From: Sasha Levin Date: Sun, 2 Feb 2025 04:05:22 +0000 (-0500) Subject: Fixes for 5.15 X-Git-Tag: v6.6.76~72 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=560530d373da531b958e6f2b864866782e930176;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/acpi-fan-cleanup-resources-in-the-error-path-of-.pro.patch b/queue-5.15/acpi-fan-cleanup-resources-in-the-error-path-of-.pro.patch new file mode 100644 index 0000000000..16b8bbcfc1 --- /dev/null +++ b/queue-5.15/acpi-fan-cleanup-resources-in-the-error-path-of-.pro.patch @@ -0,0 +1,59 @@ +From e2f40f2652f3210891a7e95203bdfd6aff62615d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 12:28:12 +0900 +Subject: ACPI: fan: cleanup resources in the error path of .probe() + +From: Joe Hattori + +[ Upstream commit c759bc8e9046f9812238f506d70f07d3ea4206d4 ] + +Call thermal_cooling_device_unregister() and sysfs_remove_link() in the +error path of acpi_fan_probe() to fix possible memory leak. + +This bug was found by an experimental static analysis tool that I am +developing. + +Fixes: 05a83d972293 ("ACPI: register ACPI Fan as generic thermal cooling device") +Signed-off-by: Joe Hattori +Link: https://patch.msgid.link/20241211032812.210164-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/fan.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c +index 5cd0ceb50bc8a..936429e81d8c8 100644 +--- a/drivers/acpi/fan.c ++++ b/drivers/acpi/fan.c +@@ -423,19 +423,25 @@ static int acpi_fan_probe(struct platform_device *pdev) + result = sysfs_create_link(&pdev->dev.kobj, + &cdev->device.kobj, + "thermal_cooling"); +- if (result) ++ if (result) { + dev_err(&pdev->dev, "Failed to create sysfs link 'thermal_cooling'\n"); ++ goto err_unregister; ++ } + + result = sysfs_create_link(&cdev->device.kobj, + &pdev->dev.kobj, + "device"); + if (result) { + dev_err(&pdev->dev, "Failed to create sysfs link 'device'\n"); +- goto err_end; ++ goto err_remove_link; + } + + return 0; + ++err_remove_link: ++ sysfs_remove_link(&pdev->dev.kobj, "thermal_cooling"); ++err_unregister: ++ thermal_cooling_device_unregister(cdev); + err_end: + if (fan->acpi4) { + int i; +-- +2.39.5 + diff --git a/queue-5.15/afs-fix-directory-format-encoding-struct.patch b/queue-5.15/afs-fix-directory-format-encoding-struct.patch new file mode 100644 index 0000000000..9fa1561e6f --- /dev/null +++ b/queue-5.15/afs-fix-directory-format-encoding-struct.patch @@ -0,0 +1,45 @@ +From 618022c0839cacb59f0f3a237cb809a3ae11f091 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 20:41:03 +0000 +Subject: afs: Fix directory format encoding struct + +From: David Howells + +[ Upstream commit 07a10767853adcbdbf436dc91393b729b52c4e81 ] + +The AFS directory format structure, union afs_xdr_dir_block::meta, has too +many alloc counter slots declared and so pushes the hash table along and +over the data. This doesn't cause a problem at the moment because I'm +currently ignoring the hash table and only using the correct number of +alloc_ctrs in the code anyway. In future, however, I should start using +the hash table to try and speed up afs_lookup(). + +Fix this by using the correct constant to declare the counter array. + +Fixes: 4ea219a839bf ("afs: Split the directory content defs into a header") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20241216204124.3752367-14-dhowells@redhat.com +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/xdr_fs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/afs/xdr_fs.h b/fs/afs/xdr_fs.h +index 8ca8681645077..cc5f143d21a34 100644 +--- a/fs/afs/xdr_fs.h ++++ b/fs/afs/xdr_fs.h +@@ -88,7 +88,7 @@ union afs_xdr_dir_block { + + struct { + struct afs_xdr_dir_hdr hdr; +- u8 alloc_ctrs[AFS_DIR_MAX_BLOCKS]; ++ u8 alloc_ctrs[AFS_DIR_BLOCKS_WITH_CTR]; + __be16 hashtable[AFS_DIR_HASHTBL_SIZE]; + } meta; + +-- +2.39.5 + diff --git a/queue-5.15/afs-fix-eexist-error-returned-from-afs_rmdir-to-be-e.patch b/queue-5.15/afs-fix-eexist-error-returned-from-afs_rmdir-to-be-e.patch new file mode 100644 index 0000000000..1385d46efe --- /dev/null +++ b/queue-5.15/afs-fix-eexist-error-returned-from-afs_rmdir-to-be-e.patch @@ -0,0 +1,48 @@ +From e7b2e748631e215fc53e84138b155b63ab9eba51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 20:41:02 +0000 +Subject: afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY + +From: David Howells + +[ Upstream commit b49194da2aff2c879dec9c59ef8dec0f2b0809ef ] + +AFS servers pass back a code indicating EEXIST when they're asked to remove +a directory that is not empty rather than ENOTEMPTY because not all the +systems that an AFS server can run on have the latter error available and +AFS preexisted the addition of that error in general. + +Fix afs_rmdir() to translate EEXIST to ENOTEMPTY. + +Fixes: 260a980317da ("[AFS]: Add "directory write" support.") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20241216204124.3752367-13-dhowells@redhat.com +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/dir.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/afs/dir.c b/fs/afs/dir.c +index cec18f9f8bd7a..d4bd6efc8c447 100644 +--- a/fs/afs/dir.c ++++ b/fs/afs/dir.c +@@ -1493,7 +1493,12 @@ static int afs_rmdir(struct inode *dir, struct dentry *dentry) + op->file[1].vnode = vnode; + } + +- return afs_do_sync_operation(op); ++ ret = afs_do_sync_operation(op); ++ ++ /* Not all systems that can host afs servers have ENOTEMPTY. */ ++ if (ret == -EEXIST) ++ ret = -ENOTEMPTY; ++ return ret; + + error: + return afs_put_operation(op); +-- +2.39.5 + diff --git a/queue-5.15/afs-fix-the-fallback-handling-for-the-yfs.removefile.patch b/queue-5.15/afs-fix-the-fallback-handling-for-the-yfs.removefile.patch new file mode 100644 index 0000000000..2d04e2729c --- /dev/null +++ b/queue-5.15/afs-fix-the-fallback-handling-for-the-yfs.removefile.patch @@ -0,0 +1,48 @@ +From 1f5f747d6c9ddada3107e102bafa4c3b1e291390 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 14:46:03 +0000 +Subject: afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call + +From: David Howells + +[ Upstream commit e30458d690f35abb01de8b3cbc09285deb725d00 ] + +Fix a pair of bugs in the fallback handling for the YFS.RemoveFile2 RPC +call: + + (1) Fix the abort code check to also look for RXGEN_OPCODE. The lack of + this masks the second bug. + + (2) call->server is now not used for ordinary filesystem RPC calls that + have an operation descriptor. Fix to use call->op->server instead. + +Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/109541.1736865963@warthog.procyon.org.uk +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/yfsclient.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c +index 88ea20e79ae27..b3bc46a112242 100644 +--- a/fs/afs/yfsclient.c ++++ b/fs/afs/yfsclient.c +@@ -662,8 +662,9 @@ static int yfs_deliver_fs_remove_file2(struct afs_call *call) + static void yfs_done_fs_remove_file2(struct afs_call *call) + { + if (call->error == -ECONNABORTED && +- call->abort_code == RX_INVALID_OPERATION) { +- set_bit(AFS_SERVER_FL_NO_RM2, &call->server->flags); ++ (call->abort_code == RX_INVALID_OPERATION || ++ call->abort_code == RXGEN_OPCODE)) { ++ set_bit(AFS_SERVER_FL_NO_RM2, &call->op->server->flags); + call->op->flags |= AFS_OPERATION_DOWNGRADE; + } + } +-- +2.39.5 + diff --git a/queue-5.15/arm-at91-pm-change-bu-power-switch-to-automatic-mode.patch b/queue-5.15/arm-at91-pm-change-bu-power-switch-to-automatic-mode.patch new file mode 100644 index 0000000000..afd01fe856 --- /dev/null +++ b/queue-5.15/arm-at91-pm-change-bu-power-switch-to-automatic-mode.patch @@ -0,0 +1,93 @@ +From 8333a69d9b1b5ca49ca00fd92d07f1df5acc35a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Nov 2024 17:56:48 +0100 +Subject: ARM: at91: pm: change BU Power Switch to automatic mode + +From: Nicolas Ferre + +[ Upstream commit 6fc5bdfa872b7da51b5507a1327a17c3db2fcf95 ] + +Change how the Backup Unit Power is configured and force the +automatic/hardware mode. +This change eliminates the need for software management of the power +switch, ensuring it transitions to the backup power source before +entering low power modes. + +This is done in the only location where this switch was configured. It's +usually done in the bootloader. + +Previously, the loss of the VDDANA (or VDDIN33) power source was not +automatically compensated by an alternative power source. This resulted +in the loss of Backup Unit content, including Backup Self-refresh low +power mode information, OTP emulation configuration, and boot +configuration, for instance. + +Fixes: ac809e7879b1 ("ARM: at91: pm: switch backup area to vbat in backup mode") +Signed-off-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20241125165648.509162-1-nicolas.ferre@microchip.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c +index c8cc993ca8ca1..91efc3d4de61d 100644 +--- a/arch/arm/mach-at91/pm.c ++++ b/arch/arm/mach-at91/pm.c +@@ -403,7 +403,21 @@ static int at91_suspend_finish(unsigned long val) + return 0; + } + +-static void at91_pm_switch_ba_to_vbat(void) ++/** ++ * at91_pm_switch_ba_to_auto() - Configure Backup Unit Power Switch ++ * to automatic/hardware mode. ++ * ++ * The Backup Unit Power Switch can be managed either by software or hardware. ++ * Enabling hardware mode allows the automatic transition of power between ++ * VDDANA (or VDDIN33) and VDDBU (or VBAT, respectively), based on the ++ * availability of these power sources. ++ * ++ * If the Backup Unit Power Switch is already in automatic mode, no action is ++ * required. If it is in software-controlled mode, it is switched to automatic ++ * mode to enhance safety and eliminate the need for toggling between power ++ * sources. ++ */ ++static void at91_pm_switch_ba_to_auto(void) + { + unsigned int offset = offsetof(struct at91_pm_sfrbu_regs, pswbu); + unsigned int val; +@@ -414,24 +428,19 @@ static void at91_pm_switch_ba_to_vbat(void) + + val = readl(soc_pm.data.sfrbu + offset); + +- /* Already on VBAT. */ +- if (!(val & soc_pm.sfrbu_regs.pswbu.state)) ++ /* Already on auto/hardware. */ ++ if (!(val & soc_pm.sfrbu_regs.pswbu.ctrl)) + return; + +- val &= ~soc_pm.sfrbu_regs.pswbu.softsw; +- val |= soc_pm.sfrbu_regs.pswbu.key | soc_pm.sfrbu_regs.pswbu.ctrl; ++ val &= ~soc_pm.sfrbu_regs.pswbu.ctrl; ++ val |= soc_pm.sfrbu_regs.pswbu.key; + writel(val, soc_pm.data.sfrbu + offset); +- +- /* Wait for update. */ +- val = readl(soc_pm.data.sfrbu + offset); +- while (val & soc_pm.sfrbu_regs.pswbu.state) +- val = readl(soc_pm.data.sfrbu + offset); + } + + static void at91_pm_suspend(suspend_state_t state) + { + if (soc_pm.data.mode == AT91_PM_BACKUP) { +- at91_pm_switch_ba_to_vbat(); ++ at91_pm_switch_ba_to_auto(); + + cpu_suspend(0, at91_suspend_finish); + +-- +2.39.5 + diff --git a/queue-5.15/arm-dts-mediatek-mt7623-fix-ir-nodename.patch b/queue-5.15/arm-dts-mediatek-mt7623-fix-ir-nodename.patch new file mode 100644 index 0000000000..4fd116e65f --- /dev/null +++ b/queue-5.15/arm-dts-mediatek-mt7623-fix-ir-nodename.patch @@ -0,0 +1,42 @@ +From f6bf1752956c436df264b167c0c9d1266f074e2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:46:33 +0200 +Subject: ARM: dts: mediatek: mt7623: fix IR nodename +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 90234cf9b37c57201a24b78c217a91a8af774109 ] + +Fix following validation error: +arch/arm/boot/dts/mediatek/mt7623a-rfb-emmc.dtb: cir@10013000: $nodename:0: 'cir@10013000' does not match '^ir(-receiver)?(@[a-f0-9]+)?$' + from schema $id: http://devicetree.org/schemas/media/mediatek,mt7622-cir.yaml# + +Fixes: 91044f38dae7 ("arm: dts: mt7623: add ir nodes to the mt7623.dtsi file") +Cc: linux-media@vger.kernel.org +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20240617094634.23173-1-zajec5@gmail.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/mt7623.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/mt7623.dtsi b/arch/arm/boot/dts/mt7623.dtsi +index a7d62dbad6026..64756888fd0d1 100644 +--- a/arch/arm/boot/dts/mt7623.dtsi ++++ b/arch/arm/boot/dts/mt7623.dtsi +@@ -309,7 +309,7 @@ + clock-names = "spi", "wrap"; + }; + +- cir: cir@10013000 { ++ cir: ir-receiver@10013000 { + compatible = "mediatek,mt7623-cir"; + reg = <0 0x10013000 0 0x1000>; + interrupts = ; +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8173-elm-drop-regulator-compati.patch b/queue-5.15/arm64-dts-mediatek-mt8173-elm-drop-regulator-compati.patch new file mode 100644 index 0000000000..936a732a95 --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8173-elm-drop-regulator-compati.patch @@ -0,0 +1,213 @@ +From c962e89869bbe2d858ef236dddd7593da059a8c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 13:24:21 +0800 +Subject: arm64: dts: mediatek: mt8173-elm: Drop regulator-compatible property + +From: Chen-Yu Tsai + +[ Upstream commit 4b907b3ea5fba240808136cc5599d14b52230b39 ] + +The "regulator-compatible" property has been deprecated since 2012 in +commit 13511def87b9 ("regulator: deprecate regulator-compatible DT +property"), which is so old it's not even mentioned in the converted +regulator bindings YAML file. It is also not listed in the MT6397 +regulator bindings. Having them present produces a whole bunch of +validation errors: + + Unevaluated properties are not allowed ('regulator-compatible' was unexpected) + +Drop the "regulator-compatible" property from the board dts. The +property values are the same as the node name, so everything should +continue to work. + +Fixes: 689b937bedde ("arm64: dts: mediatek: add mt8173 elm and hana board") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241211052427.4178367-4-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi | 23 -------------------- + 1 file changed, 23 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi +index e666ebb28980a..ed82a3feb789b 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi +@@ -930,7 +930,6 @@ + compatible = "mediatek,mt6397-regulator"; + + mt6397_vpca15_reg: buck_vpca15 { +- regulator-compatible = "buck_vpca15"; + regulator-name = "vpca15"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -940,7 +939,6 @@ + }; + + mt6397_vpca7_reg: buck_vpca7 { +- regulator-compatible = "buck_vpca7"; + regulator-name = "vpca7"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -950,7 +948,6 @@ + }; + + mt6397_vsramca15_reg: buck_vsramca15 { +- regulator-compatible = "buck_vsramca15"; + regulator-name = "vsramca15"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -959,7 +956,6 @@ + }; + + mt6397_vsramca7_reg: buck_vsramca7 { +- regulator-compatible = "buck_vsramca7"; + regulator-name = "vsramca7"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -968,7 +964,6 @@ + }; + + mt6397_vcore_reg: buck_vcore { +- regulator-compatible = "buck_vcore"; + regulator-name = "vcore"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -977,7 +972,6 @@ + }; + + mt6397_vgpu_reg: buck_vgpu { +- regulator-compatible = "buck_vgpu"; + regulator-name = "vgpu"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -986,7 +980,6 @@ + }; + + mt6397_vdrm_reg: buck_vdrm { +- regulator-compatible = "buck_vdrm"; + regulator-name = "vdrm"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <1400000>; +@@ -995,7 +988,6 @@ + }; + + mt6397_vio18_reg: buck_vio18 { +- regulator-compatible = "buck_vio18"; + regulator-name = "vio18"; + regulator-min-microvolt = <1620000>; + regulator-max-microvolt = <1980000>; +@@ -1004,18 +996,15 @@ + }; + + mt6397_vtcxo_reg: ldo_vtcxo { +- regulator-compatible = "ldo_vtcxo"; + regulator-name = "vtcxo"; + regulator-always-on; + }; + + mt6397_va28_reg: ldo_va28 { +- regulator-compatible = "ldo_va28"; + regulator-name = "va28"; + }; + + mt6397_vcama_reg: ldo_vcama { +- regulator-compatible = "ldo_vcama"; + regulator-name = "vcama"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +@@ -1023,18 +1012,15 @@ + }; + + mt6397_vio28_reg: ldo_vio28 { +- regulator-compatible = "ldo_vio28"; + regulator-name = "vio28"; + regulator-always-on; + }; + + mt6397_vusb_reg: ldo_vusb { +- regulator-compatible = "ldo_vusb"; + regulator-name = "vusb"; + }; + + mt6397_vmc_reg: ldo_vmc { +- regulator-compatible = "ldo_vmc"; + regulator-name = "vmc"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; +@@ -1042,7 +1028,6 @@ + }; + + mt6397_vmch_reg: ldo_vmch { +- regulator-compatible = "ldo_vmch"; + regulator-name = "vmch"; + regulator-min-microvolt = <3000000>; + regulator-max-microvolt = <3300000>; +@@ -1050,7 +1035,6 @@ + }; + + mt6397_vemc_3v3_reg: ldo_vemc3v3 { +- regulator-compatible = "ldo_vemc3v3"; + regulator-name = "vemc_3v3"; + regulator-min-microvolt = <3000000>; + regulator-max-microvolt = <3300000>; +@@ -1058,7 +1042,6 @@ + }; + + mt6397_vgp1_reg: ldo_vgp1 { +- regulator-compatible = "ldo_vgp1"; + regulator-name = "vcamd"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +@@ -1066,7 +1049,6 @@ + }; + + mt6397_vgp2_reg: ldo_vgp2 { +- regulator-compatible = "ldo_vgp2"; + regulator-name = "vcamio"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; +@@ -1074,7 +1056,6 @@ + }; + + mt6397_vgp3_reg: ldo_vgp3 { +- regulator-compatible = "ldo_vgp3"; + regulator-name = "vcamaf"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +@@ -1082,7 +1063,6 @@ + }; + + mt6397_vgp4_reg: ldo_vgp4 { +- regulator-compatible = "ldo_vgp4"; + regulator-name = "vgp4"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3300000>; +@@ -1090,7 +1070,6 @@ + }; + + mt6397_vgp5_reg: ldo_vgp5 { +- regulator-compatible = "ldo_vgp5"; + regulator-name = "vgp5"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3000000>; +@@ -1098,7 +1077,6 @@ + }; + + mt6397_vgp6_reg: ldo_vgp6 { +- regulator-compatible = "ldo_vgp6"; + regulator-name = "vgp6"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; +@@ -1107,7 +1085,6 @@ + }; + + mt6397_vibr_reg: ldo_vibr { +- regulator-compatible = "ldo_vibr"; + regulator-name = "vibr"; + regulator-min-microvolt = <1300000>; + regulator-max-microvolt = <3300000>; +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8173-elm-fix-mt6397-pmic-sub-no.patch b/queue-5.15/arm64-dts-mediatek-mt8173-elm-fix-mt6397-pmic-sub-no.patch new file mode 100644 index 0000000000..fc690bc0f7 --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8173-elm-fix-mt6397-pmic-sub-no.patch @@ -0,0 +1,58 @@ +From 3b3a3d1590048e59443ab31ce0e4d76362dd2e54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:26:12 +0800 +Subject: arm64: dts: mediatek: mt8173-elm: Fix MT6397 PMIC sub-node names + +From: Chen-Yu Tsai + +[ Upstream commit beb06b727194f68b0a4b5183e50c88265ce185af ] + +The MT6397 PMIC bindings specify exact names for its sub-nodes. The +names used in the current dts don't match, causing a validation error. + +Fix up the names. Also drop the label for the regulators node, since +any reference should be against the individual regulator sub-nodes. + +Fixes: 689b937bedde ("arm64: dts: mediatek: add mt8173 elm and hana board") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20241210092614.3951748-1-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi +index ed82a3feb789b..7d15be690894c 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi +@@ -914,7 +914,7 @@ + interrupt-controller; + #interrupt-cells = <2>; + +- clock: mt6397clock { ++ clock: clocks { + compatible = "mediatek,mt6397-clk"; + #clock-cells = <1>; + }; +@@ -926,7 +926,7 @@ + #gpio-cells = <2>; + }; + +- regulator: mt6397regulator { ++ regulators { + compatible = "mediatek,mt6397-regulator"; + + mt6397_vpca15_reg: buck_vpca15 { +@@ -1092,7 +1092,7 @@ + }; + }; + +- rtc: mt6397rtc { ++ rtc: rtc { + compatible = "mediatek,mt6397-rtc"; + }; + +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch b/queue-5.15/arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch new file mode 100644 index 0000000000..b13e03e08d --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch @@ -0,0 +1,214 @@ +From 687ee54d066d3fca816d2314fc5a26dcbf89bd88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 13:24:20 +0800 +Subject: arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property + +From: Chen-Yu Tsai + +[ Upstream commit a6d5983e40f5d5b219337569cdd269727f5a3e2e ] + +The "regulator-compatible" property has been deprecated since 2012 in +commit 13511def87b9 ("regulator: deprecate regulator-compatible DT +property"), which is so old it's not even mentioned in the converted +regulator bindings YAML file. It is also not listed in the MT6397 +regulator bindings. Having them present produces a whole bunch of +validation errors: + + Unevaluated properties are not allowed ('regulator-compatible' was unexpected) + +Drop the "regulator-compatible" property from the board dts. The +property values are the same as the node name, so everything should +continue to work. + +Fixes: 16ea61fc5614 ("arm64: dts: mt8173-evb: Add PMIC support") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241211052427.4178367-3-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 23 --------------------- + 1 file changed, 23 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts +index 4e0c3aa264a5c..cd52926190470 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts +@@ -311,7 +311,6 @@ + compatible = "mediatek,mt6397-regulator"; + + mt6397_vpca15_reg: buck_vpca15 { +- regulator-compatible = "buck_vpca15"; + regulator-name = "vpca15"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -320,7 +319,6 @@ + }; + + mt6397_vpca7_reg: buck_vpca7 { +- regulator-compatible = "buck_vpca7"; + regulator-name = "vpca7"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -329,7 +327,6 @@ + }; + + mt6397_vsramca15_reg: buck_vsramca15 { +- regulator-compatible = "buck_vsramca15"; + regulator-name = "vsramca15"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -338,7 +335,6 @@ + }; + + mt6397_vsramca7_reg: buck_vsramca7 { +- regulator-compatible = "buck_vsramca7"; + regulator-name = "vsramca7"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -347,7 +343,6 @@ + }; + + mt6397_vcore_reg: buck_vcore { +- regulator-compatible = "buck_vcore"; + regulator-name = "vcore"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -356,7 +351,6 @@ + }; + + mt6397_vgpu_reg: buck_vgpu { +- regulator-compatible = "buck_vgpu"; + regulator-name = "vgpu"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -365,7 +359,6 @@ + }; + + mt6397_vdrm_reg: buck_vdrm { +- regulator-compatible = "buck_vdrm"; + regulator-name = "vdrm"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <1400000>; +@@ -374,7 +367,6 @@ + }; + + mt6397_vio18_reg: buck_vio18 { +- regulator-compatible = "buck_vio18"; + regulator-name = "vio18"; + regulator-min-microvolt = <1620000>; + regulator-max-microvolt = <1980000>; +@@ -383,19 +375,16 @@ + }; + + mt6397_vtcxo_reg: ldo_vtcxo { +- regulator-compatible = "ldo_vtcxo"; + regulator-name = "vtcxo"; + regulator-always-on; + }; + + mt6397_va28_reg: ldo_va28 { +- regulator-compatible = "ldo_va28"; + regulator-name = "va28"; + regulator-always-on; + }; + + mt6397_vcama_reg: ldo_vcama { +- regulator-compatible = "ldo_vcama"; + regulator-name = "vcama"; + regulator-min-microvolt = <1500000>; + regulator-max-microvolt = <2800000>; +@@ -403,18 +392,15 @@ + }; + + mt6397_vio28_reg: ldo_vio28 { +- regulator-compatible = "ldo_vio28"; + regulator-name = "vio28"; + regulator-always-on; + }; + + mt6397_vusb_reg: ldo_vusb { +- regulator-compatible = "ldo_vusb"; + regulator-name = "vusb"; + }; + + mt6397_vmc_reg: ldo_vmc { +- regulator-compatible = "ldo_vmc"; + regulator-name = "vmc"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; +@@ -422,7 +408,6 @@ + }; + + mt6397_vmch_reg: ldo_vmch { +- regulator-compatible = "ldo_vmch"; + regulator-name = "vmch"; + regulator-min-microvolt = <3000000>; + regulator-max-microvolt = <3300000>; +@@ -430,7 +415,6 @@ + }; + + mt6397_vemc_3v3_reg: ldo_vemc3v3 { +- regulator-compatible = "ldo_vemc3v3"; + regulator-name = "vemc_3v3"; + regulator-min-microvolt = <3000000>; + regulator-max-microvolt = <3300000>; +@@ -438,7 +422,6 @@ + }; + + mt6397_vgp1_reg: ldo_vgp1 { +- regulator-compatible = "ldo_vgp1"; + regulator-name = "vcamd"; + regulator-min-microvolt = <1220000>; + regulator-max-microvolt = <3300000>; +@@ -446,7 +429,6 @@ + }; + + mt6397_vgp2_reg: ldo_vgp2 { +- regulator-compatible = "ldo_vgp2"; + regulator-name = "vcamio"; + regulator-min-microvolt = <1000000>; + regulator-max-microvolt = <3300000>; +@@ -454,7 +436,6 @@ + }; + + mt6397_vgp3_reg: ldo_vgp3 { +- regulator-compatible = "ldo_vgp3"; + regulator-name = "vcamaf"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3300000>; +@@ -462,7 +443,6 @@ + }; + + mt6397_vgp4_reg: ldo_vgp4 { +- regulator-compatible = "ldo_vgp4"; + regulator-name = "vgp4"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3300000>; +@@ -470,7 +450,6 @@ + }; + + mt6397_vgp5_reg: ldo_vgp5 { +- regulator-compatible = "ldo_vgp5"; + regulator-name = "vgp5"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3000000>; +@@ -478,7 +457,6 @@ + }; + + mt6397_vgp6_reg: ldo_vgp6 { +- regulator-compatible = "ldo_vgp6"; + regulator-name = "vgp6"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3300000>; +@@ -486,7 +464,6 @@ + }; + + mt6397_vibr_reg: ldo_vibr { +- regulator-compatible = "ldo_vibr"; + regulator-name = "vibr"; + regulator-min-microvolt = <1300000>; + regulator-max-microvolt = <3300000>; +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch b/queue-5.15/arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch new file mode 100644 index 0000000000..4757e09a56 --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch @@ -0,0 +1,40 @@ +From 12fe1dbe37dde7aa194ad2e38ec3e55e58e0f967 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:26:13 +0800 +Subject: arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names + +From: Chen-Yu Tsai + +[ Upstream commit 9545ba142865b9099d43c972b9ebcf463606499a ] + +The MT6397 PMIC bindings specify exact names for its sub-nodes. The +names used in the current dts don't match, causing a validation error. + +Fix up the names. Also drop the label for the regulators node, since +any reference should be against the individual regulator sub-nodes. + +Fixes: 16ea61fc5614 ("arm64: dts: mt8173-evb: Add PMIC support") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20241210092614.3951748-2-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts +index cd52926190470..52b56069c51d6 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts +@@ -307,7 +307,7 @@ + interrupt-controller; + #interrupt-cells = <2>; + +- mt6397regulator: mt6397regulator { ++ regulators { + compatible = "mediatek,mt6397-regulator"; + + mt6397_vpca15_reg: buck_vpca15 { +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8183-kenzo-support-second-sourc.patch b/queue-5.15/arm64-dts-mediatek-mt8183-kenzo-support-second-sourc.patch new file mode 100644 index 0000000000..b3a3beb2cc --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8183-kenzo-support-second-sourc.patch @@ -0,0 +1,47 @@ +From a57d9c6f293c43f7f59a62e58e71f5d9f7e434af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 05:27:47 +0000 +Subject: arm64: dts: mediatek: mt8183: kenzo: Support second source + touchscreen + +From: Hsin-Te Yuan + +[ Upstream commit 5ec5dc73c5ac0c6e06803dc3b5aea4493e856568 ] + +Some kenzo devices use second source touchscreen. + +Fixes: 0a9cefe21aec ("arm64: dts: mt8183: Add kukui-jacuzzi-kenzo board") +Signed-off-by: Hsin-Te Yuan +Link: https://lore.kernel.org/r/20241213-touchscreen-v3-1-7c1f670913f9@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + .../dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts +index 6f1aa692753ad..a477e2cce2048 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts +@@ -10,3 +10,18 @@ + model = "Google kenzo sku17 board"; + compatible = "google,juniper-sku17", "google,juniper", "mediatek,mt8183"; + }; ++ ++&i2c0 { ++ touchscreen@40 { ++ compatible = "hid-over-i2c"; ++ reg = <0x40>; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&touchscreen_pins>; ++ ++ interrupts-extended = <&pio 155 IRQ_TYPE_LEVEL_LOW>; ++ ++ post-power-on-delay-ms = <70>; ++ hid-descr-addr = <0x0001>; ++ }; ++}; +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8183-kukui-jacuzzi-drop-pp3300_.patch b/queue-5.15/arm64-dts-mediatek-mt8183-kukui-jacuzzi-drop-pp3300_.patch new file mode 100644 index 0000000000..ccb746a5f5 --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8183-kukui-jacuzzi-drop-pp3300_.patch @@ -0,0 +1,41 @@ +From 60d902463fb6d14931e6346c84b1ca8244fce3e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2024 15:02:20 +0800 +Subject: arm64: dts: mediatek: mt8183-kukui-jacuzzi: Drop pp3300_panel voltage + settings + +From: Chen-Yu Tsai + +[ Upstream commit 0b5b1c881a909f17c05ef4b1ccb421e077f6e466 ] + +The pp3300_panel fixed regulator is just a load switch. It does not have +any regulating capabilities. Thus having voltage constraints on it is +wrong. + +Remove the voltage constraints. + +Fixes: cabc71b08eb5 ("arm64: dts: mt8183: Add kukui-jacuzzi-damu board") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20241030070224.1006331-2-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +index f19bf2834b390..3fa491dc52021 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +@@ -39,8 +39,6 @@ + pp3300_panel: pp3300-panel { + compatible = "regulator-fixed"; + regulator-name = "pp3300_panel"; +- regulator-min-microvolt = <3300000>; +- regulator-max-microvolt = <3300000>; + pinctrl-names = "default"; + pinctrl-0 = <&pp3300_panel_pins>; + +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8183-willow-support-second-sour.patch b/queue-5.15/arm64-dts-mediatek-mt8183-willow-support-second-sour.patch new file mode 100644 index 0000000000..0c594628ea --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8183-willow-support-second-sour.patch @@ -0,0 +1,50 @@ +From bb0b9e82a90252a01472e695dc903d8f8a908c35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 05:27:48 +0000 +Subject: arm64: dts: mediatek: mt8183: willow: Support second source + touchscreen + +From: Hsin-Te Yuan + +[ Upstream commit 9594935260d76bffe200bea6cfab6ba0752e70d9 ] + +Some willow devices use second source touchscreen. + +Fixes: f006bcf1c972 ("arm64: dts: mt8183: Add kukui-jacuzzi-willow board") +Signed-off-by: Hsin-Te Yuan +Link: https://lore.kernel.org/r/20241213-touchscreen-v3-2-7c1f670913f9@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + .../dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi +index 76d33540166f9..c942e461a177e 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi +@@ -6,6 +6,21 @@ + /dts-v1/; + #include "mt8183-kukui-jacuzzi.dtsi" + ++&i2c0 { ++ touchscreen@40 { ++ compatible = "hid-over-i2c"; ++ reg = <0x40>; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&touchscreen_pins>; ++ ++ interrupts-extended = <&pio 155 IRQ_TYPE_LEVEL_LOW>; ++ ++ post-power-on-delay-ms = <70>; ++ hid-descr-addr = <0x0001>; ++ }; ++}; ++ + &i2c2 { + trackpad@2c { + compatible = "hid-over-i2c"; +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8516-add-i2c-clock-div-property.patch b/queue-5.15/arm64-dts-mediatek-mt8516-add-i2c-clock-div-property.patch new file mode 100644 index 0000000000..01c901803a --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8516-add-i2c-clock-div-property.patch @@ -0,0 +1,74 @@ +From 0d73d5d81f9a8b61f212079b861b89ad99ba62b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2024 16:05:06 -0300 +Subject: arm64: dts: mediatek: mt8516: add i2c clock-div property + +From: Val Packett + +[ Upstream commit eb72341fd92b7af510d236e5a8554d855ed38d3c ] + +Move the clock-div property from the pumpkin board dtsi to the SoC's +since it belongs to the SoC itself and is required on other devices. + +Fixes: 5236347bde42 ("arm64: dts: mediatek: add dtsi for MT8516") +Signed-off-by: Val Packett +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241204190524.21862-4-val@packett.cool +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516.dtsi | 3 +++ + arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi | 2 -- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +index 558f7e744113d..0b86863381cf3 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +@@ -345,6 +345,7 @@ + reg = <0 0x11009000 0 0x90>, + <0 0x11000180 0 0x80>; + interrupts = ; ++ clock-div = <2>; + clocks = <&topckgen CLK_TOP_I2C0>, + <&topckgen CLK_TOP_APDMA>; + clock-names = "main", "dma"; +@@ -359,6 +360,7 @@ + reg = <0 0x1100a000 0 0x90>, + <0 0x11000200 0 0x80>; + interrupts = ; ++ clock-div = <2>; + clocks = <&topckgen CLK_TOP_I2C1>, + <&topckgen CLK_TOP_APDMA>; + clock-names = "main", "dma"; +@@ -373,6 +375,7 @@ + reg = <0 0x1100b000 0 0x90>, + <0 0x11000280 0 0x80>; + interrupts = ; ++ clock-div = <2>; + clocks = <&topckgen CLK_TOP_I2C2>, + <&topckgen CLK_TOP_APDMA>; + clock-names = "main", "dma"; +diff --git a/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi b/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi +index 54514d62398f2..8696da3de4cbe 100644 +--- a/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi ++++ b/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi +@@ -48,7 +48,6 @@ + }; + + &i2c0 { +- clock-div = <2>; + pinctrl-names = "default"; + pinctrl-0 = <&i2c0_pins_a>; + status = "okay"; +@@ -157,7 +156,6 @@ + }; + + &i2c2 { +- clock-div = <2>; + pinctrl-names = "default"; + pinctrl-0 = <&i2c2_pins_a>; + status = "okay"; +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8516-fix-gicv2-range.patch b/queue-5.15/arm64-dts-mediatek-mt8516-fix-gicv2-range.patch new file mode 100644 index 0000000000..9ff2a9eee1 --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8516-fix-gicv2-range.patch @@ -0,0 +1,44 @@ +From f6e0c04abdfbfea3761f97d4d630262f022a60e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2024 16:05:04 -0300 +Subject: arm64: dts: mediatek: mt8516: fix GICv2 range + +From: Val Packett + +[ Upstream commit e3ee31e4409f051c021a30122f3c470f093a7386 ] + +On the MT8167 which is based on the MT8516 DTS, the following error +was appearing on boot, breaking interrupt operation: + +GICv2 detected, but range too small and irqchip.gicv2_force_probe not set + +Similar to what's been proposed for MT7622 which has the same issue, +fix by using the range reported by force_probe. + +Link: https://lore.kernel.org/all/YmhNSLgp%2Fyg8Vr1F@makrotopia.org/ +Fixes: 5236347bde42 ("arm64: dts: mediatek: add dtsi for MT8516") +Signed-off-by: Val Packett +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241204190524.21862-2-val@packett.cool +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +index bbe5a1419effc..198a6c747a296 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +@@ -269,7 +269,7 @@ + interrupt-parent = <&gic>; + interrupt-controller; + reg = <0 0x10310000 0 0x1000>, +- <0 0x10320000 0 0x1000>, ++ <0 0x1032f000 0 0x2000>, + <0 0x10340000 0 0x2000>, + <0 0x10360000 0 0x2000>; + interrupts = +Date: Wed, 4 Dec 2024 16:05:05 -0300 +Subject: arm64: dts: mediatek: mt8516: fix wdt irq type + +From: Val Packett + +[ Upstream commit 03a80442030e7147391738fb6cbe5fa0b3b91bb1 ] + +The GICv2 does not support EDGE_FALLING interrupts, so the watchdog +would refuse to attach due to a failing check coming from the GIC driver. + +Fixes: 5236347bde42 ("arm64: dts: mediatek: add dtsi for MT8516") +Signed-off-by: Val Packett +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241204190524.21862-3-val@packett.cool +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +index 198a6c747a296..4d6c22e84540b 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +@@ -206,7 +206,7 @@ + compatible = "mediatek,mt8516-wdt", + "mediatek,mt6589-wdt"; + reg = <0 0x10007000 0 0x1000>; +- interrupts = ; ++ interrupts = ; + #reset-cells = <1>; + }; + +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8516-remove-2-invalid-i2c-clock.patch b/queue-5.15/arm64-dts-mediatek-mt8516-remove-2-invalid-i2c-clock.patch new file mode 100644 index 0000000000..4127fda136 --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8516-remove-2-invalid-i2c-clock.patch @@ -0,0 +1,80 @@ +From 2b7febb1f86e2e45e9d3c4ec3fd6f3f49587c1c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 20:35:20 +0100 +Subject: arm64: dts: mediatek: mt8516: remove 2 invalid i2c clocks + +From: Fabien Parent + +[ Upstream commit 9cf6a26ae352a6a150662c0c4ddff87664cc6e3c ] + +The two clocks "main-source" and "main-sel" are not present in the +driver and not defined in the binding documentation. Remove them +as they are not used and not described in the documentation. + +Signed-off-by: Fabien Parent +Link: https://lore.kernel.org/r/20211110193520.488-1-fparent@baylibre.com +Signed-off-by: Matthias Brugger +Stable-dep-of: eb72341fd92b ("arm64: dts: mediatek: mt8516: add i2c clock-div property") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516.dtsi | 27 ++++++------------------ + 1 file changed, 6 insertions(+), 21 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +index 4d6c22e84540b..558f7e744113d 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +@@ -345,14 +345,9 @@ + reg = <0 0x11009000 0 0x90>, + <0 0x11000180 0 0x80>; + interrupts = ; +- clocks = <&topckgen CLK_TOP_AHB_INFRA_D2>, +- <&infracfg CLK_IFR_I2C0_SEL>, +- <&topckgen CLK_TOP_I2C0>, ++ clocks = <&topckgen CLK_TOP_I2C0>, + <&topckgen CLK_TOP_APDMA>; +- clock-names = "main-source", +- "main-sel", +- "main", +- "dma"; ++ clock-names = "main", "dma"; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +@@ -364,14 +359,9 @@ + reg = <0 0x1100a000 0 0x90>, + <0 0x11000200 0 0x80>; + interrupts = ; +- clocks = <&topckgen CLK_TOP_AHB_INFRA_D2>, +- <&infracfg CLK_IFR_I2C1_SEL>, +- <&topckgen CLK_TOP_I2C1>, ++ clocks = <&topckgen CLK_TOP_I2C1>, + <&topckgen CLK_TOP_APDMA>; +- clock-names = "main-source", +- "main-sel", +- "main", +- "dma"; ++ clock-names = "main", "dma"; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +@@ -383,14 +373,9 @@ + reg = <0 0x1100b000 0 0x90>, + <0 0x11000280 0 0x80>; + interrupts = ; +- clocks = <&topckgen CLK_TOP_AHB_INFRA_D2>, +- <&infracfg CLK_IFR_I2C2_SEL>, +- <&topckgen CLK_TOP_I2C2>, ++ clocks = <&topckgen CLK_TOP_I2C2>, + <&topckgen CLK_TOP_APDMA>; +- clock-names = "main-source", +- "main-sel", +- "main", +- "dma"; ++ clock-names = "main", "dma"; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8516-reserve-192-kib-for-tf-a.patch b/queue-5.15/arm64-dts-mediatek-mt8516-reserve-192-kib-for-tf-a.patch new file mode 100644 index 0000000000..b71751691c --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8516-reserve-192-kib-for-tf-a.patch @@ -0,0 +1,43 @@ +From a265e93c5d6f82c806f957e9c81190148f96e8ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2024 16:05:07 -0300 +Subject: arm64: dts: mediatek: mt8516: reserve 192 KiB for TF-A + +From: Val Packett + +[ Upstream commit 2561c7d5d497b988deccc36fe5eac7fd50b937f8 ] + +The Android DTB for the related MT8167 reserves 0x30000. This is likely +correct for MT8516 Android devices as well, and there's never any harm +in reserving 64KiB more. + +Fixes: 5236347bde42 ("arm64: dts: mediatek: add dtsi for MT8516") +Signed-off-by: Val Packett +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241204190524.21862-5-val@packett.cool +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8516.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +index 0b86863381cf3..5655f12723f14 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi +@@ -144,10 +144,10 @@ + #size-cells = <2>; + ranges; + +- /* 128 KiB reserved for ARM Trusted Firmware (BL31) */ ++ /* 192 KiB reserved for ARM Trusted Firmware (BL31) */ + bl31_secmon_reserved: secmon@43000000 { + no-map; +- reg = <0 0x43000000 0 0x20000>; ++ reg = <0 0x43000000 0 0x30000>; + }; + }; + +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-mt8183-set-dmic-one-wire-mode-on-damu.patch b/queue-5.15/arm64-dts-mt8183-set-dmic-one-wire-mode-on-damu.patch new file mode 100644 index 0000000000..e5105865bb --- /dev/null +++ b/queue-5.15/arm64-dts-mt8183-set-dmic-one-wire-mode-on-damu.patch @@ -0,0 +1,41 @@ +From 43c5a789d260cba195d0846c957fd754f63f019f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2024 16:16:53 +0800 +Subject: arm64: dts: mt8183: set DMIC one-wire mode on Damu + +From: Hsin-Yi Wang + +[ Upstream commit 6c379e8b984815fc8f876e4bc78c4d563f13ddae ] + +Sets DMIC one-wire mode on Damu. + +Fixes: cabc71b08eb5 ("arm64: dts: mt8183: Add kukui-jacuzzi-damu board") +Signed-off-by: Hsin-Yi Wang +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hsin-Te Yuan +Reviewed-by: Matthias Brugger +Link: https://lore.kernel.org/r/20241113-damu-v4-1-6911b69610dd@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts +index 8e0cba4d23726..9a35c65779962 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts +@@ -25,6 +25,10 @@ + hid-descr-addr = <0x0001>; + }; + ++&mt6358codec { ++ mediatek,dmic-mode = <1>; /* one-wire */ ++}; ++ + &qca_wifi { + qcom,ath10k-calibration-variant = "GO_DAMU"; + }; +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-qcom-msm8916-correct-sleep-clock-frequency.patch b/queue-5.15/arm64-dts-qcom-msm8916-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..618d436b88 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8916-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From ac7662f4782329b409dfb988455bdd1c5375a372 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:00 +0200 +Subject: arm64: dts: qcom: msm8916: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit f088b921890cef28862913e5627bb2e2b5f82125 ] + +The MSM8916 platform uses PM8916 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: f4fb6aeafaaa ("arm64: dts: qcom: msm8916: Add fixed rate on-board oscillators") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-1-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index 668674059d485..79d5f1433800f 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -105,7 +105,7 @@ + sleep_clk: sleep-clk { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <32768>; ++ clock-frequency = <32764>; + }; + }; + +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-qcom-msm8994-correct-sleep-clock-frequency.patch b/queue-5.15/arm64-dts-qcom-msm8994-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..5da25f2b06 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8994-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From 9feedc419c279ce90ea54fc7237db21903f328b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:02 +0200 +Subject: arm64: dts: qcom: msm8994: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit a4148d869d47d8c86da0291dd95d411a5ebe90c8 ] + +The MSM8994 platform uses PM8994/6 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: feeaf56ac78d ("arm64: dts: msm8994 SoC and Huawei Angler (Nexus 6P) support") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-3-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi +index fafeb790c5c59..1ae2fbef90582 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi +@@ -25,7 +25,7 @@ + sleep_clk: sleep-clk { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <32768>; ++ clock-frequency = <32764>; + clock-output-names = "sleep_clk"; + }; + }; +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-qcom-msm8994-describe-usb-interrupts.patch b/queue-5.15/arm64-dts-qcom-msm8994-describe-usb-interrupts.patch new file mode 100644 index 0000000000..3d8909ad3b --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8994-describe-usb-interrupts.patch @@ -0,0 +1,44 @@ +From d94593a7107a9c4f36ecca04cdc4cd40a7347fcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Nov 2024 23:12:48 +0100 +Subject: arm64: dts: qcom: msm8994: Describe USB interrupts + +From: Konrad Dybcio + +[ Upstream commit c910544d2234709660d60f80345c285616e73b1c ] + +Previously the interrupt lanes were not described, fix that. + +Fixes: d9be0bc95f25 ("arm64: dts: qcom: msm8994: Add USB support") +Signed-off-by: Konrad Dybcio +Tested-by: Petr Vorel +Link: https://lore.kernel.org/r/20241129-topic-qcom_usb_dtb_fixup-v1-4-cba24120c058@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994.dtsi | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi +index 4447ed146b3ac..fafeb790c5c59 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi +@@ -419,6 +419,15 @@ + #size-cells = <1>; + ranges; + ++ interrupts = , ++ , ++ , ++ ; ++ interrupt-names = "pwr_event", ++ "qusb2_phy", ++ "hs_phy_irq", ++ "ss_phy_irq"; ++ + clocks = <&gcc GCC_USB30_MASTER_CLK>, + <&gcc GCC_SYS_NOC_USB3_AXI_CLK>, + <&gcc GCC_USB30_SLEEP_CLK>, +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-qcom-msm8996-fix-up-usb3-interrupts.patch b/queue-5.15/arm64-dts-qcom-msm8996-fix-up-usb3-interrupts.patch new file mode 100644 index 0000000000..d44eed2111 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8996-fix-up-usb3-interrupts.patch @@ -0,0 +1,49 @@ +From d6158048607d8fe3443b6ad5965fcd982c0e16eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Nov 2024 23:12:47 +0100 +Subject: arm64: dts: qcom: msm8996: Fix up USB3 interrupts + +From: Konrad Dybcio + +[ Upstream commit 9cb9c9f4e1380da317a056afd26d66a835c5796c ] + +Add the missing interrupt lines and fix qusb2_phy being an impostor +of hs_phy_irq. + +This happens to also fix warnings such as: + +usb@6af8800: interrupt-names: ['hs_phy_irq', 'ss_phy_irq'] is too short + +Fixes: 4753492de9df ("arm64: dts: qcom: msm8996: Add usb3 interrupts") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20241129-topic-qcom_usb_dtb_fixup-v1-3-cba24120c058@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 9ee8eebfcdb51..ec0f067a6a5d5 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -2608,9 +2608,14 @@ + #size-cells = <1>; + ranges; + +- interrupts = , ++ interrupts = , ++ , ++ , + ; +- interrupt-names = "hs_phy_irq", "ss_phy_irq"; ++ interrupt-names = "pwr_event", ++ "qusb2_phy", ++ "hs_phy_irq", ++ "ss_phy_irq"; + + clocks = <&gcc GCC_SYS_NOC_USB3_AXI_CLK>, + <&gcc GCC_USB30_MASTER_CLK>, +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-qcom-sc7280-correct-sleep-clock-frequency.patch b/queue-5.15/arm64-dts-qcom-sc7280-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..cfcc38254b --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sc7280-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From 9a9c376b12dca5a6f73022c943d20891adbb6c12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:07 +0200 +Subject: arm64: dts: qcom: sc7280: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit f6ccdca14eac545320ab03d6ca91ca343e7372e5 ] + +The SC7280 platform uses PMK8350 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: 7a1f4e7f740d ("arm64: dts: qcom: sc7280: Add basic dts/dtsi files for sc7280 soc") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-8-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index 929fc0667e985..c65f3c9a6673f 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -39,7 +39,7 @@ + + sleep_clk: sleep-clk { + compatible = "fixed-clock"; +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + #clock-cells = <0>; + }; + }; +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-qcom-sdm845-fix-interrupt-types-of-camss-i.patch b/queue-5.15/arm64-dts-qcom-sdm845-fix-interrupt-types-of-camss-i.patch new file mode 100644 index 0000000000..6e4105b31e --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sdm845-fix-interrupt-types-of-camss-i.patch @@ -0,0 +1,56 @@ +From 3c921d087f9c86409f232b1eab310d2b9b03cd35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 14:29:49 +0200 +Subject: arm64: dts: qcom: sdm845: Fix interrupt types of camss interrupts + +From: Vladimir Zapolskiy + +[ Upstream commit cb96722b728e81ad97f5b5b20dea64cd294a5452 ] + +Qualcomm IP catalog says that all CAMSS interrupts is edge rising, +fix it in the CAMSS device tree node for sdm845 SoC. + +Fixes: d48a6698a6b7 ("arm64: dts: qcom: sdm845: Add CAMSS ISP node") +Signed-off-by: Vladimir Zapolskiy +Reviewed-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20241127122950.885982-6-vladimir.zapolskiy@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index cff5423e9c88d..69212445d22c9 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -3948,16 +3948,16 @@ + "vfe1", + "vfe_lite"; + +- interrupts = , +- , +- , +- , +- , +- , +- , +- , +- , +- ; ++ interrupts = , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ ; + interrupt-names = "csid0", + "csid1", + "csid2", +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-qcom-sm6125-correct-sleep-clock-frequency.patch b/queue-5.15/arm64-dts-qcom-sm6125-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..7feedbf103 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sm6125-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From d20830efe30b2e0e0e7668a25e9720ea2d0a1e07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:10 +0200 +Subject: arm64: dts: qcom: sm6125: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit b3c547e1507862f0e4d46432b665c5c6e61e14d6 ] + +The SM6125 platform uses PM6125 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: cff4bbaf2a2d ("arm64: dts: qcom: Add support for SM6125") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-11-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6125.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6125.dtsi b/arch/arm64/boot/dts/qcom/sm6125.dtsi +index 2e4fe2bc1e0a8..0f6a9a5cbe178 100644 +--- a/arch/arm64/boot/dts/qcom/sm6125.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6125.dtsi +@@ -27,7 +27,7 @@ + sleep_clk: sleep-clk { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + clock-output-names = "sleep_clk"; + }; + }; +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-qcom-sm8150-microsoft-surface-duo-fix-typo.patch b/queue-5.15/arm64-dts-qcom-sm8150-microsoft-surface-duo-fix-typo.patch new file mode 100644 index 0000000000..5984d80464 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sm8150-microsoft-surface-duo-fix-typo.patch @@ -0,0 +1,53 @@ +From e8a76a6afd6693b2daa8c12b680be829b4fda20c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 13:44:49 +0100 +Subject: arm64: dts: qcom: sm8150-microsoft-surface-duo: fix typos in da7280 + properties + +From: Neil Armstrong + +[ Upstream commit 9875adffb87da5c40f4013e55104f5e2fc071c2a ] + +The dlg,const-op-mode & dlg,periodic-op-mode were mis-names with twice +the "dlg," prefix, drop one to match the bindings. + +This fixes: +sm8150-microsoft-surface-duo.dtb: da7280@4a: 'dlg,const-op-mode' is a required property + from schema $id: http://devicetree.org/schemas/input/dlg,da7280.yaml# +m8150-microsoft-surface-duo.dtb: da7280@4a: 'dlg,periodic-op-mode' is a required property + from schema $id: http://devicetree.org/schemas/input/dlg,da7280.yaml# +sm8150-microsoft-surface-duo.dtb: da7280@4a: 'dlg,dlg,const-op-mode', 'dlg,dlg,periodic-op-mode' do not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/input/dlg,da7280.yaml# + +With the dlg,da7280.yaml converted from dlg,da7280.txt at [1]. + +[1] https://lore.kernel.org/all/20241206-topic-misc-da7280-convert-v2-1-1c3539f75604@linaro.org/ + +Fixes: d1f781db47a8 ("arm64: dts: qcom: add initial device-tree for Microsoft Surface Duo") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20241230-topic-misc-dt-fixes-v4-6-1e6880e9dda3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts b/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts +index 736da9af44e08..b233b56d4bbd0 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts ++++ b/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts +@@ -375,8 +375,8 @@ + pinctrl-0 = <&da7280_intr_default>; + + dlg,actuator-type = "LRA"; +- dlg,dlg,const-op-mode = <1>; +- dlg,dlg,periodic-op-mode = <1>; ++ dlg,const-op-mode = <1>; ++ dlg,periodic-op-mode = <1>; + dlg,nom-microvolt = <2000000>; + dlg,abs-max-microvolt = <2000000>; + dlg,imax-microamp = <129000>; +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-qcom-sm8250-correct-sleep-clock-frequency.patch b/queue-5.15/arm64-dts-qcom-sm8250-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..67f45d9819 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sm8250-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From e89df7f2800771a26ef0c242bea2b9aca3e54dc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:12 +0200 +Subject: arm64: dts: qcom: sm8250: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit 75420e437eed69fa95d1d7c339dad86dea35319a ] + +The SM8250 platform uses PM8150 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: 9ff8b0591fcf ("arm64: dts: qcom: sm8250: use the right clock-freqency for sleep-clk") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-13-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index 99afdd1ad7c6e..bf91e0acd435f 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -82,7 +82,7 @@ + + sleep_clk: sleep-clk { + compatible = "fixed-clock"; +- clock-frequency = <32768>; ++ clock-frequency = <32764>; + #clock-cells = <0>; + }; + }; +-- +2.39.5 + diff --git a/queue-5.15/arm64-dts-qcom-sm8350-correct-sleep-clock-frequency.patch b/queue-5.15/arm64-dts-qcom-sm8350-correct-sleep-clock-frequency.patch new file mode 100644 index 0000000000..5d3a6c1b0e --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sm8350-correct-sleep-clock-frequency.patch @@ -0,0 +1,38 @@ +From 2e4d0235409877dde4c55207682b8d9137aa8926 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:17:13 +0200 +Subject: arm64: dts: qcom: sm8350: correct sleep clock frequency + +From: Dmitry Baryshkov + +[ Upstream commit f4cc8c75cfc5d06084a31da2ff67e477565f0cae ] + +The SM8350 platform uses PMK8350 to provide sleep clock. According to the +documentation, that clock has 32.7645 kHz frequency. Correct the sleep +clock definition. + +Fixes: b7e8f433a673 ("arm64: dts: qcom: Add basic devicetree support for SM8350 SoC") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-14-e9b08fbeadd3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi +index 8506dc841c869..f873c9b50db2c 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi +@@ -32,7 +32,7 @@ + + sleep_clk: sleep-clk { + compatible = "fixed-clock"; +- clock-frequency = <32000>; ++ clock-frequency = <32764>; + #clock-cells = <0>; + }; + +-- +2.39.5 + diff --git a/queue-5.15/asoc-renesas-rz-ssi-use-only-the-proper-amount-of-di.patch b/queue-5.15/asoc-renesas-rz-ssi-use-only-the-proper-amount-of-di.patch new file mode 100644 index 0000000000..7f973e0c84 --- /dev/null +++ b/queue-5.15/asoc-renesas-rz-ssi-use-only-the-proper-amount-of-di.patch @@ -0,0 +1,41 @@ +From cb539eaac02cd4f13645a150ad95cd894ab1a355 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 19:09:34 +0200 +Subject: ASoC: renesas: rz-ssi: Use only the proper amount of dividers + +From: Claudiu Beznea + +[ Upstream commit 55c209cd4318c701e6e88e0b2512a0f12dd02a7d ] + +There is no need to populate the ckdv[] with invalid dividers as that +part will not be indexed anyway. The ssi->audio_mck/bclk_rate should +always be >= 0. While at it, change the ckdv type as u8, as the divider +128 was previously using the s8 sign bit. + +Signed-off-by: Claudiu Beznea +Fixes: 03e786bd43410fa9 ("ASoC: sh: Add RZ/G2L SSIF-2 driver") +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20241210170953.2936724-6-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rz-ssi.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c +index 2e33a1fa0a6f4..9ef7d0a12d985 100644 +--- a/sound/soc/sh/rz-ssi.c ++++ b/sound/soc/sh/rz-ssi.c +@@ -243,8 +243,7 @@ static void rz_ssi_stream_quit(struct rz_ssi_priv *ssi, + static int rz_ssi_clk_setup(struct rz_ssi_priv *ssi, unsigned int rate, + unsigned int channels) + { +- static s8 ckdv[16] = { 1, 2, 4, 8, 16, 32, 64, 128, +- 6, 12, 24, 48, 96, -1, -1, -1 }; ++ static u8 ckdv[] = { 1, 2, 4, 8, 16, 32, 64, 128, 6, 12, 24, 48, 96 }; + unsigned int channel_bits = 32; /* System Word Length */ + unsigned long bclk_rate = rate * channels * channel_bits; + unsigned int div; +-- +2.39.5 + diff --git a/queue-5.15/asoc-sun4i-spdif-add-clock-multiplier-settings.patch b/queue-5.15/asoc-sun4i-spdif-add-clock-multiplier-settings.patch new file mode 100644 index 0000000000..01c2042220 --- /dev/null +++ b/queue-5.15/asoc-sun4i-spdif-add-clock-multiplier-settings.patch @@ -0,0 +1,86 @@ +From 4f406536400eda16745d37ced1cda17a97ff5033 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 17:55:29 +0100 +Subject: ASoC: sun4i-spdif: Add clock multiplier settings + +From: George Lander + +[ Upstream commit 0a2319308de88b9e819c0b43d0fccd857123eb31 ] + +There have been intermittent issues with the SPDIF output on H3 +and H2+ devices which has been fixed by setting the s_clk to 4 +times the audio pll. +Add a quirk for the clock multiplier as not every supported SoC +requires it. Without the multiplier, the audio at normal sampling +rates was distorted and did not play at higher sampling rates. + +Fixes: 1bd92af877ab ("ASoC: sun4i-spdif: Add support for the H3 SoC") +Signed-off-by: George Lander +Signed-off-by: Marcus Cooper +Link: https://patch.msgid.link/20241111165600.57219-2-codekipper@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun4i-spdif.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c +index dd8d13f3fd121..e885af039b92f 100644 +--- a/sound/soc/sunxi/sun4i-spdif.c ++++ b/sound/soc/sunxi/sun4i-spdif.c +@@ -175,6 +175,7 @@ struct sun4i_spdif_quirks { + unsigned int reg_dac_txdata; + bool has_reset; + unsigned int val_fctl_ftx; ++ unsigned int mclk_multiplier; + }; + + struct sun4i_spdif_dev { +@@ -311,6 +312,7 @@ static int sun4i_spdif_hw_params(struct snd_pcm_substream *substream, + default: + return -EINVAL; + } ++ mclk *= host->quirks->mclk_multiplier; + + ret = clk_set_rate(host->spdif_clk, mclk); + if (ret < 0) { +@@ -345,6 +347,7 @@ static int sun4i_spdif_hw_params(struct snd_pcm_substream *substream, + default: + return -EINVAL; + } ++ mclk_div *= host->quirks->mclk_multiplier; + + reg_val = 0; + reg_val |= SUN4I_SPDIF_TXCFG_ASS; +@@ -427,24 +430,28 @@ static struct snd_soc_dai_driver sun4i_spdif_dai = { + static const struct sun4i_spdif_quirks sun4i_a10_spdif_quirks = { + .reg_dac_txdata = SUN4I_SPDIF_TXFIFO, + .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX, ++ .mclk_multiplier = 1, + }; + + static const struct sun4i_spdif_quirks sun6i_a31_spdif_quirks = { + .reg_dac_txdata = SUN4I_SPDIF_TXFIFO, + .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX, + .has_reset = true, ++ .mclk_multiplier = 1, + }; + + static const struct sun4i_spdif_quirks sun8i_h3_spdif_quirks = { + .reg_dac_txdata = SUN8I_SPDIF_TXFIFO, + .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX, + .has_reset = true, ++ .mclk_multiplier = 4, + }; + + static const struct sun4i_spdif_quirks sun50i_h6_spdif_quirks = { + .reg_dac_txdata = SUN8I_SPDIF_TXFIFO, + .val_fctl_ftx = SUN50I_H6_SPDIF_FCTL_FTX, + .has_reset = true, ++ .mclk_multiplier = 1, + }; + + static const struct of_device_id sun4i_spdif_of_match[] = { +-- +2.39.5 + diff --git a/queue-5.15/bgmac-reduce-max-frame-size-to-support-just-mtu-1500.patch b/queue-5.15/bgmac-reduce-max-frame-size-to-support-just-mtu-1500.patch new file mode 100644 index 0000000000..32d73793fb --- /dev/null +++ b/queue-5.15/bgmac-reduce-max-frame-size-to-support-just-mtu-1500.patch @@ -0,0 +1,73 @@ +From 055773b1dfdb05a2165b9bcc8d88ed6611c028a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jan 2025 09:51:59 -0800 +Subject: bgmac: reduce max frame size to support just MTU 1500 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 752e5fcc2e77358936d36ef8e522d6439372e201 ] + +bgmac allocates new replacement buffer before handling each received +frame. Allocating & DMA-preparing 9724 B each time consumes a lot of CPU +time. Ideally bgmac should just respect currently set MTU but it isn't +the case right now. For now just revert back to the old limited frame +size. + +This change bumps NAT masquerade speed by ~95%. + +Since commit 8218f62c9c9b ("mm: page_frag: use initial zero offset for +page_frag_alloc_align()"), the bgmac driver fails to open its network +interface successfully and runs out of memory in the following call +stack: + +bgmac_open + -> bgmac_dma_init + -> bgmac_dma_rx_skb_for_slot + -> netdev_alloc_frag + +BGMAC_RX_ALLOC_SIZE = 10048 and PAGE_FRAG_CACHE_MAX_SIZE = 32768. + +Eventually we land into __page_frag_alloc_align() with the following +parameters across multiple successive calls: + +__page_frag_alloc_align: fragsz=10048, align_mask=-1, size=32768, offset=0 +__page_frag_alloc_align: fragsz=10048, align_mask=-1, size=32768, offset=10048 +__page_frag_alloc_align: fragsz=10048, align_mask=-1, size=32768, offset=20096 +__page_frag_alloc_align: fragsz=10048, align_mask=-1, size=32768, offset=30144 + +So in that case we do indeed have offset + fragsz (40192) > size (32768) +and so we would eventually return NULL. Reverting to the older 1500 +bytes MTU allows the network driver to be usable again. + +Fixes: 8c7da63978f1 ("bgmac: configure MTU and add support for frames beyond 8192 byte size") +Signed-off-by: Rafał Miłecki +[florian: expand commit message about recent commits] +Reviewed-by: Simon Horman +Signed-off-by: Florian Fainelli +Link: https://patch.msgid.link/20250127175159.1788246-1-florian.fainelli@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bgmac.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bgmac.h b/drivers/net/ethernet/broadcom/bgmac.h +index 99a344175a751..378c72bfbd9e5 100644 +--- a/drivers/net/ethernet/broadcom/bgmac.h ++++ b/drivers/net/ethernet/broadcom/bgmac.h +@@ -328,8 +328,7 @@ + #define BGMAC_RX_FRAME_OFFSET 30 /* There are 2 unused bytes between header and real data */ + #define BGMAC_RX_BUF_OFFSET (NET_SKB_PAD + NET_IP_ALIGN - \ + BGMAC_RX_FRAME_OFFSET) +-/* Jumbo frame size with FCS */ +-#define BGMAC_RX_MAX_FRAME_SIZE 9724 ++#define BGMAC_RX_MAX_FRAME_SIZE 1536 + #define BGMAC_RX_BUF_SIZE (BGMAC_RX_FRAME_OFFSET + BGMAC_RX_MAX_FRAME_SIZE) + #define BGMAC_RX_ALLOC_SIZE (SKB_DATA_ALIGN(BGMAC_RX_BUF_SIZE + BGMAC_RX_BUF_OFFSET) + \ + SKB_DATA_ALIGN(sizeof(struct skb_shared_info))) +-- +2.39.5 + diff --git a/queue-5.15/block-deprecate-autoloading-based-on-dev_t.patch b/queue-5.15/block-deprecate-autoloading-based-on-dev_t.patch new file mode 100644 index 0000000000..23e4ef88c4 --- /dev/null +++ b/queue-5.15/block-deprecate-autoloading-based-on-dev_t.patch @@ -0,0 +1,113 @@ +From 967a67700b5865bbbf85be1fb1f0fcf14c525521 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jan 2022 08:16:47 +0100 +Subject: block: deprecate autoloading based on dev_t + +From: Christoph Hellwig + +[ Upstream commit fbdee71bb5d8d054e1bdb5af4c540f2cb86fe296 ] + +Make the legacy dev_t based autoloading optional and add a deprecation +warning. This kind of autoloading has ceased to be useful about 20 years +ago. + +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20220104071647.164918-1-hch@lst.de +Signed-off-by: Jens Axboe +Stable-dep-of: 457ef47c08d2 ("block: retry call probe after request_module in blk_request_module") +Signed-off-by: Sasha Levin +--- + block/Kconfig | 12 ++++++++++++ + block/bdev.c | 9 ++++++--- + block/genhd.c | 6 ++++++ + 3 files changed, 24 insertions(+), 3 deletions(-) + +diff --git a/block/Kconfig b/block/Kconfig +index 8e28ae7718bd2..0d415226e3daa 100644 +--- a/block/Kconfig ++++ b/block/Kconfig +@@ -26,6 +26,18 @@ menuconfig BLOCK + + if BLOCK + ++config BLOCK_LEGACY_AUTOLOAD ++ bool "Legacy autoloading support" ++ help ++ Enable loading modules and creating block device instances based on ++ accesses through their device special file. This is a historic Linux ++ feature and makes no sense in a udev world where device files are ++ created on demand. ++ ++ Say N here unless booting or other functionality broke without it, in ++ which case you should also send a report to your distribution and ++ linux-block@vger.kernel.org. ++ + config BLK_RQ_ALLOC_TIME + bool + +diff --git a/block/bdev.c b/block/bdev.c +index b8599a4088843..85c090ef3bf2c 100644 +--- a/block/bdev.c ++++ b/block/bdev.c +@@ -736,12 +736,15 @@ struct block_device *blkdev_get_no_open(dev_t dev) + struct inode *inode; + + inode = ilookup(blockdev_superblock, dev); +- if (!inode) { ++ if (!inode && IS_ENABLED(CONFIG_BLOCK_LEGACY_AUTOLOAD)) { + blk_request_module(dev); + inode = ilookup(blockdev_superblock, dev); +- if (!inode) +- return NULL; ++ if (inode) ++ pr_warn_ratelimited( ++"block device autoloading is deprecated. It will be removed in Linux 5.19\n"); + } ++ if (!inode) ++ return NULL; + + /* switch from the inode reference to a device mode one: */ + bdev = &BDEV_I(inode)->bdev; +diff --git a/block/genhd.c b/block/genhd.c +index 88d1a6385a242..2f66745de5d5a 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -182,7 +182,9 @@ static struct blk_major_name { + struct blk_major_name *next; + int major; + char name[16]; ++#ifdef CONFIG_BLOCK_LEGACY_AUTOLOAD + void (*probe)(dev_t devt); ++#endif + } *major_names[BLKDEV_MAJOR_HASH_SIZE]; + static DEFINE_MUTEX(major_names_lock); + static DEFINE_SPINLOCK(major_names_spinlock); +@@ -269,7 +271,9 @@ int __register_blkdev(unsigned int major, const char *name, + } + + p->major = major; ++#ifdef CONFIG_BLOCK_LEGACY_AUTOLOAD + p->probe = probe; ++#endif + strlcpy(p->name, name, sizeof(p->name)); + p->next = NULL; + index = major_to_index(major); +@@ -669,6 +673,7 @@ static ssize_t disk_badblocks_store(struct device *dev, + return badblocks_store(disk->bb, page, len, 0); + } + ++#ifdef CONFIG_BLOCK_LEGACY_AUTOLOAD + void blk_request_module(dev_t devt) + { + unsigned int major = MAJOR(devt); +@@ -688,6 +693,7 @@ void blk_request_module(dev_t devt) + /* Make old-style 2.4 aliases work */ + request_module("block-major-%d", MAJOR(devt)); + } ++#endif /* CONFIG_BLOCK_LEGACY_AUTOLOAD */ + + /* + * print a full list of all partitions - intended for places where the root +-- +2.39.5 + diff --git a/queue-5.15/block-retry-call-probe-after-request_module-in-blk_r.patch b/queue-5.15/block-retry-call-probe-after-request_module-in-blk_r.patch new file mode 100644 index 0000000000..ca900769fd --- /dev/null +++ b/queue-5.15/block-retry-call-probe-after-request_module-in-blk_r.patch @@ -0,0 +1,85 @@ +From de934d2a46c44fbaa8a1606f098645b837d7a468 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 19:04:35 +0800 +Subject: block: retry call probe after request_module in blk_request_module + +From: Yang Erkun + +[ Upstream commit 457ef47c08d2979f3e59ce66267485c3faed70c8 ] + +Set kernel config: + + CONFIG_BLK_DEV_LOOP=m + CONFIG_BLK_DEV_LOOP_MIN_COUNT=0 + +Do latter: + + mknod loop0 b 7 0 + exec 4<> loop0 + +Before commit e418de3abcda ("block: switch gendisk lookup to a simple +xarray"), lookup_gendisk will first use base_probe to load module loop, +and then the retry will call loop_probe to prepare the loop disk. Finally +open for this disk will success. However, after this commit, we lose the +retry logic, and open will fail with ENXIO. Block device autoloading is +deprecated and will be removed soon, but maybe we should keep open success +until we really remove it. So, give a retry to fix it. + +Fixes: e418de3abcda ("block: switch gendisk lookup to a simple xarray") +Suggested-by: Christoph Hellwig +Signed-off-by: Yang Erkun +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20241209110435.3670985-1-yangerkun@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/genhd.c | 22 +++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +diff --git a/block/genhd.c b/block/genhd.c +index 2f66745de5d5a..421e02794614e 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -674,7 +674,7 @@ static ssize_t disk_badblocks_store(struct device *dev, + } + + #ifdef CONFIG_BLOCK_LEGACY_AUTOLOAD +-void blk_request_module(dev_t devt) ++static bool blk_probe_dev(dev_t devt) + { + unsigned int major = MAJOR(devt); + struct blk_major_name **n; +@@ -684,14 +684,26 @@ void blk_request_module(dev_t devt) + if ((*n)->major == major && (*n)->probe) { + (*n)->probe(devt); + mutex_unlock(&major_names_lock); +- return; ++ return true; + } + } + mutex_unlock(&major_names_lock); ++ return false; ++} ++ ++void blk_request_module(dev_t devt) ++{ ++ int error; ++ ++ if (blk_probe_dev(devt)) ++ return; + +- if (request_module("block-major-%d-%d", MAJOR(devt), MINOR(devt)) > 0) +- /* Make old-style 2.4 aliases work */ +- request_module("block-major-%d", MAJOR(devt)); ++ error = request_module("block-major-%d-%d", MAJOR(devt), MINOR(devt)); ++ /* Make old-style 2.4 aliases work */ ++ if (error > 0) ++ error = request_module("block-major-%d", MAJOR(devt)); ++ if (!error) ++ blk_probe_dev(devt); + } + #endif /* CONFIG_BLOCK_LEGACY_AUTOLOAD */ + +-- +2.39.5 + diff --git a/queue-5.15/bpf-send-signals-asynchronously-if-preemptible.patch b/queue-5.15/bpf-send-signals-asynchronously-if-preemptible.patch new file mode 100644 index 0000000000..5003f14e4f --- /dev/null +++ b/queue-5.15/bpf-send-signals-asynchronously-if-preemptible.patch @@ -0,0 +1,42 @@ +From 90ba4aa5843e2fbbb716a3d1012a98f3eb267b30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 10:36:47 +0000 +Subject: bpf: Send signals asynchronously if !preemptible + +From: Puranjay Mohan + +[ Upstream commit 87c544108b612512b254c8f79aa5c0a8546e2cc4 ] + +BPF programs can execute in all kinds of contexts and when a program +running in a non-preemptible context uses the bpf_send_signal() kfunc, +it will cause issues because this kfunc can sleep. +Change `irqs_disabled()` to `!preemptible()`. + +Reported-by: syzbot+97da3d7e0112d59971de@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/67486b09.050a0220.253251.0084.GAE@google.com/ +Fixes: 1bc7896e9ef4 ("bpf: Fix deadlock with rq_lock in bpf_send_signal()") +Signed-off-by: Puranjay Mohan +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20250115103647.38487-1-puranjay@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 126754b61edc0..60acc3c76316f 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -799,7 +799,7 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type) + if (unlikely(is_global_init(current))) + return -EPERM; + +- if (irqs_disabled()) { ++ if (!preemptible()) { + /* Do an early check on signal validity. Otherwise, + * the error is lost in deferred irq_work. + */ +-- +2.39.5 + diff --git a/queue-5.15/clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch b/queue-5.15/clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch new file mode 100644 index 0000000000..ee4a30e06e --- /dev/null +++ b/queue-5.15/clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch @@ -0,0 +1,41 @@ +From 118c63bc22dd90a29c4c643882663f0d4f071195 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2024 23:16:39 -0700 +Subject: clk: analogbits: Fix incorrect calculation of vco rate delta + +From: Bo Gan + +[ Upstream commit d7f12857f095ef38523399d47e68787b357232f6 ] + +In wrpll_configure_for_rate() we try to determine the best PLL +configuration for a target rate. However, in the loop where we try +values of R, we should compare the derived `vco` with `target_vco_rate`. +However, we were in fact comparing it with `target_rate`, which is +actually after Q shift. This is incorrect, and sometimes can result in +suboptimal clock rates. Fix it. + +Fixes: 7b9487a9a5c4 ("clk: analogbits: add Wide-Range PLL library") +Signed-off-by: Bo Gan +Link: https://lore.kernel.org/r/20240830061639.2316-1-ganboing@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/analogbits/wrpll-cln28hpc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/analogbits/wrpll-cln28hpc.c b/drivers/clk/analogbits/wrpll-cln28hpc.c +index 09ca823563993..d8ae392959969 100644 +--- a/drivers/clk/analogbits/wrpll-cln28hpc.c ++++ b/drivers/clk/analogbits/wrpll-cln28hpc.c +@@ -291,7 +291,7 @@ int wrpll_configure_for_rate(struct wrpll_cfg *c, u32 target_rate, + vco = vco_pre * f; + } + +- delta = abs(target_rate - vco); ++ delta = abs(target_vco_rate - vco); + if (delta < best_delta) { + best_delta = delta; + best_r = r; +-- +2.39.5 + diff --git a/queue-5.15/clk-imx8mp-fix-clkout1-2-support.patch b/queue-5.15/clk-imx8mp-fix-clkout1-2-support.patch new file mode 100644 index 0000000000..fb6c573b7e --- /dev/null +++ b/queue-5.15/clk-imx8mp-fix-clkout1-2-support.patch @@ -0,0 +1,45 @@ +From 8afa923aec16ceb76625ed335482c34e0dd4c173 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2024 02:36:54 +0100 +Subject: clk: imx8mp: Fix clkout1/2 support + +From: Marek Vasut + +[ Upstream commit a9b7c84d22fb1687d63ca2a386773015cf59436b ] + +The CLKOUTn may be fed from PLL1/2/3, but the PLL1/2/3 has to be enabled +first by setting PLL_CLKE bit 11 in CCM_ANALOG_SYS_PLLn_GEN_CTRL register. +The CCM_ANALOG_SYS_PLLn_GEN_CTRL bit 11 is modeled by plln_out clock. Fix +the clock tree and place the clkout1/2 under plln_sel instead of plain plln +to let the clock subsystem correctly control the bit 11 and enable the PLL +in case the CLKOUTn is supplied by PLL1/2/3. + +Fixes: 43896f56b59e ("clk: imx8mp: add clkout1/2 support") +Signed-off-by: Marek Vasut +Reviewed-by: Peng Fan +Link: https://lore.kernel.org/r/20241112013718.333771-1-marex@denx.de +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8mp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c +index 8e980271b9dc6..0f9ec5e0f5f81 100644 +--- a/drivers/clk/imx/clk-imx8mp.c ++++ b/drivers/clk/imx/clk-imx8mp.c +@@ -398,8 +398,9 @@ static const char * const imx8mp_dram_core_sels[] = {"dram_pll_out", "dram_alt_r + + static const char * const imx8mp_clkout_sels[] = {"audio_pll1_out", "audio_pll2_out", "video_pll1_out", + "dummy", "dummy", "gpu_pll_out", "vpu_pll_out", +- "arm_pll_out", "sys_pll1", "sys_pll2", "sys_pll3", +- "dummy", "dummy", "osc_24m", "dummy", "osc_32k"}; ++ "arm_pll_out", "sys_pll1_out", "sys_pll2_out", ++ "sys_pll3_out", "dummy", "dummy", "osc_24m", ++ "dummy", "osc_32k"}; + + static struct clk_hw **hws; + static struct clk_hw_onecell_data *clk_hw_data; +-- +2.39.5 + diff --git a/queue-5.15/cpufreq-acpi-fix-max-frequency-computation.patch b/queue-5.15/cpufreq-acpi-fix-max-frequency-computation.patch new file mode 100644 index 0000000000..2e577c6bca --- /dev/null +++ b/queue-5.15/cpufreq-acpi-fix-max-frequency-computation.patch @@ -0,0 +1,122 @@ +From ee4a8775a1310a3ac3f0514d94d5c198810c0c30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 10:11:07 +0530 +Subject: cpufreq: ACPI: Fix max-frequency computation + +From: Gautham R. Shenoy + +[ Upstream commit 0834667545962ef1c5e8684ed32b45d9c574acd3 ] + +Commit 3c55e94c0ade ("cpufreq: ACPI: Extend frequency tables to cover +boost frequencies") introduced an assumption in acpi_cpufreq_cpu_init() +that the first entry in the P-state table was the nominal frequency. +This assumption is incorrect. The frequency corresponding to the P0 +P-State need not be the same as the nominal frequency advertised via +CPPC. + +Since the driver is using the CPPC.highest_perf and CPPC.nominal_perf +to compute the boost-ratio, it makes sense to use CPPC.nominal_freq to +compute the max-frequency. CPPC.nominal_freq is advertised on +platforms supporting CPPC revisions 3 or higher. + +Hence, fallback to using the first entry in the P-State table only on +platforms that do not advertise CPPC.nominal_freq. + +Fixes: 3c55e94c0ade ("cpufreq: ACPI: Extend frequency tables to cover boost frequencies") +Tested-by: Dhananjay Ugwekar +Signed-off-by: Gautham R. Shenoy +Reviewed-by: Mario Limonciello +Link: https://patch.msgid.link/20250113044107.566-1-gautham.shenoy@amd.com +[ rjw: Retain reverse X-mas tree ordering of local variable declarations ] +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/acpi-cpufreq.c | 36 +++++++++++++++++++++++++--------- + 1 file changed, 27 insertions(+), 9 deletions(-) + +diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c +index 28467d83c7452..4a31bd90406c9 100644 +--- a/drivers/cpufreq/acpi-cpufreq.c ++++ b/drivers/cpufreq/acpi-cpufreq.c +@@ -630,7 +630,14 @@ static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c) + #endif + + #ifdef CONFIG_ACPI_CPPC_LIB +-static u64 get_max_boost_ratio(unsigned int cpu) ++/* ++ * get_max_boost_ratio: Computes the max_boost_ratio as the ratio ++ * between the highest_perf and the nominal_perf. ++ * ++ * Returns the max_boost_ratio for @cpu. Returns the CPPC nominal ++ * frequency via @nominal_freq if it is non-NULL pointer. ++ */ ++static u64 get_max_boost_ratio(unsigned int cpu, u64 *nominal_freq) + { + struct cppc_perf_caps perf_caps; + u64 highest_perf, nominal_perf; +@@ -653,6 +660,9 @@ static u64 get_max_boost_ratio(unsigned int cpu) + + nominal_perf = perf_caps.nominal_perf; + ++ if (nominal_freq) ++ *nominal_freq = perf_caps.nominal_freq; ++ + if (!highest_perf || !nominal_perf) { + pr_debug("CPU%d: highest or nominal performance missing\n", cpu); + return 0; +@@ -665,8 +675,12 @@ static u64 get_max_boost_ratio(unsigned int cpu) + + return div_u64(highest_perf << SCHED_CAPACITY_SHIFT, nominal_perf); + } ++ + #else +-static inline u64 get_max_boost_ratio(unsigned int cpu) { return 0; } ++static inline u64 get_max_boost_ratio(unsigned int cpu, u64 *nominal_freq) ++{ ++ return 0; ++} + #endif + + static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) +@@ -676,9 +690,9 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) + struct acpi_cpufreq_data *data; + unsigned int cpu = policy->cpu; + struct cpuinfo_x86 *c = &cpu_data(cpu); ++ u64 max_boost_ratio, nominal_freq = 0; + unsigned int valid_states = 0; + unsigned int result = 0; +- u64 max_boost_ratio; + unsigned int i; + #ifdef CONFIG_SMP + static int blacklisted; +@@ -828,16 +842,20 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) + } + freq_table[valid_states].frequency = CPUFREQ_TABLE_END; + +- max_boost_ratio = get_max_boost_ratio(cpu); ++ max_boost_ratio = get_max_boost_ratio(cpu, &nominal_freq); + if (max_boost_ratio) { +- unsigned int freq = freq_table[0].frequency; ++ unsigned int freq = nominal_freq; + + /* +- * Because the loop above sorts the freq_table entries in the +- * descending order, freq is the maximum frequency in the table. +- * Assume that it corresponds to the CPPC nominal frequency and +- * use it to set cpuinfo.max_freq. ++ * The loop above sorts the freq_table entries in the ++ * descending order. If ACPI CPPC has not advertised ++ * the nominal frequency (this is possible in CPPC ++ * revisions prior to 3), then use the first entry in ++ * the pstate table as a proxy for nominal frequency. + */ ++ if (!freq) ++ freq = freq_table[0].frequency; ++ + policy->cpuinfo.max_freq = freq * max_boost_ratio >> SCHED_CAPACITY_SHIFT; + } else { + /* +-- +2.39.5 + diff --git a/queue-5.15/cpufreq-schedutil-fix-superfluous-updates-caused-by-.patch b/queue-5.15/cpufreq-schedutil-fix-superfluous-updates-caused-by-.patch new file mode 100644 index 0000000000..57a3de5b41 --- /dev/null +++ b/queue-5.15/cpufreq-schedutil-fix-superfluous-updates-caused-by-.patch @@ -0,0 +1,64 @@ +From 8680a2cac65152bf0b7d3f3d65504f1437b1eb51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 17:57:32 -0800 +Subject: cpufreq: schedutil: Fix superfluous updates caused by + need_freq_update + +From: Sultan Alsawaf (unemployed) + +[ Upstream commit 8e461a1cb43d69d2fc8a97e61916dce571e6bb31 ] + +A redundant frequency update is only truly needed when there is a policy +limits change with a driver that specifies CPUFREQ_NEED_UPDATE_LIMITS. + +In spite of that, drivers specifying CPUFREQ_NEED_UPDATE_LIMITS receive a +frequency update _all the time_, not just for a policy limits change, +because need_freq_update is never cleared. + +Furthermore, ignore_dl_rate_limit()'s usage of need_freq_update also leads +to a redundant frequency update, regardless of whether or not the driver +specifies CPUFREQ_NEED_UPDATE_LIMITS, when the next chosen frequency is the +same as the current one. + +Fix the superfluous updates by only honoring CPUFREQ_NEED_UPDATE_LIMITS +when there's a policy limits change, and clearing need_freq_update when a +requisite redundant update occurs. + +This is neatly achieved by moving up the CPUFREQ_NEED_UPDATE_LIMITS test +and instead setting need_freq_update to false in sugov_update_next_freq(). + +Fixes: 600f5badb78c ("cpufreq: schedutil: Don't skip freq update when limits change") +Signed-off-by: Sultan Alsawaf (unemployed) +Reviewed-by: Christian Loehle +Link: https://patch.msgid.link/20241212015734.41241-2-sultan@kerneltoast.