From: Sasha Levin Date: Fri, 8 Sep 2023 21:36:55 +0000 (-0400) Subject: Fixes for 6.1 X-Git-Tag: v6.1.53~112 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5c58364d5fd497290c012fcebbe6c41760729518;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/acpi-x86-s2idle-fix-a-logic-error-parsing-amd-constr.patch b/queue-6.1/acpi-x86-s2idle-fix-a-logic-error-parsing-amd-constr.patch new file mode 100644 index 00000000000..2b02d5cb77c --- /dev/null +++ b/queue-6.1/acpi-x86-s2idle-fix-a-logic-error-parsing-amd-constr.patch @@ -0,0 +1,84 @@ +From 174a461bb1654af559059ee8611c36cf3b95d6e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 14:40:04 -0500 +Subject: ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table + +From: Mario Limonciello + +[ Upstream commit 9cc8cd086f05d9a01026c65c98da88561e9c619e ] + +The constraints table should be resetting the `list` object +after running through all of `info_obj` iterations. + +This adjusts whitespace as well as less code will now be included +with each loop. This fixes a functional problem is fixed where a +badly formed package in the inner loop may have incorrect data. + +Fixes: 146f1ed852a8 ("ACPI: PM: s2idle: Add AMD support to handle _DSM") +Signed-off-by: Mario Limonciello +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/s2idle.c | 31 ++++++++++++------------------- + 1 file changed, 12 insertions(+), 19 deletions(-) + +diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c +index 3a9195df1aab3..ec84da6cc1bff 100644 +--- a/drivers/acpi/x86/s2idle.c ++++ b/drivers/acpi/x86/s2idle.c +@@ -128,12 +128,11 @@ static void lpi_device_get_constraints_amd(void) + struct lpi_constraints *list; + acpi_status status; + ++ list = &lpi_constraints_table[lpi_constraints_table_size]; ++ + for (k = 0; k < info_obj->package.count; k++) { + union acpi_object *obj = &info_obj->package.elements[k]; + +- list = &lpi_constraints_table[lpi_constraints_table_size]; +- list->min_dstate = -1; +- + switch (k) { + case 0: + dev_info.enabled = obj->integer.value; +@@ -148,27 +147,21 @@ static void lpi_device_get_constraints_amd(void) + dev_info.min_dstate = obj->integer.value; + break; + } ++ } + +- if (!dev_info.enabled || !dev_info.name || +- !dev_info.min_dstate) +- continue; ++ if (!dev_info.enabled || !dev_info.name || ++ !dev_info.min_dstate) ++ continue; + +- status = acpi_get_handle(NULL, dev_info.name, +- &list->handle); +- if (ACPI_FAILURE(status)) +- continue; ++ status = acpi_get_handle(NULL, dev_info.name, &list->handle); ++ if (ACPI_FAILURE(status)) ++ continue; + +- acpi_handle_debug(lps0_device_handle, +- "Name:%s\n", dev_info.name); ++ acpi_handle_debug(lps0_device_handle, ++ "Name:%s\n", dev_info.name); + +- list->min_dstate = dev_info.min_dstate; ++ list->min_dstate = dev_info.min_dstate; + +- if (list->min_dstate < 0) { +- acpi_handle_debug(lps0_device_handle, +- "Incomplete constraint defined\n"); +- continue; +- } +- } + lpi_constraints_table_size++; + } + } +-- +2.40.1 + diff --git a/queue-6.1/acpi-x86-s2idle-post-increment-variables-when-gettin.patch b/queue-6.1/acpi-x86-s2idle-post-increment-variables-when-gettin.patch new file mode 100644 index 00000000000..1fc7d73823c --- /dev/null +++ b/queue-6.1/acpi-x86-s2idle-post-increment-variables-when-gettin.patch @@ -0,0 +1,65 @@ +From c215577cbbbb8bde1e0d76276cd97df0f3900237 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 14:40:02 -0500 +Subject: ACPI: x86: s2idle: Post-increment variables when getting constraints + +From: Mario Limonciello + +[ Upstream commit 3c6b1212d20bbbffcad5709ab0f2d5ed9b5859a8 ] + +When code uses a pre-increment it makes the reader question "why". +In the constraint fetching code there is no reason for the variables +to be pre-incremented so adjust to post-increment. +No intended functional changes. + +Reviewed-by: Kuppuswamy Sathyanarayanan +Suggested-by: Bjorn Helgaas +Signed-off-by: Mario Limonciello +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: 9cc8cd086f05 ("ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table") +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/s2idle.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c +index e499c60c45791..3a9195df1aab3 100644 +--- a/drivers/acpi/x86/s2idle.c ++++ b/drivers/acpi/x86/s2idle.c +@@ -122,13 +122,13 @@ static void lpi_device_get_constraints_amd(void) + acpi_handle_debug(lps0_device_handle, + "LPI: constraints list begin:\n"); + +- for (j = 0; j < package->package.count; ++j) { ++ for (j = 0; j < package->package.count; j++) { + union acpi_object *info_obj = &package->package.elements[j]; + struct lpi_device_constraint_amd dev_info = {}; + struct lpi_constraints *list; + acpi_status status; + +- for (k = 0; k < info_obj->package.count; ++k) { ++ for (k = 0; k < info_obj->package.count; k++) { + union acpi_object *obj = &info_obj->package.elements[k]; + + list = &lpi_constraints_table[lpi_constraints_table_size]; +@@ -213,7 +213,7 @@ static void lpi_device_get_constraints(void) + if (!package) + continue; + +- for (j = 0; j < package->package.count; ++j) { ++ for (j = 0; j < package->package.count; j++) { + union acpi_object *element = + &(package->package.elements[j]); + +@@ -245,7 +245,7 @@ static void lpi_device_get_constraints(void) + + constraint->min_dstate = -1; + +- for (j = 0; j < package_count; ++j) { ++ for (j = 0; j < package_count; j++) { + union acpi_object *info_obj = &info.package[j]; + union acpi_object *cnstr_pkg; + union acpi_object *obj; +-- +2.40.1 + diff --git a/queue-6.1/alsa-ac97-fix-possible-error-value-of-rac97.patch b/queue-6.1/alsa-ac97-fix-possible-error-value-of-rac97.patch new file mode 100644 index 00000000000..5f77d0ae887 --- /dev/null +++ b/queue-6.1/alsa-ac97-fix-possible-error-value-of-rac97.patch @@ -0,0 +1,52 @@ +From 66b2bdd0ff09aadebd1d914f6703da6ae8c6d1a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Aug 2023 10:52:13 +0800 +Subject: ALSA: ac97: Fix possible error value of *rac97 + +From: Su Hui + +[ Upstream commit 67de40c9df94037769967ba28c7d951afb45b7fb ] + +Before committing 79597c8bf64c, *rac97 always be NULL if there is +an error. When error happens, make sure *rac97 is NULL is safer. + +For examble, in snd_vortex_mixer(): + err = snd_ac97_mixer(pbus, &ac97, &vortex->codec); + vortex->isquad = ((vortex->codec == NULL) ? + 0 : (vortex->codec->ext_id&0x80)); +If error happened but vortex->codec isn't NULL, this may cause some +problems. + +Move the judgement order to be clearer and better. + +Fixes: 79597c8bf64c ("ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer") +Suggested-by: Christophe JAILLET +Acked-by: Christophe JAILLET +Signed-off-by: Su Hui +Link: https://lore.kernel.org/r/20230823025212.1000961-1-suhui@nfschina.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/ac97/ac97_codec.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c +index 534ea7a256ec3..606b318f34e56 100644 +--- a/sound/pci/ac97/ac97_codec.c ++++ b/sound/pci/ac97/ac97_codec.c +@@ -2070,10 +2070,9 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template, + .dev_disconnect = snd_ac97_dev_disconnect, + }; + +- if (!rac97) +- return -EINVAL; +- if (snd_BUG_ON(!bus || !template)) ++ if (snd_BUG_ON(!bus || !template || !rac97)) + return -EINVAL; ++ *rac97 = NULL; + if (snd_BUG_ON(template->num >= 4)) + return -EINVAL; + if (bus->codec[template->num]) +-- +2.40.1 + diff --git a/queue-6.1/amba-bus-fix-refcount-leak.patch b/queue-6.1/amba-bus-fix-refcount-leak.patch new file mode 100644 index 00000000000..1d63148cc2c --- /dev/null +++ b/queue-6.1/amba-bus-fix-refcount-leak.patch @@ -0,0 +1,39 @@ +From fddbfe91c22f3e4560f2734033fdeb5489830a98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Aug 2023 10:39:27 +0800 +Subject: amba: bus: fix refcount leak + +From: Peng Fan + +[ Upstream commit e312cbdc11305568554a9e18a2ea5c2492c183f3 ] + +commit 5de1540b7bc4 ("drivers/amba: create devices from device tree") +increases the refcount of of_node, but not releases it in +amba_device_release, so there is refcount leak. By using of_node_put +to avoid refcount leak. + +Fixes: 5de1540b7bc4 ("drivers/amba: create devices from device tree") +Signed-off-by: Peng Fan +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230821023928.3324283-1-peng.fan@oss.nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/amba/bus.