc699c7bf18a402d9f84 ] + +When the state changes from enabled to disabled, polarity, duty_cycle +and period are not configured in hardware and TIM_CCER_CCxE is just +cleared. However if the state changes from one disabled state to +another, all parameters are written to hardware because the early exit +from stm32_pwm_apply() is only taken if the pwm is currently enabled. + +This yields surprises like: Applying + + { .period = 1, .duty_cycle = 0, .enabled = false } + +succeeds if the pwm is initially on, but fails if it's already off +because 1 is a too small period. + +Update the check for lazy disable to always exit early if the target +state is disabled, no matter what is currently configured. + +Fixes: 7edf7369205b ("pwm: Add driver for STM32 plaftorm") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20240703110010.672654-2-u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-stm32.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c +index ee7197b8e4ef7..5325e804ca24f 100644 +--- a/drivers/pwm/pwm-stm32.c ++++ b/drivers/pwm/pwm-stm32.c +@@ -451,8 +451,9 @@ static int stm32_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + + enabled = pwm->state.enabled; + +- if (enabled && !state->enabled) { +- stm32_pwm_disable(priv, pwm->hwpwm); ++ if (!state->enabled) { ++ if (enabled) ++ stm32_pwm_disable(priv, pwm->hwpwm); + return 0; + } + +-- +2.43.0 + diff --git a/queue-4.19/rdma-mlx4-fix-truncated-output-warning-in-alias_guid.patch b/queue-4.19/rdma-mlx4-fix-truncated-output-warning-in-alias_guid.patch new file mode 100644 index 00000000000..e5e11275710 --- /dev/null +++ b/queue-4.19/rdma-mlx4-fix-truncated-output-warning-in-alias_guid.patch @@ -0,0 +1,52 @@ +From 98b6a6c1c804bac5316ecfdc444e72e0d931f4cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jun 2024 19:17:30 +0300 +Subject: RDMA/mlx4: Fix truncated output warning in alias_GUID.c +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leon Romanovsky + +[ Upstream commit 5953e0647cec703ef436ead37fed48943507b433 ] + +drivers/infiniband/hw/mlx4/alias_GUID.c: In function ‘mlx4_ib_init_alias_guid_service’: +drivers/infiniband/hw/mlx4/alias_GUID.c:878:74: error: ‘%d’ directive +output may be truncated writing between 1 and 11 bytes into a region of +size 5 [-Werror=format-truncation=] + 878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i); + | ^~ +drivers/infiniband/hw/mlx4/alias_GUID.c:878:63: note: directive argument in the range [-2147483641, 2147483646] + 878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i); + | ^~~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/alias_GUID.c:878:17: note: ‘snprintf’ output +between 12 and 22 bytes into a destination of size 15 + 878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors + +Fixes: a0c64a17aba8 ("mlx4: Add alias_guid mechanism") +Link: https://lore.kernel.org/r/1951c9500109ca7e36dcd523f8a5f2d0d2a608d1.1718554641.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/alias_GUID.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx4/alias_GUID.c b/drivers/infiniband/hw/mlx4/alias_GUID.c +index baab9afa9174b..f2d975c2659d8 100644 +--- a/drivers/infiniband/hw/mlx4/alias_GUID.c ++++ b/drivers/infiniband/hw/mlx4/alias_GUID.c +@@ -832,7 +832,7 @@ void mlx4_ib_destroy_alias_guid_service(struct mlx4_ib_dev *dev) + + int mlx4_ib_init_alias_guid_service(struct mlx4_ib_dev *dev) + { +- char alias_wq_name[15]; ++ char alias_wq_name[22]; + int ret = 0; + int i, j; + union ib_gid gid; +-- +2.43.0 + diff --git a/queue-4.19/rdma-mlx4-fix-truncated-output-warning-in-mad.c.patch b/queue-4.19/rdma-mlx4-fix-truncated-output-warning-in-mad.c.patch new file mode 100644 index 00000000000..78dd07e14fa --- /dev/null +++ b/queue-4.19/rdma-mlx4-fix-truncated-output-warning-in-mad.c.patch @@ -0,0 +1,82 @@ +From b964a1011916e82fda0e334e251cf04b283a959b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jun 2024 19:16:33 +0300 +Subject: RDMA/mlx4: Fix truncated output warning in mad.c +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leon Romanovsky + +[ Upstream commit 0d2e6992fc956e3308cd5376c18567def4cb3967 ] + +Increase size of the name array to avoid truncated output warning. + +drivers/infiniband/hw/mlx4/mad.c: In function ‘mlx4_ib_alloc_demux_ctx’: +drivers/infiniband/hw/mlx4/mad.c:2197:47: error: ‘%d’ directive output +may be truncated writing between 1 and 11 bytes into a region of size 4 +[-Werror=format-truncation=] + 2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port); + | ^~ +drivers/infiniband/hw/mlx4/mad.c:2197:38: note: directive argument in +the range [-2147483645, 2147483647] + 