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/sched/cpufreq_schedutil.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c +index 7f6bb37d3a2f7..e23a0fc96a7d2 100644 +--- a/kernel/sched/cpufreq_schedutil.c ++++ b/kernel/sched/cpufreq_schedutil.c +@@ -91,7 +91,7 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time) + + if (unlikely(sg_policy->limits_changed)) { + sg_policy->limits_changed = false; +- sg_policy->need_freq_update = true; ++ sg_policy->need_freq_update = cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS); + return true; + } + +@@ -104,7 +104,7 @@ static bool sugov_update_next_freq(struct sugov_policy *sg_policy, u64 time, + unsigned int next_freq) + { + if (sg_policy->need_freq_update) +- sg_policy->need_freq_update = cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS); ++ sg_policy->need_freq_update = false; + else if (sg_policy->next_freq == next_freq) + return false; + +-- +2.39.5 + diff --git a/queue-5.15/cpupower-fix-tsc-mhz-calculation.patch b/queue-5.15/cpupower-fix-tsc-mhz-calculation.patch new file mode 100644 index 0000000000..c65495c8d9 --- /dev/null +++ b/queue-5.15/cpupower-fix-tsc-mhz-calculation.patch @@ -0,0 +1,114 @@ +From 2854f718b27e01a7cd79edced5c89ac32896df6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 10:14:59 +0800 +Subject: cpupower: fix TSC MHz calculation + +From: He Rongguang + +[ Upstream commit 9d6c0e58514f8b57cd9c2c755e41623d6a966025 ] + +Commit 'cpupower: Make TSC read per CPU for Mperf monitor' (c2adb1877b7) +changes TSC counter reads per cpu, but left time diff global (from start +of all cpus to end of all cpus), thus diff(time) is too large for a +cpu's tsc counting, resulting in far less than acutal TSC_Mhz and thus +`cpupower monitor` showing far less than actual cpu realtime frequency. + +/proc/cpuinfo shows frequency: +cat /proc/cpuinfo | egrep -e 'processor' -e 'MHz' +... +processor : 171 +cpu MHz : 4108.498 +... + +before fix (System 100% busy): + | Mperf || Idle_Stats + CPU| C0 | Cx | Freq || POLL | C1 | C2 + 171| 0.77| 99.23| 2279|| 0.00| 0.00| 0.00 + +after fix (System 100% busy): + | Mperf || Idle_Stats + CPU| C0 | Cx | Freq || POLL | C1 | C2 + 171| 0.46| 99.54| 4095|| 0.00| 0.00| 0.00 + +Fixes: c2adb1877b76 ("cpupower: Make TSC read per CPU for Mperf monitor") +Signed-off-by: He Rongguang +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + .../cpupower/utils/idle_monitor/mperf_monitor.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c +index ae6af354a81db..08a399b0be286 100644 +--- a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c ++++ b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c +@@ -33,7 +33,7 @@ static int mperf_get_count_percent(unsigned int self_id, double *percent, + unsigned int cpu); + static int mperf_get_count_freq(unsigned int id, unsigned long long *count, + unsigned int cpu); +-static struct timespec time_start, time_end; ++static struct timespec *time_start, *time_end; + + static cstate_t mperf_cstates[MPERF_CSTATE_COUNT] = { + { +@@ -174,7 +174,7 @@ static int mperf_get_count_percent(unsigned int id, double *percent, + dprint("%s: TSC Ref - mperf_diff: %llu, tsc_diff: %llu\n", + mperf_cstates[id].name, mperf_diff, tsc_diff); + } else if (max_freq_mode == MAX_FREQ_SYSFS) { +- timediff = max_frequency * timespec_diff_us(time_start, time_end); ++ timediff = max_frequency * timespec_diff_us(time_start[cpu], time_end[cpu]); + *percent = 100.0 * mperf_diff / timediff; + dprint("%s: MAXFREQ - mperf_diff: %llu, time_diff: %llu\n", + mperf_cstates[id].name, mperf_diff, timediff); +@@ -207,7 +207,7 @@ static int mperf_get_count_freq(unsigned int id, unsigned long long *count, + if (max_freq_mode == MAX_FREQ_TSC_REF) { + /* Calculate max_freq from TSC count */ + tsc_diff = tsc_at_measure_end[cpu] - tsc_at_measure_start[cpu]; +- time_diff = timespec_diff_us(time_start, time_end); ++ time_diff = timespec_diff_us(time_start[cpu], time_end[cpu]); + max_frequency = tsc_diff / time_diff; + } + +@@ -226,9 +226,8 @@ static int mperf_start(void) + { + int cpu; + +- clock_gettime(CLOCK_REALTIME, &time_start); +- + for (cpu = 0; cpu < cpu_count; cpu++) { ++ clock_gettime(CLOCK_REALTIME, &time_start[cpu]); + mperf_get_tsc(&tsc_at_measure_start[cpu]); + mperf_init_stats(cpu); + } +@@ -243,9 +242,9 @@ static int mperf_stop(void) + for (cpu = 0; cpu < cpu_count; cpu++) { + mperf_measure_stats(cpu); + mperf_get_tsc(&tsc_at_measure_end[cpu]); ++ clock_gettime(CLOCK_REALTIME, &time_end[cpu]); + } + +- clock_gettime(CLOCK_REALTIME, &time_end); + return 0; + } + +@@ -349,6 +348,8 @@ struct cpuidle_monitor *mperf_register(void) + aperf_current_count = calloc(cpu_count, sizeof(unsigned long long)); + tsc_at_measure_start = calloc(cpu_count, sizeof(unsigned long long)); + tsc_at_measure_end = calloc(cpu_count, sizeof(unsigned long long)); ++ time_start = calloc(cpu_count, sizeof(struct timespec)); ++ time_end = calloc(cpu_count, sizeof(struct timespec)); + mperf_monitor.name_len = strlen(mperf_monitor.name); + return &mperf_monitor; + } +@@ -361,6 +362,8 @@ void mperf_unregister(void) + free(aperf_current_count); + free(tsc_at_measure_start); + free(tsc_at_measure_end); ++ free(time_start); ++ free(time_end); + free(is_valid); + } + +-- +2.39.5 + diff --git a/queue-5.15/crypto-hisilicon-sec-add-some-comments-for-soft-fall.patch b/queue-5.15/crypto-hisilicon-sec-add-some-comments-for-soft-fall.patch new file mode 100644 index 0000000000..21d0824132 --- /dev/null +++ b/queue-5.15/crypto-hisilicon-sec-add-some-comments-for-soft-fall.patch @@ -0,0 +1,79 @@ +From 601e423b732c0f019d2072d5a7f0381ce8bf0c5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jan 2022 16:13:09 +0800 +Subject: crypto: hisilicon/sec - add some comments for soft fallback + +From: Kai Ye + +[ Upstream commit e764d81d58070e66e61fb1b972c81eb9d2ea971e ] + +Modify the print of information that might lead to user misunderstanding. +Currently only XTS mode need the fallback tfm when using 192bit key. +Others algs not need soft fallback tfm. So others algs can return +directly. + +Signed-off-by: Kai Ye +Signed-off-by: Herbert Xu +Stable-dep-of: fd337f852b26 ("crypto: hisilicon/sec2 - fix for aead icv error") +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec2/sec_crypto.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c +index 28c167e1be426..c8fa964238e7d 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c ++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c +@@ -643,13 +643,15 @@ static int sec_skcipher_fbtfm_init(struct crypto_skcipher *tfm) + struct sec_cipher_ctx *c_ctx = &ctx->c_ctx; + + c_ctx->fallback = false; ++ ++ /* Currently, only XTS mode need fallback tfm when using 192bit key */ + if (likely(strncmp(alg, "xts", SEC_XTS_NAME_SZ))) + return 0; + + c_ctx->fbtfm = crypto_alloc_sync_skcipher(alg, 0, + CRYPTO_ALG_NEED_FALLBACK); + if (IS_ERR(c_ctx->fbtfm)) { +- pr_err("failed to alloc fallback tfm!\n"); ++ pr_err("failed to alloc xts mode fallback tfm!\n"); + return PTR_ERR(c_ctx->fbtfm); + } + +@@ -810,7 +812,7 @@ static int sec_skcipher_setkey(struct crypto_skcipher *tfm, const u8 *key, + } + + memcpy(c_ctx->c_key, key, keylen); +- if (c_ctx->fallback) { ++ if (c_ctx->fallback && c_ctx->fbtfm) { + ret = crypto_sync_skcipher_setkey(c_ctx->fbtfm, key, keylen); + if (ret) { + dev_err(dev, "failed to set fallback skcipher key!\n"); +@@ -2034,13 +2036,12 @@ static int sec_skcipher_soft_crypto(struct sec_ctx *ctx, + struct skcipher_request *sreq, bool encrypt) + { + struct sec_cipher_ctx *c_ctx = &ctx->c_ctx; ++ SYNC_SKCIPHER_REQUEST_ON_STACK(subreq, c_ctx->fbtfm); + struct device *dev = ctx->dev; + int ret; + +- SYNC_SKCIPHER_REQUEST_ON_STACK(subreq, c_ctx->fbtfm); +- + if (!c_ctx->fbtfm) { +- dev_err(dev, "failed to check fallback tfm\n"); ++ dev_err_ratelimited(dev, "the soft tfm isn't supported in the current system.\n"); + return -EINVAL; + } + +@@ -2258,7 +2259,6 @@ static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq) + if (ctx->sec->qm.ver == QM_HW_V2) { + if (unlikely(!req->cryptlen || (!sreq->c_req.encrypt && + req->cryptlen <= authsize))) { +- dev_err(dev, "Kunpeng920 not support 0 length!\n"); + ctx->a_ctx.fallback = true; + return -EINVAL; + } +-- +2.39.5 + diff --git a/queue-5.15/crypto-hisilicon-sec-delete-redundant-blank-lines.patch b/queue-5.15/crypto-hisilicon-sec-delete-redundant-blank-lines.patch new file mode 100644 index 0000000000..f87549f050 --- /dev/null +++ b/queue-5.15/crypto-hisilicon-sec-delete-redundant-blank-lines.patch @@ -0,0 +1,42 @@ +From 98e2b352c2b82c8d8a12963d8d69b421bf304a49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Sep 2022 06:28:11 +0000 +Subject: crypto: hisilicon/sec - delete redundant blank lines + +From: Kai Ye + +[ Upstream commit 0413623c27a380d0da7240717f9435d24776b985 ] + +Some coding style fixes in sec crypto file. + +Signed-off-by: Kai Ye +Signed-off-by: Herbert Xu +Stable-dep-of: fd337f852b26 ("crypto: hisilicon/sec2 - fix for aead icv error") +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec2/sec_crypto.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c +index c8fa964238e7d..72e26a4bfb8e6 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c ++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c +@@ -1674,7 +1674,6 @@ static void sec_aead_callback(struct sec_ctx *c, struct sec_req *req, int err) + aead_req->out_mac, + authsize, a_req->cryptlen + + a_req->assoclen); +- + if (unlikely(sz != authsize)) { + dev_err(c->dev, "copy out mac err!\n"); + err = -EINVAL; +@@ -1961,7 +1960,6 @@ static int sec_aead_sha512_ctx_init(struct crypto_aead *tfm) + return sec_aead_ctx_init(tfm, "sha512"); + } + +- + static int sec_skcipher_cryptlen_ckeck(struct sec_ctx *ctx, + struct sec_req *sreq) + { +-- +2.39.5 + diff --git a/queue-5.15/crypto-hisilicon-sec2-fix-for-aead-icv-error.patch b/queue-5.15/crypto-hisilicon-sec2-fix-for-aead-icv-error.patch new file mode 100644 index 0000000000..dad9e160da --- /dev/null +++ b/queue-5.15/crypto-hisilicon-sec2-fix-for-aead-icv-error.patch @@ -0,0 +1,320 @@ +From abeea1eec6007d2f3f4b534b9821b056c27972e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 17:13:34 +0800 +Subject: crypto: hisilicon/sec2 - fix for aead icv error + +From: Wenkai Lin + +[ Upstream commit fd337f852b2677b53d0859a47b58e6e6bd189f30 ] + +When the AEAD algorithm is used for encryption or decryption, +the input authentication length varies, the hardware needs to +obtain the input length to pass the integrity check verification. +Currently, the driver uses a fixed authentication length,which +causes decryption failure, so the length configuration is modified. +In addition, the step of setting the auth length is unnecessary, +so it was deleted from the setkey function. + +Fixes: 2f072d75d1ab ("crypto: hisilicon - Add aead support on SEC2") +Signed-off-by: Wenkai Lin +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec2/sec.h | 1 - + drivers/crypto/hisilicon/sec2/sec_crypto.c | 101 +++++++++------------ + drivers/crypto/hisilicon/sec2/sec_crypto.h | 11 --- + 3 files changed, 44 insertions(+), 69 deletions(-) + +diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h +index cff00fd297652..2dcb4f4c0629a 100644 +--- a/drivers/crypto/hisilicon/sec2/sec.h ++++ b/drivers/crypto/hisilicon/sec2/sec.h +@@ -89,7 +89,6 @@ struct sec_auth_ctx { + dma_addr_t a_key_dma; + u8 *a_key; + u8 a_key_len; +- u8 mac_len; + u8 a_alg; + bool fallback; + struct crypto_shash *hash_tfm; +diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c +index dedcc7f743039..395758a29f4a3 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c ++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c +@@ -907,15 +907,14 @@ static int sec_aead_mac_init(struct sec_aead_req *req) + struct aead_request *aead_req = req->aead_req; + struct crypto_aead *tfm = crypto_aead_reqtfm(aead_req); + size_t authsize = crypto_aead_authsize(tfm); +- u8 *mac_out = req->out_mac; + struct scatterlist *sgl = aead_req->src; ++ u8 *mac_out = req->out_mac; + size_t copy_size; + off_t skip_size; + + /* Copy input mac */ + skip_size = aead_req->assoclen + aead_req->cryptlen - authsize; +- copy_size = sg_pcopy_to_buffer(sgl, sg_nents(sgl), mac_out, +- authsize, skip_size); ++ copy_size = sg_pcopy_to_buffer(sgl, sg_nents(sgl), mac_out, authsize, skip_size); + if (unlikely(copy_size != authsize)) + return -EINVAL; + +@@ -1097,7 +1096,6 @@ static int sec_aead_fallback_setkey(struct sec_auth_ctx *a_ctx, + static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + const u32 keylen, const enum sec_hash_alg a_alg, + const enum sec_calg c_alg, +- const enum sec_mac_len mac_len, + const enum sec_cmode c_mode) + { + struct sec_ctx *ctx = crypto_aead_ctx(tfm); +@@ -1109,7 +1107,6 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + + ctx->a_ctx.a_alg = a_alg; + ctx->c_ctx.c_alg = c_alg; +- ctx->a_ctx.mac_len = mac_len; + c_ctx->c_mode = c_mode; + + if (c_mode == SEC_CMODE_CCM || c_mode == SEC_CMODE_GCM) { +@@ -1145,10 +1142,9 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + goto bad_key; + } + +- if ((ctx->a_ctx.mac_len & SEC_SQE_LEN_RATE_MASK) || +- (ctx->a_ctx.a_key_len & SEC_SQE_LEN_RATE_MASK)) { ++ if (ctx->a_ctx.a_key_len & SEC_SQE_LEN_RATE_MASK) { + ret = -EINVAL; +- dev_err(dev, "MAC or AUTH key length error!\n"); ++ dev_err(dev, "AUTH key length error!\n"); + goto bad_key; + } + +@@ -1160,27 +1156,19 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + } + + +-#define GEN_SEC_AEAD_SETKEY_FUNC(name, aalg, calg, maclen, cmode) \ +-static int sec_setkey_##name(struct crypto_aead *tfm, const u8 *key, \ +- u32 keylen) \ +-{ \ +- return sec_aead_setkey(tfm, key, keylen, aalg, calg, maclen, cmode);\ +-} +- +-GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha1, SEC_A_HMAC_SHA1, +- SEC_CALG_AES, SEC_HMAC_SHA1_MAC, SEC_CMODE_CBC) +-GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha256, SEC_A_HMAC_SHA256, +- SEC_CALG_AES, SEC_HMAC_SHA256_MAC, SEC_CMODE_CBC) +-GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha512, SEC_A_HMAC_SHA512, +- SEC_CALG_AES, SEC_HMAC_SHA512_MAC, SEC_CMODE_CBC) +-GEN_SEC_AEAD_SETKEY_FUNC(aes_ccm, 0, SEC_CALG_AES, +- SEC_HMAC_CCM_MAC, SEC_CMODE_CCM) +-GEN_SEC_AEAD_SETKEY_FUNC(aes_gcm, 0, SEC_CALG_AES, +- SEC_HMAC_GCM_MAC, SEC_CMODE_GCM) +-GEN_SEC_AEAD_SETKEY_FUNC(sm4_ccm, 0, SEC_CALG_SM4, +- SEC_HMAC_CCM_MAC, SEC_CMODE_CCM) +-GEN_SEC_AEAD_SETKEY_FUNC(sm4_gcm, 0, SEC_CALG_SM4, +- SEC_HMAC_GCM_MAC, SEC_CMODE_GCM) ++#define GEN_SEC_AEAD_SETKEY_FUNC(name, aalg, calg, cmode) \ ++static int sec_setkey_##name(struct crypto_aead *tfm, const u8 *key, u32 keylen) \ ++{ \ ++ return sec_aead_setkey(tfm, key, keylen, aalg, calg, cmode); \ ++} ++ ++GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha1, SEC_A_HMAC_SHA1, SEC_CALG_AES, SEC_CMODE_CBC) ++GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha256, SEC_A_HMAC_SHA256, SEC_CALG_AES, SEC_CMODE_CBC) ++GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha512, SEC_A_HMAC_SHA512, SEC_CALG_AES, SEC_CMODE_CBC) ++GEN_SEC_AEAD_SETKEY_FUNC(aes_ccm, 0, SEC_CALG_AES, SEC_CMODE_CCM) ++GEN_SEC_AEAD_SETKEY_FUNC(aes_gcm, 0, SEC_CALG_AES, SEC_CMODE_GCM) ++GEN_SEC_AEAD_SETKEY_FUNC(sm4_ccm, 0, SEC_CALG_SM4, SEC_CMODE_CCM) ++GEN_SEC_AEAD_SETKEY_FUNC(sm4_gcm, 0, SEC_CALG_SM4, SEC_CMODE_GCM) + + static int sec_aead_sgl_map(struct sec_ctx *ctx, struct sec_req *req) + { +@@ -1425,9 +1413,10 @@ static void sec_skcipher_callback(struct sec_ctx *ctx, struct sec_req *req, + static void set_aead_auth_iv(struct sec_ctx *ctx, struct sec_req *req) + { + struct aead_request *aead_req = req->aead_req.aead_req; +- struct sec_cipher_req *c_req = &req->c_req; ++ struct crypto_aead *tfm = crypto_aead_reqtfm(aead_req); ++ size_t authsize = crypto_aead_authsize(tfm); + struct sec_aead_req *a_req = &req->aead_req; +- size_t authsize = ctx->a_ctx.mac_len; ++ struct sec_cipher_req *c_req = &req->c_req; + u32 data_size = aead_req->cryptlen; + u8 flage = 0; + u8 cm, cl; +@@ -1468,10 +1457,8 @@ static void set_aead_auth_iv(struct sec_ctx *ctx, struct sec_req *req) + static void sec_aead_set_iv(struct sec_ctx *ctx, struct sec_req *req) + { + struct aead_request *aead_req = req->aead_req.aead_req; +- struct crypto_aead *tfm = crypto_aead_reqtfm(aead_req); +- size_t authsize = crypto_aead_authsize(tfm); +- struct sec_cipher_req *c_req = &req->c_req; + struct sec_aead_req *a_req = &req->aead_req; ++ struct sec_cipher_req *c_req = &req->c_req; + + memcpy(c_req->c_ivin, aead_req->iv, ctx->c_ctx.ivsize); + +@@ -1479,15 +1466,11 @@ static void sec_aead_set_iv(struct sec_ctx *ctx, struct sec_req *req) + /* + * CCM 16Byte Cipher_IV: {1B_Flage,13B_IV,2B_counter}, + * the counter must set to 0x01 ++ * CCM 16Byte Auth_IV: {1B_AFlage,13B_IV,2B_Ptext_length} + */ +- ctx->a_ctx.mac_len = authsize; +- /* CCM 16Byte Auth_IV: {1B_AFlage,13B_IV,2B_Ptext_length} */ + set_aead_auth_iv(ctx, req); +- } +- +- /* GCM 12Byte Cipher_IV == Auth_IV */ +- if (ctx->c_ctx.c_mode == SEC_CMODE_GCM) { +- ctx->a_ctx.mac_len = authsize; ++ } else if (ctx->c_ctx.c_mode == SEC_CMODE_GCM) { ++ /* GCM 12Byte Cipher_IV == Auth_IV */ + memcpy(a_req->a_ivin, c_req->c_ivin, SEC_AIV_SIZE); + } + } +@@ -1497,9 +1480,11 @@ static void sec_auth_bd_fill_xcm(struct sec_auth_ctx *ctx, int dir, + { + struct sec_aead_req *a_req = &req->aead_req; + struct aead_request *aq = a_req->aead_req; ++ struct crypto_aead *tfm = crypto_aead_reqtfm(aq); ++ size_t authsize = crypto_aead_authsize(tfm); + + /* C_ICV_Len is MAC size, 0x4 ~ 0x10 */ +- sec_sqe->type2.icvw_kmode |= cpu_to_le16((u16)ctx->mac_len); ++ sec_sqe->type2.icvw_kmode |= cpu_to_le16((u16)authsize); + + /* mode set to CCM/GCM, don't set {A_Alg, AKey_Len, MAC_Len} */ + sec_sqe->type2.a_key_addr = sec_sqe->type2.c_key_addr; +@@ -1523,9 +1508,11 @@ static void sec_auth_bd_fill_xcm_v3(struct sec_auth_ctx *ctx, int dir, + { + struct sec_aead_req *a_req = &req->aead_req; + struct aead_request *aq = a_req->aead_req; ++ struct crypto_aead *tfm = crypto_aead_reqtfm(aq); ++ size_t authsize = crypto_aead_authsize(tfm); + + /* C_ICV_Len is MAC size, 0x4 ~ 0x10 */ +- sqe3->c_icv_key |= cpu_to_le16((u16)ctx->mac_len << SEC_MAC_OFFSET_V3); ++ sqe3->c_icv_key |= cpu_to_le16((u16)authsize << SEC_MAC_OFFSET_V3); + + /* mode set to CCM/GCM, don't set {A_Alg, AKey_Len, MAC_Len} */ + sqe3->a_key_addr = sqe3->c_key_addr; +@@ -1549,11 +1536,12 @@ static void sec_auth_bd_fill_ex(struct sec_auth_ctx *ctx, int dir, + struct sec_aead_req *a_req = &req->aead_req; + struct sec_cipher_req *c_req = &req->c_req; + struct aead_request *aq = a_req->aead_req; ++ struct crypto_aead *tfm = crypto_aead_reqtfm(aq); ++ size_t authsize = crypto_aead_authsize(tfm); + + sec_sqe->type2.a_key_addr = cpu_to_le64(ctx->a_key_dma); + +- sec_sqe->type2.mac_key_alg = +- cpu_to_le32(ctx->mac_len / SEC_SQE_LEN_RATE); ++ sec_sqe->type2.mac_key_alg = cpu_to_le32(authsize / SEC_SQE_LEN_RATE); + + sec_sqe->type2.mac_key_alg |= + cpu_to_le32((u32)((ctx->a_key_len) / +@@ -1603,11 +1591,13 @@ static void sec_auth_bd_fill_ex_v3(struct sec_auth_ctx *ctx, int dir, + struct sec_aead_req *a_req = &req->aead_req; + struct sec_cipher_req *c_req = &req->c_req; + struct aead_request *aq = a_req->aead_req; ++ struct crypto_aead *tfm = crypto_aead_reqtfm(aq); ++ size_t authsize = crypto_aead_authsize(tfm); + + sqe3->a_key_addr = cpu_to_le64(ctx->a_key_dma); + + sqe3->auth_mac_key |= +- cpu_to_le32((u32)(ctx->mac_len / ++ cpu_to_le32((u32)(authsize / + SEC_SQE_LEN_RATE) << SEC_MAC_OFFSET_V3); + + sqe3->auth_mac_key |= +@@ -1658,9 +1648,9 @@ static void sec_aead_callback(struct sec_ctx *c, struct sec_req *req, int err) + { + struct aead_request *a_req = req->aead_req.aead_req; + struct crypto_aead *tfm = crypto_aead_reqtfm(a_req); ++ size_t authsize = crypto_aead_authsize(tfm); + struct sec_aead_req *aead_req = &req->aead_req; + struct sec_cipher_req *c_req = &req->c_req; +- size_t authsize = crypto_aead_authsize(tfm); + struct sec_qp_ctx *qp_ctx = req->qp_ctx; + struct aead_request *backlog_aead_req; + struct sec_req *backlog_req; +@@ -1673,10 +1663,8 @@ static void sec_aead_callback(struct sec_ctx *c, struct sec_req *req, int err) + if (!err && c_req->encrypt) { + struct scatterlist *sgl = a_req->dst; + +- sz = sg_pcopy_from_buffer(sgl, sg_nents(sgl), +- aead_req->out_mac, +- authsize, a_req->cryptlen + +- a_req->assoclen); ++ sz = sg_pcopy_from_buffer(sgl, sg_nents(sgl), aead_req->out_mac, ++ authsize, a_req->cryptlen + a_req->assoclen); + if (unlikely(sz != authsize)) { + dev_err(c->dev, "copy out mac err!\n"); + err = -EINVAL; +@@ -2204,7 +2192,7 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq) + { + struct aead_request *req = sreq->aead_req.aead_req; + struct crypto_aead *tfm = crypto_aead_reqtfm(req); +- size_t authsize = crypto_aead_authsize(tfm); ++ size_t sz = crypto_aead_authsize(tfm); + u8 c_mode = ctx->c_ctx.c_mode; + struct device *dev = ctx->dev; + int ret; +@@ -2215,9 +2203,8 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq) + return -EINVAL; + } + +- if (unlikely((c_mode == SEC_CMODE_GCM && authsize < DES_BLOCK_SIZE) || +- (c_mode == SEC_CMODE_CCM && (authsize < MIN_MAC_LEN || +- authsize & MAC_LEN_MASK)))) { ++ if (unlikely((c_mode == SEC_CMODE_GCM && sz < DES_BLOCK_SIZE) || ++ (c_mode == SEC_CMODE_CCM && (sz < MIN_MAC_LEN || sz & MAC_LEN_MASK)))) { + dev_err(dev, "aead input mac length error!\n"); + return -EINVAL; + } +@@ -2233,7 +2220,7 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq) + if (sreq->c_req.encrypt) + sreq->c_req.c_len = req->cryptlen; + else +- sreq->c_req.c_len = req->cryptlen - authsize; ++ sreq->c_req.c_len = req->cryptlen - sz; + if (c_mode == SEC_CMODE_CBC) { + if (unlikely(sreq->c_req.c_len & (AES_BLOCK_SIZE - 1))) { + dev_err(dev, "aead crypto length error!\n"); +@@ -2259,7 +2246,7 @@ static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq) + + if (ctx->sec->qm.ver == QM_HW_V2) { + if (unlikely(!req->cryptlen || (!sreq->c_req.encrypt && +- req->cryptlen <= authsize))) { ++ req->cryptlen <= authsize))) { + ctx->a_ctx.fallback = true; + return -EINVAL; + } +diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.h b/drivers/crypto/hisilicon/sec2/sec_crypto.h +index ee2edaf5058df..4d7f917fbaf1c 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_crypto.h ++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.h +@@ -23,17 +23,6 @@ enum sec_hash_alg { + SEC_A_HMAC_SHA512 = 0x15, + }; + +-enum sec_mac_len { +- SEC_HMAC_CCM_MAC = 16, +- SEC_HMAC_GCM_MAC = 16, +- SEC_SM3_MAC = 32, +- SEC_HMAC_SM3_MAC = 32, +- SEC_HMAC_MD5_MAC = 16, +- SEC_HMAC_SHA1_MAC = 20, +- SEC_HMAC_SHA256_MAC = 32, +- SEC_HMAC_SHA512_MAC = 64, +-}; +- + enum sec_cmode { + SEC_CMODE_ECB = 0x0, + SEC_CMODE_CBC = 0x1, +-- +2.39.5 + diff --git a/queue-5.15/crypto-hisilicon-sec2-fix-for-aead-invalid-authsize.patch b/queue-5.15/crypto-hisilicon-sec2-fix-for-aead-invalid-authsize.patch new file mode 100644 index 0000000000..2bf4720f22 --- /dev/null +++ b/queue-5.15/crypto-hisilicon-sec2-fix-for-aead-invalid-authsize.patch @@ -0,0 +1,205 @@ +From e8a42e65655b5aa0880c83ff7149d25d8b34915d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 17:13:35 +0800 +Subject: crypto: hisilicon/sec2 - fix for aead invalid authsize + +From: Wenkai Lin + +[ Upstream commit a5a9d959936499a3106a1bf3b9070875d0d3dec4 ] + +When the digest alg is HMAC-SHAx or another, the authsize may be less +than 4 bytes and mac_len of the BD is set to zero, the hardware considers +it a BD configuration error and reports a ras error, so the sec driver +needs to switch to software calculation in this case, this patch add a +check for it and remove unnecessary check that has been done by crypto. + +Fixes: 2f072d75d1ab ("crypto: hisilicon - Add aead support on SEC2") +Signed-off-by: Wenkai Lin +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec2/sec.h | 2 +- + drivers/crypto/hisilicon/sec2/sec_crypto.c | 64 +++++++++++----------- + 2 files changed, 34 insertions(+), 32 deletions(-) + +diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h +index 2dcb4f4c0629a..d3515d1ea5c27 100644 +--- a/drivers/crypto/hisilicon/sec2/sec.h ++++ b/drivers/crypto/hisilicon/sec2/sec.h +@@ -36,6 +36,7 @@ struct sec_aead_req { + u8 *a_ivin; + dma_addr_t a_ivin_dma; + struct aead_request *aead_req; ++ bool fallback; + }; + + /* SEC request of Crypto */ +@@ -90,7 +91,6 @@ struct sec_auth_ctx { + u8 *a_key; + u8 a_key_len; + u8 a_alg; +- bool fallback; + struct crypto_shash *hash_tfm; + struct crypto_aead *fallback_aead_tfm; + }; +diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c +index 395758a29f4a3..32150e05a2795 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c ++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c +@@ -1077,10 +1077,7 @@ static int sec_aead_setauthsize(struct crypto_aead *aead, unsigned int authsize) + struct sec_ctx *ctx = crypto_tfm_ctx(tfm); + struct sec_auth_ctx *a_ctx = &ctx->a_ctx; + +- if (unlikely(a_ctx->fallback_aead_tfm)) +- return crypto_aead_setauthsize(a_ctx->fallback_aead_tfm, authsize); +- +- return 0; ++ return crypto_aead_setauthsize(a_ctx->fallback_aead_tfm, authsize); + } + + static int sec_aead_fallback_setkey(struct sec_auth_ctx *a_ctx, +@@ -1117,13 +1114,7 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + } + memcpy(c_ctx->c_key, key, keylen); + +- if (unlikely(a_ctx->fallback_aead_tfm)) { +- ret = sec_aead_fallback_setkey(a_ctx, tfm, key, keylen); +- if (ret) +- return ret; +- } +- +- return 0; ++ return sec_aead_fallback_setkey(a_ctx, tfm, key, keylen); + } + + ret = crypto_authenc_extractkeys(&keys, key, keylen); +@@ -1148,6 +1139,12 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + goto bad_key; + } + ++ ret = sec_aead_fallback_setkey(a_ctx, tfm, key, keylen); ++ if (ret) { ++ dev_err(dev, "set sec fallback key err!\n"); ++ goto bad_key; ++ } ++ + return 0; + + bad_key: +@@ -1873,8 +1870,10 @@ static void sec_aead_exit(struct crypto_aead *tfm) + + static int sec_aead_ctx_init(struct crypto_aead *tfm, const char *hash_name) + { ++ struct aead_alg *alg = crypto_aead_alg(tfm); + struct sec_ctx *ctx = crypto_aead_ctx(tfm); +- struct sec_auth_ctx *auth_ctx = &ctx->a_ctx; ++ struct sec_auth_ctx *a_ctx = &ctx->a_ctx; ++ const char *aead_name = alg->base.cra_name; + int ret; + + ret = sec_aead_init(tfm); +@@ -1883,11 +1882,20 @@ static int sec_aead_ctx_init(struct crypto_aead *tfm, const char *hash_name) + return ret; + } + +- auth_ctx->hash_tfm = crypto_alloc_shash(hash_name, 0, 0); +- if (IS_ERR(auth_ctx->hash_tfm)) { ++ a_ctx->hash_tfm = crypto_alloc_shash(hash_name, 0, 0); ++ if (IS_ERR(a_ctx->hash_tfm)) { + dev_err(ctx->dev, "aead alloc shash error!\n"); + sec_aead_exit(tfm); +- return PTR_ERR(auth_ctx->hash_tfm); ++ return PTR_ERR(a_ctx->hash_tfm); ++ } ++ ++ a_ctx->fallback_aead_tfm = crypto_alloc_aead(aead_name, 0, ++ CRYPTO_ALG_NEED_FALLBACK | CRYPTO_ALG_ASYNC); ++ if (IS_ERR(a_ctx->fallback_aead_tfm)) { ++ dev_err(ctx->dev, "aead driver alloc fallback tfm error!\n"); ++ crypto_free_shash(ctx->a_ctx.hash_tfm); ++ sec_aead_exit(tfm); ++ return PTR_ERR(a_ctx->fallback_aead_tfm); + } + + return 0; +@@ -1897,6 +1905,7 @@ static void sec_aead_ctx_exit(struct crypto_aead *tfm) + { + struct sec_ctx *ctx = crypto_aead_ctx(tfm); + ++ crypto_free_aead(ctx->a_ctx.fallback_aead_tfm); + crypto_free_shash(ctx->a_ctx.hash_tfm); + sec_aead_exit(tfm); + } +@@ -1923,7 +1932,6 @@ static int sec_aead_xcm_ctx_init(struct crypto_aead *tfm) + sec_aead_exit(tfm); + return PTR_ERR(a_ctx->fallback_aead_tfm); + } +- a_ctx->fallback = false; + + return 0; + } +@@ -2197,15 +2205,15 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq) + struct device *dev = ctx->dev; + int ret; + +- if (unlikely(req->cryptlen + req->assoclen > MAX_INPUT_DATA_LEN || +- req->assoclen > SEC_MAX_AAD_LEN)) { +- dev_err(dev, "aead input spec error!\n"); ++ /* Hardware does not handle cases where authsize is less than 4 bytes */ ++ if (unlikely(sz < MIN_MAC_LEN)) { ++ sreq->aead_req.fallback = true; + return -EINVAL; + } + +- if (unlikely((c_mode == SEC_CMODE_GCM && sz < DES_BLOCK_SIZE) || +- (c_mode == SEC_CMODE_CCM && (sz < MIN_MAC_LEN || sz & MAC_LEN_MASK)))) { +- dev_err(dev, "aead input mac length error!\n"); ++ if (unlikely(req->cryptlen + req->assoclen > MAX_INPUT_DATA_LEN || ++ req->assoclen > SEC_MAX_AAD_LEN)) { ++ dev_err(dev, "aead input spec error!\n"); + return -EINVAL; + } + +@@ -2247,7 +2255,7 @@ static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq) + if (ctx->sec->qm.ver == QM_HW_V2) { + if (unlikely(!req->cryptlen || (!sreq->c_req.encrypt && + req->cryptlen <= authsize))) { +- ctx->a_ctx.fallback = true; ++ sreq->aead_req.fallback = true; + return -EINVAL; + } + } +@@ -2275,16 +2283,9 @@ static int sec_aead_soft_crypto(struct sec_ctx *ctx, + bool encrypt) + { + struct sec_auth_ctx *a_ctx = &ctx->a_ctx; +- struct device *dev = ctx->dev; + struct aead_request *subreq; + int ret; + +- /* Kunpeng920 aead mode not support input 0 size */ +- if (!a_ctx->fallback_aead_tfm) { +- dev_err(dev, "aead fallback tfm is NULL!\n"); +- return -EINVAL; +- } +- + subreq = aead_request_alloc(a_ctx->fallback_aead_tfm, GFP_KERNEL); + if (!subreq) + return -ENOMEM; +@@ -2316,10 +2317,11 @@ static int sec_aead_crypto(struct aead_request *a_req, bool encrypt) + req->aead_req.aead_req = a_req; + req->c_req.encrypt = encrypt; + req->ctx = ctx; ++ req->aead_req.fallback = false; + + ret = sec_aead_param_check(ctx, req); + if (unlikely(ret)) { +- if (ctx->a_ctx.fallback) ++ if (req->aead_req.fallback) + return sec_aead_soft_crypto(ctx, a_req, encrypt); + return -EINVAL; + } +-- +2.39.5 + diff --git a/queue-5.15/crypto-hisilicon-sec2-optimize-the-error-return-proc.patch b/queue-5.15/crypto-hisilicon-sec2-optimize-the-error-return-proc.patch new file mode 100644 index 0000000000..7a94fdef0b --- /dev/null +++ b/queue-5.15/crypto-hisilicon-sec2-optimize-the-error-return-proc.patch @@ -0,0 +1,62 @@ +From 1af1bb3958ebceed338297af24616360e69214a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Dec 2023 15:01:35 +0800 +Subject: crypto: hisilicon/sec2 - optimize the error return process + +From: Chenghai Huang + +[ Upstream commit 1bed82257b1881b689ee41f14ecb4c20a273cac0 ] + +Add the printf of an error message and optimized the handling +process of ret. + +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Stable-dep-of: fd337f852b26 ("crypto: hisilicon/sec2 - fix for aead icv error") +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec2/sec_crypto.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c +index 72e26a4bfb8e6..dedcc7f743039 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c ++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c +@@ -803,6 +803,7 @@ static int sec_skcipher_setkey(struct crypto_skcipher *tfm, const u8 *key, + ret = sec_skcipher_aes_sm4_setkey(c_ctx, keylen, c_mode); + break; + default: ++ dev_err(dev, "sec c_alg err!\n"); + return -EINVAL; + } + +@@ -1128,7 +1129,8 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + return 0; + } + +- if (crypto_authenc_extractkeys(&keys, key, keylen)) ++ ret = crypto_authenc_extractkeys(&keys, key, keylen); ++ if (ret) + goto bad_key; + + ret = sec_aead_aes_set_key(c_ctx, &keys); +@@ -1145,6 +1147,7 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + + if ((ctx->a_ctx.mac_len & SEC_SQE_LEN_RATE_MASK) || + (ctx->a_ctx.a_key_len & SEC_SQE_LEN_RATE_MASK)) { ++ ret = -EINVAL; + dev_err(dev, "MAC or AUTH key length error!\n"); + goto bad_key; + } +@@ -1153,7 +1156,7 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key, + + bad_key: + memzero_explicit(&keys, sizeof(struct crypto_authenc_keys)); +- return -EINVAL; ++ return ret; + } + + +-- +2.39.5 + diff --git a/queue-5.15/crypto-ixp4xx-fix-of-node-reference-leaks-in-init_ix.patch b/queue-5.15/crypto-ixp4xx-fix-of-node-reference-leaks-in-init_ix.patch new file mode 100644 index 0000000000..5927687fc6 --- /dev/null +++ b/queue-5.15/crypto-ixp4xx-fix-of-node-reference-leaks-in-init_ix.patch @@ -0,0 +1,55 @@ +From 3cf171ce9aef3999479d1b8c1af8aea5355ea04b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Dec 2024 16:27:20 +0900 +Subject: crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto() + +From: Joe Hattori + +[ Upstream commit 472a989029aac2b78ef2f0b18b27c568bf76d104 ] + +init_ixp_crypto() calls of_parse_phandle_with_fixed_args() multiple +times, but does not release all the obtained refcounts. Fix it by adding +of_node_put() calls. + +This bug was found by an experimental static analysis tool that I am +developing. + +Fixes: 76f24b4f46b8 ("crypto: ixp4xx - Add device tree support") +Signed-off-by: Joe Hattori +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ixp4xx_crypto.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c +index 98730aab287c3..2bf315554f02a 100644 +--- a/drivers/crypto/ixp4xx_crypto.c ++++ b/drivers/crypto/ixp4xx_crypto.c +@@ -470,6 +470,7 @@ static int init_ixp_crypto(struct device *dev) + return -ENODEV; + } + npe_id = npe_spec.args[0]; ++ of_node_put(npe_spec.np); + + ret = of_parse_phandle_with_fixed_args(np, "queue-rx", 1, 0, + &queue_spec); +@@ -478,6 +479,7 @@ static int init_ixp_crypto(struct device *dev) + return -ENODEV; + } + recv_qid = queue_spec.args[0]; ++ of_node_put(queue_spec.np); + + ret = of_parse_phandle_with_fixed_args(np, "queue-txready", 1, 0, + &queue_spec); +@@ -486,6 +488,7 @@ static int init_ixp_crypto(struct device *dev) + return -ENODEV; + } + send_qid = queue_spec.args[0]; ++ of_node_put(queue_spec.np); + } else { + /* + * Hardcoded engine when using platform data, this goes away +-- +2.39.5 + diff --git a/queue-5.15/dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch b/queue-5.15/dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch new file mode 100644 index 0000000000..785e8a3347 --- /dev/null +++ b/queue-5.15/dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch @@ -0,0 +1,55 @@ +From e7eef5523d81d66ef31b1ae9fe412c15a9fa4ae2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 11:05:07 +0900 +Subject: dmaengine: ti: edma: fix OF node reference leaks in edma_driver + +From: Joe Hattori + +[ Upstream commit e883c64778e5a9905fce955681f8ee38c7197e0f ] + +The .probe() of edma_driver calls of_parse_phandle_with_fixed_args() but +does not release the obtained OF nodes. Thus add a of_node_put() call. + +This bug was found by an experimental verification tool that I am +developing. + +Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding") +Signed-off-by: Joe Hattori +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20241219020507.1983124-3-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/edma.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c +index 69292d4a0c441..560fe658b8942 100644 +--- a/drivers/dma/ti/edma.c ++++ b/drivers/dma/ti/edma.c +@@ -217,7 +217,6 @@ struct edma_desc { + struct edma_cc; + + struct edma_tc { +- struct device_node *node; + u16 id; + }; + +@@ -2524,13 +2523,13 @@ static int edma_probe(struct platform_device *pdev) + if (ret || i == ecc->num_tc) + break; + +- ecc->tc_list[i].node = tc_args.np; + ecc->tc_list[i].id = i; + queue_priority_mapping[i][1] = tc_args.args[0]; + if (queue_priority_mapping[i][1] > lowest_priority) { + lowest_priority = queue_priority_mapping[i][1]; + info->default_queue = i; + } ++ of_node_put(tc_args.np); + } + + /* See if we have optional dma-channel-mask array */ +-- +2.39.5 + diff --git a/queue-5.15/drm-amdgpu-fix-potential-null-pointer-dereference-in.patch b/queue-5.15/drm-amdgpu-fix-potential-null-pointer-dereference-in.patch new file mode 100644 index 0000000000..e81c4c8e69 --- /dev/null +++ b/queue-5.15/drm-amdgpu-fix-potential-null-pointer-dereference-in.patch @@ -0,0 +1,44 @@ +From 3a24fa5d408e8967c7b77185f770c597925e2e05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 11:00:43 +0300 +Subject: drm/amdgpu: Fix potential NULL pointer dereference in + atomctrl_get_smc_sclk_range_table + +From: Ivan Stepchenko + +[ Upstream commit 357445e28ff004d7f10967aa93ddb4bffa5c3688 ] + +The function atomctrl_get_smc_sclk_range_table() does not check the return +value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to +retrieve SMU_Info table, it returns NULL which is later dereferenced. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +In practice this should never happen as this code only gets called +on polaris chips and the vbios data table will always be present on +those chips. + +Fixes: a23eefa2f461 ("drm/amd/powerplay: enable dpm for baffin.") +Signed-off-by: Ivan Stepchenko +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +index cc3b62f733941..1fbd23922082a 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +@@ -1420,6 +1420,8 @@ int atomctrl_get_smc_sclk_range_table(struct pp_hwmgr *hwmgr, struct pp_atom_ctr + GetIndexIntoMasterTable(DATA, SMU_Info), + &size, &frev, &crev); + ++ if (!psmu_info) ++ return -EINVAL; + + for (i = 0; i < psmu_info->ucSclkEntryNum; i++) { + table->entry[i].ucVco_setting = psmu_info->asSclkFcwRangeEntry[i].ucVco_setting; +-- +2.39.5 + diff --git a/queue-5.15/drm-etnaviv-drop-the-len-parameter-of-etnaviv_iommu_.patch b/queue-5.15/drm-etnaviv-drop-the-len-parameter-of-etnaviv_iommu_.patch new file mode 100644 index 0000000000..43512937a1 --- /dev/null +++ b/queue-5.15/drm-etnaviv-drop-the-len-parameter-of-etnaviv_iommu_.patch @@ -0,0 +1,45 @@ +From 33b751104d4541371d0f7f6045b02b5df8f30511 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Oct 2023 15:03:12 +0800 +Subject: drm/etnaviv: Drop the 'len' parameter of etnaviv_iommu_map() function + +From: Sui Jingfeng + +[ Upstream commit 9e2e8a5113bf452081cb1f6a13617e36f5298cbf ] + +The 'len' parameter is the 4th argument, because it is not get used, so +drop it. No functional change. + +Signed-off-by: Sui Jingfeng +Signed-off-by: Lucas Stach +Stable-dep-of: 9aad03e7f5db ("drm/etnaviv: Drop the offset in page manipulation") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +index 1d37b5bd86760..416ef736962f9 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +@@ -70,7 +70,7 @@ static int etnaviv_context_map(struct etnaviv_iommu_context *context, + } + + static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova, +- struct sg_table *sgt, unsigned len, int prot) ++ struct sg_table *sgt, int prot) + { struct scatterlist *sg; + unsigned int da = iova; + unsigned int i; +@@ -267,7 +267,7 @@ int etnaviv_iommu_map_gem(struct etnaviv_iommu_context *context, + goto unlock; + + mapping->iova = node->start; +- ret = etnaviv_iommu_map(context, node->start, sgt, etnaviv_obj->base.size, ++ ret = etnaviv_iommu_map(context, node->start, sgt, + ETNAVIV_PROT_READ | ETNAVIV_PROT_WRITE); + + if (ret < 0) { +-- +2.39.5 + diff --git a/queue-5.15/drm-etnaviv-drop-the-offset-in-page-manipulation.patch b/queue-5.15/drm-etnaviv-drop-the-offset-in-page-manipulation.patch new file mode 100644 index 0000000000..be11dfa8c2 --- /dev/null +++ b/queue-5.15/drm-etnaviv-drop-the-offset-in-page-manipulation.patch @@ -0,0 +1,110 @@ +From dca8289dd2c186b9b30853971c1a8e6e9b873df5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2024 20:32:44 +0800 +Subject: drm/etnaviv: Drop the offset in page manipulation + +From: Sui Jingfeng + +[ Upstream commit 9aad03e7f5db7944d5ee96cd5c595c54be2236e6 ] + +The etnaviv driver, both kernel space and user space, assumes that GPU page +size is 4KiB. Its IOMMU map/unmap 4KiB physical address range once a time. +If 'sg->offset != 0' is true, then the current implementation will map the +IOVA to a wrong area, which may lead to coherency problem. Picture 0 and 1 +give the illustration, see below. + + PA start drifted + | + |<--- 'sg_dma_address(sg) - sg->offset' + | .------ sg_dma_address(sg) + | | .---- sg_dma_len(sg) + |<-sg->offset->| | + V |<-->| Another one cpu page + +----+----+----+----+ +----+----+----+----+ + |xxxx| |||||| ||||||||||||||||||||| + +----+----+----+----+ +----+----+----+----+ + ^ ^ ^ ^ + |<--- da_len --->| | | + | | | | + | .--------------' | | + | | .----------------' | + | | | .----------------' + | | | | + | | +----+----+----+----+ + | | ||||||||||||||||||||| + | | +----+----+----+----+ + | | + | '--------------. da_len = sg_dma_len(sg) + sg->offset, using + | | 'sg_dma_len(sg) + sg->offset' will lead to GPUVA + +----+ ~~~~~~~~~~~~~+ collision, but min_t(unsigned int, da_len, va_len) + |xxxx| | will clamp it to correct size. But the IOVA will + +----+ ~~~~~~~~~~~~~+ be redirect to wrong area. + ^ + | Picture 0: Possibly wrong implementation. +GPUVA (IOVA) + +-------------------------------------------------------------------------- + + .------- sg_dma_address(sg) + | .---- sg_dma_len(sg) + |<-sg->offset->| | + | |<-->| another one cpu page + +----+----+----+----+ +----+----+----+----+ + | |||||| ||||||||||||||||||||| + +----+----+----+----+ +----+----+----+----+ + ^ ^ ^ ^ + | | | | + .--------------' | | | + | | | | + | .--------------' | | + | | .----------------' | + | | | .----------------' + | | | | + +----+ +----+----+----+----+ + |||||| ||||||||||||||||||||| The first one is SZ_4K, the second is SZ_16K + +----+ +----+----+----+----+ + ^ + | Picture 1: Perfectly correct implementation. +GPUVA (IOVA) + +If sg->offset != 0 is true, IOVA will be mapped to wrong physical address. +Either because there doesn't contain the data or there contains wrong data. +Strictly speaking, the memory area that before sg_dma_address(sg) doesn't +belong to us, and it's likely that the area is being used by other process. + +Because we don't want to introduce confusions about which part is visible +to the GPU, we assumes that the size of GPUVA is always 4KiB aligned. This +is very relaxed requirement, since we already made the decision that GPU +page size is 4KiB (as a canonical decision). And softpin feature is landed, +Mesa's util_vma_heap_alloc() will certainly report correct length of GPUVA +to kernel with desired alignment ensured. + +With above statements agreed, drop the "offset in page" manipulation will +return us a correct implementation at any case. + +Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver") +Signed-off-by: Sui Jingfeng +Signed-off-by: Lucas Stach +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +index 8fcedaec6c9ee..4e7342b3adcd7 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +@@ -82,8 +82,8 @@ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, + return -EINVAL; + + for_each_sgtable_dma_sg(sgt, sg, i) { +- phys_addr_t pa = sg_dma_address(sg) - sg->offset; +- unsigned int da_len = sg_dma_len(sg) + sg->offset; ++ phys_addr_t pa = sg_dma_address(sg); ++ unsigned int da_len = sg_dma_len(sg); + unsigned int bytes = min_t(unsigned int, da_len, va_len); + + VERB("map[%d]: %08x %pap(%x)", i, iova, &pa, bytes); +-- +2.39.5 + diff --git a/queue-5.15/drm-etnaviv-drop-the-second-argument-of-the-etnaviv_.patch b/queue-5.15/drm-etnaviv-drop-the-second-argument-of-the-etnaviv_.patch new file mode 100644 index 0000000000..0c6224950a --- /dev/null +++ b/queue-5.15/drm-etnaviv-drop-the-second-argument-of-the-etnaviv_.patch @@ -0,0 +1,55 @@ +From c497c76a91d71022420bc2add2c1bb89ab4319e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Oct 2023 19:12:03 +0800 +Subject: drm/etnaviv: Drop the second argument of the etnaviv_gem_new_impl() + +From: Sui Jingfeng + +[ Upstream commit 4c6e6c01d82fc0edd8b47cb1ffbd05289029b005 ] + +The mentioned second parameter is the 'u32 size', but it is not get used by +the etnaviv_gem_new_impl() function, so drop it. No functional change. + +Signed-off-by: Sui Jingfeng +Signed-off-by: Lucas Stach +Stable-dep-of: 9aad03e7f5db ("drm/etnaviv: Drop the offset in page manipulation") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_gem.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +index 1d04232293e58..8708fc42a7c9f 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +@@ -575,7 +575,7 @@ static const struct drm_gem_object_funcs etnaviv_gem_object_funcs = { + .vm_ops = &vm_ops, + }; + +-static int etnaviv_gem_new_impl(struct drm_device *dev, u32 size, u32 flags, ++static int etnaviv_gem_new_impl(struct drm_device *dev, u32 flags, + const struct etnaviv_gem_ops *ops, struct drm_gem_object **obj) + { + struct etnaviv_gem_object *etnaviv_obj; +@@ -624,8 +624,7 @@ int etnaviv_gem_new_handle(struct drm_device *dev, struct drm_file *file, + + size = PAGE_ALIGN(size); + +- ret = etnaviv_gem_new_impl(dev, size, flags, +- &etnaviv_gem_shmem_ops, &obj); ++ ret = etnaviv_gem_new_impl(dev, flags, &etnaviv_gem_shmem_ops, &obj); + if (ret) + goto fail; + +@@ -660,7 +659,7 @@ int etnaviv_gem_new_private(struct drm_device *dev, size_t size, u32 flags, + struct drm_gem_object *obj; + int ret; + +- ret = etnaviv_gem_new_impl(dev, size, flags, ops, &obj); ++ ret = etnaviv_gem_new_impl(dev, flags, ops, &obj); + if (ret) + return ret; + +-- +2.39.5 + diff --git a/queue-5.15/drm-etnaviv-fix-page-property-being-used-for-non-wri.patch b/queue-5.15/drm-etnaviv-fix-page-property-being-used-for-non-wri.patch new file mode 100644 index 0000000000..e4b4d39759 --- /dev/null +++ b/queue-5.15/drm-etnaviv-fix-page-property-being-used-for-non-wri.patch @@ -0,0 +1,60 @@ +From cf08f87311ab8c864949da2f17130a052db5f7c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 08:41:56 +0800 +Subject: drm/etnaviv: Fix page property being used for non writecombine + buffers + +From: Sui Jingfeng + +[ Upstream commit 834f304192834d6f0941954f3277ae0ba11a9a86 ] + +In the etnaviv_gem_vmap_impl() function, the driver vmap whatever buffers +with write combine(WC) page property, this is incorrect. Cached buffers +should be mapped with the cached page property and uncached buffers should +be mapped with the uncached page property. + +Fixes: a0a5ab3e99b8 ("drm/etnaviv: call correct function when trying to vmap a DMABUF") +Signed-off-by: Sui Jingfeng +Signed-off-by: Lucas Stach +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_gem.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +index 87da2278398ae..1d04232293e58 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +@@ -340,6 +340,7 @@ void *etnaviv_gem_vmap(struct drm_gem_object *obj) + static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj) + { + struct page **pages; ++ pgprot_t prot; + + lockdep_assert_held(&obj->lock); + +@@ -347,8 +348,19 @@ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj) + if (IS_ERR(pages)) + return NULL; + +- return vmap(pages, obj->base.size >> PAGE_SHIFT, +- VM_MAP, pgprot_writecombine(PAGE_KERNEL)); ++ switch (obj->flags & ETNA_BO_CACHE_MASK) { ++ case ETNA_BO_CACHED: ++ prot = PAGE_KERNEL; ++ break; ++ case ETNA_BO_UNCACHED: ++ prot = pgprot_noncached(PAGE_KERNEL); ++ break; ++ case ETNA_BO_WC: ++ default: ++ prot = pgprot_writecombine(PAGE_KERNEL); ++ } ++ ++ return vmap(pages, obj->base.size >> PAGE_SHIFT, VM_MAP, prot); + } + + static inline enum dma_data_direction etnaviv_op_to_dma_dir(u32 op) +-- +2.39.5 + diff --git a/queue-5.15/drm-etnaviv-map-and-unmap-gpuva-range-with-respect-t.patch b/queue-5.15/drm-etnaviv-map-and-unmap-gpuva-range-with-respect-t.patch new file mode 100644 index 0000000000..5da3173a40 --- /dev/null +++ b/queue-5.15/drm-etnaviv-map-and-unmap-gpuva-range-with-respect-t.patch @@ -0,0 +1,119 @@ +From ef68036bb6f34423a035e83dd44de289379f5e9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Oct 2024 04:43:55 +0800 +Subject: drm/etnaviv: Map and unmap GPUVA range with respect to the GPUVA size + +From: Sui Jingfeng + +[ Upstream commit 68786b7f49873c69ec332a045a9bf4337d71ec20 ] + +Etnaviv assumes that GPU page size is 4KiB, however, GPUVA ranges collision +when using softpin capable GPUs on a non 4KiB CPU page size configuration. +The root cause is that kernel side BO takes up bigger address space than +userspace expect, the size of backing memory of GEM buffer objects are +required to align to the CPU PAGE_SIZE. Therefore, results in userspace +allocated GPUVA range fails to be inserted to the specified hole exactly. + +To solve this problem, record the GPU visiable size of a BO firstly, then +map and unmap the SG entry strictly with respect to the total GPUVA size. + +Signed-off-by: Sui Jingfeng +Signed-off-by: Lucas Stach +Stable-dep-of: 9aad03e7f5db ("drm/etnaviv: Drop the offset in page manipulation") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 38 +++++++++------------------ + 1 file changed, 13 insertions(+), 25 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +index 416ef736962f9..8fcedaec6c9ee 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +@@ -69,9 +69,11 @@ static int etnaviv_context_map(struct etnaviv_iommu_context *context, + return ret; + } + +-static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova, ++static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, ++ u32 iova, unsigned int va_len, + struct sg_table *sgt, int prot) +-{ struct scatterlist *sg; ++{ ++ struct scatterlist *sg; + unsigned int da = iova; + unsigned int i; + int ret; +@@ -81,14 +83,16 @@ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova, + + for_each_sgtable_dma_sg(sgt, sg, i) { + phys_addr_t pa = sg_dma_address(sg) - sg->offset; +- size_t bytes = sg_dma_len(sg) + sg->offset; ++ unsigned int da_len = sg_dma_len(sg) + sg->offset; ++ unsigned int bytes = min_t(unsigned int, da_len, va_len); + +- VERB("map[%d]: %08x %pap(%zx)", i, iova, &pa, bytes); ++ VERB("map[%d]: %08x %pap(%x)", i, iova, &pa, bytes); + + ret = etnaviv_context_map(context, da, pa, bytes, prot); + if (ret) + goto fail; + ++ va_len -= bytes; + da += bytes; + } + +@@ -104,21 +108,7 @@ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova, + static void etnaviv_iommu_unmap(struct etnaviv_iommu_context *context, u32 iova, + struct sg_table *sgt, unsigned len) + { +- struct scatterlist *sg; +- unsigned int da = iova; +- int i; +- +- for_each_sgtable_dma_sg(sgt, sg, i) { +- size_t bytes = sg_dma_len(sg) + sg->offset; +- +- etnaviv_context_unmap(context, da, bytes); +- +- VERB("unmap[%d]: %08x(%zx)", i, iova, bytes); +- +- BUG_ON(!PAGE_ALIGNED(bytes)); +- +- da += bytes; +- } ++ etnaviv_context_unmap(context, iova, len); + + context->flush_seq++; + } +@@ -131,7 +121,7 @@ static void etnaviv_iommu_remove_mapping(struct etnaviv_iommu_context *context, + lockdep_assert_held(&context->lock); + + etnaviv_iommu_unmap(context, mapping->vram_node.start, +- etnaviv_obj->sgt, etnaviv_obj->base.size); ++ etnaviv_obj->sgt, etnaviv_obj->size); + drm_mm_remove_node(&mapping->vram_node); + } + +@@ -258,16 +248,14 @@ int etnaviv_iommu_map_gem(struct etnaviv_iommu_context *context, + node = &mapping->vram_node; + + if (va) +- ret = etnaviv_iommu_insert_exact(context, node, +- etnaviv_obj->base.size, va); ++ ret = etnaviv_iommu_insert_exact(context, node, etnaviv_obj->size, va); + else +- ret = etnaviv_iommu_find_iova(context, node, +- etnaviv_obj->base.size); ++ ret = etnaviv_iommu_find_iova(context, node, etnaviv_obj->size); + if (ret < 0) + goto unlock; + + mapping->iova = node->start; +- ret = etnaviv_iommu_map(context, node->start, sgt, ++ ret = etnaviv_iommu_map(context, node->start, etnaviv_obj->size, sgt, + ETNAVIV_PROT_READ | ETNAVIV_PROT_WRITE); + + if (ret < 0) { +-- +2.39.5 + diff --git a/queue-5.15/drm-etnaviv-move-flush_seq-increment-into-etnaviv_io.patch b/queue-5.15/drm-etnaviv-move-flush_seq-increment-into-etnaviv_io.patch new file mode 100644 index 0000000000..816bf4f0bd --- /dev/null +++ b/queue-5.15/drm-etnaviv-move-flush_seq-increment-into-etnaviv_io.patch @@ -0,0 +1,68 @@ +From 6e5106528a463124fb7dcfab32b0031f7b06abaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Mar 2022 17:08:24 +0100 +Subject: drm/etnaviv: move flush_seq increment into etnaviv_iommu_map/unmap +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lucas Stach + +[ Upstream commit 9247fcca3982a29b04b002f0d30def9ff50740d5 ] + +The flush sequence is a marker that the page tables have been changed +and any affected TLBs need to be flushed. Move the flush_seq increment +a little further down the call stack to place it next to the actual +page table manipulation. Not functional change. + +Signed-off-by: Lucas Stach +Reviewed-by: Philipp Zabel +Tested-by: Guido Günther +Acked-by: Guido Günther +Stable-dep-of: 9aad03e7f5db ("drm/etnaviv: Drop the offset in page manipulation") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +index 2de806173b3aa..1d37b5bd86760 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +@@ -92,6 +92,8 @@ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova, + da += bytes; + } + ++ context->flush_seq++; ++ + return 0; + + fail: +@@ -117,6 +119,8 @@ static void etnaviv_iommu_unmap(struct etnaviv_iommu_context *context, u32 iova, + + da += bytes; + } ++ ++ context->flush_seq++; + } + + static void etnaviv_iommu_remove_mapping(struct etnaviv_iommu_context *context, +@@ -272,7 +276,6 @@ int etnaviv_iommu_map_gem(struct etnaviv_iommu_context *context, + } + + list_add_tail(&mapping->mmu_node, &context->mappings); +- context->flush_seq++; + unlock: + mutex_unlock(&context->lock); + +@@ -297,7 +300,6 @@ void etnaviv_iommu_unmap_gem(struct etnaviv_iommu_context *context, + etnaviv_iommu_remove_mapping(context, mapping); + + list_del(&mapping->mmu_node); +- context->flush_seq++; + mutex_unlock(&context->lock); + } + +-- +2.39.5 + diff --git a/queue-5.15/drm-etnaviv-record-gpu-visible-size-of-gem-bo-separa.patch b/queue-5.15/drm-etnaviv-record-gpu-visible-size-of-gem-bo-separa.patch new file mode 100644 index 0000000000..3f410d0019 --- /dev/null +++ b/queue-5.15/drm-etnaviv-record-gpu-visible-size-of-gem-bo-separa.patch @@ -0,0 +1,93 @@ +From 742f8a782dae24c01a1f7def835017ff18db5132 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Oct 2024 04:43:54 +0800 +Subject: drm/etnaviv: Record GPU visible size of GEM BO separately + +From: Sui Jingfeng + +[ Upstream commit b5f1eed853c6ea6a99149fd97fe179f3ebd96a02 ] + +The GPU visible size of a GEM BO is not necessarily PAGE_SIZE aligned, +which happens when CPU page size is not equal to GPU page size. Extra +precious resources such as GPU page tables and GPU TLBs may being paid +because of this but never get used. + +Track the size of GPU visible part of GEM BO separately, ensure no +GPUVA range wasting by aligning that size to GPU page size. + +Signed-off-by: Sui Jingfeng +Signed-off-by: Lucas Stach +Stable-dep-of: 9aad03e7f5db ("drm/etnaviv: Drop the offset in page manipulation") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_gem.c | 11 +++++------ + drivers/gpu/drm/etnaviv/etnaviv_gem.h | 5 +++++ + 2 files changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +index 8708fc42a7c9f..70862a84a4137 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +@@ -575,7 +575,7 @@ static const struct drm_gem_object_funcs etnaviv_gem_object_funcs = { + .vm_ops = &vm_ops, + }; + +-static int etnaviv_gem_new_impl(struct drm_device *dev, u32 flags, ++static int etnaviv_gem_new_impl(struct drm_device *dev, u32 size, u32 flags, + const struct etnaviv_gem_ops *ops, struct drm_gem_object **obj) + { + struct etnaviv_gem_object *etnaviv_obj; +@@ -602,6 +602,7 @@ static int etnaviv_gem_new_impl(struct drm_device *dev, u32 flags, + if (!etnaviv_obj) + return -ENOMEM; + ++ etnaviv_obj->size = ALIGN(size, SZ_4K); + etnaviv_obj->flags = flags; + etnaviv_obj->ops = ops; + +@@ -622,15 +623,13 @@ int etnaviv_gem_new_handle(struct drm_device *dev, struct drm_file *file, + struct drm_gem_object *obj = NULL; + int ret; + +- size = PAGE_ALIGN(size); +- +- ret = etnaviv_gem_new_impl(dev, flags, &etnaviv_gem_shmem_ops, &obj); ++ ret = etnaviv_gem_new_impl(dev, size, flags, &etnaviv_gem_shmem_ops, &obj); + if (ret) + goto fail; + + lockdep_set_class(&to_etnaviv_bo(obj)->lock, &etnaviv_shm_lock_class); + +- ret = drm_gem_object_init(dev, obj, size); ++ ret = drm_gem_object_init(dev, obj, PAGE_ALIGN(size)); + if (ret) + goto fail; + +@@ -659,7 +658,7 @@ int etnaviv_gem_new_private(struct drm_device *dev, size_t size, u32 flags, + struct drm_gem_object *obj; + int ret; + +- ret = etnaviv_gem_new_impl(dev, flags, ops, &obj); ++ ret = etnaviv_gem_new_impl(dev, size, flags, ops, &obj); + if (ret) + return ret; + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.h b/drivers/gpu/drm/etnaviv/etnaviv_gem.h +index 98e60df882b68..a923ba82e3363 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.h ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.h +@@ -36,6 +36,11 @@ struct etnaviv_gem_object { + const struct etnaviv_gem_ops *ops; + struct mutex lock; + ++ /* ++ * The actual size that is visible to the GPU, not necessarily ++ * PAGE_SIZE aligned, but should be aligned to GPU page size. ++ */ ++ u32 size; + u32 flags; + + struct list_head gem_node; +-- +2.39.5 + diff --git a/queue-5.15/dt-bindings-another-pass-removing-cases-of-allof-con.patch b/queue-5.15/dt-bindings-another-pass-removing-cases-of-allof-con.patch new file mode 100644 index 0000000000..539eec9851 --- /dev/null +++ b/queue-5.15/dt-bindings-another-pass-removing-cases-of-allof-con.patch @@ -0,0 +1,415 @@ +From ac628208f790a321fdec693a126b9a93f0372831 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 15:38:02 -0600 +Subject: dt-bindings: Another pass removing cases of 'allOf' containing a + '$ref' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rob Herring + +[ Upstream commit dca669354e6ff494222dfc461bed1087264f3755 ] + +Another pass at removing unnecessary use of 'allOf' with a '$ref'. + +json-schema versions draft7 and earlier have a weird behavior in that +any keywords combined with a '$ref' are ignored (silently). The correct +form was to put a '$ref' under an 'allOf'. This behavior is now changed +in the 2019-09 json-schema spec and '$ref' can be mixed with other +keywords. + +Cc: Krzysztof Kozlowski +Cc: Thierry Reding +Cc: Sam Ravnborg +Cc: Dmitry Torokhov +Cc: Pavel Machek +Cc: Guenter Roeck +Cc: Richard Weinberger +Cc: Vignesh Raghavendra +Cc: "David S. Miller" +Cc: Kishon Vijay Abraham I +Cc: Sebastian Reichel +Cc: Mathieu Poirier +Signed-off-by: Rob Herring +Acked-by: Mark Brown +Reviewed-by: Greg Kroah-Hartman +Acked-By: Vinod Koul +Acked-by: Lee Jones +Acked-by: Marek Behún +Acked-by: Miquel Raynal +Reviewed-by: Laurent Pinchart +Acked-by: Jakub Kicinski +Acked-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220228213802.1639658-1-robh@kernel.org +Stable-dep-of: 609bc99a4452 ("dt-bindings: leds: class-multicolor: Fix path to color definitions") +Signed-off-by: Sasha Levin +--- + .../bindings/connector/usb-connector.yaml | 3 +-- + .../bindings/display/brcm,bcm2711-hdmi.yaml | 3 +-- + .../bindings/display/bridge/adi,adv7511.yaml | 5 ++--- + .../bindings/display/bridge/synopsys,dw-hdmi.yaml | 5 ++--- + .../bindings/display/panel/display-timings.yaml | 3 +-- + .../devicetree/bindings/display/ste,mcde.yaml | 4 ++-- + .../devicetree/bindings/input/adc-joystick.yaml | 9 ++++----- + .../bindings/leds/cznic,turris-omnia-leds.yaml | 3 +-- + .../devicetree/bindings/leds/leds-lp50xx.yaml | 3 +-- + .../devicetree/bindings/mfd/google,cros-ec.yaml | 12 ++++-------- + .../bindings/mtd/rockchip,nand-controller.yaml | 3 +-- + .../devicetree/bindings/net/ti,cpsw-switch.yaml | 3 +-- + .../bindings/phy/phy-stm32-usbphyc.yaml | 3 +-- + .../bindings/power/supply/sbs,sbs-manager.yaml | 4 +--- + .../bindings/remoteproc/ti,k3-r5f-rproc.yaml | 3 +-- + .../devicetree/bindings/soc/ti/ti,pruss.yaml | 15 +++------------ + .../devicetree/bindings/sound/st,stm32-sai.yaml | 3 +-- + .../devicetree/bindings/sound/tlv320adcx140.yaml | 13 ++++++------- + .../devicetree/bindings/spi/spi-controller.yaml | 4 +--- + .../devicetree/bindings/usb/st,stusb160x.yaml | 4 +--- + 20 files changed, 36 insertions(+), 69 deletions(-) + +diff --git a/Documentation/devicetree/bindings/connector/usb-connector.yaml b/Documentation/devicetree/bindings/connector/usb-connector.yaml +index 7eb8659fa610f..0420fa5635322 100644 +--- a/Documentation/devicetree/bindings/connector/usb-connector.yaml ++++ b/Documentation/devicetree/bindings/connector/usb-connector.yaml +@@ -104,8 +104,7 @@ properties: + - "1.5A" and "3.0A", 5V 1.5A and 5V 3.0A respectively, as defined in USB + Type-C Cable and Connector specification, when Power Delivery is not + supported. +- allOf: +- - $ref: /schemas/types.yaml#/definitions/string ++ $ref: /schemas/types.yaml#/definitions/string + enum: + - default + - 1.5A +diff --git a/Documentation/devicetree/bindings/display/brcm,bcm2711-hdmi.yaml b/Documentation/devicetree/bindings/display/brcm,bcm2711-hdmi.yaml +index a1d5a32660e0d..a9d34dd7bbc53 100644 +--- a/Documentation/devicetree/bindings/display/brcm,bcm2711-hdmi.yaml ++++ b/Documentation/devicetree/bindings/display/brcm,bcm2711-hdmi.yaml +@@ -72,8 +72,7 @@ properties: + - const: hpd-removed + + ddc: +- allOf: +- - $ref: /schemas/types.yaml#/definitions/phandle ++ $ref: /schemas/types.yaml#/definitions/phandle + description: > + Phandle of the I2C controller used for DDC EDID probing + +diff --git a/Documentation/devicetree/bindings/display/bridge/adi,adv7511.yaml b/Documentation/devicetree/bindings/display/bridge/adi,adv7511.yaml +index d3dd7a79b9093..f08a01dfedf3f 100644 +--- a/Documentation/devicetree/bindings/display/bridge/adi,adv7511.yaml ++++ b/Documentation/devicetree/bindings/display/bridge/adi,adv7511.yaml +@@ -76,9 +76,8 @@ properties: + + adi,input-depth: + description: Number of bits per color component at the input. +- allOf: +- - $ref: /schemas/types.yaml#/definitions/uint32 +- - enum: [ 8, 10, 12 ] ++ $ref: /schemas/types.yaml#/definitions/uint32 ++ enum: [ 8, 10, 12 ] + + adi,input-colorspace: + description: Input color space. +diff --git a/Documentation/devicetree/bindings/display/bridge/synopsys,dw-hdmi.yaml b/Documentation/devicetree/bindings/display/bridge/synopsys,dw-hdmi.yaml +index 9be44a682e67a..b00246faea57c 100644 +--- a/Documentation/devicetree/bindings/display/bridge/synopsys,dw-hdmi.yaml ++++ b/Documentation/devicetree/bindings/display/bridge/synopsys,dw-hdmi.yaml +@@ -26,9 +26,8 @@ properties: + reg-io-width: + description: + Width (in bytes) of the registers specified by the reg property. +- allOf: +- - $ref: /schemas/types.yaml#/definitions/uint32 +- - enum: [1, 4] ++ $ref: /schemas/types.yaml#/definitions/uint32 ++ enum: [1, 4] + default: 1 + + clocks: +diff --git a/Documentation/devicetree/bindings/display/panel/display-timings.yaml b/Documentation/devicetree/bindings/display/panel/display-timings.yaml +index 56903ded005e5..6d30575819d3b 100644 +--- a/Documentation/devicetree/bindings/display/panel/display-timings.yaml ++++ b/Documentation/devicetree/bindings/display/panel/display-timings.yaml +@@ -31,8 +31,7 @@ properties: + patternProperties: + "^timing": + type: object +- allOf: +- - $ref: panel-timing.yaml# ++ $ref: panel-timing.yaml# + + additionalProperties: false + +diff --git a/Documentation/devicetree/bindings/display/ste,mcde.yaml b/Documentation/devicetree/bindings/display/ste,mcde.yaml +index de0c678b3c294..564ea845c82e0 100644 +--- a/Documentation/devicetree/bindings/display/ste,mcde.yaml ++++ b/Documentation/devicetree/bindings/display/ste,mcde.yaml +@@ -58,8 +58,8 @@ patternProperties: + "^dsi@[0-9a-f]+$": + description: subnodes for the three DSI host adapters + type: object +- allOf: +- - $ref: dsi-controller.yaml# ++ $ref: dsi-controller.yaml# ++ + properties: + compatible: + const: ste,mcde-dsi +diff --git a/Documentation/devicetree/bindings/input/adc-joystick.yaml b/Documentation/devicetree/bindings/input/adc-joystick.yaml +index 721878d5b7af2..2ee04e03bc224 100644 +--- a/Documentation/devicetree/bindings/input/adc-joystick.yaml ++++ b/Documentation/devicetree/bindings/input/adc-joystick.yaml +@@ -61,11 +61,10 @@ patternProperties: + description: EV_ABS specific event code generated by the axis. + + abs-range: +- allOf: +- - $ref: /schemas/types.yaml#/definitions/uint32-array +- - items: +- - description: minimum value +- - description: maximum value ++ $ref: /schemas/types.yaml#/definitions/uint32-array ++ items: ++ - description: minimum value ++ - description: maximum value + description: > + Minimum and maximum values produced by the axis. + For an ABS_X axis this will be the left-most and right-most +diff --git a/Documentation/devicetree/bindings/leds/cznic,turris-omnia-leds.yaml b/Documentation/devicetree/bindings/leds/cznic,turris-omnia-leds.yaml +index c7ed2871da06a..9362b1ef9e88a 100644 +--- a/Documentation/devicetree/bindings/leds/cznic,turris-omnia-leds.yaml ++++ b/Documentation/devicetree/bindings/leds/cznic,turris-omnia-leds.yaml +@@ -32,8 +32,7 @@ properties: + patternProperties: + "^multi-led@[0-9a-b]$": + type: object +- allOf: +- - $ref: leds-class-multicolor.yaml# ++ $ref: leds-class-multicolor.yaml# + description: + This node represents one of the RGB LED devices on Turris Omnia. + No subnodes need to be added for subchannels since this controller only +diff --git a/Documentation/devicetree/bindings/leds/leds-lp50xx.yaml b/Documentation/devicetree/bindings/leds/leds-lp50xx.yaml +index c192b5feadc76..f12fe5b53f30d 100644 +--- a/Documentation/devicetree/bindings/leds/leds-lp50xx.yaml ++++ b/Documentation/devicetree/bindings/leds/leds-lp50xx.yaml +@@ -55,8 +55,7 @@ properties: + patternProperties: + '^multi-led@[0-9a-f]$': + type: object +- allOf: +- - $ref: leds-class-multicolor.yaml# ++ $ref: leds-class-multicolor.yaml# + properties: + reg: + minItems: 1 +diff --git a/Documentation/devicetree/bindings/mfd/google,cros-ec.yaml b/Documentation/devicetree/bindings/mfd/google,cros-ec.yaml +index d793dd0316b75..546746c2e406d 100644 +--- a/Documentation/devicetree/bindings/mfd/google,cros-ec.yaml ++++ b/Documentation/devicetree/bindings/mfd/google,cros-ec.yaml +@@ -39,18 +39,14 @@ properties: + description: + This property specifies the delay in usecs between the + assertion of the CS and the first clock pulse. +- allOf: +- - $ref: /schemas/types.yaml#/definitions/uint32 +- - default: 0 +- - minimum: 0 ++ $ref: /schemas/types.yaml#/definitions/uint32 ++ default: 0 + + google,cros-ec-spi-msg-delay: + description: + This property specifies the delay in usecs between messages. +- allOf: +- - $ref: /schemas/types.yaml#/definitions/uint32 +- - default: 0 +- - minimum: 0 ++ $ref: /schemas/types.yaml#/definitions/uint32 ++ default: 0 + + google,has-vbc-nvram: + description: +diff --git a/Documentation/devicetree/bindings/mtd/rockchip,nand-controller.yaml b/Documentation/devicetree/bindings/mtd/rockchip,nand-controller.yaml +index 0922536b18114..d681a4676f069 100644 +--- a/Documentation/devicetree/bindings/mtd/rockchip,nand-controller.yaml ++++ b/Documentation/devicetree/bindings/mtd/rockchip,nand-controller.yaml +@@ -96,8 +96,7 @@ patternProperties: + + rockchip,boot-ecc-strength: + enum: [16, 24, 40, 60, 70] +- allOf: +- - $ref: /schemas/types.yaml#/definitions/uint32 ++ $ref: /schemas/types.yaml#/definitions/uint32 + description: | + If specified it indicates that a different BCH/ECC setting is + supported by the boot ROM. +diff --git a/Documentation/devicetree/bindings/net/ti,cpsw-switch.yaml b/Documentation/devicetree/bindings/net/ti,cpsw-switch.yaml +index 07a00f53adbf9..31bf825c65987 100644 +--- a/Documentation/devicetree/bindings/net/ti,cpsw-switch.yaml ++++ b/Documentation/devicetree/bindings/net/ti,cpsw-switch.yaml +@@ -88,8 +88,7 @@ properties: + type: object + description: CPSW external ports + +- allOf: +- - $ref: ethernet-controller.yaml# ++ $ref: ethernet-controller.yaml# + + properties: + reg: +diff --git a/Documentation/devicetree/bindings/phy/phy-stm32-usbphyc.yaml b/Documentation/devicetree/bindings/phy/phy-stm32-usbphyc.yaml +index 3329f1d33a4fe..3da0c4ee45cff 100644 +--- a/Documentation/devicetree/bindings/phy/phy-stm32-usbphyc.yaml ++++ b/Documentation/devicetree/bindings/phy/phy-stm32-usbphyc.yaml +@@ -76,8 +76,7 @@ patternProperties: + + connector: + type: object +- allOf: +- - $ref: ../connector/usb-connector.yaml ++ $ref: /schemas/connector/usb-connector.yaml + properties: + vbus-supply: true + +diff --git a/Documentation/devicetree/bindings/power/supply/sbs,sbs-manager.yaml b/Documentation/devicetree/bindings/power/supply/sbs,sbs-manager.yaml +index 72e8f274c791d..99f506d6b0a02 100644 +--- a/Documentation/devicetree/bindings/power/supply/sbs,sbs-manager.yaml ++++ b/Documentation/devicetree/bindings/power/supply/sbs,sbs-manager.yaml +@@ -46,9 +46,7 @@ additionalProperties: false + patternProperties: + "^i2c@[1-4]$": + type: object +- +- allOf: +- - $ref: /schemas/i2c/i2c-controller.yaml# ++ $ref: /schemas/i2c/i2c-controller.yaml# + + examples: + - | +diff --git a/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml b/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml +index 130fbaacc4b15..3daa4b37f4f6d 100644 +--- a/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml ++++ b/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml +@@ -94,8 +94,7 @@ patternProperties: + addresses. Cache and memory access settings are provided through a + Memory Protection Unit (MPU), programmable only from the R5Fs. + +- allOf: +- - $ref: /schemas/arm/keystone/ti,k3-sci-common.yaml# ++ $ref: /schemas/arm/keystone/ti,k3-sci-common.yaml# + + properties: + compatible: +diff --git a/Documentation/devicetree/bindings/soc/ti/ti,pruss.yaml b/Documentation/devicetree/bindings/soc/ti/ti,pruss.yaml +index 9d128b9e7deb6..64461d4320048 100644 +--- a/Documentation/devicetree/bindings/soc/ti/ti,pruss.yaml ++++ b/Documentation/devicetree/bindings/soc/ti/ti,pruss.yaml +@@ -281,10 +281,7 @@ patternProperties: + PRUSS INTC Node. Each PRUSS has a single interrupt controller instance + that is common to all the PRU cores. This should be represented as an + interrupt-controller node. +- +- allOf: +- - $ref: /schemas/interrupt-controller/ti,pruss-intc.yaml# +- ++ $ref: /schemas/interrupt-controller/ti,pruss-intc.yaml# + type: object + + mdio@[a-f0-9]+$: +@@ -292,10 +289,7 @@ patternProperties: + MDIO Node. Each PRUSS has an MDIO module that can be used to control + external PHYs. The MDIO module used within the PRU-ICSS is an instance of + the MDIO Controller used in TI Davinci SoCs. +- +- allOf: +- - $ref: /schemas/net/ti,davinci-mdio.yaml# +- ++ $ref: /schemas/net/ti,davinci-mdio.yaml# + type: object + + "^(pru|rtu|txpru)@[0-9a-f]+$": +@@ -305,10 +299,7 @@ patternProperties: + inactive by using the standard DT string property, "status". The ICSSG IP + present on K3 SoCs have additional auxiliary PRU cores with slightly + different IP integration. +- +- allOf: +- - $ref: /schemas/remoteproc/ti,pru-rproc.yaml# +- ++ $ref: /schemas/remoteproc/ti,pru-rproc.yaml# + type: object + + required: +diff --git a/Documentation/devicetree/bindings/sound/st,stm32-sai.yaml b/Documentation/devicetree/bindings/sound/st,stm32-sai.yaml +index f97132400bb60..2c5e237db4995 100644 +--- a/Documentation/devicetree/bindings/sound/st,stm32-sai.yaml ++++ b/Documentation/devicetree/bindings/sound/st,stm32-sai.yaml +@@ -113,8 +113,7 @@ patternProperties: + By default, custom protocol is assumed, meaning that protocol is + configured according to protocol defined in related DAI link node, + such as i2s, left justified, right justified, dsp and pdm protocols. +- allOf: +- - $ref: /schemas/types.yaml#/definitions/flag ++ $ref: /schemas/types.yaml#/definitions/flag + + "#clock-cells": + description: Configure the SAI device as master clock provider. +diff --git a/Documentation/devicetree/bindings/sound/tlv320adcx140.yaml b/Documentation/devicetree/bindings/sound/tlv320adcx140.yaml +index d77c8283526d9..2ad17b361db0a 100644 +--- a/Documentation/devicetree/bindings/sound/tlv320adcx140.yaml ++++ b/Documentation/devicetree/bindings/sound/tlv320adcx140.yaml +@@ -176,13 +176,12 @@ patternProperties: + 4 - Drive weak low and active high + 5 - Drive Hi-Z and active high + +- allOf: +- - $ref: /schemas/types.yaml#/definitions/uint32-array +- - minItems: 2 +- maxItems: 2 +- items: +- maximum: 15 +- default: [2, 2] ++ $ref: /schemas/types.yaml#/definitions/uint32-array ++ minItems: 2 ++ maxItems: 2 ++ items: ++ maximum: 15 ++ default: [2, 2] + + required: + - compatible +diff --git a/Documentation/devicetree/bindings/spi/spi-controller.yaml b/Documentation/devicetree/bindings/spi/spi-controller.yaml +index 36b72518f5654..6d0511a8727f7 100644 +--- a/Documentation/devicetree/bindings/spi/spi-controller.yaml ++++ b/Documentation/devicetree/bindings/spi/spi-controller.yaml +@@ -93,9 +93,7 @@ properties: + patternProperties: + "^.