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c +index 110a535648d2e..0aa2d3111ae6e 100644 +--- a/drivers/amba/bus.c ++++ b/drivers/amba/bus.c +@@ -534,6 +534,7 @@ static void amba_device_release(struct device *dev) + { + struct amba_device *d = to_amba_device(dev); + ++ of_node_put(d->dev.of_node); + if (d->res.parent) + release_resource(&d->res); + mutex_destroy(&d->periphid_lock); +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-add-.dts-files-missing-from-the-build.patch b/queue-6.1/arm-dts-add-.dts-files-missing-from-the-build.patch new file mode 100644 index 00000000000..6407fcaf4b1 --- /dev/null +++ b/queue-6.1/arm-dts-add-.dts-files-missing-from-the-build.patch @@ -0,0 +1,70 @@ +From 6a1fd94e112628e21887ece8bac525e5ca260e34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 May 2023 12:25:29 -0500 +Subject: ARM: dts: Add .dts files missing from the build + +From: Rob Herring + +[ Upstream commit 86684c2481b6e6a46c2282acee13554e34e66071 ] + +Comparing .dts files to built .dtb files yielded a few .dts files which +are never built. Add them to the build. + +Signed-off-by: Rob Herring +Stable-dep-of: 92632115fb57 ("samples/bpf: fix bio latency check with tracepoint") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/Makefile | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile +index 6aa7dc4db2fc8..df6d905eeb877 100644 +--- a/arch/arm/boot/dts/Makefile ++++ b/arch/arm/boot/dts/Makefile +@@ -331,6 +331,7 @@ dtb-$(CONFIG_MACH_KIRKWOOD) += \ + kirkwood-iconnect.dtb \ + kirkwood-iomega_ix2_200.dtb \ + kirkwood-is2.dtb \ ++ kirkwood-km_fixedeth.dtb \ + kirkwood-km_kirkwood.dtb \ + kirkwood-l-50.dtb \ + kirkwood-laplug.dtb \ +@@ -861,7 +862,10 @@ dtb-$(CONFIG_ARCH_OMAP3) += \ + am3517-craneboard.dtb \ + am3517-evm.dtb \ + am3517_mt_ventoux.dtb \ ++ logicpd-torpedo-35xx-devkit.dtb \ + logicpd-torpedo-37xx-devkit.dtb \ ++ logicpd-torpedo-37xx-devkit-28.dtb \ ++ logicpd-som-lv-35xx-devkit.dtb \ + logicpd-som-lv-37xx-devkit.dtb \ + omap3430-sdp.dtb \ + omap3-beagle.dtb \ +@@ -1527,6 +1531,8 @@ dtb-$(CONFIG_MACH_ARMADA_38X) += \ + armada-388-helios4.dtb \ + armada-388-rd.dtb + dtb-$(CONFIG_MACH_ARMADA_39X) += \ ++ armada-390-db.dtb \ ++ armada-395-gp.dtb \ + armada-398-db.dtb + dtb-$(CONFIG_MACH_ARMADA_XP) += \ + armada-xp-axpwifiap.dtb \ +@@ -1556,6 +1562,7 @@ dtb-$(CONFIG_MACH_DOVE) += \ + dtb-$(CONFIG_ARCH_MEDIATEK) += \ + mt2701-evb.dtb \ + mt6580-evbp1.dtb \ ++ mt6582-prestigio-pmt5008-3g.dtb \ + mt6589-aquaris5.dtb \ + mt6589-fairphone-fp1.dtb \ + mt6592-evb.dtb \ +@@ -1608,6 +1615,7 @@ dtb-$(CONFIG_ARCH_ASPEED) += \ + aspeed-bmc-intel-s2600wf.dtb \ + aspeed-bmc-inspur-fp5280g2.dtb \ + aspeed-bmc-inspur-nf5280m6.dtb \ ++ aspeed-bmc-inspur-on5263m5.dtb \ + aspeed-bmc-lenovo-hr630.dtb \ + aspeed-bmc-lenovo-hr855xg2.dtb \ + aspeed-bmc-microsoft-olympus.dtb \ +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-bcm53573-add-cells-sizes-to-pcie-node.patch b/queue-6.1/arm-dts-bcm53573-add-cells-sizes-to-pcie-node.patch new file mode 100644 index 00000000000..ba311a3b18b --- /dev/null +++ b/queue-6.1/arm-dts-bcm53573-add-cells-sizes-to-pcie-node.patch @@ -0,0 +1,47 @@ +From 44bd1e70b5434a2d9417d5e9703b8f62734881c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 13:40:03 +0200 +Subject: ARM: dts: BCM53573: Add cells sizes to PCIe node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 3392ef368d9b04622fe758b1079b512664b6110a ] + +This fixes: +arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: pcie@2000: '#address-cells' is a required property + From schema: /lib/python3.10/site-packages/dtschema/schemas/pci/pci-bus.yaml +arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: pcie@2000: '#size-cells' is a required property + From schema: /lib/python3.10/site-packages/dtschema/schemas/pci/pci-bus.yaml + +Two properties that need to be added later are "device_type" and +"ranges". Adding "device_type" on its own causes a new warning and the +value of "ranges" needs to be determined yet. + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20230707114004.2740-3-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm53573.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi +index 3cb71829e8597..eed1a6147f0bf 100644 +--- a/arch/arm/boot/dts/bcm53573.dtsi ++++ b/arch/arm/boot/dts/bcm53573.dtsi +@@ -127,6 +127,9 @@ uart0: serial@300 { + + pcie0: pcie@2000 { + reg = <0x00002000 0x1000>; ++ ++ #address-cells = <3>; ++ #size-cells = <2>; + }; + + usb2: usb2@4000 { +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-bcm53573-drop-nonexistent-usb-cells.patch b/queue-6.1/arm-dts-bcm53573-drop-nonexistent-usb-cells.patch new file mode 100644 index 00000000000..96863f55fd1 --- /dev/null +++ b/queue-6.1/arm-dts-bcm53573-drop-nonexistent-usb-cells.patch @@ -0,0 +1,42 @@ +From d3fcccbfaf13ffb1529a95b42e13c0a7e8b3cabb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 13:40:02 +0200 +Subject: ARM: dts: BCM53573: Drop nonexistent #usb-cells +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 05d2c3d552b8c92fc397377d9d1112fc58e2cd59 ] + +Such property simply doesn't exist (is not documented or used anywhere). + +This fixes: +arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: usb@d000: Unevaluated properties are not allowed ('#usb-cells' was unexpected) + From schema: Documentation/devicetree/bindings/usb/generic-ohci.yaml + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20230707114004.2740-2-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm53573.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi +index 3f03a381db0f2..3cb71829e8597 100644 +--- a/arch/arm/boot/dts/bcm53573.dtsi ++++ b/arch/arm/boot/dts/bcm53573.dtsi +@@ -156,8 +156,6 @@ ehci_port2: port@2 { + }; + + ohci: usb@d000 { +- #usb-cells = <0>; +- + compatible = "generic-ohci"; + reg = <0xd000 0x1000>; + interrupt-parent = <&gic>; +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-bcm53573-fix-ethernet-info-for-luxul-devices.patch b/queue-6.1/arm-dts-bcm53573-fix-ethernet-info-for-luxul-devices.patch new file mode 100644 index 00000000000..27e5a40fbec --- /dev/null +++ b/queue-6.1/arm-dts-bcm53573-fix-ethernet-info-for-luxul-devices.patch @@ -0,0 +1,87 @@ +From 1a266d967a03a291a4c9bca63edbac3d4f6dd47c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 13:11:45 +0200 +Subject: ARM: dts: BCM53573: Fix Ethernet info for Luxul devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 44ad8207806973f4e4f7d870fff36cc01f494250 ] + +Both Luxul's XAP devices (XAP-810 and XAP-1440) are access points that +use a non-default design. They don't include switch but have a single +Ethernet port and BCM54210E PHY connected to the Ethernet controller's +MDIO bus. + +Support for those devices regressed due to two changes: + +1. Describing MDIO bus with switch +After commit 9fb90ae6cae7 ("ARM: dts: BCM53573: Describe on-SoC BCM53125 +rev 4 switch") Linux stopped probing for MDIO devices. + +2. Dropping hardcoded BCM54210E delays +In commit fea7fda7f50a ("net: phy: broadcom: Fix RGMII delays +configuration for BCM54210E") support for other PHY