2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port); + | ^~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2197:9: note: ‘snprintf’ output between +10 and 20 bytes into a destination of size 12 + 2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2205:48: error: ‘%d’ directive output +may be truncated writing between 1 and 11 bytes into a region of size 3 +[-Werror=format-truncation=] + 2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port); + | ^~ +drivers/infiniband/hw/mlx4/mad.c:2205:38: note: directive argument in +the range [-2147483645, 2147483647] + 2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port); + | ^~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2205:9: note: ‘snprintf’ output between +11 and 21 bytes into a destination of size 12 + 2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2213:48: error: ‘%d’ directive output +may be truncated writing between 1 and 11 bytes into a region of size 3 +[-Werror=format-truncation=] + 2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port); + | ^~ +drivers/infiniband/hw/mlx4/mad.c:2213:38: note: directive argument in +the range [-2147483645, 2147483647] + 2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port); + | ^~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2213:9: note: ‘snprintf’ output between +11 and 21 bytes into a destination of size 12 + 2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors +make[6]: *** [scripts/Makefile.build:244: drivers/infiniband/hw/mlx4/mad.o] Error 1 + +Fixes: fc06573dfaf8 ("IB/mlx4: Initialize SR-IOV IB support for slaves in master context") +Link: https://lore.kernel.org/r/f3798b3ce9a410257d7e1ec7c9e285f1352e256a.1718554569.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/mad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c +index 418b9312fb2d7..a034cb3fa7cad 100644 +--- a/drivers/infiniband/hw/mlx4/mad.c ++++ b/drivers/infiniband/hw/mlx4/mad.c +@@ -2158,7 +2158,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, + struct mlx4_ib_demux_ctx *ctx, + int port) + { +- char name[12]; ++ char name[21]; + int ret = 0; + int i; + +-- +2.43.0 + diff --git a/queue-4.19/rdma-rxe-don-t-set-bth_ack_mask-for-uc-or-ud-qps.patch b/queue-4.19/rdma-rxe-don-t-set-bth_ack_mask-for-uc-or-ud-qps.patch new file mode 100644 index 00000000000..74e0132854f --- /dev/null +++ b/queue-4.19/rdma-rxe-don-t-set-bth_ack_mask-for-uc-or-ud-qps.patch @@ -0,0 +1,53 @@ +From a1481acbd1ecce23243e5369bc063346cbad9588 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 10:03:48 +0800 +Subject: RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs + +From: Honggang LI + +[ Upstream commit 4adcaf969d77d3d3aa3871bbadc196258a38aec6 ] + +BTH_ACK_MASK bit is used to indicate that an acknowledge +(for this packet) should be scheduled by the responder. +Both UC and UD QPs are unacknowledged, so don't set +BTH_ACK_MASK for UC or UD QPs. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Signed-off-by: Honggang LI +Link: https://lore.kernel.org/r/20240624020348.494338-1-honggangli@163.com +Reviewed-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_req.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index 4008ab2da0526..aa57a9cb53886 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -390,7 +390,7 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp, + int solicited; + u16 pkey; + u32 qp_num; +- int ack_req; ++ int ack_req = 0; + + /* length from start of bth to end of icrc */ + paylen = rxe_opcode[opcode].length + payload + pad + RXE_ICRC_SIZE; +@@ -426,8 +426,9 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp, + qp_num = (pkt->mask & RXE_DETH_MASK) ? ibwr->wr.ud.remote_qpn : + qp->attr.dest_qp_num; + +- ack_req = ((pkt->mask & RXE_END_MASK) || +- (qp->req.noack_pkts++ > RXE_MAX_PKT_PER_ACK)); ++ if (qp_type(qp) != IB_QPT_UD && qp_type(qp) != IB_QPT_UC) ++ ack_req = ((pkt->mask & RXE_END_MASK) || ++ (qp->req.noack_pkts++ > RXE_MAX_PKT_PER_ACK)); + if (ack_req) + qp->req.noack_pkts = 0; + +-- +2.43.0 + diff --git a/queue-4.19/saa7134-unchecked-i2c_transfer-function-result-fixed.patch b/queue-4.19/saa7134-unchecked-i2c_transfer-function-result-fixed.patch new file mode 100644 index 00000000000..656fdf0cb8d --- /dev/null +++ b/queue-4.19/saa7134-unchecked-i2c_transfer-function-result-fixed.patch @@ -0,0 +1,51 @@ +From 90c75aba94ff5cf08c210b9c01965999b4269f14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 15:40:06 +0300 +Subject: saa7134: Unchecked i2c_transfer function result fixed + +From: Aleksandr Burakov + +[ Upstream commit 9d8683b3fd93f0e378f24dc3d9604e5d7d3e0a17 ] + +Return value of function 'i2c_transfer' is not checked that +may cause undefined behaviour. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 2cf36ac44730 ("[PATCH] v4l: 656: added support for the following cards") +Signed-off-by: Aleksandr Burakov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-dvb.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/pci/saa7134/saa7134-dvb.c b/drivers/media/pci/saa7134/saa7134-dvb.c +index 3025d38ddb2b5..d710c00b4dc91 100644 +--- a/drivers/media/pci/saa7134/saa7134-dvb.c ++++ b/drivers/media/pci/saa7134/saa7134-dvb.c +@@ -475,7 +475,9 @@ static int philips_europa_tuner_sleep(struct dvb_frontend *fe) + /* switch the board to analog mode */ + if (fe->ops.i2c_gate_ctrl) + fe->ops.i2c_gate_ctrl(fe, 1); +- i2c_transfer(&dev->i2c_adap, &analog_msg, 1); ++ if (i2c_transfer(&dev->i2c_adap, &analog_msg, 1) != 1) ++ return -EIO; ++ + return 0; + } + +@@ -1027,7 +1029,9 @@ static int md8800_set_voltage2(struct dvb_frontend *fe, + else + wbuf[1] = rbuf & 0xef; + msg[0].len = 2; +- i2c_transfer(&dev->i2c_adap, msg, 1); ++ if (i2c_transfer(&dev->i2c_adap, msg, 1) != 1) ++ return -EIO; ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-4.19/selftests-bpf-check-length-of-recv-in-test_sockmap.patch b/queue-4.19/selftests-bpf-check-length-of-recv-in-test_sockmap.patch new file mode 100644 index 00000000000..82c39ea3d9b --- /dev/null +++ b/queue-4.19/selftests-bpf-check-length-of-recv-in-test_sockmap.patch @@ -0,0 +1,40 @@ +From 4fa459700a4940151cfc2cb67f2e2c139d3ffffb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 14:50:03 +0800 +Subject: selftests/bpf: Check length of recv in test_sockmap + +From: Geliang Tang + +[ Upstream commit de1b5ea789dc28066cc8dc634b6825bd6148f38b ] + +The value of recv in msg_loop may be negative, like EWOULDBLOCK, so it's +necessary to check if it is positive before accumulating it to bytes_recvd. + +Fixes: 16962b2404ac ("bpf: sockmap, add selftests") +Signed-off-by: Geliang Tang +Signed-off-by: Daniel Borkmann +Tested-by: Jakub Sitnicki +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/5172563f7c7b2a2e953cef02e89fc34664a7b190.1716446893.git.tanggeliang@kylinos.cn +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_sockmap.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c +index a7fc91bb9119c..b9deed81656ba 100644 +--- a/tools/testing/selftests/bpf/test_sockmap.c ++++ b/tools/testing/selftests/bpf/test_sockmap.c +@@ -395,7 +395,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, + } + } + +- s->bytes_recvd += recv; ++ if (recv > 0) ++ s->bytes_recvd += recv; + + if (data_test) { + int j; +-- +2.43.0 + diff --git a/queue-4.19/selftests-forwarding-devlink_lib-wait-for-udev-event.patch b/queue-4.19/selftests-forwarding-devlink_lib-wait-for-udev-event.patch new file mode 100644 index 00000000000..b8ae73dd73d --- /dev/null +++ b/queue-4.19/selftests-forwarding-devlink_lib-wait-for-udev-event.patch @@ -0,0 +1,75 @@ +From dfd86ec011038fdbb438126d23e773b1e58ef06a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 17:27:02 +0200 +Subject: selftests: forwarding: devlink_lib: Wait for udev events after + reloading + +From: Amit Cohen + +[ Upstream commit f67a90a0c8f5b3d0acc18f10650d90fec44775f9 ] + +Lately, an additional locking was added by commit c0a40097f0bc +("drivers: core: synchronize really_probe() and dev_uevent()"). The +locking protects dev_uevent() calling. This function is used to send +messages from the kernel to user space. Uevent messages notify user space +about changes in device states, such as when a device is added, removed, +or changed. These messages are used by udev (or other similar user-space +tools) to apply device-specific rules. + +After reloading devlink instance, udev events should be processed. This +locking causes a short delay of udev events handling. + +One example for useful udev rule is renaming ports. 'forwading.config' +can be configured to use names after udev rules are applied. Some tests run +devlink_reload() and immediately use the updated names. This worked before +the above mentioned commit was pushed, but now the delay of uevent messages +causes that devlink_reload() returns before udev events are handled and +tests fail. + +Adjust devlink_reload() to not assume that udev events are already +processed when devlink reload is done, instead, wait for udev events to +ensure they are processed before returning from the function. + +Without this patch: +TESTS='rif_mac_profile' ./resource_scale.sh +TEST: 'rif_mac_profile' 4 [ OK ] +sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory +sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory +sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory +sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory +Cannot find device "swp1" +Cannot find device "swp2" +TEST: setup_wait_dev (: Interface swp1 does not come up.) [FAIL] + +With this patch: +$ TESTS='rif_mac_profile' ./resource_scale.sh +TEST: 'rif_mac_profile' 4 [ OK ] +TEST: 'rif_mac_profile' overflow 5 [ OK ] + +This is relevant not only for this test. + +Fixes: bc7cbb1e9f4c ("selftests: forwarding: Add devlink_lib.sh") +Signed-off-by: Amit Cohen +Reviewed-by: Ido Schimmel +Signed-off-by: Petr Machata +Link: https://patch.msgid.link/89367666e04b38a8993027f1526801ca327ab96a.1720709333.