*@[0-9a-f]+$": + type: object +- +- allOf: +- - $ref: spi-peripheral-props.yaml ++ $ref: spi-peripheral-props.yaml + + required: + - compatible +diff --git a/Documentation/devicetree/bindings/usb/st,stusb160x.yaml b/Documentation/devicetree/bindings/usb/st,stusb160x.yaml +index 9a51efa9d101e..35477fc6d9f43 100644 +--- a/Documentation/devicetree/bindings/usb/st,stusb160x.yaml ++++ b/Documentation/devicetree/bindings/usb/st,stusb160x.yaml +@@ -32,9 +32,7 @@ properties: + + connector: + type: object +- +- allOf: +- - $ref: ../connector/usb-connector.yaml ++ $ref: /schemas/connector/usb-connector.yaml# + + properties: + compatible: +-- +2.39.5 + diff --git a/queue-5.15/dt-bindings-leds-add-multicolor-pwm-led-bindings.patch b/queue-5.15/dt-bindings-leds-add-multicolor-pwm-led-bindings.patch new file mode 100644 index 0000000000..74bda9bebc --- /dev/null +++ b/queue-5.15/dt-bindings-leds-add-multicolor-pwm-led-bindings.patch @@ -0,0 +1,110 @@ +From 6cbb375f4ec32f5ca112610b03e9bf06cdbc2c15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 09:32:24 +0200 +Subject: dt-bindings: leds: Add multicolor PWM LED bindings + +From: Sven Schwermer + +[ Upstream commit ac123741b8f52311af118f8a052b1cbbed041291 ] + +This allows to group multiple PWM-connected monochrome LEDs into +multicolor LEDs, e.g. RGB LEDs. + +Signed-off-by: Sven Schwermer +Reviewed-by: Rob Herring +Signed-off-by: Pavel Machek +Stable-dep-of: 609bc99a4452 ("dt-bindings: leds: class-multicolor: Fix path to color definitions") +Signed-off-by: Sasha Levin +--- + .../bindings/leds/leds-pwm-multicolor.yaml | 79 +++++++++++++++++++ + 1 file changed, 79 insertions(+) + create mode 100644 Documentation/devicetree/bindings/leds/leds-pwm-multicolor.yaml + +diff --git a/Documentation/devicetree/bindings/leds/leds-pwm-multicolor.yaml b/Documentation/devicetree/bindings/leds/leds-pwm-multicolor.yaml +new file mode 100644 +index 0000000000000..6625a528f7275 +--- /dev/null ++++ b/Documentation/devicetree/bindings/leds/leds-pwm-multicolor.yaml +@@ -0,0 +1,79 @@ ++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) ++%YAML 1.2 ++--- ++$id: http://devicetree.org/schemas/leds/leds-pwm-multicolor.yaml# ++$schema: http://devicetree.org/meta-schemas/core.yaml# ++ ++title: Multi-color LEDs connected to PWM ++ ++maintainers: ++ - Sven Schwermer ++ ++description: | ++ This driver combines several monochrome PWM LEDs into one multi-color ++ LED using the multicolor LED class. ++ ++properties: ++ compatible: ++ const: pwm-leds-multicolor ++ ++ multi-led: ++ type: object ++ ++ patternProperties: ++ "^led-[0-9a-z]+$": ++ type: object ++ $ref: common.yaml# ++ ++ additionalProperties: false ++ ++ properties: ++ pwms: ++ maxItems: 1 ++ ++ pwm-names: true ++ ++ color: true ++ ++ required: ++ - pwms ++ - color ++ ++required: ++ - compatible ++ ++allOf: ++ - $ref: leds-class-multicolor.yaml# ++ ++additionalProperties: false ++ ++examples: ++ - | ++ #include ++ ++ led-controller { ++ compatible = "pwm-leds-multicolor"; ++ ++ multi-led { ++ color = ; ++ function = LED_FUNCTION_INDICATOR; ++ max-brightness = <65535>; ++ ++ led-red { ++ pwms = <&pwm1 0 1000000>; ++ color = ; ++ }; ++ ++ led-green { ++ pwms = <&pwm2 0 1000000>; ++ color = ; ++ }; ++ ++ led-blue { ++ pwms = <&pwm3 0 1000000>; ++ color = ; ++ }; ++ }; ++ }; ++ ++... +-- +2.39.5 + diff --git a/queue-5.15/dt-bindings-leds-add-qualcomm-light-pulse-generator-.patch b/queue-5.15/dt-bindings-leds-add-qualcomm-light-pulse-generator-.patch new file mode 100644 index 0000000000..d44c46151e --- /dev/null +++ b/queue-5.15/dt-bindings-leds-add-qualcomm-light-pulse-generator-.patch @@ -0,0 +1,207 @@ +From 954c22fc83af54b3e0622f7ad7f58aca3b5053d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Mar 2022 13:42:59 -0800 +Subject: dt-bindings: leds: Add Qualcomm Light Pulse Generator binding + +From: Bjorn Andersson + +[ Upstream commit a8e53db46f19f67be6a26488aafb7d10c78e33bd ] + +This adds the binding document describing the three hardware blocks +related to the Light Pulse Generator found in a wide range of Qualcomm +PMICs. + +Signed-off-by: Bjorn Andersson +Reviewed-by: Stephen Boyd +Reviewed-by: Rob Herring +Reviewed-by: Marijn Suijten +Signed-off-by: Pavel Machek +Stable-dep-of: 609bc99a4452 ("dt-bindings: leds: class-multicolor: Fix path to color definitions") +Signed-off-by: Sasha Levin +--- + .../bindings/leds/leds-qcom-lpg.yaml | 173 ++++++++++++++++++ + 1 file changed, 173 insertions(+) + create mode 100644 Documentation/devicetree/bindings/leds/leds-qcom-lpg.yaml + +diff --git a/Documentation/devicetree/bindings/leds/leds-qcom-lpg.yaml b/Documentation/devicetree/bindings/leds/leds-qcom-lpg.yaml +new file mode 100644 +index 0000000000000..336bd8e10efd3 +--- /dev/null ++++ b/Documentation/devicetree/bindings/leds/leds-qcom-lpg.yaml +@@ -0,0 +1,173 @@ ++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) ++%YAML 1.2 ++--- ++$id: http://devicetree.org/schemas/leds/leds-qcom-lpg.yaml# ++$schema: http://devicetree.org/meta-schemas/core.yaml# ++ ++title: Qualcomm Light Pulse Generator ++ ++maintainers: ++ - Bjorn Andersson ++ ++description: > ++ The Qualcomm Light Pulse Generator consists of three different hardware blocks; ++ a ramp generator with lookup table, the light pulse generator and a three ++ channel current sink. These blocks are found in a wide range of Qualcomm PMICs. ++ ++properties: ++ compatible: ++ enum: ++ - qcom,pm8150b-lpg ++ - qcom,pm8150l-lpg ++ - qcom,pm8916-pwm ++ - qcom,pm8941-lpg ++ - qcom,pm8994-lpg ++ - qcom,pmc8180c-lpg ++ - qcom,pmi8994-lpg ++ - qcom,pmi8998-lpg ++ ++ "#pwm-cells": ++ const: 2 ++ ++ "#address-cells": ++ const: 1 ++ ++ "#size-cells": ++ const: 0 ++ ++ qcom,power-source: ++ $ref: /schemas/types.yaml#/definitions/uint32 ++ description: ++ power-source used to drive the output, as defined in the datasheet. ++ Should be specified if the TRILED block is present ++ enum: [0, 1, 3] ++ ++ qcom,dtest: ++ $ref: /schemas/types.yaml#/definitions/uint32-matrix ++ description: > ++ A list of integer pairs, where each pair represent the dtest line the ++ particular channel should be connected to and the flags denoting how the ++ value should be outputed, as defined in the datasheet. The number of ++ pairs should be the same as the number of channels. ++ items: ++ items: ++ - description: dtest line to attach ++ - description: flags for the attachment ++ ++ multi-led: ++ type: object ++ $ref: leds-class-multicolor.yaml# ++ properties: ++ "#address-cells": ++ const: 1 ++ ++ "#size-cells": ++ const: 0 ++ ++ patternProperties: ++ "^led@[0-9a-f]$": ++ type: object ++ $ref: common.yaml# ++ ++patternProperties: ++ "^led@[0-9a-f]$": ++ type: object ++ $ref: common.yaml# ++ ++ properties: ++ reg: true ++ ++ required: ++ - reg ++ ++required: ++ - compatible ++ ++additionalProperties: false ++ ++examples: ++ - | ++ #include ++ ++ led-controller { ++ compatible = "qcom,pmi8994-lpg"; ++ ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ qcom,power-source = <1>; ++ ++ qcom,dtest = <0 0>, ++ <0 0>, ++ <0 0>, ++ <4 1>; ++ ++ led@1 { ++ reg = <1>; ++ color = ; ++ function = LED_FUNCTION_INDICATOR; ++ function-enumerator = <1>; ++ }; ++ ++ led@2 { ++ reg = <2>; ++ color = ; ++ function = LED_FUNCTION_INDICATOR; ++ function-enumerator = <0>; ++ default-state = "on"; ++ }; ++ ++ led@3 { ++ reg = <3>; ++ color = ; ++ function = LED_FUNCTION_INDICATOR; ++ function-enumerator = <2>; ++ }; ++ ++ led@4 { ++ reg = <4>; ++ color = ; ++ function = LED_FUNCTION_INDICATOR; ++ function-enumerator = <3>; ++ }; ++ }; ++ - | ++ #include ++ ++ led-controller { ++ compatible = "qcom,pmi8994-lpg"; ++ ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ qcom,power-source = <1>; ++ ++ multi-led { ++ color = ; ++ function = LED_FUNCTION_STATUS; ++ ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ led@1 { ++ reg = <1>; ++ color = ; ++ }; ++ ++ led@2 { ++ reg = <2>; ++ color = ; ++ }; ++ ++ led@3 { ++ reg = <3>; ++ color = ; ++ }; ++ }; ++ }; ++ - | ++ pwm-controller { ++ compatible = "qcom,pm8916-pwm"; ++ #pwm-cells = <2>; ++ }; ++... +-- +2.39.5 + diff --git a/queue-5.15/dt-bindings-leds-class-multicolor-fix-path-to-color-.patch b/queue-5.15/dt-bindings-leds-class-multicolor-fix-path-to-color-.patch new file mode 100644 index 0000000000..9be048250b --- /dev/null +++ b/queue-5.15/dt-bindings-leds-class-multicolor-fix-path-to-color-.patch @@ -0,0 +1,38 @@ +From 106c4752dd37016b4f0db1a978bacd2e0b4d75dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2024 13:44:29 +0100 +Subject: dt-bindings: leds: class-multicolor: Fix path to color definitions + +From: Geert Uytterhoeven + +[ Upstream commit 609bc99a4452ffbce82d10f024a85d911c42e6cd ] + +The LED color definitions have always been in +include/dt-bindings/leds/common.h in upstream. + +Fixes: 5c7f8ffe741daae7 ("dt: bindings: Add multicolor class dt bindings documention") +Signed-off-by: Geert Uytterhoeven +Acked-by: Conor Dooley +Link: https://lore.kernel.org/r/a3c7ea92e90b77032f2e480d46418b087709286d.1731588129.git.geert+renesas@glider.be +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/leds/leds-class-multicolor.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml b/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml +index 12693483231f7..71fcd10cb9bc0 100644 +--- a/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml ++++ b/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml +@@ -27,7 +27,7 @@ properties: + description: | + For multicolor LED support this property should be defined as either + LED_COLOR_ID_RGB or LED_COLOR_ID_MULTI which can be found in +- include/linux/leds/common.h. ++ include/dt-bindings/leds/common.h. + enum: [ 8, 9 ] + + required: +-- +2.39.5 + diff --git a/queue-5.15/dt-bindings-leds-class-multicolor-reference-class-di.patch b/queue-5.15/dt-bindings-leds-class-multicolor-reference-class-di.patch new file mode 100644 index 0000000000..9d0cb5f3c7 --- /dev/null +++ b/queue-5.15/dt-bindings-leds-class-multicolor-reference-class-di.patch @@ -0,0 +1,140 @@ +From 3b11375eb1e900178ba4e2020bf55934f1b9f879 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 13:21:06 +0200 +Subject: dt-bindings: leds: class-multicolor: reference class directly in + multi-led node + +From: Krzysztof Kozlowski + +[ Upstream commit de40c8496ead3e25d1e989999eed0c3ecee8fc96 ] + +The leds/common.yaml is referenced directly in each LED node, which +leads to people doing the same with leds/leds-class-multicolor.yaml. +This is not correct because leds-class-multicolor.yaml defined multi-led +property and its children. Some schemas implemented this incorrect. + +Rework this to match same behavior common.yaml, so expect the multi-led +node to reference the leds-class-multicolor.yaml. Fixing allows to add +unevaluatedProperties:false. + +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Rob Herring +Signed-off-by: Pavel Machek +Stable-dep-of: 609bc99a4452 ("dt-bindings: leds: class-multicolor: Fix path to color definitions") +Signed-off-by: Sasha Levin +--- + .../leds/cznic,turris-omnia-leds.yaml | 2 ++ + .../bindings/leds/leds-class-multicolor.yaml | 32 +++++++++---------- + .../devicetree/bindings/leds/leds-lp50xx.yaml | 2 ++ + .../bindings/leds/leds-pwm-multicolor.yaml | 5 ++- + .../bindings/leds/leds-qcom-lpg.yaml | 2 ++ + 5 files changed, 24 insertions(+), 19 deletions(-) + +diff --git a/Documentation/devicetree/bindings/leds/cznic,turris-omnia-leds.yaml b/Documentation/devicetree/bindings/leds/cznic,turris-omnia-leds.yaml +index 9362b1ef9e88a..14bebe1ad8f8a 100644 +--- a/Documentation/devicetree/bindings/leds/cznic,turris-omnia-leds.yaml ++++ b/Documentation/devicetree/bindings/leds/cznic,turris-omnia-leds.yaml +@@ -33,6 +33,8 @@ patternProperties: + "^multi-led@[0-9a-b]$": + type: object + $ref: leds-class-multicolor.yaml# ++ unevaluatedProperties: false ++ + description: + This node represents one of the RGB LED devices on Turris Omnia. + No subnodes need to be added for subchannels since this controller only +diff --git a/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml b/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml +index f41d021ed6774..12693483231f7 100644 +--- a/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml ++++ b/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml +@@ -19,22 +19,22 @@ description: | + LED class. Common LED nodes and properties are inherited from the common.yaml + within this documentation directory. + +-patternProperties: +- "^multi-led(@[0-9a-f])?$": +- type: object +- description: Represents the LEDs that are to be grouped. +- properties: +- color: +- description: | +- For multicolor LED support this property should be defined as either +- LED_COLOR_ID_RGB or LED_COLOR_ID_MULTI which can be found in +- include/linux/leds/common.h. +- enum: [ 8, 9 ] +- +- $ref: "common.yaml#" +- +- required: +- - color ++properties: ++ $nodename: ++ pattern: "^multi-led(@[0-9a-f])?$" ++ ++ color: ++ description: | ++ For multicolor LED support this property should be defined as either ++ LED_COLOR_ID_RGB or LED_COLOR_ID_MULTI which can be found in ++ include/linux/leds/common.h. ++ enum: [ 8, 9 ] ++ ++required: ++ - color ++ ++allOf: ++ - $ref: "common.yaml#" + + additionalProperties: true + +diff --git a/Documentation/devicetree/bindings/leds/leds-lp50xx.yaml b/Documentation/devicetree/bindings/leds/leds-lp50xx.yaml +index f12fe5b53f30d..64d07fd20eab3 100644 +--- a/Documentation/devicetree/bindings/leds/leds-lp50xx.yaml ++++ b/Documentation/devicetree/bindings/leds/leds-lp50xx.yaml +@@ -56,6 +56,8 @@ patternProperties: + '^multi-led@[0-9a-f]$': + type: object + $ref: leds-class-multicolor.yaml# ++ unevaluatedProperties: false ++ + properties: + reg: + minItems: 1 +diff --git a/Documentation/devicetree/bindings/leds/leds-pwm-multicolor.yaml b/Documentation/devicetree/bindings/leds/leds-pwm-multicolor.yaml +index 6625a528f7275..03fc14d1601f3 100644 +--- a/Documentation/devicetree/bindings/leds/leds-pwm-multicolor.yaml ++++ b/Documentation/devicetree/bindings/leds/leds-pwm-multicolor.yaml +@@ -19,6 +19,8 @@ properties: + + multi-led: + type: object ++ $ref: leds-class-multicolor.yaml# ++ unevaluatedProperties: false + + patternProperties: + "^led-[0-9a-z]+$": +@@ -42,9 +44,6 @@ properties: + required: + - compatible + +-allOf: +- - $ref: leds-class-multicolor.yaml# +- + additionalProperties: false + + examples: +diff --git a/Documentation/devicetree/bindings/leds/leds-qcom-lpg.yaml b/Documentation/devicetree/bindings/leds/leds-qcom-lpg.yaml +index 336bd8e10efd3..6df2838d5f5b3 100644 +--- a/Documentation/devicetree/bindings/leds/leds-qcom-lpg.yaml ++++ b/Documentation/devicetree/bindings/leds/leds-qcom-lpg.yaml +@@ -57,6 +57,8 @@ properties: + multi-led: + type: object + $ref: leds-class-multicolor.yaml# ++ unevaluatedProperties: false ++ + properties: + "#address-cells": + const: 1 +-- +2.39.5 + diff --git a/queue-5.15/dt-bindings-leds-optional-multi-led-unit-address.patch b/queue-5.15/dt-bindings-leds-optional-multi-led-unit-address.patch new file mode 100644 index 0000000000..d5c3aa98cd --- /dev/null +++ b/queue-5.15/dt-bindings-leds-optional-multi-led-unit-address.patch @@ -0,0 +1,37 @@ +From 0e65809ecd2b3e69f0b9deafea93824023c23eb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 09:32:23 +0200 +Subject: dt-bindings: leds: Optional multi-led unit address + +From: Sven Schwermer + +[ Upstream commit 21c0d13e3dd64581bab0ef4b4d0fea7752cc236b ] + +The unit address does not make sense in all cases the multi-led node is +used, e.g. for the upcoming PWM multi-color LED driver. + +Signed-off-by: Sven Schwermer +Reviewed-by: Rob Herring +Signed-off-by: Pavel Machek +Stable-dep-of: 609bc99a4452 ("dt-bindings: leds: class-multicolor: Fix path to color definitions") +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/leds/leds-class-multicolor.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml b/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml +index 37445c68cdef9..f41d021ed6774 100644 +--- a/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml ++++ b/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml +@@ -20,7 +20,7 @@ description: | + within this documentation directory. + + patternProperties: +- "^multi-led@([0-9a-f])$": ++ "^multi-led(@[0-9a-f])?$": + type: object + description: Represents the LEDs that are to be grouped. + properties: +-- +2.39.5 + diff --git a/queue-5.15/dt-bindings-mfd-bd71815-fix-rsense-and-typos.patch b/queue-5.15/dt-bindings-mfd-bd71815-fix-rsense-and-typos.patch new file mode 100644 index 0000000000..7cf531ccb6 --- /dev/null +++ b/queue-5.15/dt-bindings-mfd-bd71815-fix-rsense-and-typos.patch @@ -0,0 +1,77 @@ +From 90eb7c255ebba6d6e20a2504e97d2e424b216dfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2024 19:01:06 +0200 +Subject: dt-bindings: mfd: bd71815: Fix rsense and typos + +From: Matti Vaittinen + +[ Upstream commit 6856edf7ead8c54803216a38a7b227bcb3dadff7 ] + +The sense resistor used for measuring currents is typically some tens of +milli Ohms. It has accidentally been documented to be tens of mega Ohms. +Fix the size of this resistor and a few copy-paste errors while at it. + +Drop the unsuitable 'rohm,charger-sense-resistor-ohms' property (which +can't represent resistors smaller than one Ohm), and introduce a new +'rohm,charger-sense-resistor-micro-ohms' property with appropriate +minimum, maximum and default values instead. + +Fixes: 4238dc1e6490 ("dt_bindings: mfd: Add ROHM BD71815 PMIC") +Signed-off-by: Matti Vaittinen +Acked-by: Conor Dooley +Link: https://lore.kernel.org/r/0efd8e9de0ae8d62ee4c6b78cc565b04007a245d.1731430700.git.mazziesaccount@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + .../bindings/mfd/rohm,bd71815-pmic.yaml | 20 +++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml b/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml +index fe265bcab50d9..91df60d566292 100644 +--- a/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml ++++ b/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml +@@ -50,15 +50,15 @@ properties: + minimum: 0 + maximum: 1 + +- rohm,charger-sense-resistor-ohms: +- minimum: 10000000 +- maximum: 50000000 ++ rohm,charger-sense-resistor-micro-ohms: ++ minimum: 10000 ++ maximum: 50000 + description: | +- BD71827 and BD71828 have SAR ADC for measuring charging currents. +- External sense resistor (RSENSE in data sheet) should be used. If +- something other but 30MOhm resistor is used the resistance value +- should be given here in Ohms. +- default: 30000000 ++ BD71815 has SAR ADC for measuring charging currents. External sense ++ resistor (RSENSE in data sheet) should be used. If something other ++ but a 30 mOhm resistor is used the resistance value should be given ++ here in micro Ohms. ++ default: 30000 + + regulators: + $ref: ../regulator/rohm,bd71815-regulator.yaml +@@ -67,7 +67,7 @@ properties: + + gpio-reserved-ranges: + description: | +- Usage of BD71828 GPIO pins can be changed via OTP. This property can be ++ Usage of BD71815 GPIO pins can be changed via OTP. This property can be + used to mark the pins which should not be configured for GPIO. Please see + the ../gpio/gpio.txt for more information. + +@@ -113,7 +113,7 @@ examples: + gpio-controller; + #gpio-cells = <2>; + +- rohm,charger-sense-resistor-ohms = <10000000>; ++ rohm,charger-sense-resistor-micro-ohms = <10000>; + + regulators { + buck1: buck1 { +-- +2.39.5 + diff --git a/queue-5.15/dt-bindings-mmc-controller-clarify-the-address-cells.patch b/queue-5.15/dt-bindings-mmc-controller-clarify-the-address-cells.patch new file mode 100644 index 0000000000..9657dabada --- /dev/null +++ b/queue-5.15/dt-bindings-mmc-controller-clarify-the-address-cells.patch @@ -0,0 +1,39 @@ +From ca10f1067916e4f0cb15ff7b626612fe2ff93024 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Nov 2024 16:16:41 +0100 +Subject: dt-bindings: mmc: controller: clarify the address-cells description + +From: Neil Armstrong + +[ Upstream commit b2b8e93ec00b8110cb37cbde5400d5abfdaed6a7 ] + +The term "slot ID" has nothing to do with the SDIO function number +which is specified in the reg property of the subnodes, rephrase +the description to be more accurate. + +Fixes: f9b7989859dd ("dt-bindings: mmc: Add YAML schemas for the generic MMC options") +Signed-off-by: Neil Armstrong +Acked-by: Rob Herring (Arm) +Message-ID: <20241128-topic-amlogic-arm32-upstream-bindings-fixes-convert-meson-mx-sdio-v4-1-11d9f9200a59@linaro.org> +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/mmc/mmc-controller.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/mmc/mmc-controller.yaml b/Documentation/devicetree/bindings/mmc/mmc-controller.yaml +index 25ac8e2009708..093bdad8daf82 100644 +--- a/Documentation/devicetree/bindings/mmc/mmc-controller.yaml ++++ b/Documentation/devicetree/bindings/mmc/mmc-controller.yaml +@@ -25,7 +25,7 @@ properties: + "#address-cells": + const: 1 + description: | +- The cell is the slot ID if a function subnode is used. ++ The cell is the SDIO function number if a function subnode is used. + + "#size-cells": + const: 0 +-- +2.39.5 + diff --git a/queue-5.15/efi-sysfb_efi-fix-w-1-warnings-when-efi-is-not-set.patch b/queue-5.15/efi-sysfb_efi-fix-w-1-warnings-when-efi-is-not-set.patch new file mode 100644 index 0000000000..a6a5a57f8f --- /dev/null +++ b/queue-5.15/efi-sysfb_efi-fix-w-1-warnings-when-efi-is-not-set.patch @@ -0,0 +1,70 @@ +From c878e0062066bf113692f04738f209b1489cbd4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 15:53:09 -0800 +Subject: efi: sysfb_efi: fix W=1 warnings when EFI is not set +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit 19fdc68aa7b90b1d3d600e873a3e050a39e7663d ] + +A build with W=1 fails because there are code and data that are not +needed or used when CONFIG_EFI is not set. Move the "#ifdef CONFIG_EFI" +block to earlier in the source file so that the unused code/data are +not built. + +drivers/firmware/efi/sysfb_efi.c:345:39: warning: ‘efifb_fwnode_ops’ defined but not used [-Wunused-const-variable=] + 345 | static const struct fwnode_operations efifb_fwnode_ops = { + | ^~~~~~~~~~~~~~~~ +drivers/firmware/efi/sysfb_efi.c:238:35: warning: ‘efifb_dmi_swap_width_height’ defined but not used [-Wunused-const-variable=] + 238 | static const struct dmi_system_id efifb_dmi_swap_width_height[] __initconst = { + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/firmware/efi/sysfb_efi.c:188:35: warning: ‘efifb_dmi_system_table’ defined but not used [-Wunused-const-variable=] + 188 | static const struct dmi_system_id efifb_dmi_system_table[] __initconst = { + | ^~~~~~~~~~~~~~~~~~~~~~ + +Fixes: 15d27b15de96 ("efi: sysfb_efi: fix build when EFI is not set") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202501071933.20nlmJJt-lkp@intel.com/ +Cc: David Rheinsberg +Cc: Hans de Goede +Cc: Javier Martinez Canillas +Cc: Peter Jones +Cc: Simona Vetter +Cc: linux-fbdev@vger.kernel.org +Cc: Ard Biesheuvel +Cc: linux-efi@vger.kernel.org +Reviewed-by: Thomas Zimmermann +Reviewed-by: Javier Martinez Canillas +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/sysfb_efi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/sysfb_efi.c b/drivers/firmware/efi/sysfb_efi.c +index 24d6f6e08df8b..816b2b05fe487 100644 +--- a/drivers/firmware/efi/sysfb_efi.c ++++ b/drivers/firmware/efi/sysfb_efi.c +@@ -93,6 +93,7 @@ void efifb_setup_from_dmi(struct screen_info *si, const char *opt) + _ret_; \ + }) + ++#ifdef CONFIG_EFI + static int __init efifb_set_system(const struct dmi_system_id *id) + { + struct efifb_dmi_info *info = id->driver_data; +@@ -348,7 +349,6 @@ static const struct fwnode_operations efifb_fwnode_ops = { + .add_links = efifb_add_links, + }; + +-#ifdef CONFIG_EFI + static struct fwnode_handle efifb_fwnode; + + __init void sysfb_apply_efi_quirks(void) +-- +2.39.5 + diff --git a/queue-5.15/fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch b/queue-5.15/fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch new file mode 100644 index 0000000000..7dc16f14d1 --- /dev/null +++ b/queue-5.15/fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch @@ -0,0 +1,42 @@ +From 6aeb3498a533f9194375b2d0b38e2c2d3268b25f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 10:15:37 +0900 +Subject: fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() + +From: Joe Hattori + +[ Upstream commit de124b61e179e690277116e6be512e4f422b5dd8 ] + +dss_of_port_get_parent_device() leaks an OF node reference when i >= 2 +and struct device_node *np is present. Since of_get_next_parent() +obtains a reference of the returned OF node, call of_node_put() before +returning NULL. + +This was found by an experimental verifier that I am developing, and no +runtime test was able to be performed due to that lack of actual +devices. + +Fixes: f76ee892a99e ("omapfb: copy omapdss & displays for omapfb") +Signed-off-by: Joe Hattori +Reviewed-by: Laurent Pinchart +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/omap2/omapfb/dss/dss-of.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c +index 0282d4eef139d..3b16c3342cb77 100644 +--- a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c ++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c +@@ -102,6 +102,7 @@ struct device_node *dss_of_port_get_parent_device(struct device_node *port) + np = of_get_next_parent(np); + } + ++ of_node_put(np); + return NULL; + } + +-- +2.39.5 + diff --git a/queue-5.15/fs-fix-proc_handler-for-sysctl_nr_open.patch b/queue-5.15/fs-fix-proc_handler-for-sysctl_nr_open.patch new file mode 100644 index 0000000000..45c3205aa8 --- /dev/null +++ b/queue-5.15/fs-fix-proc_handler-for-sysctl_nr_open.patch @@ -0,0 +1,37 @@ +From 578e0126d15d1b4bcd0ae6cb2735f76c15b2fa9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Nov 2024 11:46:36 +0800 +Subject: fs: fix proc_handler for sysctl_nr_open + +From: Jinliang Zheng + +[ Upstream commit d727935cad9f6f52c8d184968f9720fdc966c669 ] + +Use proc_douintvec_minmax() instead of proc_dointvec_minmax() to handle +sysctl_nr_open, because its data type is unsigned int, not int. + +Fixes: 9b80a184eaad ("fs/file: more unsigned file descriptors") +Signed-off-by: Jinliang Zheng +Link: https://lore.kernel.org/r/20241124034636.325337-1-alexjlzheng@tencent.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/file_table.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/file_table.c b/fs/file_table.c +index a8d4a2fb9c67f..e03ff9a2c2b1f 100644 +--- a/fs/file_table.c ++++ b/fs/file_table.c +@@ -109,7 +109,7 @@ static struct ctl_table fs_stat_sysctls[] = { + .data = &sysctl_nr_open, + .maxlen = sizeof(unsigned int), + .mode = 0644, +- .proc_handler = proc_dointvec_minmax, ++ .proc_handler = proc_douintvec_minmax, + .extra1 = &sysctl_nr_open_min, + .extra2 = &sysctl_nr_open_max, + }, +-- +2.39.5 + diff --git a/queue-5.15/fs-move-fs-stat-sysctls-to-file_table.c.patch b/queue-5.15/fs-move-fs-stat-sysctls-to-file_table.c.patch new file mode 100644 index 0000000000..3f3e973f9d --- /dev/null +++ b/queue-5.15/fs-move-fs-stat-sysctls-to-file_table.c.patch @@ -0,0 +1,178 @@ +From 79f285db2fa704784d26a15d28708de82fc97aab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 22:12:56 -0800 +Subject: fs: move fs stat sysctls to file_table.c + +From: Luis Chamberlain + +[ Upstream commit 204d5a24e15562b2816825c0f9b49d26814b77be ] + +kernel/sysctl.c is a kitchen sink where everyone leaves their dirty +dishes, this makes it very difficult to maintain. + +To help with this maintenance let's start by moving sysctls to places +where they actually belong. The proc sysctl maintainers do not want to +know what sysctl knobs you wish to add for your own piece of code, we +just care about the core logic. + +We can create the sysctl dynamically on early init for fs stat to help +with this clutter. This dusts off the fs stat syctls knobs and puts +them into where they are declared. + +Link: https://lkml.kernel.org/r/20211129205548.605569-3-mcgrof@kernel.org +Signed-off-by: Luis Chamberlain +Cc: Al Viro +Cc: Andy Shevchenko +Cc: Antti Palosaari +Cc: Eric Biederman +Cc: Iurii Zaikin +Cc: "J. Bruce Fields" +Cc: Jeff Layton +Cc: Kees Cook +Cc: Lukas Middendorf +Cc: Stephen Kitt +Cc: Xiaoming Ni +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: d727935cad9f ("fs: fix proc_handler for sysctl_nr_open") +Signed-off-by: Sasha Levin +--- + fs/file_table.c | 47 ++++++++++++++++++++++++++++++++++++++-------- + include/linux/fs.h | 3 --- + kernel/sysctl.c | 25 ------------------------ + 3 files changed, 39 insertions(+), 36 deletions(-) + +diff --git a/fs/file_table.c b/fs/file_table.c +index 6f297f9782fc5..a8d4a2fb9c67f 100644 +--- a/fs/file_table.c ++++ b/fs/file_table.c +@@ -33,7 +33,7 @@ + #include "internal.h" + + /* sysctl tunables... */ +-struct files_stat_struct files_stat = { ++static struct files_stat_struct files_stat = { + .max_files = NR_FILE + }; + +@@ -75,22 +75,53 @@ unsigned long get_max_files(void) + } + EXPORT_SYMBOL_GPL(get_max_files); + ++#if defined(CONFIG_SYSCTL) && defined(CONFIG_PROC_FS) ++ + /* + * Handle nr_files sysctl + */ +-#if defined(CONFIG_SYSCTL) && defined(CONFIG_PROC_FS) +-int proc_nr_files(struct ctl_table *table, int write, +- void *buffer, size_t *lenp, loff_t *ppos) ++static int proc_nr_files(struct ctl_table *table, int write, void *buffer, ++ size_t *lenp, loff_t *ppos) + { + files_stat.nr_files = get_nr_files(); + return proc_doulongvec_minmax(table, write, buffer, lenp, ppos); + } +-#else +-int proc_nr_files(struct ctl_table *table, int write, +- void *buffer, size_t *lenp, loff_t *ppos) ++ ++static struct ctl_table fs_stat_sysctls[] = { ++ { ++ .procname = "file-nr", ++ .data = &files_stat, ++ .maxlen = sizeof(files_stat), ++ .mode = 0444, ++ .proc_handler = proc_nr_files, ++ }, ++ { ++ .procname = "file-max", ++ .data = &files_stat.max_files, ++ .maxlen = sizeof(files_stat.max_files), ++ .mode = 0644, ++ .proc_handler = proc_doulongvec_minmax, ++ .extra1 = SYSCTL_LONG_ZERO, ++ .extra2 = SYSCTL_LONG_MAX, ++ }, ++ { ++ .procname = "nr_open", ++ .data = &sysctl_nr_open, ++ .maxlen = sizeof(unsigned int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = &sysctl_nr_open_min, ++ .extra2 = &sysctl_nr_open_max, ++ }, ++ { } ++}; ++ ++static int __init init_fs_stat_sysctls(void) + { +- return -ENOSYS; ++ register_sysctl_init("fs", fs_stat_sysctls); ++ return 0; + } ++fs_initcall(init_fs_stat_sysctls); + #endif + + static struct file *__alloc_file(int flags, const struct cred *cred) +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 2af01758a1abf..d011dc742e3ef 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -78,7 +78,6 @@ extern void __init inode_init_early(void); + extern void __init files_init(void); + extern void __init files_maxfiles_init(void); + +-extern struct files_stat_struct files_stat; + extern unsigned long get_max_files(void); + extern unsigned int sysctl_nr_open; + extern int leases_enable, lease_break_time; +@@ -3669,8 +3668,6 @@ ssize_t simple_attr_write_signed(struct file *file, const char __user *buf, + size_t len, loff_t *ppos); + + struct ctl_table; +-int proc_nr_files(struct ctl_table *table, int write, +- void *buffer, size_t *lenp, loff_t *ppos); + int proc_nr_dentry(struct ctl_table *table, int write, + void *buffer, size_t *lenp, loff_t *ppos); + int __init list_bdev_fs_names(char *buf, size_t size); +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index a491d145acc31..eaf9dd6a2f12f 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -3116,31 +3116,6 @@ static struct ctl_table vm_table[] = { + }; + + static struct ctl_table fs_table[] = { +- { +- .procname = "file-nr", +- .data = &files_stat, +- .maxlen = sizeof(files_stat), +- .mode = 0444, +- .proc_handler = proc_nr_files, +- }, +- { +- .procname = "file-max", +- .data = &files_stat.max_files, +- .maxlen = sizeof(files_stat.max_files), +- .mode = 0644, +- .proc_handler = proc_doulongvec_minmax, +- .extra1 = SYSCTL_LONG_ZERO, +- .extra2 = SYSCTL_LONG_MAX, +- }, +- { +- .procname = "nr_open", +- .data = &sysctl_nr_open, +- .maxlen = sizeof(unsigned int), +- .mode = 0644, +- .proc_handler = proc_dointvec_minmax, +- .extra1 = &sysctl_nr_open_min, +- .extra2 = &sysctl_nr_open_max, +- }, + { + .procname = "dentry-state", + .data = &dentry_stat, +-- +2.39.5 + diff --git a/queue-5.15/fs-move-inode-sysctls-to-its-own-file.patch b/queue-5.15/fs-move-inode-sysctls-to-its-own-file.patch new file mode 100644 index 0000000000..d762b70054 --- /dev/null +++ b/queue-5.15/fs-move-inode-sysctls-to-its-own-file.patch @@ -0,0 +1,172 @@ +From f8ac848d6cdfdc484178b758d6dd12c78e1aa6de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 22:12:52 -0800 +Subject: fs: move inode sysctls to its own file + +From: Luis Chamberlain + +[ Upstream commit 1d67fe585049d3e2448b997af78c68cbf90ada09 ] + +Patch series "sysctl: 4th set of kernel/sysctl cleanups". + +This is slimming down the fs uses of kernel/sysctl.c to the point that +the next step is to just get rid of the fs base directory for it and +move that elsehwere, so that next patch series starts dealing with that +to demo how we can end up cleaning up a full base directory from +kernel/sysctl.c, one at a time. + +This patch (of 9): + +kernel/sysctl.c is a kitchen sink where everyone leaves their dirty +dishes, this makes it very difficult to maintain. + +To help with this maintenance let's start by moving sysctls to places +where they actually belong. The proc sysctl maintainers do not want to +know what sysctl knobs you wish to add for your own piece of code, we +just care about the core logic. + +So move the inode sysctls to its own file. Since we are no longer using +this outside of fs/ remove the extern declaration of its respective proc +helper. + +We use early_initcall() as it is the earliest we can use. + +[arnd@arndb.de: avoid unused-variable warning] + Link: https://lkml.kernel.org/r/20211203190123.874239-1-arnd@kernel.org + +Link: https://lkml.kernel.org/r/20211129205548.605569-1-mcgrof@kernel.org +Link: https://lkml.kernel.org/r/20211129205548.605569-2-mcgrof@kernel.org +Signed-off-by: Luis Chamberlain +Signed-off-by: Arnd Bergmann +Cc: Al Viro +Cc: Kees Cook +Cc: Iurii Zaikin +Cc: Xiaoming Ni +Cc: Eric Biederman +Cc: Stephen Kitt +Cc: Lukas Middendorf +Cc: Antti Palosaari +Cc: Andy Shevchenko +Cc: Jeff Layton +Cc: "J. Bruce Fields" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: d727935cad9f ("fs: fix proc_handler for sysctl_nr_open") +Signed-off-by: Sasha Levin +--- + fs/inode.c | 39 ++++++++++++++++++++++++++++++++------- + include/linux/fs.h | 3 --- + kernel/sysctl.c | 14 -------------- + 3 files changed, 32 insertions(+), 24 deletions(-) + +diff --git a/fs/inode.c b/fs/inode.c +index c7ef50d0fe38b..0a3a14b9ee46f 100644 +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -67,11 +67,6 @@ const struct address_space_operations empty_aops = { + }; + EXPORT_SYMBOL(empty_aops); + +-/* +- * Statistics gathering.. +- */ +-struct inodes_stat_t inodes_stat; +- + static DEFINE_PER_CPU(unsigned long, nr_inodes); + static DEFINE_PER_CPU(unsigned long, nr_unused); + +@@ -106,13 +101,43 @@ long get_nr_dirty_inodes(void) + * Handle nr_inode sysctl + */ + #ifdef CONFIG_SYSCTL +-int proc_nr_inodes(struct ctl_table *table, int write, +- void *buffer, size_t *lenp, loff_t *ppos) ++/* ++ * Statistics gathering.. ++ */ ++static struct inodes_stat_t inodes_stat; ++ ++static int proc_nr_inodes(struct ctl_table *table, int write, void *buffer, ++ size_t *lenp, loff_t *ppos) + { + inodes_stat.nr_inodes = get_nr_inodes(); + inodes_stat.nr_unused = get_nr_inodes_unused(); + return proc_doulongvec_minmax(table, write, buffer, lenp, ppos); + } ++ ++static struct ctl_table inodes_sysctls[] = { ++ { ++ .procname = "inode-nr", ++ .data = &inodes_stat, ++ .maxlen = 2*sizeof(long), ++ .mode = 0444, ++ .proc_handler = proc_nr_inodes, ++ }, ++ { ++ .procname = "inode-state", ++ .data = &inodes_stat, ++ .maxlen = 7*sizeof(long), ++ .mode = 0444, ++ .proc_handler = proc_nr_inodes, ++ }, ++ { } ++}; ++ ++static int __init init_fs_inode_sysctls(void) ++{ ++ register_sysctl_init("fs", inodes_sysctls); ++ return 0; ++} ++early_initcall(init_fs_inode_sysctls); + #endif + + static int no_open(struct inode *inode, struct file *file) +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 2ef0e48c89ec4..2af01758a1abf 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -81,7 +81,6 @@ extern void __init files_maxfiles_init(void); + extern struct files_stat_struct files_stat; + extern unsigned long get_max_files(void); + extern unsigned int sysctl_nr_open; +-extern struct inodes_stat_t inodes_stat; + extern int leases_enable, lease_break_time; + extern int sysctl_protected_symlinks; + extern int sysctl_protected_hardlinks; +@@ -3674,8 +3673,6 @@ int proc_nr_files(struct ctl_table *table, int write, + void *buffer, size_t *lenp, loff_t *ppos); + int proc_nr_dentry(struct ctl_table *table, int write, + void *buffer, size_t *lenp, loff_t *ppos); +-int proc_nr_inodes(struct ctl_table *table, int write, +- void *buffer, size_t *lenp, loff_t *ppos); + int __init list_bdev_fs_names(char *buf, size_t size); + + #define __FMODE_EXEC ((__force int) FMODE_EXEC) +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 05853e7681512..a491d145acc31 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -3116,20 +3116,6 @@ static struct ctl_table vm_table[] = { + }; + + static struct ctl_table fs_table[] = { +- { +- .procname = "inode-nr", +- .data = &inodes_stat, +- .maxlen = 2*sizeof(long), +- .mode = 0444, +- .proc_handler = proc_nr_inodes, +- }, +- { +- .procname = "inode-state", +- .data = &inodes_stat, +- .maxlen = 7*sizeof(long), +- .mode = 0444, +- .proc_handler = proc_nr_inodes, +- }, + { + .procname = "file-nr", + .data = &files_stat, +-- +2.39.5 + diff --git a/queue-5.15/genirq-make-handle_enforce_irqctx-unconditionally-av.patch b/queue-5.15/genirq-make-handle_enforce_irqctx-unconditionally-av.patch new file mode 100644 index 0000000000..3447b0715f --- /dev/null +++ b/queue-5.15/genirq-make-handle_enforce_irqctx-unconditionally-av.patch @@ -0,0 +1,60 @@ +From a36f28a201f8516cf44850e11266694340dc2191 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 11:20:43 +0100 +Subject: genirq: Make handle_enforce_irqctx() unconditionally available + +From: Thomas Gleixner + +[ Upstream commit 8d187a77f04c14fb459a5301d69f733a5a1396bc ] + +Commit 1b57d91b969c ("irqchip/gic-v2, v3: Prevent SW resends entirely") +sett the flag which enforces interrupt handling in interrupt context and +prevents software base resends for ARM GIC v2/v3. + +But it missed that the helper function which checks the flag was hidden +behind CONFIG_GENERIC_PENDING_IRQ, which is not set by ARM[64]. + +Make the helper unconditionally available so that the enforcement actually +works. + +Fixes: 1b57d91b969c ("irqchip/gic-v2, v3: Prevent SW resends entirely") +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/all/20241210101811.497716609@linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/irq/internals.h | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h +index f1d83a8b44171..da1f282d5a1d1 100644 +--- a/kernel/irq/internals.h ++++ b/kernel/irq/internals.h +@@ -429,10 +429,6 @@ static inline struct cpumask *irq_desc_get_pending_mask(struct irq_desc *desc) + { + return desc->pending_mask; + } +-static inline bool handle_enforce_irqctx(struct irq_data *data) +-{ +- return irqd_is_handle_enforce_irqctx(data); +-} + bool irq_fixup_move_pending(struct irq_desc *desc, bool force_clear); + #else /* CONFIG_GENERIC_PENDING_IRQ */ + static inline bool irq_can_move_pcntxt(struct irq_data *data) +@@ -459,11 +455,12 @@ static inline bool irq_fixup_move_pending(struct irq_desc *desc, bool fclear) + { + return false; + } ++#endif /* !CONFIG_GENERIC_PENDING_IRQ */ ++ + static inline bool handle_enforce_irqctx(struct irq_data *data) + { +- return false; ++ return irqd_is_handle_enforce_irqctx(data); + } +-#endif /* !CONFIG_GENERIC_PENDING_IRQ */ + + #if !defined(CONFIG_IRQ_DOMAIN) || !defined(CONFIG_IRQ_DOMAIN_HIERARCHY) + static inline int irq_domain_activate_irq(struct irq_data *data, bool reserve) +-- +2.39.5 + diff --git a/queue-5.15/gpio-mxc-remove-dead-code-after-switch-to-dt-only.patch b/queue-5.15/gpio-mxc-remove-dead-code-after-switch-to-dt-only.patch new file mode 100644 index 0000000000..b8728c8818 --- /dev/null +++ b/queue-5.15/gpio-mxc-remove-dead-code-after-switch-to-dt-only.patch @@ -0,0 +1,44 @@ +From 89b579bd682ff50d8d2cefb7228b5ca96b00ea38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 23:19:11 +0100 +Subject: gpio: mxc: remove dead code after switch to DT-only + +From: Ahmad Fatoum + +[ Upstream commit b049e7abe9001a780d58e78e3833dcceee22f396 ] + +struct platform_device::id was only set by board code, but since i.MX +became a devicetree-only platform, this will always be -1 +(PLATFORM_DEVID_NONE). + +Note: of_alias_get_id() returns a negative number on error and base +treats all negative errors the same, so we need not add any additional +error handling. + +Fixes: 0f2c7af45d7e ("gpio: mxc: Convert the driver to DT-only") +Signed-off-by: Ahmad Fatoum +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20250113-b4-imx-gpio-base-warning-v1-3-0a28731a5cf6@pengutronix.de +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mxc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c +index 853d9aa6b3b1f..d456077c74f2f 100644 +--- a/drivers/gpio/gpio-mxc.c ++++ b/drivers/gpio/gpio-mxc.c +@@ -445,8 +445,7 @@ static int mxc_gpio_probe(struct platform_device *pdev) + port->gc.request = gpiochip_generic_request; + port->gc.free = gpiochip_generic_free; + port->gc.to_irq = mxc_gpio_to_irq; +- port->gc.base = (pdev->id < 0) ? of_alias_get_id(np, "gpio") * 32 : +- pdev->id * 32; ++ port->gc.base = of_alias_get_id(np, "gpio") * 32; + + err = devm_gpiochip_add_data(&pdev->dev, &port->gc, port); + if (err) +-- +2.39.5 + diff --git a/queue-5.15/hid-hid-thrustmaster-fix-warning-in-thrustmaster_pro.patch b/queue-5.15/hid-hid-thrustmaster-fix-warning-in-thrustmaster_pro.patch new file mode 100644 index 0000000000..0888ea76ba --- /dev/null +++ b/queue-5.15/hid-hid-thrustmaster-fix-warning-in-thrustmaster_pro.patch @@ -0,0 +1,50 @@ +From 1685085fa45cc66b0726797c63313896cfe58869 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 23:22:21 +0100 +Subject: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding + endpoint check + +From: Karol Przybylski + +[ Upstream commit 50420d7c79c37a3efe4010ff9b1bb14bc61ebccf ] + +syzbot has found a type mismatch between a USB pipe and the transfer +endpoint, which is triggered by the hid-thrustmaster driver[1]. +There is a number of similar, already fixed issues [2]. +In this case as in others, implementing check for endpoint type fixes the issue. + +[1] https://syzkaller.appspot.com/bug?extid=040e8b3db6a96908d470 +[2] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622 + +Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels") +Reported-by: syzbot+040e8b3db6a96908d470@syzkaller.appspotmail.com +Tested-by: syzbot+040e8b3db6a96908d470@syzkaller.appspotmail.com +Signed-off-by: Karol Przybylski +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-thrustmaster.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/hid/hid-thrustmaster.c b/drivers/hid/hid-thrustmaster.c +index 2221bc26e611a..d11297640fe08 100644 +--- a/drivers/hid/hid-thrustmaster.c ++++ b/drivers/hid/hid-thrustmaster.c +@@ -170,6 +170,14 @@ static void thrustmaster_interrupts(struct hid_device *hdev) + ep = &usbif->cur_altsetting->endpoint[1]; + b_ep = ep->desc.bEndpointAddress; + ++ /* Are the expected endpoints present? */ ++ u8 ep_addr[1] = {b_ep}; ++ ++ if (!usb_check_int_endpoints(usbif, ep_addr)) { ++ hid_err(hdev, "Unexpected non-int endpoint\n"); ++ return; ++ } ++ + for (i = 0; i < ARRAY_SIZE(setup_arr); ++i) { + memcpy(send_buf, setup_arr[i], setup_arr_sizes[i]); + +-- +2.39.5 + diff --git a/queue-5.15/hid-multitouch-add-support-for-lenovo-y9000p-touchpa.patch b/queue-5.15/hid-multitouch-add-support-for-lenovo-y9000p-touchpa.patch new file mode 100644 index 0000000000..67365afca9 --- /dev/null +++ b/queue-5.15/hid-multitouch-add-support-for-lenovo-y9000p-touchpa.patch @@ -0,0 +1,63 @@ +From 53db7bb479893b1b786cb428e53d3b0d6a31ef24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2024 10:56:05 +0800 +Subject: HID: multitouch: Add support for lenovo Y9000P Touchpad + +From: He Lugang + +[ Upstream commit 251efae73bd46b097deec4f9986d926813aed744 ] + +The 2024 Lenovo Y9000P which use GT7868Q chip also needs a fixup. +The information of the chip is as follows: +I2C HID v1.00 Mouse [GXTP5100:00 27C6:01E0] + +Signed-off-by: He Lugang +Signed-off-by: Jiri Kosina +Stable-dep-of: 8ade5e05bd09 ("HID: multitouch: fix support for Goodix PID 0x01e9") +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 8 ++++++-- + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 81db294dda408..291f8d3a3dd37 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -484,6 +484,7 @@ + #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100 + + #define I2C_VENDOR_ID_GOODIX 0x27c6 ++#define I2C_DEVICE_ID_GOODIX_01E0 0x01e0 + #define I2C_DEVICE_ID_GOODIX_01E8 0x01e8 + #define I2C_DEVICE_ID_GOODIX_01E9 0x01e9 + #define I2C_DEVICE_ID_GOODIX_01F0 0x01f0 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 57e4ff1ab275d..196ed532baa5d 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1447,7 +1447,8 @@ static __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc, + { + if (hdev->vendor == I2C_VENDOR_ID_GOODIX && + (hdev->product == I2C_DEVICE_ID_GOODIX_01E8 || +- hdev->product == I2C_DEVICE_ID_GOODIX_01E9)) { ++ hdev->product == I2C_DEVICE_ID_GOODIX_01E9 || ++ hdev->product == I2C_DEVICE_ID_GOODIX_01E0)) { + if (rdesc[607] == 0x15) { + rdesc[607] = 0x25; + dev_info( +@@ -2070,7 +2071,10 @@ static const struct hid_device_id mt_devices[] = { + I2C_DEVICE_ID_GOODIX_01E8) }, + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, + HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, +- I2C_DEVICE_ID_GOODIX_01E8) }, ++ I2C_DEVICE_ID_GOODIX_01E9) }, ++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, ++ HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, ++ I2C_DEVICE_ID_GOODIX_01E0) }, + + /* GoodTouch panels */ + { .driver_data = MT_CLS_NSMU, +-- +2.39.5 + diff --git a/queue-5.15/hid-multitouch-fix-support-for-goodix-pid-0x01e9.patch b/queue-5.15/hid-multitouch-fix-support-for-goodix-pid-0x01e9.patch new file mode 100644 index 0000000000..6c3c70bce3 --- /dev/null +++ b/queue-5.15/hid-multitouch-fix-support-for-goodix-pid-0x01e9.patch @@ -0,0 +1,42 @@ +From c52e90c19a77d8fd4df4504fa907f9370dfe24c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 10:19:32 +0100 +Subject: HID: multitouch: fix support for Goodix PID 0x01e9 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jiri Kosina + +[ Upstream commit 8ade5e05bd094485ce370fad66a6a3fb6f50bfbc ] + +Commit c8000deb68365b ("HID: multitouch: Add support for GT7868Q") added +support for 0x01e8 and 0x01e9, but the mt_device[] entries were added +twice for 0x01e8 and there was none added for 0x01e9. Fix that. + +Fixes: c8000deb68365b ("HID: multitouch: Add support for GT7868Q") +Reported-by: He Lugang +Reported-by: WangYuli +Reported-by: Ulrich Müller +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 57e4ff1ab275d..df7b620fa23ee 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2070,7 +2070,7 @@ static const struct hid_device_id mt_devices[] = { + I2C_DEVICE_ID_GOODIX_01E8) }, + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, + HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, +- I2C_DEVICE_ID_GOODIX_01E8) }, ++ I2C_DEVICE_ID_GOODIX_01E9) }, + + /* GoodTouch panels */ + { .driver_data = MT_CLS_NSMU, +-- +2.39.5 + diff --git a/queue-5.15/hung_task-move-hung_task-sysctl-interface-to-hung_ta.patch b/queue-5.15/hung_task-move-hung_task-sysctl-interface-to-hung_ta.patch new file mode 100644 index 0000000000..0ed9db3bf8 --- /dev/null +++ b/queue-5.15/hung_task-move-hung_task-sysctl-interface-to-hung_ta.patch @@ -0,0 +1,299 @@ +From a36d76645c569fa2924fef4797d3158ee495595c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 22:11:00 -0800 +Subject: hung_task: move hung_task sysctl interface to hung_task.c + +From: Xiaoming Ni + +[ Upstream commit bbe7a10ed83a5fa0b0ff6161ecdc4e65a0e9c993 ] + +The kernel/sysctl.c is a kitchen sink where everyone leaves their dirty +dishes, this makes it very difficult to maintain. + +To help with this maintenance let's start by moving sysctls to places +where they actually belong. The proc sysctl maintainers do not want to +know what sysctl knobs you wish to add for your own piece of code, we +just care about the core logic. + +So move hung_task sysctl interface to hung_task.c and use +register_sysctl() to register the sysctl interface. + +[mcgrof@kernel.org: commit log refresh and fixed 2-3 0day reported compile issues] + +Link: https://lkml.kernel.org/r/20211123202347.818157-4-mcgrof@kernel.org +Signed-off-by: Xiaoming Ni +Signed-off-by: Luis Chamberlain +Reviewed-by: Kees Cook +Reviewed-by: Petr Mladek +Cc: Al Viro +Cc: Amir Goldstein +Cc: Andy Shevchenko +Cc: Benjamin LaHaise +Cc: "Eric W. Biederman" +Cc: Greg Kroah-Hartman +Cc: Iurii Zaikin +Cc: Jan Kara +Cc: Paul Turner +Cc: Peter Zijlstra +Cc: Qing Wang +Cc: Sebastian Reichel +Cc: Sergey Senozhatsky +Cc: Stephen Kitt +Cc: Tetsuo Handa +Cc: Antti Palosaari +Cc: Arnd Bergmann +Cc: Benjamin Herrenschmidt +Cc: Clemens Ladisch +Cc: David Airlie +Cc: Jani Nikula +Cc: Joel Becker +Cc: Joonas Lahtinen +Cc: Joseph Qi +Cc: Julia Lawall +Cc: Lukas Middendorf +Cc: Mark Fasheh +Cc: Phillip Potter +Cc: Rodrigo Vivi +Cc: Douglas Gilbert +Cc: James E.J. Bottomley +Cc: Jani Nikula +Cc: John Ogness +Cc: Martin K. Petersen +Cc: "Rafael J. Wysocki" +Cc: Steven Rostedt (VMware) +Cc: Suren Baghdasaryan +Cc: "Theodore Ts'o" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: d727935cad9f ("fs: fix proc_handler for sysctl_nr_open") +Signed-off-by: Sasha Levin +--- + include/linux/sched/sysctl.h | 14 +------ + kernel/hung_task.c | 81 ++++++++++++++++++++++++++++++++++-- + kernel/sysctl.c | 61 --------------------------- + 3 files changed, 79 insertions(+), 77 deletions(-) + +diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h +index 304f431178fd9..c19dd5a2c05c6 100644 +--- a/include/linux/sched/sysctl.h ++++ b/include/linux/sched/sysctl.h +@@ -7,20 +7,8 @@ + struct ctl_table; + + #ifdef CONFIG_DETECT_HUNG_TASK +- +-#ifdef CONFIG_SMP +-extern unsigned int sysctl_hung_task_all_cpu_backtrace; +-#else +-#define sysctl_hung_task_all_cpu_backtrace 0 +-#endif /* CONFIG_SMP */ +- +-extern int sysctl_hung_task_check_count; +-extern unsigned int sysctl_hung_task_panic; ++/* used for hung_task and block/ */ + extern unsigned long sysctl_hung_task_timeout_secs; +-extern unsigned long sysctl_hung_task_check_interval_secs; +-extern int sysctl_hung_task_warnings; +-int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, +- void *buffer, size_t *lenp, loff_t *ppos); + #else + /* Avoid need for ifdefs elsewhere in the code */ + enum { sysctl_hung_task_timeout_secs = 0 }; +diff --git a/kernel/hung_task.c b/kernel/hung_task.c +index 9888e2bc8c767..52501e5f76554 100644 +--- a/kernel/hung_task.c ++++ b/kernel/hung_task.c +@@ -63,7 +63,9 @@ static struct task_struct *watchdog_task; + * Should we dump all CPUs backtraces in a hung task event? + * Defaults to 0, can be changed via sysctl. + */ +-unsigned int __read_mostly sysctl_hung_task_all_cpu_backtrace; ++static unsigned int __read_mostly sysctl_hung_task_all_cpu_backtrace; ++#else ++#define sysctl_hung_task_all_cpu_backtrace 0 + #endif /* CONFIG_SMP */ + + /* +@@ -222,11 +224,13 @@ static long hung_timeout_jiffies(unsigned long last_checked, + MAX_SCHEDULE_TIMEOUT; + } + ++#ifdef CONFIG_SYSCTL + /* + * Process updating of timeout sysctl + */ +-int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, +- void *buffer, size_t *lenp, loff_t *ppos) ++static int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, ++ void __user *buffer, ++ size_t *lenp, loff_t *ppos) + { + int ret; + +@@ -241,6 +245,76 @@ int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, + return ret; + } + ++/* ++ * This is needed for proc_doulongvec_minmax of sysctl_hung_task_timeout_secs ++ * and hung_task_check_interval_secs ++ */ ++static const unsigned long hung_task_timeout_max = (LONG_MAX / HZ); ++static struct ctl_table hung_task_sysctls[] = { ++#ifdef CONFIG_SMP ++ { ++ .procname = "hung_task_all_cpu_backtrace", ++ .data = &sysctl_hung_task_all_cpu_backtrace, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_ONE, ++ }, ++#endif /* CONFIG_SMP */ ++ { ++ .procname = "hung_task_panic", ++ .data = &sysctl_hung_task_panic, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_ONE, ++ }, ++ { ++ .procname = "hung_task_check_count", ++ .data = &sysctl_hung_task_check_count, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ }, ++ { ++ .procname = "hung_task_timeout_secs", ++ .data = &sysctl_hung_task_timeout_secs, ++ .maxlen = sizeof(unsigned long), ++ .mode = 0644, ++ .proc_handler = proc_dohung_task_timeout_secs, ++ .extra2 = (void *)&hung_task_timeout_max, ++ }, ++ { ++ .procname = "hung_task_check_interval_secs", ++ .data = &sysctl_hung_task_check_interval_secs, ++ .maxlen = sizeof(unsigned long), ++ .mode = 0644, ++ .proc_handler = proc_dohung_task_timeout_secs, ++ .extra2 = (void *)&hung_task_timeout_max, ++ }, ++ { ++ .procname = "hung_task_warnings", ++ .data = &sysctl_hung_task_warnings, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = SYSCTL_NEG_ONE, ++ }, ++ {} ++}; ++ ++static void __init hung_task_sysctl_init(void) ++{ ++ register_sysctl_init("kernel", hung_task_sysctls); ++} ++#else ++#define hung_task_sysctl_init() do { } while (0) ++#endif /* CONFIG_SYSCTL */ ++ ++ + static atomic_t reset_hung_task = ATOMIC_INIT(0); + + void reset_hung_task_detector(void) +@@ -310,6 +384,7 @@ static int __init hung_task_init(void) + pm_notifier(hungtask_pm_notify, 0); + + watchdog_task = kthread_run(watchdog, NULL, "khungtaskd"); ++ hung_task_sysctl_init(); + + return 0; + } +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 4554e80c42729..0a84cb7a8bffe 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -133,13 +133,6 @@ static int minolduid; + static int ngroups_max = NGROUPS_MAX; + static const int cap_last_cap = CAP_LAST_CAP; + +-/* +- * This is needed for proc_doulongvec_minmax of sysctl_hung_task_timeout_secs +- * and hung_task_check_interval_secs +- */ +-#ifdef CONFIG_DETECT_HUNG_TASK +-static unsigned long hung_task_timeout_max = (LONG_MAX/HZ); +-#endif + + #ifdef CONFIG_INOTIFY_USER + #include +@@ -2510,60 +2503,6 @@ static struct ctl_table kern_table[] = { + .proc_handler = proc_dointvec, + }, + #endif +-#ifdef CONFIG_DETECT_HUNG_TASK +-#ifdef CONFIG_SMP +- { +- .procname = "hung_task_all_cpu_backtrace", +- .data = &sysctl_hung_task_all_cpu_backtrace, +- .maxlen = sizeof(int), +- .mode = 0644, +- .proc_handler = proc_dointvec_minmax, +- .extra1 = SYSCTL_ZERO, +- .extra2 = SYSCTL_ONE, +- }, +-#endif /* CONFIG_SMP */ +- { +- .procname = "hung_task_panic", +- .data = &sysctl_hung_task_panic, +- .maxlen = sizeof(int), +- .mode = 0644, +- .proc_handler = proc_dointvec_minmax, +- .extra1 = SYSCTL_ZERO, +- .extra2 = SYSCTL_ONE, +- }, +- { +- .procname = "hung_task_check_count", +- .data = &sysctl_hung_task_check_count, +- .maxlen = sizeof(int), +- .mode = 0644, +- .proc_handler = proc_dointvec_minmax, +- .extra1 = SYSCTL_ZERO, +- }, +- { +- .procname = "hung_task_timeout_secs", +- .data = &sysctl_hung_task_timeout_secs, +- .maxlen = sizeof(unsigned long), +- .mode = 0644, +- .proc_handler = proc_dohung_task_timeout_secs, +- .extra2 = &hung_task_timeout_max, +- }, +- { +- .procname = "hung_task_check_interval_secs", +- .data = &sysctl_hung_task_check_interval_secs, +- .maxlen = sizeof(unsigned long), +- .mode = 0644, +- .proc_handler = proc_dohung_task_timeout_secs, +- .extra2 = &hung_task_timeout_max, +- }, +- { +- .procname = "hung_task_warnings", +- .data = &sysctl_hung_task_warnings, +- .maxlen = sizeof(int), +- .mode = 0644, +- .proc_handler = proc_dointvec_minmax, +- .extra1 = SYSCTL_NEG_ONE, +- }, +-#endif + #ifdef CONFIG_RT_MUTEXES + { + .procname = "max_lock_depth", +-- +2.39.5 + diff --git a/queue-5.15/i915-move-list_count-to-list.h-as-list_count_nodes-f.patch b/queue-5.15/i915-move-list_count-to-list.h-as-list_count_nodes-f.patch new file mode 100644 index 0000000000..c782d302d2 --- /dev/null +++ b/queue-5.15/i915-move-list_count-to-list.h-as-list_count_nodes-f.patch @@ -0,0 +1,88 @@ +From e7acfdd65c2af947a6e8bf2fdfcc029c42aba44b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Nov 2022 15:48:35 +0200 +Subject: i915: Move list_count() to list.h as list_count_nodes() for broader + use + +From: Andy Shevchenko + +[ Upstream commit 4d70c74659d9746502b23d055dba03d1d28ec388 ] + +Some of the existing users, and definitely will be new ones, want to +count existing nodes in the list. Provide a generic API for that by +moving code from i915 to list.h. + +Reviewed-by: Lucas De Marchi +Acked-by: Jani Nikula +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20221130134838.23805-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 19ae40f572a9 ("ptp: Properly handle compat ioctls") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_engine_cs.c | 15 ++------------- + include/linux/list.h | 15 +++++++++++++++ + 2 files changed, 17 insertions(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c +index eb99441e0ada0..598a605d2cf71 100644 +--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c ++++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c +@@ -1639,17 +1639,6 @@ static void print_request_ring(struct drm_printer *m, struct i915_request *rq) + } + } + +-static unsigned long list_count(struct list_head *list) +-{ +- struct list_head *pos; +- unsigned long count = 0; +- +- list_for_each(pos, list) +- count++; +- +- return count; +-} +- + static unsigned long read_ul(void *p, size_t x) + { + return *(unsigned long *)(p + x); +@@ -1824,8 +1813,8 @@ void intel_engine_dump(struct intel_engine_cs *engine, + spin_lock_irqsave(&engine->sched_engine->lock, flags); + engine_dump_active_requests(engine, m); + +- drm_printf(m, "\tOn hold?: %lu\n", +- list_count(&engine->sched_engine->hold)); ++ drm_printf(m, "\tOn hold?: %zu\n", ++ list_count_nodes(&engine->sched_engine->hold)); + spin_unlock_irqrestore(&engine->sched_engine->lock, flags); + + drm_printf(m, "\tMMIO base: 0x%08x\n", engine->mmio_base); +diff --git a/include/linux/list.h b/include/linux/list.h +index d206ae93c06da..dd9285360dbc9 100644 +--- a/include/linux/list.h ++++ b/include/linux/list.h +@@ -627,6 +627,21 @@ static inline void list_splice_tail_init(struct list_head *list, + !list_is_head(pos, (head)); \ + pos = n, n = pos->prev) + ++/** ++ * list_count_nodes - count nodes in the list ++ * @head: the head for your list. ++ */ ++static inline size_t list_count_nodes(struct list_head *head) ++{ ++ struct list_head *pos; ++ size_t count = 0; ++ ++ list_for_each(pos, head) ++ count++; ++ ++ return count; ++} ++ + /** + * list_entry_is_head - test if the entry points to the head of the list + * @pos: the type * to cursor +-- +2.39.5 + diff --git a/queue-5.15/ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch b/queue-5.15/ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch new file mode 100644 index 0000000000..c01afc400a --- /dev/null +++ b/queue-5.15/ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch @@ -0,0 +1,38 @@ +From 60c651da4c760966f6239d6c45a314ccf9dca30b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2024 17:44:19 +0800 +Subject: ipmi: ipmb: Add check devm_kasprintf() returned value + +From: Charles Han + +[ Upstream commit 2378bd0b264ad3a1f76bd957caf33ee0c7945351 ] + +devm_kasprintf() can return a NULL pointer on failure but this +returned value is not checked. + +Fixes: 51bd6f291583 ("Add support for IPMB driver") +Signed-off-by: Charles Han +Message-ID: <20240926094419.25900-1-hanchunchao@inspur.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmb_dev_int.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/char/ipmi/ipmb_dev_int.c b/drivers/char/ipmi/ipmb_dev_int.c +index 49b8f22fdcf03..964bde656f0d3 100644 +--- a/drivers/char/ipmi/ipmb_dev_int.c ++++ b/drivers/char/ipmi/ipmb_dev_int.c +@@ -322,6 +322,9 @@ static int ipmb_probe(struct i2c_client *client, + ipmb_dev->miscdev.name = devm_kasprintf(&client->dev, GFP_KERNEL, + "%s%d", "ipmb-", + client->adapter->nr); ++ if (!ipmb_dev->miscdev.name) ++ return -ENOMEM; ++ + ipmb_dev->miscdev.fops = &ipmb_fops; + ipmb_dev->miscdev.parent = &client->dev; + ret = misc_register(&ipmb_dev->miscdev); +-- +2.39.5 + diff --git a/queue-5.15/ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch b/queue-5.15/ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch new file mode 100644 index 0000000000..288fbb16ad --- /dev/null +++ b/queue-5.15/ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch @@ -0,0 +1,71 @@ +From 48afd9c18f5435770bf6c54e58c1b0959e51d5cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jan 2025 18:12:41 +0000 +Subject: ipmr: do not call mr_mfc_uses_dev() for unres entries + +From: Eric Dumazet + +[ Upstream commit 15a901361ec3fb1c393f91880e1cbf24ec0a88bd ] + +syzbot found that calling mr_mfc_uses_dev() for unres entries +would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif +alias to "struct sk_buff_head unresolved", which contain two pointers. + +This code never worked, lets remove it. + +[1] +Unable to handle kernel paging request at virtual address ffff5fff2d536613 +KASAN: maybe wild-memory-access in range [0xfffefff96a9b3098-0xfffefff96a9b309f] +Modules linked in: +CPU: 1 UID: 0 PID: 7321 Comm: syz.0.16 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 +pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] + pc : mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 + lr : mr_mfc_uses_dev net/ipv4/ipmr_base.c:289 [inline] + lr : mr_table_dump+0x694/0x8b0 net/ipv4/ipmr_base.c:334 +Call trace: + mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] (P) + mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 (P) + mr_rtm_dumproute+0x254/0x454 net/ipv4/ipmr_base.c:382 + ipmr_rtm_dumproute+0x248/0x4b4 net/ipv4/ipmr.c:2648 + rtnl_dump_all+0x2e4/0x4e8 net/core/rtnetlink.c:4327 + rtnl_dumpit+0x98/0x1d0 net/core/rtnetlink.c:6791 + netlink_dump+0x4f0/0xbc0 net/netlink/af_netlink.c:2317 + netlink_recvmsg+0x56c/0xe64 net/netlink/af_netlink.c:1973 + sock_recvmsg_nosec net/socket.c:1033 [inline] + sock_recvmsg net/socket.c:1055 [inline] + sock_read_iter+0x2d8/0x40c net/socket.c:1125 + new_sync_read fs/read_write.c:484 [inline] + vfs_read+0x740/0x970 fs/read_write.c:565 + ksys_read+0x15c/0x26c fs/read_write.c:708 + +Fixes: cb167893f41e ("net: Plumb support for filtering ipv4 and ipv6 multicast route dumps") +Reported-by: syzbot+5cfae50c0e5f2c500013@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/678fe2d1.050a0220.15cac.00b3.GAE@google.com/T/#u +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250121181241.841212-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/ipmr_base.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/net/ipv4/ipmr_base.c b/net/ipv4/ipmr_base.c +index c45cb7cb57590..8b5b6f196cdc4 100644 +--- a/net/ipv4/ipmr_base.c ++++ b/net/ipv4/ipmr_base.c +@@ -321,9 +321,6 @@ int mr_table_dump(struct mr_table *mrt, struct sk_buff *skb, + list_for_each_entry(mfc, &mrt->mfc_unres_queue, list) { + if (e < s_e) + goto next_entry2; +- if (filter->dev && +- !mr_mfc_uses_dev(mrt, mfc, filter->dev)) +- goto next_entry2; + + err = fill(mrt, skb, NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, mfc, RTM_NEWROUTE, flags); +-- +2.39.5 + diff --git a/queue-5.15/ktest.pl-remove-unused-declarations-in-run_bisect_te.patch b/queue-5.15/ktest.pl-remove-unused-declarations-in-run_bisect_te.patch new file mode 100644 index 0000000000..e04c8f789c --- /dev/null +++ b/queue-5.15/ktest.pl-remove-unused-declarations-in-run_bisect_te.patch @@ -0,0 +1,37 @@ +From 69d82d2d3365dd2ad287efff6a70861dd24a3ff0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Sep 2024 21:07:35 +0800 +Subject: ktest.pl: Remove unused declarations in run_bisect_test function + +From: Ba Jing + +[ Upstream commit 776735b954f49f85fd19e1198efa421fae2ad77c ] + +Since $output and $ret are not used in the subsequent code, the declarations +should be removed. + +Fixes: a75fececff3c ("ktest: Added sample.conf, new %default option format") +Link: https://lore.kernel.org/20240902130735.6034-1-bajing@cmss.chinamobile.com +Signed-off-by: Ba Jing +Signed-off-by: Steven Rostedt +Signed-off-by: Sasha Levin +--- + tools/testing/ktest/ktest.pl | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl +index 99e17a0a13649..f7f371a91ed97 100755 +--- a/tools/testing/ktest/ktest.pl ++++ b/tools/testing/ktest/ktest.pl +@@ -2939,8 +2939,6 @@ sub run_bisect_test { + + my $failed = 0; + my $result; +- my $output; +- my $ret; + + $in_bisect = 1; + +-- +2.39.5 + diff --git a/queue-5.15/landlock-handle-weird-files.patch b/queue-5.15/landlock-handle-weird-files.patch new file mode 100644 index 0000000000..77f534019a --- /dev/null +++ b/queue-5.15/landlock-handle-weird-files.patch @@ -0,0 +1,67 @@ +From b6244da8c2e8ec90b9d9b198caf3047113cc3fbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 16:39:13 +0100 +Subject: landlock: Handle weird files +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mickaël Salaün + +[ Upstream commit 49440290a0935f428a1e43a5ac8dc275a647ff80 ] + +A corrupted filesystem (e.g. bcachefs) might return weird files. +Instead of throwing a warning and allowing access to such file, treat +them as regular files. + +Cc: Dave Chinner +Cc: Kent Overstreet +Cc: Paul Moore +Reported-by: syzbot+34b68f850391452207df@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/r/000000000000a65b35061cffca61@google.com +Reported-by: syzbot+360866a59e3c80510a62@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/r/67379b3f.050a0220.85a0.0001.GAE@google.com +Reported-by: Ubisectech Sirius +Closes: https://lore.kernel.org/r/c426821d-8380-46c4-a494-7008bbd7dd13.bugreport@ubisectech.com +Fixes: cb2c7d1a1776 ("landlock: Support filesystem access-control") +Reviewed-by: Günther Noack +Link: https://lore.kernel.org/r/20250110153918.241810-1-mic@digikod.net +Signed-off-by: Mickaël Salaün +Signed-off-by: Sasha Levin +--- + security/landlock/fs.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/security/landlock/fs.c b/security/landlock/fs.c +index 7b7860039a08b..a3d99bba5f1e7 100644 +--- a/security/landlock/fs.c ++++ b/security/landlock/fs.c +@@ -370,10 +370,6 @@ static inline access_mask_t get_mode_access(const umode_t mode) + switch (mode & S_IFMT) { + case S_IFLNK: + return LANDLOCK_ACCESS_FS_MAKE_SYM; +- case 0: +- /* A zero mode translates to S_IFREG. */ +- case S_IFREG: +- return LANDLOCK_ACCESS_FS_MAKE_REG; + case S_IFDIR: + return LANDLOCK_ACCESS_FS_MAKE_DIR; + case S_IFCHR: +@@ -384,9 +380,12 @@ static inline access_mask_t get_mode_access(const umode_t mode) + return LANDLOCK_ACCESS_FS_MAKE_FIFO; + case S_IFSOCK: + return LANDLOCK_ACCESS_FS_MAKE_SOCK; ++ case S_IFREG: ++ case 0: ++ /* A zero mode translates to S_IFREG. */ + default: +- WARN_ON_ONCE(1); +- return 0; ++ /* Treats weird files as regular files. */ ++ return LANDLOCK_ACCESS_FS_MAKE_REG; + } + } + +-- +2.39.5 + diff --git a/queue-5.15/landlock-move-filesystem-helpers-and-add-a-new-one.patch b/queue-5.15/landlock-move-filesystem-helpers-and-add-a-new-one.patch new file mode 100644 index 0000000000..d54f74e75a --- /dev/null +++ b/queue-5.15/landlock-move-filesystem-helpers-and-add-a-new-one.patch @@ -0,0 +1,157 @@ +From 813bf0a7aaa011c04bfa5419db4adec5f80c564a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 May 2022 18:10:55 +0200 +Subject: landlock: Move filesystem helpers and add a new one +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mickaël Salaün + +[ Upstream commit 9da82b20fde95814af721a2a7b1796a5b4a3d78e ] + +Move the SB_NOUSER and IS_PRIVATE dentry check to a standalone +is_nouser_or_private() helper. This will be useful for a following +commit. + +Move get_mode_access() and maybe_remove() to make them usable by new +code provided by a following commit. + +Reviewed-by: Paul Moore +Signed-off-by: Mickaël Salaün +Link: https://lore.kernel.org/r/20220506161102.525323-6-mic@digikod.net +Stable-dep-of: 49440290a093 ("landlock: Handle weird files") +Signed-off-by: Sasha Levin +--- + security/landlock/fs.c | 87 ++++++++++++++++++++++-------------------- + 1 file changed, 46 insertions(+), 41 deletions(-) + +diff --git a/security/landlock/fs.c b/security/landlock/fs.c +index c5749301b37d6..7b7860039a08b 100644 +--- a/security/landlock/fs.c ++++ b/security/landlock/fs.c +@@ -261,6 +261,18 @@ unmask_layers(const struct landlock_rule *const rule, + return false; + } + ++/* ++ * Allows access to pseudo filesystems that will never be mountable (e.g. ++ * sockfs, pipefs), but can still be reachable through ++ * /proc//fd/ ++ */ ++static inline bool is_nouser_or_private(const struct dentry *dentry) ++{ ++ return (dentry->d_sb->s_flags & SB_NOUSER) || ++ (d_is_positive(dentry) && ++ unlikely(IS_PRIVATE(d_backing_inode(dentry)))); ++} ++ + static int check_access_path(const struct landlock_ruleset *const domain, + const struct path *const path, + const access_mask_t access_request) +@@ -274,14 +286,7 @@ static int check_access_path(const struct landlock_ruleset *const domain, + return 0; + if (WARN_ON_ONCE(!domain || !path)) + return 0; +- /* +- * Allows access to pseudo filesystems that will never be mountable +- * (e.g. sockfs, pipefs), but can still be reachable through +- * /proc//fd/ . +- */ +- if ((path->dentry->d_sb->s_flags & SB_NOUSER) || +- (d_is_positive(path->dentry) && +- unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))) ++ if (is_nouser_or_private(path->dentry)) + return 0; + if (WARN_ON_ONCE(domain->num_layers < 1)) + return -EACCES; +@@ -360,6 +365,39 @@ static inline int current_check_access_path(const struct path *const path, + return check_access_path(dom, path, access_request); + } + ++static inline access_mask_t get_mode_access(const umode_t mode) ++{ ++ switch (mode & S_IFMT) { ++ case S_IFLNK: ++ return LANDLOCK_ACCESS_FS_MAKE_SYM; ++ case 0: ++ /* A zero mode translates to S_IFREG. */ ++ case S_IFREG: ++ return LANDLOCK_ACCESS_FS_MAKE_REG; ++ case S_IFDIR: ++ return LANDLOCK_ACCESS_FS_MAKE_DIR; ++ case S_IFCHR: ++ return LANDLOCK_ACCESS_FS_MAKE_CHAR; ++ case S_IFBLK: ++ return LANDLOCK_ACCESS_FS_MAKE_BLOCK; ++ case S_IFIFO: ++ return LANDLOCK_ACCESS_FS_MAKE_FIFO; ++ case S_IFSOCK: ++ return LANDLOCK_ACCESS_FS_MAKE_SOCK; ++ default: ++ WARN_ON_ONCE(1); ++ return 0; ++ } ++} ++ ++static inline access_mask_t maybe_remove(const struct dentry *const dentry) ++{ ++ if (d_is_negative(dentry)) ++ return 0; ++ return d_is_dir(dentry) ? LANDLOCK_ACCESS_FS_REMOVE_DIR : ++ LANDLOCK_ACCESS_FS_REMOVE_FILE; ++} ++ + /* Inode hooks */ + + static void hook_inode_free_security(struct inode *const inode) +@@ -553,31 +591,6 @@ static int hook_sb_pivotroot(const struct path *const old_path, + + /* Path hooks */ + +-static inline access_mask_t get_mode_access(const umode_t mode) +-{ +- switch (mode & S_IFMT) { +- case S_IFLNK: +- return LANDLOCK_ACCESS_FS_MAKE_SYM; +- case 0: +- /* A zero mode translates to S_IFREG. */ +- case S_IFREG: +- return LANDLOCK_ACCESS_FS_MAKE_REG; +- case S_IFDIR: +- return LANDLOCK_ACCESS_FS_MAKE_DIR; +- case S_IFCHR: +- return LANDLOCK_ACCESS_FS_MAKE_CHAR; +- case S_IFBLK: +- return LANDLOCK_ACCESS_FS_MAKE_BLOCK; +- case S_IFIFO: +- return LANDLOCK_ACCESS_FS_MAKE_FIFO; +- case S_IFSOCK: +- return LANDLOCK_ACCESS_FS_MAKE_SOCK; +- default: +- WARN_ON_ONCE(1); +- return 0; +- } +-} +- + /* + * Creating multiple links or renaming may lead to privilege escalations if not + * handled properly. Indeed, we must be sure that the source doesn't gain more +@@ -606,14 +619,6 @@ static int hook_path_link(struct dentry *const old_dentry, + get_mode_access(d_backing_inode(old_dentry)->i_mode)); + } + +-static inline access_mask_t maybe_remove(const struct dentry *const dentry) +-{ +- if (d_is_negative(dentry)) +- return 0; +- return d_is_dir(dentry) ? LANDLOCK_ACCESS_FS_REMOVE_DIR : +- LANDLOCK_ACCESS_FS_REMOVE_FILE; +-} +- + static int hook_path_rename(const struct path *const old_dir, + struct dentry *const old_dentry, + const struct path *const new_dir, +-- +2.39.5 + diff --git a/queue-5.15/leds-netxbig-fix-an-of-node-reference-leak-in-netxbi.patch b/queue-5.15/leds-netxbig-fix-an-of-node-reference-leak-in-netxbi.patch new file mode 100644 index 0000000000..9877114505 --- /dev/null +++ b/queue-5.15/leds-netxbig-fix-an-of-node-reference-leak-in-netxbi.patch @@ -0,0 +1,41 @@ +From d6e77302b30fdc3940a2a02723e4777c79bd2710 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 16:49:23 +0900 +Subject: leds: netxbig: Fix an OF node reference leak in + netxbig_leds_get_of_pdata() + +From: Joe Hattori + +[ Upstream commit 0508316be63bb735f59bdc8fe4527cadb62210ca ] + +netxbig_leds_get_of_pdata() does not release the OF node obtained by +of_parse_phandle() when of_find_device_by_node() fails. Add an +of_node_put() call to fix the leak. + +This bug was found by an experimental static analysis tool that I am +developing. + +Fixes: 9af512e81964 ("leds: netxbig: Convert to use GPIO descriptors") +Signed-off-by: Joe Hattori +Link: https://lore.kernel.org/r/20241216074923.628509-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-netxbig.