modes was added but +that requires a proper "phy-mode" value in DT. + +Both above changes are correct (they don't need to be reverted or +anything) but they need this fix for DT data to be correct and for Linux +to work properly. + +Fixes: 9fb90ae6cae7 ("ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch") +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20230713111145.14864-1-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts | 13 +++++++++++++ + arch/arm/boot/dts/bcm47189-luxul-xap-810.dts | 13 +++++++++++++ + 2 files changed, 26 insertions(+) + +diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts +index e20b6d2eb274a..1e23e0a807819 100644 +--- a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts ++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts +@@ -46,3 +46,16 @@ button-restart { + }; + }; + }; ++ ++&gmac0 { ++ phy-mode = "rgmii"; ++ phy-handle = <&bcm54210e>; ++ ++ mdio { ++ /delete-node/ switch@1e; ++ ++ bcm54210e: ethernet-phy@0 { ++ reg = <0>; ++ }; ++ }; ++}; +diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts +index 9d863570fcf3a..5dbb950c8113e 100644 +--- a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts ++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts +@@ -83,3 +83,16 @@ pcie0_chipcommon: chipcommon@0 { + }; + }; + }; ++ ++&gmac0 { ++ phy-mode = "rgmii"; ++ phy-handle = <&bcm54210e>; ++ ++ mdio { ++ /delete-node/ switch@1e; ++ ++ bcm54210e: ethernet-phy@0 { ++ reg = <0>; ++ }; ++ }; ++}; +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-bcm53573-fix-tenda-ac9-switch-cpu-port.patch b/queue-6.1/arm-dts-bcm53573-fix-tenda-ac9-switch-cpu-port.patch new file mode 100644 index 00000000000..4291a323abe --- /dev/null +++ b/queue-6.1/arm-dts-bcm53573-fix-tenda-ac9-switch-cpu-port.patch @@ -0,0 +1,41 @@ +From c1989b7c0822dd483531aebadda1732e2a466046 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 21:54:14 +0200 +Subject: ARM: dts: BCM53573: Fix Tenda AC9 switch CPU port +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 7141209db9c335ab261a17933809a3e660ebdc12 ] + +Primary Ethernet interface is connected to the port 8 (not 5). + +Fixes: 64612828628c ("ARM: dts: BCM53573: Add Tenda AC9 switch ports") +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20230723195416.7831-1-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm47189-tenda-ac9.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm47189-tenda-ac9.dts b/arch/arm/boot/dts/bcm47189-tenda-ac9.dts +index 55b92645b0f1f..b7c7bf0be76f4 100644 +--- a/arch/arm/boot/dts/bcm47189-tenda-ac9.dts ++++ b/arch/arm/boot/dts/bcm47189-tenda-ac9.dts +@@ -135,8 +135,8 @@ port@4 { + label = "lan4"; + }; + +- port@5 { +- reg = <5>; ++ port@8 { ++ reg = <8>; + label = "cpu"; + ethernet = <&gmac0>; + }; +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-bcm53573-use-updated-spi-gpio-binding-proper.patch b/queue-6.1/arm-dts-bcm53573-use-updated-spi-gpio-binding-proper.patch new file mode 100644 index 00000000000..9e7538f3349 --- /dev/null +++ b/queue-6.1/arm-dts-bcm53573-use-updated-spi-gpio-binding-proper.patch @@ -0,0 +1,54 @@ +From d5524302edeaa1dee7013ef0f7cdf99760ebdfee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 13:40:04 +0200 +Subject: ARM: dts: BCM53573: Use updated "spi-gpio" binding properties +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 2c0fd6b3d0778ceab40205315ccef74568490f17 ] + +Switch away from deprecated properties. + +This fixes: +arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-sck: False schema does not allow [[3, 21, 0]] + From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml +arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-miso: False schema does not allow [[3, 22, 0]] + From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml +arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-mosi: False schema does not allow [[3, 23, 0]] + From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml +arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: 'sck-gpios' is a required property + From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml +arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: Unevaluated properties are not allowed ('gpio-miso', 'gpio-mosi', 'gpio-sck' were unexpected) + From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20230707114004.2740-4-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm947189acdbmr.dts | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm947189acdbmr.dts b/arch/arm/boot/dts/bcm947189acdbmr.dts +index 16e70a264faf5..458bb6e2f5728 100644 +--- a/arch/arm/boot/dts/bcm947189acdbmr.dts ++++ b/arch/arm/boot/dts/bcm947189acdbmr.dts +@@ -60,9 +60,9 @@ button-wps { + spi { + compatible = "spi-gpio"; + num-chipselects = <1>; +- gpio-sck = <&chipcommon 21 0>; +- gpio-miso = <&chipcommon 22 0>; +- gpio-mosi = <&chipcommon 23 0>; ++ sck-gpios = <&chipcommon 21 0>; ++ miso-gpios = <&chipcommon 22 0>; ++ mosi-gpios = <&chipcommon 23 0>; + cs-gpios = <&chipcommon 24 0>; + #address-cells = <1>; + #size-cells = <0>; +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-qcom-ipq4019-correct-sdhci-xo-clock.patch b/queue-6.1/arm-dts-qcom-ipq4019-correct-sdhci-xo-clock.patch new file mode 100644 index 00000000000..6d2c8e525d9 --- /dev/null +++ b/queue-6.1/arm-dts-qcom-ipq4019-correct-sdhci-xo-clock.patch @@ -0,0 +1,46 @@ +From d3022bd76ffc576b016b8532233ccb890f7945be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 13:01:16 +0200 +Subject: ARM: dts: qcom: ipq4019: correct SDHCI XO clock + +From: Robert Marko + +[ Upstream commit b5ed7a5c1fdb3981713f7b637b72aa390c3db036 ] + +Using GCC_DCD_XO_CLK as the XO clock for SDHCI controller is not correct, +it seems that I somehow made a mistake of passing it instead of the fixed +XO clock. + +Fixes: 04b3b72b5b8f ("ARM: dts: qcom: ipq4019: Add SDHCI controller node") +Signed-off-by: Robert Marko +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230811110150.229966-1-robert.marko@sartura.hr +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-ipq4019.dtsi | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi +index 02e13d8c222a0..b5e0ed4923b59 100644 +--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi +@@ -228,9 +228,12 @@ sdhci: mmc@7824900 { + interrupts = , ; + interrupt-names = "hc_irq", "pwr_irq"; + bus-width = <8>; +- clocks = <&gcc GCC_SDCC1_AHB_CLK>, <&gcc GCC_SDCC1_APPS_CLK>, +- <&gcc GCC_DCD_XO_CLK>; +- clock-names = "iface", "core", "xo"; ++ clocks = <&gcc GCC_SDCC1_AHB_CLK>, ++ <&gcc GCC_SDCC1_APPS_CLK>, ++ <&xo>; ++ clock-names = "iface", ++ "core", ++ "xo"; + status = "disabled"; + }; + +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-s5pv210-add-dummy-5v-regulator-for-backlight.patch b/queue-6.1/arm-dts-s5pv210-add-dummy-5v-regulator-for-backlight.patch new file mode 100644 index 00000000000..593747a718b --- /dev/null +++ b/queue-6.1/arm-dts-s5pv210-add-dummy-5v-regulator-for-backlight.patch @@ -0,0 +1,44 @@ +From 7f980321bf2cda6a2d491afbe88cdd1d8acf5b9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 11:57:21 +0200 +Subject: ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210 + +From: Krzysztof Kozlowski + +[ Upstream commit b77904ba177a9c67b6dbc3637fdf1faa22df6e5c ] + +Backlight is supplied by DC5V regulator. The DTS has no PMIC node, so +just add a regulator-fixed to solve it and fix dtbs_check warning: + + s5pv210-smdkv210.dtb: backlight: 'power-supply' is a required property + +Link: https://lore.kernel.org/r/20230421095721.31857-4-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s5pv210-smdkv210.dts | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts +index fbae768d65e27..6e26c67e0a26e 100644 +--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts ++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts +@@ -55,6 +55,14 @@ backlight { + default-brightness-level = <6>; + pinctrl-names = "default"; + pinctrl-0 = <&pwm3_out>; ++ power-supply = <&dc5v_reg>; ++ }; ++ ++ dc5v_reg: regulator-0 { ++ compatible = "regulator-fixed"; ++ regulator-name = "DC5V"; ++ regulator-min-microvolt = <5000000>; ++ regulator-max-microvolt = <5000000>; + }; + }; + +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-samsung-s3c6410-mini6410-correct-ethernet-re.patch b/queue-6.1/arm-dts-samsung-s3c6410-mini6410-correct-ethernet-re.patch new file mode 100644 index 00000000000..b6643daf933 --- /dev/null +++ b/queue-6.1/arm-dts-samsung-s3c6410-mini6410-correct-ethernet-re.patch @@ -0,0 +1,37 @@ +From 857c1ce7ee5086296219b304705369fd5655ce48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 17:29:25 +0200 +Subject: ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses + (split) + +From: Krzysztof Kozlowski + +[ Upstream commit cf0cb2af6a18f28b84f9f1416bff50ca60d6e98a ] + +The davicom,dm9000 Ethernet Controller accepts two reg addresses. + +Fixes: a43736deb47d ("ARM: dts: Add dts file for S3C6410-based Mini6410 board") +Reviewed-by: Alim Akhtar +Link: https://lore.kernel.org/r/20230713152926.82884-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s3c6410-mini6410.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts +index 17097da36f5ed..0b07b3c319604 100644 +--- a/arch/arm/boot/dts/s3c6410-mini6410.dts ++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts +@@ -51,7 +51,7 @@ srom-cs1-bus@18000000 { + + ethernet@18000000 { + compatible = "davicom,dm9000"; +- reg = <0x18000000 0x2 0x18000004 0x2>; ++ reg = <0x18000000 0x2>, <0x18000004 0x2>; + interrupt-parent = <&gpn>; + interrupts = <7 IRQ_TYPE_LEVEL_HIGH>; + davicom,no-eeprom; +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-samsung-s5pv210-smdkv210-correct-ethernet-re.patch b/queue-6.1/arm-dts-samsung-s5pv210-smdkv210-correct-ethernet-re.patch new file mode 100644 index 00000000000..68ecb812e10 --- /dev/null +++ b/queue-6.1/arm-dts-samsung-s5pv210-smdkv210-correct-ethernet-re.patch @@ -0,0 +1,37 @@ +From 0e2e6ae18ac6b02ee50f3d198fb7db46b4d8b6af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 17:29:26 +0200 +Subject: ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses + (split) + +From: Krzysztof Kozlowski + +[ Upstream commit 982655cb0e7f18934d7532c32366e574ad61dbd7 ] + +The davicom,dm9000 Ethernet Controller accepts two reg addresses. + +Fixes: b672b27d232e ("ARM: dts: Add Device tree for s5pc110/s5pv210 boards") +Reviewed-by: Alim Akhtar +Link: https://lore.kernel.org/r/20230713152926.82884-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s5pv210-smdkv210.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts +index 6e26c67e0a26e..901e7197b1368 100644 +--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts ++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts +@@ -41,7 +41,7 @@ pmic_ap_clk: clock-0 { + + ethernet@a8000000 { + compatible = "davicom,dm9000"; +- reg = <0xA8000000 0x2 0xA8000002 0x2>; ++ reg = <0xa8000000 0x2>, <0xa8000002 0x2>; + interrupt-parent = <&gph1>; + interrupts = <1 IRQ_TYPE_LEVEL_HIGH>; + local-mac-address = [00 00 de ad be ef]; +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-stm32-add-missing-detach-mailbox-for-dhcom-s.patch b/queue-6.1/arm-dts-stm32-add-missing-detach-mailbox-for-dhcom-s.patch new file mode 100644 index 00000000000..e430c78db28 --- /dev/null +++ b/queue-6.1/arm-dts-stm32-add-missing-detach-mailbox-for-dhcom-s.patch @@ -0,0 +1,47 @@ +From 4b5b2bb6e84115f5fd5f789d2544c0ff599cb80f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 15:09:07 +0200 +Subject: ARM: dts: stm32: Add missing detach mailbox for DHCOM SoM + +From: Marek Vasut + +[ Upstream commit deb7edbc27a6ec4d8f5edfd8519b7ed13cbd2a52 ] + +Add missing "detach" mailbox to this board to permit the CPU to inform +the remote processor on a detach. This signal allows the remote processor +firmware to stop IPC communication and to reinitialize the resources for +a re-attach. + +Without this mailbox, detach is not possible and kernel log contains the +following warning to, so make sure all the STM32MP15xx platform DTs are +in sync regarding the mailboxes to fix the detach issue and the warning: +" +stm32-rproc 10000000.m4: mbox_request_channel_byname() could not locate channel named "detach" +" + +Fixes: 6257dfc1c412 ("ARM: dts: stm32: Add coprocessor detach mbox on stm32mp15x-dkx boards") +Signed-off-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +index e61df23d361a7..74a11ccc5333f 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +@@ -416,8 +416,8 @@ &iwdg2 { + &m4_rproc { + memory-region = <&retram>, <&mcuram>, <&mcuram2>, <&vdev0vring0>, + <&vdev0vring1>, <&vdev0buffer>; +- mboxes = <&ipcc 0>, <&ipcc 1>, <&ipcc 2>; +- mbox-names = "vq0", "vq1", "shutdown"; ++ mboxes = <&ipcc 0>, <&ipcc 1>, <&ipcc 2>, <&ipcc 3>; ++ mbox-names = "vq0", "vq1", "shutdown", "detach"; + interrupt-parent = <&exti>; + interrupts = <68 1>; + status = "okay"; +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-stm32-add-missing-detach-mailbox-for-emtrion.patch b/queue-6.1/arm-dts-stm32-add-missing-detach-mailbox-for-emtrion.patch new file mode 100644 index 00000000000..cb48913e92a --- /dev/null +++ b/queue-6.1/arm-dts-stm32-add-missing-detach-mailbox-for-emtrion.patch @@ -0,0 +1,47 @@ +From 815514d1a68fa9832de85c78edc5b46281dfbc61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 03:12:42 +0200 +Subject: ARM: dts: stm32: Add missing detach mailbox for emtrion emSBC-Argon + +From: Marek Vasut + +[ Upstream commit 0ee0ef38aa9f75f21b51f729dd42b2e932515188 ] + +Add missing "detach" mailbox to this board to permit the CPU to inform +the remote processor on a detach. This signal allows the remote processor +firmware to stop IPC communication and to reinitialize the resources for +a re-attach. + +Without this mailbox, detach is not possible and kernel log contains the +following warning to, so make sure all the STM32MP15xx platform DTs are +in sync regarding the mailboxes to fix the detach issue and the warning: +" +stm32-rproc 10000000.m4: mbox_request_channel_byname() could not locate channel named "detach" +" + +Fixes: 6257dfc1c412 ("ARM: dts: stm32: Add coprocessor detach mbox on stm32mp15x-dkx boards") +Signed-off-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi b/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi +index 94e38141af672..fd89542c69c93 100644 +--- a/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi ++++ b/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi +@@ -368,8 +368,8 @@ &iwdg2 { + &m4_rproc { + memory-region = <&retram>, <&mcuram>, <&mcuram2>, <&vdev0vring0>, + <&vdev0vring1>, <&vdev0buffer>; +- mboxes = <&ipcc 0>, <&ipcc 1>, <&ipcc 2>; +- mbox-names = "vq0", "vq1", "shutdown"; ++ mboxes = <&ipcc 0>, <&ipcc 1>, <&ipcc 2>, <&ipcc 3>; ++ mbox-names = "vq0", "vq1", "shutdown", "detach"; + interrupt-parent = <&exti>; + interrupts = <68 1>; + interrupt-names = "wdg"; +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-stm32-add-missing-detach-mailbox-for-odyssey.patch b/queue-6.1/arm-dts-stm32-add-missing-detach-mailbox-for-odyssey.patch new file mode 100644 index 00000000000..126a9b8eeb2 --- /dev/null +++ b/queue-6.1/arm-dts-stm32-add-missing-detach-mailbox-for-odyssey.patch @@ -0,0 +1,47 @@ +From a31d1a968270a2571e8dd7d44a5166838d2ad82d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 03:12:43 +0200 +Subject: ARM: dts: stm32: Add missing detach mailbox for Odyssey SoM + +From: Marek Vasut + +[ Upstream commit 966f04a89d77548e673de2c400abe0b2cf5c15db ] + +Add missing "detach" mailbox to this board to permit the CPU to inform +the remote processor on a detach. This signal allows the remote processor +firmware to stop IPC communication and to reinitialize the resources for +a re-attach. + +Without this mailbox, detach is not possible and kernel log contains the +following warning to, so make sure all the STM32MP15xx platform DTs are +in sync regarding the mailboxes to fix the detach issue and the warning: +" +stm32-rproc 10000000.m4: mbox_request_channel_byname() could not locate channel named "detach" +" + +Fixes: 6257dfc1c412 ("ARM: dts: stm32: Add coprocessor detach mbox on stm32mp15x-dkx boards") +Signed-off-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp157c-odyssey-som.