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/devlink_lib.sh | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/net/forwarding/devlink_lib.sh b/tools/testing/selftests/net/forwarding/devlink_lib.sh +index 5ab1e5f430221..ea708b6c1e002 100644 +--- a/tools/testing/selftests/net/forwarding/devlink_lib.sh ++++ b/tools/testing/selftests/net/forwarding/devlink_lib.sh +@@ -105,4 +105,6 @@ devlink_reload() + still_pending=$(devlink resource show "$DEVLINK_DEV" | \ + grep -c "size_new") + check_err $still_pending "Failed reload - There are still unset sizes" ++ ++ udevadm settle + } +-- +2.43.0 + diff --git a/queue-4.19/series b/queue-4.19/series new file mode 100644 index 00000000000..dfe51f19b90 --- /dev/null +++ b/queue-4.19/series @@ -0,0 +1,61 @@ +platform-chrome-cros_ec_debugfs-fix-wrong-ec-message.patch +hfsplus-fix-to-avoid-false-alarm-of-circular-locking.patch +x86-of-return-consistent-error-type-from-x86_of_pci_.patch +x86-pci-intel_mid_pci-fix-pcibios_-return-code-handl.patch +x86-pci-xen-fix-pcibios_-return-code-handling.patch +x86-platform-iosf_mbi-convert-pcibios_-return-codes-.patch +hwmon-adt7475-fix-default-duty-on-fan-is-disabled.patch +pwm-stm32-always-do-lazy-disabling.patch +hwmon-max6697-fix-underflow-when-writing-limit-attri.patch +hwmon-introduce-sensor_device_attr_-ro-rw-wo-and-var.patch +hwmon-max6697-auto-convert-to-use-sensor_device_attr.patch +hwmon-max6697-fix-swapped-temp-1-8-critical-alarms.patch +arm64-dts-rockchip-increase-vop-clk-rate-on-rk3328.patch +m68k-atari-fix-tt-bootup-freeze-unexpected-scu-inter.patch +x86-xen-convert-comma-to-semicolon.patch +m68k-cmpxchg-fix-return-value-for-default-case-in-__.patch +wifi-brcmsmac-lcn-phy-code-is-used-for-bcm4313-2g-on.patch +net-smc-allow-smc-d-1mb-dmb-allocations.patch +net-smc-set-rmb-s-sg_max_single_alloc-limitation-onl.patch +selftests-bpf-check-length-of-recv-in-test_sockmap.patch +wifi-cfg80211-fix-typo-in-cfg80211_calculate_bitrate.patch +wifi-cfg80211-handle-2x996-ru-allocation-in-cfg80211.patch +net-fec-refactor-define-magic-constants.patch +net-fec-fix-fec_ecr_en1588-being-cleared-on-link-dow.patch +ipvs-avoid-unnecessary-calls-to-skb_is_gso_sctp.patch +perf-fix-perf_aux_size-for-greater-than-32-bit-size.patch +perf-prevent-passing-zero-nr_pages-to-rb_alloc_aux.patch +bna-adjust-name-buf-size-of-bna_tcb-and-bna_ccb-stru.patch +selftests-forwarding-devlink_lib-wait-for-udev-event.patch +media-imon-fix-race-getting-ictx-lock.patch +saa7134-unchecked-i2c_transfer-function-result-fixed.patch +media-uvcvideo-allow-entity-defined-get_info-and-get.patch +media-uvcvideo-override-default-flags.patch +media-renesas-vsp1-fix-_irqsave-and-_irq-mix.patch +media-renesas-vsp1-store-rpf-partition-configuration.patch +leds-trigger-unregister-sysfs-attributes-before-call.patch +perf-report-fix-condition-in-sort__sym_cmp.patch +drm-etnaviv-fix-dma-direction-handling-for-cached-rw.patch +mfd-omap-usb-tll-use-struct_size-to-allocate-tll.patch +ext4-avoid-writing-unitialized-memory-to-disk-in-ea-.patch +sparc64-fix-incorrect-function-signature-and-add-pro.patch +pci-equalize-hotplug-memory-and-io-for-occupied-and-.patch +pci-fix-resource-double-counting-on-remove-rescan.patch +rdma-mlx4-fix-truncated-output-warning-in-mad.c.patch +rdma-mlx4-fix-truncated-output-warning-in-alias_guid.patch +rdma-rxe-don-t-set-bth_ack_mask-for-uc-or-ud-qps.patch +mtd-make-mtd_test.c-a-separate-module.patch +input-elan_i2c-do-not-leave-interrupt-disabled-on-su.patch +mips-octeron-remove-source-file-executable-bit.patch +powerpc-xmon-fix-disassembly-cpu-feature-checks.patch +macintosh-therm_windtunnel-fix-module-unload.patch +bnxt_re-fix-imm_data-endianness.patch +ice-rework-flex-descriptor-programming.patch +netfilter-ctnetlink-use-helper-function-to-calculate.patch +pinctrl-core-fix-possible-memory-leak-when-pinctrl_e.patch +pinctrl-single-fix-possible-memory-leak-when-pinctrl.patch +pinctrl-ti-ti-iodelay-drop-if-block-with-always-fals.patch +pinctrl-ti-ti-iodelay-fix-possible-memory-leak-when-.patch +pinctrl-freescale-mxs-fix-refcount-of-child.patch +fs-nilfs2-remove-some-unused-macros-to-tame-gcc.patch +nilfs2-avoid-undefined-behavior-in-nilfs_cnt32_ge-ma.patch diff --git a/queue-4.19/sparc64-fix-incorrect-function-signature-and-add-pro.patch b/queue-4.19/sparc64-fix-incorrect-function-signature-and-add-pro.patch new file mode 100644 index 00000000000..2d076568c92 --- /dev/null +++ b/queue-4.19/sparc64-fix-incorrect-function-signature-and-add-pro.patch @@ -0,0 +1,75 @@ +From a681f58e070aa252ea7d2a900bf5878977ce8864 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 11:41:53 +0200 +Subject: sparc64: Fix incorrect function signature and add prototype for + prom_cif_init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andreas Larsson + +[ Upstream commit a6c3ea1ec96307dbfbb2f16d96c674c5cc80f445 ] + +Remove the unused cif_stack argument and add a protype in oplib_64.h +Commit ef3e035c3a9b ("sparc64: Fix register corruption in top-most +kernel stack frame during boot.") removed the cif_stack argument to +prom_cif init in the declaration at the caller site and the usage of it +within prom_cif_init, but not in the function signature of the function +itself. + +This also fixes the following warning: +arch/sparc/prom/p1275.c:52:6: warning: no previous prototype for ‘prom_cif_init’ + +Fixes: ef3e035c3a9b ("sparc64: Fix register corruption in top-most kernel stack frame during boot.") +Link: https://lore.kernel.org/r/20240710094155.458731-3-andreas@gaisler.com +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/include/asm/oplib_64.h | 1 + + arch/sparc/prom/init_64.c | 3 --- + arch/sparc/prom/p1275.c | 2 +- + 3 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/sparc/include/asm/oplib_64.h b/arch/sparc/include/asm/oplib_64.h +index a67abebd43592..1b86d02a84556 100644 +--- a/arch/sparc/include/asm/oplib_64.h ++++ b/arch/sparc/include/asm/oplib_64.h +@@ -247,6 +247,7 @@ void prom_sun4v_guest_soft_state(void); + int prom_ihandle2path(int handle, char *buffer, int bufsize); + + /* Client interface level routines. */ ++void prom_cif_init(void *cif_handler); + void p1275_cmd_direct(unsigned long *); + + #endif /* !(__SPARC64_OPLIB_H) */ +diff --git a/arch/sparc/prom/init_64.c b/arch/sparc/prom/init_64.c +index 103aa91043185..f7b8a1a865b8f 100644 +--- a/arch/sparc/prom/init_64.c ++++ b/arch/sparc/prom/init_64.c +@@ -26,9 +26,6 @@ phandle prom_chosen_node; + * routines in the prom library. + * It gets passed the pointer to the PROM vector. + */ +- +-extern void prom_cif_init(void *); +- + void __init prom_init(void *cif_handler) + { + phandle node; +diff --git a/arch/sparc/prom/p1275.c b/arch/sparc/prom/p1275.c +index 889aa602f8d86..51c3f984bbf72 100644 +--- a/arch/sparc/prom/p1275.c ++++ b/arch/sparc/prom/p1275.c +@@ -49,7 +49,7 @@ void p1275_cmd_direct(unsigned long *args) + local_irq_restore(flags); + } + +-void prom_cif_init(void *cif_handler, void *cif_stack) ++void prom_cif_init(void *cif_handler) + { + p1275buf.prom_cif_handler = (void (*)(long *))cif_handler; + } +-- +2.43.0 + diff --git a/queue-4.19/wifi-brcmsmac-lcn-phy-code-is-used-for-bcm4313-2g-on.patch b/queue-4.19/wifi-brcmsmac-lcn-phy-code-is-used-for-bcm4313-2g-on.patch new file mode 100644 index 00000000000..0908a256ced --- /dev/null +++ b/queue-4.19/wifi-brcmsmac-lcn-phy-code-is-used-for-bcm4313-2g-on.patch @@ -0,0 +1,75 @@ +From c9c6de078418cf805c6e401ba0a41d2d1b060158 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 16:10:37 -0700 +Subject: wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device + +From: Samasth Norway Ananda + +[ Upstream commit c636fa85feb450ca414a10010ed05361a73c93a6 ] + +The band_idx variable in the function wlc_lcnphy_tx_iqlo_cal() will +never be set to 1 as BCM4313 is the only device for which the LCN PHY +code is used. This is a 2G-only device. + +Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers") +Signed-off-by: Samasth Norway Ananda +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240509231037.2014109-1-samasth.norway.ananda@oracle.com +Signed-off-by: Sasha Levin +--- + .../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +index d532decc15383..071dee3c3deda 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +@@ -2638,7 +2638,6 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi, + + struct lcnphy_txgains cal_gains, temp_gains; + u16 hash; +- u8 band_idx; + int j; + u16 ncorr_override[5]; + u16 syst_coeffs[] = { 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, +@@ -2670,6 +2669,9 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi, + u16 *values_to_save; + struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy; + ++ if (WARN_ON(CHSPEC_IS5G(pi->radio_chanspec))) ++ return; ++ + values_to_save = kmalloc_array(20, sizeof(u16), GFP_ATOMIC); + if (NULL == values_to_save) + return; +@@ -2733,20 +2735,18 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi, + hash = (target_gains->gm_gain << 8) | + (target_gains->pga_gain << 4) | (target_gains->pad_gain); + +- band_idx = (CHSPEC_IS5G(pi->radio_chanspec) ? 