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c +index 77213b79f84d9..6692de0af68f1 100644 +--- a/drivers/leds/leds-netxbig.c ++++ b/drivers/leds/leds-netxbig.c +@@ -440,6 +440,7 @@ static int netxbig_leds_get_of_pdata(struct device *dev, + } + gpio_ext_pdev = of_find_device_by_node(gpio_ext_np); + if (!gpio_ext_pdev) { ++ of_node_put(gpio_ext_np); + dev_err(dev, "Failed to find platform device for gpio-ext\n"); + return -ENODEV; + } +-- +2.39.5 + diff --git a/queue-5.15/libbpf-fix-segfault-due-to-libelf-functions-not-sett.patch b/queue-5.15/libbpf-fix-segfault-due-to-libelf-functions-not-sett.patch new file mode 100644 index 0000000000..7490d7a107 --- /dev/null +++ b/queue-5.15/libbpf-fix-segfault-due-to-libelf-functions-not-sett.patch @@ -0,0 +1,140 @@ +From 0714f0d3833dd0abee038d1f36719bdeab2089e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 13:59:42 +0000 +Subject: libbpf: Fix segfault due to libelf functions not setting errno + +From: Quentin Monnet + +[ Upstream commit e10500b69c3f3378f3dcfc8c2fe4cdb74fc844f5 ] + +Libelf functions do not set errno on failure. Instead, it relies on its +internal _elf_errno value, that can be retrieved via elf_errno (or the +corresponding message via elf_errmsg()). From "man libelf": + + If a libelf function encounters an error it will set an internal + error code that can be retrieved with elf_errno. Each thread + maintains its own separate error code. The meaning of each error + code can be determined with elf_errmsg, which returns a string + describing the error. + +As a consequence, libbpf should not return -errno when a function from +libelf fails, because an empty value will not be interpreted as an error +and won't prevent the program to stop. This is visible in +bpf_linker__add_file(), for example, where we call a succession of +functions that rely on libelf: + + err = err ?: linker_load_obj_file(linker, filename, opts, &obj); + err = err ?: linker_append_sec_data(linker, &obj); + err = err ?: linker_append_elf_syms(linker, &obj); + err = err ?: linker_append_elf_relos(linker, &obj); + err = err ?: linker_append_btf(linker, &obj); + err = err ?: linker_append_btf_ext(linker, &obj); + +If the object file that we try to process is not, in fact, a correct +object file, linker_load_obj_file() may fail with errno not being set, +and return 0. In this case we attempt to run linker_append_elf_sysms() +and may segfault. + +This can happen (and was discovered) with bpftool: + + $ bpftool gen object output.o sample_ret0.bpf.c + libbpf: failed to get ELF header for sample_ret0.bpf.c: invalid `Elf' handle + zsh: segmentation fault (core dumped) bpftool gen object output.o sample_ret0.bpf.c + +Fix the issue by returning a non-null error code (-EINVAL) when libelf +functions fail. + +Fixes: faf6ed321cf6 ("libbpf: Add BPF static linker APIs") +Signed-off-by: Quentin Monnet +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20241205135942.65262-1-qmo@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/linker.c | 22 ++++++++-------------- + 1 file changed, 8 insertions(+), 14 deletions(-) + +diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c +index 8907d4238818c..2adf55f487430 100644 +--- a/tools/lib/bpf/linker.c ++++ b/tools/lib/bpf/linker.c +@@ -568,17 +568,15 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename, + } + obj->elf = elf_begin(obj->fd, ELF_C_READ_MMAP, NULL); + if (!obj->elf) { +- err = -errno; + pr_warn_elf("failed to parse ELF file '%s'", filename); +- return err; ++ return -EINVAL; + } + + /* Sanity check ELF file high-level properties */ + ehdr = elf64_getehdr(obj->elf); + if (!ehdr) { +- err = -errno; + pr_warn_elf("failed to get ELF header for %s", filename); +- return err; ++ return -EINVAL; + } + if (ehdr->e_ident[EI_DATA] != host_endianness) { + err = -EOPNOTSUPP; +@@ -594,9 +592,8 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename, + } + + if (elf_getshdrstrndx(obj->elf, &obj->shstrs_sec_idx)) { +- err = -errno; + pr_warn_elf("failed to get SHSTRTAB section index for %s", filename); +- return err; ++ return -EINVAL; + } + + scn = NULL; +@@ -606,26 +603,23 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename, + + shdr = elf64_getshdr(scn); + if (!shdr) { +- err = -errno; + pr_warn_elf("failed to get section #%zu header for %s", + sec_idx, filename); +- return err; ++ return -EINVAL; + } + + sec_name = elf_strptr(obj->elf, obj->shstrs_sec_idx, shdr->sh_name); + if (!sec_name) { +- err = -errno; + pr_warn_elf("failed to get section #%zu name for %s", + sec_idx, filename); +- return err; ++ return -EINVAL; + } + + data = elf_getdata(scn, 0); + if (!data) { +- err = -errno; + pr_warn_elf("failed to get section #%zu (%s) data from %s", + sec_idx, sec_name, filename); +- return err; ++ return -EINVAL; + } + + sec = add_src_sec(obj, sec_name); +@@ -2601,14 +2595,14 @@ int bpf_linker__finalize(struct bpf_linker *linker) + + /* Finalize ELF layout */ + if (elf_update(linker->elf, ELF_C_NULL) < 0) { +- err = -errno; ++ err = -EINVAL; + pr_warn_elf("failed to finalize ELF layout"); + return libbpf_err(err); + } + + /* Write out final ELF contents */ + if (elf_update(linker->elf, ELF_C_WRITE) < 0) { +- err = -errno; ++ err = -EINVAL; + pr_warn_elf("failed to write ELF contents"); + return libbpf_err(err); + } +-- +2.39.5 + diff --git a/queue-5.15/media-camif-core-add-check-for-clk_enable.patch b/queue-5.15/media-camif-core-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..e443dd6e8c --- /dev/null +++ b/queue-5.15/media-camif-core-add-check-for-clk_enable.patch @@ -0,0 +1,50 @@ +From 552d5343abd9dc3adbda3ed1e746b64cd34c5dcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Nov 2024 19:18:17 +0000 +Subject: media: camif-core: Add check for clk_enable() + +From: Jiasheng Jiang + +[ Upstream commit 77ed2470ac09c2b0a33cf3f98cc51d18ba9ed976 ] + +Add check for the return value of clk_enable() to gurantee the success. + +Fixes: babde1c243b2 ("[media] V4L: Add driver for S3C24XX/S3C64XX SoC series camera interface") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/s3c-camif/camif-core.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/s3c-camif/camif-core.c b/drivers/media/platform/s3c-camif/camif-core.c +index e1d51fd3e7008..e4c8e3f19626d 100644 +--- a/drivers/media/platform/s3c-camif/camif-core.c ++++ b/drivers/media/platform/s3c-camif/camif-core.c +@@ -532,10 +532,19 @@ static int s3c_camif_remove(struct platform_device *pdev) + static int s3c_camif_runtime_resume(struct device *dev) + { + struct camif_dev *camif = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = clk_enable(camif->clock[CLK_GATE]); ++ if (ret) ++ return ret; + +- clk_enable(camif->clock[CLK_GATE]); + /* null op on s3c244x */ +- clk_enable(camif->clock[CLK_CAM]); ++ ret = clk_enable(camif->clock[CLK_CAM]); ++ if (ret) { ++ clk_disable(camif->clock[CLK_GATE]); ++ return ret; ++ } ++ + return 0; + } + +-- +2.39.5 + diff --git a/queue-5.15/media-i2c-imx412-add-missing-newline-to-prints.patch b/queue-5.15/media-i2c-imx412-add-missing-newline-to-prints.patch new file mode 100644 index 0000000000..128c5e859d --- /dev/null +++ b/queue-5.15/media-i2c-imx412-add-missing-newline-to-prints.patch @@ -0,0 +1,210 @@ +From 945067d16c0788922323243d9d11fc11efffa533 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2024 22:45:46 +0100 +Subject: media: i2c: imx412: Add missing newline to prints + +From: Luca Weiss + +[ Upstream commit 33f4a7fba7229232e294f4794503283e44cd03f2 ] + +Add trailing \n to dev_dbg and dev_err prints where missing. + +Signed-off-by: Luca Weiss +Fixes: 9214e86c0cc1 ("media: i2c: Add imx412 camera sensor driver") +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx412.c | 42 +++++++++++++++++++------------------- + 1 file changed, 21 insertions(+), 21 deletions(-) + +diff --git a/drivers/media/i2c/imx412.c b/drivers/media/i2c/imx412.c +index 3d4d813923918..5e7ccbc8dfecd 100644 +--- a/drivers/media/i2c/imx412.c ++++ b/drivers/media/i2c/imx412.c +@@ -540,7 +540,7 @@ static int imx412_update_exp_gain(struct imx412 *imx412, u32 exposure, u32 gain) + + lpfr = imx412->vblank + imx412->cur_mode->height; + +- dev_dbg(imx412->dev, "Set exp %u, analog gain %u, lpfr %u", ++ dev_dbg(imx412->dev, "Set exp %u, analog gain %u, lpfr %u\n", + exposure, gain, lpfr); + + ret = imx412_write_reg(imx412, IMX412_REG_HOLD, 1, 1); +@@ -587,7 +587,7 @@ static int imx412_set_ctrl(struct v4l2_ctrl *ctrl) + case V4L2_CID_VBLANK: + imx412->vblank = imx412->vblank_ctrl->val; + +- dev_dbg(imx412->dev, "Received vblank %u, new lpfr %u", ++ dev_dbg(imx412->dev, "Received vblank %u, new lpfr %u\n", + imx412->vblank, + imx412->vblank + imx412->cur_mode->height); + +@@ -606,7 +606,7 @@ static int imx412_set_ctrl(struct v4l2_ctrl *ctrl) + exposure = ctrl->val; + analog_gain = imx412->again_ctrl->val; + +- dev_dbg(imx412->dev, "Received exp %u, analog gain %u", ++ dev_dbg(imx412->dev, "Received exp %u, analog gain %u\n", + exposure, analog_gain); + + ret = imx412_update_exp_gain(imx412, exposure, analog_gain); +@@ -615,7 +615,7 @@ static int imx412_set_ctrl(struct v4l2_ctrl *ctrl) + + break; + default: +- dev_err(imx412->dev, "Invalid control %d", ctrl->id); ++ dev_err(imx412->dev, "Invalid control %d\n", ctrl->id); + ret = -EINVAL; + } + +@@ -796,14 +796,14 @@ static int imx412_start_streaming(struct imx412 *imx412) + ret = imx412_write_regs(imx412, reg_list->regs, + reg_list->num_of_regs); + if (ret) { +- dev_err(imx412->dev, "fail to write initial registers"); ++ dev_err(imx412->dev, "fail to write initial registers\n"); + return ret; + } + + /* Setup handler will write actual exposure and gain */ + ret = __v4l2_ctrl_handler_setup(imx412->sd.ctrl_handler); + if (ret) { +- dev_err(imx412->dev, "fail to setup handler"); ++ dev_err(imx412->dev, "fail to setup handler\n"); + return ret; + } + +@@ -814,7 +814,7 @@ static int imx412_start_streaming(struct imx412 *imx412) + ret = imx412_write_reg(imx412, IMX412_REG_MODE_SELECT, + 1, IMX412_MODE_STREAMING); + if (ret) { +- dev_err(imx412->dev, "fail to start streaming"); ++ dev_err(imx412->dev, "fail to start streaming\n"); + return ret; + } + +@@ -895,7 +895,7 @@ static int imx412_detect(struct imx412 *imx412) + return ret; + + if (val != IMX412_ID) { +- dev_err(imx412->dev, "chip id mismatch: %x!=%x", ++ dev_err(imx412->dev, "chip id mismatch: %x!=%x\n", + IMX412_ID, val); + return -ENXIO; + } +@@ -927,7 +927,7 @@ static int imx412_parse_hw_config(struct imx412 *imx412) + imx412->reset_gpio = devm_gpiod_get_optional(imx412->dev, "reset", + GPIOD_OUT_LOW); + if (IS_ERR(imx412->reset_gpio)) { +- dev_err(imx412->dev, "failed to get reset gpio %ld", ++ dev_err(imx412->dev, "failed to get reset gpio %ld\n", + PTR_ERR(imx412->reset_gpio)); + return PTR_ERR(imx412->reset_gpio); + } +@@ -935,13 +935,13 @@ static int imx412_parse_hw_config(struct imx412 *imx412) + /* Get sensor input clock */ + imx412->inclk = devm_clk_get(imx412->dev, NULL); + if (IS_ERR(imx412->inclk)) { +- dev_err(imx412->dev, "could not get inclk"); ++ dev_err(imx412->dev, "could not get inclk\n"); + return PTR_ERR(imx412->inclk); + } + + rate = clk_get_rate(imx412->inclk); + if (rate != IMX412_INCLK_RATE) { +- dev_err(imx412->dev, "inclk frequency mismatch"); ++ dev_err(imx412->dev, "inclk frequency mismatch\n"); + return -EINVAL; + } + +@@ -956,14 +956,14 @@ static int imx412_parse_hw_config(struct imx412 *imx412) + + if (bus_cfg.bus.mipi_csi2.num_data_lanes != IMX412_NUM_DATA_LANES) { + dev_err(imx412->dev, +- "number of CSI2 data lanes %d is not supported", ++ "number of CSI2 data lanes %d is not supported\n", + bus_cfg.bus.mipi_csi2.num_data_lanes); + ret = -EINVAL; + goto done_endpoint_free; + } + + if (!bus_cfg.nr_of_link_frequencies) { +- dev_err(imx412->dev, "no link frequencies defined"); ++ dev_err(imx412->dev, "no link frequencies defined\n"); + ret = -EINVAL; + goto done_endpoint_free; + } +@@ -1014,7 +1014,7 @@ static int imx412_power_on(struct device *dev) + + ret = clk_prepare_enable(imx412->inclk); + if (ret) { +- dev_err(imx412->dev, "fail to enable inclk"); ++ dev_err(imx412->dev, "fail to enable inclk\n"); + goto error_reset; + } + +@@ -1120,7 +1120,7 @@ static int imx412_init_controls(struct imx412 *imx412) + imx412->hblank_ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY; + + if (ctrl_hdlr->error) { +- dev_err(imx412->dev, "control init failed: %d", ++ dev_err(imx412->dev, "control init failed: %d\n", + ctrl_hdlr->error); + v4l2_ctrl_handler_free(ctrl_hdlr); + return ctrl_hdlr->error; +@@ -1153,7 +1153,7 @@ static int imx412_probe(struct i2c_client *client) + + ret = imx412_parse_hw_config(imx412); + if (ret) { +- dev_err(imx412->dev, "HW configuration is not supported"); ++ dev_err(imx412->dev, "HW configuration is not supported\n"); + return ret; + } + +@@ -1161,14 +1161,14 @@ static int imx412_probe(struct i2c_client *client) + + ret = imx412_power_on(imx412->dev); + if (ret) { +- dev_err(imx412->dev, "failed to power-on the sensor"); ++ dev_err(imx412->dev, "failed to power-on the sensor\n"); + goto error_mutex_destroy; + } + + /* Check module identity */ + ret = imx412_detect(imx412); + if (ret) { +- dev_err(imx412->dev, "failed to find sensor: %d", ret); ++ dev_err(imx412->dev, "failed to find sensor: %d\n", ret); + goto error_power_off; + } + +@@ -1178,7 +1178,7 @@ static int imx412_probe(struct i2c_client *client) + + ret = imx412_init_controls(imx412); + if (ret) { +- dev_err(imx412->dev, "failed to init controls: %d", ret); ++ dev_err(imx412->dev, "failed to init controls: %d\n", ret); + goto error_power_off; + } + +@@ -1190,14 +1190,14 @@ static int imx412_probe(struct i2c_client *client) + imx412->pad.flags = MEDIA_PAD_FL_SOURCE; + ret = media_entity_pads_init(&imx412->sd.entity, 1, &imx412->pad); + if (ret) { +- dev_err(imx412->dev, "failed to init entity pads: %d", ret); ++ dev_err(imx412->dev, "failed to init entity pads: %d\n", ret); + goto error_handler_free; + } + + ret = v4l2_async_register_subdev_sensor(&imx412->sd); + if (ret < 0) { + dev_err(imx412->dev, +- "failed to register async subdev: %d", ret); ++ "failed to register async subdev: %d\n", ret); + goto error_media_entity; + } + +-- +2.39.5 + diff --git a/queue-5.15/media-i2c-ov9282-correct-the-exposure-offset.patch b/queue-5.15/media-i2c-ov9282-correct-the-exposure-offset.patch new file mode 100644 index 0000000000..cd9d849cf6 --- /dev/null +++ b/queue-5.15/media-i2c-ov9282-correct-the-exposure-offset.patch @@ -0,0 +1,44 @@ +From 6da06a07de99222cbed2bec8a30c4608d1005ef6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 14:55:45 +0000 +Subject: media: i2c: ov9282: Correct the exposure offset + +From: Dave Stevenson + +[ Upstream commit feaf4154d69657af2bf96e6e66cca794f88b1a61 ] + +The datasheet lists that "Maximum exposure time is frame +length -25 row periods, where frame length is set by +registers {0x380E, 0x380F}". +However this driver had OV9282_EXPOSURE_OFFSET set to 12 +which allowed that restriction to be violated, and would +result in very under-exposed images. + +Correct the offset. + +Fixes: 14ea315bbeb7 ("media: i2c: Add ov9282 camera sensor driver") +Signed-off-by: Dave Stevenson +Reviewed-by: Kieran Bingham +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov9282.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov9282.c b/drivers/media/i2c/ov9282.c +index 2e0b315801e56..5bc9fafa72a4b 100644 +--- a/drivers/media/i2c/ov9282.c ++++ b/drivers/media/i2c/ov9282.c +@@ -31,7 +31,7 @@ + /* Exposure control */ + #define OV9282_REG_EXPOSURE 0x3500 + #define OV9282_EXPOSURE_MIN 1 +-#define OV9282_EXPOSURE_OFFSET 12 ++#define OV9282_EXPOSURE_OFFSET 25 + #define OV9282_EXPOSURE_STEP 1 + #define OV9282_EXPOSURE_DEFAULT 0x0282 + +-- +2.39.5 + diff --git a/queue-5.15/media-lmedm04-handle-errors-for-lme2510_int_read.patch b/queue-5.15/media-lmedm04-handle-errors-for-lme2510_int_read.patch new file mode 100644 index 0000000000..ed29fab231 --- /dev/null +++ b/queue-5.15/media-lmedm04-handle-errors-for-lme2510_int_read.patch @@ -0,0 +1,58 @@ +From c99ab4760e1dbeacaf50f2a57a864dd0d8366d30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 17:10:42 +0800 +Subject: media: lmedm04: Handle errors for lme2510_int_read + +From: Chen Ni + +[ Upstream commit a2836d3fe220220ff8c495ca9722f89cea8a67e7 ] + +Add check for the return value of usb_pipe_endpoint() and +usb_submit_urb() in order to catch the errors. + +Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb") +Signed-off-by: Chen Ni +Link: https://lore.kernel.org/r/20240521091042.1769684-1-nichen@iscas.ac.cn +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb-v2/lmedm04.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c +index fe4d886442a41..220df46f56c57 100644 +--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c ++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c +@@ -373,6 +373,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap) + struct dvb_usb_device *d = adap_to_d(adap); + struct lme2510_state *lme_int = adap_to_priv(adap); + struct usb_host_endpoint *ep; ++ int ret; + + lme_int->lme_urb = usb_alloc_urb(0, GFP_KERNEL); + +@@ -390,11 +391,20 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap) + + /* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */ + ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe); ++ if (!ep) { ++ usb_free_urb(lme_int->lme_urb); ++ return -ENODEV; ++ } + + if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK) + lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa); + +- usb_submit_urb(lme_int->lme_urb, GFP_KERNEL); ++ ret = usb_submit_urb(lme_int->lme_urb, GFP_KERNEL); ++ if (ret) { ++ usb_free_urb(lme_int->lme_urb); ++ return ret; ++ } ++ + info("INT Interrupt Service Started"); + + return 0; +-- +2.39.5 + diff --git a/queue-5.15/media-marvell-add-check-for-clk_enable.patch b/queue-5.15/media-marvell-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..18b9ad5057 --- /dev/null +++ b/queue-5.15/media-marvell-add-check-for-clk_enable.patch @@ -0,0 +1,42 @@ +From 691f04e8ceedf86a41402c8ff11617c46a5d9622 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 21:29:02 +0000 +Subject: media: marvell: Add check for clk_enable() + +From: Jiasheng Jiang + +[ Upstream commit 11f68d2ba2e1521a608af773bf788e8cfa260f68 ] + +Add check for the return value of clk_enable() to guarantee the success. + +Fixes: 81a409bfd551 ("media: marvell-ccic: provide a clock for the sensor") +Signed-off-by: Jiasheng Jiang +[Sakari Ailus: Fix spelling in commit message.] +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/marvell-ccic/mcam-core.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/marvell-ccic/mcam-core.c b/drivers/media/platform/marvell-ccic/mcam-core.c +index 58f9463f3b8ce..a8d3ed5dc206f 100644 +--- a/drivers/media/platform/marvell-ccic/mcam-core.c ++++ b/drivers/media/platform/marvell-ccic/mcam-core.c +@@ -935,7 +935,12 @@ static int mclk_enable(struct clk_hw *hw) + ret = pm_runtime_resume_and_get(cam->dev); + if (ret < 0) + return ret; +- clk_enable(cam->clk[0]); ++ ret = clk_enable(cam->clk[0]); ++ if (ret) { ++ pm_runtime_put(cam->dev); ++ return ret; ++ } ++ + mcam_reg_write(cam, REG_CLKCTRL, (mclk_src << 29) | mclk_div); + mcam_ctlr_power_up(cam); + +-- +2.39.5 + diff --git a/queue-5.15/media-mipi-csis-add-check-for-clk_enable.patch b/queue-5.15/media-mipi-csis-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..6f04fc079d --- /dev/null +++ b/queue-5.15/media-mipi-csis-add-check-for-clk_enable.patch @@ -0,0 +1,50 @@ +From dfa38258f2fe29ddebc8b2c5ab883e6fd4431845 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Nov 2024 19:18:18 +0000 +Subject: media: mipi-csis: Add check for clk_enable() + +From: Jiasheng Jiang + +[ Upstream commit 125ad1aeec77eb55273b420be6894b284a01e4b6 ] + +Add check for the return value of clk_enable() to gurantee the success. + +Fixes: b5f1220d587d ("[media] v4l: Add v4l2 subdev driver for S5P/EXYNOS4 MIPI-CSI receivers") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/exynos4-is/mipi-csis.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c +index 32b23329b0331..51467ddff185b 100644 +--- a/drivers/media/platform/exynos4-is/mipi-csis.c ++++ b/drivers/media/platform/exynos4-is/mipi-csis.c +@@ -942,13 +942,19 @@ static int s5pcsis_pm_resume(struct device *dev, bool runtime) + state->supplies); + goto unlock; + } +- clk_enable(state->clock[CSIS_CLK_GATE]); ++ ret = clk_enable(state->clock[CSIS_CLK_GATE]); ++ if (ret) { ++ phy_power_off(state->phy); ++ regulator_bulk_disable(CSIS_NUM_SUPPLIES, ++ state->supplies); ++ goto unlock; ++ } + } + if (state->flags & ST_STREAMING) + s5pcsis_start_stream(state); + + state->flags &= ~ST_SUSPENDED; +- unlock: ++unlock: + mutex_unlock(&state->lock); + return ret ? -EAGAIN : 0; + } +-- +2.39.5 + diff --git a/queue-5.15/media-rc-iguanair-handle-timeouts.patch b/queue-5.15/media-rc-iguanair-handle-timeouts.patch new file mode 100644 index 0000000000..ce56b12cfd --- /dev/null +++ b/queue-5.15/media-rc-iguanair-handle-timeouts.patch @@ -0,0 +1,48 @@ +From 3c7d5b18b0d9c19e2be4187e2de4653f125ecb86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 14:17:22 +0100 +Subject: media: rc: iguanair: handle timeouts + +From: Oliver Neukum + +[ Upstream commit b98d5000c50544f14bacb248c34e5219fbe81287 ] + +In case of a timeout the IO must be cancelled or +the next IO using the URB will fail and/or overwrite +an operational URB. + +The automatic bisection fails because it arrives +at a commit that correctly lets the test case run +without an error. + +Signed-off-by: Oliver Neukum +Fixes: e99a7cfe93fd ("[media] iguanair: reuse existing urb callback for command responses") +Reported-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/66f5cc9a.050a0220.46d20.0004.GAE@google.com/ +Tested-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/iguanair.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c +index 84949baf9f6b3..c1343df0dbbab 100644 +--- a/drivers/media/rc/iguanair.c ++++ b/drivers/media/rc/iguanair.c +@@ -197,8 +197,10 @@ static int iguanair_send(struct iguanair *ir, unsigned size) + if (rc) + return rc; + +- if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) ++ if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) { ++ usb_kill_urb(ir->urb_out); + return -ETIMEDOUT; ++ } + + return rc; + } +-- +2.39.5 + diff --git a/queue-5.15/media-uvcvideo-propagate-buf-error-to-userspace.patch b/queue-5.15/media-uvcvideo-propagate-buf-error-to-userspace.patch new file mode 100644 index 0000000000..1b181116d2 --- /dev/null +++ b/queue-5.15/media-uvcvideo-propagate-buf-error-to-userspace.patch @@ -0,0 +1,44 @@ +From 66d16a52d0bd59df2d8c00758b63daa8c7d76f78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 21:39:08 +0000 +Subject: media: uvcvideo: Propagate buf->error to userspace + +From: Ricardo Ribalda + +[ Upstream commit 87ce177654e388451850905a1d376658aebe8699 ] + +Now we return VB2_BUF_STATE_DONE for valid and invalid frames. Propagate +the correct value, so the user can know if the frame is valid or not via +struct v4l2_buffer->flags. + +Reported-by: Hans de Goede +Closes: https://lore.kernel.org/linux-media/84b0f212-cd88-46bb-8e6f-b94ec3eccba6@redhat.com +Fixes: 6998b6fb4b1c ("[media] uvcvideo: Use videobuf2-vmalloc") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20241218-uvc-deprecate-v2-1-ab814139e983@chromium.org +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_queue.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c +index 21a907d32bb73..f1f58f2d820f8 100644 +--- a/drivers/media/usb/uvc/uvc_queue.c ++++ b/drivers/media/usb/uvc/uvc_queue.c +@@ -481,7 +481,8 @@ static void uvc_queue_buffer_complete(struct kref *ref) + + buf->state = buf->error ? UVC_BUF_STATE_ERROR : UVC_BUF_STATE_DONE; + vb2_set_plane_payload(&buf->buf.vb2_buf, 0, buf->bytesused); +- vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_DONE); ++ vb2_buffer_done(&buf->buf.vb2_buf, buf->error ? VB2_BUF_STATE_ERROR : ++ VB2_BUF_STATE_DONE); + } + + /* +-- +2.39.5 + diff --git a/queue-5.15/memblock-drop-memblock_free_early_nid-and-memblock_f.patch b/queue-5.15/memblock-drop-memblock_free_early_nid-and-memblock_f.patch new file mode 100644 index 0000000000..0eaf5711e2 --- /dev/null +++ b/queue-5.15/memblock-drop-memblock_free_early_nid-and-memblock_f.patch @@ -0,0 +1,208 @@ +From 831afb50375b3df5ca04c8b4b53d461ec42de80d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 13:43:13 -0700 +Subject: memblock: drop memblock_free_early_nid() and memblock_free_early() + +From: Mike Rapoport + +[ Upstream commit fa27717110ae51b9b9013ced0b5143888257bb79 ] + +memblock_free_early_nid() is unused and memblock_free_early() is an +alias for memblock_free(). + +Replace calls to memblock_free_early() with calls to memblock_free() and +remove memblock_free_early() and memblock_free_early_nid(). + +Link: https://lkml.kernel.org/r/20210930185031.18648-4-rppt@kernel.org +Signed-off-by: Mike Rapoport +Cc: Christophe Leroy +Cc: Juergen Gross +Cc: Shahab Vahedi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: 29091a52562b ("of: reserved-memory: Do not make kmemleak ignore freed address") +Signed-off-by: Sasha Levin +--- + arch/mips/mm/init.c | 2 +- + arch/powerpc/platforms/pseries/svm.c | 3 +-- + arch/s390/kernel/smp.c | 2 +- + drivers/base/arch_numa.c | 2 +- + drivers/s390/char/sclp_early.c | 2 +- + include/linux/memblock.h | 12 ------------ + kernel/dma/swiotlb.c | 2 +- + lib/cpumask.c | 2 +- + mm/percpu.c | 8 ++++---- + mm/sparse.c | 2 +- + 10 files changed, 12 insertions(+), 25 deletions(-) + +diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c +index 833fcfc20b103..81fda8c583ae1 100644 +--- a/arch/mips/mm/init.c ++++ b/arch/mips/mm/init.c +@@ -527,7 +527,7 @@ static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size, + + static void __init pcpu_fc_free(void *ptr, size_t size) + { +- memblock_free_early(__pa(ptr), size); ++ memblock_free(__pa(ptr), size); + } + + void __init setup_per_cpu_areas(void) +diff --git a/arch/powerpc/platforms/pseries/svm.c b/arch/powerpc/platforms/pseries/svm.c +index 87f001b4c4e4f..f12229ce73014 100644 +--- a/arch/powerpc/platforms/pseries/svm.c ++++ b/arch/powerpc/platforms/pseries/svm.c +@@ -56,8 +56,7 @@ void __init svm_swiotlb_init(void) + return; + + +- memblock_free_early(__pa(vstart), +- PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT)); ++ memblock_free(__pa(vstart), PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT)); + panic("SVM: Cannot allocate SWIOTLB buffer"); + } + +diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c +index 48f67a69d119b..5c1fd147591cb 100644 +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -875,7 +875,7 @@ void __init smp_detect_cpus(void) + + /* Add CPUs present at boot */ + __smp_rescan_cpus(info, true); +- memblock_free_early((unsigned long)info, sizeof(*info)); ++ memblock_free((unsigned long)info, sizeof(*info)); + } + + /* +diff --git a/drivers/base/arch_numa.c b/drivers/base/arch_numa.c +index bce0902dccb40..6d4a955847140 100644 +--- a/drivers/base/arch_numa.c ++++ b/drivers/base/arch_numa.c +@@ -165,7 +165,7 @@ static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size, + + static void __init pcpu_fc_free(void *ptr, size_t size) + { +- memblock_free_early(__pa(ptr), size); ++ memblock_free(__pa(ptr), size); + } + + void __init setup_per_cpu_areas(void) +diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c +index f3d5c7f4c13d2..f01d942e1c1df 100644 +--- a/drivers/s390/char/sclp_early.c ++++ b/drivers/s390/char/sclp_early.c +@@ -139,7 +139,7 @@ int __init sclp_early_get_core_info(struct sclp_core_info *info) + } + sclp_fill_core_info(info, sccb); + out: +- memblock_free_early((unsigned long)sccb, length); ++ memblock_free((unsigned long)sccb, length); + return rc; + } + +diff --git a/include/linux/memblock.h b/include/linux/memblock.h +index 307cab05d67ec..41f95cf22cb81 100644 +--- a/include/linux/memblock.h ++++ b/include/linux/memblock.h +@@ -442,18 +442,6 @@ static inline void *memblock_alloc_node(phys_addr_t size, + MEMBLOCK_ALLOC_ACCESSIBLE, nid); + } + +-static inline void memblock_free_early(phys_addr_t base, +- phys_addr_t size) +-{ +- memblock_free(base, size); +-} +- +-static inline void memblock_free_early_nid(phys_addr_t base, +- phys_addr_t size, int nid) +-{ +- memblock_free(base, size); +-} +- + static inline void memblock_free_late(phys_addr_t base, phys_addr_t size) + { + __memblock_free_late(base, size); +diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c +index 5c7ed5d519424..59d44d8f6161d 100644 +--- a/kernel/dma/swiotlb.c ++++ b/kernel/dma/swiotlb.c +@@ -247,7 +247,7 @@ swiotlb_init(int verbose) + return; + + fail_free_mem: +- memblock_free_early(__pa(tlb), bytes); ++ memblock_free(__pa(tlb), bytes); + fail: + pr_warn("Cannot allocate buffer"); + } +diff --git a/lib/cpumask.c b/lib/cpumask.c +index c3c76b8333846..045779446a18d 100644 +--- a/lib/cpumask.c ++++ b/lib/cpumask.c +@@ -188,7 +188,7 @@ EXPORT_SYMBOL(free_cpumask_var); + */ + void __init free_bootmem_cpumask_var(cpumask_var_t mask) + { +- memblock_free_early(__pa(mask), cpumask_size()); ++ memblock_free(__pa(mask), cpumask_size()); + } + #endif + +diff --git a/mm/percpu.c b/mm/percpu.c +index e0a986818903d..f58318cb04c02 100644 +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -2472,7 +2472,7 @@ struct pcpu_alloc_info * __init pcpu_alloc_alloc_info(int nr_groups, + */ + void __init pcpu_free_alloc_info(struct pcpu_alloc_info *ai) + { +- memblock_free_early(__pa(ai), ai->__ai_size); ++ memblock_free(__pa(ai), ai->__ai_size); + } + + /** +@@ -3134,7 +3134,7 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size, + out_free: + pcpu_free_alloc_info(ai); + if (areas) +- memblock_free_early(__pa(areas), areas_size); ++ memblock_free(__pa(areas), areas_size); + return rc; + } + #endif /* BUILD_EMBED_FIRST_CHUNK */ +@@ -3256,7 +3256,7 @@ int __init pcpu_page_first_chunk(size_t reserved_size, + free_fn(page_address(pages[j]), PAGE_SIZE); + rc = -ENOMEM; + out_free_ar: +- memblock_free_early(__pa(pages), pages_size); ++ memblock_free(__pa(pages), pages_size); + pcpu_free_alloc_info(ai); + return rc; + } +@@ -3286,7 +3286,7 @@ static void * __init pcpu_dfl_fc_alloc(unsigned int cpu, size_t size, + + static void __init pcpu_dfl_fc_free(void *ptr, size_t size) + { +- memblock_free_early(__pa(ptr), size); ++ memblock_free(__pa(ptr), size); + } + + void __init setup_per_cpu_areas(void) +diff --git a/mm/sparse.c b/mm/sparse.c +index 27092badd15bd..df9f8459043ef 100644 +--- a/mm/sparse.c ++++ b/mm/sparse.c +@@ -451,7 +451,7 @@ static void *sparsemap_buf_end __meminitdata; + static inline void __meminit sparse_buffer_free(unsigned long size) + { + WARN_ON(!sparsemap_buf || size == 0); +- memblock_free_early(__pa(sparsemap_buf), size); ++ memblock_free(__pa(sparsemap_buf), size); + } + + static void __init sparse_buffer_init(unsigned long size, int nid) +-- +2.39.5 + diff --git a/queue-5.15/memory-add-lpddr2-info-helpers.patch b/queue-5.15/memory-add-lpddr2-info-helpers.patch new file mode 100644 index 0000000000..06a554715d --- /dev/null +++ b/queue-5.15/memory-add-lpddr2-info-helpers.patch @@ -0,0 +1,263 @@ +From 19c81f9396559c40c83e60e06b63e4f216dad747 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Oct 2021 01:46:58 +0300 +Subject: memory: Add LPDDR2-info helpers + +From: Dmitry Osipenko + +[ Upstream commit 38322cf423f69b89b6e0eaad4017ab41cfe45b45 ] + +Add common helpers for reading and parsing standard LPDDR2 configuration +properties. + +Signed-off-by: Dmitry Osipenko +Link: https://lore.kernel.org/r/20211006224659.21434-9-digetx@gmail.com +Signed-off-by: Krzysztof Kozlowski +Stable-dep-of: b9784e5cde1f ("memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()") +Signed-off-by: Sasha Levin +--- + drivers/memory/jedec_ddr.h | 47 ++++++++++++++++++ + drivers/memory/jedec_ddr_data.c | 41 ++++++++++++++++ + drivers/memory/of_memory.c | 87 +++++++++++++++++++++++++++++++++ + drivers/memory/of_memory.h | 9 ++++ + 4 files changed, 184 insertions(+) + +diff --git a/drivers/memory/jedec_ddr.h b/drivers/memory/jedec_ddr.h +index e59ccbd982d02..6cd508478b146 100644 +--- a/drivers/memory/jedec_ddr.h ++++ b/drivers/memory/jedec_ddr.h +@@ -112,6 +112,26 @@ + #define NUM_DDR_ADDR_TABLE_ENTRIES 11 + #define NUM_DDR_TIMING_TABLE_ENTRIES 4 + ++#define LPDDR2_MANID_SAMSUNG 1 ++#define LPDDR2_MANID_QIMONDA 2 ++#define LPDDR2_MANID_ELPIDA 3 ++#define LPDDR2_MANID_ETRON 4 ++#define LPDDR2_MANID_NANYA 5 ++#define LPDDR2_MANID_HYNIX 6 ++#define LPDDR2_MANID_MOSEL 7 ++#define LPDDR2_MANID_WINBOND 8 ++#define LPDDR2_MANID_ESMT 9 ++#define LPDDR2_MANID_SPANSION 11 ++#define LPDDR2_MANID_SST 12 ++#define LPDDR2_MANID_ZMOS 13 ++#define LPDDR2_MANID_INTEL 14 ++#define LPDDR2_MANID_NUMONYX 254 ++#define LPDDR2_MANID_MICRON 255 ++ ++#define LPDDR2_TYPE_S4 0 ++#define LPDDR2_TYPE_S2 1 ++#define LPDDR2_TYPE_NVM 2 ++ + /* Structure for DDR addressing info from the JEDEC spec */ + struct lpddr2_addressing { + u32 num_banks; +@@ -170,6 +190,33 @@ extern const struct lpddr2_timings + lpddr2_jedec_timings[NUM_DDR_TIMING_TABLE_ENTRIES]; + extern const struct lpddr2_min_tck lpddr2_jedec_min_tck; + ++/* Structure of MR8 */ ++union lpddr2_basic_config4 { ++ u32 value; ++ ++ struct { ++ unsigned int arch_type : 2; ++ unsigned int density : 4; ++ unsigned int io_width : 2; ++ } __packed; ++}; ++ ++/* ++ * Structure for information about LPDDR2 chip. All parameters are ++ * matching raw values of standard mode register bitfields or set to ++ * -ENOENT if info unavailable. ++ */ ++struct lpddr2_info { ++ int arch_type; ++ int density; ++ int io_width; ++ int manufacturer_id; ++ int revision_id1; ++ int revision_id2; ++}; ++ ++const char *lpddr2_jedec_manufacturer(unsigned int manufacturer_id); ++ + /* + * Structure for timings for LPDDR3 based on LPDDR2 plus additional fields. + * All parameters are in pico seconds(ps) excluding max_freq, min_freq which +diff --git a/drivers/memory/jedec_ddr_data.c b/drivers/memory/jedec_ddr_data.c +index ed601d813175e..2cca4fa188f92 100644 +--- a/drivers/memory/jedec_ddr_data.c ++++ b/drivers/memory/jedec_ddr_data.c +@@ -131,3 +131,44 @@ const struct lpddr2_min_tck lpddr2_jedec_min_tck = { + .tFAW = 8 + }; + EXPORT_SYMBOL_GPL(lpddr2_jedec_min_tck); ++ ++const char *lpddr2_jedec_manufacturer(unsigned int manufacturer_id) ++{ ++ switch (manufacturer_id) { ++ case LPDDR2_MANID_SAMSUNG: ++ return "Samsung"; ++ case LPDDR2_MANID_QIMONDA: ++ return "Qimonda"; ++ case LPDDR2_MANID_ELPIDA: ++ return "Elpida"; ++ case LPDDR2_MANID_ETRON: ++ return "Etron"; ++ case LPDDR2_MANID_NANYA: ++ return "Nanya"; ++ case LPDDR2_MANID_HYNIX: ++ return "Hynix"; ++ case LPDDR2_MANID_MOSEL: ++ return "Mosel"; ++ case LPDDR2_MANID_WINBOND: ++ return "Winbond"; ++ case LPDDR2_MANID_ESMT: ++ return "ESMT"; ++ case LPDDR2_MANID_SPANSION: ++ return "Spansion"; ++ case LPDDR2_MANID_SST: ++ return "SST"; ++ case LPDDR2_MANID_ZMOS: ++ return "ZMOS"; ++ case LPDDR2_MANID_INTEL: ++ return "Intel"; ++ case LPDDR2_MANID_NUMONYX: ++ return "Numonyx"; ++ case LPDDR2_MANID_MICRON: ++ return "Micron"; ++ default: ++ break; ++ } ++ ++ return "invalid"; ++} ++EXPORT_SYMBOL_GPL(lpddr2_jedec_manufacturer); +diff --git a/drivers/memory/of_memory.c b/drivers/memory/of_memory.c +index 1791614f324b7..755ce416fbbad 100644 +--- a/drivers/memory/of_memory.c ++++ b/drivers/memory/of_memory.c +@@ -300,3 +300,90 @@ const struct lpddr3_timings + return NULL; + } + EXPORT_SYMBOL(of_lpddr3_get_ddr_timings); ++ ++/** ++ * of_lpddr2_get_info() - extracts information about the lpddr2 chip. ++ * @np: Pointer to device tree node containing lpddr2 info ++ * @dev: Device requesting info ++ * ++ * Populates lpddr2_info structure by extracting data from device ++ * tree node. Returns pointer to populated structure. If error ++ * happened while populating, returns NULL. If property is missing ++ * in a device-tree, then the corresponding value is set to -ENOENT. ++ */ ++const struct lpddr2_info ++*of_lpddr2_get_info(struct device_node *np, struct device *dev) ++{ ++ struct lpddr2_info *ret_info, info = {}; ++ struct property *prop; ++ const char *cp; ++ int err; ++ ++ err = of_property_read_u32(np, "revision-id1", &info.revision_id1); ++ if (err) ++ info.revision_id1 = -ENOENT; ++ ++ err = of_property_read_u32(np, "revision-id2", &info.revision_id2); ++ if (err) ++ info.revision_id2 = -ENOENT; ++ ++ err = of_property_read_u32(np, "io-width", &info.io_width); ++ if (err) ++ return NULL; ++ ++ info.io_width = 32 / info.io_width - 1; ++ ++ err = of_property_read_u32(np, "density", &info.density); ++ if (err) ++ return NULL; ++ ++ info.density = ffs(info.density) - 7; ++ ++ if (of_device_is_compatible(np, "jedec,lpddr2-s4")) ++ info.arch_type = LPDDR2_TYPE_S4; ++ else if (of_device_is_compatible(np, "jedec,lpddr2-s2")) ++ info.arch_type = LPDDR2_TYPE_S2; ++ else if (of_device_is_compatible(np, "jedec,lpddr2-nvm")) ++ info.arch_type = LPDDR2_TYPE_NVM; ++ else ++ return NULL; ++ ++ prop = of_find_property(np, "compatible", NULL); ++ for (cp = of_prop_next_string(prop, NULL); cp; ++ cp = of_prop_next_string(prop, cp)) { ++ ++#define OF_LPDDR2_VENDOR_CMP(compat, ID) \ ++ if (!of_compat_cmp(cp, compat ",", strlen(compat ","))) { \ ++ info.manufacturer_id = LPDDR2_MANID_##ID; \ ++ break; \ ++ } ++ ++ OF_LPDDR2_VENDOR_CMP("samsung", SAMSUNG) ++ OF_LPDDR2_VENDOR_CMP("qimonda", QIMONDA) ++ OF_LPDDR2_VENDOR_CMP("elpida", ELPIDA) ++ OF_LPDDR2_VENDOR_CMP("etron", ETRON) ++ OF_LPDDR2_VENDOR_CMP("nanya", NANYA) ++ OF_LPDDR2_VENDOR_CMP("hynix", HYNIX) ++ OF_LPDDR2_VENDOR_CMP("mosel", MOSEL) ++ OF_LPDDR2_VENDOR_CMP("winbond", WINBOND) ++ OF_LPDDR2_VENDOR_CMP("esmt", ESMT) ++ OF_LPDDR2_VENDOR_CMP("spansion", SPANSION) ++ OF_LPDDR2_VENDOR_CMP("sst", SST) ++ OF_LPDDR2_VENDOR_CMP("zmos", ZMOS) ++ OF_LPDDR2_VENDOR_CMP("intel", INTEL) ++ OF_LPDDR2_VENDOR_CMP("numonyx", NUMONYX) ++ OF_LPDDR2_VENDOR_CMP("micron", MICRON) ++ ++#undef OF_LPDDR2_VENDOR_CMP ++ } ++ ++ if (!info.manufacturer_id) ++ info.manufacturer_id = -ENOENT; ++ ++ ret_info = devm_kzalloc(dev, sizeof(*ret_info), GFP_KERNEL); ++ if (ret_info) ++ *ret_info = info; ++ ++ return ret_info; ++} ++EXPORT_SYMBOL(of_lpddr2_get_info); +diff --git a/drivers/memory/of_memory.h b/drivers/memory/of_memory.h +index 4a99b232ab0a8..1c4e47fede8ae 100644 +--- a/drivers/memory/of_memory.h ++++ b/drivers/memory/of_memory.h +@@ -20,6 +20,9 @@ const struct lpddr3_min_tck *of_lpddr3_get_min_tck(struct device_node *np, + const struct lpddr3_timings * + of_lpddr3_get_ddr_timings(struct device_node *np_ddr, + struct device *dev, u32 device_type, u32 *nr_frequencies); ++ ++const struct lpddr2_info *of_lpddr2_get_info(struct device_node *np, ++ struct device *dev); + #else + static inline const struct lpddr2_min_tck + *of_get_min_tck(struct device_node *np, struct device *dev) +@@ -46,6 +49,12 @@ static inline const struct lpddr3_timings + { + return NULL; + } ++ ++static inline const struct lpddr2_info ++ *of_lpddr2_get_info(struct device_node *np, struct device *dev) ++{ ++ return NULL; ++} + #endif /* CONFIG_OF && CONFIG_DDR */ + + #endif /* __LINUX_MEMORY_OF_REG_ */ +-- +2.39.5 + diff --git a/queue-5.15/memory-tegra20-emc-fix-an-of-node-reference-bug-in-t.patch b/queue-5.15/memory-tegra20-emc-fix-an-of-node-reference-bug-in-t.patch new file mode 100644 index 0000000000..588c10fa44 --- /dev/null +++ b/queue-5.15/memory-tegra20-emc-fix-an-of-node-reference-bug-in-t.patch @@ -0,0 +1,67 @@ +From b93c8f9f0f0f82d39bd08f5850df342b314b36e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 18:14:34 +0900 +Subject: memory: tegra20-emc: fix an OF node reference bug in + tegra_emc_find_node_by_ram_code() + +From: Joe Hattori + +[ Upstream commit b9784e5cde1f9fb83661a70e580e381ae1264d12 ] + +As of_find_node_by_name() release the reference of the argument device +node, tegra_emc_find_node_by_ram_code() releases some device nodes while +still in use, resulting in possible UAFs. According to the bindings and +the in-tree DTS files, the "emc-tables" node is always device's child +node with the property "nvidia,use-ram-code", and the "lpddr2" node is a +child of the "emc-tables" node. Thus utilize the +for_each_child_of_node() macro and of_get_child_by_name() instead of +of_find_node_by_name() to simplify the code. + +This bug was found by an experimental verification tool that I am +developing. + +Fixes: 96e5da7c8424 ("memory: tegra: Introduce Tegra20 EMC driver") +Signed-off-by: Joe Hattori +Link: https://lore.kernel.org/r/20241217091434.1993597-1-joe@pf.is.s.u-tokyo.ac.jp +Link: https://lore.kernel.org/r/20241218024415.2494267-3-joe@pf.is.s.u-tokyo.ac.jp +[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts] +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/tegra/tegra20-emc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/memory/tegra/tegra20-emc.c b/drivers/memory/tegra/tegra20-emc.c +index 497b6edbf3ca1..2ac074b96f859 100644 +--- a/drivers/memory/tegra/tegra20-emc.c ++++ b/drivers/memory/tegra/tegra20-emc.c +@@ -477,14 +477,15 @@ tegra_emc_find_node_by_ram_code(struct tegra_emc *emc) + + ram_code = tegra_read_ram_code(); + +- for (np = of_find_node_by_name(dev->of_node, "emc-tables"); np; +- np = of_find_node_by_name(np, "emc-tables")) { ++ for_each_child_of_node(dev->of_node, np) { ++ if (!of_node_name_eq(np, "emc-tables")) ++ continue; + err = of_property_read_u32(np, "nvidia,ram-code", &value); + if (err || value != ram_code) { + struct device_node *lpddr2_np; + bool cfg_mismatches = false; + +- lpddr2_np = of_find_node_by_name(np, "lpddr2"); ++ lpddr2_np = of_get_child_by_name(np, "lpddr2"); + if (lpddr2_np) { + const struct lpddr2_info *info; + +@@ -521,7 +522,6 @@ tegra_emc_find_node_by_ram_code(struct tegra_emc *emc) + } + + if (cfg_mismatches) { +- of_node_put(np); + continue; + } + } +-- +2.39.5 + diff --git a/queue-5.15/memory-tegra20-emc-support-matching-timings-by-lpddr.patch b/queue-5.15/memory-tegra20-emc-support-matching-timings-by-lpddr.patch new file mode 100644 index 0000000000..75d13ccfc7 --- /dev/null +++ b/queue-5.15/memory-tegra20-emc-support-matching-timings-by-lpddr.patch @@ -0,0 +1,358 @@ +From a3d8d7d279f0d5d8ea4b32ecd2f1e58afbf93f9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Oct 2021 01:46:59 +0300 +Subject: memory: tegra20-emc: Support matching timings by LPDDR2 configuration + +From: Dmitry Osipenko + +[ Upstream commit 131dd9a436d8f6dbaf3d9597803765d271b2fc19 ] + +ASUS Transformer TF101 doesn't provide RAM code and in this case memory +timings should be selected based on identity information read out from +SDRAM chip. Support matching timings by LPDDR2 configuration. + +Signed-off-by: Dmitry Osipenko +Link: https://lore.kernel.org/r/20211006224659.21434-10-digetx@gmail.com +Signed-off-by: Krzysztof Kozlowski +Stable-dep-of: b9784e5cde1f ("memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()") +Signed-off-by: Sasha Levin +--- + drivers/memory/tegra/Kconfig | 1 + + drivers/memory/tegra/tegra20-emc.c | 199 +++++++++++++++++++++++++++-- + 2 files changed, 186 insertions(+), 14 deletions(-) + +diff --git a/drivers/memory/tegra/Kconfig b/drivers/memory/tegra/Kconfig +index f9bae36c03a39..7951764b4efec 100644 +--- a/drivers/memory/tegra/Kconfig ++++ b/drivers/memory/tegra/Kconfig +@@ -16,6 +16,7 @@ config TEGRA20_EMC + depends on ARCH_TEGRA_2x_SOC || COMPILE_TEST + select DEVFREQ_GOV_SIMPLE_ONDEMAND + select PM_DEVFREQ ++ select DDR + help + This driver is for the External Memory Controller (EMC) found on + Tegra20 chips. The EMC controls the external DRAM on the board. +diff --git a/drivers/memory/tegra/tegra20-emc.c b/drivers/memory/tegra/tegra20-emc.c +index 6fc90f2160e93..497b6edbf3ca1 100644 +--- a/drivers/memory/tegra/tegra20-emc.c ++++ b/drivers/memory/tegra/tegra20-emc.c +@@ -5,6 +5,7 @@ + * Author: Dmitry Osipenko + */ + ++#include + #include + #include + #include +@@ -27,11 +28,15 @@ + #include + #include + ++#include "../jedec_ddr.h" ++#include "../of_memory.h" ++ + #include "mc.h" + + #define EMC_INTSTATUS 0x000 + #define EMC_INTMASK 0x004 + #define EMC_DBG 0x008 ++#define EMC_ADR_CFG_0 0x010 + #define EMC_TIMING_CONTROL 0x028 + #define EMC_RC 0x02c + #define EMC_RFC 0x030 +@@ -68,6 +73,7 @@ + #define EMC_QUSE_EXTRA 0x0ac + #define EMC_ODT_WRITE 0x0b0 + #define EMC_ODT_READ 0x0b4 ++#define EMC_MRR 0x0ec + #define EMC_FBIO_CFG5 0x104 + #define EMC_FBIO_CFG6 0x114 + #define EMC_STAT_CONTROL 0x160 +@@ -94,6 +100,7 @@ + + #define EMC_REFRESH_OVERFLOW_INT BIT(3) + #define EMC_CLKCHANGE_COMPLETE_INT BIT(4) ++#define EMC_MRR_DIVLD_INT BIT(5) + + #define EMC_DBG_READ_MUX_ASSEMBLY BIT(0) + #define EMC_DBG_WRITE_MUX_ACTIVE BIT(1) +@@ -102,11 +109,25 @@ + #define EMC_DBG_CFG_PRIORITY BIT(24) + + #define EMC_FBIO_CFG5_DRAM_WIDTH_X16 BIT(4) ++#define EMC_FBIO_CFG5_DRAM_TYPE GENMASK(1, 0) ++ ++#define EMC_MRR_DEV_SELECTN GENMASK(31, 30) ++#define EMC_MRR_MRR_MA GENMASK(23, 16) ++#define EMC_MRR_MRR_DATA GENMASK(15, 0) ++ ++#define EMC_ADR_CFG_0_EMEM_NUMDEV GENMASK(25, 24) + + #define EMC_PWR_GATHER_CLEAR (1 << 8) + #define EMC_PWR_GATHER_DISABLE (2 << 8) + #define EMC_PWR_GATHER_ENABLE (3 << 8) + ++enum emc_dram_type { ++ DRAM_TYPE_RESERVED, ++ DRAM_TYPE_DDR1, ++ DRAM_TYPE_LPDDR2, ++ DRAM_TYPE_DDR2, ++}; ++ + static const u16 emc_timing_registers[] = { + EMC_RC, + EMC_RFC, +@@ -201,6 +222,14 @@ struct tegra_emc { + struct mutex rate_lock; + + struct devfreq_simple_ondemand_data ondemand_data; ++ ++ /* memory chip identity information */ ++ union lpddr2_basic_config4 basic_conf4; ++ unsigned int manufacturer_id; ++ unsigned int revision_id1; ++ unsigned int revision_id2; ++ ++ bool mrr_error; + }; + + static irqreturn_t tegra_emc_isr(int irq, void *data) +@@ -397,15 +426,19 @@ static int tegra_emc_load_timings_from_dt(struct tegra_emc *emc, + if (!emc->timings) + return -ENOMEM; + +- emc->num_timings = child_count; + timing = emc->timings; + + for_each_child_of_node(node, child) { ++ if (of_node_name_eq(child, "lpddr2")) ++ continue; ++ + err = load_one_timing_from_dt(emc, timing++, child); + if (err) { + of_node_put(child); + return err; + } ++ ++ emc->num_timings++; + } + + sort(emc->timings, emc->num_timings, sizeof(*timing), cmp_timings, +@@ -422,12 +455,18 @@ static int tegra_emc_load_timings_from_dt(struct tegra_emc *emc, + } + + static struct device_node * +-tegra_emc_find_node_by_ram_code(struct device *dev) ++tegra_emc_find_node_by_ram_code(struct tegra_emc *emc) + { ++ struct device *dev = emc->dev; + struct device_node *np; + u32 value, ram_code; + int err; + ++ if (emc->mrr_error) { ++ dev_warn(dev, "memory timings skipped due to MRR error\n"); ++ return NULL; ++ } ++ + if (of_get_child_count(dev->of_node) == 0) { + dev_info_once(dev, "device-tree doesn't have memory timings\n"); + return NULL; +@@ -442,8 +481,49 @@ tegra_emc_find_node_by_ram_code(struct device *dev) + np = of_find_node_by_name(np, "emc-tables")) { + err = of_property_read_u32(np, "nvidia,ram-code", &value); + if (err || value != ram_code) { +- of_node_put(np); +- continue; ++ struct device_node *lpddr2_np; ++ bool cfg_mismatches = false; ++ ++ lpddr2_np = of_find_node_by_name(np, "lpddr2"); ++ if (lpddr2_np) { ++ const struct lpddr2_info *info; ++ ++ info = of_lpddr2_get_info(lpddr2_np, dev); ++ if (info) { ++ if (info->manufacturer_id >= 0 && ++ info->manufacturer_id != emc->manufacturer_id) ++ cfg_mismatches = true; ++ ++ if (info->revision_id1 >= 0 && ++ info->revision_id1 != emc->revision_id1) ++ cfg_mismatches = true; ++ ++ if (info->revision_id2 >= 0 && ++ info->revision_id2 != emc->revision_id2) ++ cfg_mismatches = true; ++ ++ if (info->density != emc->basic_conf4.density) ++ cfg_mismatches = true; ++ ++ if (info->io_width != emc->basic_conf4.io_width) ++ cfg_mismatches = true; ++ ++ if (info->arch_type != emc->basic_conf4.arch_type) ++ cfg_mismatches = true; ++ } else { ++ dev_err(dev, "failed to parse %pOF\n", lpddr2_np); ++ cfg_mismatches = true; ++ } ++ ++ of_node_put(lpddr2_np); ++ } else { ++ cfg_mismatches = true; ++ } ++ ++ if (cfg_mismatches) { ++ of_node_put(np); ++ continue; ++ } + } + + return np; +@@ -455,10 +535,72 @@ tegra_emc_find_node_by_ram_code(struct device *dev) + return NULL; + } + ++static int emc_read_lpddr_mode_register(struct tegra_emc *emc, ++ unsigned int emem_dev, ++ unsigned int register_addr, ++ unsigned int *register_data) ++{ ++ u32 memory_dev = emem_dev + 1; ++ u32 val, mr_mask = 0xff; ++ int err; ++ ++ /* clear data-valid interrupt status */ ++ writel_relaxed(EMC_MRR_DIVLD_INT, emc->regs + EMC_INTSTATUS); ++ ++ /* issue mode register read request */ ++ val = FIELD_PREP(EMC_MRR_DEV_SELECTN, memory_dev); ++ val |= FIELD_PREP(EMC_MRR_MRR_MA, register_addr); ++ ++ writel_relaxed(val, emc->regs + EMC_MRR); ++ ++ /* wait for the LPDDR2 data-valid interrupt */ ++ err = readl_relaxed_poll_timeout_atomic(emc->regs + EMC_INTSTATUS, val, ++ val & EMC_MRR_DIVLD_INT, ++ 1, 100); ++ if (err) { ++ dev_err(emc->dev, "mode register %u read failed: %d\n", ++ register_addr, err); ++ emc->mrr_error = true; ++ return err; ++ } ++ ++ /* read out mode register data */ ++ val = readl_relaxed(emc->regs + EMC_MRR); ++ *register_data = FIELD_GET(EMC_MRR_MRR_DATA, val) & mr_mask; ++ ++ return 0; ++} ++ ++static void emc_read_lpddr_sdram_info(struct tegra_emc *emc, ++ unsigned int emem_dev, ++ bool print_out) ++{ ++ /* these registers are standard for all LPDDR JEDEC memory chips */ ++ emc_read_lpddr_mode_register(emc, emem_dev, 5, &emc->manufacturer_id); ++ emc_read_lpddr_mode_register(emc, emem_dev, 6, &emc->revision_id1); ++ emc_read_lpddr_mode_register(emc, emem_dev, 7, &emc->revision_id2); ++ emc_read_lpddr_mode_register(emc, emem_dev, 8, &emc->basic_conf4.value); ++ ++ if (!print_out) ++ return; ++ ++ dev_info(emc->dev, "SDRAM[dev%u]: manufacturer: 0x%x (%s) rev1: 0x%x rev2: 0x%x prefetch: S%u density: %uMbit iowidth: %ubit\n", ++ emem_dev, emc->manufacturer_id, ++ lpddr2_jedec_manufacturer(emc->manufacturer_id), ++ emc->revision_id1, emc->revision_id2, ++ 4 >> emc->basic_conf4.arch_type, ++ 64 << emc->basic_conf4.density, ++ 32 >> emc->basic_conf4.io_width); ++} ++ + static int emc_setup_hw(struct tegra_emc *emc) + { ++ u32 emc_cfg, emc_dbg, emc_fbio, emc_adr_cfg; + u32 intmask = EMC_REFRESH_OVERFLOW_INT; +- u32 emc_cfg, emc_dbg, emc_fbio; ++ static bool print_sdram_info_once; ++ enum emc_dram_type dram_type; ++ const char *dram_type_str; ++ unsigned int emem_numdev; + + emc_cfg = readl_relaxed(emc->regs + EMC_CFG_2); + +@@ -496,7 +638,36 @@ static int emc_setup_hw(struct tegra_emc *emc) + else + emc->dram_bus_width = 32; + +- dev_info_once(emc->dev, "%ubit DRAM bus\n", emc->dram_bus_width); ++ dram_type = FIELD_GET(EMC_FBIO_CFG5_DRAM_TYPE, emc_fbio); ++ ++ switch (dram_type) { ++ case DRAM_TYPE_RESERVED: ++ dram_type_str = "INVALID"; ++ break; ++ case DRAM_TYPE_DDR1: ++ dram_type_str = "DDR1"; ++ break; ++ case DRAM_TYPE_LPDDR2: ++ dram_type_str = "LPDDR2"; ++ break; ++ case DRAM_TYPE_DDR2: ++ dram_type_str = "DDR2"; ++ break; ++ } ++ ++ emc_adr_cfg = readl_relaxed(emc->regs + EMC_ADR_CFG_0); ++ emem_numdev = FIELD_GET(EMC_ADR_CFG_0_EMEM_NUMDEV, emc_adr_cfg) + 1; ++ ++ dev_info_once(emc->dev, "%ubit DRAM bus, %u %s %s attached\n", ++ emc->dram_bus_width, emem_numdev, dram_type_str, ++ emem_numdev == 2 ? "devices" : "device"); ++ ++ if (dram_type == DRAM_TYPE_LPDDR2) { ++ while (emem_numdev--) ++ emc_read_lpddr_sdram_info(emc, emem_numdev, ++ !print_sdram_info_once); ++ print_sdram_info_once = true; ++ } + + return 0; + } +@@ -1049,14 +1220,6 @@ static int tegra_emc_probe(struct platform_device *pdev) + emc->clk_nb.notifier_call = tegra_emc_clk_change_notify; + emc->dev = &pdev->dev; + +- np = tegra_emc_find_node_by_ram_code(&pdev->dev); +- if (np) { +- err = tegra_emc_load_timings_from_dt(emc, np); +- of_node_put(np); +- if (err) +- return err; +- } +- + emc->regs = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(emc->regs)) + return PTR_ERR(emc->regs); +@@ -1065,6 +1228,14 @@ static int tegra_emc_probe(struct platform_device *pdev) + if (err) + return err; + ++ np = tegra_emc_find_node_by_ram_code(emc); ++ if (np) { ++ err = tegra_emc_load_timings_from_dt(emc, np); ++ of_node_put(np); ++ if (err) ++ return err; ++ } ++ + err = devm_request_irq(&pdev->dev, irq, tegra_emc_isr, 0, + dev_name(&pdev->dev), emc); + if (err) { +-- +2.39.5 + diff --git a/queue-5.15/module-extend-the-preempt-disabled-section-in-derefe.patch b/queue-5.15/module-extend-the-preempt-disabled-section-in-derefe.patch new file mode 100644 index 0000000000..9036b273cd --- /dev/null +++ b/queue-5.15/module-extend-the-preempt-disabled-section-in-derefe.patch @@ -0,0 +1,59 @@ +From 0f0d3194c129eb7865ab3275f92e72fe86e10bf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 10:04:30 +0100 +Subject: module: Extend the preempt disabled section in + dereference_symbol_descriptor(). + +From: Sebastian Andrzej Siewior + +[ Upstream commit a145c848d69f9c6f32008d8319edaa133360dd74 ] + +dereference_symbol_descriptor() needs to obtain the module pointer +belonging to pointer in order to resolve that pointer. +The returned mod pointer is obtained under RCU-sched/ preempt_disable() +guarantees and needs to be used within this section to ensure that the +module is not removed in the meantime. + +Extend the preempt_disable() section to also cover +dereference_module_function_descriptor(). + +Fixes: 04b8eb7a4ccd9 ("symbol lookup: introduce dereference_symbol_descriptor()") +Cc: James E.J. Bottomley +Cc: Christophe Leroy +Cc: Helge Deller +Cc: Madhavan Srinivasan +Cc: Michael Ellerman +Cc: Naveen N Rao +Cc: Nicholas Piggin +Cc: Sergey Senozhatsky +Cc: linux-parisc@vger.kernel.org +Cc: linuxppc-dev@lists.ozlabs.org +Reviewed-by: Sergey Senozhatsky +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/20250108090457.512198-2-bigeasy@linutronix.de +Signed-off-by: Petr Pavlu +Signed-off-by: Sasha Levin +--- + include/linux/kallsyms.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h +index eae9f423bd648..0f73f69e64035 100644 +--- a/include/linux/kallsyms.h ++++ b/include/linux/kallsyms.h +@@ -66,10 +66,10 @@ static inline void *dereference_symbol_descriptor(void *ptr) + + preempt_disable(); + mod = __module_address((unsigned long)ptr); +- preempt_enable(); + + if (mod) + ptr = dereference_module_function_descriptor(mod, ptr); ++ preempt_enable(); + #endif + return ptr; + } +-- +2.39.5 + diff --git a/queue-5.15/mtd-hyperbus-hbmc-am654-convert-to-platform-remove-c.patch b/queue-5.15/mtd-hyperbus-hbmc-am654-convert-to-platform-remove-c.patch new file mode 100644 index 0000000000..87a075e525 --- /dev/null +++ b/queue-5.15/mtd-hyperbus-hbmc-am654-convert-to-platform-remove-c.patch @@ -0,0 +1,70 @@ +From 6307f5c9197653c138c512078211fd7fc7737b71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Oct 2023 22:01:32 +0200 +Subject: mtd: hyperbus: hbmc-am654: Convert to platform remove callback + returning void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 59bd56760df17506bc2f828f19b40a2243edd0d0 ] + +The .remove() callback for a platform driver returns an int which makes +many driver authors wrongly assume it's possible to do error handling by +returning an error code. However the value returned is ignored (apart +from emitting a warning) and this typically results in resource leaks. + +To improve here there is a quest to make the remove callback return +void. In the first step of this quest all drivers are converted to +.remove_new(), which already returns void. Eventually after all drivers +are converted, .remove_new() will be renamed to .remove(). + +Trivially convert this driver from always returning zero in the remove +callback to the void returning variant. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Miquel Raynal +Acked-by: Tudor Ambarus +Link: https://lore.kernel.org/linux-mtd/20231008200143.196369-10-u.kleine-koenig@pengutronix.de +Stable-dep-of: bf5821909eb9 ("mtd: hyperbus: hbmc-am654: fix an OF node reference leak") +Signed-off-by: Sasha Levin +--- + drivers/mtd/hyperbus/hbmc-am654.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/mtd/hyperbus/hbmc-am654.c b/drivers/mtd/hyperbus/hbmc-am654.c +index a6161ce340d4e..dbe3eb361cca2 100644 +--- a/drivers/mtd/hyperbus/hbmc-am654.c ++++ b/drivers/mtd/hyperbus/hbmc-am654.c +@@ -229,7 +229,7 @@ static int am654_hbmc_probe(struct platform_device *pdev) + return ret; + } + +-static int am654_hbmc_remove(struct platform_device *pdev) ++static void am654_hbmc_remove(struct platform_device *pdev) + { + struct am654_hbmc_priv *priv = platform_get_drvdata(pdev); + struct am654_hbmc_device_priv *dev_priv = priv->hbdev.priv; +@@ -241,8 +241,6 @@ static int am654_hbmc_remove(struct platform_device *pdev) + + if (dev_priv->rx_chan) + dma_release_channel(dev_priv->rx_chan); +- +- return 0; + } + + static const struct of_device_id am654_hbmc_dt_ids[] = { +@@ -256,7 +254,7 @@ MODULE_DEVICE_TABLE(of, am654_hbmc_dt_ids); + + static struct platform_driver am654_hbmc_platform_driver = { + .probe = am654_hbmc_probe, +- .remove = am654_hbmc_remove, ++ .remove_new = am654_hbmc_remove, + .driver = { + .name = "hbmc-am654", + .of_match_table = am654_hbmc_dt_ids, +-- +2.39.5 + diff --git a/queue-5.15/mtd-hyperbus-hbmc-am654-fix-an-of-node-reference-lea.patch b/queue-5.15/mtd-hyperbus-hbmc-am654-fix-an-of-node-reference-lea.patch new file mode 100644 index 0000000000..ff73f4a6a7 --- /dev/null +++ b/queue-5.15/mtd-hyperbus-hbmc-am654-fix-an-of-node-reference-lea.patch @@ -0,0 +1,82 @@ +From 35679a37b2d8f636c20fe92507c70a558c0d60a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 22:38:09 +0900 +Subject: mtd: hyperbus: hbmc-am654: fix an OF node reference leak + +From: Joe Hattori + +[ Upstream commit bf5821909eb9c7f5d07d5c6e852ead2c373c94a0 ] + +In am654_hbmc_platform_driver, .remove() and the error path of .probe() +do not decrement the refcount of an OF node obtained by + of_get_next_child(). Fix this by adding of_node_put() calls. + +Fixes: aca31ce96814 ("mtd: hyperbus: hbmc-am654: Fix direct mapping setup flash access") +Signed-off-by: Joe Hattori +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/hyperbus/hbmc-am654.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/mtd/hyperbus/hbmc-am654.c b/drivers/mtd/hyperbus/hbmc-am654.c +index dbe3eb361cca2..4b6cbee23fe89 100644 +--- a/drivers/mtd/hyperbus/hbmc-am654.c ++++ b/drivers/mtd/hyperbus/hbmc-am654.c +@@ -174,26 +174,30 @@ static int am654_hbmc_probe(struct platform_device *pdev) + priv->hbdev.np = of_get_next_child(np, NULL); + ret = of_address_to_resource(priv->hbdev.np, 0, &res); + if (ret) +- return ret; ++ goto put_node; + + if (of_property_read_bool(dev->of_node, "mux-controls")) { + struct mux_control *control = devm_mux_control_get(dev, NULL); + +- if (IS_ERR(control)) +- return PTR_ERR(control); ++ if (IS_ERR(control)) { ++ ret = PTR_ERR(control); ++ goto put_node; ++ } + + ret = mux_control_select(control, 1); + if (ret) { + dev_err(dev, "Failed to select HBMC mux\n"); +- return ret; ++ goto put_node; + } + priv->mux_ctrl = control; + } + + priv->hbdev.map.size = resource_size(&res); + priv->hbdev.map.virt = devm_ioremap_resource(dev, &res); +- if (IS_ERR(priv->hbdev.map.virt)) +- return PTR_ERR(priv->hbdev.map.virt); ++ if (IS_ERR(priv->hbdev.map.virt)) { ++ ret = PTR_ERR(priv->hbdev.map.virt); ++ goto disable_mux; ++ } + + priv->ctlr.dev = dev; + priv->ctlr.ops = &am654_hbmc_ops; +@@ -226,6 +230,8 @@ static int am654_hbmc_probe(struct platform_device *pdev) + disable_mux: + if (priv->mux_ctrl) + mux_control_deselect(priv->mux_ctrl); ++put_node: ++ of_node_put(priv->hbdev.np); + return ret; + } + +@@ -241,6 +247,7 @@ static void am654_hbmc_remove(struct platform_device *pdev) + + if (dev_priv->rx_chan) + dma_release_channel(dev_priv->rx_chan); ++ of_node_put(priv->hbdev.np); + } + + static const struct of_device_id am654_hbmc_dt_ids[] = { +-- +2.39.5 + diff --git a/queue-5.15/mtd-hyperbus-make-hyperbus_unregister_device-return-.patch b/queue-5.15/mtd-hyperbus-make-hyperbus_unregister_device-return-.patch new file mode 100644 index 0000000000..860e272429 --- /dev/null +++ b/queue-5.15/mtd-hyperbus-make-hyperbus_unregister_device-return-.patch @@ -0,0 +1,117 @@ +From 268f167d905c272df44296cab355bfb8043b9948 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 23:07:45 +0200 +Subject: mtd: hyperbus: Make hyperbus_unregister_device() return void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 0c90466a7985d39355f743e9cd2139da3e86c4d8 ] + +The only thing that could theoretically fail in that function is +mtd_device_unregister(). However it's not supposed to fail and when +used correctly it doesn't. So wail loudly if it does anyhow. + +This matches how other drivers (e.g. nand/raw/nandsim.c) use +mtd_device_unregister(). + +This is a preparation for making platform remove callbacks return void. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220603210758.148493-2-u.kleine-koenig@pengutronix.de +Stable-dep-of: bf5821909eb9 ("mtd: hyperbus: hbmc-am654: fix an OF node reference leak") +Signed-off-by: Sasha Levin +--- + drivers/mtd/hyperbus/hbmc-am654.c | 6 +++--- + drivers/mtd/hyperbus/hyperbus-core.c | 8 ++------ + drivers/mtd/hyperbus/rpc-if.c | 5 +++-- + include/linux/mtd/hyperbus.h | 4 +--- + 4 files changed, 9 insertions(+), 14 deletions(-) + +diff --git a/drivers/mtd/hyperbus/hbmc-am654.c b/drivers/mtd/hyperbus/hbmc-am654.c +index a3439b791eeb4..a6161ce340d4e 100644 +--- a/drivers/mtd/hyperbus/hbmc-am654.c ++++ b/drivers/mtd/hyperbus/hbmc-am654.c +@@ -233,16 +233,16 @@ static int am654_hbmc_remove(struct platform_device *pdev) + { + struct am654_hbmc_priv *priv = platform_get_drvdata(pdev); + struct am654_hbmc_device_priv *dev_priv = priv->hbdev.priv; +- int ret; + +- ret = hyperbus_unregister_device(&priv->hbdev); ++ hyperbus_unregister_device(&priv->hbdev); ++ + if (priv->mux_ctrl) + mux_control_deselect(priv->mux_ctrl); + + if (dev_priv->rx_chan) + dma_release_channel(dev_priv->rx_chan); + +- return ret; ++ return 0; + } + + static const struct of_device_id am654_hbmc_dt_ids[] = { +diff --git a/drivers/mtd/hyperbus/hyperbus-core.c b/drivers/mtd/hyperbus/hyperbus-core.c +index 2f9fc4e17d53e..4d8047d43e48e 100644 +--- a/drivers/mtd/hyperbus/hyperbus-core.c ++++ b/drivers/mtd/hyperbus/hyperbus-core.c +@@ -126,16 +126,12 @@ int hyperbus_register_device(struct hyperbus_device *hbdev) + } + EXPORT_SYMBOL_GPL(hyperbus_register_device); + +-int hyperbus_unregister_device(struct hyperbus_device *hbdev) ++void hyperbus_unregister_device(struct hyperbus_device *hbdev) + { +- int ret = 0; +- + if (hbdev && hbdev->mtd) { +- ret = mtd_device_unregister(hbdev->mtd); ++ WARN_ON(mtd_device_unregister(hbdev->mtd)); + map_destroy(hbdev->mtd); + } +- +- return ret; + } + EXPORT_SYMBOL_GPL(hyperbus_unregister_device); + +diff --git a/drivers/mtd/hyperbus/rpc-if.c b/drivers/mtd/hyperbus/rpc-if.c +index dc164c18f8429..cd0e577684ff0 100644 +--- a/drivers/mtd/hyperbus/rpc-if.c ++++ b/drivers/mtd/hyperbus/rpc-if.c +@@ -151,11 +151,12 @@ static int rpcif_hb_probe(struct platform_device *pdev) + static int rpcif_hb_remove(struct platform_device *pdev) + { + struct rpcif_hyperbus *hyperbus = platform_get_drvdata(pdev); +- int error = hyperbus_unregister_device(&hyperbus->hbdev); ++ ++ hyperbus_unregister_device(&hyperbus->hbdev); + + rpcif_disable_rpm(&hyperbus->rpc); + +- return error; ++ return 0; + } + + static struct platform_driver rpcif_platform_driver = { +diff --git a/include/linux/mtd/hyperbus.h b/include/linux/mtd/hyperbus.h +index 0ce612428aea2..bb6b7121a5427 100644 +--- a/include/linux/mtd/hyperbus.h ++++ b/include/linux/mtd/hyperbus.h +@@ -89,9 +89,7 @@ int hyperbus_register_device(struct hyperbus_device *hbdev); + /** + * hyperbus_unregister_device - deregister HyperBus slave memory device + * @hbdev: hyperbus_device to be unregistered +- * +- * Return: 0 for success, others for failure. + */ +-int hyperbus_unregister_device(struct hyperbus_device *hbdev); ++void hyperbus_unregister_device(struct hyperbus_device *hbdev); + + #endif /* __LINUX_MTD_HYPERBUS_H__ */ +-- +2.39.5 + diff --git a/queue-5.15/nbd-don-t-allow-reconnect-after-disconnect.patch b/queue-5.15/nbd-don-t-allow-reconnect-after-disconnect.patch new file mode 100644 index 0000000000..1952080eb7 --- /dev/null +++ b/queue-5.15/nbd-don-t-allow-reconnect-after-disconnect.patch @@ -0,0 +1,75 @@ +From eb83d9ddb4942b4469d1cc4a4c5ab68d97ab6113 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jan 2025 17:28:59 +0800 +Subject: nbd: don't allow reconnect after disconnect + +From: Yu Kuai + +[ Upstream commit 844b8cdc681612ff24df62cdefddeab5772fadf1 ] + +Following process can cause nbd_config UAF: + +1) grab nbd_config temporarily; + +2) nbd_genl_disconnect() flush all recv_work() and release the +initial reference: + + nbd_genl_disconnect + nbd_disconnect_and_put + nbd_disconnect + flush_workqueue(nbd->recv_workq) + if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) + nbd_config_put + -> due to step 1), reference is still not zero + +3) nbd_genl_reconfigure() queue recv_work() again; + + nbd_genl_reconfigure + config = nbd_get_config_unlocked(nbd) + if (!config) + -> succeed + if (!test_bit(NBD_RT_BOUND, ...)) + -> succeed + nbd_reconnect_socket + queue_work(nbd->recv_workq, &args->work) + +4) step 1) release the reference; + +5) Finially, recv_work() will trigger UAF: + + recv_work + nbd_config_put(nbd) + -> nbd_config is freed + atomic_dec(&config->recv_threads) + -> UAF + +Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so +that nbd_genl_reconfigure() will fail. + +Fixes: b7aa3d39385d ("nbd: add a reconfigure netlink command") +Reported-by: syzbot+6b0df248918b92c33e6a@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/675bfb65.050a0220.1a2d0d.0006.GAE@google.com/ +Signed-off-by: Yu Kuai +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20250103092859.3574648-1-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index d12e9f1721c8e..1b04fd7c6b98a 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -2055,6 +2055,7 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd) + flush_workqueue(nbd->recv_workq); + nbd_clear_que(nbd); + nbd->task_setup = NULL; ++ clear_bit(NBD_RT_BOUND, &nbd->config->runtime_flags); + mutex_unlock(&nbd->config_lock); + + if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, +-- +2.39.5 + diff --git a/queue-5.15/net-avoid-race-between-device-unregistration-and-eth.patch b/queue-5.15/net-avoid-race-between-device-unregistration-and-eth.patch new file mode 100644 index 0000000000..237337a04f --- /dev/null +++ b/queue-5.15/net-avoid-race-between-device-unregistration-and-eth.patch @@ -0,0 +1,73 @@ +From 7102d1a032afd5d19d86feb196c9def6e081d177 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 10:21:57 +0100 +Subject: net: avoid race between device unregistration and ethnl ops + +From: Antoine Tenart + +[ Upstream commit 12e070eb6964b341b41677fd260af5a305316a1f ] + +The following trace can be seen if a device is being unregistered while +its number of channels are being modified. + + DEBUG_LOCKS_WARN_ON(lock->magic != lock) + WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120 + CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771 + RIP: 0010:__mutex_lock+0xc8a/0x1120 + Call Trace: + + ethtool_check_max_channel+0x1ea/0x880 + ethnl_set_channels+0x3c3/0xb10 + ethnl_default_set_doit+0x306/0x650 + genl_family_rcv_msg_doit+0x1e3/0x2c0 + genl_rcv_msg+0x432/0x6f0 + netlink_rcv_skb+0x13d/0x3b0 + genl_rcv+0x28/0x40 + netlink_unicast+0x42e/0x720 + netlink_sendmsg+0x765/0xc20 + __sys_sendto+0x3ac/0x420 + __x64_sys_sendto+0xe0/0x1c0 + do_syscall_64+0x95/0x180 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +This is because unregister_netdevice_many_notify might run before the +rtnl lock section of ethnl operations, eg. set_channels in the above +example. In this example the rss lock would be destroyed by the device +unregistration path before being used again, but in general running +ethnl operations while dismantle has started is not a good idea. + +Fix this by denying any operation on devices being unregistered. A check +was already there in ethnl_ops_begin, but not wide enough. + +Note that the same issue cannot be seen on the ioctl version +(__dev_ethtool) because the device reference is retrieved from within +the rtnl lock section there. Once dismantle started, the net device is +unlisted and no reference will be found. + +Fixes: dde91ccfa25f ("ethtool: do not perform operations on net devices being unregistered") +Signed-off-by: Antoine Tenart +Reviewed-by: Przemek Kitszel +Reviewed-by: Edward Cree +Link: https://patch.msgid.link/20250116092159.50890-1-atenart@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ethtool/netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ethtool/netlink.c b/net/ethtool/netlink.c +index b3729bdafb602..0ffcd0e873b60 100644 +--- a/net/ethtool/netlink.c ++++ b/net/ethtool/netlink.c +@@ -41,7 +41,7 @@ int ethnl_ops_begin(struct net_device *dev) + pm_runtime_get_sync(dev->dev.parent); + + if (!netif_device_present(dev) || +- dev->reg_state == NETREG_UNREGISTERING) { ++ dev->reg_state >= NETREG_UNREGISTERING) { + ret = -ENODEV; + goto err; + } +-- +2.39.5 + diff --git a/queue-5.15/net-davicom-fix-uaf-in-dm9000_drv_remove.patch b/queue-5.15/net-davicom-fix-uaf-in-dm9000_drv_remove.patch new file mode 100644 index 0000000000..181c102ddc --- /dev/null +++ b/queue-5.15/net-davicom-fix-uaf-in-dm9000_drv_remove.patch @@ -0,0 +1,52 @@ +From 40292d338cf0cb5c9ab1b3a08f6ef5bb4557f1db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2025 15:42:13 -0600 +Subject: net: davicom: fix UAF in dm9000_drv_remove +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chenyuan Yang + +[ Upstream commit 19e65c45a1507a1a2926649d2db3583ed9d55fd9 ] + +dm is netdev private data and it cannot be +used after free_netdev() call. Using dm after free_netdev() +can cause UAF bug. Fix it by moving free_netdev() at the end of the +function. + +This is similar to the issue fixed in commit +ad297cd2db89 ("net: qcom/emac: fix UAF in emac_remove"). + +This bug is detected by our static analysis tool. + +Fixes: cf9e60aa69ae ("net: davicom: Fix regulator not turned off on driver removal") +Signed-off-by: Chenyuan Yang +CC: Uwe Kleine-König +Link: https://patch.msgid.link/20250123214213.623518-1-chenyuan0y@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/davicom/dm9000.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c +index e842de6f66356..afa92b44c8ebb 100644 +--- a/drivers/net/ethernet/davicom/dm9000.c ++++ b/drivers/net/ethernet/davicom/dm9000.c +@@ -1773,10 +1773,11 @@ dm9000_drv_remove(struct platform_device *pdev) + + unregister_netdev(ndev); + dm9000_release_board(pdev, dm); +- free_netdev(ndev); /* free device structure */ + if (dm->power_supply) + regulator_disable(dm->power_supply); + ++ free_netdev(ndev); /* free device structure */ ++ + dev_dbg(&pdev->dev, "released and freed device\n"); + return 0; + } +-- +2.39.5 + diff --git a/queue-5.15/net-ethernet-ti-am65-cpsw-fix-freeing-irq-in-am65_cp.patch b/queue-5.15/net-ethernet-ti-am65-cpsw-fix-freeing-irq-in-am65_cp.patch new file mode 100644 index 0000000000..b53bfc641a --- /dev/null +++ b/queue-5.15/net-ethernet-ti-am65-cpsw-fix-freeing-irq-in-am65_cp.patch @@ -0,0 +1,61 @@ +From 408c3c16c2170ed1ad52f81ef2c3379e114a16e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 15:54:49 +0200 +Subject: net: ethernet: ti: am65-cpsw: fix freeing IRQ in + am65_cpsw_nuss_remove_tx_chns() + +From: Roger Quadros + +[ Upstream commit 4395a44acb15850e492dd1de9ec4b6479d96bc80 ] + +When getting the IRQ we use k3_udma_glue_tx_get_irq() which returns +negative error value on error. So not NULL check is not sufficient +to deteremine if IRQ is valid. Check that IRQ is greater then zero +to ensure it is valid. + +There is no issue at probe time but at runtime user can invoke +.set_channels which results in the following call chain. +am65_cpsw_set_channels() + am65_cpsw_nuss_update_tx_rx_chns() + am65_cpsw_nuss_remove_tx_chns() + am65_cpsw_nuss_init_tx_chns() + +At this point if am65_cpsw_nuss_init_tx_chns() fails due to +k3_udma_glue_tx_get_irq() then tx_chn->irq will be set to a +negative value. + +Then, at subsequent .set_channels with higher channel count we +will attempt to free an invalid IRQ in am65_cpsw_nuss_remove_tx_chns() +leading to a kernel warning. + +The issue is present in the original commit that introduced this driver, +although there, am65_cpsw_nuss_update_tx_rx_chns() existed as +am65_cpsw_nuss_update_tx_chns(). + +Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver") +Signed-off-by: Roger Quadros +Reviewed-by: Simon Horman +Reviewed-by: Siddharth Vadapalli +Reviewed-by: Jacob Keller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index 4bd57b79a023b..c2700fcfc10e2 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -1546,7 +1546,7 @@ void am65_cpsw_nuss_remove_tx_chns(struct am65_cpsw_common *common) + for (i = 0; i < common->tx_ch_num; i++) { + struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i]; + +- if (tx_chn->irq) ++ if (tx_chn->irq > 0) + devm_free_irq(dev, tx_chn->irq, tx_chn); + + netif_napi_del(&tx_chn->napi_tx); +-- +2.39.5 + diff --git a/queue-5.15/net-fec-implement-tso-descriptor-cleanup.patch b/queue-5.15/net-fec-implement-tso-descriptor-cleanup.patch new file mode 100644 index 0000000000..b3b3967b98 --- /dev/null +++ b/queue-5.15/net-fec-implement-tso-descriptor-cleanup.patch @@ -0,0 +1,78 @@ +From 8d3a5314c3efd693faeaab341fe1c89f58934ee6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 14:24:30 +0530 +Subject: net: fec: implement TSO descriptor cleanup + +From: Dheeraj Reddy Jonnalagadda + +[ Upstream commit 61dc1fd9205bc9d9918aa933a847b08e80b4dc20 ] + +Implement cleanup of descriptors in the TSO error path of +fec_enet_txq_submit_tso(). The cleanup + +- Unmaps DMA buffers for data descriptors skipping TSO header +- Clears all buffer descriptors +- Handles extended descriptors by clearing cbd_esc when enabled + +Fixes: 79f339125ea3 ("net: fec: Add software TSO support") +Signed-off-by: Dheeraj Reddy Jonnalagadda +Reviewed-by: Wei Fang +Link: https://patch.msgid.link/20250120085430.99318-1-dheeraj.linuxdev@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 31 ++++++++++++++++++++++- + 1 file changed, 30 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 0a3cf22dc260b..7b5585bc21d8f 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -761,6 +761,8 @@ static int fec_enet_txq_submit_tso(struct fec_enet_priv_tx_q *txq, + struct fec_enet_private *fep = netdev_priv(ndev); + int hdr_len, total_len, data_left; + struct bufdesc *bdp = txq->bd.cur; ++ struct bufdesc *tmp_bdp; ++ struct bufdesc_ex *ebdp; + struct tso_t tso; + unsigned int index = 0; + int ret; +@@ -834,7 +836,34 @@ static int fec_enet_txq_submit_tso(struct fec_enet_priv_tx_q *txq, + return 0; + + err_release: +- /* TODO: Release all used data descriptors for TSO */ ++ /* Release all used data descriptors for TSO */ ++ tmp_bdp = txq->bd.cur; ++ ++ while (tmp_bdp != bdp) { ++ /* Unmap data buffers */ ++ if (tmp_bdp->cbd_bufaddr && ++ !IS_TSO_HEADER(txq, fec32_to_cpu(tmp_bdp->cbd_bufaddr))) ++ dma_unmap_single(&fep->pdev->dev, ++ fec32_to_cpu(tmp_bdp->cbd_bufaddr), ++ fec16_to_cpu(tmp_bdp->cbd_datlen), ++ DMA_TO_DEVICE); ++ ++ /* Clear standard buffer descriptor fields */ ++ tmp_bdp->cbd_sc = 0; ++ tmp_bdp->cbd_datlen = 0; ++ tmp_bdp->cbd_bufaddr = 0; ++ ++ /* Handle extended descriptor if enabled */ ++ if (fep->bufdesc_ex) { ++ ebdp = (struct bufdesc_ex *)tmp_bdp; ++ ebdp->cbd_esc = 0; ++ } ++ ++ tmp_bdp = fec_enet_get_nextdesc(tmp_bdp, &txq->bd); ++ } ++ ++ dev_kfree_skb_any(skb); ++ + return ret; + } + +-- +2.39.5 + diff --git a/queue-5.15/net-hns3-fix-oops-when-unload-drivers-paralleling.patch b/queue-5.15/net-hns3-fix-oops-when-unload-drivers-paralleling.patch new file mode 100644 index 0000000000..fb59e8c05d --- /dev/null +++ b/queue-5.15/net-hns3-fix-oops-when-unload-drivers-paralleling.patch @@ -0,0 +1,121 @@ +From 8dadc8a106dee60b88cdfd86a9d64c732569bedc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jan 2025 17:47:41 +0800 +Subject: net: hns3: fix oops when unload drivers paralleling + +From: Jian Shen + +[ Upstream commit 92e5995773774a3e70257e9c95ea03518268bea5 ] + +When unload hclge driver, it tries to disable sriov first for each +ae_dev node from hnae3_ae_dev_list. If user unloads hns3 driver at +the time, because it removes all the ae_dev nodes, and it may cause +oops. + +But we can't simply use hnae3_common_lock for this. Because in the +process flow of pci_disable_sriov(), it will trigger the remove flow +of VF, which will also take hnae3_common_lock. + +To fixes it, introduce a new mutex to protect the unload process. + +Fixes: 0dd8a25f355b ("net: hns3: disable sriov before unload hclge layer") +Signed-off-by: Jian Shen +Signed-off-by: Jijie Shao +Link: https://patch.msgid.link/20250118094741.3046663-1-shaojijie@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hnae3.c | 15 +++++++++++++++ + drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 ++ + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 ++ + .