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp157c-odyssey-som.dtsi b/arch/arm/boot/dts/stm32mp157c-odyssey-som.dtsi +index e22871dc580c8..cf74852514906 100644 +--- a/arch/arm/boot/dts/stm32mp157c-odyssey-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp157c-odyssey-som.dtsi +@@ -230,8 +230,8 @@ &iwdg2 { + &m4_rproc { + memory-region = <&retram>, <&mcuram>, <&mcuram2>, <&vdev0vring0>, + <&vdev0vring1>, <&vdev0buffer>; +- mboxes = <&ipcc 0>, <&ipcc 1>, <&ipcc 2>; +- mbox-names = "vq0", "vq1", "shutdown"; ++ mboxes = <&ipcc 0>, <&ipcc 1>, <&ipcc 2>, <&ipcc 3>; ++ mbox-names = "vq0", "vq1", "shutdown", "detach"; + interrupt-parent = <&exti>; + interrupts = <68 1>; + status = "okay"; +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-stm32-adopt-generic-iio-bindings-for-adc-cha.patch b/queue-6.1/arm-dts-stm32-adopt-generic-iio-bindings-for-adc-cha.patch new file mode 100644 index 00000000000..59995325dc1 --- /dev/null +++ b/queue-6.1/arm-dts-stm32-adopt-generic-iio-bindings-for-adc-cha.patch @@ -0,0 +1,48 @@ +From bf4147be382b7ac5b7609d54b236265fefd4c6bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 14:45:34 +0200 +Subject: ARM: dts: stm32: adopt generic iio bindings for adc channels on + emstamp-argon + +From: Olivier Moysan + +[ Upstream commit c46e9b6cc98245f7264a8d15394d1f95d433abec ] + +Use STM32 ADC generic bindings instead of legacy bindings on +emtrion GmbH Argon boards. + +The STM32 ADC specific binding to declare channels has been deprecated, +hence adopt the generic IIO channels bindings, instead. +The STM32MP151 device tree now exposes internal channels using the +generic binding. This makes the change mandatory here to avoid a mixed +use of legacy and generic binding, which is not supported by the driver. + +Signed-off-by: Olivier Moysan +Signed-off-by: Alexandre Torgue +Stable-dep-of: 0ee0ef38aa9f ("ARM: dts: stm32: Add missing detach mailbox for emtrion emSBC-Argon") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi b/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi +index b01470a9a3d53..94e38141af672 100644 +--- a/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi ++++ b/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi +@@ -97,9 +97,11 @@ &adc { + adc1: adc@0 { + pinctrl-names = "default"; + pinctrl-0 = <&adc1_in6_pins_a>; +- st,min-sample-time-nsecs = <5000>; +- st,adc-channels = <6>; + status = "disabled"; ++ channel@6 { ++ reg = <6>; ++ st,min-sample-time-ns = <5000>; ++ }; + }; + + adc2: adc@100 { +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-stm32-rename-mdio0-to-mdio.patch b/queue-6.1/arm-dts-stm32-rename-mdio0-to-mdio.patch new file mode 100644 index 00000000000..9391996fdee --- /dev/null +++ b/queue-6.1/arm-dts-stm32-rename-mdio0-to-mdio.patch @@ -0,0 +1,133 @@ +From 5daa96db6be10240eaf9f65a0129cca6614a23bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Sep 2022 00:44:37 +0200 +Subject: ARM: dts: stm32: Rename mdio0 to mdio + +From: Marek Vasut + +[ Upstream commit a306d8962a24f4e8385853793fd58f9792c7aa61 ] + +Replace "mdio0" node with "mdio" to match mdio.yaml DT schema. + +Signed-off-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Stable-dep-of: 0ee0ef38aa9f ("ARM: dts: stm32: Add missing detach mailbox for emtrion emSBC-Argon") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi | 2 +- + arch/arm/boot/dts/stm32mp157c-ev1.dts | 2 +- + arch/arm/boot/dts/stm32mp157c-lxa-mc1.dts | 2 +- + arch/arm/boot/dts/stm32mp157c-odyssey.dts | 2 +- + arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 2 +- + arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 2 +- + arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi | 2 +- + arch/arm/boot/dts/stm32mp15xx-dkx.dtsi | 2 +- + 8 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi b/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi +index d540550f7da26..7d11c50b9e408 100644 +--- a/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi ++++ b/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi +@@ -173,7 +173,7 @@ ðernet0 { + phy-handle = <&phy0>; + st,eth-ref-clk-sel; + +- mdio0 { ++ mdio { + #address-cells = <1>; + #size-cells = <0>; + compatible = "snps,dwmac-mdio"; +diff --git a/arch/arm/boot/dts/stm32mp157c-ev1.dts b/arch/arm/boot/dts/stm32mp157c-ev1.dts +index 050c3c27a4203..b72d5e8aa4669 100644 +--- a/arch/arm/boot/dts/stm32mp157c-ev1.dts ++++ b/arch/arm/boot/dts/stm32mp157c-ev1.dts +@@ -144,7 +144,7 @@ ðernet0 { + max-speed = <1000>; + phy-handle = <&phy0>; + +- mdio0 { ++ mdio { + #address-cells = <1>; + #size-cells = <0>; + compatible = "snps,dwmac-mdio"; +diff --git a/arch/arm/boot/dts/stm32mp157c-lxa-mc1.dts b/arch/arm/boot/dts/stm32mp157c-lxa-mc1.dts +index e8d2ec41d5374..cb00ce7cec8b1 100644 +--- a/arch/arm/boot/dts/stm32mp157c-lxa-mc1.dts ++++ b/arch/arm/boot/dts/stm32mp157c-lxa-mc1.dts +@@ -112,7 +112,7 @@ ðernet0 { + phy-handle = <ðphy>; + status = "okay"; + +- mdio0 { ++ mdio { + compatible = "snps,dwmac-mdio"; + #address-cells = <1>; + #size-cells = <0>; +diff --git a/arch/arm/boot/dts/stm32mp157c-odyssey.dts b/arch/arm/boot/dts/stm32mp157c-odyssey.dts +index ed66d25b8bf3d..a8b3f7a547036 100644 +--- a/arch/arm/boot/dts/stm32mp157c-odyssey.dts ++++ b/arch/arm/boot/dts/stm32mp157c-odyssey.dts +@@ -41,7 +41,7 @@ ðernet0 { + assigned-clock-rates = <125000000>; /* Clock PLL4 to 750Mhz in ATF/U-Boot */ + st,eth-clk-sel; + +- mdio0 { ++ mdio { + #address-cells = <1>; + #size-cells = <0>; + compatible = "snps,dwmac-mdio"; +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +index d3b85a8764d74..c06edd2eacb0c 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +@@ -125,7 +125,7 @@ ðernet0 { + max-speed = <100>; + phy-handle = <&phy0>; + +- mdio0 { ++ mdio { + #address-cells = <1>; + #size-cells = <0>; + compatible = "snps,dwmac-mdio"; +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +index f068e4fcc404f..dae602b7a54df 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +@@ -151,7 +151,7 @@ ðernet0 { + max-speed = <1000>; + phy-handle = <&phy0>; + +- mdio0 { ++ mdio { + #address-cells = <1>; + #size-cells = <0>; + compatible = "snps,dwmac-mdio"; +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi +index bb4ac6c13cbd3..39af79dc654cc 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-drc-compact.dtsi +@@ -78,7 +78,7 @@ ðernet0 { + max-speed = <1000>; + phy-handle = <&phy0>; + +- mdio0 { ++ mdio { + #address-cells = <1>; + #size-cells = <0>; + compatible = "snps,dwmac-mdio"; +diff --git a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi +index fdc48536e97d1..73a6a7b278b90 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi +@@ -141,7 +141,7 @@ ðernet0 { + max-speed = <1000>; + phy-handle = <&phy0>; + +- mdio0 { ++ mdio { + #address-cells = <1>; + #size-cells = <0>; + compatible = "snps,dwmac-mdio"; +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-stm32-update-to-generic-adc-channel-binding-.patch