1 : 0); +- + cal_gains = *target_gains; + memset(ncorr_override, 0, sizeof(ncorr_override)); +- for (j = 0; j < iqcal_gainparams_numgains_lcnphy[band_idx]; j++) { +- if (hash == tbl_iqcal_gainparams_lcnphy[band_idx][j][0]) { ++ for (j = 0; j < iqcal_gainparams_numgains_lcnphy[0]; j++) { ++ if (hash == tbl_iqcal_gainparams_lcnphy[0][j][0]) { + cal_gains.gm_gain = +- tbl_iqcal_gainparams_lcnphy[band_idx][j][1]; ++ tbl_iqcal_gainparams_lcnphy[0][j][1]; + cal_gains.pga_gain = +- tbl_iqcal_gainparams_lcnphy[band_idx][j][2]; ++ tbl_iqcal_gainparams_lcnphy[0][j][2]; + cal_gains.pad_gain = +- tbl_iqcal_gainparams_lcnphy[band_idx][j][3]; ++ tbl_iqcal_gainparams_lcnphy[0][j][3]; + memcpy(ncorr_override, +- &tbl_iqcal_gainparams_lcnphy[band_idx][j][3], ++ &tbl_iqcal_gainparams_lcnphy[0][j][3], + sizeof(ncorr_override)); + break; + } +-- +2.43.0 + diff --git a/queue-4.19/wifi-cfg80211-fix-typo-in-cfg80211_calculate_bitrate.patch b/queue-4.19/wifi-cfg80211-fix-typo-in-cfg80211_calculate_bitrate.patch new file mode 100644 index 00000000000..22bd6828b13 --- /dev/null +++ b/queue-4.19/wifi-cfg80211-fix-typo-in-cfg80211_calculate_bitrate.patch @@ -0,0 +1,45 @@ +From c1f42fa0f4404c2eb45991ace2f6408b231d504e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:06:52 +0800 +Subject: wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he() + +From: Baochen Qiang + +[ Upstream commit 9ee0d44f055276fe2802b2f65058e920853f4f99 ] + +rates_996 is mistakenly written as rates_969, fix it. + +Fixes: c4cbaf7973a7 ("cfg80211: Add support for HE") +Signed-off-by: Baochen Qiang +Link: https://msgid.link/20240606020653.33205-2-quic_bqiang@quicinc.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/util.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index 82bf1339c28e8..eff4877bb4383 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -1206,7 +1206,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) + 2048, /* 1.000000... */ + }; + u32 rates_160M[3] = { 960777777, 907400000, 816666666 }; +- u32 rates_969[3] = { 480388888, 453700000, 408333333 }; ++ u32 rates_996[3] = { 480388888, 453700000, 408333333 }; + u32 rates_484[3] = { 229411111, 216666666, 195000000 }; + u32 rates_242[3] = { 114711111, 108333333, 97500000 }; + u32 rates_106[3] = { 40000000, 37777777, 34000000 }; +@@ -1231,7 +1231,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) + else if (rate->bw == RATE_INFO_BW_80 || + (rate->bw == RATE_INFO_BW_HE_RU && + rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_996)) +- result = rates_969[rate->he_gi]; ++ result = rates_996[rate->he_gi]; + else if (rate->bw == RATE_INFO_BW_40 || + (rate->bw == RATE_INFO_BW_HE_RU && + rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_484)) +-- +2.43.0 + diff --git a/queue-4.19/wifi-cfg80211-handle-2x996-ru-allocation-in-cfg80211.patch b/queue-4.19/wifi-cfg80211-handle-2x996-ru-allocation-in-cfg80211.patch new file mode 100644 index 00000000000..f6f07d653fc --- /dev/null +++ b/queue-4.19/wifi-cfg80211-handle-2x996-ru-allocation-in-cfg80211.patch @@ -0,0 +1,45 @@ +From 59e2a4567fada1660a4ab2f54b3353a89144d079 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:06:53 +0800 +Subject: wifi: cfg80211: handle 2x996 RU allocation in + cfg80211_calculate_bitrate_he() + +From: Baochen Qiang + +[ Upstream commit bcbd771cd5d68c0c52567556097d75f9fc4e7cd6 ] + +Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in +cfg80211_calculate_bitrate_he(), leading to below warning: + +kernel: invalid HE MCS: bw:6, ru:6 +kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211] + +Fix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth. + +Fixes: c4cbaf7973a7 ("cfg80211: Add support for HE") +Signed-off-by: Baochen Qiang +Link: https://msgid.link/20240606020653.33205-3-quic_bqiang@quicinc.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/util.