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 ++ + .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 2 ++ + 5 files changed, 23 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c +index 9a63fbc694083..b25fb400f4767 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c +@@ -40,6 +40,21 @@ EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare); + */ + static DEFINE_MUTEX(hnae3_common_lock); + ++/* ensure the drivers being unloaded one by one */ ++static DEFINE_MUTEX(hnae3_unload_lock); ++ ++void hnae3_acquire_unload_lock(void) ++{ ++ mutex_lock(&hnae3_unload_lock); ++} ++EXPORT_SYMBOL(hnae3_acquire_unload_lock); ++ ++void hnae3_release_unload_lock(void) ++{ ++ mutex_unlock(&hnae3_unload_lock); ++} ++EXPORT_SYMBOL(hnae3_release_unload_lock); ++ + static bool hnae3_client_match(enum hnae3_client_type client_type) + { + if (client_type == HNAE3_CLIENT_KNIC || +diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +index f362a2fac3c29..fa16cdcee10db 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +@@ -885,4 +885,6 @@ int hnae3_register_client(struct hnae3_client *client); + void hnae3_set_client_init_flag(struct hnae3_client *client, + struct hnae3_ae_dev *ae_dev, + unsigned int inited); ++void hnae3_acquire_unload_lock(void); ++void hnae3_release_unload_lock(void); + #endif +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index d6bdcd9f285b0..60592e8ddf3b8 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -5720,9 +5720,11 @@ module_init(hns3_init_module); + */ + static void __exit hns3_exit_module(void) + { ++ hnae3_acquire_unload_lock(); + pci_unregister_driver(&hns3_driver); + hnae3_unregister_client(&client); + hns3_dbg_unregister_debugfs(); ++ hnae3_release_unload_lock(); + } + module_exit(hns3_exit_module); + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index eb902e80a8158..35411f9a14323 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -13300,9 +13300,11 @@ static int hclge_init(void) + + static void hclge_exit(void) + { ++ hnae3_acquire_unload_lock(); + hnae3_unregister_ae_algo_prepare(&ae_algo); + hnae3_unregister_ae_algo(&ae_algo); + destroy_workqueue(hclge_wq); ++ hnae3_release_unload_lock(); + } + module_init(hclge_init); + module_exit(hclge_exit); +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +index 5b861a2a3e73e..7bb01eafba745 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -3947,8 +3947,10 @@ static int hclgevf_init(void) + + static void hclgevf_exit(void) + { ++ hnae3_acquire_unload_lock(); + hnae3_unregister_ae_algo(&ae_algovf); + destroy_workqueue(hclgevf_wq); ++ hnae3_release_unload_lock(); + } + module_init(hclgevf_init); + module_exit(hclgevf_exit); +-- +2.39.5 + diff --git a/queue-5.15/net-hsr-fix-fill_frame_info-regression-vs-vlan-packe.patch b/queue-5.15/net-hsr-fix-fill_frame_info-regression-vs-vlan-packe.patch new file mode 100644 index 0000000000..e2d9f46261 --- /dev/null +++ b/queue-5.15/net-hsr-fix-fill_frame_info-regression-vs-vlan-packe.patch @@ -0,0 +1,79 @@ +From 66da091668fb4012ec6428a63eeb601ce374f710 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2025 13:00:07 +0000 +Subject: net: hsr: fix fill_frame_info() regression vs VLAN packets + +From: Eric Dumazet + +[ Upstream commit 0f5697f1a3f99bc2b674b8aa3c5da822c5673c11 ] + +Stephan Wurm reported that my recent patch broke VLAN support. + +Apparently skb->mac_len is not correct for VLAN traffic as +shown by debug traces [1]. + +Use instead pskb_may_pull() to make sure the expected header +is present in skb->head. + +Many thanks to Stephan for his help. + +[1] +kernel: skb len=170 headroom=2 headlen=170 tailroom=20 + mac=(2,14) mac_len=14 net=(16,-1) trans=-1 + shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0)) + csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0) + hash(0x0 sw=0 l4=0) proto=0x0000 pkttype=0 iif=0 + priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0 + encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0) +kernel: dev name=prp0 feat=0x0000000000007000 +kernel: sk family=17 type=3 proto=0 +kernel: skb headroom: 00000000: 74 00 +kernel: skb linear: 00000000: 01 0c cd 01 00 01 00 d0 93 53 9c cb 81 00 80 00 +kernel: skb linear: 00000010: 88 b8 00 01 00 98 00 00 00 00 61 81 8d 80 16 52 +kernel: skb linear: 00000020: 45 47 44 4e 43 54 52 4c 2f 4c 4c 4e 30 24 47 4f +kernel: skb linear: 00000030: 24 47 6f 43 62 81 01 14 82 16 52 45 47 44 4e 43 +kernel: skb linear: 00000040: 54 52 4c 2f 4c 4c 4e 30 24 44 73 47 6f 6f 73 65 +kernel: skb linear: 00000050: 83 07 47 6f 49 64 65 6e 74 84 08 67 8d f5 93 7e +kernel: skb linear: 00000060: 76 c8 00 85 01 01 86 01 00 87 01 00 88 01 01 89 +kernel: skb linear: 00000070: 01 00 8a 01 02 ab 33 a2 15 83 01 00 84 03 03 00 +kernel: skb linear: 00000080: 00 91 08 67 8d f5 92 77 4b c6 1f 83 01 00 a2 1a +kernel: skb linear: 00000090: a2 06 85 01 00 83 01 00 84 03 03 00 00 91 08 67 +kernel: skb linear: 000000a0: 8d f5 92 77 4b c6 1f 83 01 00 +kernel: skb tailroom: 00000000: 80 18 02 00 fe 4e 00 00 01 01 08 0a 4f fd 5e d1 +kernel: skb tailroom: 00000010: 4f fd 5e cd + +Fixes: b9653d19e556 ("net: hsr: avoid potential out-of-bound access in fill_frame_info()") +Reported-by: Stephan Wurm +Tested-by: Stephan Wurm +Closes: https://lore.kernel.org/netdev/Z4o_UC0HweBHJ_cw@PC-LX-SteWu/ +Signed-off-by: Eric Dumazet +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250129130007.644084-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/hsr/hsr_forward.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c +index 20d4c3f8d8750..3de280a0dab2b 100644 +--- a/net/hsr/hsr_forward.c ++++ b/net/hsr/hsr_forward.c +@@ -546,9 +546,12 @@ static int fill_frame_info(struct hsr_frame_info *frame, + frame->is_vlan = true; + + if (frame->is_vlan) { +- if (skb->mac_len < offsetofend(struct hsr_vlan_ethhdr, vlanhdr)) ++ /* Note: skb->mac_len might be wrong here. */ ++ if (!pskb_may_pull(skb, ++ skb_mac_offset(skb) + ++ offsetofend(struct hsr_vlan_ethhdr, vlanhdr))) + return -EINVAL; +- vlan_hdr = (struct hsr_vlan_ethhdr *)ethhdr; ++ vlan_hdr = (struct hsr_vlan_ethhdr *)skb_mac_header(skb); + proto = vlan_hdr->vlanhdr.h_vlan_encapsulated_proto; + /* FIXME: */ + netdev_warn_once(skb->dev, "VLAN not yet supported"); +-- +2.39.5 + diff --git a/queue-5.15/net-let-net.core.dev_weight-always-be-non-zero.patch b/queue-5.15/net-let-net.core.dev_weight-always-be-non-zero.patch new file mode 100644 index 0000000000..e71729922f --- /dev/null +++ b/queue-5.15/net-let-net.core.dev_weight-always-be-non-zero.patch @@ -0,0 +1,103 @@ +From d1352480111511376236263461c400d8f1a4e197 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 22:30:53 +0800 +Subject: net: let net.core.dev_weight always be non-zero + +From: Liu Jian + +[ Upstream commit d1f9f79fa2af8e3b45cffdeef66e05833480148a ] + +The following problem was encountered during stability test: + +(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ + returned 1, exceeding its budget of 0. +------------[ cut here ]------------ +list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \ + next=ffff88905f746e40. +WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \ + __list_add_valid_or_report+0xf3/0x130 +CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+ +RIP: 0010:__list_add_valid_or_report+0xf3/0x130 +Call Trace: +? __warn+0xcd/0x250 +? __list_add_valid_or_report+0xf3/0x130 +enqueue_to_backlog+0x923/0x1070 +netif_rx_internal+0x92/0x2b0 +__netif_rx+0x15/0x170 +loopback_xmit+0x2ef/0x450 +dev_hard_start_xmit+0x103/0x490 +__dev_queue_xmit+0xeac/0x1950 +ip_finish_output2+0x6cc/0x1620 +ip_output+0x161/0x270 +ip_push_pending_frames+0x155/0x1a0 +raw_sendmsg+0xe13/0x1550 +__sys_sendto+0x3bf/0x4e0 +__x64_sys_sendto+0xdc/0x1b0 +do_syscall_64+0x5b/0x170 +entry_SYSCALL_64_after_hwframe+0x76/0x7e + +The reproduction command is as follows: + sysctl -w net.core.dev_weight=0 + ping 127.0.0.1 + +This is because when the napi's weight is set to 0, process_backlog() may +return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this +napi to be re-polled in net_rx_action() until __do_softirq() times out. +Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can +be retriggered in enqueue_to_backlog(), causing this issue. + +Making the napi's weight always non-zero solves this problem. + +Triggering this issue requires system-wide admin (setting is +not namespaced). + +Fixes: e38766054509 ("[NET]: Fix sysctl net.core.dev_weight") +Fixes: 3d48b53fb2ae ("net: dev_weight: TX/RX orthogonality") +Signed-off-by: Liu Jian +Link: https://patch.msgid.link/20250116143053.4146855-1-liujian56@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/sysctl_net_core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c +index ed20cbdd19315..60ea97aaea7d9 100644 +--- a/net/core/sysctl_net_core.c ++++ b/net/core/sysctl_net_core.c +@@ -240,7 +240,7 @@ static int proc_do_dev_weight(struct ctl_table *table, int write, + int ret, weight; + + mutex_lock(&dev_weight_mutex); +- ret = proc_dointvec(table, write, buffer, lenp, ppos); ++ ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); + if (!ret && write) { + weight = READ_ONCE(weight_p); + WRITE_ONCE(dev_rx_weight, weight * dev_weight_rx_bias); +@@ -351,6 +351,7 @@ static struct ctl_table net_core_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_do_dev_weight, ++ .extra1 = SYSCTL_ONE, + }, + { + .procname = "dev_weight_rx_bias", +@@ -358,6 +359,7 @@ static struct ctl_table net_core_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_do_dev_weight, ++ .extra1 = SYSCTL_ONE, + }, + { + .procname = "dev_weight_tx_bias", +@@ -365,6 +367,7 @@ static struct ctl_table net_core_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_do_dev_weight, ++ .extra1 = SYSCTL_ONE, + }, + { + .procname = "netdev_max_backlog", +-- +2.39.5 + diff --git a/queue-5.15/net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch b/queue-5.15/net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch new file mode 100644 index 0000000000..6f20b395d4 --- /dev/null +++ b/queue-5.15/net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch @@ -0,0 +1,53 @@ +From c17d8301fa9ed944e16b9365287aa230b2944bac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 14:33:16 +0200 +Subject: net/mlxfw: Drop hard coded max FW flash image size + +From: Maher Sanalla + +[ Upstream commit 70d81f25cc92cc4e914516c9935ae752f27d78ad ] + +Currently, mlxfw kernel module limits FW flash image size to be +10MB at most, preventing the ability to burn recent BlueField-3 +FW that exceeds the said size limit. + +Thus, drop the hard coded limit. Instead, rely on FW's +max_component_size threshold that is reported in MCQI register +as the size limit for FW image. + +Fixes: 410ed13cae39 ("Add the mlxfw module for Mellanox firmware flash process") +Signed-off-by: Maher Sanalla +Signed-off-by: Moshe Shemesh +Reviewed-by: Ido Schimmel +Tested-by: Ido Schimmel +Reviewed-by: Michal Swiatkowski +Link: https://patch.msgid.link/1737030796-1441634-1-git-send-email-moshe@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c +index 46245e0b24623..43c84900369a3 100644 +--- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c ++++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c +@@ -14,7 +14,6 @@ + #define MLXFW_FSM_STATE_WAIT_TIMEOUT_MS 30000 + #define MLXFW_FSM_STATE_WAIT_ROUNDS \ + (MLXFW_FSM_STATE_WAIT_TIMEOUT_MS / MLXFW_FSM_STATE_WAIT_CYCLE_MS) +-#define MLXFW_FSM_MAX_COMPONENT_SIZE (10 * (1 << 20)) + + static const int mlxfw_fsm_state_errno[] = { + [MLXFW_FSM_STATE_ERR_ERROR] = -EIO, +@@ -229,7 +228,6 @@ static int mlxfw_flash_component(struct mlxfw_dev *mlxfw_dev, + return err; + } + +- comp_max_size = min_t(u32, comp_max_size, MLXFW_FSM_MAX_COMPONENT_SIZE); + if (comp->data_size > comp_max_size) { + MLXFW_ERR_MSG(mlxfw_dev, extack, + "Component size is bigger than limit", -EINVAL); +-- +2.39.5 + diff --git a/queue-5.15/net-netdevsim-try-to-close-udp-port-harness-races.patch b/queue-5.15/net-netdevsim-try-to-close-udp-port-harness-races.patch new file mode 100644 index 0000000000..9b986f33b9 --- /dev/null +++ b/queue-5.15/net-netdevsim-try-to-close-udp-port-harness-races.patch @@ -0,0 +1,175 @@ +From 3ee1c6cf83478d55e6b171e21d9e210b5223e575 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2025 14:45:03 -0800 +Subject: net: netdevsim: try to close UDP port harness races + +From: Jakub Kicinski + +[ Upstream commit 50bf398e1ceacb9a7f85bd3bdca065ebe5cb6159 ] + +syzbot discovered that we remove the debugfs files after we free +the netdev. Try to clean up the relevant dir while the device +is still around. + +Reported-by: syzbot+2e5de9e3ab986b71d2bf@syzkaller.appspotmail.com +Fixes: 424be63ad831 ("netdevsim: add UDP tunnel port offload support") +Reviewed-by: Michal Swiatkowski +Link: https://patch.msgid.link/20250122224503.762705-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/netdevsim.h | 1 + + drivers/net/netdevsim/udp_tunnels.c | 23 +++++++++++-------- + .../drivers/net/netdevsim/udp_tunnel_nic.sh | 16 ++++++------- + 3 files changed, 23 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h +index 793c86dc5a9c1..902c74a74c56d 100644 +--- a/drivers/net/netdevsim/netdevsim.h ++++ b/drivers/net/netdevsim/netdevsim.h +@@ -97,6 +97,7 @@ struct netdevsim { + u32 sleep; + u32 __ports[2][NSIM_UDP_TUNNEL_N_PORTS]; + u32 (*ports)[NSIM_UDP_TUNNEL_N_PORTS]; ++ struct dentry *ddir; + struct debugfs_u32_array dfs_ports[2]; + } udp_ports; + +diff --git a/drivers/net/netdevsim/udp_tunnels.c b/drivers/net/netdevsim/udp_tunnels.c +index 02dc3123eb6c1..640b4983a9a0d 100644 +--- a/drivers/net/netdevsim/udp_tunnels.c ++++ b/drivers/net/netdevsim/udp_tunnels.c +@@ -112,9 +112,11 @@ nsim_udp_tunnels_info_reset_write(struct file *file, const char __user *data, + struct net_device *dev = file->private_data; + struct netdevsim *ns = netdev_priv(dev); + +- memset(ns->udp_ports.ports, 0, sizeof(ns->udp_ports.__ports)); + rtnl_lock(); +- udp_tunnel_nic_reset_ntf(dev); ++ if (dev->reg_state == NETREG_REGISTERED) { ++ memset(ns->udp_ports.ports, 0, sizeof(ns->udp_ports.__ports)); ++ udp_tunnel_nic_reset_ntf(dev); ++ } + rtnl_unlock(); + + return count; +@@ -144,23 +146,23 @@ int nsim_udp_tunnels_info_create(struct nsim_dev *nsim_dev, + else + ns->udp_ports.ports = nsim_dev->udp_ports.__ports; + +- debugfs_create_u32("udp_ports_inject_error", 0600, +- ns->nsim_dev_port->ddir, ++ ns->udp_ports.ddir = debugfs_create_dir("udp_ports", ++ ns->nsim_dev_port->ddir); ++ ++ debugfs_create_u32("inject_error", 0600, ns->udp_ports.ddir, + &ns->udp_ports.inject_error); + + ns->udp_ports.dfs_ports[0].array = ns->udp_ports.ports[0]; + ns->udp_ports.dfs_ports[0].n_elements = NSIM_UDP_TUNNEL_N_PORTS; +- debugfs_create_u32_array("udp_ports_table0", 0400, +- ns->nsim_dev_port->ddir, ++ debugfs_create_u32_array("table0", 0400, ns->udp_ports.ddir, + &ns->udp_ports.dfs_ports[0]); + + ns->udp_ports.dfs_ports[1].array = ns->udp_ports.ports[1]; + ns->udp_ports.dfs_ports[1].n_elements = NSIM_UDP_TUNNEL_N_PORTS; +- debugfs_create_u32_array("udp_ports_table1", 0400, +- ns->nsim_dev_port->ddir, ++ debugfs_create_u32_array("table1", 0400, ns->udp_ports.ddir, + &ns->udp_ports.dfs_ports[1]); + +- debugfs_create_file("udp_ports_reset", 0200, ns->nsim_dev_port->ddir, ++ debugfs_create_file("reset", 0200, ns->udp_ports.ddir, + dev, &nsim_udp_tunnels_info_reset_fops); + + /* Note: it's not normal to allocate the info struct like this! +@@ -196,6 +198,9 @@ int nsim_udp_tunnels_info_create(struct nsim_dev *nsim_dev, + + void nsim_udp_tunnels_info_destroy(struct net_device *dev) + { ++ struct netdevsim *ns = netdev_priv(dev); ++ ++ debugfs_remove_recursive(ns->udp_ports.ddir); + kfree(dev->udp_tunnel_nic_info); + dev->udp_tunnel_nic_info = NULL; + } +diff --git a/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh b/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh +index 185b02d2d4cd1..7af78990b5bb6 100755 +--- a/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh ++++ b/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh +@@ -142,7 +142,7 @@ function pre_ethtool { + } + + function check_table { +- local path=$NSIM_DEV_DFS/ports/$port/udp_ports_table$1 ++ local path=$NSIM_DEV_DFS/ports/$port/udp_ports/table$1 + local -n expected=$2 + local last=$3 + +@@ -212,7 +212,7 @@ function check_tables { + } + + function print_table { +- local path=$NSIM_DEV_DFS/ports/$port/udp_ports_table$1 ++ local path=$NSIM_DEV_DFS/ports/$port/udp_ports/table$1 + read -a have < $path + + tree $NSIM_DEV_DFS/ +@@ -640,7 +640,7 @@ for port in 0 1; do + NSIM_NETDEV=`get_netdev_name old_netdevs` + ifconfig $NSIM_NETDEV up + +- echo 110 > $NSIM_DEV_DFS/ports/$port/udp_ports_inject_error ++ echo 110 > $NSIM_DEV_DFS/ports/$port/udp_ports/inject_error + + msg="1 - create VxLANs v6" + exp0=( 0 0 0 0 ) +@@ -662,7 +662,7 @@ for port in 0 1; do + new_geneve gnv0 20000 + + msg="2 - destroy GENEVE" +- echo 2 > $NSIM_DEV_DFS/ports/$port/udp_ports_inject_error ++ echo 2 > $NSIM_DEV_DFS/ports/$port/udp_ports/inject_error + exp1=( `mke 20000 2` 0 0 0 ) + del_dev gnv0 + +@@ -763,7 +763,7 @@ for port in 0 1; do + msg="create VxLANs v4" + new_vxlan vxlan0 10000 $NSIM_NETDEV + +- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset ++ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset + check_tables + + msg="NIC device goes down" +@@ -774,7 +774,7 @@ for port in 0 1; do + fi + check_tables + +- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset ++ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset + check_tables + + msg="NIC device goes up again" +@@ -788,7 +788,7 @@ for port in 0 1; do + del_dev vxlan0 + check_tables + +- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset ++ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset + check_tables + + msg="destroy NIC" +@@ -895,7 +895,7 @@ msg="vacate VxLAN in overflow table" + exp0=( `mke 10000 1` `mke 10004 1` 0 `mke 10003 1` ) + del_dev vxlan2 + +-echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset ++echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset + check_tables + + msg="tunnels destroyed 2" +-- +2.39.5 + diff --git a/queue-5.15/net-rose-fix-timer-races-against-user-threads.patch b/queue-5.15/net-rose-fix-timer-races-against-user-threads.patch new file mode 100644 index 0000000000..021518ed63 --- /dev/null +++ b/queue-5.15/net-rose-fix-timer-races-against-user-threads.patch @@ -0,0 +1,116 @@ +From ab623e8463997728a6f70857e7ffe82040d8f874 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2025 18:02:44 +0000 +Subject: net: rose: fix timer races against user threads + +From: Eric Dumazet + +[ Upstream commit 5de7665e0a0746b5ad7943554b34db8f8614a196 ] + +Rose timers only acquire the socket spinlock, without +checking if the socket is owned by one user thread. + +Add a check and rearm the timers if needed. + +BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174 +Read of size 2 at addr ffff88802f09b82a by task swapper/0/0 + +CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:378 [inline] + print_report+0x169/0x550 mm/kasan/report.c:489 + kasan_report+0x143/0x180 mm/kasan/report.c:602 + rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174 + call_timer_fn+0x187/0x650 kernel/time/timer.c:1793 + expire_timers kernel/time/timer.c:1844 [inline] + __run_timers kernel/time/timer.c:2418 [inline] + __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430 + run_timer_base kernel/time/timer.c:2439 [inline] + run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 + handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 + __do_softirq kernel/softirq.c:595 [inline] + invoke_softirq kernel/softirq.c:435 [inline] + __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 + irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 + instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] + sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 + + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20250122180244.1861468-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rose/rose_timer.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c +index f06ddbed3fed6..1525773e94aa1 100644 +--- a/net/rose/rose_timer.c ++++ b/net/rose/rose_timer.c +@@ -122,6 +122,10 @@ static void rose_heartbeat_expiry(struct timer_list *t) + struct rose_sock *rose = rose_sk(sk); + + bh_lock_sock(sk); ++ if (sock_owned_by_user(sk)) { ++ sk_reset_timer(sk, &sk->sk_timer, jiffies + HZ/20); ++ goto out; ++ } + switch (rose->state) { + case ROSE_STATE_0: + /* Magic here: If we listen() and a new link dies before it +@@ -152,6 +156,7 @@ static void rose_heartbeat_expiry(struct timer_list *t) + } + + rose_start_heartbeat(sk); ++out: + bh_unlock_sock(sk); + sock_put(sk); + } +@@ -162,6 +167,10 @@ static void rose_timer_expiry(struct timer_list *t) + struct sock *sk = &rose->sock; + + bh_lock_sock(sk); ++ if (sock_owned_by_user(sk)) { ++ sk_reset_timer(sk, &rose->timer, jiffies + HZ/20); ++ goto out; ++ } + switch (rose->state) { + case ROSE_STATE_1: /* T1 */ + case ROSE_STATE_4: /* T2 */ +@@ -182,6 +191,7 @@ static void rose_timer_expiry(struct timer_list *t) + } + break; + } ++out: + bh_unlock_sock(sk); + sock_put(sk); + } +@@ -192,6 +202,10 @@ static void rose_idletimer_expiry(struct timer_list *t) + struct sock *sk = &rose->sock; + + bh_lock_sock(sk); ++ if (sock_owned_by_user(sk)) { ++ sk_reset_timer(sk, &rose->idletimer, jiffies + HZ/20); ++ goto out; ++ } + rose_clear_queues(sk); + + rose_write_internal(sk, ROSE_CLEAR_REQUEST); +@@ -207,6 +221,7 @@ static void rose_idletimer_expiry(struct timer_list *t) + sk->sk_state_change(sk); + sock_set_flag(sk, SOCK_DEAD); + } ++out: + bh_unlock_sock(sk); + sock_put(sk); + } +-- +2.39.5 + diff --git a/queue-5.15/net-rose-prevent-integer-overflows-in-rose_setsockop.patch b/queue-5.15/net-rose-prevent-integer-overflows-in-rose_setsockop.patch new file mode 100644 index 0000000000..4179f4bb87 --- /dev/null +++ b/queue-5.15/net-rose-prevent-integer-overflows-in-rose_setsockop.patch @@ -0,0 +1,90 @@ +From 7acef0819b373e707157d77dc2cf5dc2aa98666f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 08:42:20 -0800 +Subject: net/rose: prevent integer overflows in rose_setsockopt() + +From: Nikita Zhandarovich + +[ Upstream commit d640627663bfe7d8963c7615316d7d4ef60f3b0b ] + +In case of possible unpredictably large arguments passed to +rose_setsockopt() and multiplied by extra values on top of that, +integer overflows may occur. + +Do the safest minimum and fix these issues by checking the +contents of 'opt' and returning -EINVAL if they are too large. Also, +switch to unsigned int and remove useless check for negative 'opt' +in ROSE_IDLE case. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Nikita Zhandarovich +Link: https://patch.msgid.link/20250115164220.19954-1-n.zhandarovich@fintech.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rose/af_rose.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c +index 1d95ff34b13c9..65fd5b99f9dea 100644 +--- a/net/rose/af_rose.c ++++ b/net/rose/af_rose.c +@@ -396,15 +396,15 @@ static int rose_setsockopt(struct socket *sock, int level, int optname, + { + struct sock *sk = sock->sk; + struct rose_sock *rose = rose_sk(sk); +- int opt; ++ unsigned int opt; + + if (level != SOL_ROSE) + return -ENOPROTOOPT; + +- if (optlen < sizeof(int)) ++ if (optlen < sizeof(unsigned int)) + return -EINVAL; + +- if (copy_from_sockptr(&opt, optval, sizeof(int))) ++ if (copy_from_sockptr(&opt, optval, sizeof(unsigned int))) + return -EFAULT; + + switch (optname) { +@@ -413,31 +413,31 @@ static int rose_setsockopt(struct socket *sock, int level, int optname, + return 0; + + case ROSE_T1: +- if (opt < 1) ++ if (opt < 1 || opt > UINT_MAX / HZ) + return -EINVAL; + rose->t1 = opt * HZ; + return 0; + + case ROSE_T2: +- if (opt < 1) ++ if (opt < 1 || opt > UINT_MAX / HZ) + return -EINVAL; + rose->t2 = opt * HZ; + return 0; + + case ROSE_T3: +- if (opt < 1) ++ if (opt < 1 || opt > UINT_MAX / HZ) + return -EINVAL; + rose->t3 = opt * HZ; + return 0; + + case ROSE_HOLDBACK: +- if (opt < 1) ++ if (opt < 1 || opt > UINT_MAX / HZ) + return -EINVAL; + rose->hb = opt * HZ; + return 0; + + case ROSE_IDLE: +- if (opt < 0) ++ if (opt > UINT_MAX / (60 * HZ)) + return -EINVAL; + rose->idle = opt * 60 * HZ; + return 0; +-- +2.39.5 + diff --git a/queue-5.15/net-sched-disallow-replacing-of-child-qdisc-from-one.patch b/queue-5.15/net-sched-disallow-replacing-of-child-qdisc-from-one.patch new file mode 100644 index 0000000000..1f4011c009 --- /dev/null +++ b/queue-5.15/net-sched-disallow-replacing-of-child-qdisc-from-one.patch @@ -0,0 +1,115 @@ +From 6da850a4f1d9c140fc40b28685e99501359ee9b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 17:37:13 -0800 +Subject: net: sched: Disallow replacing of child qdisc from one parent to + another + +From: Jamal Hadi Salim + +[ Upstream commit bc50835e83f60f56e9bec2b392fb5544f250fb6f ] + +Lion Ackermann was able to create a UAF which can be abused for privilege +escalation with the following script + +Step 1. create root qdisc +tc qdisc add dev lo root handle 1:0 drr + +step2. a class for packet aggregation do demonstrate uaf +tc class add dev lo classid 1:1 drr + +step3. a class for nesting +tc class add dev lo classid 1:2 drr + +step4. a class to graft qdisc to +tc class add dev lo classid 1:3 drr + +step5. +tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024 + +step6. +tc qdisc add dev lo parent 1:2 handle 3:0 drr + +step7. +tc class add dev lo classid 3:1 drr + +step 8. +tc qdisc add dev lo parent 3:1 handle 4:0 pfifo + +step 9. Display the class/qdisc layout + +tc class ls dev lo + class drr 1:1 root leaf 2: quantum 64Kb + class drr 1:2 root leaf 3: quantum 64Kb + class drr 3:1 root leaf 4: quantum 64Kb + +tc qdisc ls + qdisc drr 1: dev lo root refcnt 2 + qdisc plug 2: dev lo parent 1:1 + qdisc pfifo 4: dev lo parent 3:1 limit 1000p + qdisc drr 3: dev lo parent 1:2 + +step10. trigger the bug <=== prevented by this patch +tc qdisc replace dev lo parent 1:3 handle 4:0 + +step 11. Redisplay again the qdiscs/classes + +tc class ls dev lo + class drr 1:1 root leaf 2: quantum 64Kb + class drr 1:2 root leaf 3: quantum 64Kb + class drr 1:3 root leaf 4: quantum 64Kb + class drr 3:1 root leaf 4: quantum 64Kb + +tc qdisc ls + qdisc drr 1: dev lo root refcnt 2 + qdisc plug 2: dev lo parent 1:1 + qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p + qdisc drr 3: dev lo parent 1:2 + +Observe that a) parent for 4:0 does not change despite the replace request. +There can only be one parent. b) refcount has gone up by two for 4:0 and +c) both class 1:3 and 3:1 are pointing to it. + +Step 12. send one packet to plug +echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001)) +step13. send one packet to the grafted fifo +echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003)) + +step14. lets trigger the uaf +tc class delete dev lo classid 1:3 +tc class delete dev lo classid 1:1 + +The semantics of "replace" is for a del/add _on the same node_ and not +a delete from one node(3:1) and add to another node (1:3) as in step10. +While we could "fix" with a more complex approach there could be +consequences to expectations so the patch takes the preventive approach of +"disallow such config". + +Joint work with Lion Ackermann +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jamal Hadi Salim +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250116013713.900000-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_api.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c +index bf8af9f3f3dce..516874d943cd9 100644 +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -1603,6 +1603,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, + q = qdisc_lookup(dev, tcm->tcm_handle); + if (!q) + goto create_n_graft; ++ if (q->parent != tcm->tcm_parent) { ++ NL_SET_ERR_MSG(extack, "Cannot move an existing qdisc to a different parent"); ++ return -EINVAL; ++ } + if (n->nlmsg_flags & NLM_F_EXCL) { + NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot override"); + return -EEXIST; +-- +2.39.5 + diff --git a/queue-5.15/net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch b/queue-5.15/net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch new file mode 100644 index 0000000000..3155d66dcf --- /dev/null +++ b/queue-5.15/net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch @@ -0,0 +1,60 @@ +From 8b11bf68f3738fd6fc12129ffc876ff1b46cc032 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2025 10:50:47 +0100 +Subject: net: sh_eth: Fix missing rtnl lock in suspend/resume path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kory Maincent + +[ Upstream commit b95102215a8d0987789715ce11c0d4ec031cbfbe ] + +Fix the suspend/resume path by ensuring the rtnl lock is held where +required. Calls to sh_eth_close, sh_eth_open and wol operations must be +performed under the rtnl lock to prevent conflicts with ongoing ndo +operations. + +Fixes: b71af04676e9 ("sh_eth: add more PM methods") +Tested-by: Niklas Söderlund +Reviewed-by: Sergey Shtylyov +Signed-off-by: Kory Maincent +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/sh_eth.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index b6e426d8014d1..183db093815cb 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -3476,10 +3476,12 @@ static int sh_eth_suspend(struct device *dev) + + netif_device_detach(ndev); + ++ rtnl_lock(); + if (mdp->wol_enabled) + ret = sh_eth_wol_setup(ndev); + else + ret = sh_eth_close(ndev); ++ rtnl_unlock(); + + return ret; + } +@@ -3493,10 +3495,12 @@ static int sh_eth_resume(struct device *dev) + if (!netif_running(ndev)) + return 0; + ++ rtnl_lock(); + if (mdp->wol_enabled) + ret = sh_eth_wol_restore(ndev); + else + ret = sh_eth_open(ndev); ++ rtnl_unlock(); + + if (ret < 0) + return ret; +-- +2.39.5 + diff --git a/queue-5.15/net-smc-fix-data-error-when-recvmsg-with-msg_peek-fl.patch b/queue-5.15/net-smc-fix-data-error-when-recvmsg-with-msg_peek-fl.patch new file mode 100644 index 0000000000..c4128220c3 --- /dev/null +++ b/queue-5.15/net-smc-fix-data-error-when-recvmsg-with-msg_peek-fl.patch @@ -0,0 +1,244 @@ +From 4cb7efab8a7a17819f69cfca990f0afa681b8698 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jan 2025 22:32:01 +0800 +Subject: net/smc: fix data error when recvmsg with MSG_PEEK flag + +From: Guangguan Wang + +[ Upstream commit a4b6539038c1aa1ae871aacf6e41b566c3613993 ] + +When recvmsg with MSG_PEEK flag, the data will be copied to +user's buffer without advancing consume cursor and without +reducing the length of rx available data. Once the expected +peek length is larger than the value of bytes_to_rcv, in the +loop of do while in smc_rx_recvmsg, the first loop will copy +bytes_to_rcv bytes of data from the position local_tx_ctrl.cons, +the second loop will copy the min(bytes_to_rcv, read_remaining) +bytes from the position local_tx_ctrl.cons again because of the +lacking of process with advancing consume cursor and reducing +the length of available data. So do the subsequent loops. The +data copied in the second loop and the subsequent loops will +result in data error, as it should not be copied if no more data +arrives and it should be copied from the position advancing +bytes_to_rcv bytes from the local_tx_ctrl.cons if more data arrives. + +This issue can be reproduce by the following python script: +server.py: +import socket +import time +server_ip = '0.0.0.0' +server_port = 12346 +server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +server_socket.bind((server_ip, server_port)) +server_socket.listen(1) +print('Server is running and listening for connections...') +conn, addr = server_socket.accept() +print('Connected by', addr) +while True: + data = conn.recv(1024) + if not data: + break + print('Received request:', data.decode()) + conn.sendall(b'Hello, client!\n') + time.sleep(5) + conn.sendall(b'Hello, again!\n') +conn.close() + +client.py: +import socket +server_ip = '' +server_port = 12346 +resp=b'Hello, client!\nHello, again!\n' +client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +client_socket.connect((server_ip, server_port)) +request = 'Hello, server!' +client_socket.sendall(request.encode()) +peek_data = client_socket.recv(len(resp), + socket.MSG_PEEK | socket.MSG_WAITALL) +print('Peeked data:', peek_data.decode()) +client_socket.close() + +Fixes: 952310ccf2d8 ("smc: receive data from RMBE") +Reported-by: D. Wythe +Signed-off-by: Guangguan Wang +Link: https://patch.msgid.link/20250104143201.35529-1-guangguan.wang@linux.alibaba.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 2 +- + net/smc/smc_rx.c | 37 +++++++++++++++++++++---------------- + net/smc/smc_rx.h | 8 ++++---- + 3 files changed, 26 insertions(+), 21 deletions(-) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index ef0f264932e1f..2a642dfbc94a1 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -2209,7 +2209,7 @@ static int smc_accept(struct socket *sock, struct socket *new_sock, + release_sock(clcsk); + } else if (!atomic_read(&smc_sk(nsk)->conn.bytes_to_rcv)) { + lock_sock(nsk); +- smc_rx_wait(smc_sk(nsk), &timeo, smc_rx_data_available); ++ smc_rx_wait(smc_sk(nsk), &timeo, 0, smc_rx_data_available); + release_sock(nsk); + } + } +diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c +index 5b63c250ba604..81cf611eae750 100644 +--- a/net/smc/smc_rx.c ++++ b/net/smc/smc_rx.c +@@ -175,22 +175,23 @@ static int smc_rx_splice(struct pipe_inode_info *pipe, char *src, size_t len, + return bytes; + } + +-static int smc_rx_data_available_and_no_splice_pend(struct smc_connection *conn) ++static int smc_rx_data_available_and_no_splice_pend(struct smc_connection *conn, size_t peeked) + { +- return atomic_read(&conn->bytes_to_rcv) && ++ return smc_rx_data_available(conn, peeked) && + !atomic_read(&conn->splice_pending); + } + + /* blocks rcvbuf consumer until >=len bytes available or timeout or interrupted + * @smc smc socket + * @timeo pointer to max seconds to wait, pointer to value 0 for no timeout ++ * @peeked number of bytes already peeked + * @fcrit add'l criterion to evaluate as function pointer + * Returns: + * 1 if at least 1 byte available in rcvbuf or if socket error/shutdown. + * 0 otherwise (nothing in rcvbuf nor timeout, e.g. interrupted). + */ +-int smc_rx_wait(struct smc_sock *smc, long *timeo, +- int (*fcrit)(struct smc_connection *conn)) ++int smc_rx_wait(struct smc_sock *smc, long *timeo, size_t peeked, ++ int (*fcrit)(struct smc_connection *conn, size_t baseline)) + { + DEFINE_WAIT_FUNC(wait, woken_wake_function); + struct smc_connection *conn = &smc->conn; +@@ -199,7 +200,7 @@ int smc_rx_wait(struct smc_sock *smc, long *timeo, + struct sock *sk = &smc->sk; + int rc; + +- if (fcrit(conn)) ++ if (fcrit(conn, peeked)) + return 1; + sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk); + add_wait_queue(sk_sleep(sk), &wait); +@@ -208,7 +209,7 @@ int smc_rx_wait(struct smc_sock *smc, long *timeo, + cflags->peer_conn_abort || + READ_ONCE(sk->sk_shutdown) & RCV_SHUTDOWN || + conn->killed || +- fcrit(conn), ++ fcrit(conn, peeked), + &wait); + remove_wait_queue(sk_sleep(sk), &wait); + sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk); +@@ -259,11 +260,11 @@ static int smc_rx_recv_urg(struct smc_sock *smc, struct msghdr *msg, int len, + return -EAGAIN; + } + +-static bool smc_rx_recvmsg_data_available(struct smc_sock *smc) ++static bool smc_rx_recvmsg_data_available(struct smc_sock *smc, size_t peeked) + { + struct smc_connection *conn = &smc->conn; + +- if (smc_rx_data_available(conn)) ++ if (smc_rx_data_available(conn, peeked)) + return true; + else if (conn->urg_state == SMC_URG_VALID) + /* we received a single urgent Byte - skip */ +@@ -281,10 +282,10 @@ static bool smc_rx_recvmsg_data_available(struct smc_sock *smc) + int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, + struct pipe_inode_info *pipe, size_t len, int flags) + { +- size_t copylen, read_done = 0, read_remaining = len; ++ size_t copylen, read_done = 0, read_remaining = len, peeked_bytes = 0; + size_t chunk_len, chunk_off, chunk_len_sum; + struct smc_connection *conn = &smc->conn; +- int (*func)(struct smc_connection *conn); ++ int (*func)(struct smc_connection *conn, size_t baseline); + union smc_host_cursor cons; + int readable, chunk; + char *rcvbuf_base; +@@ -321,14 +322,14 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, + if (conn->killed) + break; + +- if (smc_rx_recvmsg_data_available(smc)) ++ if (smc_rx_recvmsg_data_available(smc, peeked_bytes)) + goto copy; + + if (sk->sk_shutdown & RCV_SHUTDOWN) { + /* smc_cdc_msg_recv_action() could have run after + * above smc_rx_recvmsg_data_available() + */ +- if (smc_rx_recvmsg_data_available(smc)) ++ if (smc_rx_recvmsg_data_available(smc, peeked_bytes)) + goto copy; + break; + } +@@ -362,26 +363,28 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, + } + } + +- if (!smc_rx_data_available(conn)) { +- smc_rx_wait(smc, &timeo, smc_rx_data_available); ++ if (!smc_rx_data_available(conn, peeked_bytes)) { ++ smc_rx_wait(smc, &timeo, peeked_bytes, smc_rx_data_available); + continue; + } + + copy: + /* initialize variables for 1st iteration of subsequent loop */ + /* could be just 1 byte, even after waiting on data above */ +- readable = atomic_read(&conn->bytes_to_rcv); ++ readable = smc_rx_data_available(conn, peeked_bytes); + splbytes = atomic_read(&conn->splice_pending); + if (!readable || (msg && splbytes)) { + if (splbytes) + func = smc_rx_data_available_and_no_splice_pend; + else + func = smc_rx_data_available; +- smc_rx_wait(smc, &timeo, func); ++ smc_rx_wait(smc, &timeo, peeked_bytes, func); + continue; + } + + smc_curs_copy(&cons, &conn->local_tx_ctrl.cons, conn); ++ if ((flags & MSG_PEEK) && peeked_bytes) ++ smc_curs_add(conn->rmb_desc->len, &cons, peeked_bytes); + /* subsequent splice() calls pick up where previous left */ + if (splbytes) + smc_curs_add(conn->rmb_desc->len, &cons, splbytes); +@@ -418,6 +421,8 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, + } + read_remaining -= chunk_len; + read_done += chunk_len; ++ if (flags & MSG_PEEK) ++ peeked_bytes += chunk_len; + + if (chunk_len_sum == copylen) + break; /* either on 1st or 2nd iteration */ +diff --git a/net/smc/smc_rx.h b/net/smc/smc_rx.h +index db823c97d824e..994f5e42d1ba2 100644 +--- a/net/smc/smc_rx.h ++++ b/net/smc/smc_rx.h +@@ -21,11 +21,11 @@ void smc_rx_init(struct smc_sock *smc); + + int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, + struct pipe_inode_info *pipe, size_t len, int flags); +-int smc_rx_wait(struct smc_sock *smc, long *timeo, +- int (*fcrit)(struct smc_connection *conn)); +-static inline int smc_rx_data_available(struct smc_connection *conn) ++int smc_rx_wait(struct smc_sock *smc, long *timeo, size_t peeked, ++ int (*fcrit)(struct smc_connection *conn, size_t baseline)); ++static inline int smc_rx_data_available(struct smc_connection *conn, size_t peeked) + { +- return atomic_read(&conn->bytes_to_rcv); ++ return atomic_read(&conn->bytes_to_rcv) - peeked; + } + + #endif /* SMC_RX_H */ +-- +2.39.5 + diff --git a/queue-5.15/netfilter-nft_flow_offload-update-tcp-state-flags-un.patch b/queue-5.15/netfilter-nft_flow_offload-update-tcp-state-flags-un.patch new file mode 100644 index 0000000000..f528e746e5 --- /dev/null +++ b/queue-5.15/netfilter-nft_flow_offload-update-tcp-state-flags-un.patch @@ -0,0 +1,63 @@ +From 1e3e5820139d182c38f5f07402c68fe48efaf8c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 00:50:34 +0100 +Subject: netfilter: nft_flow_offload: update tcp state flags under lock + +From: Florian Westphal + +[ Upstream commit 7a4b61406395291ffb7220a10e8951a9a8684819 ] + +The conntrack entry is already public, there is a small chance that another +CPU is handling a packet in reply direction and racing with the tcp state +update. + +Move this under ct spinlock. + +This is done once, when ct is about to be offloaded, so this should +not result in a noticeable performance hit. + +Fixes: 8437a6209f76 ("netfilter: nft_flow_offload: set liberal tracking mode for tcp") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_flow_offload.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index fbb9f3a6c8444..41d04fa12f67d 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -278,6 +278,15 @@ static bool nft_flow_offload_skip(struct sk_buff *skb, int family) + return false; + } + ++static void flow_offload_ct_tcp(struct nf_conn *ct) ++{ ++ /* conntrack will not see all packets, disable tcp window validation. */ ++ spin_lock_bh(&ct->lock); ++ ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; ++ ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; ++ spin_unlock_bh(&ct->lock); ++} ++ + static void nft_flow_offload_eval(const struct nft_expr *expr, + struct nft_regs *regs, + const struct nft_pktinfo *pkt) +@@ -332,11 +341,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + goto err_flow_alloc; + + flow_offload_route_init(flow, &route); +- +- if (tcph) { +- ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; +- ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; +- } ++ if (tcph) ++ flow_offload_ct_tcp(ct); + + ret = flow_offload_add(flowtable, flow); + if (ret < 0) +-- +2.39.5 + diff --git a/queue-5.15/nfsv4.2-fix-copy_notify-xdr-buf-size-calculation.patch b/queue-5.15/nfsv4.2-fix-copy_notify-xdr-buf-size-calculation.patch new file mode 100644 index 0000000000..bd8ac569a6 --- /dev/null +++ b/queue-5.15/nfsv4.2-fix-copy_notify-xdr-buf-size-calculation.patch @@ -0,0 +1,38 @@ +From 067ce54dc0e796699b963ab2a54201a64a633fd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 11:52:00 -0500 +Subject: NFSv4.2: fix COPY_NOTIFY xdr buf size calculation + +From: Olga Kornievskaia + +[ Upstream commit e8380c2d06055665b3df6c03964911375d7f9290 ] + +We need to include sequence size in the compound. + +Fixes: 0491567b51ef ("NFS: add COPY_NOTIFY operation") +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs42xdr.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c +index 271e5f92ed019..4d8a6f0537148 100644 +--- a/fs/nfs/nfs42xdr.c ++++ b/fs/nfs/nfs42xdr.c +@@ -122,9 +122,11 @@ + decode_putfh_maxsz + \ + decode_offload_cancel_maxsz) + #define NFS4_enc_copy_notify_sz (compound_encode_hdr_maxsz + \ ++ encode_sequence_maxsz + \ + encode_putfh_maxsz + \ + encode_copy_notify_maxsz) + #define NFS4_dec_copy_notify_sz (compound_decode_hdr_maxsz + \ ++ decode_sequence_maxsz + \ + decode_putfh_maxsz + \ + decode_copy_notify_maxsz) + #define NFS4_enc_deallocate_sz (compound_encode_hdr_maxsz + \ +-- +2.39.5 + diff --git a/queue-5.15/nfsv4.2-mark-offload_cancel-moveable.patch b/queue-5.15/nfsv4.2-mark-offload_cancel-moveable.patch new file mode 100644 index 0000000000..b489da9674 --- /dev/null +++ b/queue-5.15/nfsv4.2-mark-offload_cancel-moveable.patch @@ -0,0 +1,36 @@ +From 19f4412e8cb9c28438a823bc9b1030e3d9e1ec3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 11:52:01 -0500 +Subject: NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE + +From: Olga Kornievskaia + +[ Upstream commit 668135b9348c53fd205f5e07d11e82b10f31b55b ] + +OFFLOAD_CANCEL should be marked MOVEABLE for when we need to move +tasks off a non-functional transport. + +Fixes: c975c2092657 ("NFS send OFFLOAD_CANCEL when COPY killed") +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs42proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c +index eb347742e611b..b57e3a631b975 100644 +--- a/fs/nfs/nfs42proc.c ++++ b/fs/nfs/nfs42proc.c +@@ -541,7 +541,7 @@ static int nfs42_do_offload_cancel_async(struct file *dst, + .rpc_message = &msg, + .callback_ops = &nfs42_offload_cancel_ops, + .workqueue = nfsiod_workqueue, +- .flags = RPC_TASK_ASYNC, ++ .flags = RPC_TASK_ASYNC | RPC_TASK_MOVEABLE, + }; + int status; + +-- +2.39.5 + diff --git a/queue-5.15/nvme-add-error-check-for-xa_store-in-nvme_get_effect.patch b/queue-5.15/nvme-add-error-check-for-xa_store-in-nvme_get_effect.patch new file mode 100644 index 0000000000..a891ca39dc --- /dev/null +++ b/queue-5.15/nvme-add-error-check-for-xa_store-in-nvme_get_effect.patch @@ -0,0 +1,52 @@ +From 53851d9fe05d312a3b5c653ce6c46c0ce5e4fb34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 13:00:47 +0100 +Subject: nvme: Add error check for xa_store in nvme_get_effects_log + +From: Keisuke Nishimura + +[ Upstream commit ac32057acc7f3d7a238dafaa9b2aa2bc9750080e ] + +The xa_store() may fail due to memory allocation failure because there +is no guarantee that the index csi is already used. This fix adds an +error check of the return value of xa_store() in nvme_get_effects_log(). + +Fixes: 1cf7a12e09aa ("nvme: use an xarray to lookup the Commands Supported and Effects log") +Signed-off-by: Keisuke Nishimura +Reviewed-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 93a19588ae92a..17ba2e59fce26 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2861,7 +2861,7 @@ int nvme_get_log(struct nvme_ctrl *ctrl, u32 nsid, u8 log_page, u8 lsp, u8 csi, + static int nvme_get_effects_log(struct nvme_ctrl *ctrl, u8 csi, + struct nvme_effects_log **log) + { +- struct nvme_effects_log *cel = xa_load(&ctrl->cels, csi); ++ struct nvme_effects_log *old, *cel = xa_load(&ctrl->cels, csi); + int ret; + + if (cel) +@@ -2878,7 +2878,11 @@ static int nvme_get_effects_log(struct nvme_ctrl *ctrl, u8 csi, + return ret; + } + +- xa_store(&ctrl->cels, csi, cel, GFP_KERNEL); ++ old = xa_store(&ctrl->cels, csi, cel, GFP_KERNEL); ++ if (xa_is_err(old)) { ++ kfree(cel); ++ return xa_err(old); ++ } + out: + *log = cel; + return 0; +-- +2.39.5 + diff --git a/queue-5.15/ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch b/queue-5.15/ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch new file mode 100644 index 0000000000..0933305f51 --- /dev/null +++ b/queue-5.15/ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch @@ -0,0 +1,68 @@ +From 7c4ec9de234e6c68da39d612eb015fe5b02aa486 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jan 2025 22:06:53 +0800 +Subject: ocfs2: mark dquot as inactive if failed to start trans while + releasing dquot + +From: Su Yue + +[ Upstream commit 276c61385f6bc3223a5ecd307cf4aba2dfbb9a31 ] + +While running fstests generic/329, the kernel workqueue +quota_release_workfn is dead looping in calling ocfs2_release_dquot(). +The ocfs2 state is already readonly but ocfs2_release_dquot wants to +start a transaction but fails and returns. + +===================================================================== +[ 2918.123602 ][ T275 ] On-disk corruption discovered. Please run +fsck.ocfs2 once the filesystem is unmounted. +[ 2918.124034 ][ T275 ] (kworker/u135:1,275,11):ocfs2_release_dquot:765 +ERROR: status = -30 +[ 2918.124452 ][ T275 ] (kworker/u135:1,275,11):ocfs2_release_dquot:795 +ERROR: status = -30 +[ 2918.124883 ][ T275 ] (kworker/u135:1,275,11):ocfs2_start_trans:357 +ERROR: status = -30 +[ 2918.125276 ][ T275 ] OCFS2: abort (device dm-0): ocfs2_start_trans: +Detected aborted journal +[ 2918.125710 ][ T275 ] On-disk corruption discovered. Please run +fsck.ocfs2 once the filesystem is unmounted. +===================================================================== + +ocfs2_release_dquot() is much like dquot_release(), which is called by +ext4 to handle similar situation. So here fix it by marking the dquot as +inactive like what dquot_release() does. + +Link: https://lkml.kernel.org/r/20250106140653.92292-1-glass.su@suse.com +Fixes: 9e33d69f553a ("ocfs2: Implementation of local and global quota file handling") +Signed-off-by: Su Yue +Reviewed-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/quota_global.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c +index cc464c9560e25..79e70aaa9a90d 100644 +--- a/fs/ocfs2/quota_global.c ++++ b/fs/ocfs2/quota_global.c +@@ -749,6 +749,11 @@ static int ocfs2_release_dquot(struct dquot *dquot) + handle = ocfs2_start_trans(osb, + ocfs2_calc_qdel_credits(dquot->dq_sb, dquot->dq_id.type)); + if (IS_ERR(handle)) { ++ /* ++ * Mark dquot as inactive to avoid endless cycle in ++ * quota_release_workfn(). ++ */ ++ clear_bit(DQ_ACTIVE_B, &dquot->dq_flags); + status = PTR_ERR(handle); + mlog_errno(status); + goto out_ilock; +-- +2.39.5 + diff --git a/queue-5.15/of-reserved-memory-do-not-make-kmemleak-ignore-freed.patch b/queue-5.15/of-reserved-memory-do-not-make-kmemleak-ignore-freed.patch new file mode 100644 index 0000000000..115ff6d258 --- /dev/null +++ b/queue-5.15/of-reserved-memory-do-not-make-kmemleak-ignore-freed.patch @@ -0,0 +1,48 @@ +From 15fe79ca4d988a2c08ba2d181012b5a67aa00879 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 21:27:01 +0800 +Subject: of: reserved-memory: Do not make kmemleak ignore freed address + +From: Zijun Hu + +[ Upstream commit 29091a52562bca4d6e678dd8f0085dac119d6a21 ] + +early_init_dt_alloc_reserved_memory_arch() will free address @base when +suffers memblock_mark_nomap() error, but it still makes kmemleak ignore +the freed address @base via kmemleak_ignore_phys(). + +That is unnecessary, besides, also causes unnecessary warning messages: + +kmemleak_ignore_phys() + -> make_black_object() + -> paint_ptr() + -> kmemleak_warn() // warning message here. + +Fix by avoiding kmemleak_ignore_phys() when suffer the error. + +Fixes: 658aafc8139c ("memblock: exclude MEMBLOCK_NOMAP regions from kmemleak") +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/r/20250109-of_core_fix-v4-10-db8a72415b8c@quicinc.com +Signed-off-by: Rob Herring (Arm) +Signed-off-by: Sasha Levin +--- + drivers/of/of_reserved_mem.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c +index 6ec668ae2d6fa..8d6ca796d9ffa 100644 +--- a/drivers/of/of_reserved_mem.c ++++ b/drivers/of/of_reserved_mem.c +@@ -50,7 +50,8 @@ static int __init early_init_dt_alloc_reserved_memory_arch(phys_addr_t size, + memblock_free(base, size); + } + +- kmemleak_ignore_phys(base); ++ if (!err) ++ kmemleak_ignore_phys(base); + + return err; + } +-- +2.39.5 + diff --git a/queue-5.15/padata-add-pd-get-put-refcnt-helper.patch b/queue-5.15/padata-add-pd-get-put-refcnt-helper.patch new file mode 100644 index 0000000000..fe892daea8 --- /dev/null +++ b/queue-5.15/padata-add-pd-get-put-refcnt-helper.patch @@ -0,0 +1,89 @@ +From 477eaee439b1528227a25038588ed7b14e8fc28c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 06:16:37 +0000 +Subject: padata: add pd get/put refcnt helper + +From: Chen Ridong + +[ Upstream commit ae154202cc6a189b035359f3c4e143d5c24d5352 ] + +Add helpers for pd to get/put refcnt to make code consice. + +Signed-off-by: Chen Ridong +Acked-by: Daniel Jordan +Signed-off-by: Herbert Xu +Stable-dep-of: dd7d37ccf6b1 ("padata: avoid UAF for reorder_work") +Signed-off-by: Sasha Levin +--- + kernel/padata.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/kernel/padata.c b/kernel/padata.c +index 9608a269f66f2..b5a1a31ce6c11 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -47,6 +47,22 @@ struct padata_mt_job_state { + static void padata_free_pd(struct parallel_data *pd); + static void __init padata_mt_helper(struct work_struct *work); + ++static inline void padata_get_pd(struct parallel_data *pd) ++{ ++ refcount_inc(&pd->refcnt); ++} ++ ++static inline void padata_put_pd_cnt(struct parallel_data *pd, int cnt) ++{ ++ if (refcount_sub_and_test(cnt, &pd->refcnt)) ++ padata_free_pd(pd); ++} ++ ++static inline void padata_put_pd(struct parallel_data *pd) ++{ ++ padata_put_pd_cnt(pd, 1); ++} ++ + static int padata_index_to_cpu(struct parallel_data *pd, int cpu_index) + { + int cpu, target_cpu; +@@ -198,7 +214,7 @@ int padata_do_parallel(struct padata_shell *ps, + if ((pinst->flags & PADATA_RESET)) + goto out; + +- refcount_inc(&pd->refcnt); ++ padata_get_pd(pd); + padata->pd = pd; + padata->cb_cpu = *cb_cpu; + +@@ -372,8 +388,7 @@ static void padata_serial_worker(struct work_struct *serial_work) + } + local_bh_enable(); + +- if (refcount_sub_and_test(cnt, &pd->refcnt)) +- padata_free_pd(pd); ++ padata_put_pd_cnt(pd, cnt); + } + + /** +@@ -670,8 +685,7 @@ static int padata_replace(struct padata_instance *pinst) + synchronize_rcu(); + + list_for_each_entry_continue_reverse(ps, &pinst->pslist, list) +- if (refcount_dec_and_test(&ps->opd->refcnt)) +- padata_free_pd(ps->opd); ++ padata_put_pd(ps->opd); + + pinst->flags &= ~PADATA_RESET; + +@@ -1119,8 +1133,7 @@ void padata_free_shell(struct padata_shell *ps) + mutex_lock(&ps->pinst->lock); + list_del(&ps->list); + pd = rcu_dereference_protected(ps->pd, 1); +- if (refcount_dec_and_test(&pd->refcnt)) +- padata_free_pd(pd); ++ padata_put_pd(pd); + mutex_unlock(&ps->pinst->lock); + + kfree(ps); +-- +2.39.5 + diff --git a/queue-5.15/padata-avoid-uaf-for-reorder_work.patch b/queue-5.15/padata-avoid-uaf-for-reorder_work.patch new file mode 100644 index 0000000000..a2b443246b --- /dev/null +++ b/queue-5.15/padata-avoid-uaf-for-reorder_work.patch @@ -0,0 +1,91 @@ +From cef6ef13a942f6c01f3c3f9d849ad5298bb6c952 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 06:16:39 +0000 +Subject: padata: avoid UAF for reorder_work + +From: Chen Ridong + +[ Upstream commit dd7d37ccf6b11f3d95e797ebe4e9e886d0332600 ] + +Although the previous patch can avoid ps and ps UAF for _do_serial, it +can not avoid potential UAF issue for reorder_work. This issue can +happen just as below: + +crypto_request crypto_request crypto_del_alg +padata_do_serial + ... + padata_reorder + // processes all remaining + // requests then breaks + while (1) { + if (!padata) + break; + ... + } + + padata_do_serial + // new request added + list_add + // sees the new request + queue_work(reorder_work) + padata_reorder + queue_work_on(squeue->work) +... + + + padata_serial_worker + // completes new request, + // no more outstanding + // requests + + crypto_del_alg + // free pd + + +invoke_padata_reorder + // UAF of pd + +To avoid UAF for 'reorder_work', get 'pd' ref before put 'reorder_work' +into the 'serial_wq' and put 'pd' ref until the 'serial_wq' finish. + +Fixes: bbefa1dd6a6d ("crypto: pcrypt - Avoid deadlock by using per-instance padata queues") +Signed-off-by: Chen Ridong +Acked-by: Daniel Jordan +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + kernel/padata.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/kernel/padata.c b/kernel/padata.c +index b5a1a31ce6c11..db45af7728cb2 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -344,8 +344,14 @@ static void padata_reorder(struct parallel_data *pd) + smp_mb(); + + reorder = per_cpu_ptr(pd->reorder_list, pd->cpu); +- if (!list_empty(&reorder->list) && padata_find_next(pd, false)) ++ if (!list_empty(&reorder->list) && padata_find_next(pd, false)) { ++ /* ++ * Other context(eg. the padata_serial_worker) can finish the request. ++ * To avoid UAF issue, add pd ref here, and put pd ref after reorder_work finish. ++ */ ++ padata_get_pd(pd); + queue_work(pinst->serial_wq, &pd->reorder_work); ++ } + } + + static void invoke_padata_reorder(struct work_struct *work) +@@ -356,6 +362,8 @@ static void invoke_padata_reorder(struct work_struct *work) + pd = container_of(work, struct parallel_data, reorder_work); + padata_reorder(pd); + local_bh_enable(); ++ /* Pairs with putting the reorder_work in the serial_wq */ ++ padata_put_pd(pd); + } + + static void padata_serial_worker(struct work_struct *serial_work) +-- +2.39.5 + diff --git a/queue-5.15/padata-fix-sysfs-store-callback-check.patch b/queue-5.15/padata-fix-sysfs-store-callback-check.patch new file mode 100644 index 0000000000..1fb988ceae --- /dev/null +++ b/queue-5.15/padata-fix-sysfs-store-callback-check.patch @@ -0,0 +1,40 @@ +From c2910c3a04981bd1733ac44cb4d3a67c59196b74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2024 23:32:01 +0100 +Subject: padata: fix sysfs store callback check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 9ff6e943bce67d125781fe4780a5d6f072dc44c0 ] + +padata_sysfs_store() was copied from padata_sysfs_show() but this check +was not adapted. Today there is no attribute which can fail this +check, but if there is one it may as well be correct. + +Fixes: 5e017dc3f8bc ("padata: Added sysfs primitives to padata subsystem") +Signed-off-by: Thomas Weißschuh +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + kernel/padata.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/padata.c b/kernel/padata.c +index 39faea30d76a5..a5699c5ba58da 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -959,7 +959,7 @@ static ssize_t padata_sysfs_store(struct kobject *kobj, struct attribute *attr, + + pinst = kobj2pinst(kobj); + pentry = attr2pentry(attr); +- if (pentry->show) ++ if (pentry->store) + ret = pentry->store(pinst, attr, buf, count); + + return ret; +-- +2.39.5 + diff --git a/queue-5.15/padata-fix-uaf-in-padata_reorder.patch b/queue-5.15/padata-fix-uaf-in-padata_reorder.patch new file mode 100644 index 0000000000..168c565d6a --- /dev/null +++ b/queue-5.15/padata-fix-uaf-in-padata_reorder.patch @@ -0,0 +1,94 @@ +From 9c30f92e04ec19a6640dbf9504232bdb01d9596d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 06:16:38 +0000 +Subject: padata: fix UAF in padata_reorder + +From: Chen Ridong + +[ Upstream commit e01780ea4661172734118d2a5f41bc9720765668 ] + +A bug was found when run ltp test: + +BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 +Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 + +CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ +Workqueue: pdecrypt_parallel padata_parallel_worker +Call Trace: + +dump_stack_lvl+0x32/0x50 +print_address_description.constprop.0+0x6b/0x3d0 +print_report+0xdd/0x2c0 +kasan_report+0xa5/0xd0 +padata_find_next+0x29/0x1a0 +padata_reorder+0x131/0x220 +padata_parallel_worker+0x3d/0xc0 +process_one_work+0x2ec/0x5a0 + +If 'mdelay(10)' is added before calling 'padata_find_next' in the +'padata_reorder' function, this issue could be reproduced easily with +ltp test (pcrypt_aead01). + +This can be explained as bellow: + +pcrypt_aead_encrypt +... +padata_do_parallel +refcount_inc(&pd->refcnt); // add refcnt +... +padata_do_serial +padata_reorder // pd +while (1) { +padata_find_next(pd, true); // using pd +queue_work_on +... +padata_serial_worker crypto_del_alg +padata_put_pd_cnt // sub refcnt + padata_free_shell + padata_put_pd(ps->pd); + // pd is freed +// loop again, but pd is freed +// call padata_find_next, UAF +} + +In the padata_reorder function, when it loops in 'while', if the alg is +deleted, the refcnt may be decreased to 0 before entering +'padata_find_next', which leads to UAF. + +As mentioned in [1], do_serial is supposed to be called with BHs disabled +and always happen under RCU protection, to address this issue, add +synchronize_rcu() in 'padata_free_shell' wait for all _do_serial calls +to finish. + +[1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.localdomain/ +[2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofeiczqmqs2m7o6@fq426cwnjtkm/ +Fixes: b128a3040935 ("padata: allocate workqueue internally") +Signed-off-by: Chen Ridong +Signed-off-by: Qu Zicheng +Acked-by: Daniel Jordan +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + kernel/padata.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/kernel/padata.c b/kernel/padata.c +index a5699c5ba58da..9608a269f66f2 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -1110,6 +1110,12 @@ void padata_free_shell(struct padata_shell *ps) + if (!ps) + return; + ++ /* ++ * Wait for all _do_serial calls to finish to avoid touching ++ * freed pd's and ps's. ++ */ ++ synchronize_rcu(); ++ + mutex_lock(&ps->pinst->lock); + list_del(&ps->list); + pd = rcu_dereference_protected(ps->pd, 1); +-- +2.39.5 + diff --git a/queue-5.15/partitions-ldm-remove-the-initial-kernel-doc-notatio.patch b/queue-5.15/partitions-ldm-remove-the-initial-kernel-doc-notatio.patch new file mode 100644 index 0000000000..6b04ea3275 --- /dev/null +++ b/queue-5.15/partitions-ldm-remove-the-initial-kernel-doc-notatio.patch @@ -0,0 +1,41 @@ +From efff3e01d7a2bf182f5dc32d1913f834fda27f15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 22:27:58 -0800 +Subject: partitions: ldm: remove the initial kernel-doc notation + +From: Randy Dunlap + +[ Upstream commit e494e451611a3de6ae95f99e8339210c157d70fb ] + +Remove the file's first comment describing what the file is. +This comment is not in kernel-doc format so it causes a kernel-doc +warning. + +ldm.h:13: warning: expecting prototype for ldm(). Prototype was for _FS_PT_LDM_H_() instead + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Randy Dunlap +Cc: Richard Russon (FlatCap) +Cc: linux-ntfs-dev@lists.sourceforge.net +Cc: Jens Axboe +Link: https://lore.kernel.org/r/20250111062758.910458-1-rdunlap@infradead.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/partitions/ldm.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/partitions/ldm.h b/block/partitions/ldm.h +index 8693704dcf5e9..84a66b51cd2ab 100644 +--- a/block/partitions/ldm.h ++++ b/block/partitions/ldm.h +@@ -1,5 +1,5 @@ + // SPDX-License-Identifier: GPL-2.0-or-later +-/** ++/* + * ldm - Part of the Linux-NTFS project. + * + * Copyright (C) 2001,2002 Richard Russon +-- +2.39.5 + diff --git a/queue-5.15/pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch b/queue-5.15/pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch new file mode 100644 index 0000000000..c89a138931 --- /dev/null +++ b/queue-5.15/pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch @@ -0,0 +1,43 @@ +From 62315b61cf0e5ea8d322bedc0546715dde486730 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 22:00:18 +0800 +Subject: PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() + +From: Zijun Hu + +[ Upstream commit d4929755e4d02bd3de3ae5569dab69cb9502c54f ] + +The devm_pci_epc_destroy() comment says destroys the EPC device, but it +does not actually do that since devres_destroy() does not call +devm_pci_epc_release(), and it also can not fully undo what the API +devm_pci_epc_create() does, so it is faulty. + +Fortunately, the faulty API has not been used by current kernel tree. Use +devres_release() instead of devres_destroy() so the EPC device will be +released. + +Link: https://lore.kernel.org/r/20241210-pci-epc-core_fix-v3-1-4d86dd573e4b@quicinc.com +Fixes: 5e8cb4033807 ("PCI: endpoint: Add EP core layer to enable EP controller and EP functions") +Signed-off-by: Zijun Hu +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/pci-epc-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/endpoint/pci-epc-core.c b/drivers/pci/endpoint/pci-epc-core.c +index ecbb0fb3b653c..64f9bae6d15b9 100644 +--- a/drivers/pci/endpoint/pci-epc-core.c ++++ b/drivers/pci/endpoint/pci-epc-core.c +@@ -740,7 +740,7 @@ void devm_pci_epc_destroy(struct device *dev, struct pci_epc *epc) + { + int r; + +- r = devres_destroy(dev, devm_pci_epc_release, devm_pci_epc_match, ++ r = devres_release(dev, devm_pci_epc_release, devm_pci_epc_match, + epc); + dev_WARN_ONCE(dev, r, "couldn't find PCI EPC resource\n"); + } +-- +2.39.5 + diff --git a/queue-5.15/pci-rcar-ep-fix-incorrect-variable-used-when-calling.patch b/queue-5.15/pci-rcar-ep-fix-incorrect-variable-used-when-calling.patch new file mode 100644 index 0000000000..11ca39a022 --- /dev/null +++ b/queue-5.15/pci-rcar-ep-fix-incorrect-variable-used-when-calling.patch @@ -0,0 +1,69 @@ +From 3b70c5d878ec0d0dce6d10081b953e88fe9eddc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 08:50:18 +0800 +Subject: PCI: rcar-ep: Fix incorrect variable used when calling + devm_request_mem_region() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: King Dix + +[ Upstream commit 2d2da5a4c1b4509f6f7e5a8db015cd420144beb4 ] + +The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() +macro to request a needed resource. A string variable that lives on the +stack is then used to store a dynamically computed resource name, which +is then passed on as one of the macro arguments. This can lead to +undefined behavior. + +Depending on the current contents of the memory, the manifestations of +errors may vary. One possible output may be as follows: + + $ cat /proc/iomem + 30000000-37ffffff : + 38000000-3fffffff : + +Sometimes, garbage may appear after the colon. + +In very rare cases, if no NULL-terminator is found in memory, the system +might crash because the string iterator will overrun which can lead to +access of unmapped memory above the stack. + +Thus, fix this by replacing outbound_name with the name of the previously +requested resource. With the changes applied, the output will be as +follows: + + $ cat /proc/iomem + 30000000-37ffffff : memory2 + 38000000-3fffffff : memory3 + +Fixes: 2a6d0d63d999 ("PCI: rcar: Add endpoint mode support") +Link: https://lore.kernel.org/r/tencent_DBDCC19D60F361119E76919ADAB25EC13C06@qq.com +Tested-by: Lad Prabhakar +Signed-off-by: King Dix +[kwilczynski: commit log] +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Lad Prabhakar +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-rcar-ep.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pcie-rcar-ep.c b/drivers/pci/controller/pcie-rcar-ep.c +index aa1cf24a5a723..c143ee1740ce7 100644 +--- a/drivers/pci/controller/pcie-rcar-ep.c ++++ b/drivers/pci/controller/pcie-rcar-ep.c +@@ -110,7 +110,7 @@ static int rcar_pcie_parse_outbound_ranges(struct rcar_pcie_endpoint *ep, + } + if (!devm_request_mem_region(&pdev->dev, res->start, + resource_size(res), +- outbound_name)) { ++ res->name)) { + dev_err(pcie->dev, "Cannot request memory region %s.\n", + outbound_name); + return -EIO; +-- +2.39.5 + diff --git a/queue-5.15/perf-bpf-fix-two-memory-leakages-when-calling-perf_e.patch b/queue-5.15/perf-bpf-fix-two-memory-leakages-when-calling-perf_e.patch new file mode 100644 index 0000000000..36df3424c4 --- /dev/null +++ b/queue-5.15/perf-bpf-fix-two-memory-leakages-when-calling-perf_e.patch @@ -0,0 +1,105 @@ +From f584cbe9d6e977cf8ddc305b62bf136a2e326109 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 16:45:00 +0800 +Subject: perf bpf: Fix two memory leakages when calling + perf_env__insert_bpf_prog_info() + +From: Zhongqiu Han + +[ Upstream commit 03edb7020bb920f1935c3f30acad0bb27fdb99af ] + +If perf_env__insert_bpf_prog_info() returns false due to a duplicate bpf +prog info node insertion, the temporary info_node and info_linear memory +will leak. Add a check to ensure the memory is freed if the function +returns false. + +Fixes: d56354dc49091e33 ("perf tools: Save bpf_prog_info and BTF of new BPF programs") +Reviewed-by: Namhyung Kim +Signed-off-by: Zhongqiu Han +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Yicong Yang +Link: https://lore.kernel.org/r/20241205084500.823660-4-quic_zhonhan@quicinc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-event.c | 10 ++++++++-- + tools/perf/util/env.c | 8 ++++++-- + tools/perf/util/env.h | 2 +- + 3 files changed, 15 insertions(+), 5 deletions(-) + +diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c +index ce74bc367e9c4..41b889ab4d6ab 100644 +--- a/tools/perf/util/bpf-event.c ++++ b/tools/perf/util/bpf-event.c +@@ -300,7 +300,10 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session, + } + + info_node->info_linear = info_linear; +- perf_env__insert_bpf_prog_info(env, info_node); ++ if (!perf_env__insert_bpf_prog_info(env, info_node)) { ++ free(info_linear); ++ free(info_node); ++ } + info_linear = NULL; + + /* +@@ -488,7 +491,10 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) + info_node = malloc(sizeof(struct bpf_prog_info_node)); + if (info_node) { + info_node->info_linear = info_linear; +- perf_env__insert_bpf_prog_info(env, info_node); ++ if (!perf_env__insert_bpf_prog_info(env, info_node)) { ++ free(info_linear); ++ free(info_node); ++ } + } else + free(info_linear); + +diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c +index e6f8d3b0ef8a6..6903accf3a5c4 100644 +--- a/tools/perf/util/env.c ++++ b/tools/perf/util/env.c +@@ -18,12 +18,16 @@ struct perf_env perf_env; + #include "bpf-event.h" + #include + +-void perf_env__insert_bpf_prog_info(struct perf_env *env, ++bool perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node) + { ++ bool ret; ++ + down_write(&env->bpf_progs.lock); +- __perf_env__insert_bpf_prog_info(env, info_node); ++ ret = __perf_env__insert_bpf_prog_info(env, info_node); + up_write(&env->bpf_progs.lock); ++ ++ return ret; + } + + bool __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node) +diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h +index e098ee49237c4..5385104ca989a 100644 +--- a/tools/perf/util/env.h ++++ b/tools/perf/util/env.h +@@ -165,7 +165,7 @@ int perf_env__nr_cpus_avail(struct perf_env *env); + void perf_env__init(struct perf_env *env); + bool __perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node); +-void perf_env__insert_bpf_prog_info(struct perf_env *env, ++bool perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node); + struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, + __u32 prog_id); +-- +2.39.5 + diff --git a/queue-5.15/perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch b/queue-5.15/perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch new file mode 100644 index 0000000000..64d6eb1d69 --- /dev/null +++ b/queue-5.15/perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch @@ -0,0 +1,51 @@ +From 9f48a03eae5be56b9be5971df50abccd4d060a99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 16:44:58 +0800 +Subject: perf header: Fix one memory leakage in process_bpf_btf() + +From: Zhongqiu Han + +[ Upstream commit 875d22980a062521beed7b5df71fb13a1af15d83 ] + +If __perf_env__insert_btf() returns false due to a duplicate btf node +insertion, the temporary node will leak. Add a check to ensure the memory +is freed if the function returns false. + +Fixes: a70a1123174ab592 ("perf bpf: Save BTF information as headers to perf.data") +Reviewed-by: Namhyung Kim +Signed-off-by: Zhongqiu Han +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Yicong Yang +Link: https://lore.kernel.org/r/20241205084500.823660-2-quic_zhonhan@quicinc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/header.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index 8b0a8ac7afefd..7937ff460c446 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -3120,7 +3120,8 @@ static int process_bpf_btf(struct feat_fd *ff, void *data __maybe_unused) + if (__do_read(ff, node->data, data_size)) + goto out; + +- __perf_env__insert_btf(env, node); ++ if (!__perf_env__insert_btf(env, node)) ++ free(node); + node = NULL; + } + +-- +2.39.5 + diff --git a/queue-5.15/perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch b/queue-5.15/perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch new file mode 100644 index 0000000000..cacb8fbbe9 --- /dev/null +++ b/queue-5.15/perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch @@ -0,0 +1,99 @@ +From f15ce55dd0f927b8d55e3c3495bd415778aea520 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 16:44:59 +0800 +Subject: perf header: Fix one memory leakage in process_bpf_prog_info() + +From: Zhongqiu Han + +[ Upstream commit a7da6c7030e1aec32f0a41c7b4fa70ec96042019 ] + +Function __perf_env__insert_bpf_prog_info() will return without inserting +bpf prog info node into perf env again due to a duplicate bpf prog info +node insertion, causing the temporary info_linear and info_node memory to +leak. Modify the return type of this function to bool and add a check to +ensure the memory is freed if the function returns false. + +Fixes: 606f972b1361f477 ("perf bpf: Save bpf_prog_info information as headers to perf.data") +Reviewed-by: Namhyung Kim +Signed-off-by: Zhongqiu Han +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Yicong Yang +Link: https://lore.kernel.org/r/20241205084500.823660-3-quic_zhonhan@quicinc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/env.c | 5 +++-- + tools/perf/util/env.h | 2 +- + tools/perf/util/header.c | 5 ++++- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c +index d3d67ce70f556..e6f8d3b0ef8a6 100644 +--- a/tools/perf/util/env.c ++++ b/tools/perf/util/env.c +@@ -26,7 +26,7 @@ void perf_env__insert_bpf_prog_info(struct perf_env *env, + up_write(&env->bpf_progs.lock); + } + +-void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node) ++bool __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node) + { + __u32 prog_id = info_node->info_linear->info.id; + struct bpf_prog_info_node *node; +@@ -44,13 +44,14 @@ void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info + p = &(*p)->rb_right; + } else { + pr_debug("duplicated bpf prog info %u\n", prog_id); +- return; ++ return false; + } + } + + rb_link_node(&info_node->rb_node, parent, p); + rb_insert_color(&info_node->rb_node, &env->bpf_progs.infos); + env->bpf_progs.infos_cnt++; ++ return true; + } + + struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, +diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h +index 192318054e12f..e098ee49237c4 100644 +--- a/tools/perf/util/env.h ++++ b/tools/perf/util/env.h +@@ -163,7 +163,7 @@ const char *perf_env__raw_arch(struct perf_env *env); + int perf_env__nr_cpus_avail(struct perf_env *env); + + void perf_env__init(struct perf_env *env); +-void __perf_env__insert_bpf_prog_info(struct perf_env *env, ++bool __perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node); + void perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node); +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index 7937ff460c446..3e18acb719324 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -3073,7 +3073,10 @@ static int process_bpf_prog_info(struct feat_fd *ff, void *data __maybe_unused) + /* after reading from file, translate offset to address */ + bpf_program__bpil_offs_to_addr(info_linear); + info_node->info_linear = info_linear; +- __perf_env__insert_bpf_prog_info(env, info_node); ++ if (!