b/queue-6.1/arm-dts-stm32-update-to-generic-adc-channel-binding-.patch new file mode 100644 index 00000000000..c3fd80392d6 --- /dev/null +++ b/queue-6.1/arm-dts-stm32-update-to-generic-adc-channel-binding-.patch @@ -0,0 +1,111 @@ +From 7c90ae9567b36f96de5fd2e1abc6a1a43576b470 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 14:45:37 +0200 +Subject: ARM: dts: stm32: Update to generic ADC channel binding on DHSOM + systems + +From: Marek Vasut + +[ Upstream commit 9bcfc3cdc903485a52c6f471f4ae96a41fa51803 ] + +The generic ADC channel binding is recommended over legacy one, update the +DT to the modern binding. No functional change. For further details, see +commit which adds the generic binding to STM32 ADC binding document: +'664b9879f56e ("dt-bindings: iio: stm32-adc: add generic channel binding")' + +Signed-off-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Stable-dep-of: deb7edbc27a6 ("ARM: dts: stm32: Add missing detach mailbox for DHCOM SoM") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 18 +++++---- + .../boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 38 +++++++++++++++---- + 2 files changed, 40 insertions(+), 16 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +index c06edd2eacb0c..e61df23d361a7 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +@@ -80,17 +80,19 @@ &adc { + vdda-supply = <&vdda>; + vref-supply = <&vdda>; + status = "okay"; ++}; + +- adc1: adc@0 { +- st,min-sample-time-nsecs = <5000>; +- st,adc-channels = <0>; +- status = "okay"; ++&adc1 { ++ channel@0 { ++ reg = <0>; ++ st,min-sample-time-ns = <5000>; + }; ++}; + +- adc2: adc@100 { +- st,adc-channels = <1>; +- st,min-sample-time-nsecs = <5000>; +- status = "okay"; ++&adc2 { ++ channel@1 { ++ reg = <1>; ++ st,min-sample-time-ns = <5000>; + }; + }; + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +index dae602b7a54df..b7ba43865514d 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +@@ -112,17 +112,39 @@ &adc { + vdda-supply = <&vdda>; + vref-supply = <&vdda>; + status = "okay"; ++}; + +- adc1: adc@0 { +- st,adc-channels = <0 1 6>; +- st,min-sample-time-nsecs = <5000>; +- status = "okay"; ++&adc1 { ++ channel@0 { ++ reg = <0>; ++ st,min-sample-time-ns = <5000>; + }; + +- adc2: adc@100 { +- st,adc-channels = <0 1 2>; +- st,min-sample-time-nsecs = <5000>; +- status = "okay"; ++ channel@1 { ++ reg = <1>; ++ st,min-sample-time-ns = <5000>; ++ }; ++ ++ channel@6 { ++ reg = <6>; ++ st,min-sample-time-ns = <5000>; ++ }; ++}; ++ ++&adc2 { ++ channel@0 { ++ reg = <0>; ++ st,min-sample-time-ns = <5000>; ++ }; ++ ++ channel@1 { ++ reg = <1>; ++ st,min-sample-time-ns = <5000>; ++ }; ++ ++ channel@2 { ++ reg = <2>; ++ st,min-sample-time-ns = <5000>; + }; + }; + +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-stm32-yaml-validation-fails-for-argon-boards.patch b/queue-6.1/arm-dts-stm32-yaml-validation-fails-for-argon-boards.patch new file mode 100644 index 00000000000..be6ed9e49d3 --- /dev/null +++ b/queue-6.1/arm-dts-stm32-yaml-validation-fails-for-argon-boards.patch @@ -0,0 +1,52 @@ +From 75b52a979b8c19b18843f0a1c81a8941cd4a7407 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 10:01:06 +0200 +Subject: ARM: dts: stm32: YAML validation fails for Argon Boards + +From: Pierre-Yves MORDRET + +[ Upstream commit fc8d2b21bc5d5d7a6eadaa8c2a5d2e6856689480 ] + +"make dtbs_check" gives following output : +stm32mp157c-emstamp-argon.dtb: gpu@59000000: 'contiguous-area' does not match +any of the regexes: 'pinctrl-[0-9]+' +From schema: Documentation/devicetree/bindings/gpu/vivante,gc.yaml + +Signed-off-by: Pierre-Yves MORDRET +Signed-off-by: Alexandre Torgue +Stable-dep-of: 0ee0ef38aa9f ("ARM: dts: stm32: Add missing detach mailbox for emtrion emSBC-Argon") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi b/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi +index 7d11c50b9e408..b01470a9a3d53 100644 +--- a/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi ++++ b/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi +@@ -68,11 +68,6 @@ retram: retram@38000000 { + reg = <0x38000000 0x10000>; + no-map; + }; +- +- gpu_reserved: gpu@dc000000 { +- reg = <0xdc000000 0x4000000>; +- no-map; +- }; + }; + + led: gpio_leds { +@@ -183,10 +178,6 @@ phy0: ethernet-phy@0 { + }; + }; + +-&gpu { +- contiguous-area = <&gpu_reserved>; +-}; +- + &hash1 { + status = "okay"; + }; +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-stm32-yaml-validation-fails-for-odyssey-boar.patch b/queue-6.1/arm-dts-stm32-yaml-validation-fails-for-odyssey-boar.patch new file mode 100644 index 00000000000..0cf604fc523 --- /dev/null +++ b/queue-6.1/arm-dts-stm32-yaml-validation-fails-for-odyssey-boar.patch @@ -0,0 +1,53 @@ +From ba36e0e68ebbeed667ca2b4a6fec2559c234c774 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 09:58:31 +0200 +Subject: ARM: dts: stm32: YAML validation fails for Odyssey Boards + +From: Pierre-Yves MORDRET + +[ Upstream commit 84a34e1862aae43e4dcdfb743a7dd3ade1fe4a3c ] + +"make dtbs_check" gives following output : +stm32mp157c-odyssey.dt.yaml: gpu@59000000: 'contiguous-area' does not match +any of the regexes: 'pinctrl-[0-9]+' +From schema: Documentation/devicetree/bindings/gpu/vivante,gc.yaml + +Signed-off-by: Pierre-Yves MORDRET +Signed-off-by: Alexandre Torgue +Stable-dep-of: 966f04a89d77 ("ARM: dts: stm32: Add missing detach mailbox for Odyssey SoM") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp157c-odyssey-som.dtsi | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp157c-odyssey-som.dtsi b/arch/arm/boot/dts/stm32mp157c-odyssey-som.dtsi +index 2d9461006810c..e22871dc580c8 100644 +--- a/arch/arm/boot/dts/stm32mp157c-odyssey-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp157c-odyssey-som.dtsi +@@ -62,11 +62,6 @@ retram: retram@38000000 { + reg = <0x38000000 0x10000>; + no-map; + }; +- +- gpu_reserved: gpu@d4000000 { +- reg = <0xd4000000 0x4000000>; +- no-map; +- }; + }; + + led { +@@ -80,11 +75,6 @@ led-blue { + }; + }; + +-&gpu { +- contiguous-area = <&gpu_reserved>; +- status = "okay"; +-}; +- + &i2c2 { + pinctrl-names = "default"; + pinctrl-0 = <&i2c2_pins_a>; +-- +2.40.1 + diff --git a/queue-6.1/arm-ptrace-restore-syscall-restart-tracing.patch b/queue-6.1/arm-ptrace-restore-syscall-restart-tracing.patch new file mode 100644 index 00000000000..4dd08949b47 --- /dev/null +++ b/queue-6.1/arm-ptrace-restore-syscall-restart-tracing.patch @@ -0,0 +1,45 @@ +From b34dae8f7f042a065e74776e7aaec579e162c126 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 12:54:18 -0700 +Subject: ARM: ptrace: Restore syscall restart tracing + +From: Kees Cook + +[ Upstream commit cf007647475b5090819c5fe8da771073145c7334 ] + +Since commit 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store +thread_info->abi_syscall"), the seccomp selftests "syscall_restart" has +been broken. This was caused by the restart syscall not being stored to +"abi_syscall" during restart setup before branching to the "local_restart" +label. Tracers would see the wrong syscall, and scno would get overwritten +while returning from the TIF_WORK path. Add the missing store. + +Cc: Russell King +Cc: Arnd Bergmann +Cc: Lecopzer Chen +Cc: Oleg Nesterov +Cc: linux-arm-kernel@lists.infradead.org +Fixes: 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall") +Reviewed-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20230810195422.2304827-1-keescook@chromium.org +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/entry-common.S | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S +index 405a607b754f4..b413b541c3c71 100644 +--- a/arch/arm/kernel/entry-common.S ++++ b/arch/arm/kernel/entry-common.S +@@ -103,6 +103,7 @@ slow_work_pending: + cmp r0, #0 + beq no_work_pending + movlt scno, #(__NR_restart_syscall - __NR_SYSCALL_BASE) ++ str scno, [tsk, #TI_ABI_SYSCALL] @ make sure tracers see update + ldmia sp, {r0 - r6} @ have to reload r0 - r6 + b local_restart @ ... and off we go + ENDPROC(ret_fast_syscall) +-- +2.40.1 + diff --git a/queue-6.1/arm-ptrace-restore-syscall-skipping-for-tracers.patch b/queue-6.1/arm-ptrace-restore-syscall-skipping-for-tracers.patch new file mode 100644 index 00000000000..4490fe6938f --- /dev/null +++ b/queue-6.1/arm-ptrace-restore-syscall-skipping-for-tracers.patch @@ -0,0 +1,68 @@ +From 6f8f94ff4b7c8a45bd27c902e2470b74ff5a5f3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 12:54:19 -0700 +Subject: ARM: ptrace: Restore syscall skipping for tracers + +From: Kees Cook + +[ Upstream commit 4697b5848bd933f68ebd04836362c8de0cacaf71 ] + +Since commit 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store +thread_info->abi_syscall"), the seccomp selftests "syscall_errno" +and "syscall_faked" have been broken. Both seccomp and PTRACE depend +on using the special value of "-1" for skipping syscalls. This value +wasn't working because it was getting masked by __NR_SYSCALL_MASK in +both PTRACE_SET_SYSCALL and get_syscall_nr(). + +Explicitly test for -1 in PTRACE_SET_SYSCALL and get_syscall_nr(), +leaving it exposed when present, allowing tracers to skip syscalls +again. + +Cc: Russell King +Cc: Arnd Bergmann +Cc: Lecopzer Chen +Cc: Oleg Nesterov +Cc: linux-arm-kernel@lists.infradead.org +Fixes: 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall") +Reviewed-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20230810195422.2304827-2-keescook@chromium.org +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/syscall.h | 3 +++ + arch/arm/kernel/ptrace.c | 5 +++-- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/include/asm/syscall.h b/arch/arm/include/asm/syscall.h +index dfeed440254a8..fe4326d938c18 100644 +--- a/arch/arm/include/asm/syscall.h ++++ b/arch/arm/include/asm/syscall.h +@@ -25,6 +25,9 @@ static inline int syscall_get_nr(struct task_struct *task, + if (IS_ENABLED(CONFIG_AEABI) && !IS_ENABLED(CONFIG_OABI_COMPAT)) + return task_thread_info(task)->abi_syscall; + ++ if (task_thread_info(task)->abi_syscall == -1) ++ return -1; ++ + return task_thread_info(task)->abi_syscall & __NR_SYSCALL_MASK; + } + +diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c +index bfe88c6e60d58..cef106913ab7b 100644 +--- a/arch/arm/kernel/ptrace.c ++++ b/arch/arm/kernel/ptrace.c +@@ -785,8 +785,9 @@ long arch_ptrace(struct task_struct *child, long request, + break; + + case PTRACE_SET_SYSCALL: +- task_thread_info(child)->abi_syscall = data & +- __NR_SYSCALL_MASK; ++ if (data != -1) ++ data &= __NR_SYSCALL_MASK; ++ task_thread_info(child)->abi_syscall = data; + ret = 0; + break; + +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-apq8016-sbc-fix-ov5640-regulator-supp.patch b/queue-6.1/arm64-dts-qcom-apq8016-sbc-fix-ov5640-regulator-supp.patch new file mode 100644 index 00000000000..946a83de59b --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-apq8016-sbc-fix-ov5640-regulator-supp.patch @@ -0,0 +1,49 @@ +From 4c25a200c50fa1cd5a68bd41f80f077df7a08f06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Aug 2023 00:47:33 +0100 +Subject: arm64: dts: qcom: apq8016-sbc: Fix ov5640 regulator supply names + +From: Bryan O'Donoghue + +[ Upstream commit 43a684580819e7f35b6cb38236be63c4cba26ef4 ] + +The ov5640 driver expects DOVDD, AVDD and DVDD as regulator supply names. + +The ov5640 has depended on these names since the driver was committed +upstream in 2017. Similarly apq8016-sbc.dtsi has had completely different +regulator names since its own initial commit in 2020. + +Perhaps the regulators were left on in previous 410c bootloaders. In any +case today on 6.5 we won't switch on the ov5640 without correctly naming +the regulators. + +Fixes: 39e0ce6cd1bf ("arm64: dts: qcom: apq8016-sbc: Add CCI/Sensor nodes") +Signed-off-by: Bryan O'Donoghue +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230811234738.2859417-3-bryan.odonoghue@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dts | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +index e3e90ad92cc59..9650ae70c8723 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +@@ -289,9 +289,9 @@ camera_rear@3b { + clock-names = "xclk"; + clock-frequency = <23880000>; + +- vdddo-supply = <&camera_vdddo_1v8>; +- vdda-supply = <&camera_vdda_2v8>; +- vddd-supply = <&camera_vddd_1v5>; ++ DOVDD-supply = <&camera_vdddo_1v8>; ++ AVDD-supply = <&camera_vdda_2v8>; ++ DVDD-supply = <&camera_vddd_1v5>; + + /* No camera mezzanine by default */ + status = "disabled"; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-msm8916-l8150-correct-light-sensor-vd.patch b/queue-6.1/arm64-dts-qcom-msm8916-l8150-correct-light-sensor-vd.patch new file mode 100644 index 00000000000..fa285435574 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8916-l8150-correct-light-sensor-vd.patch @@ -0,0 +1,39 @@ +From 13bd962c1c0fc203f43089e65a253306572a4777 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 19:15:28 +0200 +Subject: arm64: dts: qcom: msm8916-l8150: correct light sensor VDDIO supply + +From: Krzysztof Kozlowski + +[ Upstream commit 6a541eaa6e8e5283efb993ae7a947bede8d01fa5 ] + +liteon,ltr559 light sensor takes VDDIO, not VIO, supply: + + msm8916-longcheer-l8150.dtb: light-sensor@23: 'vio-supply' does not match any of the regexes: 'pinctrl-[0-9]+' + +Fixes: 3016af34ef8d ("arm64: dts: qcom: msm8916-longcheer-l8150: Add light and proximity sensor") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Nikita Travkin +Link: https://lore.kernel.org/r/20230617171541.286957-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8916-longcheer-l8150.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8916-longcheer-l8150.dts b/arch/arm64/boot/dts/qcom/msm8916-longcheer-l8150.dts +index d85e7f7c0835a..75f7b4f35fe82 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916-longcheer-l8150.dts ++++ b/arch/arm64/boot/dts/qcom/msm8916-longcheer-l8150.dts +@@ -163,7 +163,7 @@ light-sensor@23 { + pinctrl-0 = <&light_int_default>; + + vdd-supply = <&pm8916_l17>; +- vio-supply = <&pm8916_l6>; ++ vddio-supply = <&pm8916_l6>; + }; + + gyroscope@68 { +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-msm8996-add-missing-interrupt-to-the-.patch b/queue-6.1/arm64-dts-qcom-msm8996-add-missing-interrupt-to-the-.patch new file mode 100644 index 00000000000..9489602b4e1 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8996-add-missing-interrupt-to-the-.patch @@ -0,0 +1,38 @@ +From 1ba122bbe4b04dfd0dd6d723feee1e65e2931f5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 18:24:27 +0200 +Subject: arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 + controller + +From: Konrad Dybcio + +[ Upstream commit 36541089c4733355ed844c67eebd0c3936953454 ] + +The interrupt line was previously not described. Take care of that. + +Fixes: 1e39255ed29d ("arm64: dts: msm8996: Add device node for qcom,dwc3") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230627-topic-more_bindings-v1-11-6b4b6cd081e5@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 9d6ec59d1cd3a..7e381d8257ba1 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -3292,6 +3292,9 @@ usb2: usb@76f8800 { + #size-cells = <1>; + ranges; + ++ interrupts = ; ++ interrupt-names = "hs_phy_irq"; ++ + clocks = <&gcc GCC_PERIPH_NOC_USB20_AHB_CLK>, + <&gcc GCC_USB20_MASTER_CLK>, + <&gcc GCC_USB20_MOCK_UTMI_CLK>, +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-msm8996-fix-dsi1-interrupts.patch b/queue-6.1/arm64-dts-qcom-msm8996-fix-dsi1-interrupts.patch new file mode 100644 index 00000000000..3783869adb3 