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index eff4877bb4383..7886f26043ed4 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -1226,7 +1226,9 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) + if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8)) + return 0; + +- if (rate->bw == RATE_INFO_BW_160) ++ if (rate->bw == RATE_INFO_BW_160 || ++ (rate->bw == RATE_INFO_BW_HE_RU && ++ rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_2x996)) + result = rates_160M[rate->he_gi]; + else if (rate->bw == RATE_INFO_BW_80 || + (rate->bw == RATE_INFO_BW_HE_RU && +-- +2.43.0 + diff --git a/queue-4.19/x86-of-return-consistent-error-type-from-x86_of_pci_.patch b/queue-4.19/x86-of-return-consistent-error-type-from-x86_of_pci_.patch new file mode 100644 index 00000000000..39db1b57168 --- /dev/null +++ b/queue-4.19/x86-of-return-consistent-error-type-from-x86_of_pci_.patch @@ -0,0 +1,45 @@ +From 11457c8c0fe9d1d9ce51f7b593e23940864e37df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 15:55:35 +0300 +Subject: x86/of: Return consistent error type from x86_of_pci_irq_enable() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit ec0b4c4d45cf7cf9a6c9626a494a89cb1ae7c645 ] + +x86_of_pci_irq_enable() returns PCIBIOS_* code received from +pci_read_config_byte() directly and also -EINVAL which are not +compatible error types. x86_of_pci_irq_enable() is used as +(*pcibios_enable_irq) function which should not return PCIBIOS_* codes. + +Convert the PCIBIOS_* return code from pci_read_config_byte() into +normal errno using pcibios_err_to_errno(). + +Fixes: 96e0a0797eba ("x86: dtb: Add support for PCI devices backed by dtb nodes") +Signed-off-by: Ilpo Järvinen +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20240527125538.13620-1-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/devicetree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c +index f39f3a06c26fa..c4c84e1a3044e 100644 +--- a/arch/x86/kernel/devicetree.c ++++ b/arch/x86/kernel/devicetree.c +@@ -90,7 +90,7 @@ static int x86_of_pci_irq_enable(struct pci_dev *dev) + + ret = pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin); + if (ret) +- return ret; ++ return pcibios_err_to_errno(ret); + if (!pin) + return 0; + +-- +2.43.0 + diff --git a/queue-4.19/x86-pci-intel_mid_pci-fix-pcibios_-return-code-handl.patch b/queue-4.19/x86-pci-intel_mid_pci-fix-pcibios_-return-code-handl.patch new file mode 100644 index 00000000000..073ed73b79b --- /dev/null +++ b/queue-4.19/x86-pci-intel_mid_pci-fix-pcibios_-return-code-handl.patch @@ -0,0 +1,53 @@ +From 5f55726ecc55d4f3c01d1941d8c175aad8b823e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 15:55:36 +0300 +Subject: x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 724852059e97c48557151b3aa4af424614819752 ] + +intel_mid_pci_irq_enable() uses pci_read_config_byte() that returns +PCIBIOS_* codes. The error handling, however, assumes the codes are +normal errnos because it checks for < 0. + +intel_mid_pci_irq_enable() also returns the PCIBIOS_* code back to the +caller but the function is used as the (*pcibios_enable_irq) function +which should return normal errnos. + +Convert the error check to plain non-zero check which works for +PCIBIOS_* return codes and convert the PCIBIOS_* return code using +pcibios_err_to_errno() into normal errno before returning it. + +Fixes: 5b395e2be6c4 ("x86/platform/intel-mid: Make IRQ allocation a bit more flexible") +Signed-off-by: Ilpo Järvinen +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240527125538.13620-2-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/pci/intel_mid_pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c +index eea5a0f3b959b..63513968f5617 100644 +--- a/arch/x86/pci/intel_mid_pci.c ++++ b/arch/x86/pci/intel_mid_pci.c +@@ -223,9 +223,9 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev) + return 0; + + ret = pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &gsi); +- if (ret < 0) { ++ if (ret) { + dev_warn(&dev->dev, "Failed to read interrupt line: %d\n", ret); +- return ret; ++ return pcibios_err_to_errno(ret); + } + + switch (intel_mid_identify_cpu()) { +-- +2.43.0 + diff --git a/queue-4.19/x86-pci-xen-fix-pcibios_-return-code-handling.patch b/queue-4.19/x86-pci-xen-fix-pcibios_-return-code-handling.patch new file mode 100644 index 00000000000..bff9963297d --- /dev/null +++ b/queue-4.19/x86-pci-xen-fix-pcibios_-return-code-handling.patch @@ -0,0 +1,54 @@ +From f2ef1bfb843d1c03d4e4f7fc37ecb10b5a05fc20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 15:55:37 +0300 +Subject: x86/pci/xen: Fix PCIBIOS_* return code handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit e9d7b435dfaec58432f4106aaa632bf39f52ce9f ] + +xen_pcifront_enable_irq() uses pci_read_config_byte() that returns +PCIBIOS_* codes. The error handling, however, assumes the codes are +normal errnos because it checks for < 0. + +xen_pcifront_enable_irq() also returns the PCIBIOS_* code back to the +caller but the function is used as the (*pcibios_enable_irq) function +which should return normal errnos. + +Convert the error check to plain non-zero check which works for +PCIBIOS_* return codes and convert the PCIBIOS_* return code using +pcibios_err_to_errno() into normal errno before returning it. + +Fixes: 3f2a230caf21 ("xen: handled remapped IRQs when enabling a pcifront PCI device.") +Signed-off-by: Ilpo Järvinen +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20240527125538.13620-3-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/pci/xen.