__perf_env__insert_bpf_prog_info(env, info_node)) { ++ free(info_linear); ++ free(info_node); ++ } + } + + up_write(&env->bpf_progs.lock); +-- +2.39.5 + diff --git a/queue-5.15/perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch b/queue-5.15/perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch new file mode 100644 index 0000000000..8074d72084 --- /dev/null +++ b/queue-5.15/perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch @@ -0,0 +1,68 @@ +From dae45e485a8de2d006de4fdfdba3693ff7e0ac1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 10:15:24 +0100 +Subject: perf machine: Don't ignore _etext when not a text symbol + +From: Christophe Leroy + +[ Upstream commit 7a93786c306296f15e728b1dbd949a319e4e3d19 ] + +Depending on how vmlinux.lds is written, _etext might be the very first +data symbol instead of the very last text symbol. + +Don't require it to be a text symbol, accept any symbol type. + +Comitter notes: + +See the first Link for further discussion, but it all boils down to +this: + + --- + # grep -e _stext -e _etext -e _edata /proc/kallsyms + c0000000 T _stext + c08b8000 D _etext + + So there is no _edata and _etext is not text + + $ ppc-linux-objdump -x vmlinux | grep -e _stext -e _etext -e _edata + c0000000 g .head.text 00000000 _stext + c08b8000 g .rodata 00000000 _etext + c1378000 g .sbss 00000000 _edata + --- + +Fixes: ed9adb2035b5be58 ("perf machine: Read also the end of the kernel") +Signed-off-by: Christophe Leroy +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: linuxppc-dev@lists.ozlabs.org +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Link: https://lore.kernel.org/r/b3ee1994d95257cb7f2de037c5030ba7d1bed404.1736327613.git.christophe.leroy@csgroup.eu +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/machine.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c +index 697652b1fc03e..6c22a0a244896 100644 +--- a/tools/perf/util/machine.c ++++ b/tools/perf/util/machine.c +@@ -1068,7 +1068,7 @@ static int machine__get_running_kernel_start(struct machine *machine, + + err = kallsyms__get_symbol_start(filename, "_edata", &addr); + if (err) +- err = kallsyms__get_function_start(filename, "_etext", &addr); ++ err = kallsyms__get_symbol_start(filename, "_etext", &addr); + if (!err) + *end = addr; + +-- +2.39.5 + diff --git a/queue-5.15/perf-machine-include-data-symbols-in-the-kernel-map.patch b/queue-5.15/perf-machine-include-data-symbols-in-the-kernel-map.patch new file mode 100644 index 0000000000..b89c7ae41d --- /dev/null +++ b/queue-5.15/perf-machine-include-data-symbols-in-the-kernel-map.patch @@ -0,0 +1,77 @@ +From 63d2dad959f6dd55de8e46291e26e73f8146daa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 17:19:29 -0700 +Subject: perf machine: Include data symbols in the kernel map + +From: Namhyung Kim + +[ Upstream commit 69a87a32f5cd8b262cb2195b045f96c63aede734 ] + +When 'perf record -d' is used, it needs data mmaps to symbolize global +data. But it missed to collect kernel data maps so it cannot symbolize +them. Instead of having a separate map, just increase the kernel map +size to include the data section. + +Probably we can have a separate kernel map for data, but the current +code assumes a single kernel map. So it'd require more changes in other +places and looks error-prone. I decided not to go that way for now. + +Also it seems the kernel module size already includes the data section. + +For example, my system has the following. + + $ grep -e _stext -e _etext -e _edata /proc/kallsyms + ffffffff99800000 T _stext + ffffffff9a601ac8 T _etext + ffffffff9b446a00 D _edata + +Size of the text section is (0x9a601ac8 - 0x99800000 = 0xe01ac8) and +size including data section is (0x9b446a00 - 0x99800000 = 0x1c46a00). + +Before: + $ perf record -d true + + $ perf report -D | grep MMAP | head -1 + 0 0 0x460 [0x60]: PERF_RECORD_MMAP -1/0: [0xffffffff99800000(0xe01ac8) @ 0xffffffff99800000]: x [kernel.kallsyms]_text + ^^^^^^^^ + here +After: + $ perf report -D | grep MMAP | head -1 + 0 0 0x460 [0x60]: PERF_RECORD_MMAP -1/0: [0xffffffff99800000(0x1c46a00) @ 0xffffffff99800000]: x [kernel.kallsyms]_text + ^^^^^^^^^ + +Instead of just replacing it to _edata, try _edata first and then fall +back to _etext just in case. + +Signed-off-by: Namhyung Kim +Acked-by: Adrian Hunter +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20230725001929.368041-2-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 7a93786c3062 ("perf machine: Don't ignore _etext when not a text symbol") +Signed-off-by: Sasha Levin +--- + tools/perf/util/machine.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c +index a0df9d24b2cb4..697652b1fc03e 100644 +--- a/tools/perf/util/machine.c ++++ b/tools/perf/util/machine.c +@@ -1066,7 +1066,9 @@ static int machine__get_running_kernel_start(struct machine *machine, + + *start = addr; + +- err = kallsyms__get_function_start(filename, "_etext", &addr); ++ err = kallsyms__get_symbol_start(filename, "_edata", &addr); ++ if (err) ++ err = kallsyms__get_function_start(filename, "_etext", &addr); + if (!err) + *end = addr; + +-- +2.39.5 + diff --git a/queue-5.15/perf-report-fix-misleading-help-message-about-demang.patch b/queue-5.15/perf-report-fix-misleading-help-message-about-demang.patch new file mode 100644 index 0000000000..b5e96dd795 --- /dev/null +++ b/queue-5.15/perf-report-fix-misleading-help-message-about-demang.patch @@ -0,0 +1,46 @@ +From 774c12d8b8443dba91e73aa6bd50d3c9ddb3a315 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 23:22:19 +0800 +Subject: perf report: Fix misleading help message about --demangle + +From: Jiachen Zhang + +[ Upstream commit ac0ac75189a4d6a29a2765a7adbb62bc6cc650c7 ] + +The wrong help message may mislead users. This commit fixes it. + +Fixes: 328ccdace8855289 ("perf report: Add --no-demangle option") +Reviewed-by: Namhyung Kim +Signed-off-by: Jiachen Zhang +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20250109152220.1869581-1-me@jcix.top +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-report.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index 6583ad9cc7deb..c52b321e22ccf 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -1308,7 +1308,7 @@ int cmd_report(int argc, const char **argv) + OPT_STRING(0, "objdump", &report.annotation_opts.objdump_path, "path", + "objdump binary to use for disassembly and annotations"), + OPT_BOOLEAN(0, "demangle", &symbol_conf.demangle, +- "Disable symbol demangling"), ++ "Symbol demangling. Enabled by default, use --no-demangle to disable."), + OPT_BOOLEAN(0, "demangle-kernel", &symbol_conf.demangle_kernel, + "Enable kernel symbol demangling"), + OPT_BOOLEAN(0, "mem-mode", &report.mem_mode, "mem access profile"), +-- +2.39.5 + diff --git a/queue-5.15/perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch b/queue-5.15/perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch new file mode 100644 index 0000000000..11912a50f0 --- /dev/null +++ b/queue-5.15/perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch @@ -0,0 +1,64 @@ +From d0194e4f91a6a3dea2b41e730ea8fdd8b039d2f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jan 2025 16:50:39 -0300 +Subject: perf top: Don't complain about lack of vmlinux when not resolving + some kernel samples + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 058b38ccd2af9e5c95590b018e8425fa148d7aca ] + +Recently we got a case where a kernel sample wasn't being resolved due +to a bug that was not setting the end address on kernel functions +implemented in assembly (see Link: tag), and then those were not being +found by machine__resolve() -> map__find_symbol(). + +So we ended up with: + + # perf top --stdio + PerfTop: 0 irqs/s kernel: 0% exact: 0% lost: 0/0 drop: 0/0 [cycles/P] + ----------------------------------------------------------------------- + + Warning: + A vmlinux file was not found. + Kernel samples will not be resolved. + ^Z + [1]+ Stopped perf top --stdio + # + +But then resolving all other kernel symbols. + +So just fixup the logic to only print that warning when there are no +symbols in the kernel map. + +Fixes: d88205db9caa0e9d ("perf dso: Add dso__has_symbols() method") +Reviewed-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Christophe Leroy +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Link: https://lore.kernel.org/lkml/Z3buKhcCsZi3_aGb@x1 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-top.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c +index 6fdd401ec9c56..b318ce937e629 100644 +--- a/tools/perf/builtin-top.c ++++ b/tools/perf/builtin-top.c +@@ -807,7 +807,7 @@ static void perf_event__process_sample(struct perf_tool *tool, + * invalid --vmlinux ;-) + */ + if (!machine->kptr_restrict_warned && !top->vmlinux_warned && +- __map__is_kernel(al.map) && map__has_symbols(al.map)) { ++ __map__is_kernel(al.map) && !map__has_symbols(al.map)) { + if (symbol_conf.vmlinux_name) { + char serr[256]; + dso__strerror_load(al.map->dso, serr, sizeof(serr)); +-- +2.39.5 + diff --git a/queue-5.15/perf-trace-fix-runtime-error-of-index-out-of-bounds.patch b/queue-5.15/perf-trace-fix-runtime-error-of-index-out-of-bounds.patch new file mode 100644 index 0000000000..ec9cade9f5 --- /dev/null +++ b/queue-5.15/perf-trace-fix-runtime-error-of-index-out-of-bounds.patch @@ -0,0 +1,63 @@ +From b1df251740f43fc99a44be2cc19ff0ca50852938 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jan 2025 18:55:19 -0800 +Subject: perf trace: Fix runtime error of index out of bounds + +From: Howard Chu + +[ Upstream commit c7b87ce0dd10b64b68a0b22cb83bbd556e28fe81 ] + +libtraceevent parses and returns an array of argument fields, sometimes +larger than RAW_SYSCALL_ARGS_NUM (6) because it includes "__syscall_nr", +idx will traverse to index 6 (7th element) whereas sc->fmt->arg holds 6 +elements max, creating an out-of-bounds access. This runtime error is +found by UBsan. The error message: + + $ sudo UBSAN_OPTIONS=print_stacktrace=1 ./perf trace -a --max-events=1 + builtin-trace.c:1966:35: runtime error: index 6 out of bounds for type 'syscall_arg_fmt [6]' + #0 0x5c04956be5fe in syscall__alloc_arg_fmts /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:1966 + #1 0x5c04956c0510 in trace__read_syscall_info /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:2110 + #2 0x5c04956c372b in trace__syscall_info /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:2436 + #3 0x5c04956d2f39 in trace__init_syscalls_bpf_prog_array_maps /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:3897 + #4 0x5c04956d6d25 in trace__run /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:4335 + #5 0x5c04956e112e in cmd_trace /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:5502 + #6 0x5c04956eda7d in run_builtin /home/howard/hw/linux-perf/tools/perf/perf.c:351 + #7 0x5c04956ee0a8 in handle_internal_command /home/howard/hw/linux-perf/tools/perf/perf.c:404 + #8 0x5c04956ee37f in run_argv /home/howard/hw/linux-perf/tools/perf/perf.c:448 + #9 0x5c04956ee8e9 in main /home/howard/hw/linux-perf/tools/perf/perf.c:556 + #10 0x79eb3622a3b7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 + #11 0x79eb3622a47a in __libc_start_main_impl ../csu/libc-start.c:360 + #12 0x5c04955422d4 in _start (/home/howard/hw/linux-perf/tools/perf/perf+0x4e02d4) (BuildId: 5b6cab2d59e96a4341741765ad6914a4d784dbc6) + + 0.000 ( 0.014 ms): Chrome_ChildIO/117244 write(fd: 238, buf: !, count: 1) = 1 + +Fixes: 5e58fcfaf4c6 ("perf trace: Allow allocating sc->arg_fmt even without the syscall tracepoint") +Signed-off-by: Howard Chu +Link: https://lore.kernel.org/r/20250122025519.361873-1-howardchu95@gmail.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-trace.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c +index 65f94597590ef..c569e090fa976 100644 +--- a/tools/perf/builtin-trace.c ++++ b/tools/perf/builtin-trace.c +@@ -1813,8 +1813,12 @@ static int trace__read_syscall_info(struct trace *trace, int id) + return PTR_ERR(sc->tp_format); + } + ++ /* ++ * The tracepoint format contains __syscall_nr field, so it's one more ++ * than the actual number of syscall arguments. ++ */ + if (syscall__alloc_arg_fmts(sc, IS_ERR(sc->tp_format) ? +- RAW_SYSCALL_ARGS_NUM : sc->tp_format->format.nr_fields)) ++ RAW_SYSCALL_ARGS_NUM : sc->tp_format->format.nr_fields - 1)) + return -ENOMEM; + + sc->args = sc->tp_format->format.fields; +-- +2.39.5 + diff --git a/queue-5.15/pm-hibernate-add-error-handling-for-syscore_suspend.patch b/queue-5.15/pm-hibernate-add-error-handling-for-syscore_suspend.patch new file mode 100644 index 0000000000..afe1e87f8e --- /dev/null +++ b/queue-5.15/pm-hibernate-add-error-handling-for-syscore_suspend.patch @@ -0,0 +1,58 @@ +From 43bd5340e5a99d738af315b6d741c8077dead32a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jan 2025 22:32:05 +0800 +Subject: PM: hibernate: Add error handling for syscore_suspend() + +From: Wentao Liang + +[ Upstream commit e20a70c572539a486dbd91b225fa6a194a5e2122 ] + +In hibernation_platform_enter(), the code did not check the +return value of syscore_suspend(), potentially leading to a +situation where syscore_resume() would be called even if +syscore_suspend() failed. This could cause unpredictable +behavior or system instability. + +Modify the code sequence in question to properly handle errors returned +by syscore_suspend(). If an error occurs in the suspend path, the code +now jumps to label 'Enable_irqs' skipping the syscore_resume() call and +only enabling interrupts after setting the system state to SYSTEM_RUNNING. + +Fixes: 40dc166cb5dd ("PM / Core: Introduce struct syscore_ops for core subsystems PM") +Signed-off-by: Wentao Liang +Link: https://patch.msgid.link/20250119143205.2103-1-vulab@iscas.ac.cn +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/hibernate.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index 9abc73d500fbf..747c856411e39 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -593,7 +593,11 @@ int hibernation_platform_enter(void) + + local_irq_disable(); + system_state = SYSTEM_SUSPEND; +- syscore_suspend(); ++ ++ error = syscore_suspend(); ++ if (error) ++ goto Enable_irqs; ++ + if (pm_wakeup_pending()) { + error = -EAGAIN; + goto Power_up; +@@ -605,6 +609,7 @@ int hibernation_platform_enter(void) + + Power_up: + syscore_resume(); ++ Enable_irqs: + system_state = SYSTEM_RUNNING; + local_irq_enable(); + +-- +2.39.5 + diff --git a/queue-5.15/pm-sleep-core-synchronize-runtime-pm-status-of-paren.patch b/queue-5.15/pm-sleep-core-synchronize-runtime-pm-status-of-paren.patch new file mode 100644 index 0000000000..fe5139d95a --- /dev/null +++ b/queue-5.15/pm-sleep-core-synchronize-runtime-pm-status-of-paren.patch @@ -0,0 +1,119 @@ +From 4059106177b70a7510345b9463b375e2da51f702 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 20:24:41 +0100 +Subject: PM: sleep: core: Synchronize runtime PM status of parents and + children + +From: Rafael J. Wysocki + +[ Upstream commit 3775fc538f535a7c5adaf11990c7932a0bd1f9eb ] + +Commit 6e176bf8d461 ("PM: sleep: core: Do not skip callbacks in the +resume phase") overlooked the case in which the parent of a device with +DPM_FLAG_SMART_SUSPEND set did not use that flag and could be runtime- +suspended before a transition into a system-wide sleep state. In that +case, if the child is resumed during the subsequent transition from +that state into the working state, its runtime PM status will be set to +RPM_ACTIVE, but the runtime PM status of the parent will not be updated +accordingly, even though the parent will be resumed too, because of the +dev_pm_skip_suspend() check in device_resume_noirq(). + +Address this problem by tracking the need to set the runtime PM status +to RPM_ACTIVE during system-wide resume transitions for devices with +DPM_FLAG_SMART_SUSPEND set and all of the devices depended on by them. + +Fixes: 6e176bf8d461 ("PM: sleep: core: Do not skip callbacks in the resume phase") +Closes: https://lore.kernel.org/linux-pm/Z30p2Etwf3F2AUvD@hovoldconsulting.com/ +Reported-by: Johan Hovold +Tested-by: Manivannan Sadhasivam +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Johan Hovold +Tested-by: Johan Hovold +Link: https://patch.msgid.link/12619233.O9o76ZdvQC@rjwysocki.net +Signed-off-by: Sasha Levin +--- + drivers/base/power/main.c | 29 ++++++++++++++++++++--------- + include/linux/pm.h | 1 + + 2 files changed, 21 insertions(+), 9 deletions(-) + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index 01591c1055117..c9092e0f9bc3b 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -615,13 +615,15 @@ static void device_resume_noirq(struct device *dev, pm_message_t state, bool asy + * so change its status accordingly. + * + * Otherwise, the device is going to be resumed, so set its PM-runtime +- * status to "active", but do that only if DPM_FLAG_SMART_SUSPEND is set +- * to avoid confusing drivers that don't use it. ++ * status to "active" unless its power.set_active flag is clear, in ++ * which case it is not necessary to update its PM-runtime status. + */ +- if (skip_resume) ++ if (skip_resume) { + pm_runtime_set_suspended(dev); +- else if (dev_pm_skip_suspend(dev)) ++ } else if (dev->power.set_active) { + pm_runtime_set_active(dev); ++ dev->power.set_active = false; ++ } + + if (dev->pm_domain) { + info = "noirq power domain "; +@@ -1173,18 +1175,24 @@ static pm_message_t resume_event(pm_message_t sleep_state) + return PMSG_ON; + } + +-static void dpm_superior_set_must_resume(struct device *dev) ++static void dpm_superior_set_must_resume(struct device *dev, bool set_active) + { + struct device_link *link; + int idx; + +- if (dev->parent) ++ if (dev->parent) { + dev->parent->power.must_resume = true; ++ if (set_active) ++ dev->parent->power.set_active = true; ++ } + + idx = device_links_read_lock(); + +- list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node) ++ list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node) { + link->supplier->power.must_resume = true; ++ if (set_active) ++ link->supplier->power.set_active = true; ++ } + + device_links_read_unlock(idx); + } +@@ -1260,8 +1268,11 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a + dev->power.may_skip_resume)) + dev->power.must_resume = true; + +- if (dev->power.must_resume) +- dpm_superior_set_must_resume(dev); ++ if (dev->power.must_resume) { ++ dev->power.set_active = dev->power.set_active || ++ dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND); ++ dpm_superior_set_must_resume(dev, dev->power.set_active); ++ } + + Complete: + complete_all(&dev->power.completion); +diff --git a/include/linux/pm.h b/include/linux/pm.h +index 1a478b7d6bef4..5549bdefabf8c 100644 +--- a/include/linux/pm.h ++++ b/include/linux/pm.h +@@ -633,6 +633,7 @@ struct dev_pm_info { + bool no_pm_callbacks:1; /* Owned by the PM core */ + bool async_in_progress:1; /* Owned by the PM core */ + bool must_resume:1; /* Owned by the PM core */ ++ bool set_active:1; /* Owned by the PM core */ + bool may_skip_resume:1; /* Set by subsystems */ + #else + bool should_wakeup:1; +-- +2.39.5 + diff --git a/queue-5.15/pm-sleep-restore-asynchronous-device-resume-optimiza.patch b/queue-5.15/pm-sleep-restore-asynchronous-device-resume-optimiza.patch new file mode 100644 index 0000000000..fff0d93b77 --- /dev/null +++ b/queue-5.15/pm-sleep-restore-asynchronous-device-resume-optimiza.patch @@ -0,0 +1,284 @@ +From 6585d5c43ceac9a984ca2eb2cf6e02aa64ea7685 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 17:59:22 +0100 +Subject: PM: sleep: Restore asynchronous device resume optimization + +From: Rafael J. Wysocki + +[ Upstream commit 3e999770ac1c7c31a70685dd5b88e89473509e9c ] + +Before commit 7839d0078e0d ("PM: sleep: Fix possible deadlocks in core +system-wide PM code"), the resume of devices that were allowed to resume +asynchronously was scheduled before starting the resume of the other +devices, so the former did not have to wait for the latter unless +functional dependencies were present. + +Commit 7839d0078e0d removed that optimization in order to address a +correctness issue, but it can be restored with the help of a new device +power management flag, so do that now. + +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Stanislaw Gruszka +Stable-dep-of: 3775fc538f53 ("PM: sleep: core: Synchronize runtime PM status of parents and children") +Signed-off-by: Sasha Levin +--- + drivers/base/power/main.c | 117 +++++++++++++++++++++----------------- + include/linux/pm.h | 1 + + 2 files changed, 65 insertions(+), 53 deletions(-) + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index 185ea0d93a5e5..01591c1055117 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -580,7 +580,7 @@ bool dev_pm_skip_resume(struct device *dev) + } + + /** +- * __device_resume_noirq - Execute a "noirq resume" callback for given device. ++ * device_resume_noirq - Execute a "noirq resume" callback for given device. + * @dev: Device to handle. + * @state: PM transition of the system being carried out. + * @async: If true, the device is being resumed asynchronously. +@@ -588,7 +588,7 @@ bool dev_pm_skip_resume(struct device *dev) + * The driver of @dev will not receive interrupts while this function is being + * executed. + */ +-static void __device_resume_noirq(struct device *dev, pm_message_t state, bool async) ++static void device_resume_noirq(struct device *dev, pm_message_t state, bool async) + { + pm_callback_t callback = NULL; + const char *info = NULL; +@@ -675,16 +675,22 @@ static bool dpm_async_fn(struct device *dev, async_func_t func) + { + reinit_completion(&dev->power.completion); + +- if (!is_async(dev)) +- return false; +- +- get_device(dev); ++ if (is_async(dev)) { ++ dev->power.async_in_progress = true; + +- if (async_schedule_dev_nocall(func, dev)) +- return true; ++ get_device(dev); + +- put_device(dev); ++ if (async_schedule_dev_nocall(func, dev)) ++ return true; + ++ put_device(dev); ++ } ++ /* ++ * Because async_schedule_dev_nocall() above has returned false or it ++ * has not been called at all, func() is not running and it is safe to ++ * update the async_in_progress flag without extra synchronization. ++ */ ++ dev->power.async_in_progress = false; + return false; + } + +@@ -692,18 +698,10 @@ static void async_resume_noirq(void *data, async_cookie_t cookie) + { + struct device *dev = data; + +- __device_resume_noirq(dev, pm_transition, true); ++ device_resume_noirq(dev, pm_transition, true); + put_device(dev); + } + +-static void device_resume_noirq(struct device *dev) +-{ +- if (dpm_async_fn(dev, async_resume_noirq)) +- return; +- +- __device_resume_noirq(dev, pm_transition, false); +-} +- + static void dpm_noirq_resume_devices(pm_message_t state) + { + struct device *dev; +@@ -713,18 +711,28 @@ static void dpm_noirq_resume_devices(pm_message_t state) + mutex_lock(&dpm_list_mtx); + pm_transition = state; + ++ /* ++ * Trigger the resume of "async" devices upfront so they don't have to ++ * wait for the "non-async" ones they don't depend on. ++ */ ++ list_for_each_entry(dev, &dpm_noirq_list, power.entry) ++ dpm_async_fn(dev, async_resume_noirq); ++ + while (!list_empty(&dpm_noirq_list)) { + dev = to_device(dpm_noirq_list.next); +- get_device(dev); + list_move_tail(&dev->power.entry, &dpm_late_early_list); + +- mutex_unlock(&dpm_list_mtx); ++ if (!dev->power.async_in_progress) { ++ get_device(dev); + +- device_resume_noirq(dev); ++ mutex_unlock(&dpm_list_mtx); + +- put_device(dev); ++ device_resume_noirq(dev, state, false); + +- mutex_lock(&dpm_list_mtx); ++ put_device(dev); ++ ++ mutex_lock(&dpm_list_mtx); ++ } + } + mutex_unlock(&dpm_list_mtx); + async_synchronize_full(); +@@ -750,14 +758,14 @@ void dpm_resume_noirq(pm_message_t state) + } + + /** +- * __device_resume_early - Execute an "early resume" callback for given device. ++ * device_resume_early - Execute an "early resume" callback for given device. + * @dev: Device to handle. + * @state: PM transition of the system being carried out. + * @async: If true, the device is being resumed asynchronously. + * + * Runtime PM is disabled for @dev while this function is being executed. + */ +-static void __device_resume_early(struct device *dev, pm_message_t state, bool async) ++static void device_resume_early(struct device *dev, pm_message_t state, bool async) + { + pm_callback_t callback = NULL; + const char *info = NULL; +@@ -823,18 +831,10 @@ static void async_resume_early(void *data, async_cookie_t cookie) + { + struct device *dev = data; + +- __device_resume_early(dev, pm_transition, true); ++ device_resume_early(dev, pm_transition, true); + put_device(dev); + } + +-static void device_resume_early(struct device *dev) +-{ +- if (dpm_async_fn(dev, async_resume_early)) +- return; +- +- __device_resume_early(dev, pm_transition, false); +-} +- + /** + * dpm_resume_early - Execute "early resume" callbacks for all devices. + * @state: PM transition of the system being carried out. +@@ -848,18 +848,28 @@ void dpm_resume_early(pm_message_t state) + mutex_lock(&dpm_list_mtx); + pm_transition = state; + ++ /* ++ * Trigger the resume of "async" devices upfront so they don't have to ++ * wait for the "non-async" ones they don't depend on. ++ */ ++ list_for_each_entry(dev, &dpm_late_early_list, power.entry) ++ dpm_async_fn(dev, async_resume_early); ++ + while (!list_empty(&dpm_late_early_list)) { + dev = to_device(dpm_late_early_list.next); +- get_device(dev); + list_move_tail(&dev->power.entry, &dpm_suspended_list); + +- mutex_unlock(&dpm_list_mtx); ++ if (!dev->power.async_in_progress) { ++ get_device(dev); + +- device_resume_early(dev); ++ mutex_unlock(&dpm_list_mtx); + +- put_device(dev); ++ device_resume_early(dev, state, false); + +- mutex_lock(&dpm_list_mtx); ++ put_device(dev); ++ ++ mutex_lock(&dpm_list_mtx); ++ } + } + mutex_unlock(&dpm_list_mtx); + async_synchronize_full(); +@@ -879,12 +889,12 @@ void dpm_resume_start(pm_message_t state) + EXPORT_SYMBOL_GPL(dpm_resume_start); + + /** +- * __device_resume - Execute "resume" callbacks for given device. ++ * device_resume - Execute "resume" callbacks for given device. + * @dev: Device to handle. + * @state: PM transition of the system being carried out. + * @async: If true, the device is being resumed asynchronously. + */ +-static void __device_resume(struct device *dev, pm_message_t state, bool async) ++static void device_resume(struct device *dev, pm_message_t state, bool async) + { + pm_callback_t callback = NULL; + const char *info = NULL; +@@ -978,18 +988,10 @@ static void async_resume(void *data, async_cookie_t cookie) + { + struct device *dev = data; + +- __device_resume(dev, pm_transition, true); ++ device_resume(dev, pm_transition, true); + put_device(dev); + } + +-static void device_resume(struct device *dev) +-{ +- if (dpm_async_fn(dev, async_resume)) +- return; +- +- __device_resume(dev, pm_transition, false); +-} +- + /** + * dpm_resume - Execute "resume" callbacks for non-sysdev devices. + * @state: PM transition of the system being carried out. +@@ -1009,16 +1011,25 @@ void dpm_resume(pm_message_t state) + pm_transition = state; + async_error = 0; + ++ /* ++ * Trigger the resume of "async" devices upfront so they don't have to ++ * wait for the "non-async" ones they don't depend on. ++ */ ++ list_for_each_entry(dev, &dpm_suspended_list, power.entry) ++ dpm_async_fn(dev, async_resume); ++ + while (!list_empty(&dpm_suspended_list)) { + dev = to_device(dpm_suspended_list.next); + + get_device(dev); + +- mutex_unlock(&dpm_list_mtx); ++ if (!dev->power.async_in_progress) { ++ mutex_unlock(&dpm_list_mtx); + +- device_resume(dev); ++ device_resume(dev, state, false); + +- mutex_lock(&dpm_list_mtx); ++ mutex_lock(&dpm_list_mtx); ++ } + + if (!list_empty(&dev->power.entry)) + list_move_tail(&dev->power.entry, &dpm_prepared_list); +diff --git a/include/linux/pm.h b/include/linux/pm.h +index b8578e1f7c110..6eceb403afacf 100644 +--- a/include/linux/pm.h ++++ b/include/linux/pm.h +@@ -631,6 +631,7 @@ struct dev_pm_info { + bool wakeup_path:1; + bool syscore:1; + bool no_pm_callbacks:1; /* Owned by the PM core */ ++ bool async_in_progress:1; /* Owned by the PM core */ + unsigned int must_resume:1; /* Owned by the PM core */ + unsigned int may_skip_resume:1; /* Set by subsystems */ + #else +-- +2.39.5 + diff --git a/queue-5.15/pm-sleep-use-bool-for-all-1-bit-fields-in-struct-dev.patch b/queue-5.15/pm-sleep-use-bool-for-all-1-bit-fields-in-struct-dev.patch new file mode 100644 index 0000000000..4e7c32548b --- /dev/null +++ b/queue-5.15/pm-sleep-use-bool-for-all-1-bit-fields-in-struct-dev.patch @@ -0,0 +1,86 @@ +From 402a16325d0ef46e9c9d76c937274902475110a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 17:11:26 +0100 +Subject: PM: sleep: Use bool for all 1-bit fields in struct dev_pm_info + +From: Rafael J. Wysocki + +[ Upstream commit b017500ab53c06441ff7d3a681484e37039b4f57 ] + +For some 1-bit fields in struct dev_pm_info the data type is bool, while +for some other 1-bit fields in there it is unsigned int, and these +differences are somewhat arbitrary. + +For consistency, change the data type of the latter to bool, so that all +of the 1-bit fields in struct dev_pm_info fields are bool. + +No intentional functional impact. + +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Greg Kroah-Hartman +Stable-dep-of: 3775fc538f53 ("PM: sleep: core: Synchronize runtime PM status of parents and children") +Signed-off-by: Sasha Levin +--- + include/linux/pm.h | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/include/linux/pm.h b/include/linux/pm.h +index 6eceb403afacf..1a478b7d6bef4 100644 +--- a/include/linux/pm.h ++++ b/include/linux/pm.h +@@ -612,8 +612,8 @@ struct pm_subsys_data { + + struct dev_pm_info { + pm_message_t power_state; +- unsigned int can_wakeup:1; +- unsigned int async_suspend:1; ++ bool can_wakeup:1; ++ bool async_suspend:1; + bool in_dpm_list:1; /* Owned by the PM core */ + bool is_prepared:1; /* Owned by the PM core */ + bool is_suspended:1; /* Ditto */ +@@ -632,10 +632,10 @@ struct dev_pm_info { + bool syscore:1; + bool no_pm_callbacks:1; /* Owned by the PM core */ + bool async_in_progress:1; /* Owned by the PM core */ +- unsigned int must_resume:1; /* Owned by the PM core */ +- unsigned int may_skip_resume:1; /* Set by subsystems */ ++ bool must_resume:1; /* Owned by the PM core */ ++ bool may_skip_resume:1; /* Set by subsystems */ + #else +- unsigned int should_wakeup:1; ++ bool should_wakeup:1; + #endif + #ifdef CONFIG_PM + struct hrtimer suspend_timer; +@@ -646,17 +646,17 @@ struct dev_pm_info { + atomic_t usage_count; + atomic_t child_count; + unsigned int disable_depth:3; +- unsigned int idle_notification:1; +- unsigned int request_pending:1; +- unsigned int deferred_resume:1; +- unsigned int needs_force_resume:1; +- unsigned int runtime_auto:1; ++ bool idle_notification:1; ++ bool request_pending:1; ++ bool deferred_resume:1; ++ bool needs_force_resume:1; ++ bool runtime_auto:1; + bool ignore_children:1; +- unsigned int no_callbacks:1; +- unsigned int irq_safe:1; +- unsigned int use_autosuspend:1; +- unsigned int timer_autosuspends:1; +- unsigned int memalloc_noio:1; ++ bool no_callbacks:1; ++ bool irq_safe:1; ++ bool use_autosuspend:1; ++ bool timer_autosuspends:1; ++ bool memalloc_noio:1; + unsigned int links_count; + enum rpm_request request; + enum rpm_status runtime_status; +-- +2.39.5 + diff --git a/queue-5.15/posix-clock-introduce-posix_clock_context-concept.patch b/queue-5.15/posix-clock-introduce-posix_clock_context-concept.patch new file mode 100644 index 0000000000..73dcdda455 --- /dev/null +++ b/queue-5.15/posix-clock-introduce-posix_clock_context-concept.patch @@ -0,0 +1,318 @@ +From d3dbd7c7cecddf184931301a7970cbc1cd39da0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Oct 2023 00:39:53 +0200 +Subject: posix-clock: introduce posix_clock_context concept + +From: Xabier Marquiegui + +[ Upstream commit 60c6946675fc06dd2fd2b7a4b6fd1c1f046f1056 ] + +Add the necessary structure to support custom private-data per +posix-clock user. + +The previous implementation of posix-clock assumed all file open +instances need access to the same clock structure on private_data. + +The need for individual data structures per file open instance has been +identified when developing support for multiple timestamp event queue +users for ptp_clock. + +Signed-off-by: Xabier Marquiegui +Suggested-by: Richard Cochran +Suggested-by: Vinicius Costa Gomes +Signed-off-by: David S. Miller +Stable-dep-of: 19ae40f572a9 ("ptp: Properly handle compat ioctls") +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_chardev.c | 21 +++++++++++++-------- + drivers/ptp/ptp_private.h | 16 +++++++++------- + include/linux/posix-clock.h | 35 +++++++++++++++++++++++++++-------- + kernel/time/posix-clock.c | 36 +++++++++++++++++++++++++++--------- + 4 files changed, 76 insertions(+), 32 deletions(-) + +diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c +index 8eb902fe73a98..2776f37713123 100644 +--- a/drivers/ptp/ptp_chardev.c ++++ b/drivers/ptp/ptp_chardev.c +@@ -102,14 +102,16 @@ int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin, + return 0; + } + +-int ptp_open(struct posix_clock *pc, fmode_t fmode) ++int ptp_open(struct posix_clock_context *pccontext, fmode_t fmode) + { + return 0; + } + +-long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) ++long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd, ++ unsigned long arg) + { +- struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); ++ struct ptp_clock *ptp = ++ container_of(pccontext->clk, struct ptp_clock, clock); + struct ptp_sys_offset_extended *extoff = NULL; + struct ptp_sys_offset_precise precise_offset; + struct system_device_crosststamp xtstamp; +@@ -430,9 +432,11 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) + return err; + } + +-__poll_t ptp_poll(struct posix_clock *pc, struct file *fp, poll_table *wait) ++__poll_t ptp_poll(struct posix_clock_context *pccontext, struct file *fp, ++ poll_table *wait) + { +- struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); ++ struct ptp_clock *ptp = ++ container_of(pccontext->clk, struct ptp_clock, clock); + + poll_wait(fp, &ptp->tsev_wq, wait); + +@@ -441,10 +445,11 @@ __poll_t ptp_poll(struct posix_clock *pc, struct file *fp, poll_table *wait) + + #define EXTTS_BUFSIZE (PTP_BUF_TIMESTAMPS * sizeof(struct ptp_extts_event)) + +-ssize_t ptp_read(struct posix_clock *pc, +- uint rdflags, char __user *buf, size_t cnt) ++ssize_t ptp_read(struct posix_clock_context *pccontext, uint rdflags, ++ char __user *buf, size_t cnt) + { +- struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); ++ struct ptp_clock *ptp = ++ container_of(pccontext->clk, struct ptp_clock, clock); + struct timestamp_event_queue *queue = &ptp->tsevq; + struct ptp_extts_event *event; + unsigned long flags; +diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h +index b336c12bb6976..ed6bf42fba86d 100644 +--- a/drivers/ptp/ptp_private.h ++++ b/drivers/ptp/ptp_private.h +@@ -110,16 +110,18 @@ extern struct class *ptp_class; + int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin, + enum ptp_pin_function func, unsigned int chan); + +-long ptp_ioctl(struct posix_clock *pc, +- unsigned int cmd, unsigned long arg); ++long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd, ++ unsigned long arg); + +-int ptp_open(struct posix_clock *pc, fmode_t fmode); ++int ptp_open(struct posix_clock_context *pccontext, fmode_t fmode); + +-ssize_t ptp_read(struct posix_clock *pc, +- uint flags, char __user *buf, size_t cnt); ++int ptp_release(struct posix_clock_context *pccontext); + +-__poll_t ptp_poll(struct posix_clock *pc, +- struct file *fp, poll_table *wait); ++ssize_t ptp_read(struct posix_clock_context *pccontext, uint flags, char __user *buf, ++ size_t cnt); ++ ++__poll_t ptp_poll(struct posix_clock_context *pccontext, struct file *fp, ++ poll_table *wait); + + /* + * see ptp_sysfs.c +diff --git a/include/linux/posix-clock.h b/include/linux/posix-clock.h +index 468328b1e1dd5..ef8619f489203 100644 +--- a/include/linux/posix-clock.h ++++ b/include/linux/posix-clock.h +@@ -14,6 +14,7 @@ + #include + + struct posix_clock; ++struct posix_clock_context; + + /** + * struct posix_clock_operations - functional interface to the clock +@@ -50,18 +51,18 @@ struct posix_clock_operations { + /* + * Optional character device methods: + */ +- long (*ioctl) (struct posix_clock *pc, +- unsigned int cmd, unsigned long arg); ++ long (*ioctl)(struct posix_clock_context *pccontext, unsigned int cmd, ++ unsigned long arg); + +- int (*open) (struct posix_clock *pc, fmode_t f_mode); ++ int (*open)(struct posix_clock_context *pccontext, fmode_t f_mode); + +- __poll_t (*poll) (struct posix_clock *pc, +- struct file *file, poll_table *wait); ++ __poll_t (*poll)(struct posix_clock_context *pccontext, struct file *file, ++ poll_table *wait); + +- int (*release) (struct posix_clock *pc); ++ int (*release)(struct posix_clock_context *pccontext); + +- ssize_t (*read) (struct posix_clock *pc, +- uint flags, char __user *buf, size_t cnt); ++ ssize_t (*read)(struct posix_clock_context *pccontext, uint flags, ++ char __user *buf, size_t cnt); + }; + + /** +@@ -90,6 +91,24 @@ struct posix_clock { + bool zombie; + }; + ++/** ++ * struct posix_clock_context - represents clock file operations context ++ * ++ * @clk: Pointer to the clock ++ * @private_clkdata: Pointer to user data ++ * ++ * Drivers should use struct posix_clock_context during specific character ++ * device file operation methods to access the posix clock. ++ * ++ * Drivers can store a private data structure during the open operation ++ * if they have specific information that is required in other file ++ * operations. ++ */ ++struct posix_clock_context { ++ struct posix_clock *clk; ++ void *private_clkdata; ++}; ++ + /** + * posix_clock_register() - register a new clock + * @clk: Pointer to the clock. Caller must provide 'ops' field +diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c +index 05e73d209aa87..706559ed75793 100644 +--- a/kernel/time/posix-clock.c ++++ b/kernel/time/posix-clock.c +@@ -19,7 +19,8 @@ + */ + static struct posix_clock *get_posix_clock(struct file *fp) + { +- struct posix_clock *clk = fp->private_data; ++ struct posix_clock_context *pccontext = fp->private_data; ++ struct posix_clock *clk = pccontext->clk; + + down_read(&clk->rwsem); + +@@ -39,6 +40,7 @@ static void put_posix_clock(struct posix_clock *clk) + static ssize_t posix_clock_read(struct file *fp, char __user *buf, + size_t count, loff_t *ppos) + { ++ struct posix_clock_context *pccontext = fp->private_data; + struct posix_clock *clk = get_posix_clock(fp); + int err = -EINVAL; + +@@ -46,7 +48,7 @@ static ssize_t posix_clock_read(struct file *fp, char __user *buf, + return -ENODEV; + + if (clk->ops.read) +- err = clk->ops.read(clk, fp->f_flags, buf, count); ++ err = clk->ops.read(pccontext, fp->f_flags, buf, count); + + put_posix_clock(clk); + +@@ -55,6 +57,7 @@ static ssize_t posix_clock_read(struct file *fp, char __user *buf, + + static __poll_t posix_clock_poll(struct file *fp, poll_table *wait) + { ++ struct posix_clock_context *pccontext = fp->private_data; + struct posix_clock *clk = get_posix_clock(fp); + __poll_t result = 0; + +@@ -62,7 +65,7 @@ static __poll_t posix_clock_poll(struct file *fp, poll_table *wait) + return EPOLLERR; + + if (clk->ops.poll) +- result = clk->ops.poll(clk, fp, wait); ++ result = clk->ops.poll(pccontext, fp, wait); + + put_posix_clock(clk); + +@@ -72,6 +75,7 @@ static __poll_t posix_clock_poll(struct file *fp, poll_table *wait) + static long posix_clock_ioctl(struct file *fp, + unsigned int cmd, unsigned long arg) + { ++ struct posix_clock_context *pccontext = fp->private_data; + struct posix_clock *clk = get_posix_clock(fp); + int err = -ENOTTY; + +@@ -79,7 +83,7 @@ static long posix_clock_ioctl(struct file *fp, + return -ENODEV; + + if (clk->ops.ioctl) +- err = clk->ops.ioctl(clk, cmd, arg); ++ err = clk->ops.ioctl(pccontext, cmd, arg); + + put_posix_clock(clk); + +@@ -90,6 +94,7 @@ static long posix_clock_ioctl(struct file *fp, + static long posix_clock_compat_ioctl(struct file *fp, + unsigned int cmd, unsigned long arg) + { ++ struct posix_clock_context *pccontext = fp->private_data; + struct posix_clock *clk = get_posix_clock(fp); + int err = -ENOTTY; + +@@ -97,7 +102,7 @@ static long posix_clock_compat_ioctl(struct file *fp, + return -ENODEV; + + if (clk->ops.ioctl) +- err = clk->ops.ioctl(clk, cmd, arg); ++ err = clk->ops.ioctl(pccontext, cmd, arg); + + put_posix_clock(clk); + +@@ -110,6 +115,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp) + int err; + struct posix_clock *clk = + container_of(inode->i_cdev, struct posix_clock, cdev); ++ struct posix_clock_context *pccontext; + + down_read(&clk->rwsem); + +@@ -117,14 +123,20 @@ static int posix_clock_open(struct inode *inode, struct file *fp) + err = -ENODEV; + goto out; + } ++ pccontext = kzalloc(sizeof(*pccontext), GFP_KERNEL); ++ if (!pccontext) { ++ err = -ENOMEM; ++ goto out; ++ } ++ pccontext->clk = clk; ++ fp->private_data = pccontext; + if (clk->ops.open) +- err = clk->ops.open(clk, fp->f_mode); ++ err = clk->ops.open(pccontext, fp->f_mode); + else + err = 0; + + if (!err) { + get_device(clk->dev); +- fp->private_data = clk; + } + out: + up_read(&clk->rwsem); +@@ -133,14 +145,20 @@ static int posix_clock_open(struct inode *inode, struct file *fp) + + static int posix_clock_release(struct inode *inode, struct file *fp) + { +- struct posix_clock *clk = fp->private_data; ++ struct posix_clock_context *pccontext = fp->private_data; ++ struct posix_clock *clk; + int err = 0; + ++ if (!pccontext) ++ return -ENODEV; ++ clk = pccontext->clk; ++ + if (clk->ops.release) +- err = clk->ops.release(clk); ++ err = clk->ops.release(pccontext); + + put_device(clk->dev); + ++ kfree(pccontext); + fp->private_data = NULL; + + return err; +-- +2.39.5 + diff --git a/queue-5.15/pstore-blk-trivial-typo-fixes.patch b/queue-5.15/pstore-blk-trivial-typo-fixes.patch new file mode 100644 index 0000000000..6f2c0fdd5f --- /dev/null +++ b/queue-5.15/pstore-blk-trivial-typo-fixes.patch @@ -0,0 +1,46 @@ +From 8fbb61e6eb859cc0c97e9eaad85f45f33e4ffdb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jan 2025 13:19:21 +0200 +Subject: pstore/blk: trivial typo fixes + +From: Eugen Hristev + +[ Upstream commit 542243af7182efaeaf6d0f4643f7de437541a9af ] + +Fix trivial typos in comments. + +Fixes: 2a03ddbde1e1 ("pstore/blk: Move verify_size() macro out of function") +Fixes: 17639f67c1d6 ("pstore/blk: Introduce backend for block devices") +Signed-off-by: Eugen Hristev +Link: https://lore.kernel.org/r/20250101111921.850406-1-eugen.hristev@linaro.org +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/pstore/blk.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/pstore/blk.c b/fs/pstore/blk.c +index 6093088de49fd..cb5fe2f28c708 100644 +--- a/fs/pstore/blk.c ++++ b/fs/pstore/blk.c +@@ -89,7 +89,7 @@ static struct pstore_device_info *pstore_device_info; + _##name_ = check_size(name, alignsize); \ + else \ + _##name_ = 0; \ +- /* Synchronize module parameters with resuls. */ \ ++ /* Synchronize module parameters with results. */ \ + name = _##name_ / 1024; \ + dev->zone.name = _##name_; \ + } +@@ -121,7 +121,7 @@ static int __register_pstore_device(struct pstore_device_info *dev) + if (pstore_device_info) + return -EBUSY; + +- /* zero means not limit on which backends to attempt to store. */ ++ /* zero means no limit on which backends attempt to store. */ + if (!dev->flags) + dev->flags = UINT_MAX; + +-- +2.39.5 + diff --git a/queue-5.15/ptp-properly-handle-compat-ioctls.patch b/queue-5.15/ptp-properly-handle-compat-ioctls.patch new file mode 100644 index 0000000000..cd60936771 --- /dev/null +++ b/queue-5.15/ptp-properly-handle-compat-ioctls.patch @@ -0,0 +1,56 @@ +From 7d612e2d279e7223b19b6a2d11d480396dcb37e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Jan 2025 10:28:38 +0100 +Subject: ptp: Properly handle compat ioctls +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 19ae40f572a9ce1ade9954990af709a03fd37010 ] + +Pointer arguments passed to ioctls need to pass through compat_ptr() to +work correctly on s390; as explained in Documentation/driver-api/ioctl.rst. +Detect compat mode at runtime and call compat_ptr() for those commands +which do take pointer arguments. + +Suggested-by: Arnd Bergmann +Link: https://lore.kernel.org/lkml/1ba5d3a4-7931-455b-a3ce-85a968a7cb10@app.fastmail.com/ +Fixes: d94ba80ebbea ("ptp: Added a brand new class driver for ptp clocks.") +Signed-off-by: Thomas Weißschuh +Reviewed-by: Cyrill Gorcunov +Reviewed-by: Arnd Bergmann +Acked-by: Richard Cochran +Link: https://patch.msgid.link/20250125-posix-clock-compat_ioctl-v2-1-11c865c500eb@weissschuh.net +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_chardev.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c +index c48b9379ca094..8912e3efa00e2 100644 +--- a/drivers/ptp/ptp_chardev.c ++++ b/drivers/ptp/ptp_chardev.c +@@ -4,6 +4,7 @@ + * + * Copyright (C) 2010 OMICRON electronics GmbH + */ ++#include + #include + #include + #include +@@ -159,6 +160,9 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd, + struct timespec64 ts; + int enable, err = 0; + ++ if (in_compat_syscall() && cmd != PTP_ENABLE_PPS && cmd != PTP_ENABLE_PPS2) ++ arg = (unsigned long)compat_ptr(arg); ++ + tsevq = pccontext->private_clkdata; + + switch (cmd) { +-- +2.39.5 + diff --git a/queue-5.15/ptp-remove-usage-of-the-deprecated-ida_simple_xxx-ap.patch b/queue-5.15/ptp-remove-usage-of-the-deprecated-ida_simple_xxx-ap.patch new file mode 100644 index 0000000000..94558cab45 --- /dev/null +++ b/queue-5.15/ptp-remove-usage-of-the-deprecated-ida_simple_xxx-ap.patch @@ -0,0 +1,56 @@ +From 8a4821b10bb2cb3b7032e73aa8d87e2d9574c870 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Sep 2022 21:27:44 -0400 +Subject: ptp: Remove usage of the deprecated ida_simple_xxx API + +From: Bo Liu + +[ Upstream commit ab7ea1e73532247217d3e450015dd7ece966dc0e ] + +Use ida_alloc_xxx()/ida_free() instead of +ida_simple_get()/ida_simple_remove(). +The latter is deprecated and more verbose. + +Signed-off-by: Bo Liu +Link: https://lore.kernel.org/r/20220926012744.3363-1-liubo03@inspur.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 19ae40f572a9 ("ptp: Properly handle compat ioctls") +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_clock.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c +index 92dd1c6f54f4a..25e37c2bc672b 100644 +--- a/drivers/ptp/ptp_clock.c ++++ b/drivers/ptp/ptp_clock.c +@@ -176,7 +176,7 @@ static void ptp_clock_release(struct device *dev) + mutex_destroy(&ptp->tsevq_mux); + mutex_destroy(&ptp->pincfg_mux); + mutex_destroy(&ptp->n_vclocks_mux); +- ida_simple_remove(&ptp_clocks_map, ptp->index); ++ ida_free(&ptp_clocks_map, ptp->index); + kfree(ptp); + } + +@@ -211,7 +211,7 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + if (ptp == NULL) + goto no_memory; + +- index = ida_simple_get(&ptp_clocks_map, 0, MINORMASK + 1, GFP_KERNEL); ++ index = ida_alloc_max(&ptp_clocks_map, MINORMASK, GFP_KERNEL); + if (index < 0) { + err = index; + goto no_slot; +@@ -311,7 +311,7 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + mutex_destroy(&ptp->tsevq_mux); + mutex_destroy(&ptp->pincfg_mux); + mutex_destroy(&ptp->n_vclocks_mux); +- ida_simple_remove(&ptp_clocks_map, index); ++ ida_free(&ptp_clocks_map, index); + no_slot: + kfree(ptp); + no_memory: +-- +2.39.5 + diff --git a/queue-5.15/ptp-replace-timestamp-event-queue-with-linked-list.patch b/queue-5.15/ptp-replace-timestamp-event-queue-with-linked-list.patch new file mode 100644 index 0000000000..5a89b0cd1d --- /dev/null +++ b/queue-5.15/ptp-replace-timestamp-event-queue-with-linked-list.patch @@ -0,0 +1,193 @@ +From f1a224315c4ce57c28eb4d157062f342bc25250e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Oct 2023 00:39:54 +0200 +Subject: ptp: Replace timestamp event queue with linked list + +From: Xabier Marquiegui + +[ Upstream commit d26ab5a35ad9920940a9e07665130d501b2ae1a3 ] + +Introduce linked lists to access the timestamp event queue. + +Signed-off-by: Xabier Marquiegui +Suggested-by: Richard Cochran +Signed-off-by: David S. Miller +Stable-dep-of: 19ae40f572a9 ("ptp: Properly handle compat ioctls") +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_chardev.c | 12 ++++++++++-- + drivers/ptp/ptp_clock.c | 26 ++++++++++++++++++++++++-- + drivers/ptp/ptp_private.h | 4 +++- + drivers/ptp/ptp_sysfs.c | 6 +++++- + 4 files changed, 42 insertions(+), 6 deletions(-) + +diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c +index 2776f37713123..82b5a68d1ca34 100644 +--- a/drivers/ptp/ptp_chardev.c ++++ b/drivers/ptp/ptp_chardev.c +@@ -437,10 +437,14 @@ __poll_t ptp_poll(struct posix_clock_context *pccontext, struct file *fp, + { + struct ptp_clock *ptp = + container_of(pccontext->clk, struct ptp_clock, clock); ++ struct timestamp_event_queue *queue; + + poll_wait(fp, &ptp->tsev_wq, wait); + +- return queue_cnt(&ptp->tsevq) ? EPOLLIN : 0; ++ /* Extract only the first element in the queue list */ ++ queue = list_first_entry(&ptp->tsevqs, struct timestamp_event_queue, qlist); ++ ++ return queue_cnt(queue) ? EPOLLIN : 0; + } + + #define EXTTS_BUFSIZE (PTP_BUF_TIMESTAMPS * sizeof(struct ptp_extts_event)) +@@ -450,12 +454,16 @@ ssize_t ptp_read(struct posix_clock_context *pccontext, uint rdflags, + { + struct ptp_clock *ptp = + container_of(pccontext->clk, struct ptp_clock, clock); +- struct timestamp_event_queue *queue = &ptp->tsevq; ++ struct timestamp_event_queue *queue; + struct ptp_extts_event *event; + unsigned long flags; + size_t qcnt, i; + int result; + ++ /* Extract only the first element in the queue list */ ++ queue = list_first_entry(&ptp->tsevqs, struct timestamp_event_queue, ++ qlist); ++ + if (cnt % sizeof(struct ptp_extts_event) != 0) + return -EINVAL; + +diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c +index 25e37c2bc672b..ff40f902f706f 100644 +--- a/drivers/ptp/ptp_clock.c ++++ b/drivers/ptp/ptp_clock.c +@@ -170,12 +170,21 @@ static struct posix_clock_operations ptp_clock_ops = { + static void ptp_clock_release(struct device *dev) + { + struct ptp_clock *ptp = container_of(dev, struct ptp_clock, dev); ++ struct timestamp_event_queue *tsevq; ++ unsigned long flags; + + ptp_cleanup_pin_groups(ptp); + kfree(ptp->vclock_index); + mutex_destroy(&ptp->tsevq_mux); + mutex_destroy(&ptp->pincfg_mux); + mutex_destroy(&ptp->n_vclocks_mux); ++ /* Delete first entry */ ++ tsevq = list_first_entry(&ptp->tsevqs, struct timestamp_event_queue, ++ qlist); ++ spin_lock_irqsave(&tsevq->lock, flags); ++ list_del(&tsevq->qlist); ++ spin_unlock_irqrestore(&tsevq->lock, flags); ++ kfree(tsevq); + ida_free(&ptp_clocks_map, ptp->index); + kfree(ptp); + } +@@ -199,6 +208,7 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + struct device *parent) + { + struct ptp_clock *ptp; ++ struct timestamp_event_queue *queue = NULL; + int err = 0, index, major = MAJOR(ptp_devt); + size_t size; + +@@ -221,7 +231,12 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + ptp->info = info; + ptp->devid = MKDEV(major, index); + ptp->index = index; +- spin_lock_init(&ptp->tsevq.lock); ++ INIT_LIST_HEAD(&ptp->tsevqs); ++ queue = kzalloc(sizeof(*queue), GFP_KERNEL); ++ if (!queue) ++ goto no_memory_queue; ++ spin_lock_init(&queue->lock); ++ list_add_tail(&queue->qlist, &ptp->tsevqs); + mutex_init(&ptp->tsevq_mux); + mutex_init(&ptp->pincfg_mux); + mutex_init(&ptp->n_vclocks_mux); +@@ -311,6 +326,9 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + mutex_destroy(&ptp->tsevq_mux); + mutex_destroy(&ptp->pincfg_mux); + mutex_destroy(&ptp->n_vclocks_mux); ++ list_del(&queue->qlist); ++ kfree(queue); ++no_memory_queue: + ida_free(&ptp_clocks_map, index); + no_slot: + kfree(ptp); +@@ -353,6 +371,7 @@ EXPORT_SYMBOL(ptp_clock_unregister); + + void ptp_clock_event(struct ptp_clock *ptp, struct ptp_clock_event *event) + { ++ struct timestamp_event_queue *tsevq; + struct pps_event_time evt; + + switch (event->type) { +@@ -361,7 +380,10 @@ void ptp_clock_event(struct ptp_clock *ptp, struct ptp_clock_event *event) + break; + + case PTP_CLOCK_EXTTS: +- enqueue_external_timestamp(&ptp->tsevq, event); ++ /* Enqueue timestamp on all queues */ ++ list_for_each_entry(tsevq, &ptp->tsevqs, qlist) { ++ enqueue_external_timestamp(tsevq, event); ++ } + wake_up_interruptible(&ptp->tsev_wq); + break; + +diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h +index ed6bf42fba86d..a469623f22751 100644 +--- a/drivers/ptp/ptp_private.h ++++ b/drivers/ptp/ptp_private.h +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + #define PTP_MAX_TIMESTAMPS 128 + #define PTP_BUF_TIMESTAMPS 30 +@@ -25,6 +26,7 @@ struct timestamp_event_queue { + int head; + int tail; + spinlock_t lock; ++ struct list_head qlist; + }; + + struct ptp_clock { +@@ -35,7 +37,7 @@ struct ptp_clock { + int index; /* index into clocks.map */ + struct pps_device *pps_source; + long dialed_frequency; /* remembers the frequency adjustment */ +- struct timestamp_event_queue tsevq; /* simple fifo for time stamps */ ++ struct list_head tsevqs; /* timestamp fifo list */ + struct mutex tsevq_mux; /* one process at a time reading the fifo */ + struct mutex pincfg_mux; /* protect concurrent info->pin_config access */ + wait_queue_head_t tsev_wq; +diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c +index be58d5257bcb6..2b2caca45a7d7 100644 +--- a/drivers/ptp/ptp_sysfs.c ++++ b/drivers/ptp/ptp_sysfs.c +@@ -64,12 +64,16 @@ static ssize_t extts_fifo_show(struct device *dev, + struct device_attribute *attr, char *page) + { + struct ptp_clock *ptp = dev_get_drvdata(dev); +- struct timestamp_event_queue *queue = &ptp->tsevq; ++ struct timestamp_event_queue *queue; + struct ptp_extts_event event; + unsigned long flags; + size_t qcnt; + int cnt = 0; + ++ /* The sysfs fifo will always draw from the fist queue */ ++ queue = list_first_entry(&ptp->tsevqs, struct timestamp_event_queue, ++ qlist); ++ + memset(&event, 0, sizeof(event)); + + if (mutex_lock_interruptible(&ptp->tsevq_mux)) +-- +2.39.5 + diff --git a/queue-5.15/ptp-support-event-queue-reader-channel-masks.patch b/queue-5.15/ptp-support-event-queue-reader-channel-masks.patch new file mode 100644 index 0000000000..7ad6ba7dc6 --- /dev/null +++ b/queue-5.15/ptp-support-event-queue-reader-channel-masks.patch @@ -0,0 +1,195 @@ +From aa92e17a6bc056b506704a3fbaf3c553ffdc4ff6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Oct 2023 00:39:56 +0200 +Subject: ptp: support event queue reader channel masks + +From: Xabier Marquiegui + +[ Upstream commit c5a445b1e9347b14752b01f1a304bd7a2f260acc ] + +On systems with multiple timestamp event channels, some readers might +want to receive only a subset of those channels. + +Add the necessary modifications to support timestamp event channel +filtering, including two IOCTL operations: + +- Clear all channels +- Enable one channel + +The mask modification operations will be applied exclusively on the +event queue assigned to the file descriptor used on the IOCTL operation, +so the typical procedure to have a reader receiving only a subset of the +enabled channels would be: + +- Open device file +- ioctl: clear all channels +- ioctl: enable one channel +- start reading + +Calling the enable one channel ioctl more than once will result in +multiple enabled channels. + +Signed-off-by: Xabier Marquiegui +Suggested-by: Richard Cochran +Suggested-by: Vinicius Costa Gomes +Signed-off-by: David S. Miller +Stable-dep-of: 19ae40f572a9 ("ptp: Properly handle compat ioctls") +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_chardev.c | 26 ++++++++++++++++++++++++++ + drivers/ptp/ptp_clock.c | 12 ++++++++++-- + drivers/ptp/ptp_private.h | 3 +++ + include/uapi/linux/ptp_clock.h | 2 ++ + 4 files changed, 41 insertions(+), 2 deletions(-) + +diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c +index 3c795fee49262..c48b9379ca094 100644 +--- a/drivers/ptp/ptp_chardev.c ++++ b/drivers/ptp/ptp_chardev.c +@@ -111,6 +111,12 @@ int ptp_open(struct posix_clock_context *pccontext, fmode_t fmode) + queue = kzalloc(sizeof(*queue), GFP_KERNEL); + if (!queue) + return -EINVAL; ++ queue->mask = bitmap_alloc(PTP_MAX_CHANNELS, GFP_KERNEL); ++ if (!queue->mask) { ++ kfree(queue); ++ return -EINVAL; ++ } ++ bitmap_set(queue->mask, 0, PTP_MAX_CHANNELS); + spin_lock_init(&queue->lock); + list_add_tail(&queue->qlist, &ptp->tsevqs); + pccontext->private_clkdata = queue; +@@ -127,6 +133,7 @@ int ptp_release(struct posix_clock_context *pccontext) + spin_lock_irqsave(&queue->lock, flags); + list_del(&queue->qlist); + spin_unlock_irqrestore(&queue->lock, flags); ++ bitmap_free(queue->mask); + kfree(queue); + } + return 0; +@@ -142,6 +149,7 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd, + struct system_device_crosststamp xtstamp; + struct ptp_clock_info *ops = ptp->info; + struct ptp_sys_offset *sysoff = NULL; ++ struct timestamp_event_queue *tsevq; + struct ptp_system_timestamp sts; + struct ptp_clock_request req; + struct ptp_clock_caps caps; +@@ -151,6 +159,8 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd, + struct timespec64 ts; + int enable, err = 0; + ++ tsevq = pccontext->private_clkdata; ++ + switch (cmd) { + + case PTP_CLOCK_GETCAPS: +@@ -446,6 +456,22 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd, + mutex_unlock(&ptp->pincfg_mux); + break; + ++ case PTP_MASK_CLEAR_ALL: ++ bitmap_clear(tsevq->mask, 0, PTP_MAX_CHANNELS); ++ break; ++ ++ case PTP_MASK_EN_SINGLE: ++ if (copy_from_user(&i, (void __user *)arg, sizeof(i))) { ++ err = -EFAULT; ++ break; ++ } ++ if (i >= PTP_MAX_CHANNELS) { ++ err = -EFAULT; ++ break; ++ } ++ set_bit(i, tsevq->mask); ++ break; ++ + default: + err = -ENOTTY; + break; +diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c +index c677a45474360..1e398fe5694db 100644 +--- a/drivers/ptp/ptp_clock.c ++++ b/drivers/ptp/ptp_clock.c +@@ -184,6 +184,7 @@ static void ptp_clock_release(struct device *dev) + spin_lock_irqsave(&tsevq->lock, flags); + list_del(&tsevq->qlist); + spin_unlock_irqrestore(&tsevq->lock, flags); ++ bitmap_free(tsevq->mask); + kfree(tsevq); + ida_free(&ptp_clocks_map, ptp->index); + kfree(ptp); +@@ -236,6 +237,10 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + if (!queue) + goto no_memory_queue; + list_add_tail(&queue->qlist, &ptp->tsevqs); ++ queue->mask = bitmap_alloc(PTP_MAX_CHANNELS, GFP_KERNEL); ++ if (!queue->mask) ++ goto no_memory_bitmap; ++ bitmap_set(queue->mask, 0, PTP_MAX_CHANNELS); + spin_lock_init(&queue->lock); + mutex_init(&ptp->pincfg_mux); + mutex_init(&ptp->n_vclocks_mux); +@@ -324,6 +329,8 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + kworker_err: + mutex_destroy(&ptp->pincfg_mux); + mutex_destroy(&ptp->n_vclocks_mux); ++ bitmap_free(queue->mask); ++no_memory_bitmap: + list_del(&queue->qlist); + kfree(queue); + no_memory_queue: +@@ -378,9 +385,10 @@ void ptp_clock_event(struct ptp_clock *ptp, struct ptp_clock_event *event) + break; + + case PTP_CLOCK_EXTTS: +- /* Enqueue timestamp on all queues */ ++ /* Enqueue timestamp on selected queues */ + list_for_each_entry(tsevq, &ptp->tsevqs, qlist) { +- enqueue_external_timestamp(tsevq, event); ++ if (test_bit((unsigned int)event->index, tsevq->mask)) ++ enqueue_external_timestamp(tsevq, event); + } + wake_up_interruptible(&ptp->tsev_wq); + break; +diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h +index baee5123dc22f..cc95f49abce5f 100644 +--- a/drivers/ptp/ptp_private.h ++++ b/drivers/ptp/ptp_private.h +@@ -16,10 +16,12 @@ + #include + #include + #include ++#include + + #define PTP_MAX_TIMESTAMPS 128 + #define PTP_BUF_TIMESTAMPS 30 + #define PTP_DEFAULT_MAX_VCLOCKS 20 ++#define PTP_MAX_CHANNELS 2048 + + struct timestamp_event_queue { + struct ptp_extts_event buf[PTP_MAX_TIMESTAMPS]; +@@ -27,6 +29,7 @@ struct timestamp_event_queue { + int tail; + spinlock_t lock; + struct list_head qlist; ++ unsigned long *mask; + }; + + struct ptp_clock { +diff --git a/include/uapi/linux/ptp_clock.h b/include/uapi/linux/ptp_clock.h +index 1d108d597f66d..2c4a479084b14 100644 +--- a/include/uapi/linux/ptp_clock.h ++++ b/include/uapi/linux/ptp_clock.h +@@ -223,6 +223,8 @@ struct ptp_pin_desc { + _IOWR(PTP_CLK_MAGIC, 17, struct ptp_sys_offset_precise) + #define PTP_SYS_OFFSET_EXTENDED2 \ + _IOWR(PTP_CLK_MAGIC, 18, struct ptp_sys_offset_extended) ++#define PTP_MASK_CLEAR_ALL _IO(PTP_CLK_MAGIC, 19) ++#define PTP_MASK_EN_SINGLE _IOW(PTP_CLK_MAGIC, 20, unsigned int) + + struct ptp_extts_event { + struct ptp_clock_time t; /* Time event occured. */ +-- +2.39.5 + diff --git a/queue-5.15/ptp-support-multiple-timestamp-event-readers.patch b/queue-5.15/ptp-support-multiple-timestamp-event-readers.patch new file mode 100644 index 0000000000..b187ce5b52 --- /dev/null +++ b/queue-5.15/ptp-support-multiple-timestamp-event-readers.patch @@ -0,0 +1,231 @@ +From 71884617a75ed903c04c09be4f759f634e9127f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Oct 2023 00:39:55 +0200 +Subject: ptp: support multiple timestamp event readers + +From: Xabier Marquiegui + +[ Upstream commit 8f5de6fb245326704f37d91780b9a10253a8a100 ] + +Use linked lists to create one event queue per open file. This enables +simultaneous readers for timestamp event queues. + +Signed-off-by: Xabier Marquiegui +Suggested-by: Richard Cochran +Signed-off-by: David S. Miller +Stable-dep-of: 19ae40f572a9 ("ptp: Properly handle compat ioctls") +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_chardev.c | 68 ++++++++++++++++++++++++++++----------- + drivers/ptp/ptp_clock.c | 6 ++-- + drivers/ptp/ptp_private.h | 1 - + drivers/ptp/ptp_sysfs.c | 9 +++--- + 4 files changed, 55 insertions(+), 29 deletions(-) + +diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c +index 82b5a68d1ca34..3c795fee49262 100644 +--- a/drivers/ptp/ptp_chardev.c ++++ b/drivers/ptp/ptp_chardev.c +@@ -104,6 +104,31 @@ int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin, + + int ptp_open(struct posix_clock_context *pccontext, fmode_t fmode) + { ++ struct ptp_clock *ptp = ++ container_of(pccontext->clk, struct ptp_clock, clock); ++ struct timestamp_event_queue *queue; ++ ++ queue = kzalloc(sizeof(*queue), GFP_KERNEL); ++ if (!queue) ++ return -EINVAL; ++ spin_lock_init(&queue->lock); ++ list_add_tail(&queue->qlist, &ptp->tsevqs); ++ pccontext->private_clkdata = queue; ++ return 0; ++} ++ ++int ptp_release(struct posix_clock_context *pccontext) ++{ ++ struct timestamp_event_queue *queue = pccontext->private_clkdata; ++ unsigned long flags; ++ ++ if (queue) { ++ pccontext->private_clkdata = NULL; ++ spin_lock_irqsave(&queue->lock, flags); ++ list_del(&queue->qlist); ++ spin_unlock_irqrestore(&queue->lock, flags); ++ kfree(queue); ++ } + return 0; + } + +@@ -439,10 +464,11 @@ __poll_t ptp_poll(struct posix_clock_context *pccontext, struct file *fp, + container_of(pccontext->clk, struct ptp_clock, clock); + struct timestamp_event_queue *queue; + +- poll_wait(fp, &ptp->tsev_wq, wait); ++ queue = pccontext->private_clkdata; ++ if (!queue) ++ return EPOLLERR; + +- /* Extract only the first element in the queue list */ +- queue = list_first_entry(&ptp->tsevqs, struct timestamp_event_queue, qlist); ++ poll_wait(fp, &ptp->tsev_wq, wait); + + return queue_cnt(queue) ? EPOLLIN : 0; + } +@@ -460,36 +486,36 @@ ssize_t ptp_read(struct posix_clock_context *pccontext, uint rdflags, + size_t qcnt, i; + int result; + +- /* Extract only the first element in the queue list */ +- queue = list_first_entry(&ptp->tsevqs, struct timestamp_event_queue, +- qlist); ++ queue = pccontext->private_clkdata; ++ if (!queue) { ++ result = -EINVAL; ++ goto exit; ++ } + +- if (cnt % sizeof(struct ptp_extts_event) != 0) +- return -EINVAL; ++ if (cnt % sizeof(struct ptp_extts_event) != 0) { ++ result = -EINVAL; ++ goto exit; ++ } + + if (cnt > EXTTS_BUFSIZE) + cnt = EXTTS_BUFSIZE; + + cnt = cnt / sizeof(struct ptp_extts_event); + +- if (mutex_lock_interruptible(&ptp->tsevq_mux)) +- return -ERESTARTSYS; +- + if (wait_event_interruptible(ptp->tsev_wq, + ptp->defunct || queue_cnt(queue))) { +- mutex_unlock(&ptp->tsevq_mux); + return -ERESTARTSYS; + } + + if (ptp->defunct) { +- mutex_unlock(&ptp->tsevq_mux); +- return -ENODEV; ++ result = -ENODEV; ++ goto exit; + } + + event = kmalloc(EXTTS_BUFSIZE, GFP_KERNEL); + if (!event) { +- mutex_unlock(&ptp->tsevq_mux); +- return -ENOMEM; ++ result = -ENOMEM; ++ goto exit; + } + + spin_lock_irqsave(&queue->lock, flags); +@@ -509,12 +535,16 @@ ssize_t ptp_read(struct posix_clock_context *pccontext, uint rdflags, + + cnt = cnt * sizeof(struct ptp_extts_event); + +- mutex_unlock(&ptp->tsevq_mux); +- + result = cnt; +- if (copy_to_user(buf, event, cnt)) ++ if (copy_to_user(buf, event, cnt)) { + result = -EFAULT; ++ goto free_event; ++ } + ++free_event: + kfree(event); ++exit: ++ if (result < 0) ++ ptp_release(pccontext); + return result; + } +diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c +index ff40f902f706f..c677a45474360 100644 +--- a/drivers/ptp/ptp_clock.c ++++ b/drivers/ptp/ptp_clock.c +@@ -163,6 +163,7 @@ static struct posix_clock_operations ptp_clock_ops = { + .clock_settime = ptp_clock_settime, + .ioctl = ptp_ioctl, + .open = ptp_open, ++ .release = ptp_release, + .poll = ptp_poll, + .read = ptp_read, + }; +@@ -175,7 +176,6 @@ static void ptp_clock_release(struct device *dev) + + ptp_cleanup_pin_groups(ptp); + kfree(ptp->vclock_index); +- mutex_destroy(&ptp->tsevq_mux); + mutex_destroy(&ptp->pincfg_mux); + mutex_destroy(&ptp->n_vclocks_mux); + /* Delete first entry */ +@@ -235,9 +235,8 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + queue = kzalloc(sizeof(*queue), GFP_KERNEL); + if (!queue) + goto no_memory_queue; +- spin_lock_init(&queue->lock); + list_add_tail(&queue->qlist, &ptp->tsevqs); +- mutex_init(&ptp->tsevq_mux); ++ spin_lock_init(&queue->lock); + mutex_init(&ptp->pincfg_mux); + mutex_init(&ptp->n_vclocks_mux); + init_waitqueue_head(&ptp->tsev_wq); +@@ -323,7 +322,6 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + if (ptp->kworker) + kthread_destroy_worker(ptp->kworker); + kworker_err: +- mutex_destroy(&ptp->tsevq_mux); + mutex_destroy(&ptp->pincfg_mux); + mutex_destroy(&ptp->n_vclocks_mux); + list_del(&queue->qlist); +diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h +index a469623f22751..baee5123dc22f 100644 +--- a/drivers/ptp/ptp_private.h ++++ b/drivers/ptp/ptp_private.h +@@ -38,7 +38,6 @@ struct ptp_clock { + struct pps_device *pps_source; + long dialed_frequency; /* remembers the frequency adjustment */ + struct list_head tsevqs; /* timestamp fifo list */ +- struct mutex tsevq_mux; /* one process at a time reading the fifo */ + struct mutex pincfg_mux; /* protect concurrent info->pin_config access */ + wait_queue_head_t tsev_wq; + int defunct; /* tells readers to go away when clock is being removed */ +diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c +index 2b2caca45a7d7..5986cb0c502c9 100644 +--- a/drivers/ptp/ptp_sysfs.c ++++ b/drivers/ptp/ptp_sysfs.c +@@ -70,15 +70,15 @@ static ssize_t extts_fifo_show(struct device *dev, + size_t qcnt; + int cnt = 0; + ++ cnt = list_count_nodes(&ptp->tsevqs); ++ if (cnt <= 0) ++ goto out; ++ + /* The sysfs fifo will always draw from the fist queue */ + queue = list_first_entry(&ptp->tsevqs, struct timestamp_event_queue, + qlist); + + memset(&event, 0, sizeof(event)); +- +- if (mutex_lock_interruptible(&ptp->tsevq_mux)) +- return -ERESTARTSYS; +- + spin_lock_irqsave(&queue->lock, flags); + qcnt = queue_cnt(queue); + if (qcnt) { +@@ -94,7 +94,6 @@ static ssize_t extts_fifo_show(struct device *dev, + cnt = snprintf(page, PAGE_SIZE, "%u %lld %u\n", + event.index, event.t.sec, event.t.nsec); + out: +- mutex_unlock(&ptp->tsevq_mux); + return cnt; + } + static DEVICE_ATTR(fifo, 0444, extts_fifo_show, NULL); +-- +2.39.5 + diff --git a/queue-5.15/pwm-stm32-add-check-for-clk_enable.patch b/queue-5.15/pwm-stm32-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..77b1100889 --- /dev/null +++ b/queue-5.15/pwm-stm32-add-check-for-clk_enable.patch @@ -0,0 +1,46 @@ +From 3a96e70b8e700e704043a1d35f2fd18ad82177d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Dec 2024 17:47:52 -0500 +Subject: pwm: stm32: Add check for clk_enable() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mingwei Zheng + +[ Upstream commit e8c59791ebb60790c74b2c3ab520f04a8a57219a ] + +Add check for the return value of clk_enable() to catch the potential +error. + +Fixes: 19f1016ea960 ("pwm: stm32: Fix enable count for clk in .probe()") +Signed-off-by: Mingwei Zheng +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20241215224752.220318-1-zmw12306@gmail.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-stm32.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c +index 2070d107c6328..fda7d76f08b1b 100644 +--- a/drivers/pwm/pwm-stm32.c ++++ b/drivers/pwm/pwm-stm32.c +@@ -631,8 +631,11 @@ static int stm32_pwm_probe(struct platform_device *pdev) + priv->chip.npwm = stm32_pwm_detect_channels(priv, &num_enabled); + + /* Initialize clock refcount to number of enabled PWM channels. */ +- for (i = 0; i < num_enabled; i++) +- clk_enable(priv->clk); ++ for (i = 0; i < num_enabled; i++) { ++ ret = clk_enable(priv->clk); ++ if (ret) ++ return ret; ++ } + + ret = pwmchip_add(&priv->chip); + if (ret < 0) +-- +2.39.5 + diff --git a/queue-5.15/pwm-stm32-lp-add-check-for-clk_enable.patch b/queue-5.15/pwm-stm32-lp-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..2ed0c5c18b --- /dev/null +++ b/queue-5.15/pwm-stm32-lp-add-check-for-clk_enable.patch @@ -0,0 +1,48 @@ +From 8043273e4e4a30f3924ccbfcacbb1eeccb110d9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 16:53:18 -0500 +Subject: pwm: stm32-lp: Add check for clk_enable() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mingwei Zheng + +[ Upstream commit cce16e7f6216227964cda25f5f23634bce2c500f ] + +Add check for the return value of clk_enable() to catch the potential +error. +We used APP-Miner to find it. + +Fixes: e70a540b4e02 ("pwm: Add STM32 LPTimer PWM driver") +Signed-off-by: Mingwei Zheng +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20241206215318.3402860-1-zmw12306@gmail.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-stm32-lp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-stm32-lp.c b/drivers/pwm/pwm-stm32-lp.c +index 61a1c87cd5016..c0350f5e02ac5 100644 +--- a/drivers/pwm/pwm-stm32-lp.c ++++ b/drivers/pwm/pwm-stm32-lp.c +@@ -169,8 +169,12 @@ static void stm32_pwm_lp_get_state(struct pwm_chip *chip, + regmap_read(priv->regmap, STM32_LPTIM_CR, &val); + state->enabled = !!FIELD_GET(STM32_LPTIM_ENABLE, val); + /* Keep PWM counter clock refcount in sync with PWM initial state */ +- if (state->enabled) +- clk_enable(priv->clk); ++ if (state->enabled) { ++ int ret = clk_enable(priv->clk); ++ ++ if (ret) ++ return ret; ++ } + + regmap_read(priv->regmap, STM32_LPTIM_CFGR, &val); + presc = FIELD_GET(STM32_LPTIM_PRESC, val); +-- +2.39.5 + diff --git a/queue-5.15/rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch b/queue-5.15/rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch new file mode 100644 index 0000000000..3147de2ba0 --- /dev/null +++ b/queue-5.15/rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch @@ -0,0 +1,43 @@ +From 1aaa8ee5b1c0e58f9faa0ab3310e02affda4dc49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Nov 2024 13:01:37 +0300 +Subject: rdma/cxgb4: Prevent potential integer overflow on 32bit + +From: Dan Carpenter + +[ Upstream commit bd96a3935e89486304461a21752f824fc25e0f0b ] + +The "gl->tot_len" variable is controlled by the user. It comes from +process_responses(). On 32bit systems, the "gl->tot_len + sizeof(struct +cpl_pass_accept_req) + sizeof(struct rss_header)" addition could have an +integer wrapping bug. Use size_add() to prevent this. + +Fixes: 1cab775c3e75 ("RDMA/cxgb4: Fix LE hash collision bug for passive open connection") +Link: https://patch.msgid.link/r/86b404e1-4a75-4a35-a34e-e3054fa554c7@stanley.mountain +Signed-off-by: Dan Carpenter +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/device.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c +index 541dbcf22d0eb..13e4b2c40d835 100644 +--- a/drivers/infiniband/hw/cxgb4/device.c ++++ b/drivers/infiniband/hw/cxgb4/device.c +@@ -1114,8 +1114,10 @@ static inline struct sk_buff *copy_gl_to_skb_pkt(const struct pkt_gl *gl, + * The math here assumes sizeof cpl_pass_accept_req >= sizeof + * cpl_rx_pkt. + */ +- skb = alloc_skb(gl->tot_len + sizeof(struct cpl_pass_accept_req) + +- sizeof(struct rss_header) - pktshift, GFP_ATOMIC); ++ skb = alloc_skb(size_add(gl->tot_len, ++ sizeof(struct cpl_pass_accept_req) + ++ sizeof(struct rss_header)) - pktshift, ++ GFP_ATOMIC); + if (unlikely(!skb)) + return NULL; + +-- +2.39.5 + diff --git a/queue-5.15/rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch b/queue-5.15/rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch new file mode 100644 index 0000000000..c197c16ceb --- /dev/null +++ b/queue-5.15/rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch @@ -0,0 +1,45 @@ +From 6169cfa155cf7c30622f2f4480bab9fc855b43f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 15:44:25 +0200 +Subject: RDMA/mlx4: Avoid false error about access to uninitialized gids array + +From: Leon Romanovsky + +[ Upstream commit 1f53d88cbb0dcc7df235bf6611ae632b254fccd8 ] + +Smatch generates the following false error report: +drivers/infiniband/hw/mlx4/main.c:393 mlx4_ib_del_gid() error: uninitialized symbol 'gids'. + +Traditionally, we are not changing kernel code and asking people to fix +the tools. However in this case, the fix can be done by simply rearranging +the code to be more clear. + +Fixes: e26be1bfef81 ("IB/mlx4: Implement ib_device callbacks") +Link: https://patch.msgid.link/6a3a1577463da16962463fcf62883a87506e9b62.1733233426.git.leonro@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c +index 53d83212cda81..67a1ef0260b24 100644 +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -392,10 +392,10 @@ static int mlx4_ib_del_gid(const struct ib_gid_attr *attr, void **context) + } + spin_unlock_bh(&iboe->lock); + +- if (!ret && hw_update) { ++ if (gids) + ret = mlx4_ib_update_gids(gids, ibdev, attr->port_num); +- kfree(gids); +- } ++ ++ kfree(gids); + return ret; + } + +-- +2.39.5 + diff --git a/queue-5.15/rdma-mlx5-enforce-umem-boundaries-for-explicit-odp-p.patch b/queue-5.15/rdma-mlx5-enforce-umem-boundaries-for-explicit-odp-p.patch new file mode 100644 index 0000000000..4005a89fef --- /dev/null +++ b/queue-5.15/rdma-mlx5-enforce-umem-boundaries-for-explicit-odp-p.patch @@ -0,0 +1,99 @@ +From ee3f5a75ecb57fbbf146d2d3b6fa3abb24149aff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Sep 2024 13:05:00 +0300 +Subject: RDMA/mlx5: Enforce umem boundaries for explicit ODP page faults + +From: Michael Guralnik + +[ Upstream commit 8c6d097d830f779fc1725fbaa1314f20a7a07b4b ] + +The new memory scheme page faults are requesting the driver to fetch +additinal pages to the faulted memory access. +This is done in order to prefetch pages before and after the area that +got the page fault, assuming this will reduce the total amount of page +faults. + +The driver should ensure it handles only the pages that are within the +umem range. + +Signed-off-by: Michael Guralnik +Link: https://patch.msgid.link/20240909100504.29797-5-michaelgur@nvidia.com +Signed-off-by: Leon Romanovsky +Stable-dep-of: 235f23840219 ("RDMA/mlx5: Fix indirect mkey ODP page count") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/odp.c | 25 ++++++++++++++++--------- + 1 file changed, 16 insertions(+), 9 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c +index 6ff65aaafcaa4..70d64a8378b5c 100644 +--- a/drivers/infiniband/hw/mlx5/odp.c ++++ b/drivers/infiniband/hw/mlx5/odp.c +@@ -732,24 +732,31 @@ static int pagefault_dmabuf_mr(struct mlx5_ib_mr *mr, size_t bcnt, + * >0: Number of pages mapped + */ + static int pagefault_mr(struct mlx5_ib_mr *mr, u64 io_virt, size_t bcnt, +- u32 *bytes_mapped, u32 flags) ++ u32 *bytes_mapped, u32 flags, bool permissive_fault) + { + struct ib_umem_odp *odp = to_ib_umem_odp(mr->umem); + +- if (unlikely(io_virt < mr->ibmr.iova)) ++ if (unlikely(io_virt < mr->ibmr.iova) && !permissive_fault) + return -EFAULT; + + if (mr->umem->is_dmabuf) + return pagefault_dmabuf_mr(mr, bcnt, bytes_mapped, flags); + + if (!odp->is_implicit_odp) { ++ u64 offset = io_virt < mr->ibmr.iova ? 0 : io_virt - mr->ibmr.iova; + u64 user_va; + +- if (check_add_overflow(io_virt - mr->ibmr.iova, +- (u64)odp->umem.address, &user_va)) ++ if (check_add_overflow(offset, (u64)odp->umem.address, ++ &user_va)) + return -EFAULT; +- if (unlikely(user_va >= ib_umem_end(odp) || +- ib_umem_end(odp) - user_va < bcnt)) ++ ++ if (permissive_fault) { ++ if (user_va < ib_umem_start(odp)) ++ user_va = ib_umem_start(odp); ++ if ((user_va + bcnt) > ib_umem_end(odp)) ++ bcnt = ib_umem_end(odp) - user_va; ++ } else if (unlikely(user_va >= ib_umem_end(odp) || ++ ib_umem_end(odp) - user_va < bcnt)) + return -EFAULT; + return pagefault_real_mr(mr, odp, user_va, bcnt, bytes_mapped, + flags); +@@ -872,7 +879,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev, + case MLX5_MKEY_MR: + mr = container_of(mmkey, struct mlx5_ib_mr, mmkey); + +- ret = pagefault_mr(mr, io_virt, bcnt, bytes_mapped, 0); ++ ret = pagefault_mr(mr, io_virt, bcnt, bytes_mapped, 0, false); + if (ret < 0) + goto end; + +@@ -1743,7 +1750,7 @@ static void mlx5_ib_prefetch_mr_work(struct work_struct *w) + for (i = 0; i < work->num_sge; ++i) { + ret = pagefault_mr(work->frags[i].mr, work->frags[i].io_virt, + work->frags[i].length, &bytes_mapped, +- work->pf_flags); ++ work->pf_flags, false); + if (ret <= 0) + continue; + mlx5_update_odp_stats(work->frags[i].mr, prefetch, ret); +@@ -1792,7 +1799,7 @@ static int mlx5_ib_prefetch_sg_list(struct ib_pd *pd, + if (!mr) + return -ENOENT; + ret = pagefault_mr(mr, sg_list[i].addr, sg_list[i].length, +- &bytes_mapped, pf_flags); ++ &bytes_mapped, pf_flags, false); + if (ret < 0) { + mlx5r_deref_odp_mkey(&mr->mmkey); + return ret; +-- +2.39.5 + diff --git a/queue-5.15/rdma-mlx5-fix-indirect-mkey-odp-page-count.patch b/queue-5.15/rdma-mlx5-fix-indirect-mkey-odp-page-count.patch new file mode 100644 index 0000000000..d5cc548254 --- /dev/null +++ b/queue-5.15/rdma-mlx5-fix-indirect-mkey-odp-page-count.patch @@ -0,0 +1,148 @@ +From e7c54ef5b00099b9b6c67cce88ccdeed6ca66e19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jan 2025 20:27:10 +0200 +Subject: RDMA/mlx5: Fix indirect mkey ODP page count + +From: Michael Guralnik + +[ Upstream commit 235f238402194a78ac5fb882a46717eac817e5d1 ] + +Restrict the check for the number of pages handled during an ODP page +fault to direct mkeys. +Perform the check right after handling the page fault and don't +propagate the number of handled pages to callers. + +Indirect mkeys and their associated direct mkeys can have different +start addresses. As a result, the calculation of the number of pages to +handle for an indirect mkey may not match the actual page fault +handling done on the direct mkey. + +For example: +A 4K sized page fault on a KSM mkey that has a start address that is not +aligned to a page will result a calculation that assumes the number of +pages required to handle are 2. +While the underlying MTT might be aligned will require fetching only a +single page. +Thus, do the calculation and compare number of pages handled only per +direct mkey. + +Fixes: db570d7deafb ("IB/mlx5: Add ODP support to MW") +Signed-off-by: Michael Guralnik +Reviewed-by: Artemy Kovalyov +Link: https://patch.msgid.link/86c483d9e75ce8fe14e9ff85b62df72b779f8ab1.1736187990.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/odp.c | 32 +++++++++++++++----------------- + 1 file changed, 15 insertions(+), 17 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c +index 70d64a8378b5c..ec18f8dda94f9 100644 +--- a/drivers/infiniband/hw/mlx5/odp.c ++++ b/drivers/infiniband/hw/mlx5/odp.c +@@ -821,8 +821,7 @@ static int get_indirect_num_descs(struct mlx5_core_mkey *mmkey) + /* + * Handle a single data segment in a page-fault WQE or RDMA region. + * +- * Returns number of OS pages retrieved on success. The caller may continue to +- * the next data segment. ++ * Returns zero on success. The caller may continue to the next data segment. + * Can return the following error codes: + * -EAGAIN to designate a temporary error. The caller will abort handling the + * page fault and resolve it. +@@ -835,7 +834,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev, + u32 *bytes_committed, + u32 *bytes_mapped) + { +- int npages = 0, ret, i, outlen, cur_outlen = 0, depth = 0; ++ int ret, i, outlen, cur_outlen = 0, depth = 0, pages_in_range; + struct pf_frame *head = NULL, *frame; + struct mlx5_core_mkey *mmkey; + struct mlx5_ib_mr *mr; +@@ -879,13 +878,20 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev, + case MLX5_MKEY_MR: + mr = container_of(mmkey, struct mlx5_ib_mr, mmkey); + ++ pages_in_range = (ALIGN(io_virt + bcnt, PAGE_SIZE) - ++ (io_virt & PAGE_MASK)) >> ++ PAGE_SHIFT; + ret = pagefault_mr(mr, io_virt, bcnt, bytes_mapped, 0, false); + if (ret < 0) + goto end; + + mlx5_update_odp_stats(mr, faults, ret); + +- npages += ret; ++ if (ret < pages_in_range) { ++ ret = -EFAULT; ++ goto end; ++ } ++ + ret = 0; + break; + +@@ -978,7 +984,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev, + kfree(out); + + *bytes_committed = 0; +- return ret ? ret : npages; ++ return ret; + } + + /* +@@ -997,8 +1003,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev, + * the committed bytes). + * @receive_queue: receive WQE end of sg list + * +- * Returns the number of pages loaded if positive, zero for an empty WQE, or a +- * negative error code. ++ * Returns zero for success or a negative error code. + */ + static int pagefault_data_segments(struct mlx5_ib_dev *dev, + struct mlx5_pagefault *pfault, +@@ -1006,7 +1011,7 @@ static int pagefault_data_segments(struct mlx5_ib_dev *dev, + void *wqe_end, u32 *bytes_mapped, + u32 *total_wqe_bytes, bool receive_queue) + { +- int ret = 0, npages = 0; ++ int ret = 0; + u64 io_virt; + u32 key; + u32 byte_count; +@@ -1062,10 +1067,9 @@ static int pagefault_data_segments(struct mlx5_ib_dev *dev, + bytes_mapped); + if (ret < 0) + break; +- npages += ret; + } + +- return ret < 0 ? ret : npages; ++ return ret; + } + + /* +@@ -1301,12 +1305,6 @@ static void mlx5_ib_mr_wqe_pfault_handler(struct mlx5_ib_dev *dev, + free_page((unsigned long)wqe_start); + } + +-static int pages_in_range(u64 address, u32 length) +-{ +- return (ALIGN(address + length, PAGE_SIZE) - +- (address & PAGE_MASK)) >> PAGE_SHIFT; +-} +- + static void mlx5_ib_mr_rdma_pfault_handler(struct mlx5_ib_dev *dev, + struct mlx5_pagefault *pfault) + { +@@ -1345,7 +1343,7 @@ static void mlx5_ib_mr_rdma_pfault_handler(struct mlx5_ib_dev *dev, + if (ret == -EAGAIN) { + /* We're racing with an invalidation, don't prefetch */ + prefetch_activated = 0; +- } else if (ret < 0 || pages_in_range(address, length) > ret) { ++ } else if (ret < 0) { + mlx5_ib_page_fault_resume(dev, pfault, 1); + if (ret != -ENOENT) + mlx5_ib_dbg(dev, "PAGE FAULT error %d. QP 0x%x, type: 0x%x\n", +-- +2.39.5 + diff --git a/queue-5.15/rdma-mlx5-remove-iova-from-struct-mlx5_core_mkey.patch b/queue-5.15/rdma-mlx5-remove-iova-from-struct-mlx5_core_mkey.patch new file mode 100644 index 0000000000..3a1eae7159 --- /dev/null +++ b/queue-5.15/rdma-mlx5-remove-iova-from-struct-mlx5_core_mkey.patch @@ -0,0 +1,194 @@ +From a39ee956a9d655d74e27310d4506dec7625788c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Oct 2021 13:26:30 +0300 +Subject: RDMA/mlx5: Remove iova from struct mlx5_core_mkey + +From: Aharon Landau + +[ Upstream commit cf6a8b1b24d675afc35a01cccd081160014a0125 ] + +iova is already stored in ibmr->iova, no need to store it here. + +Signed-off-by: Aharon Landau +Reviewed-by: Shay Drory +Acked-by: Michael S. Tsirkin +Signed-off-by: Leon Romanovsky +Stable-dep-of: 235f23840219 ("RDMA/mlx5: Fix indirect mkey ODP page count") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/devx.c | 1 - + drivers/infiniband/hw/mlx5/mr.c | 16 ++++++++-------- + drivers/infiniband/hw/mlx5/odp.c | 8 ++++---- + drivers/net/ethernet/mellanox/mlx5/core/mr.c | 1 - + drivers/vdpa/mlx5/core/resources.c | 1 - + include/linux/mlx5/driver.h | 1 - + 6 files changed, 12 insertions(+), 16 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index ef3585af40263..55e2873351240 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -1317,7 +1317,6 @@ static int devx_handle_mkey_indirect(struct devx_obj *obj, + mkey->key = mlx5_idx_to_mkey( + MLX5_GET(create_mkey_out, out, mkey_index)) | key; + mkey->type = MLX5_MKEY_INDIRECT_DEVX; +- mkey->iova = MLX5_GET64(mkc, mkc, start_addr); + mkey->size = MLX5_GET64(mkc, mkc, len); + mkey->pd = MLX5_GET(mkc, mkc, pd); + devx_mr->ndescs = MLX5_GET(mkc, mkc, translations_octword_size); +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index 191078b6e9129..768aba0987cce 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -916,12 +916,13 @@ static struct mlx5_cache_ent *mr_cache_ent_from_order(struct mlx5_ib_dev *dev, + } + + static void set_mr_fields(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr, +- u64 length, int access_flags) ++ u64 length, int access_flags, u64 iova) + { + mr->ibmr.lkey = mr->mmkey.key; + mr->ibmr.rkey = mr->mmkey.key; + mr->ibmr.length = length; + mr->ibmr.device = &dev->ib_dev; ++ mr->ibmr.iova = iova; + mr->access_flags = access_flags; + } + +@@ -979,11 +980,10 @@ static struct mlx5_ib_mr *alloc_cacheable_mr(struct ib_pd *pd, + + mr->ibmr.pd = pd; + mr->umem = umem; +- mr->mmkey.iova = iova; + mr->mmkey.size = umem->length; + mr->mmkey.pd = to_mpd(pd)->pdn; + mr->page_shift = order_base_2(page_size); +- set_mr_fields(dev, mr, umem->length, access_flags); ++ set_mr_fields(dev, mr, umem->length, access_flags, iova); + + return mr; + } +@@ -1093,7 +1093,7 @@ static void *mlx5_ib_create_xlt_wr(struct mlx5_ib_mr *mr, + wr->pd = mr->ibmr.pd; + wr->mkey = mr->mmkey.key; + wr->length = mr->mmkey.size; +- wr->virt_addr = mr->mmkey.iova; ++ wr->virt_addr = mr->ibmr.iova; + wr->access_flags = mr->access_flags; + wr->page_shift = mr->page_shift; + wr->xlt_size = sg->length; +@@ -1345,7 +1345,7 @@ static struct mlx5_ib_mr *reg_create(struct ib_pd *pd, struct ib_umem *umem, + } + mr->mmkey.type = MLX5_MKEY_MR; + mr->umem = umem; +- set_mr_fields(dev, mr, umem->length, access_flags); ++ set_mr_fields(dev, mr, umem->length, access_flags, iova); + kvfree(in); + + mlx5_ib_dbg(dev, "mkey = 0x%x\n", mr->mmkey.key); +@@ -1392,7 +1392,7 @@ static struct ib_mr *mlx5_ib_get_dm_mr(struct ib_pd *pd, u64 start_addr, + + kfree(in); + +- set_mr_fields(dev, mr, length, acc); ++ set_mr_fields(dev, mr, length, acc, start_addr); + + return &mr->ibmr; + +@@ -1769,7 +1769,7 @@ static int umr_rereg_pas(struct mlx5_ib_mr *mr, struct ib_pd *pd, + } + + mr->ibmr.length = new_umem->length; +- mr->mmkey.iova = iova; ++ mr->ibmr.iova = iova; + mr->mmkey.size = new_umem->length; + mr->page_shift = order_base_2(page_size); + mr->umem = new_umem; +@@ -1840,7 +1840,7 @@ struct ib_mr *mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start, + mr->umem = NULL; + atomic_sub(ib_umem_num_pages(umem), &dev->mdev->priv.reg_pages); + +- return create_real_mr(new_pd, umem, mr->mmkey.iova, ++ return create_real_mr(new_pd, umem, mr->ibmr.iova, + new_access_flags); + } + +diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c +index 66e53e895d341..6ff65aaafcaa4 100644 +--- a/drivers/infiniband/hw/mlx5/odp.c ++++ b/drivers/infiniband/hw/mlx5/odp.c +@@ -430,7 +430,7 @@ static struct mlx5_ib_mr *implicit_get_child_mr(struct mlx5_ib_mr *imr, + mr->umem = &odp->umem; + mr->ibmr.lkey = mr->mmkey.key; + mr->ibmr.rkey = mr->mmkey.key; +- mr->mmkey.iova = idx * MLX5_IMR_MTT_SIZE; ++ mr->ibmr.iova = idx * MLX5_IMR_MTT_SIZE; + mr->parent = imr; + odp->private = mr; + +@@ -500,7 +500,7 @@ struct mlx5_ib_mr *mlx5_ib_alloc_implicit_mr(struct mlx5_ib_pd *pd, + } + + imr->ibmr.pd = &pd->ibpd; +- imr->mmkey.iova = 0; ++ imr->ibmr.iova = 0; + imr->umem = &umem_odp->umem; + imr->ibmr.lkey = imr->mmkey.key; + imr->ibmr.rkey = imr->mmkey.key; +@@ -736,7 +736,7 @@ static int pagefault_mr(struct mlx5_ib_mr *mr, u64 io_virt, size_t bcnt, + { + struct ib_umem_odp *odp = to_ib_umem_odp(mr->umem); + +- if (unlikely(io_virt < mr->mmkey.iova)) ++ if (unlikely(io_virt < mr->ibmr.iova)) + return -EFAULT; + + if (mr->umem->is_dmabuf) +@@ -745,7 +745,7 @@ static int pagefault_mr(struct mlx5_ib_mr *mr, u64 io_virt, size_t bcnt, + if (!odp->is_implicit_odp) { + u64 user_va; + +- if (check_add_overflow(io_virt - mr->mmkey.iova, ++ if (check_add_overflow(io_virt - mr->ibmr.iova, + (u64)odp->umem.address, &user_va)) + return -EFAULT; + if (unlikely(user_va >= ib_umem_end(odp) || +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mr.c b/drivers/net/ethernet/mellanox/mlx5/core/mr.c +index 174f71ed52800..d239d559994fa 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/mr.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/mr.c +@@ -52,7 +52,6 @@ int mlx5_core_create_mkey(struct mlx5_core_dev *dev, + + mkc = MLX5_ADDR_OF(create_mkey_in, in, memory_key_mkey_entry); + mkey_index = MLX5_GET(create_mkey_out, lout, mkey_index); +- mkey->iova = MLX5_GET64(mkc, mkc, start_addr); + mkey->size = MLX5_GET64(mkc, mkc, len); + mkey->key = (u32)mlx5_mkey_variant(mkey->key) | mlx5_idx_to_mkey(mkey_index); + mkey->pd = MLX5_GET(mkc, mkc, pd); +diff --git a/drivers/vdpa/mlx5/core/resources.c b/drivers/vdpa/mlx5/core/resources.c +index 15e266d0e27a5..14d4314cdc295 100644 +--- a/drivers/vdpa/mlx5/core/resources.c ++++ b/drivers/vdpa/mlx5/core/resources.c +@@ -215,7 +215,6 @@ int mlx5_vdpa_create_mkey(struct mlx5_vdpa_dev *mvdev, struct mlx5_core_mkey *mk + + mkc = MLX5_ADDR_OF(create_mkey_in, in, memory_key_mkey_entry); + mkey_index = MLX5_GET(create_mkey_out, lout, mkey_index); +- mkey->iova = MLX5_GET64(mkc, mkc, start_addr); + mkey->size = MLX5_GET64(mkc, mkc, len); + mkey->key |= mlx5_idx_to_mkey(mkey_index); + mkey->pd = MLX5_GET(mkc, mkc, pd); +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index 62d60a515b038..8f0c321674a88 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -364,7 +364,6 @@ enum { + }; + + struct mlx5_core_mkey { +- u64 iova; + u64 size; + u32 key; + u32 pd; +-- +2.39.5 + diff --git a/queue-5.15/regulator-dt-bindings-mt6315-drop-regulator-compatib.patch b/queue-5.15/regulator-dt-bindings-mt6315-drop-regulator-compatib.patch new file mode 100644 index 0000000000..95634184e8 --- /dev/null +++ b/queue-5.15/regulator-dt-bindings-mt6315-drop-regulator-compatib.patch @@ -0,0 +1,62 @@ +From 3c616ee8d32451c1d7361e34d25ca2123f785ee0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 13:24:19 +0800 +Subject: regulator: dt-bindings: mt6315: Drop regulator-compatible property + +From: Chen-Yu Tsai + +[ Upstream commit 08242719a8af603db54a2a79234a8fe600680105 ] + +The "regulator-compatible" property has been deprecated since 2012 in +commit 13511def87b9 ("regulator: deprecate regulator-compatible DT +property"), which is so old it's not even mentioned in the converted +regulator bindings YAML file. It should not have been used for new +submissions such as the MT6315. + +Drop the property from the MT6315 regulator binding and its examples. + +Fixes: 977fb5b58469 ("regulator: document binding for MT6315 regulator") +Fixes: 6d435a94ba5b ("regulator: mt6315: Enforce regulator-compatible, not name") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patch.msgid.link/20241211052427.4178367-2-wenst@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/regulator/mt6315-regulator.yaml | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml b/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml +index 37402c370fbbc..eed0b3fa2d82c 100644 +--- a/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml ++++ b/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml +@@ -30,10 +30,6 @@ properties: + type: object + $ref: "regulator.yaml#" + +- properties: +- regulator-compatible: +- pattern: "^vbuck[1-4]$" +- + additionalProperties: false + + required: +@@ -51,7 +47,6 @@ examples: + + regulators { + vbuck1 { +- regulator-compatible = "vbuck1"; + regulator-min-microvolt = <300000>; + regulator-max-microvolt = <1193750>; + regulator-enable-ramp-delay = <256>; +@@ -59,7 +54,6 @@ examples: + }; + + vbuck3 { +- regulator-compatible = "vbuck3"; + regulator-min-microvolt = <300000>; + regulator-max-microvolt = <1193750>; + regulator-enable-ramp-delay = <256>; +-- +2.39.5 + diff --git a/queue-5.15/regulator-of-implement-the-unwind-path-of-of_regulat.patch b/queue-5.15/regulator-of-implement-the-unwind-path-of-of_regulat.patch new file mode 100644 index 0000000000..12dc133b56 --- /dev/null +++ b/queue-5.15/regulator-of-implement-the-unwind-path-of-of_regulat.patch @@ -0,0 +1,66 @@ +From d86dd910002a2e216596bcda4ff245a2e56edb0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jan 2025 17:04:53 +0900 +Subject: regulator: of: Implement the unwind path of of_regulator_match() + +From: Joe Hattori + +[ Upstream commit dddca3b2fc676113c58b04aaefe84bfb958ac83e ] + +of_regulator_match() does not release the OF node reference in the error +path, resulting in an OF node leak. Therefore, call of_node_put() on the +obtained nodes before returning the EINVAL error. + +Since it is possible that some drivers call this function and do not +exit on failure, such as s2mps11_pmic_driver, clear the init_data and +of_node in the error path. + +This was reported by an experimental verification tool that I am +developing. As I do not have access to actual devices nor the QEMU board +configuration to test drivers that call this function, no runtime test +was able to be performed. + +Fixes: 1c8fa58f4750 ("regulator: Add generic DT parsing for regulators") +Signed-off-by: Joe Hattori +Link: https://patch.msgid.link/20250104080453.2153592-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/of_regulator.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c +index e12b681c72e5e..a08905bab2797 100644 +--- a/drivers/regulator/of_regulator.c ++++ b/drivers/regulator/of_regulator.c +@@ -435,7 +435,7 @@ int of_regulator_match(struct device *dev, struct device_node *node, + "failed to parse DT for regulator %pOFn\n", + child); + of_node_put(child); +- return -EINVAL; ++ goto err_put; + } + match->of_node = of_node_get(child); + count++; +@@ -444,6 +444,18 @@ int of_regulator_match(struct device *dev, struct device_node *node, + } + + return count; ++ ++err_put: ++ for (i = 0; i < num_matches; i++) { ++ struct of_regulator_match *match = &matches[i]; ++ ++ match->init_data = NULL; ++ if (match->of_node) { ++ of_node_put(match->of_node); ++ match->of_node = NULL; ++ } ++ } ++ return -EINVAL; + } + EXPORT_SYMBOL_GPL(of_regulator_match); + +-- +2.39.5 + diff --git a/queue-5.15/revert-hid-multitouch-add-support-for-lenovo-y9000p-.patch b/queue-5.15/revert-hid-multitouch-add-support-for-lenovo-y9000p-.patch new file mode 100644 index 0000000000..cd070d4722 --- /dev/null +++ b/queue-5.15/revert-hid-multitouch-add-support-for-lenovo-y9000p-.patch @@ -0,0 +1,84 @@ +From d39c56cd86716e656811aaf9cee038be511fd026 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 09:53:10 +0100 +Subject: Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jiri Kosina + +[ Upstream commit 3d88ba86ba6f35a0467f25a88c38aa5639190d04 ] + +This reverts commit 251efae73bd46b097deec4f9986d926813aed744. + +Quoting Wang Yuli: + + "The 27C6:01E0 touchpad doesn't require the workaround and applying it + would actually break functionality. + + The initial report came from a BBS forum, but we suspect the + information provided by the forum user may be incorrect which could + happen sometimes. [1] + + Further investigation showed that the Lenovo Y9000P 2024 doesn't even + use a Goodix touchpad. [2] + + For the broader issue of 27c6:01e0 being unusable on some devices, it + just need to address it with a libinput quirk. + + In conclusion, we should revert this commit, which is the best + solution." + +Reported-by: Ulrich Müller +Reported-by: WangYuli +Link: https://lore.kernel.org/all/uikt4wwpw@gentoo.org/ +Signed-off-by: Jiri Kosina +Stable-dep-of: 8ade5e05bd09 ("HID: multitouch: fix support for Goodix PID 0x01e9") +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 - + drivers/hid/hid-multitouch.c | 8 ++------ + 2 files changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 291f8d3a3dd37..81db294dda408 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -484,7 +484,6 @@ + #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100 + + #define I2C_VENDOR_ID_GOODIX 0x27c6 +-#define I2C_DEVICE_ID_GOODIX_01E0 0x01e0 + #define I2C_DEVICE_ID_GOODIX_01E8 0x01e8 + #define I2C_DEVICE_ID_GOODIX_01E9 0x01e9 + #define I2C_DEVICE_ID_GOODIX_01F0 0x01f0 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 196ed532baa5d..57e4ff1ab275d 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1447,8 +1447,7 @@ static __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc, + { + if (hdev->vendor == I2C_VENDOR_ID_GOODIX && + (hdev->product == I2C_DEVICE_ID_GOODIX_01E8 || +- hdev->product == I2C_DEVICE_ID_GOODIX_01E9 || +- hdev->product == I2C_DEVICE_ID_GOODIX_01E0)) { ++ hdev->product == I2C_DEVICE_ID_GOODIX_01E9)) { + if (rdesc[607] == 0x15) { + rdesc[607] = 0x25; + dev_info( +@@ -2071,10 +2070,7 @@ static const struct hid_device_id mt_devices[] = { + I2C_DEVICE_ID_GOODIX_01E8) }, + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, + HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, +- I2C_DEVICE_ID_GOODIX_01E9) }, +- { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, +- HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, +- I2C_DEVICE_ID_GOODIX_01E0) }, ++ I2C_DEVICE_ID_GOODIX_01E8) }, + + /* GoodTouch panels */ + { .driver_data = MT_CLS_NSMU, +-- +2.39.5 + diff --git a/queue-5.15/rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch b/queue-5.15/rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch new file mode 100644 index 0000000000..f5fcacd276 --- /dev/null +++ b/queue-5.15/rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch @@ -0,0 +1,51 @@ +From 216080e5147a1052368f81b4243da57f7e7dd708 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 20:34:58 +0100 +Subject: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read + +From: Oleksij Rempel + +[ Upstream commit 3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c ] + +The nvmem interface supports variable buffer sizes, while the regmap +interface operates with fixed-size storage. If an nvmem client uses a +buffer size less than 4 bytes, regmap_read will write out of bounds +as it expects the buffer to point at an unsigned int. + +Fix this by using an intermediary unsigned int to hold the value. + +Fixes: fadfd092ee91 ("rtc: pcf85063: add nvram support") +Signed-off-by: Oleksij Rempel +Signed-off-by: Ahmad Fatoum +Link: https://lore.kernel.org/r/20241218-rtc-pcf85063-stack-corruption-v1-1-12fd0ee0f046@pengutronix.de +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf85063.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-pcf85063.c b/drivers/rtc/rtc-pcf85063.c +index bf2e370907b73..89e080798e03f 100644 +--- a/drivers/rtc/rtc-pcf85063.c ++++ b/drivers/rtc/rtc-pcf85063.c +@@ -320,7 +320,16 @@ static const struct rtc_class_ops pcf85063_rtc_ops = { + static int pcf85063_nvmem_read(void *priv, unsigned int offset, + void *val, size_t bytes) + { +- return regmap_read(priv, PCF85063_REG_RAM, val); ++ unsigned int tmp; ++ int ret; ++ ++ ret = regmap_read(priv, PCF85063_REG_RAM, &tmp); ++ if (ret < 0) ++ return ret; ++ ++ *(u8 *)val = tmp; ++ ++ return 0; + } + + static int pcf85063_nvmem_write(void *priv, unsigned int offset, +-- +2.39.5 + diff --git a/queue-5.15/rtlwifi-replace-usage-of-found-with-dedicated-list-i.patch b/queue-5.15/rtlwifi-replace-usage-of-found-with-dedicated-list-i.patch new file mode 100644 index 0000000000..bf80fba414 --- /dev/null +++ b/queue-5.15/rtlwifi-replace-usage-of-found-with-dedicated-list-i.patch @@ -0,0 +1,119 @@ +From 3a3c125e5cf67fc073a5d204e1bfb327f9fdeefd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Mar 2022 08:21:24 +0100 +Subject: rtlwifi: replace usage of found with dedicated list iterator variable + +From: Jakob Koschel + +[ Upstream commit a0ff2a87194a968b9547fd4d824a09092171d1ea ] + +To move the list iterator variable into the list_for_each_entry_*() +macro in the future it should be avoided to use the list iterator +variable after the loop body. + +To *never* use the list iterator variable after the loop it was +concluded to use a separate iterator variable instead of a +found boolean [1]. + +This removes the need to use a found variable and simply checking if +the variable was set, can determine if the break/goto was hit. + +Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ +Signed-off-by: Jakob Koschel +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220324072124.62458-1-jakobkoschel@gmail.com +Stable-dep-of: 2fdac64c3c35 ("wifi: rtlwifi: remove unused check_buddy_priv") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/base.c | 13 ++++++------- + drivers/net/wireless/realtek/rtlwifi/pci.c | 15 +++++++-------- + 2 files changed, 13 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index ffd150ec181fa..a7ef84f559399 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -1994,8 +1994,7 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb) + struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); + unsigned long flags; + +- struct rtl_bssid_entry *entry; +- bool entry_found = false; ++ struct rtl_bssid_entry *entry = NULL, *iter; + + /* check if it is scanning */ + if (!mac->act_scanning) +@@ -2008,10 +2007,10 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb) + + spin_lock_irqsave(&rtlpriv->locks.scan_list_lock, flags); + +- list_for_each_entry(entry, &rtlpriv->scan_list.list, list) { +- if (memcmp(entry->bssid, hdr->addr3, ETH_ALEN) == 0) { +- list_del_init(&entry->list); +- entry_found = true; ++ list_for_each_entry(iter, &rtlpriv->scan_list.list, list) { ++ if (memcmp(iter->bssid, hdr->addr3, ETH_ALEN) == 0) { ++ list_del_init(&iter->list); ++ entry = iter; + rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD, + "Update BSSID=%pM to scan list (total=%d)\n", + hdr->addr3, rtlpriv->scan_list.num); +@@ -2019,7 +2018,7 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb) + } + } + +- if (!entry_found) { ++ if (!entry) { + entry = kmalloc(sizeof(*entry), GFP_ATOMIC); + + if (!entry) +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 70f1cc906502b..f17a365fba070 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -300,14 +300,13 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw); +- bool find_buddy_priv = false; +- struct rtl_priv *tpriv; ++ struct rtl_priv *tpriv = NULL, *iter; + struct rtl_pci_priv *tpcipriv = NULL; + + if (!list_empty(&rtlpriv->glb_var->glb_priv_list)) { +- list_for_each_entry(tpriv, &rtlpriv->glb_var->glb_priv_list, ++ list_for_each_entry(iter, &rtlpriv->glb_var->glb_priv_list, + list) { +- tpcipriv = (struct rtl_pci_priv *)tpriv->priv; ++ tpcipriv = (struct rtl_pci_priv *)iter->priv; + rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, + "pcipriv->ndis_adapter.funcnumber %x\n", + pcipriv->ndis_adapter.funcnumber); +@@ -321,19 +320,19 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, + tpcipriv->ndis_adapter.devnumber && + pcipriv->ndis_adapter.funcnumber != + tpcipriv->ndis_adapter.funcnumber) { +- find_buddy_priv = true; ++ tpriv = iter; + break; + } + } + } + + rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, +- "find_buddy_priv %d\n", find_buddy_priv); ++ "find_buddy_priv %d\n", tpriv != NULL); + +- if (find_buddy_priv) ++ if (tpriv) + *buddy_priv = tpriv; + +- return find_buddy_priv; ++ return tpriv != NULL; + } + + static void rtl_pci_parse_configuration(struct pci_dev *pdev, +-- +2.39.5 + diff --git a/queue-5.15/samples-landlock-fix-possible-null-dereference-in-pa.patch b/queue-5.15/samples-landlock-fix-possible-null-dereference-in-pa.patch new file mode 100644 index 0000000000..0abc39776b --- /dev/null +++ b/queue-5.15/samples-landlock-fix-possible-null-dereference-in-pa.patch @@ -0,0 +1,53 @@ +From f4672fd4f217eaaf474c48774066f53a61f7ea78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 21:29:56 -0600 +Subject: samples/landlock: Fix possible NULL dereference in parse_path() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zichen Xie + +[ Upstream commit 078bf9438a31567e2c0587159ccefde835fb1ced ] + +malloc() may return NULL, leading to NULL dereference. Add a NULL +check. + +Fixes: ba84b0bf5a16 ("samples/landlock: Add a sandbox manager example") +Signed-off-by: Zichen Xie +Link: https://lore.kernel.org/r/20241128032955.11711-1-zichenxie0106@gmail.com +[mic: Simplify fix] +Signed-off-by: Mickaël Salaün +Signed-off-by: Sasha Levin +--- + samples/landlock/sandboxer.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c +index c089e9cdaf328..1825a2935bd82 100644 +--- a/samples/landlock/sandboxer.c ++++ b/samples/landlock/sandboxer.c +@@ -65,6 +65,9 @@ static int parse_path(char *env_path, const char ***const path_list) + } + } + *path_list = malloc(num_paths * sizeof(**path_list)); ++ if (!*path_list) ++ return -1; ++ + for (i = 0; i < num_paths; i++) + (*path_list)[i] = strsep(&env_path, ENV_PATH_TOKEN); + +@@ -99,6 +102,10 @@ static int populate_ruleset(const char *const env_var, const int ruleset_fd, + env_path_name = strdup(env_path_name); + unsetenv(env_var); + num_paths = parse_path(env_path_name, &path_list); ++ if (num_paths < 0) { ++ fprintf(stderr, "Failed to allocate memory\n"); ++ goto out_free_name; ++ } + if (num_paths == 1 && path_list[0][0] == '\0') { + /* + * Allows to not use all possible restrictions (e.g. use +-- +2.39.5 + diff --git a/queue-5.15/sched-fair-fix-value-reported-by-hot-tasks-pulled-in.patch b/queue-5.15/sched-fair-fix-value-reported-by-hot-tasks-pulled-in.patch new file mode 100644 index 0000000000..b7124832a4 --- /dev/null +++ b/queue-5.15/sched-fair-fix-value-reported-by-hot-tasks-pulled-in.patch @@ -0,0 +1,97 @@ +From eeae6ea6e6cb681262cacd62a7ac826e23801b49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 06:32:19 +0000 +Subject: sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat + +From: Peter Zijlstra + +[ Upstream commit a430d99e349026d53e2557b7b22bd2ebd61fe12a ] + +In /proc/schedstat, lb_hot_gained reports the number hot tasks pulled +during load balance. This value is incremented in can_migrate_task() +if the task is migratable and hot. After incrementing the value, +load balancer can still decide not to migrate this task leading to wrong +accounting. Fix this by incrementing stats when hot tasks are detached. +This issue only exists in detach_tasks() where we can decide to not +migrate hot task even if it is migratable. However, in detach_one_task(), +we migrate it unconditionally. + +[Swapnil: Handled the case where nr_failed_migrations_hot was not accounted properly and wrote commit log] + +Fixes: d31980846f96 ("sched: Move up affinity check to mitigate useless redoing overhead") +Signed-off-by: Peter Zijlstra (Intel) +Reported-by: "Gautham R. Shenoy" +Not-yet-signed-off-by: Peter Zijlstra +Signed-off-by: Swapnil Sapkal +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20241220063224.17767-2-swapnil.sapkal@amd.com +Signed-off-by: Sasha Levin +--- + include/linux/sched.h | 1 + + kernel/sched/fair.c | 17 +++++++++++++---- + 2 files changed, 14 insertions(+), 4 deletions(-) + +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 875f3d317b9c8..5d0a44e4db4b5 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -874,6 +874,7 @@ struct task_struct { + unsigned sched_reset_on_fork:1; + unsigned sched_contributes_to_load:1; + unsigned sched_migrated:1; ++ unsigned sched_task_hot:1; + + /* Force alignment to the next boundary: */ + unsigned :0; +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 4056330d38887..20044e7506ae1 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -8022,6 +8022,8 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) + int tsk_cache_hot; + + lockdep_assert_rq_held(env->src_rq); ++ if (p->sched_task_hot) ++ p->sched_task_hot = 0; + + /* + * We do not migrate tasks that are: +@@ -8094,10 +8096,8 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) + + if (tsk_cache_hot <= 0 || + env->sd->nr_balance_failed > env->sd->cache_nice_tries) { +- if (tsk_cache_hot == 1) { +- schedstat_inc(env->sd->lb_hot_gained[env->idle]); +- schedstat_inc(p->stats.nr_forced_migrations); +- } ++ if (tsk_cache_hot == 1) ++ p->sched_task_hot = 1; + return 1; + } + +@@ -8112,6 +8112,12 @@ static void detach_task(struct task_struct *p, struct lb_env *env) + { + lockdep_assert_rq_held(env->src_rq); + ++ if (p->sched_task_hot) { ++ p->sched_task_hot = 0; ++ schedstat_inc(env->sd->lb_hot_gained[env->idle]); ++ schedstat_inc(p->stats.nr_forced_migrations); ++ } ++ + deactivate_task(env->src_rq, p, DEQUEUE_NOCLOCK); + set_task_cpu(p, env->dst_cpu); + } +@@ -8274,6 +8280,9 @@ static int detach_tasks(struct lb_env *env) + + continue; + next: ++ if (p->sched_task_hot) ++ schedstat_inc(p->stats.nr_failed_migrations_hot); ++ + list_move(&p->se.group_node, tasks); + } + +-- +2.39.5 + diff --git a/queue-5.15/sched-psi-use-task-psi_flags-to-clear-in-cpu-migrati.patch b/queue-5.15/sched-psi-use-task-psi_flags-to-clear-in-cpu-migrati.patch new file mode 100644 index 0000000000..87241467e7 --- /dev/null +++ b/queue-5.15/sched-psi-use-task-psi_flags-to-clear-in-cpu-migrati.patch @@ -0,0 +1,118 @@ +From 67fd499db66073d1dd81750876a8a2937167876f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Sep 2022 16:19:31 +0800 +Subject: sched/psi: Use task->psi_flags to clear in CPU migration + +From: Chengming Zhou + +[ Upstream commit 52b33d87b9197c51e8ffdc61873739d90dd0a16f ] + +The commit d583d360a620 ("psi: Fix psi state corruption when schedule() +races with cgroup move") fixed a race problem by making cgroup_move_task() +use task->psi_flags instead of looking at the scheduler state. + +We can extend task->psi_flags usage to CPU migration, which should be +a minor optimization for performance and code simplicity. + +Signed-off-by: Chengming Zhou +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Johannes Weiner +Link: https://lore.kernel.org/r/20220926081931.45420-1-zhouchengming@bytedance.com +Stable-dep-of: a430d99e3490 ("sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat") +Signed-off-by: Sasha Levin +--- + include/linux/sched.h | 3 --- + kernel/sched/core.c | 2 +- + kernel/sched/stats.h | 22 ++++------------------ + 3 files changed, 5 insertions(+), 22 deletions(-) + +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 9b3cfe685cb45..875f3d317b9c8 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -874,9 +874,6 @@ struct task_struct { + unsigned sched_reset_on_fork:1; + unsigned sched_contributes_to_load:1; + unsigned sched_migrated:1; +-#ifdef CONFIG_PSI +- unsigned sched_psi_wake_requeue:1; +-#endif + + /* Force alignment to the next boundary: */ + unsigned :0; +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index ed92b75f7e024..fee8e2a7c7530 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -1967,7 +1967,7 @@ static inline void enqueue_task(struct rq *rq, struct task_struct *p, int flags) + + if (!(flags & ENQUEUE_RESTORE)) { + sched_info_enqueue(rq, p); +- psi_enqueue(p, flags & ENQUEUE_WAKEUP); ++ psi_enqueue(p, (flags & ENQUEUE_WAKEUP) && !(flags & ENQUEUE_MIGRATED)); + } + + uclamp_rq_inc(rq, p); +diff --git a/kernel/sched/stats.h b/kernel/sched/stats.h +index 975703572bc0d..cee3100c74cd5 100644 +--- a/kernel/sched/stats.h ++++ b/kernel/sched/stats.h +@@ -91,11 +91,9 @@ static inline void psi_enqueue(struct task_struct *p, bool wakeup) + if (p->in_memstall) + set |= TSK_MEMSTALL_RUNNING; + +- if (!wakeup || p->sched_psi_wake_requeue) { ++ if (!wakeup) { + if (p->in_memstall) + set |= TSK_MEMSTALL; +- if (p->sched_psi_wake_requeue) +- p->sched_psi_wake_requeue = 0; + } else { + if (p->in_iowait) + clear |= TSK_IOWAIT; +@@ -106,8 +104,6 @@ static inline void psi_enqueue(struct task_struct *p, bool wakeup) + + static inline void psi_dequeue(struct task_struct *p, bool sleep) + { +- int clear = TSK_RUNNING; +- + if (static_branch_likely(&psi_disabled)) + return; + +@@ -120,10 +116,7 @@ static inline void psi_dequeue(struct task_struct *p, bool sleep) + if (sleep) + return; + +- if (p->in_memstall) +- clear |= (TSK_MEMSTALL | TSK_MEMSTALL_RUNNING); +- +- psi_task_change(p, clear, 0); ++ psi_task_change(p, p->psi_flags, 0); + } + + static inline void psi_ttwu_dequeue(struct task_struct *p) +@@ -135,19 +128,12 @@ static inline void psi_ttwu_dequeue(struct task_struct *p) + * deregister its sleep-persistent psi states from the old + * queue, and let psi_enqueue() know it has to requeue. + */ +- if (unlikely(p->in_iowait || p->in_memstall)) { ++ if (unlikely(p->psi_flags)) { + struct rq_flags rf; + struct rq *rq; +- int clear = 0; +- +- if (p->in_iowait) +- clear |= TSK_IOWAIT; +- if (p->in_memstall) +- clear |= TSK_MEMSTALL; + + rq = __task_rq_lock(p, &rf); +- psi_task_change(p, clear, 0); +- p->sched_psi_wake_requeue = 1; ++ psi_task_change(p, p->psi_flags, 0); + __task_rq_unlock(rq, &rf); + } + } +-- +2.39.5 + diff --git a/queue-5.15/scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch b/queue-5.15/scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch new file mode 100644 index 0000000000..3e259cd0dc --- /dev/null +++ b/queue-5.15/scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch @@ -0,0 +1,46 @@ +From 6b3f396e91848c98ec8fcb1a15f1b8f8ad7b6c0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 23:18:12 +0100 +Subject: scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1 + +From: Paul Menzel + +[ Upstream commit ad7c3c0cb8f61d6d5a48b83e62ca4a9fd2f26153 ] + +Currently, the code does: + + if (x == 0) { + x &= ~0x3; + x |= 0x1; + } + +Zeroing bits 0 and 1 of a variable that is 0 is not necessary. So directly +set the variable to 1. + +Cc: Sreekanth Reddy +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Signed-off-by: Paul Menzel +Link: https://lore.kernel.org/r/20241212221817.78940-2-pmenzel@molgen.mpg.de +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 0c768c404d3d8..64163090f63a8 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -5497,8 +5497,7 @@ _base_static_config_pages(struct MPT3SAS_ADAPTER *ioc) + if (!ioc->is_gen35_ioc && ioc->manu_pg11.EEDPTagMode == 0) { + pr_err("%s: overriding NVDATA EEDPTagMode setting\n", + ioc->name); +- ioc->manu_pg11.EEDPTagMode &= ~0x3; +- ioc->manu_pg11.EEDPTagMode |= 0x1; ++ ioc->manu_pg11.EEDPTagMode = 0x1; + mpt3sas_config_set_manufacturing_pg11(ioc, &mpi_reply, + &ioc->manu_pg11); + } +-- +2.39.5 + diff --git a/queue-5.15/scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch b/queue-5.15/scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch new file mode 100644 index 0000000000..cc23a8b161 --- /dev/null +++ b/queue-5.15/scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch @@ -0,0 +1,37 @@ +From 5077fc4061d08c12a89bbf501aa6adb48282a2bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 09:42:13 +0800 +Subject: scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails + +From: Guixin Liu + +[ Upstream commit fcf247deb3c3e1c6be5774e3fa03bbd018eff1a9 ] + +We should remove the bsg device when bsg_setup_queue() fails to release the +resources. + +Fixes: df032bf27a41 ("scsi: ufs: Add a bsg endpoint that supports UPIUs") +Signed-off-by: Guixin Liu +Link: https://lore.kernel.org/r/20241218014214.64533-2-kanie@linux.alibaba.com +Reviewed-by: Avri Altman +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs_bsg.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/ufs/ufs_bsg.c b/drivers/scsi/ufs/ufs_bsg.c +index 39bf204c6ec3e..16e8ddcf22fe4 100644 +--- a/drivers/scsi/ufs/ufs_bsg.c ++++ b/drivers/scsi/ufs/ufs_bsg.c +@@ -213,6 +213,7 @@ int ufs_bsg_probe(struct ufs_hba *hba) + q = bsg_setup_queue(bsg_dev, dev_name(bsg_dev), ufs_bsg_request, NULL, 0); + if (IS_ERR(q)) { + ret = PTR_ERR(q); ++ device_del(bsg_dev); + goto out; + } + +-- +2.39.5 + diff --git a/queue-5.15/select-fix-unbalanced-user_access_end.patch b/queue-5.15/select-fix-unbalanced-user_access_end.patch new file mode 100644 index 0000000000..bdf585b279 --- /dev/null +++ b/queue-5.15/select-fix-unbalanced-user_access_end.patch @@ -0,0 +1,56 @@ +From f1a984e96062eee1b2f36976cb75a091edda28c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 09:37:24 +0100 +Subject: select: Fix unbalanced user_access_end() + +From: Christophe Leroy + +[ Upstream commit 344af27715ddbf357cf76978d674428b88f8e92d ] + +While working on implementing user access validation on powerpc +I got the following warnings on a pmac32_defconfig build: + + CC fs/select.o + fs/select.o: warning: objtool: sys_pselect6+0x1bc: redundant UACCESS disable + fs/select.o: warning: objtool: sys_pselect6_time32+0x1bc: redundant UACCESS disable + +On powerpc/32s, user_read_access_begin/end() are no-ops, but the +failure path has a user_access_end() instead of user_read_access_end() +which means an access end without any prior access begin. + +Replace that user_access_end() by user_read_access_end(). + +Fixes: 7e71609f64ec ("pselect6() and friends: take handling the combined 6th/7th args into helper") +Signed-off-by: Christophe Leroy +Link: https://lore.kernel.org/r/a7139e28d767a13e667ee3c79599a8047222ef36.1736751221.git.christophe.leroy@csgroup.eu +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/select.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/select.c b/fs/select.c +index 668a5200503ae..7ce67428582e6 100644 +--- a/fs/select.c ++++ b/fs/select.c +@@ -787,7 +787,7 @@ static inline int get_sigset_argpack(struct sigset_argpack *to, + } + return 0; + Efault: +- user_access_end(); ++ user_read_access_end(); + return -EFAULT; + } + +@@ -1360,7 +1360,7 @@ static inline int get_compat_sigset_argpack(struct compat_sigset_argpack *to, + } + return 0; + Efault: +- user_access_end(); ++ user_read_access_end(); + return -EFAULT; + } + +-- +2.39.5 + diff --git a/queue-5.15/selftests-harness-fix-printing-of-mismatch-values-in.patch b/queue-5.15/selftests-harness-fix-printing-of-mismatch-values-in.patch new file mode 100644 index 0000000000..54a83a73ab --- /dev/null +++ b/queue-5.15/selftests-harness-fix-printing-of-mismatch-values-in.patch @@ -0,0 +1,83 @@ +From 59c8e84ed0197b91ba8eb5061ad170bf12526e98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 19:07:57 +0200 +Subject: selftests: harness: fix printing of mismatch values in __EXPECT() + +From: Dmitry V. Levin + +[ Upstream commit 02bc220dc6dc7c56edc4859bc5dd2c08b95d5fb5 ] + +intptr_t and uintptr_t are not big enough types on 32-bit architectures +when printing 64-bit values, resulting to the following incorrect +diagnostic output: + + # get_syscall_info.c:209:get_syscall_info:Expected exp_args[2] (3134324433) == info.entry.args[1] (3134324433) + +Replace intptr_t and uintptr_t with intmax_t and uintmax_t, respectively. +With this fix, the same test produces more usable diagnostic output: + + # get_syscall_info.c:209:get_syscall_info:Expected exp_args[2] (3134324433) == info.entry.args[1] (18446744072548908753) + +Link: https://lore.kernel.org/r/20250108170757.GA6723@strace.io +Fixes: b5bb6d3068ea ("selftests/seccomp: fix 32-bit build warnings") +Signed-off-by: Dmitry V. Levin +Reviewed-by: Kees Cook +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kselftest_harness.h | 24 ++++++++++----------- + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/tools/testing/selftests/kselftest_harness.h b/tools/testing/selftests/kselftest_harness.h +index a6ea2bd63a831..af65a83d1422a 100644 +--- a/tools/testing/selftests/kselftest_harness.h ++++ b/tools/testing/selftests/kselftest_harness.h +@@ -701,33 +701,33 @@ + /* Report with actual signedness to avoid weird output. */ \ + switch (is_signed_type(__exp) * 2 + is_signed_type(__seen)) { \ + case 0: { \ +- unsigned long long __exp_print = (uintptr_t)__exp; \ +- unsigned long long __seen_print = (uintptr_t)__seen; \ +- __TH_LOG("Expected %s (%llu) %s %s (%llu)", \ ++ uintmax_t __exp_print = (uintmax_t)__exp; \ ++ uintmax_t __seen_print = (uintmax_t)__seen; \ ++ __TH_LOG("Expected %s (%ju) %s %s (%ju)", \ + _expected_str, __exp_print, #_t, \ + _seen_str, __seen_print); \ + break; \ + } \ + case 1: { \ +- unsigned long long __exp_print = (uintptr_t)__exp; \ +- long long __seen_print = (intptr_t)__seen; \ +- __TH_LOG("Expected %s (%llu) %s %s (%lld)", \ ++ uintmax_t __exp_print = (uintmax_t)__exp; \ ++ intmax_t __seen_print = (intmax_t)__seen; \ ++ __TH_LOG("Expected %s (%ju) %s %s (%jd)", \ + _expected_str, __exp_print, #_t, \ + _seen_str, __seen_print); \ + break; \ + } \ + case 2: { \ +- long long __exp_print = (intptr_t)__exp; \ +- unsigned long long __seen_print = (uintptr_t)__seen; \ +- __TH_LOG("Expected %s (%lld) %s %s (%llu)", \ ++ intmax_t __exp_print = (intmax_t)__exp; \ ++ uintmax_t __seen_print = (uintmax_t)__seen; \ ++ __TH_LOG("Expected %s (%jd) %s %s (%ju)", \ + _expected_str, __exp_print, #_t, \ + _seen_str, __seen_print); \ + break; \ + } \ + case 3: { \ +- long long __exp_print = (intptr_t)__exp; \ +- long long __seen_print = (intptr_t)__seen; \ +- __TH_LOG("Expected %s (%lld) %s %s (%lld)", \ ++ intmax_t __exp_print = (intmax_t)__exp; \ ++ intmax_t __seen_print = (intmax_t)__seen; \ ++ __TH_LOG("Expected %s (%jd) %s %s (%jd)", \ + _expected_str, __exp_print, #_t, \ + _seen_str, __seen_print); \ + break; \ +-- +2.39.5 + diff --git a/queue-5.15/selftests-landlock-fix-error-message.patch b/queue-5.15/selftests-landlock-fix-error-message.patch new file mode 100644 index 0000000000..24ad7cf0b6 --- /dev/null +++ b/queue-5.15/selftests-landlock-fix-error-message.patch @@ -0,0 +1,41 @@ +From a91c02a0d40e00dc1f1df4106c8b00620ff1c0cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 16:43:28 +0100 +Subject: selftests/landlock: Fix error message +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mickaël Salaün + +[ Upstream commit 2107c35128ad751b201eb92fe91443450d9e5c37 ] + +The global variable errno may not be set in test_execute(). Do not use +it in related error message. + +Cc: Günther Noack +Fixes: e1199815b47b ("selftests/landlock: Add user space tests") +Link: https://lore.kernel.org/r/20250108154338.1129069-21-mic@digikod.net +Signed-off-by: Mickaël Salaün +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/landlock/fs_test.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c +index ea988b3d6b2ed..47fc4392f412e 100644 +--- a/tools/testing/selftests/landlock/fs_test.c ++++ b/tools/testing/selftests/landlock/fs_test.c +@@ -1767,8 +1767,7 @@ static void test_execute(struct __test_metadata *const _metadata, const int err, + ASSERT_EQ(1, WIFEXITED(status)); + ASSERT_EQ(err ? 2 : 0, WEXITSTATUS(status)) + { +- TH_LOG("Unexpected return code for \"%s\": %s", path, +- strerror(errno)); ++ TH_LOG("Unexpected return code for \"%s\"", path); + }; + } + +-- +2.39.5 + diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 0000000000..9f3cfa2b05 --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1,195 @@ +afs-fix-eexist-error-returned-from-afs_rmdir-to-be-e.patch +afs-fix-directory-format-encoding-struct.patch +hung_task-move-hung_task-sysctl-interface-to-hung_ta.patch +sysctl-use-const-for-typically-used-max-min-proc-sys.patch +sysctl-share-unsigned-long-const-values.patch +fs-move-inode-sysctls-to-its-own-file.patch +fs-move-fs-stat-sysctls-to-file_table.c.patch +fs-fix-proc_handler-for-sysctl_nr_open.patch +block-deprecate-autoloading-based-on-dev_t.patch +block-retry-call-probe-after-request_module-in-blk_r.patch +nbd-don-t-allow-reconnect-after-disconnect.patch +pstore-blk-trivial-typo-fixes.patch +nvme-add-error-check-for-xa_store-in-nvme_get_effect.patch +partitions-ldm-remove-the-initial-kernel-doc-notatio.patch +select-fix-unbalanced-user_access_end.patch +afs-fix-the-fallback-handling-for-the-yfs.removefile.patch +sched-psi-use-task-psi_flags-to-clear-in-cpu-migrati.patch +sched-fair-fix-value-reported-by-hot-tasks-pulled-in.patch +drm-etnaviv-fix-page-property-being-used-for-non-wri.patch +drm-etnaviv-move-flush_seq-increment-into-etnaviv_io.patch +drm-etnaviv-drop-the-second-argument-of-the-etnaviv_.patch +drm-etnaviv-drop-the-len-parameter-of-etnaviv_iommu_.patch +drm-etnaviv-record-gpu-visible-size-of-gem-bo-separa.patch +drm-etnaviv-map-and-unmap-gpuva-range-with-respect-t.patch +drm-etnaviv-drop-the-offset-in-page-manipulation.patch +drm-amdgpu-fix-potential-null-pointer-dereference-in.patch +genirq-make-handle_enforce_irqctx-unconditionally-av.patch +ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch +wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch +wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch +wifi-rtlwifi-wait-for-firmware-loading-before-releas.patch +wifi-rtlwifi-fix-init_sw_vars-leak-when-probe-fails.patch +wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch +spi-zynq-qspi-add-check-for-clk_enable.patch +dt-bindings-mmc-controller-clarify-the-address-cells.patch +spi-dt-bindings-add-schema-listing-peripheral-specif.patch +dt-bindings-another-pass-removing-cases-of-allof-con.patch +dt-bindings-leds-add-qualcomm-light-pulse-generator-.patch +dt-bindings-leds-optional-multi-led-unit-address.patch +dt-bindings-leds-add-multicolor-pwm-led-bindings.patch +dt-bindings-leds-class-multicolor-reference-class-di.patch +dt-bindings-leds-class-multicolor-fix-path-to-color-.patch +rtlwifi-replace-usage-of-found-with-dedicated-list-i.patch +wifi-rtlwifi-remove-unused-timer-and-related-code.patch +wifi-rtlwifi-remove-unused-dualmac-control-leftovers.patch +wifi-rtlwifi-remove-unused-check_buddy_priv.patch +wifi-rtlwifi-destroy-workqueue-at-rtl_deinit_core.patch +wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch +wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch +hid-multitouch-add-support-for-lenovo-y9000p-touchpa.patch +revert-hid-multitouch-add-support-for-lenovo-y9000p-.patch +hid-multitouch-fix-support-for-goodix-pid-0x01e9.patch +regulator-dt-bindings-mt6315-drop-regulator-compatib.patch +acpi-fan-cleanup-resources-in-the-error-path-of-.pro.patch +cpupower-fix-tsc-mhz-calculation.patch +dt-bindings-mfd-bd71815-fix-rsense-and-typos.patch +leds-netxbig-fix-an-of-node-reference-leak-in-netxbi.patch +pwm-stm32-lp-add-check-for-clk_enable.patch +cpufreq-schedutil-fix-superfluous-updates-caused-by-.patch +udp-deal-with-race-between-udp-socket-address-change.patch +clk-imx8mp-fix-clkout1-2-support.patch +team-prevent-adding-a-device-which-is-already-a-team.patch +regulator-of-implement-the-unwind-path-of-of_regulat.patch +hid-hid-thrustmaster-fix-warning-in-thrustmaster_pro.patch +samples-landlock-fix-possible-null-dereference-in-pa.patch +wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch +net-smc-fix-data-error-when-recvmsg-with-msg_peek-fl.patch +landlock-move-filesystem-helpers-and-add-a-new-one.patch +landlock-handle-weird-files.patch +wifi-mt76-mt76u_vendor_request-do-not-print-error-me.patch +cpufreq-acpi-fix-max-frequency-computation.patch +selftests-harness-fix-printing-of-mismatch-values-in.patch +wifi-cfg80211-handle-specific-bssid-in-6ghz-scanning.patch +wifi-cfg80211-adjust-allocation-of-colocated-ap-data.patch +clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch +pwm-stm32-add-check-for-clk_enable.patch +selftests-landlock-fix-error-message.patch +net-let-net.core.dev_weight-always-be-non-zero.patch +net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch +net-avoid-race-between-device-unregistration-and-eth.patch +net-sched-disallow-replacing-of-child-qdisc-from-one.patch +netfilter-nft_flow_offload-update-tcp-state-flags-un.patch +net-ethernet-ti-am65-cpsw-fix-freeing-irq-in-am65_cp.patch +tcp_cubic-fix-incorrect-hystart-round-start-detectio.patch +net-rose-prevent-integer-overflows-in-rose_setsockop.patch +tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch +libbpf-fix-segfault-due-to-libelf-functions-not-sett.patch +asoc-sun4i-spdif-add-clock-multiplier-settings.patch +perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch +perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch +perf-bpf-fix-two-memory-leakages-when-calling-perf_e.patch +asoc-renesas-rz-ssi-use-only-the-proper-amount-of-di.patch +ktest.pl-remove-unused-declarations-in-run_bisect_te.patch +crypto-hisilicon-sec-add-some-comments-for-soft-fall.patch +crypto-hisilicon-sec-delete-redundant-blank-lines.patch +crypto-hisilicon-sec2-optimize-the-error-return-proc.patch +crypto-hisilicon-sec2-fix-for-aead-icv-error.patch +crypto-hisilicon-sec2-fix-for-aead-invalid-authsize.patch +crypto-ixp4xx-fix-of-node-reference-leaks-in-init_ix.patch +padata-fix-sysfs-store-callback-check.patch +perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch +perf-machine-include-data-symbols-in-the-kernel-map.patch +perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch +perf-report-fix-misleading-help-message-about-demang.patch +bpf-send-signals-asynchronously-if-preemptible.patch +padata-fix-uaf-in-padata_reorder.patch +padata-add-pd-get-put-refcnt-helper.patch +padata-avoid-uaf-for-reorder_work.patch +soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch +arm-at91-pm-change-bu-power-switch-to-automatic-mode.patch +arm64-dts-mt8183-set-dmic-one-wire-mode-on-damu.patch +arm64-dts-mediatek-mt8516-fix-gicv2-range.patch +arm64-dts-mediatek-mt8516-fix-wdt-irq-type.patch +arm64-dts-mediatek-mt8516-remove-2-invalid-i2c-clock.patch +arm64-dts-mediatek-mt8516-add-i2c-clock-div-property.patch +arm64-dts-mediatek-mt8516-reserve-192-kib-for-tf-a.patch +rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch +rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch +arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch +arm64-dts-mediatek-mt8173-elm-drop-regulator-compati.patch +arm64-dts-mediatek-mt8173-elm-fix-mt6397-pmic-sub-no.patch +arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch +arm64-dts-mediatek-mt8183-kenzo-support-second-sourc.patch +arm64-dts-mediatek-mt8183-willow-support-second-sour.patch +memory-add-lpddr2-info-helpers.patch +memory-tegra20-emc-support-matching-timings-by-lpddr.patch +memory-tegra20-emc-fix-an-of-node-reference-bug-in-t.patch +arm64-dts-mediatek-mt8183-kukui-jacuzzi-drop-pp3300_.patch +arm64-dts-qcom-msm8996-fix-up-usb3-interrupts.patch +arm64-dts-qcom-msm8994-describe-usb-interrupts.patch +arm64-dts-qcom-msm8916-correct-sleep-clock-frequency.patch +arm64-dts-qcom-msm8994-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sc7280-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sm6125-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sm8250-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sm8350-correct-sleep-clock-frequency.patch +arm64-dts-qcom-sm8150-microsoft-surface-duo-fix-typo.patch +arm64-dts-qcom-sdm845-fix-interrupt-types-of-camss-i.patch +arm-dts-mediatek-mt7623-fix-ir-nodename.patch +fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch +rdma-mlx5-remove-iova-from-struct-mlx5_core_mkey.patch +rdma-mlx5-enforce-umem-boundaries-for-explicit-odp-p.patch +rdma-mlx5-fix-indirect-mkey-odp-page-count.patch +xen-x86-free_p2m_page-use-memblock_free_ptr-to-free-.patch +memblock-drop-memblock_free_early_nid-and-memblock_f.patch +of-reserved-memory-do-not-make-kmemleak-ignore-freed.patch +efi-sysfb_efi-fix-w-1-warnings-when-efi-is-not-set.patch +media-rc-iguanair-handle-timeouts.patch +media-lmedm04-handle-errors-for-lme2510_int_read.patch +pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch +media-marvell-add-check-for-clk_enable.patch +media-i2c-imx412-add-missing-newline-to-prints.patch +media-i2c-ov9282-correct-the-exposure-offset.patch +media-mipi-csis-add-check-for-clk_enable.patch +media-camif-core-add-check-for-clk_enable.patch +media-uvcvideo-propagate-buf-error-to-userspace.patch +mtd-hyperbus-make-hyperbus_unregister_device-return-.patch +mtd-hyperbus-hbmc-am654-convert-to-platform-remove-c.patch +mtd-hyperbus-hbmc-am654-fix-an-of-node-reference-lea.patch +staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch +pci-rcar-ep-fix-incorrect-variable-used-when-calling.patch +scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch +scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch +ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch +module-extend-the-preempt-disabled-section-in-derefe.patch +nfsv4.2-fix-copy_notify-xdr-buf-size-calculation.patch +nfsv4.2-mark-offload_cancel-moveable.patch +tools-bootconfig-fix-the-wrong-format-specifier.patch +xfrm-replay-fix-the-update-of-replay_esn-oseq_hi-for.patch +dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch +rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch +ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch +net-hns3-fix-oops-when-unload-drivers-paralleling.patch +gpio-mxc-remove-dead-code-after-switch-to-dt-only.patch +net-fec-implement-tso-descriptor-cleanup.patch +ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch +pm-hibernate-add-error-handling-for-syscore_suspend.patch +net-rose-fix-timer-races-against-user-threads.patch +net-netdevsim-try-to-close-udp-port-harness-races.patch +net-davicom-fix-uaf-in-dm9000_drv_remove.patch +ptp-remove-usage-of-the-deprecated-ida_simple_xxx-ap.patch +i915-move-list_count-to-list.h-as-list_count_nodes-f.patch +posix-clock-introduce-posix_clock_context-concept.patch +ptp-replace-timestamp-event-queue-with-linked-list.patch +ptp-support-multiple-timestamp-event-readers.patch +ptp-support-event-queue-reader-channel-masks.patch +ptp-properly-handle-compat-ioctls.patch +perf-trace-fix-runtime-error-of-index-out-of-bounds.patch +pm-sleep-restore-asynchronous-device-resume-optimiza.patch +pm-sleep-use-bool-for-all-1-bit-fields-in-struct-dev.patch +pm-sleep-core-synchronize-runtime-pm-status-of-paren.patch +vsock-allow-retrying-on-connect-failure.patch +bgmac-reduce-max-frame-size-to-support-just-mtu-1500.patch +net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch +net-hsr-fix-fill_frame_info-regression-vs-vlan-packe.patch diff --git a/queue-5.15/soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch b/queue-5.15/soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch new file mode 100644 index 0000000000..ce01b6c1ef --- /dev/null +++ b/queue-5.15/soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch @@ -0,0 +1,43 @@ +From bbc05a60f5781ebf28b3e5a4d3de62f2fdbe2a94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2024 13:33:36 +0100 +Subject: soc: atmel: fix device_node release in atmel_soc_device_init() + +From: Javier Carrasco + +[ Upstream commit d3455ab798100f40af77123e7c2443ec979c546b ] + +A device_node acquired via of_find_node_by_path() requires explicit +calls to of_node_put() when it is no longer needed to avoid leaking the +resource. + +Instead of adding the missing calls to of_node_put() in all execution +paths, use the cleanup attribute for 'np' by means of the __free() +macro, which automatically calls of_node_put() when the variable goes +out of scope. + +Fixes: 960ddf70cc11 ("drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs") +Signed-off-by: Javier Carrasco +Link: https://lore.kernel.org/r/20241031-soc-atmel-soc-cleanup-v2-1-73f2d235fd98@gmail.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/soc/atmel/soc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/atmel/soc.c b/drivers/soc/atmel/soc.c +index 9e3d370114474..31fae363a589b 100644 +--- a/drivers/soc/atmel/soc.c ++++ b/drivers/soc/atmel/soc.c +@@ -364,7 +364,7 @@ static const struct of_device_id at91_soc_allowed_list[] __initconst = { + + static int __init atmel_soc_device_init(void) + { +- struct device_node *np = of_find_node_by_path("/"); ++ struct device_node *np __free(device_node) = of_find_node_by_path("/"); + + if (!of_match_node(at91_soc_allowed_list, np)) + return 0; +-- +2.39.5 + diff --git a/queue-5.15/spi-dt-bindings-add-schema-listing-peripheral-specif.patch b/queue-5.15/spi-dt-bindings-add-schema-listing-peripheral-specif.patch new file mode 100644 index 0000000000..593c6f08a8 --- /dev/null +++ b/queue-5.15/spi-dt-bindings-add-schema-listing-peripheral-specif.patch @@ -0,0 +1,222 @@ +From 09df52a2a3a23621fff53072abfb9139562a489f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Nov 2021 23:49:09 +0530 +Subject: spi: dt-bindings: add schema listing peripheral-specific properties + +From: Pratyush Yadav + +[ Upstream commit 8762b07c95c18fbbe1c6b3eb1e8e686091c346b5 ] + +Many SPI controllers need to add properties to peripheral devices. This +could be the delay in clock or data lines, etc. These properties are +controller specific but need to be defined in the peripheral node +because they are per-peripheral and there can be multiple peripherals +attached to a controller. + +If these properties are not added to the peripheral binding, then the +dtbs check emits a warning. But these properties do not make much sense +in the peripheral binding because they are controller-specific and they +will just pollute every peripheral binding. So this binding is added to +collect all such properties from all such controllers. Peripheral +bindings should simply refer to this binding and they should be rid of +the warnings. + +There are some limitations with this approach. Firstly, there is no way +to specify required properties. The schema contains properties for all +controllers and there is no way to know which controller is being used. +Secondly, there is no way to restrict additional properties. Since this +schema will be used with an allOf operator, additionalProperties needs +to be true. In addition, the peripheral schema will have to set +unevaluatedProperties: false. + +Despite these limitations, this appears to be the best solution to this +problem that doesn't involve modifying existing tools or schema specs. + +Signed-off-by: Pratyush Yadav +Reviewed-by: Rob Herring +Link: https://lore.kernel.org/r/20211109181911.2251-2-p.yadav@ti.com +Signed-off-by: Mark Brown +Stable-dep-of: 609bc99a4452 ("dt-bindings: leds: class-multicolor: Fix path to color definitions") +Signed-off-by: Sasha Levin +--- + .../bindings/spi/spi-controller.yaml | 69 +-------------- + .../bindings/spi/spi-peripheral-props.yaml | 87 +++++++++++++++++++ + 2 files changed, 89 insertions(+), 67 deletions(-) + create mode 100644 Documentation/devicetree/bindings/spi/spi-peripheral-props.yaml + +diff --git a/Documentation/devicetree/bindings/spi/spi-controller.yaml b/Documentation/devicetree/bindings/spi/spi-controller.yaml +index 8246891602e77..36b72518f5654 100644 +--- a/Documentation/devicetree/bindings/spi/spi-controller.yaml ++++ b/Documentation/devicetree/bindings/spi/spi-controller.yaml +@@ -94,73 +94,8 @@ patternProperties: + "^.*@[0-9a-f]+$": + type: object + +- properties: +- compatible: +- description: +- Compatible of the SPI device. +- +- reg: +- minItems: 1 +- maxItems: 256 +- items: +- minimum: 0 +- maximum: 256 +- description: +- Chip select used by the device. +- +- spi-3wire: +- $ref: /schemas/types.yaml#/definitions/flag +- description: +- The device requires 3-wire mode. +- +- spi-cpha: +- $ref: /schemas/types.yaml#/definitions/flag +- description: +- The device requires shifted clock phase (CPHA) mode. +- +- spi-cpol: +- $ref: /schemas/types.yaml#/definitions/flag +- description: +- The device requires inverse clock polarity (CPOL) mode. +- +- spi-cs-high: +- $ref: /schemas/types.yaml#/definitions/flag +- description: +- The device requires the chip select active high. +- +- spi-lsb-first: +- $ref: /schemas/types.yaml#/definitions/flag +- description: +- The device requires the LSB first mode. +- +- spi-max-frequency: +- $ref: /schemas/types.yaml#/definitions/uint32 +- description: +- Maximum SPI clocking speed of the device in Hz. +- +- spi-rx-bus-width: +- description: +- Bus width to the SPI bus used for read transfers. +- If 0 is provided, then no RX will be possible on this device. +- $ref: /schemas/types.yaml#/definitions/uint32 +- enum: [0, 1, 2, 4, 8] +- default: 1 +- +- spi-rx-delay-us: +- description: +- Delay, in microseconds, after a read transfer. +- +- spi-tx-bus-width: +- description: +- Bus width to the SPI bus used for write transfers. +- If 0 is provided, then no TX will be possible on this device. +- $ref: /schemas/types.yaml#/definitions/uint32 +- enum: [0, 1, 2, 4, 8] +- default: 1 +- +- spi-tx-delay-us: +- description: +- Delay, in microseconds, after a write transfer. ++ allOf: ++ - $ref: spi-peripheral-props.yaml + + required: + - compatible +diff --git a/Documentation/devicetree/bindings/spi/spi-peripheral-props.yaml b/Documentation/devicetree/bindings/spi/spi-peripheral-props.yaml +new file mode 100644 +index 0000000000000..105fa2840e72a +--- /dev/null ++++ b/Documentation/devicetree/bindings/spi/spi-peripheral-props.yaml +@@ -0,0 +1,87 @@ ++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) ++%YAML 1.2 ++--- ++$id: http://devicetree.org/schemas/spi/spi-peripheral-props.yaml# ++$schema: http://devicetree.org/meta-schemas/core.yaml# ++ ++title: Peripheral-specific properties for a SPI bus. ++ ++description: ++ Many SPI controllers need to add properties to peripheral devices. They could ++ be common properties like spi-max-frequency, spi-cpha, etc. or they could be ++ controller specific like delay in clock or data lines, etc. These properties ++ need to be defined in the peripheral node because they are per-peripheral and ++ there can be multiple peripherals attached to a controller. All those ++ properties are listed here. The controller specific properties should go in ++ their own separate schema that should be referenced from here. ++ ++maintainers: ++ - Pratyush Yadav ++ ++properties: ++ reg: ++ minItems: 1 ++ maxItems: 256 ++ items: ++ minimum: 0 ++ maximum: 256 ++ description: ++ Chip select used by the device. ++ ++ spi-3wire: ++ $ref: /schemas/types.yaml#/definitions/flag ++ description: ++ The device requires 3-wire mode. ++ ++ spi-cpha: ++ $ref: /schemas/types.yaml#/definitions/flag ++ description: ++ The device requires shifted clock phase (CPHA) mode. ++ ++ spi-cpol: ++ $ref: /schemas/types.yaml#/definitions/flag ++ description: ++ The device requires inverse clock polarity (CPOL) mode. ++ ++ spi-cs-high: ++ $ref: /schemas/types.yaml#/definitions/flag ++ description: ++ The device requires the chip select active high. ++ ++ spi-lsb-first: ++ $ref: /schemas/types.yaml#/definitions/flag ++ description: ++ The device requires the LSB first mode. ++ ++ spi-max-frequency: ++ $ref: /schemas/types.yaml#/definitions/uint32 ++ description: ++ Maximum SPI clocking speed of the device in Hz. ++ ++ spi-rx-bus-width: ++ description: ++ Bus width to the SPI bus used for read transfers. ++ If 0 is provided, then no RX will be possible on this device. ++ $ref: /schemas/types.yaml#/definitions/uint32 ++ enum: [0, 1, 2, 4, 8] ++ default: 1 ++ ++ spi-rx-delay-us: ++ description: ++ Delay, in microseconds, after a read transfer. ++ ++ spi-tx-bus-width: ++ description: ++ Bus width to the SPI bus used for write transfers. ++ If 0 is provided, then no TX will be possible on this device. ++ $ref: /schemas/types.yaml#/definitions/uint32 ++ enum: [0, 1, 2, 4, 8] ++ default: 1 ++ ++ spi-tx-delay-us: ++ description: ++ Delay, in microseconds, after a write transfer. ++ ++# The controller specific properties go here. ++ ++additionalProperties: true +-- +2.39.5 + diff --git a/queue-5.15/spi-zynq-qspi-add-check-for-clk_enable.patch b/queue-5.15/spi-zynq-qspi-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..d0e759032f --- /dev/null +++ b/queue-5.15/spi-zynq-qspi-add-check-for-clk_enable.patch @@ -0,0 +1,53 @@ +From 556623acfdd01a3178c30f095e5110dacf19cc64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 20:52:06 -0500 +Subject: spi: zynq-qspi: Add check for clk_enable() + +From: Mingwei Zheng + +[ Upstream commit 8332e667099712e05ec87ba2058af394b51ebdc9 ] + +Add check for the return value of clk_enable() to catch the potential +error. + +Fixes: c618a90dcaf3 ("spi: zynq-qspi: Drop GPIO header") +Signed-off-by: Mingwei Zheng +Signed-off-by: Jiasheng Jiang +Link: https://patch.msgid.link/20241207015206.3689364-1-zmw12306@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynq-qspi.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c +index 78f31b61a2aac..77ea6b5223483 100644 +--- a/drivers/spi/spi-zynq-qspi.c ++++ b/drivers/spi/spi-zynq-qspi.c +@@ -379,12 +379,21 @@ static int zynq_qspi_setup_op(struct spi_device *spi) + { + struct spi_controller *ctlr = spi->master; + struct zynq_qspi *qspi = spi_controller_get_devdata(ctlr); ++ int ret; + + if (ctlr->busy) + return -EBUSY; + +- clk_enable(qspi->refclk); +- clk_enable(qspi->pclk); ++ ret = clk_enable(qspi->refclk); ++ if (ret) ++ return ret; ++ ++ ret = clk_enable(qspi->pclk); ++ if (ret) { ++ clk_disable(qspi->refclk); ++ return ret; ++ } ++ + zynq_qspi_write(qspi, ZYNQ_QSPI_ENABLE_OFFSET, + ZYNQ_QSPI_ENABLE_ENABLE_MASK); + +-- +2.39.5 + diff --git a/queue-5.15/staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch b/queue-5.15/staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch new file mode 100644 index 0000000000..e93cf4e5f2 --- /dev/null +++ b/queue-5.15/staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch @@ -0,0 +1,58 @@ +From 47e74b405f237d7f1b12c0bddad2018b81796b6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:54:11 +0900 +Subject: staging: media: imx: fix OF node leak in imx_media_add_of_subdevs() + +From: Joe Hattori + +[ Upstream commit 094f5c315f756b19198e6c401aa821ac0e868750 ] + +imx_media_add_of_subdevs() calls of_parse_phandle() and passes the +obtained node to imx_media_of_add_csi(). The passed node is used in +v4l2_async_nf_add_fwnode(), which increments the refcount of the node. +Therefore, while the current implementation only releases the node when +imx_media_of_add_csi() fails, but should always release it. Call +of_node_put() right after imx_media_of_add_csi(). + +Fixes: dee747f88167 ("media: imx: Don't register IPU subdevs/links if CSI port missing") +Signed-off-by: Joe Hattori +Reviewed-by: Vladimir Zapolskiy +Reviewed-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/staging/media/imx/imx-media-of.