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c +index bacf8d988f65f..d308057aec0b9 100644 +--- a/arch/x86/pci/xen.c ++++ b/arch/x86/pci/xen.c +@@ -36,10 +36,10 @@ static int xen_pcifront_enable_irq(struct pci_dev *dev) + u8 gsi; + + rc = pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &gsi); +- if (rc < 0) { ++ if (rc) { + dev_warn(&dev->dev, "Xen PCI: failed to read interrupt line: %d\n", + rc); +- return rc; ++ return pcibios_err_to_errno(rc); + } + /* In PV DomU the Xen PCI backend puts the PIRQ in the interrupt line.*/ + pirq = gsi; +-- +2.43.0 + diff --git a/queue-4.19/x86-platform-iosf_mbi-convert-pcibios_-return-codes-.patch b/queue-4.19/x86-platform-iosf_mbi-convert-pcibios_-return-codes-.patch new file mode 100644 index 00000000000..eac754b21e4 --- /dev/null +++ b/queue-4.19/x86-platform-iosf_mbi-convert-pcibios_-return-codes-.patch @@ -0,0 +1,54 @@ +From 7e01f7f514c9a15b4f3a844695da1028149e8695 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 15:55:38 +0300 +Subject: x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 7821fa101eab529521aa4b724bf708149d70820c ] + +iosf_mbi_pci_{read,write}_mdr() use pci_{read,write}_config_dword() +that return PCIBIOS_* codes but functions also return -ENODEV which are +not compatible error codes. As neither of the functions are related to +PCI read/write functions, they should return normal errnos. + +Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal +errno before returning it. + +Fixes: 46184415368a ("arch: x86: New MailBox support driver for Intel SOC's") +Signed-off-by: Ilpo Järvinen +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20240527125538.13620-4-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/platform/intel/iosf_mbi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/platform/intel/iosf_mbi.c b/arch/x86/platform/intel/iosf_mbi.c +index 6f37a2137a795..dfeedbd6467fc 100644 +--- a/arch/x86/platform/intel/iosf_mbi.c ++++ b/arch/x86/platform/intel/iosf_mbi.c +@@ -68,7 +68,7 @@ static int iosf_mbi_pci_read_mdr(u32 mcrx, u32 mcr, u32 *mdr) + + fail_read: + dev_err(&mbi_pdev->dev, "PCI config access failed with %d\n", result); +- return result; ++ return pcibios_err_to_errno(result); + } + + static int iosf_mbi_pci_write_mdr(u32 mcrx, u32 mcr, u32 mdr) +@@ -97,7 +97,7 @@ static int iosf_mbi_pci_write_mdr(u32 mcrx, u32 mcr, u32 mdr) + + fail_write: + dev_err(&mbi_pdev->dev, "PCI config access failed with %d\n", result); +- return result; ++ return pcibios_err_to_errno(result); + } + + int iosf_mbi_read(u8 port, u8 opcode, u32 offset, u32 *mdr) +-- +2.43.0 + diff --git a/queue-4.19/x86-xen-convert-comma-to-semicolon.patch b/queue-4.19/x86-xen-convert-comma-to-semicolon.patch new file mode 100644 index 00000000000..d83cc9e4e6e --- /dev/null +++ b/queue-4.19/x86-xen-convert-comma-to-semicolon.patch @@ -0,0 +1,46 @@ +From be236e4333aed367199bf7600925a2d72d16a075 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 11:10:10 +0800 +Subject: x86/xen: Convert comma to semicolon + +From: Chen Ni + +[ Upstream commit 349d271416c61f82b853336509b1d0dc04c1fcbb ] + +Replace a comma between expression statements by a semicolon. + +Fixes: 8310b77b48c5 ("Xen/gnttab: handle p2m update errors on a per-slot basis") +Signed-off-by: Chen Ni +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20240702031010.1411875-1-nichen@iscas.ac.cn +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/x86/xen/p2m.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c +index f9b31eb6846c4..8cbdc5e6863c3 100644 +--- a/arch/x86/xen/p2m.c ++++ b/arch/x86/xen/p2m.c +@@ -733,7 +733,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops, + * immediate unmapping. + */ + map_ops[i].status = GNTST_general_error; +- unmap[0].host_addr = map_ops[i].host_addr, ++ unmap[0].host_addr = map_ops[i].host_addr; + unmap[0].handle = map_ops[i].handle; + map_ops[i].handle = ~0; + if (map_ops[i].flags & GNTMAP_device_map) +@@ -743,7 +743,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops, + + if (kmap_ops) { + kmap_ops[i].status = GNTST_general_error; +- unmap[1].host_addr = kmap_ops[i].host_addr, ++ unmap[1].host_addr = kmap_ops[i].host_addr; + unmap[1].handle = kmap_ops[i].handle; + kmap_ops[i].handle = ~0; + if (kmap_ops[i].flags & GNTMAP_device_map) +-- +2.43.0 +