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/staging/media/imx/imx-media-of.c b/drivers/staging/media/imx/imx-media-of.c +index b677cf0e0c849..386ff38821e2f 100644 +--- a/drivers/staging/media/imx/imx-media-of.c ++++ b/drivers/staging/media/imx/imx-media-of.c +@@ -55,22 +55,18 @@ int imx_media_add_of_subdevs(struct imx_media_dev *imxmd, + break; + + ret = imx_media_of_add_csi(imxmd, csi_np); ++ of_node_put(csi_np); + if (ret) { + /* unavailable or already added is not an error */ + if (ret == -ENODEV || ret == -EEXIST) { +- of_node_put(csi_np); + continue; + } + + /* other error, can't continue */ +- goto err_out; ++ return ret; + } + } + + return 0; +- +-err_out: +- of_node_put(csi_np); +- return ret; + } + EXPORT_SYMBOL_GPL(imx_media_add_of_subdevs); +-- +2.39.5 + diff --git a/queue-5.15/sysctl-share-unsigned-long-const-values.patch b/queue-5.15/sysctl-share-unsigned-long-const-values.patch new file mode 100644 index 0000000000..1d76e99bc4 --- /dev/null +++ b/queue-5.15/sysctl-share-unsigned-long-const-values.patch @@ -0,0 +1,133 @@ +From 19204a941cffa0bb30965a16bb486823c815f854 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 22:12:48 -0800 +Subject: sysctl: share unsigned long const values + +From: Luis Chamberlain + +[ Upstream commit b1f2aff888af54a057c2c3c0d88a13ef5d37b52a ] + +Provide a way to share unsigned long values. This will allow others to +not have to re-invent these values. + +Link: https://lkml.kernel.org/r/20211124231435.1445213-9-mcgrof@kernel.org +Signed-off-by: Luis Chamberlain +Cc: Al Viro +Cc: Amir Goldstein +Cc: Andy Shevchenko +Cc: Antti Palosaari +Cc: Arnd Bergmann +Cc: Benjamin Herrenschmidt +Cc: Benjamin LaHaise +Cc: Clemens Ladisch +Cc: David Airlie +Cc: Douglas Gilbert +Cc: Eric Biederman +Cc: Greg Kroah-Hartman +Cc: Iurii Zaikin +Cc: James E.J. Bottomley +Cc: Jani Nikula +Cc: Jani Nikula +Cc: Jan Kara +Cc: Joel Becker +Cc: John Ogness +Cc: Joonas Lahtinen +Cc: Joseph Qi +Cc: Julia Lawall +Cc: Kees Cook +Cc: Lukas Middendorf +Cc: Mark Fasheh +Cc: Martin K. Petersen +Cc: Paul Turner +Cc: Peter Zijlstra +Cc: Petr Mladek +Cc: Phillip Potter +Cc: Qing Wang +Cc: "Rafael J. Wysocki" +Cc: Rodrigo Vivi +Cc: Sebastian Reichel +Cc: Sergey Senozhatsky +Cc: Stephen Kitt +Cc: Steven Rostedt (VMware) +Cc: Suren Baghdasaryan +Cc: Tetsuo Handa +Cc: "Theodore Ts'o" +Cc: Xiaoming Ni +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: d727935cad9f ("fs: fix proc_handler for sysctl_nr_open") +Signed-off-by: Sasha Levin +--- + fs/proc/proc_sysctl.c | 3 +++ + include/linux/sysctl.h | 6 ++++++ + kernel/sysctl.c | 9 +++------ + 3 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c +index 213ea008fe2db..7c5d472b193f8 100644 +--- a/fs/proc/proc_sysctl.c ++++ b/fs/proc/proc_sysctl.c +@@ -29,6 +29,9 @@ static const struct inode_operations proc_sys_dir_operations; + const int sysctl_vals[] = { -1, 0, 1, 2, 4, 100, 200, 1000, 3000, INT_MAX }; + EXPORT_SYMBOL(sysctl_vals); + ++const unsigned long sysctl_long_vals[] = { 0, 1, LONG_MAX }; ++EXPORT_SYMBOL_GPL(sysctl_long_vals); ++ + /* Support for permanently empty directories */ + + struct ctl_table sysctl_mount_point[] = { +diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h +index 32d79ef906e51..3fa5e2713aace 100644 +--- a/include/linux/sysctl.h ++++ b/include/linux/sysctl.h +@@ -51,6 +51,12 @@ struct ctl_dir; + + extern const int sysctl_vals[]; + ++#define SYSCTL_LONG_ZERO ((void *)&sysctl_long_vals[0]) ++#define SYSCTL_LONG_ONE ((void *)&sysctl_long_vals[1]) ++#define SYSCTL_LONG_MAX ((void *)&sysctl_long_vals[2]) ++ ++extern const unsigned long sysctl_long_vals[]; ++ + typedef int proc_handler(struct ctl_table *ctl, int write, void *buffer, + size_t *lenp, loff_t *ppos); + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 48eb4e7b72dea..05853e7681512 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -113,9 +113,6 @@ + static int sixty = 60; + #endif + +-static const unsigned long zero_ul; +-static const unsigned long one_ul = 1; +-static const unsigned long long_max = LONG_MAX; + #ifdef CONFIG_PRINTK + static const int ten_thousand = 10000; + #endif +@@ -2726,7 +2723,7 @@ static struct ctl_table vm_table[] = { + .maxlen = sizeof(dirty_background_bytes), + .mode = 0644, + .proc_handler = dirty_background_bytes_handler, +- .extra1 = (void *)&one_ul, ++ .extra1 = SYSCTL_LONG_ONE, + }, + { + .procname = "dirty_ratio", +@@ -3146,8 +3143,8 @@ static struct ctl_table fs_table[] = { + .maxlen = sizeof(files_stat.max_files), + .mode = 0644, + .proc_handler = proc_doulongvec_minmax, +- .extra1 = (void *)&zero_ul, +- .extra2 = (void *)&long_max, ++ .extra1 = SYSCTL_LONG_ZERO, ++ .extra2 = SYSCTL_LONG_MAX, + }, + { + .procname = "nr_open", +-- +2.39.5 + diff --git a/queue-5.15/sysctl-use-const-for-typically-used-max-min-proc-sys.patch b/queue-5.15/sysctl-use-const-for-typically-used-max-min-proc-sys.patch new file mode 100644 index 0000000000..3f69051783 --- /dev/null +++ b/queue-5.15/sysctl-use-const-for-typically-used-max-min-proc-sys.patch @@ -0,0 +1,223 @@ +From 2f261be58124e5da5a0f67b87ac2efe0d9d77acf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 22:11:14 -0800 +Subject: sysctl: use const for typically used max/min proc sysctls + +From: Xiaoming Ni + +[ Upstream commit d73840ec2f747b860331bbba53677d0ce38fb9c1 ] + +When proc_dointvec_minmax() or proc_doulongvec_minmax() are used we are +using the extra1 and extra2 parameters on the sysctl table only for a +min and max boundary, these extra1 and extra2 arguments are then used +for read-only operations. So make them const to reflect this. + +[mcgrof@kernel.org: commit log love] + +Link: https://lkml.kernel.org/r/20211123202347.818157-7-mcgrof@kernel.org +Signed-off-by: Xiaoming Ni +Signed-off-by: Luis Chamberlain +Cc: Al Viro +Cc: Amir Goldstein +Cc: Andy Shevchenko +Cc: Benjamin LaHaise +Cc: "Eric W. Biederman" +Cc: Greg Kroah-Hartman +Cc: Iurii Zaikin +Cc: Jan Kara +Cc: Kees Cook +Cc: Paul Turner +Cc: Peter Zijlstra +Cc: Petr Mladek +Cc: Qing Wang +Cc: Sebastian Reichel +Cc: Sergey Senozhatsky +Cc: Stephen Kitt +Cc: Tetsuo Handa +Cc: Antti Palosaari +Cc: Arnd Bergmann +Cc: Benjamin Herrenschmidt +Cc: Clemens Ladisch +Cc: David Airlie +Cc: Jani Nikula +Cc: Joel Becker +Cc: Joonas Lahtinen +Cc: Joseph Qi +Cc: Julia Lawall +Cc: Lukas Middendorf +Cc: Mark Fasheh +Cc: Phillip Potter +Cc: Rodrigo Vivi +Cc: Douglas Gilbert +Cc: James E.J. Bottomley +Cc: Jani Nikula +Cc: John Ogness +Cc: Martin K. Petersen +Cc: "Rafael J. Wysocki" +Cc: Steven Rostedt (VMware) +Cc: Suren Baghdasaryan +Cc: "Theodore Ts'o" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: d727935cad9f ("fs: fix proc_handler for sysctl_nr_open") +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 53 ++++++++++++++++++++++++------------------------- + 1 file changed, 26 insertions(+), 27 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 0a84cb7a8bffe..48eb4e7b72dea 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -113,27 +113,26 @@ + static int sixty = 60; + #endif + +-static unsigned long zero_ul; +-static unsigned long one_ul = 1; +-static unsigned long long_max = LONG_MAX; ++static const unsigned long zero_ul; ++static const unsigned long one_ul = 1; ++static const unsigned long long_max = LONG_MAX; + #ifdef CONFIG_PRINTK +-static int ten_thousand = 10000; ++static const int ten_thousand = 10000; + #endif + #ifdef CONFIG_PERF_EVENTS +-static int six_hundred_forty_kb = 640 * 1024; ++static const int six_hundred_forty_kb = 640 * 1024; + #endif + + /* this is needed for the proc_doulongvec_minmax of vm_dirty_bytes */ +-static unsigned long dirty_bytes_min = 2 * PAGE_SIZE; ++static const unsigned long dirty_bytes_min = 2 * PAGE_SIZE; + + /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */ +-static int maxolduid = 65535; +-static int minolduid; ++static const int maxolduid = 65535; ++static const int minolduid; + + static int ngroups_max = NGROUPS_MAX; + static const int cap_last_cap = CAP_LAST_CAP; + +- + #ifdef CONFIG_INOTIFY_USER + #include + #endif +@@ -177,8 +176,8 @@ int sysctl_legacy_va_layout; + #endif + + #ifdef CONFIG_COMPACTION +-static int min_extfrag_threshold; +-static int max_extfrag_threshold = 1000; ++static const int min_extfrag_threshold; ++static const int max_extfrag_threshold = 1000; + #endif + + #endif /* CONFIG_SYSCTL */ +@@ -2196,8 +2195,8 @@ static struct ctl_table kern_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, +- .extra1 = &minolduid, +- .extra2 = &maxolduid, ++ .extra1 = (void *)&minolduid, ++ .extra2 = (void *)&maxolduid, + }, + { + .procname = "overflowgid", +@@ -2205,8 +2204,8 @@ static struct ctl_table kern_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, +- .extra1 = &minolduid, +- .extra2 = &maxolduid, ++ .extra1 = (void *)&minolduid, ++ .extra2 = (void *)&maxolduid, + }, + #ifdef CONFIG_S390 + { +@@ -2269,7 +2268,7 @@ static struct ctl_table kern_table[] = { + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, +- .extra2 = &ten_thousand, ++ .extra2 = (void *)&ten_thousand, + }, + { + .procname = "printk_devkmsg", +@@ -2571,7 +2570,7 @@ static struct ctl_table kern_table[] = { + .mode = 0644, + .proc_handler = perf_event_max_stack_handler, + .extra1 = SYSCTL_ZERO, +- .extra2 = &six_hundred_forty_kb, ++ .extra2 = (void *)&six_hundred_forty_kb, + }, + { + .procname = "perf_event_max_contexts_per_stack", +@@ -2727,7 +2726,7 @@ static struct ctl_table vm_table[] = { + .maxlen = sizeof(dirty_background_bytes), + .mode = 0644, + .proc_handler = dirty_background_bytes_handler, +- .extra1 = &one_ul, ++ .extra1 = (void *)&one_ul, + }, + { + .procname = "dirty_ratio", +@@ -2744,7 +2743,7 @@ static struct ctl_table vm_table[] = { + .maxlen = sizeof(vm_dirty_bytes), + .mode = 0644, + .proc_handler = dirty_bytes_handler, +- .extra1 = &dirty_bytes_min, ++ .extra1 = (void *)&dirty_bytes_min, + }, + { + .procname = "dirty_writeback_centisecs", +@@ -2860,8 +2859,8 @@ static struct ctl_table vm_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, +- .extra1 = &min_extfrag_threshold, +- .extra2 = &max_extfrag_threshold, ++ .extra1 = (void *)&min_extfrag_threshold, ++ .extra2 = (void *)&max_extfrag_threshold, + }, + { + .procname = "compact_unevictable_allowed", +@@ -3147,8 +3146,8 @@ static struct ctl_table fs_table[] = { + .maxlen = sizeof(files_stat.max_files), + .mode = 0644, + .proc_handler = proc_doulongvec_minmax, +- .extra1 = &zero_ul, +- .extra2 = &long_max, ++ .extra1 = (void *)&zero_ul, ++ .extra2 = (void *)&long_max, + }, + { + .procname = "nr_open", +@@ -3172,8 +3171,8 @@ static struct ctl_table fs_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, +- .extra1 = &minolduid, +- .extra2 = &maxolduid, ++ .extra1 = (void *)&minolduid, ++ .extra2 = (void *)&maxolduid, + }, + { + .procname = "overflowgid", +@@ -3181,8 +3180,8 @@ static struct ctl_table fs_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, +- .extra1 = &minolduid, +- .extra2 = &maxolduid, ++ .extra1 = (void *)&minolduid, ++ .extra2 = (void *)&maxolduid, + }, + #ifdef CONFIG_FILE_LOCKING + { +-- +2.39.5 + diff --git a/queue-5.15/tcp_cubic-fix-incorrect-hystart-round-start-detectio.patch b/queue-5.15/tcp_cubic-fix-incorrect-hystart-round-start-detectio.patch new file mode 100644 index 0000000000..57d0b99a7b --- /dev/null +++ b/queue-5.15/tcp_cubic-fix-incorrect-hystart-round-start-detectio.patch @@ -0,0 +1,83 @@ +From 5773731316ae914a2488235415a7aaf25d8a0776 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 21:37:51 +0000 +Subject: tcp_cubic: fix incorrect HyStart round start detection + +From: Mahdi Arghavani + +[ Upstream commit 25c1a9ca53db5780757e7f53e688b8f916821baa ] + +I noticed that HyStart incorrectly marks the start of rounds, +leading to inaccurate measurements of ACK train lengths and +resetting the `ca->sample_cnt` variable. This inaccuracy can impact +HyStart's functionality in terminating exponential cwnd growth during +Slow-Start, potentially degrading TCP performance. + +The issue arises because the changes introduced in commit 4e1fddc98d25 +("tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows") +moved the caller of the `bictcp_hystart_reset` function inside the `hystart_update` function. +This modification added an additional condition for triggering the caller, +requiring that (tcp_snd_cwnd(tp) >= hystart_low_window) must also +be satisfied before invoking `bictcp_hystart_reset`. + +This fix ensures that `bictcp_hystart_reset` is correctly called +at the start of a new round, regardless of the congestion window size. +This is achieved by moving the condition +(tcp_snd_cwnd(tp) >= hystart_low_window) +from before calling `bictcp_hystart_reset` to after it. + +I tested with a client and a server connected through two Linux software routers. +In this setup, the minimum RTT was 150 ms, the bottleneck bandwidth was 50 Mbps, +and the bottleneck buffer size was 1 BDP, calculated as (50M / 1514 / 8) * 0.150 = 619 packets. +I conducted the test twice, transferring data from the server to the client for 1.5 seconds. +Before the patch was applied, HYSTART-DELAY stopped the exponential growth of cwnd when +cwnd = 516, and the bottleneck link was not yet saturated (516 < 619). +After the patch was applied, HYSTART-ACK-TRAIN stopped the exponential growth of cwnd when +cwnd = 632, and the bottleneck link was saturated (632 > 619). +In this test, applying the patch resulted in 300 KB more data delivered. + +Fixes: 4e1fddc98d25 ("tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows") +Signed-off-by: Mahdi Arghavani +Reviewed-by: Jason Xing +Cc: Neal Cardwell +Cc: Eric Dumazet +Cc: Haibo Zhang +Cc: David Eyers +Cc: Abbas Arghavani +Reviewed-by: Neal Cardwell +Tested-by: Neal Cardwell +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_cubic.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c +index af4fc067f2a19..741a15799ab35 100644 +--- a/net/ipv4/tcp_cubic.c ++++ b/net/ipv4/tcp_cubic.c +@@ -390,6 +390,10 @@ static void hystart_update(struct sock *sk, u32 delay) + if (after(tp->snd_una, ca->end_seq)) + bictcp_hystart_reset(sk); + ++ /* hystart triggers when cwnd is larger than some threshold */ ++ if (tcp_snd_cwnd(tp) < hystart_low_window) ++ return; ++ + if (hystart_detect & HYSTART_ACK_TRAIN) { + u32 now = bictcp_clock_us(sk); + +@@ -465,9 +469,7 @@ static void cubictcp_acked(struct sock *sk, const struct ack_sample *sample) + if (ca->delay_min == 0 || ca->delay_min > delay) + ca->delay_min = delay; + +- /* hystart triggers when cwnd is larger than some threshold */ +- if (!ca->found && tcp_in_slow_start(tp) && hystart && +- tcp_snd_cwnd(tp) >= hystart_low_window) ++ if (!ca->found && tcp_in_slow_start(tp) && hystart) + hystart_update(sk, delay); + } + +-- +2.39.5 + diff --git a/queue-5.15/team-prevent-adding-a-device-which-is-already-a-team.patch b/queue-5.15/team-prevent-adding-a-device-which-is-already-a-team.patch new file mode 100644 index 0000000000..4d8cc39e4c --- /dev/null +++ b/queue-5.15/team-prevent-adding-a-device-which-is-already-a-team.patch @@ -0,0 +1,118 @@ +From 0e9ef7fcb471b828a2585845eec1abbbb5697ba0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 12:56:47 -0800 +Subject: team: prevent adding a device which is already a team device lower + +From: Octavian Purdila + +[ Upstream commit 3fff5da4ca2164bb4d0f1e6cd33f6eb8a0e73e50 ] + +Prevent adding a device which is already a team device lower, +e.g. adding veth0 if vlan1 was already added and veth0 is a lower of +vlan1. + +This is not useful in practice and can lead to recursive locking: + +$ ip link add veth0 type veth peer name veth1 +$ ip link set veth0 up +$ ip link set veth1 up +$ ip link add link veth0 name veth0.1 type vlan protocol 802.1Q id 1 +$ ip link add team0 type team +$ ip link set veth0.1 down +$ ip link set veth0.1 master team0 +team0: Port device veth0.1 added +$ ip link set veth0 down +$ ip link set veth0 master team0 + +============================================ +WARNING: possible recursive locking detected +6.13.0-rc2-virtme-00441-ga14a429069bb #46 Not tainted +-------------------------------------------- +ip/7684 is trying to acquire lock: +ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) + +but task is already holding lock: +ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_add_slave (drivers/net/team/team_core.c:1147 drivers/net/team/team_core.c:1977) + +other info that might help us debug this: +Possible unsafe locking scenario: + +CPU0 +---- +lock(team->team_lock_key); +lock(team->team_lock_key); + +*** DEADLOCK *** + +May be due to missing lock nesting notation + +2 locks held by ip/7684: + +stack backtrace: +CPU: 3 UID: 0 PID: 7684 Comm: ip Not tainted 6.13.0-rc2-virtme-00441-ga14a429069bb #46 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 +Call Trace: + +dump_stack_lvl (lib/dump_stack.c:122) +print_deadlock_bug.cold (kernel/locking/lockdep.c:3040) +__lock_acquire (kernel/locking/lockdep.c:3893 kernel/locking/lockdep.c:5226) +? netlink_broadcast_filtered (net/netlink/af_netlink.c:1548) +lock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 2)) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +? lock_acquire (kernel/locking/lockdep.c:5822) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +__mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:735) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +? fib_sync_up (net/ipv4/fib_semantics.c:2167) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +notifier_call_chain (kernel/notifier.c:85) +call_netdevice_notifiers_info (net/core/dev.c:1996) +__dev_notify_flags (net/core/dev.c:8993) +? __dev_change_flags (net/core/dev.c:8975) +dev_change_flags (net/core/dev.c:9027) +vlan_device_event (net/8021q/vlan.c:85 net/8021q/vlan.c:470) +? br_device_event (net/bridge/br.c:143) +notifier_call_chain (kernel/notifier.c:85) +call_netdevice_notifiers_info (net/core/dev.c:1996) +dev_open (net/core/dev.c:1519 net/core/dev.c:1505) +team_add_slave (drivers/net/team/team_core.c:1219 drivers/net/team/team_core.c:1977) +? __pfx_team_add_slave (drivers/net/team/team_core.c:1972) +do_set_master (net/core/rtnetlink.c:2917) +do_setlink.isra.0 (net/core/rtnetlink.c:3117) + +Reported-by: syzbot+3c47b5843403a45aef57@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=3c47b5843403a45aef57 +Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device") +Signed-off-by: Octavian Purdila +Reviewed-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/team/team.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 5e5af71a85ac1..015151cd22220 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -1166,6 +1166,13 @@ static int team_port_add(struct team *team, struct net_device *port_dev, + return -EBUSY; + } + ++ if (netdev_has_upper_dev(port_dev, dev)) { ++ NL_SET_ERR_MSG(extack, "Device is already a lower device of the team interface"); ++ netdev_err(dev, "Device %s is already a lower device of the team interface\n", ++ portname); ++ return -EBUSY; ++ } ++ + if (port_dev->features & NETIF_F_VLAN_CHALLENGED && + vlan_uses_dev(dev)) { + NL_SET_ERR_MSG(extack, "Device is VLAN challenged and team device has VLAN set up"); +-- +2.39.5 + diff --git a/queue-5.15/tools-bootconfig-fix-the-wrong-format-specifier.patch b/queue-5.15/tools-bootconfig-fix-the-wrong-format-specifier.patch new file mode 100644 index 0000000000..9a220298f8 --- /dev/null +++ b/queue-5.15/tools-bootconfig-fix-the-wrong-format-specifier.patch @@ -0,0 +1,46 @@ +From 3b8e855f2bd0a75543d44e18683af2a3bc65ac6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 23:27:01 +0900 +Subject: tools/bootconfig: Fix the wrong format specifier + +From: Luo Yifan + +[ Upstream commit f6ab7384d554ba80ff4793259d75535874b366f5 ] + +Use '%u' instead of '%d' for unsigned int. + +Link: https://lore.kernel.org/all/20241105011048.201629-1-luoyifan@cmss.chinamobile.com/ + +Fixes: 973780011106 ("tools/bootconfig: Suppress non-error messages") +Signed-off-by: Luo Yifan +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Sasha Levin +--- + tools/bootconfig/main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c +index fd67496a947f3..fc922cfdadaa6 100644 +--- a/tools/bootconfig/main.c ++++ b/tools/bootconfig/main.c +@@ -225,7 +225,7 @@ static int load_xbc_from_initrd(int fd, char **buf) + /* Wrong Checksum */ + rcsum = xbc_calc_checksum(*buf, size); + if (csum != rcsum) { +- pr_err("checksum error: %d != %d\n", csum, rcsum); ++ pr_err("checksum error: %u != %u\n", csum, rcsum); + return -EINVAL; + } + +@@ -393,7 +393,7 @@ static int apply_xbc(const char *path, const char *xbc_path) + printf("Apply %s to %s\n", xbc_path, path); + printf("\tNumber of nodes: %d\n", ret); + printf("\tSize: %u bytes\n", (unsigned int)size); +- printf("\tChecksum: %d\n", (unsigned int)csum); ++ printf("\tChecksum: %u\n", (unsigned int)csum); + + /* TODO: Check the options by schema */ + xbc_destroy_all(); +-- +2.39.5 + diff --git a/queue-5.15/tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch b/queue-5.15/tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch new file mode 100644 index 0000000000..5bd2aa9743 --- /dev/null +++ b/queue-5.15/tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch @@ -0,0 +1,43 @@ +From 943d0b9d51782a86065285d6ae5c875c79133de6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 12:45:30 -0800 +Subject: tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server + bind + +From: Marco Leogrande + +[ Upstream commit e2f0791124a1b6ca8d570110cbd487969d9d41ef ] + +Commit f803bcf9208a ("selftests/bpf: Prevent client connect before +server bind in test_tc_tunnel.sh") added code that waits for the +netcat server to start before the netcat client attempts to connect to +it. However, not all calls to 'server_listen' were guarded. + +This patch adds the existing 'wait_for_port' guard after the remaining +call to 'server_listen'. + +Fixes: f803bcf9208a ("selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh") +Signed-off-by: Marco Leogrande +Acked-by: Stanislav Fomichev +Link: https://lore.kernel.org/r/20241202204530.1143448-1-leogrande@google.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_tc_tunnel.sh | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh +index 38c6e9f16f41e..88488779792ff 100755 +--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh ++++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh +@@ -295,6 +295,7 @@ else + client_connect + verify_data + server_listen ++ wait_for_port ${port} ${netcat_opt} + fi + + # bpf_skb_net_shrink does not take tunnel flags yet, cannot update L3. +-- +2.39.5 + diff --git a/queue-5.15/ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch b/queue-5.15/ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch new file mode 100644 index 0000000000..4e0d0da5d2 --- /dev/null +++ b/queue-5.15/ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch @@ -0,0 +1,60 @@ +From a46e627642dc4eac42d0b6ecc36c9014e4e20ac7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 16:18:23 +0800 +Subject: ubifs: skip dumping tnc tree when zroot is null + +From: pangliyuan + +[ Upstream commit bdb0ca39e0acccf6771db49c3f94ed787d05f2d7 ] + +Clearing slab cache will free all znode in memory and make +c->zroot.znode = NULL, then dumping tnc tree will access +c->zroot.znode which cause null pointer dereference. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=219624#c0 +Fixes: 1e51764a3c2a ("UBIFS: add new flash file system") +Signed-off-by: pangliyuan +Reviewed-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/debug.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c +index fc718f6178f25..8386228131a29 100644 +--- a/fs/ubifs/debug.c ++++ b/fs/ubifs/debug.c +@@ -946,16 +946,20 @@ void ubifs_dump_tnc(struct ubifs_info *c) + + pr_err("\n"); + pr_err("(pid %d) start dumping TNC tree\n", current->pid); +- znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL); +- level = znode->level; +- pr_err("== Level %d ==\n", level); +- while (znode) { +- if (level != znode->level) { +- level = znode->level; +- pr_err("== Level %d ==\n", level); ++ if (c->zroot.znode) { ++ znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL); ++ level = znode->level; ++ pr_err("== Level %d ==\n", level); ++ while (znode) { ++ if (level != znode->level) { ++ level = znode->level; ++ pr_err("== Level %d ==\n", level); ++ } ++ ubifs_dump_znode(c, znode); ++ znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode); + } +- ubifs_dump_znode(c, znode); +- znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode); ++ } else { ++ pr_err("empty TNC tree in memory\n"); + } + pr_err("(pid %d) finish dumping TNC tree\n", current->pid); + } +-- +2.39.5 + diff --git a/queue-5.15/udp-deal-with-race-between-udp-socket-address-change.patch b/queue-5.15/udp-deal-with-race-between-udp-socket-address-change.patch new file mode 100644 index 0000000000..3601cc7156 --- /dev/null +++ b/queue-5.15/udp-deal-with-race-between-udp-socket-address-change.patch @@ -0,0 +1,301 @@ +From 176d1b6e5679f1a36776339dbe0b1f280a649446 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 17:21:16 +0100 +Subject: udp: Deal with race between UDP socket address change and rehash + +From: Stefano Brivio + +[ Upstream commit a502ea6fa94b1f7be72a24bcf9e3f5f6b7e6e90c ] + +If a UDP socket changes its local address while it's receiving +datagrams, as a result of connect(), there is a period during which +a lookup operation might fail to find it, after the address is changed +but before the secondary hash (port and address) and the four-tuple +hash (local and remote ports and addresses) are updated. + +Secondary hash chains were introduced by commit 30fff9231fad ("udp: +bind() optimisation") and, as a result, a rehash operation became +needed to make a bound socket reachable again after a connect(). + +This operation was introduced by commit 719f835853a9 ("udp: add +rehash on connect()") which isn't however a complete fix: the +socket will be found once the rehashing completes, but not while +it's pending. + +This is noticeable with a socat(1) server in UDP4-LISTEN mode, and a +client sending datagrams to it. After the server receives the first +datagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to +the address of the sender, in order to set up a directed flow. + +Now, if the client, running on a different CPU thread, happens to +send a (subsequent) datagram while the server's socket changes its +address, but is not rehashed yet, this will result in a failed +lookup and a port unreachable error delivered to the client, as +apparent from the following reproducer: + + LEN=$(($(cat /proc/sys/net/core/wmem_default) / 4)) + dd if=/dev/urandom bs=1 count=${LEN} of=tmp.in + + while :; do + taskset -c 1 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc & + sleep 0.1 || sleep 1 + taskset -c 2 socat OPEN:tmp.in UDP4:localhost:1337,shut-null + wait + done + +where the client will eventually get ECONNREFUSED on a write() +(typically the second or third one of a given iteration): + + 2024/11/13 21:28:23 socat[46901] E write(6, 0x556db2e3c000, 8192): Connection refused + +This issue was first observed as a seldom failure in Podman's tests +checking UDP functionality while using pasta(1) to connect the +container's network namespace, which leads us to a reproducer with +the lookup error resulting in an ICMP packet on a tap device: + + LOCAL_ADDR="$(ip -j -4 addr show|jq -rM '.[] | .addr_info[0] | select(.scope == "global").local')" + + while :; do + ./pasta --config-net -p pasta.pcap -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc & + sleep 0.2 || sleep 1 + socat OPEN:tmp.in UDP4:${LOCAL_ADDR}:1337,shut-null + wait + cmp tmp.in tmp.out + done + +Once this fails: + + tmp.in tmp.out differ: char 8193, line 29 + +we can finally have a look at what's going on: + + $ tshark -r pasta.pcap + 1 0.000000 :: ? ff02::16 ICMPv6 110 Multicast Listener Report Message v2 + 2 0.168690 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 + 3 0.168767 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 + 4 0.168806 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 + 5 0.168827 c6:47:05:8d:dc:04 ? Broadcast ARP 42 Who has 88.198.0.161? Tell 88.198.0.164 + 6 0.168851 9a:55:9a:55:9a:55 ? c6:47:05:8d:dc:04 ARP 42 88.198.0.161 is at 9a:55:9a:55:9a:55 + 7 0.168875 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 + 8 0.168896 88.198.0.164 ? 88.198.0.161 ICMP 590 Destination unreachable (Port unreachable) + 9 0.168926 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 + 10 0.168959 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 + 11 0.168989 88.198.0.161 ? 88.198.0.164 UDP 4138 60260 ? 1337 Len=4096 + 12 0.169010 88.198.0.161 ? 88.198.0.164 UDP 42 60260 ? 1337 Len=0 + +On the third datagram received, the network namespace of the container +initiates an ARP lookup to deliver the ICMP message. + +In another variant of this reproducer, starting the client with: + + strace -f pasta --config-net -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc 2>strace.log & + +and connecting to the socat server using a loopback address: + + socat OPEN:tmp.in UDP4:localhost:1337,shut-null + +we can more clearly observe a sendmmsg() call failing after the +first datagram is delivered: + + [pid 278012] connect(173, 0x7fff96c95fc0, 16) = 0 + [...] + [pid 278012] recvmmsg(173, 0x7fff96c96020, 1024, MSG_DONTWAIT, NULL) = -1 EAGAIN (Resource temporarily unavailable) + [pid 278012] sendmmsg(173, 0x561c5ad0a720, 1, MSG_NOSIGNAL) = 1 + [...] + [pid 278012] sendmmsg(173, 0x561c5ad0a720, 1, MSG_NOSIGNAL) = -1 ECONNREFUSED (Connection refused) + +and, somewhat confusingly, after a connect() on the same socket +succeeded. + +Until commit 4cdeeee9252a ("net: udp: prefer listeners bound to an +address"), the race between receive address change and lookup didn't +actually cause visible issues, because, once the lookup based on the +secondary hash chain failed, we would still attempt a lookup based on +the primary hash (destination port only), and find the socket with the +outdated secondary hash. + +That change, however, dropped port-only lookups altogether, as side +effect, making the race visible. + +To fix this, while avoiding the need to make address changes and +rehash atomic against lookups, reintroduce primary hash lookups as +fallback, if lookups based on four-tuple and secondary hashes fail. + +To this end, introduce a simplified lookup implementation, which +doesn't take care of SO_REUSEPORT groups: if we have one, there are +multiple sockets that would match the four-tuple or secondary hash, +meaning that we can't run into this race at all. + +v2: + - instead of synchronising lookup operations against address change + plus rehash, reintroduce a simplified version of the original + primary hash lookup as fallback + +v1: + - fix build with CONFIG_IPV6=n: add ifdef around sk_v6_rcv_saddr + usage (Kuniyuki Iwashima) + - directly use sk_rcv_saddr for IPv4 receive addresses instead of + fetching inet_rcv_saddr (Kuniyuki Iwashima) + - move inet_update_saddr() to inet_hashtables.h and use that + to set IPv4/IPv6 addresses as suitable (Kuniyuki Iwashima) + - rebase onto net-next, update commit message accordingly + +Reported-by: Ed Santiago +Link: https://github.com/containers/podman/issues/24147 +Analysed-by: David Gibson +Fixes: 30fff9231fad ("udp: bind() optimisation") +Signed-off-by: Stefano Brivio +Reviewed-by: Eric Dumazet +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/udp.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++ + net/ipv6/udp.c | 50 ++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 106 insertions(+) + +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 138fef35e7071..e25ccec527ed0 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -412,6 +412,49 @@ u32 udp_ehashfn(const struct net *net, const __be32 laddr, const __u16 lport, + udp_ehash_secret + net_hash_mix(net)); + } + ++/** ++ * udp4_lib_lookup1() - Simplified lookup using primary hash (destination port) ++ * @net: Network namespace ++ * @saddr: Source address, network order ++ * @sport: Source port, network order ++ * @daddr: Destination address, network order ++ * @hnum: Destination port, host order ++ * @dif: Destination interface index ++ * @sdif: Destination bridge port index, if relevant ++ * @udptable: Set of UDP hash tables ++ * ++ * Simplified lookup to be used as fallback if no sockets are found due to a ++ * potential race between (receive) address change, and lookup happening before ++ * the rehash operation. This function ignores SO_REUSEPORT groups while scoring ++ * result sockets, because if we have one, we don't need the fallback at all. ++ * ++ * Called under rcu_read_lock(). ++ * ++ * Return: socket with highest matching score if any, NULL if none ++ */ ++static struct sock *udp4_lib_lookup1(const struct net *net, ++ __be32 saddr, __be16 sport, ++ __be32 daddr, unsigned int hnum, ++ int dif, int sdif, ++ const struct udp_table *udptable) ++{ ++ unsigned int slot = udp_hashfn(net, hnum, udptable->mask); ++ struct udp_hslot *hslot = &udptable->hash[slot]; ++ struct sock *sk, *result = NULL; ++ int score, badness = 0; ++ ++ sk_for_each_rcu(sk, &hslot->head) { ++ score = compute_score(sk, net, ++ saddr, sport, daddr, hnum, dif, sdif); ++ if (score > badness) { ++ result = sk; ++ badness = score; ++ } ++ } ++ ++ return result; ++} ++ + /* called with rcu_read_lock() */ + static struct sock *udp4_lib_lookup2(struct net *net, + __be32 saddr, __be16 sport, +@@ -539,6 +582,19 @@ struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr, + result = udp4_lib_lookup2(net, saddr, sport, + htonl(INADDR_ANY), hnum, dif, sdif, + hslot2, skb); ++ if (!IS_ERR_OR_NULL(result)) ++ goto done; ++ ++ /* Primary hash (destination port) lookup as fallback for this race: ++ * 1. __ip4_datagram_connect() sets sk_rcv_saddr ++ * 2. lookup (this function): new sk_rcv_saddr, hashes not updated yet ++ * 3. rehash operation updating _secondary and four-tuple_ hashes ++ * The primary hash doesn't need an update after 1., so, thanks to this ++ * further step, 1. and 3. don't need to be atomic against the lookup. ++ */ ++ result = udp4_lib_lookup1(net, saddr, sport, daddr, hnum, dif, sdif, ++ udptable); ++ + done: + if (IS_ERR(result)) + return NULL; +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index c60162ea0aa8a..9a72562716ebb 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -157,6 +157,49 @@ static int compute_score(struct sock *sk, struct net *net, + return score; + } + ++/** ++ * udp6_lib_lookup1() - Simplified lookup using primary hash (destination port) ++ * @net: Network namespace ++ * @saddr: Source address, network order ++ * @sport: Source port, network order ++ * @daddr: Destination address, network order ++ * @hnum: Destination port, host order ++ * @dif: Destination interface index ++ * @sdif: Destination bridge port index, if relevant ++ * @udptable: Set of UDP hash tables ++ * ++ * Simplified lookup to be used as fallback if no sockets are found due to a ++ * potential race between (receive) address change, and lookup happening before ++ * the rehash operation. This function ignores SO_REUSEPORT groups while scoring ++ * result sockets, because if we have one, we don't need the fallback at all. ++ * ++ * Called under rcu_read_lock(). ++ * ++ * Return: socket with highest matching score if any, NULL if none ++ */ ++static struct sock *udp6_lib_lookup1(const struct net *net, ++ const struct in6_addr *saddr, __be16 sport, ++ const struct in6_addr *daddr, ++ unsigned int hnum, int dif, int sdif, ++ const struct udp_table *udptable) ++{ ++ unsigned int slot = udp_hashfn(net, hnum, udptable->mask); ++ struct udp_hslot *hslot = &udptable->hash[slot]; ++ struct sock *sk, *result = NULL; ++ int score, badness = 0; ++ ++ sk_for_each_rcu(sk, &hslot->head) { ++ score = compute_score(sk, net, ++ saddr, sport, daddr, hnum, dif, sdif); ++ if (score > badness) { ++ result = sk; ++ badness = score; ++ } ++ } ++ ++ return result; ++} ++ + /* called with rcu_read_lock() */ + static struct sock *udp6_lib_lookup2(struct net *net, + const struct in6_addr *saddr, __be16 sport, +@@ -285,6 +328,13 @@ struct sock *__udp6_lib_lookup(struct net *net, + result = udp6_lib_lookup2(net, saddr, sport, + &in6addr_any, hnum, dif, sdif, + hslot2, skb); ++ if (!IS_ERR_OR_NULL(result)) ++ goto done; ++ ++ /* Cover address change/lookup/rehash race: see __udp4_lib_lookup() */ ++ result = udp6_lib_lookup1(net, saddr, sport, daddr, hnum, dif, sdif, ++ udptable); ++ + done: + if (IS_ERR(result)) + return NULL; +-- +2.39.5 + diff --git a/queue-5.15/vsock-allow-retrying-on-connect-failure.patch b/queue-5.15/vsock-allow-retrying-on-connect-failure.patch new file mode 100644 index 0000000000..c07ddb6acc --- /dev/null +++ b/queue-5.15/vsock-allow-retrying-on-connect-failure.patch @@ -0,0 +1,45 @@ +From 209659569db590d64c14b3a488cde1695ca433a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 14:15:28 +0100 +Subject: vsock: Allow retrying on connect() failure + +From: Michal Luczaj + +[ Upstream commit aa388c72113b7458127b709bdd7d3628af26e9b4 ] + +sk_err is set when a (connectible) connect() fails. Effectively, this makes +an otherwise still healthy SS_UNCONNECTED socket impossible to use for any +subsequent connection attempts. + +Clear sk_err upon trying to establish a connection. + +Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") +Reviewed-by: Stefano Garzarella +Reviewed-by: Luigi Leonardi +Signed-off-by: Michal Luczaj +Link: https://patch.msgid.link/20250128-vsock-transport-vs-autobind-v3-2-1cf57065b770@rbox.co +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/af_vsock.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 943d58b07a559..a4bcb758301dd 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -1386,6 +1386,11 @@ static int vsock_connect(struct socket *sock, struct sockaddr *addr, + if (err < 0) + goto out; + ++ /* sk_err might have been set as a result of an earlier ++ * (failed) connect attempt. ++ */ ++ sk->sk_err = 0; ++ + /* Mark sock as connecting and set the error code to in + * progress in case this is a non-blocking connect. + */ +-- +2.39.5 + diff --git a/queue-5.15/wifi-cfg80211-adjust-allocation-of-colocated-ap-data.patch b/queue-5.15/wifi-cfg80211-adjust-allocation-of-colocated-ap-data.patch new file mode 100644 index 0000000000..d4f59dff58 --- /dev/null +++ b/queue-5.15/wifi-cfg80211-adjust-allocation-of-colocated-ap-data.patch @@ -0,0 +1,41 @@ +From 0e0a2d12eb6fcc6ba6aab223971728f34089ba3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 18:54:17 +0300 +Subject: wifi: cfg80211: adjust allocation of colocated AP data + +From: Dmitry Antipov + +[ Upstream commit 1a0d24775cdee2b8dc14bfa4f4418c930ab1ac57 ] + +In 'cfg80211_scan_6ghz()', an instances of 'struct cfg80211_colocated_ap' +are allocated as if they would have 'ssid' as trailing VLA member. Since +this is not so, extra IEEE80211_MAX_SSID_LEN bytes are not needed. +Briefly tested with KUnit. + +Fixes: c8cb5b854b40 ("nl80211/cfg80211: support 6 GHz scanning") +Signed-off-by: Dmitry Antipov +Link: https://patch.msgid.link/20250113155417.552587-1-dmantipov@yandex.ru +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/scan.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index ad857cd1e6f0e..d977d7a7675e1 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -821,9 +821,7 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev) + if (ret) + continue; + +- entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN, +- GFP_ATOMIC); +- ++ entry = kzalloc(sizeof(*entry), GFP_ATOMIC); + if (!entry) + continue; + +-- +2.39.5 + diff --git a/queue-5.15/wifi-cfg80211-handle-specific-bssid-in-6ghz-scanning.patch b/queue-5.15/wifi-cfg80211-handle-specific-bssid-in-6ghz-scanning.patch new file mode 100644 index 0000000000..c2e13f31d8 --- /dev/null +++ b/queue-5.15/wifi-cfg80211-handle-specific-bssid-in-6ghz-scanning.patch @@ -0,0 +1,84 @@ +From b87c52c58105bb0f698cd1b958279eca0ca287a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Sep 2023 17:35:30 +0300 +Subject: wifi: cfg80211: Handle specific BSSID in 6GHz scanning + +From: Ilan Peer + +[ Upstream commit 0fca7784b7a14d4ede64f479662afb98876ec7f8 ] + +When the scan parameters for a 6GHz scan specify a unicast +BSSID address, and the corresponding AP is found in the scan +list, add a corresponding entry in the collocated AP list, +so this AP would be directly probed even if it was not +advertised as a collocated AP. + +This is needed for handling a scan request that is intended +for a ML probe flow, where user space can requests a scan +to retrieve information for other links in the AP MLD. + +Signed-off-by: Ilan Peer +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230928172905.54b954bc02ad.I1c072793d3d77a4c8fbbc64b4db5cce1bbb00382@changeid +Signed-off-by: Johannes Berg +Stable-dep-of: 1a0d24775cde ("wifi: cfg80211: adjust allocation of colocated AP data") +Signed-off-by: Sasha Levin +--- + net/wireless/scan.c | 37 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 37 insertions(+) + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index dc41b31073e75..ad857cd1e6f0e 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -796,10 +796,47 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev) + list_for_each_entry(intbss, &rdev->bss_list, list) { + struct cfg80211_bss *res = &intbss->pub; + const struct cfg80211_bss_ies *ies; ++ const struct element *ssid_elem; ++ struct cfg80211_colocated_ap *entry; ++ u32 s_ssid_tmp; ++ int ret; + + ies = rcu_access_pointer(res->ies); + count += cfg80211_parse_colocated_ap(ies, + &coloc_ap_list); ++ ++ /* In case the scan request specified a specific BSSID ++ * and the BSS is found and operating on 6GHz band then ++ * add this AP to the collocated APs list. ++ * This is relevant for ML probe requests when the lower ++ * band APs have not been discovered. ++ */ ++ if (is_broadcast_ether_addr(rdev_req->bssid) || ++ !ether_addr_equal(rdev_req->bssid, res->bssid) || ++ res->channel->band != NL80211_BAND_6GHZ) ++ continue; ++ ++ ret = cfg80211_calc_short_ssid(ies, &ssid_elem, ++ &s_ssid_tmp); ++ if (ret) ++ continue; ++ ++ entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN, ++ GFP_ATOMIC); ++ ++ if (!entry) ++ continue; ++ ++ memcpy(entry->bssid, res->bssid, ETH_ALEN); ++ entry->short_ssid = s_ssid_tmp; ++ memcpy(entry->ssid, ssid_elem->data, ++ ssid_elem->datalen); ++ entry->ssid_len = ssid_elem->datalen; ++ entry->short_ssid_valid = true; ++ entry->center_freq = res->channel->center_freq; ++ ++ list_add_tail(&entry->list, &coloc_ap_list); ++ count++; + } + spin_unlock_bh(&rdev->bss_lock); + } +-- +2.39.5 + diff --git a/queue-5.15/wifi-mt76-mt76u_vendor_request-do-not-print-error-me.patch b/queue-5.15/wifi-mt76-mt76u_vendor_request-do-not-print-error-me.patch new file mode 100644 index 0000000000..09830fc40c --- /dev/null +++ b/queue-5.15/wifi-mt76-mt76u_vendor_request-do-not-print-error-me.patch @@ -0,0 +1,72 @@ +From 9fbf201a751fd39cf4152d7452a5ac61b0bb41f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 15:02:41 +0800 +Subject: wifi: mt76: mt76u_vendor_request: Do not print error messages when + -EPROTO +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: WangYuli + +[ Upstream commit f1b1e133a770fcdbd89551651232b034d2f7a27a ] + +When initializing the network card, unplugging the device will +trigger an -EPROTO error, resulting in a flood of error messages +being printed frantically. + +The exception is printed as follows： + + mt76x2u 2-2.4:1.0: vendor request req:47 off:9018 failed:-71 + mt76x2u 2-2.4:1.0: vendor request req:47 off:9018 failed:-71 + ... + +It will continue to print more than 2000 times for about 5 minutes, +causing the usb device to be unable to be disconnected. During this +period, the usb port cannot recognize the new device because the old +device has not disconnected. + +There may be other operating methods that cause -EPROTO, but -EPROTO is +a low-level hardware error. It is unwise to repeat vendor requests +expecting to read correct data. It is a better choice to treat -EPROTO +and -ENODEV the same way. + +Similar to commit 9b0f100c1970 ("mt76: usb: process URBs with status +EPROTO properly") do no schedule rx_worker for urb marked with status +set -EPROTO. I also reproduced this situation when plugging and +unplugging the device, and this patch is effective. + +Just do not vendor request again for urb marked with status set -EPROTO. + +Link: https://lore.kernel.org/all/531681bd-30f5-4a70-a156-bf8754b8e072@intel.com/ +Link: https://lore.kernel.org/all/D4B9CC1FFC0CBAC3+20250105040607.154706-1-wangyuli@uniontech.com/ +Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer") +Co-developed-by: Xu Rao +Signed-off-by: Xu Rao +Signed-off-by: WangYuli +Link: https://patch.msgid.link/9DD7DE7AAB497CB7+20250113070241.63590-1-wangyuli@uniontech.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/usb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c +index 392632c3f1b1d..e40569fc7edea 100644 +--- a/drivers/net/wireless/mediatek/mt76/usb.c ++++ b/drivers/net/wireless/mediatek/mt76/usb.c +@@ -34,9 +34,9 @@ static int __mt76u_vendor_request(struct mt76_dev *dev, u8 req, + + ret = usb_control_msg(udev, pipe, req, req_type, val, + offset, buf, len, MT_VEND_REQ_TOUT_MS); +- if (ret == -ENODEV) ++ if (ret == -ENODEV || ret == -EPROTO) + set_bit(MT76_REMOVED, &dev->phy.state); +- if (ret >= 0 || ret == -ENODEV) ++ if (ret >= 0 || ret == -ENODEV || ret == -EPROTO) + return ret; + usleep_range(5000, 10000); + } +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtlwifi-destroy-workqueue-at-rtl_deinit_core.patch b/queue-5.15/wifi-rtlwifi-destroy-workqueue-at-rtl_deinit_core.patch new file mode 100644 index 0000000000..f03fbc56a2 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-destroy-workqueue-at-rtl_deinit_core.patch @@ -0,0 +1,88 @@ +From 3b238e93f9933cc897d8d0dedae1a6e4f3b07f69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 14:37:11 -0300 +Subject: wifi: rtlwifi: destroy workqueue at rtl_deinit_core + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit d8ece6fc3694657e4886191b32ca1690af11adda ] + +rtl_wq is allocated at rtl_init_core, so it makes more sense to destroy it +at rtl_deinit_core. In the case of USB, where _rtl_usb_init does not +require anything to be undone, that is fine. But for PCI, rtl_pci_init, +which is called after rtl_init_core, needs to deallocate data, but only if +it has been called. + +That means that destroying the workqueue needs to be done whether +rtl_pci_init has been called or not. And since rtl_pci_deinit was doing it, +it has to be moved out of there. + +It makes more sense to move it to rtl_deinit_core and have it done in both +cases, USB and PCI. + +Since this is a requirement for a followup memory leak fix, mark this as +fixing such memory leak. + +Fixes: 0c8173385e54 ("rtl8192ce: Add new driver") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241206173713.3222187-3-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/base.c | 6 ++++++ + drivers/net/wireless/realtek/rtlwifi/pci.c | 2 -- + drivers/net/wireless/realtek/rtlwifi/usb.c | 5 ----- + 3 files changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index f424d495305a8..1d6f46f521539 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -575,9 +575,15 @@ static void rtl_free_entries_from_ack_queue(struct ieee80211_hw *hw, + + void rtl_deinit_core(struct ieee80211_hw *hw) + { ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ + rtl_c2hcmd_launcher(hw, 0); + rtl_free_entries_from_scan_list(hw); + rtl_free_entries_from_ack_queue(hw, false); ++ if (rtlpriv->works.rtl_wq) { ++ destroy_workqueue(rtlpriv->works.rtl_wq); ++ rtlpriv->works.rtl_wq = NULL; ++ } + } + EXPORT_SYMBOL_GPL(rtl_deinit_core); + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index c0a201f1b74e5..84f2669f201ab 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -1657,8 +1657,6 @@ static void rtl_pci_deinit(struct ieee80211_hw *hw) + synchronize_irq(rtlpci->pdev->irq); + tasklet_kill(&rtlpriv->works.irq_tasklet); + cancel_work_sync(&rtlpriv->works.lps_change_work); +- +- destroy_workqueue(rtlpriv->works.rtl_wq); + } + + static int rtl_pci_init(struct ieee80211_hw *hw, struct pci_dev *pdev) +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 04590d16874c4..68dc0e6af6b1b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -679,11 +679,6 @@ static void _rtl_usb_cleanup_rx(struct ieee80211_hw *hw) + tasklet_kill(&rtlusb->rx_work_tasklet); + cancel_work_sync(&rtlpriv->works.lps_change_work); + +- if (rtlpriv->works.rtl_wq) { +- destroy_workqueue(rtlpriv->works.rtl_wq); +- rtlpriv->works.rtl_wq = NULL; +- } +- + skb_queue_purge(&rtlusb->rx_queue); + + while ((urb = usb_get_from_anchor(&rtlusb->rx_cleanup_urbs))) { +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch b/queue-5.15/wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch new file mode 100644 index 0000000000..ac96028ba6 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch @@ -0,0 +1,50 @@ +From 897b737503f3f063a5d12cae0b71075e4db3ea05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:33:18 -0300 +Subject: wifi: rtlwifi: do not complete firmware loading needlessly + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit e73e11d303940119e41850a0452a0deda2cc4eb5 ] + +The only code waiting for completion is driver removal, which will not be +called when probe returns a failure. So this completion is unnecessary. + +Fixes: b0302aba812b ("rtlwifi: Convert to asynchronous firmware load") +Signed-off-by: Thadeu Lima de Souza Cascardo +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241107133322.855112-2-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 1 - + drivers/net/wireless/realtek/rtlwifi/usb.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 6d9f2a6233a21..70f1cc906502b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -2274,7 +2274,6 @@ int rtl_pci_probe(struct pci_dev *pdev, + pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start); + + pci_release_regions(pdev); +- complete(&rtlpriv->firmware_loading_complete); + + fail1: + if (hw) +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index a8eebafb9a7ee..c2a3c88ea1fcc 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1085,7 +1085,6 @@ int rtl_usb_probe(struct usb_interface *intf, + error_out2: + _rtl_usb_io_handler_release(hw); + usb_put_dev(udev); +- complete(&rtlpriv->firmware_loading_complete); + kfree(rtlpriv->usb_data); + ieee80211_free_hw(hw); + return -ENODEV; +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtlwifi-fix-init_sw_vars-leak-when-probe-fails.patch b/queue-5.15/wifi-rtlwifi-fix-init_sw_vars-leak-when-probe-fails.patch new file mode 100644 index 0000000000..3bef127262 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-fix-init_sw_vars-leak-when-probe-fails.patch @@ -0,0 +1,37 @@ +From 7b763123d4e4f3d4f124b50e6dc9e849ec6f0829 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:33:21 -0300 +Subject: wifi: rtlwifi: fix init_sw_vars leak when probe fails + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit 00260350aed80c002df270c805ca443ec9a719a6 ] + +If ieee80211_register_hw fails, the memory allocated for the firmware will +not be released. Call deinit_sw_vars as the function that undoes the +allocationes done by init_sw_vars. + +Fixes: cefe3dfdb9f5 ("rtl8192cu: Call ieee80211_register_hw from rtl_usb_probe") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241107133322.855112-5-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 038d9bb652b64..1753eccbefdd9 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1082,6 +1082,7 @@ int rtl_usb_probe(struct usb_interface *intf, + + error_init_vars: + wait_for_completion(&rtlpriv->firmware_loading_complete); ++ rtlpriv->cfg->ops->deinit_sw_vars(hw); + error_out: + rtl_deinit_core(hw); + error_out2: +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch b/queue-5.15/wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch new file mode 100644 index 0000000000..4219568a70 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch @@ -0,0 +1,80 @@ +From 547aa99b371fea703655af21f6b07a537fcec9a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 14:37:12 -0300 +Subject: wifi: rtlwifi: fix memory leaks and invalid access at probe error + path + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit e7ceefbfd8d447abc8aca8ab993a942803522c06 ] + +Deinitialize at reverse order when probe fails. + +When init_sw_vars fails, rtl_deinit_core should not be called, specially +now that it destroys the rtl_wq workqueue. + +And call rtl_pci_deinit and deinit_sw_vars, otherwise, memory will be +leaked. + +Remove pci_set_drvdata call as it will already be cleaned up by the core +driver code and could lead to memory leaks too. cf. commit 8d450935ae7f +("wireless: rtlwifi: remove unnecessary pci_set_drvdata()") and +commit 3d86b93064c7 ("rtlwifi: Fix PCI probe error path orphaned memory"). + +Fixes: 0c8173385e54 ("rtl8192ce: Add new driver") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241206173713.3222187-4-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 84f2669f201ab..5b0a5a22d06d2 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -2167,7 +2167,7 @@ int rtl_pci_probe(struct pci_dev *pdev, + if (rtlpriv->cfg->ops->init_sw_vars(hw)) { + pr_err("Can't init_sw_vars\n"); + err = -ENODEV; +- goto fail3; ++ goto fail2; + } + rtlpriv->cfg->ops->init_sw_leds(hw); + +@@ -2185,14 +2185,14 @@ int rtl_pci_probe(struct pci_dev *pdev, + err = rtl_pci_init(hw, pdev); + if (err) { + pr_err("Failed to init PCI\n"); +- goto fail3; ++ goto fail4; + } + + err = ieee80211_register_hw(hw); + if (err) { + pr_err("Can't register mac80211 hw.\n"); + err = -ENODEV; +- goto fail3; ++ goto fail5; + } + rtlpriv->mac80211.mac80211_registered = 1; + +@@ -2215,9 +2215,12 @@ int rtl_pci_probe(struct pci_dev *pdev, + set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status); + return 0; + +-fail3: +- pci_set_drvdata(pdev, NULL); ++fail5: ++ rtl_pci_deinit(hw); ++fail4: + rtl_deinit_core(hw); ++fail3: ++ rtlpriv->cfg->ops->deinit_sw_vars(hw); + + fail2: + if (rtlpriv->io.pci_mem_start != 0) +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch b/queue-5.15/wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch new file mode 100644 index 0000000000..4c9e37e21c --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch @@ -0,0 +1,38 @@ +From 05c03b1bbbfecc17215310d43c2f561a7e49e8ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 14:37:13 -0300 +Subject: wifi: rtlwifi: pci: wait for firmware loading before releasing memory + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit b59b86c5d08be7d761c04affcbcec8184738c200 ] + +At probe error path, the firmware loading work may have already been +queued. In such a case, it will try to access memory allocated by the probe +function, which is about to be released. In such paths, wait for the +firmware worker to finish before releasing memory. + +Fixes: 3d86b93064c7 ("rtlwifi: Fix PCI probe error path orphaned memory") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241206173713.3222187-5-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 5b0a5a22d06d2..925e4f807eb9f 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -2220,6 +2220,7 @@ int rtl_pci_probe(struct pci_dev *pdev, + fail4: + rtl_deinit_core(hw); + fail3: ++ wait_for_completion(&rtlpriv->firmware_loading_complete); + rtlpriv->cfg->ops->deinit_sw_vars(hw); + + fail2: +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtlwifi-remove-unused-check_buddy_priv.patch b/queue-5.15/wifi-rtlwifi-remove-unused-check_buddy_priv.patch new file mode 100644 index 0000000000..3802c8f6e3 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-remove-unused-check_buddy_priv.patch @@ -0,0 +1,200 @@ +From 85dff2d7234df16a2fa4091adff9c586f13fcd37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 14:37:10 -0300 +Subject: wifi: rtlwifi: remove unused check_buddy_priv + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit 2fdac64c3c35858aa8ac5caa70b232e03456e120 ] + +Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global +list of private data structures. + +Later on, commit 26634c4b1868 ("rtlwifi Modify existing bits to match +vendor version 2013.02.07") started adding the private data to that list at +probe time and added a hook, check_buddy_priv to find the private data from +a similar device. + +However, that function was never used. + +Besides, though there is a lock for that list, it is never used. And when +the probe fails, the private data is never removed from the list. This +would cause a second probe to access freed memory. + +Remove the unused hook, structures and members, which will prevent the +potential race condition on the list and its corruption during a second +probe when probe fails. + +Fixes: 26634c4b1868 ("rtlwifi Modify existing bits to match vendor version 2013.02.07") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241206173713.3222187-2-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/base.c | 7 ---- + drivers/net/wireless/realtek/rtlwifi/base.h | 1 - + drivers/net/wireless/realtek/rtlwifi/pci.c | 44 --------------------- + drivers/net/wireless/realtek/rtlwifi/wifi.h | 12 ------ + 4 files changed, 64 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index e2552bcdc6a02..f424d495305a8 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -2709,9 +2709,6 @@ MODULE_AUTHOR("Larry Finger "); + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core"); + +-struct rtl_global_var rtl_global_var = {}; +-EXPORT_SYMBOL_GPL(rtl_global_var); +- + static int __init rtl_core_module_init(void) + { + BUILD_BUG_ON(TX_PWR_BY_RATE_NUM_RATE < TX_PWR_BY_RATE_NUM_SECTION); +@@ -2725,10 +2722,6 @@ static int __init rtl_core_module_init(void) + /* add debugfs */ + rtl_debugfs_add_topdir(); + +- /* init some global vars */ +- INIT_LIST_HEAD(&rtl_global_var.glb_priv_list); +- spin_lock_init(&rtl_global_var.glb_list_lock); +- + return 0; + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h +index f081a9a90563f..f3a6a43a42eca 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.h ++++ b/drivers/net/wireless/realtek/rtlwifi/base.h +@@ -124,7 +124,6 @@ int rtl_send_smps_action(struct ieee80211_hw *hw, + u8 *rtl_find_ie(u8 *data, unsigned int len, u8 ie); + void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len); + u8 rtl_tid_to_ac(u8 tid); +-extern struct rtl_global_var rtl_global_var; + void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation); + + #endif +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 0dcf5350e0885..c0a201f1b74e5 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -295,46 +295,6 @@ static bool rtl_pci_get_amd_l1_patch(struct ieee80211_hw *hw) + return status; + } + +-static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, +- struct rtl_priv **buddy_priv) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw); +- struct rtl_priv *tpriv = NULL, *iter; +- struct rtl_pci_priv *tpcipriv = NULL; +- +- if (!list_empty(&rtlpriv->glb_var->glb_priv_list)) { +- list_for_each_entry(iter, &rtlpriv->glb_var->glb_priv_list, +- list) { +- tpcipriv = (struct rtl_pci_priv *)iter->priv; +- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, +- "pcipriv->ndis_adapter.funcnumber %x\n", +- pcipriv->ndis_adapter.funcnumber); +- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, +- "tpcipriv->ndis_adapter.funcnumber %x\n", +- tpcipriv->ndis_adapter.funcnumber); +- +- if (pcipriv->ndis_adapter.busnumber == +- tpcipriv->ndis_adapter.busnumber && +- pcipriv->ndis_adapter.devnumber == +- tpcipriv->ndis_adapter.devnumber && +- pcipriv->ndis_adapter.funcnumber != +- tpcipriv->ndis_adapter.funcnumber) { +- tpriv = iter; +- break; +- } +- } +- } +- +- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, +- "find_buddy_priv %d\n", tpriv != NULL); +- +- if (tpriv) +- *buddy_priv = tpriv; +- +- return tpriv != NULL; +-} +- + static void rtl_pci_parse_configuration(struct pci_dev *pdev, + struct ieee80211_hw *hw) + { +@@ -2013,7 +1973,6 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, + pcipriv->ndis_adapter.amd_l1_patch); + + rtl_pci_parse_configuration(pdev, hw); +- list_add_tail(&rtlpriv->list, &rtlpriv->glb_var->glb_priv_list); + + return true; + } +@@ -2160,7 +2119,6 @@ int rtl_pci_probe(struct pci_dev *pdev, + rtlpriv->rtlhal.interface = INTF_PCI; + rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data); + rtlpriv->intf_ops = &rtl_pci_ops; +- rtlpriv->glb_var = &rtl_global_var; + rtl_efuse_ops_init(hw); + + /* MEM map */ +@@ -2318,7 +2276,6 @@ void rtl_pci_disconnect(struct pci_dev *pdev) + if (rtlpci->using_msi) + pci_disable_msi(rtlpci->pdev); + +- list_del(&rtlpriv->list); + if (rtlpriv->io.pci_mem_start != 0) { + pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start); + pci_release_regions(pdev); +@@ -2378,7 +2335,6 @@ const struct rtl_intf_ops rtl_pci_ops = { + .read_efuse_byte = read_efuse_byte, + .adapter_start = rtl_pci_start, + .adapter_stop = rtl_pci_stop, +- .check_buddy_priv = rtl_pci_check_buddy_priv, + .adapter_tx = rtl_pci_tx, + .flush = rtl_pci_flush, + .reset_trx_ring = rtl_pci_reset_trx_ring, +diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h +index d461c22aa9ed7..a8b5db365a30e 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -2335,8 +2335,6 @@ struct rtl_intf_ops { + void (*read_efuse_byte)(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf); + int (*adapter_start)(struct ieee80211_hw *hw); + void (*adapter_stop)(struct ieee80211_hw *hw); +- bool (*check_buddy_priv)(struct ieee80211_hw *hw, +- struct rtl_priv **buddy_priv); + + int (*adapter_tx)(struct ieee80211_hw *hw, + struct ieee80211_sta *sta, +@@ -2580,14 +2578,6 @@ struct dig_t { + u32 rssi_max; + }; + +-struct rtl_global_var { +- /* from this list we can get +- * other adapter's rtl_priv +- */ +- struct list_head glb_priv_list; +- spinlock_t glb_list_lock; +-}; +- + #define IN_4WAY_TIMEOUT_TIME (30 * MSEC_PER_SEC) /* 30 seconds */ + + struct rtl_btc_info { +@@ -2733,9 +2723,7 @@ struct rtl_scan_list { + struct rtl_priv { + struct ieee80211_hw *hw; + struct completion firmware_loading_complete; +- struct list_head list; + struct rtl_priv *buddy_priv; +- struct rtl_global_var *glb_var; + struct rtl_dmsp_ctl dmsp_ctl; + struct rtl_locks locks; + struct rtl_works works; +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtlwifi-remove-unused-dualmac-control-leftovers.patch b/queue-5.15/wifi-rtlwifi-remove-unused-dualmac-control-leftovers.patch new file mode 100644 index 0000000000..a2343f540b --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-remove-unused-dualmac-control-leftovers.patch @@ -0,0 +1,69 @@ +From 29182d25d95cfce50d665d23f432cb431908b16c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 09:59:40 +0300 +Subject: wifi: rtlwifi: remove unused dualmac control leftovers + +From: Dmitry Antipov + +[ Upstream commit 557123259200b30863e1b6a8f24a8c8060b6fc1d ] + +Remove 'struct rtl_dualmac_easy_concurrent_ctl' of 'struct rtl_priv' +and related code in '_rtl_pci_tx_chk_waitq()'. + +Signed-off-by: Dmitry Antipov +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230602065940.149198-2-dmantipov@yandex.ru +Stable-dep-of: 2fdac64c3c35 ("wifi: rtlwifi: remove unused check_buddy_priv") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 5 ----- + drivers/net/wireless/realtek/rtlwifi/wifi.h | 9 --------- + 2 files changed, 14 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index f17a365fba070..0dcf5350e0885 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -443,11 +443,6 @@ static void _rtl_pci_tx_chk_waitq(struct ieee80211_hw *hw) + if (!rtlpriv->rtlhal.earlymode_enable) + return; + +- if (rtlpriv->dm.supp_phymode_switch && +- (rtlpriv->easy_concurrent_ctl.switch_in_process || +- (rtlpriv->buddy_priv && +- rtlpriv->buddy_priv->easy_concurrent_ctl.switch_in_process))) +- return; + /* we just use em for BE/BK/VI/VO */ + for (tid = 7; tid >= 0; tid--) { + u8 hw_queue = ac_to_hwq[rtl_tid_to_ac(tid)]; +diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h +index 1991cffd3dd4a..d461c22aa9ed7 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -2496,14 +2496,6 @@ struct rtl_debug { + #define MIMO_PS_DYNAMIC 1 + #define MIMO_PS_NOLIMIT 3 + +-struct rtl_dualmac_easy_concurrent_ctl { +- enum band_type currentbandtype_backfordmdp; +- bool close_bbandrf_for_dmsp; +- bool change_to_dmdp; +- bool change_to_dmsp; +- bool switch_in_process; +-}; +- + struct rtl_dmsp_ctl { + bool activescan_for_slaveofdmsp; + bool scan_for_anothermac_fordmsp; +@@ -2744,7 +2736,6 @@ struct rtl_priv { + struct list_head list; + struct rtl_priv *buddy_priv; + struct rtl_global_var *glb_var; +- struct rtl_dualmac_easy_concurrent_ctl easy_concurrent_ctl; + struct rtl_dmsp_ctl dmsp_ctl; + struct rtl_locks locks; + struct rtl_works works; +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtlwifi-remove-unused-timer-and-related-code.patch b/queue-5.15/wifi-rtlwifi-remove-unused-timer-and-related-code.patch new file mode 100644 index 0000000000..0339182ccc --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-remove-unused-timer-and-related-code.patch @@ -0,0 +1,95 @@ +From 361fd0a19e868847d22b90cb7cc1fba09c9eeb86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 09:59:39 +0300 +Subject: wifi: rtlwifi: remove unused timer and related code + +From: Dmitry Antipov + +[ Upstream commit 358b94f0a7cadd2ec7824531d54dadaa8b71de04 ] + +Drop unused 'dualmac_easyconcurrent_retrytimer' of 'struct rtl_works', +corresponding 'rtl_easy_concurrent_retrytimer_callback()' handler, +'dualmac_easy_concurrent' function pointer of 'struct rtl_hal_ops' +and related call to 'timer_setup()' in '_rtl_init_deferred_work()'. + +Signed-off-by: Dmitry Antipov +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230602065940.149198-1-dmantipov@yandex.ru +Stable-dep-of: 2fdac64c3c35 ("wifi: rtlwifi: remove unused check_buddy_priv") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/base.c | 16 +--------------- + drivers/net/wireless/realtek/rtlwifi/base.h | 1 - + drivers/net/wireless/realtek/rtlwifi/wifi.h | 2 -- + 3 files changed, 1 insertion(+), 18 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index a7ef84f559399..e2552bcdc6a02 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -452,8 +452,7 @@ static int _rtl_init_deferred_work(struct ieee80211_hw *hw) + /* <1> timer */ + timer_setup(&rtlpriv->works.watchdog_timer, + rtl_watch_dog_timer_callback, 0); +- timer_setup(&rtlpriv->works.dualmac_easyconcurrent_retrytimer, +- rtl_easy_concurrent_retrytimer_callback, 0); ++ + /* <2> work queue */ + rtlpriv->works.hw = hw; + rtlpriv->works.rtl_wq = wq; +@@ -2365,19 +2364,6 @@ static void rtl_c2hcmd_wq_callback(struct work_struct *work) + rtl_c2hcmd_launcher(hw, 1); + } + +-void rtl_easy_concurrent_retrytimer_callback(struct timer_list *t) +-{ +- struct rtl_priv *rtlpriv = +- from_timer(rtlpriv, t, works.dualmac_easyconcurrent_retrytimer); +- struct ieee80211_hw *hw = rtlpriv->hw; +- struct rtl_priv *buddy_priv = rtlpriv->buddy_priv; +- +- if (buddy_priv == NULL) +- return; +- +- rtlpriv->cfg->ops->dualmac_easy_concurrent(hw); +-} +- + /********************************************************* + * + * frame process functions +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h +index 0e4f8a8ae3a5f..f081a9a90563f 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.h ++++ b/drivers/net/wireless/realtek/rtlwifi/base.h +@@ -124,7 +124,6 @@ int rtl_send_smps_action(struct ieee80211_hw *hw, + u8 *rtl_find_ie(u8 *data, unsigned int len, u8 ie); + void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len); + u8 rtl_tid_to_ac(u8 tid); +-void rtl_easy_concurrent_retrytimer_callback(struct timer_list *t); + extern struct rtl_global_var rtl_global_var; + void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation); + +diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h +index 0bac788ccd6e3..1991cffd3dd4a 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -2300,7 +2300,6 @@ struct rtl_hal_ops { + u32 regaddr, u32 bitmask, u32 data); + void (*linked_set_reg)(struct ieee80211_hw *hw); + void (*chk_switch_dmdp)(struct ieee80211_hw *hw); +- void (*dualmac_easy_concurrent)(struct ieee80211_hw *hw); + void (*dualmac_switch_to_dmdp)(struct ieee80211_hw *hw); + bool (*phy_rf6052_config)(struct ieee80211_hw *hw); + void (*phy_rf6052_set_cck_txpower)(struct ieee80211_hw *hw, +@@ -2465,7 +2464,6 @@ struct rtl_works { + + /*timer */ + struct timer_list watchdog_timer; +- struct timer_list dualmac_easyconcurrent_retrytimer; + struct timer_list fw_clockoff_timer; + struct timer_list fast_antenna_training_timer; + /*task */ +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch b/queue-5.15/wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch new file mode 100644 index 0000000000..65dc6e2606 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch @@ -0,0 +1,59 @@ +From da3b8565b27dbbe302c26564b96bbaf928c98a43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:33:19 -0300 +Subject: wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last + step + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit 8559a9e0c457729fe3edb3176bbf7c7874f482b0 ] + +Just like in commit 4dfde294b979 ("rtlwifi: rise completion at the last +step of firmware callback"), only signal completion once the function is +finished. Otherwise, the module removal waiting for the completion could +free the memory that the callback will still use before returning. + +Fixes: b0302aba812b ("rtlwifi: Convert to asynchronous firmware load") +Signed-off-by: Thadeu Lima de Souza Cascardo +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241107133322.855112-3-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c +index 6d352a3161b8f..60d97e73ca28e 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c +@@ -67,22 +67,23 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context) + + rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD, + "Firmware callback routine entered!\n"); +- complete(&rtlpriv->firmware_loading_complete); + if (!firmware) { + pr_err("Firmware %s not available\n", fw_name); + rtlpriv->max_fw_size = 0; +- return; ++ goto exit; + } + if (firmware->size > rtlpriv->max_fw_size) { + pr_err("Firmware is too big!\n"); + rtlpriv->max_fw_size = 0; + release_firmware(firmware); +- return; ++ goto exit; + } + pfirmware = (struct rt_firmware *)rtlpriv->rtlhal.pfirmware; + memcpy(pfirmware->sz_fw_tmpbuffer, firmware->data, firmware->size); + pfirmware->sz_fw_tmpbufferlen = firmware->size; + release_firmware(firmware); ++exit: ++ complete(&rtlpriv->firmware_loading_complete); + } + + static int rtl92s_init_sw_vars(struct ieee80211_hw *hw) +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch b/queue-5.15/wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch new file mode 100644 index 0000000000..8cb85c8dd3 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch @@ -0,0 +1,38 @@ +From 6044294c68ada2bc0ca5dfef4269129c506934bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:33:22 -0300 +Subject: wifi: rtlwifi: usb: fix workqueue leak when probe fails + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit f79bc5c67867c19ce2762e7934c20dbb835ed82c ] + +rtl_init_core creates a workqueue that is then assigned to rtl_wq. +rtl_deinit_core does not destroy it. It is left to rtl_usb_deinit, which +must be called in the probe error path. + +Fixes: 2ca20f79e0d8 ("rtlwifi: Add usb driver") +Fixes: 851639fdaeac ("rtlwifi: Modify some USB de-initialize code.") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241107133322.855112-6-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 1753eccbefdd9..04590d16874c4 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1084,6 +1084,7 @@ int rtl_usb_probe(struct usb_interface *intf, + wait_for_completion(&rtlpriv->firmware_loading_complete); + rtlpriv->cfg->ops->deinit_sw_vars(hw); + error_out: ++ rtl_usb_deinit(hw); + rtl_deinit_core(hw); + error_out2: + _rtl_usb_io_handler_release(hw); +-- +2.39.5 + diff --git a/queue-5.15/wifi-rtlwifi-wait-for-firmware-loading-before-releas.patch b/queue-5.15/wifi-rtlwifi-wait-for-firmware-loading-before-releas.patch new file mode 100644 index 0000000000..1cef25f572 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-wait-for-firmware-loading-before-releas.patch @@ -0,0 +1,47 @@ +From c8b3a1519bfddf2c052ab60b71bcb4d8ab45434d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:33:20 -0300 +Subject: wifi: rtlwifi: wait for firmware loading before releasing memory + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit b4b26642b31ef282df6ff7ea8531985edfdef12a ] + +At probe error path, the firmware loading work may have already been +queued. In such a case, it will try to access memory allocated by the probe +function, which is about to be released. In such paths, wait for the +firmware worker to finish before releasing memory. + +Fixes: a7f7c15e945a ("rtlwifi: rtl8192cu: Free ieee80211_hw if probing fails") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241107133322.855112-4-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/usb.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index c2a3c88ea1fcc..038d9bb652b64 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1073,13 +1073,15 @@ int rtl_usb_probe(struct usb_interface *intf, + err = ieee80211_register_hw(hw); + if (err) { + pr_err("Can't register mac80211 hw.\n"); +- goto error_out; ++ goto error_init_vars; + } + rtlpriv->mac80211.mac80211_registered = 1; + + set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status); + return 0; + ++error_init_vars: ++ wait_for_completion(&rtlpriv->firmware_loading_complete); + error_out: + rtl_deinit_core(hw); + error_out2: +-- +2.39.5 + diff --git a/queue-5.15/wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch b/queue-5.15/wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch new file mode 100644 index 0000000000..e757764ddc --- /dev/null +++ b/queue-5.15/wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch @@ -0,0 +1,70 @@ +From 9cc2dcd5b0d26ba75d9e49dd78b30560d59d219d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jan 2025 20:55:07 +0100 +Subject: wifi: wlcore: fix unbalanced pm_runtime calls + +From: Andreas Kemnade + +[ Upstream commit 996c934c8c196144af386c4385f61fcd5349af28 ] + +If firmware boot failes, runtime pm is put too often: +[12092.708099] wlcore: ERROR firmware boot failed despite 3 retries +[12092.708099] wl18xx_driver wl18xx.1.auto: Runtime PM usage count underflow! +Fix that by redirecting all error gotos before runtime_get so that runtime is +not put. + +Fixes: c40aad28a3cf ("wlcore: Make sure firmware is initialized in wl1271_op_add_interface()") +Signed-off-by: Andreas Kemnade +Reviewed-by: Michael Nemanov +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20250104195507.402673-1-akemnade@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ti/wlcore/main.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c +index 5669f17b395f3..7d664380c4771 100644 +--- a/drivers/net/wireless/ti/wlcore/main.c ++++ b/drivers/net/wireless/ti/wlcore/main.c +@@ -2552,24 +2552,24 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw, + if (test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS, &wl->flags) || + test_bit(WLVIF_FLAG_INITIALIZED, &wlvif->flags)) { + ret = -EBUSY; +- goto out; ++ goto out_unlock; + } + + + ret = wl12xx_init_vif_data(wl, vif); + if (ret < 0) +- goto out; ++ goto out_unlock; + + wlvif->wl = wl; + role_type = wl12xx_get_role_type(wl, wlvif); + if (role_type == WL12XX_INVALID_ROLE_TYPE) { + ret = -EINVAL; +- goto out; ++ goto out_unlock; + } + + ret = wlcore_allocate_hw_queue_base(wl, wlvif); + if (ret < 0) +- goto out; ++ goto out_unlock; + + /* + * TODO: after the nvs issue will be solved, move this block +@@ -2584,7 +2584,7 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw, + + ret = wl12xx_init_fw(wl); + if (ret < 0) +- goto out; ++ goto out_unlock; + } + + /* +-- +2.39.5 + diff --git a/queue-5.15/xen-x86-free_p2m_page-use-memblock_free_ptr-to-free-.patch b/queue-5.15/xen-x86-free_p2m_page-use-memblock_free_ptr-to-free-.patch new file mode 100644 index 0000000000..34d562f1c2 --- /dev/null +++ b/queue-5.15/xen-x86-free_p2m_page-use-memblock_free_ptr-to-free-.patch @@ -0,0 +1,45 @@ +From 26a853a6dfd11c2154232c9a2e9a7c25a3c02ed3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 13:43:10 -0700 +Subject: xen/x86: free_p2m_page: use memblock_free_ptr() to free a virtual + pointer + +From: Mike Rapoport + +[ Upstream commit c486514dd40980b2dbb0e15fabddfe1324ed0197 ] + +free_p2m_page() wrongly passes a virtual pointer to memblock_free() that +treats it as a physical address. + +Call memblock_free_ptr() instead that gets a virtual address to free the +memory. + +Link: https://lkml.kernel.org/r/20210930185031.18648-3-rppt@kernel.org +Signed-off-by: Mike Rapoport +Reviewed-by: Juergen Gross +Cc: Christophe Leroy +Cc: Shahab Vahedi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: 29091a52562b ("of: reserved-memory: Do not make kmemleak ignore freed address") +Signed-off-by: Sasha Levin +--- + arch/x86/xen/p2m.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c +index 9b3a9fa4a0ade..899590f1f74a5 100644 +--- a/arch/x86/xen/p2m.c ++++ b/arch/x86/xen/p2m.c +@@ -197,7 +197,7 @@ static void * __ref alloc_p2m_page(void) + static void __ref free_p2m_page(void *p) + { + if (unlikely(!slab_is_available())) { +- memblock_free((unsigned long)p, PAGE_SIZE); ++ memblock_free_ptr(p, PAGE_SIZE); + return; + } + +-- +2.39.5 + diff --git a/queue-5.15/xfrm-replay-fix-the-update-of-replay_esn-oseq_hi-for.patch b/queue-5.15/xfrm-replay-fix-the-update-of-replay_esn-oseq_hi-for.patch new file mode 100644 index 0000000000..202f56c663 --- /dev/null +++ b/queue-5.15/xfrm-replay-fix-the-update-of-replay_esn-oseq_hi-for.patch @@ -0,0 +1,61 @@ +From 7f94be6829b56829e7c817af9d8e6e59b8a87553 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2024 14:10:31 +0200 +Subject: xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO + +From: Jianbo Liu + +[ Upstream commit c05c5e5aa163f4682ca97a2f0536575fc7dbdecb ] + +When skb needs GSO and wrap around happens, if xo->seq.low (seqno of +the first skb segment) is before the last seq number but oseq (seqno +of the last segment) is after it, xo->seq.low is still bigger than +replay_esn->oseq while oseq is smaller than it, so the update of +replay_esn->oseq_hi is missed for this case wrap around because of +the change in the cited commit. + +For example, if sending a packet with gso_segs=3 while old +replay_esn->oseq=0xfffffffe, we calculate: + xo->seq.low = 0xfffffffe + 1 = 0x0xffffffff + oseq = 0xfffffffe + 3 = 0x1 +(oseq < replay_esn->oseq) is true, but (xo->seq.low < +replay_esn->oseq) is false, so replay_esn->oseq_hi is not incremented. + +To fix this issue, change the outer checking back for the update of +replay_esn->oseq_hi. And add new checking inside for the update of +packet's oseq_hi. + +Fixes: 4b549ccce941 ("xfrm: replay: Fix ESN wrap around for GSO") +Signed-off-by: Jianbo Liu +Reviewed-by: Patrisious Haddad +Signed-off-by: Leon Romanovsky +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_replay.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c +index 49dd788859d8b..6f6a18dc375b7 100644 +--- a/net/xfrm/xfrm_replay.c ++++ b/net/xfrm/xfrm_replay.c +@@ -714,10 +714,12 @@ static int xfrm_replay_overflow_offload_esn(struct xfrm_state *x, struct sk_buff + oseq += skb_shinfo(skb)->gso_segs; + } + +- if (unlikely(xo->seq.low < replay_esn->oseq)) { +- XFRM_SKB_CB(skb)->seq.output.hi = ++oseq_hi; +- xo->seq.hi = oseq_hi; +- replay_esn->oseq_hi = oseq_hi; ++ if (unlikely(oseq < replay_esn->oseq)) { ++ replay_esn->oseq_hi = ++oseq_hi; ++ if (xo->seq.low < replay_esn->oseq) { ++ XFRM_SKB_CB(skb)->seq.output.hi = oseq_hi; ++ xo->seq.hi = oseq_hi; ++ } + if (replay_esn->oseq_hi == 0) { + replay_esn->oseq--; + replay_esn->oseq_hi--; +-- +2.39.5 +