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8996-fix-dsi1-interrupts.patch @@ -0,0 +1,39 @@ +From a9318a561a5195e7d6a0b12369f161e04cf44d71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Aug 2023 15:09:37 +0200 +Subject: arm64: dts: qcom: msm8996: Fix dsi1 interrupts + +From: David Wronek + +[ Upstream commit bd3b4ac11845b428996cfd2c7b8302ba6a07340d ] + +Fix IRQ flags mismatch which was keeping dsi1 from probing by changing +interrupts = <4> to interrupts = <5>. + +Fixes: 2752bb7d9b58 ("arm64: dts: qcom: msm8996: add second DSI interface") +Signed-off-by: David Wronek +Acked-by: Yassine Oudjana +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230805130936.359860-2-davidwronek@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 7e381d8257ba1..9de2248a385a5 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -1063,7 +1063,7 @@ dsi1: dsi@996000 { + reg-names = "dsi_ctrl"; + + interrupt-parent = <&mdss>; +- interrupts = <4>; ++ interrupts = <5>; + + clocks = <&mmcc MDSS_MDP_CLK>, + <&mmcc MDSS_BYTE1_CLK>, +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-msm8996-gemini-fix-touchscreen-vio-su.patch b/queue-6.1/arm64-dts-qcom-msm8996-gemini-fix-touchscreen-vio-su.patch new file mode 100644 index 00000000000..97c6dfb3962 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8996-gemini-fix-touchscreen-vio-su.patch @@ -0,0 +1,36 @@ +From c1a5421a18e7c42800b457e7362940dcc5688d49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 13:53:31 +0200 +Subject: arm64: dts: qcom: msm8996-gemini: fix touchscreen VIO supply + +From: Krzysztof Kozlowski + +[ Upstream commit 21fc24ee9c5943732c9ae538766c9be93d70d936 ] + +According to bindings and Linux driver, there is no VDDA but VIO supply. + +Fixes: 4ac46b3682c5 ("arm64: dts: qcom: msm8996: xiaomi-gemini: Add support for Xiaomi Mi 5") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230720115335.137354-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts +index 4e5264f4116a0..3bbafb68ba5c5 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts ++++ b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts +@@ -81,7 +81,7 @@ synaptics@20 { + #size-cells = <0>; + interrupt-parent = <&tlmm>; + interrupts = <125 IRQ_TYPE_LEVEL_LOW>; +- vdda-supply = <&vreg_l6a_1p8>; ++ vio-supply = <&vreg_l6a_1p8>; + vdd-supply = <&vdd_3v2_tp>; + reset-gpios = <&tlmm 89 GPIO_ACTIVE_LOW>; + +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-msm8998-add-missing-power-domain-to-m.patch b/queue-6.1/arm64-dts-qcom-msm8998-add-missing-power-domain-to-m.patch new file mode 100644 index 00000000000..a1e44ab49f9 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8998-add-missing-power-domain-to-m.patch @@ -0,0 +1,38 @@ +From 899199744cec725d0e0733de35ea3c45767d99e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 21:20:25 +0200 +Subject: arm64: dts: qcom: msm8998: Add missing power domain to MMSS SMMU + +From: Konrad Dybcio + +[ Upstream commit 7f828f3207142351750e9545527341425187de7b ] + +The MMSS SMMU has its own power domain. Attach it so that we can drop +the "keep it always-on" hack. + +Fixes: 05ce21b54423 ("arm64: dts: qcom: msm8998: Configure the multimedia subsystem iommu") +Reviewed-by: Jeffrey Hugo +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230531-topic-8998_mmssclk-v3-2-ba1b1fd9ee75@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi +index 3d6c7940d2a04..b00b8164c4aa2 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -2445,6 +2445,8 @@ mmss_smmu: iommu@cd00000 { + , + , + ; ++ ++ power-domains = <&mmcc BIMC_SMMU_GDSC>; + }; + + remoteproc_adsp: remoteproc@17300000 { +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-msm8998-drop-bus-clock-reference-from.patch b/queue-6.1/arm64-dts-qcom-msm8998-drop-bus-clock-reference-from.patch new file mode 100644 index 00000000000..1f5463b2933 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8998-drop-bus-clock-reference-from.patch @@ -0,0 +1,43 @@ +From fd19d5a038be45b5e66b898427d2585b0b5b7daa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 21:20:24 +0200 +Subject: arm64: dts: qcom: msm8998: Drop bus clock reference from MMSS SMMU + +From: Konrad Dybcio + +[ Upstream commit a3ce236364b82688ca4c7605f63c4efd68e9589c ] + +The MMSS SMMU has been abusingly consuming the exposed RPM interconnect +clock. Drop it. + +Fixes: 05ce21b54423 ("arm64: dts: qcom: msm8998: Configure the multimedia subsystem iommu") +Reviewed-by: Jeffrey Hugo +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230531-topic-8998_mmssclk-v3-1-ba1b1fd9ee75@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi +index 29c60bb56ed5f..3d6c7940d2a04 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -2418,10 +2418,10 @@ mmss_smmu: iommu@cd00000 { + + clocks = <&mmcc MNOC_AHB_CLK>, + <&mmcc BIMC_SMMU_AHB_CLK>, +- <&rpmcc RPM_SMD_MMAXI_CLK>, + <&mmcc BIMC_SMMU_AXI_CLK>; +- clock-names = "iface-mm", "iface-smmu", +- "bus-mm", "bus-smmu"; ++ clock-names = "iface-mm", ++ "iface-smmu", ++ "bus-smmu"; + + #global-interrupts = <0>; + interrupts = +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-pm6150l-add-missing-short-interrupt.patch b/queue-6.1/arm64-dts-qcom-pm6150l-add-missing-short-interrupt.patch new file mode 100644 index 00000000000..eb1d8da004d --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-pm6150l-add-missing-short-interrupt.patch @@ -0,0 +1,42 @@ +From 81974206c898c2a8c6a0e8f8dc039fcafa9a8cac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 22:00:25 +0200 +Subject: arm64: dts: qcom: pm6150l: Add missing short interrupt + +From: Konrad Dybcio + +[ Upstream commit 7e1f024ef0d1da456f61d00f01dc3287ede915b3 ] + +Add the missing short interrupt. This fixes the schema warning: + +wled@d800: interrupt-names: ['ovp'] is too short + +Fixes: fe508ced49dd ("arm64: dts: qcom: pm6150l: Add wled node") +Signed-off-by: Konrad Dybcio +Reviewed-by: Luca Weiss +Link: https://lore.kernel.org/r/20230626-topic-bindingsfixups-v1-3-254ae8642e69@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/pm6150l.dtsi | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/pm6150l.dtsi b/arch/arm64/boot/dts/qcom/pm6150l.dtsi +index f02c223ef4485..06d729ff65a9d 100644 +--- a/arch/arm64/boot/dts/qcom/pm6150l.dtsi ++++ b/arch/arm64/boot/dts/qcom/pm6150l.dtsi +@@ -75,8 +75,9 @@ pm6150l_lsid5: pmic@5 { + pm6150l_wled: leds@d800 { + compatible = "qcom,pm6150l-wled"; + reg = <0xd800>, <0xd900>; +- interrupts = <0x5 0xd8 0x1 IRQ_TYPE_EDGE_RISING>; +- interrupt-names = "ovp"; ++ interrupts = <0x5 0xd8 0x1 IRQ_TYPE_EDGE_RISING>, ++ <0x5 0xd8 0x2 IRQ_TYPE_EDGE_RISING>; ++ interrupt-names = "ovp", "short"; + label = "backlight"; + + status = "disabled"; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-pm660l-add-missing-short-interrupt.patch b/queue-6.1/arm64-dts-qcom-pm660l-add-missing-short-interrupt.patch new file mode 100644 index 00000000000..c19f48f7919 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-pm660l-add-missing-short-interrupt.patch @@ -0,0 +1,41 @@ +From 347e60f8164f91d1a3d6b008d52de24792d6f020 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 22:00:26 +0200 +Subject: arm64: dts: qcom: pm660l: Add missing short interrupt + +From: Konrad Dybcio + +[ Upstream commit 9a4ac09db3c7413e334b4abd6b2f6de8930dd781 ] + +Add the missing short interrupt. This fixes the schema warning: + +wled@d800: interrupt-names: ['ovp'] is too short + +Fixes: 7b56a804e58b ("arm64: dts: qcom: pm660l: Add WLED support") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230626-topic-bindingsfixups-v1-4-254ae8642e69@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/pm660l.dtsi | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/pm660l.dtsi b/arch/arm64/boot/dts/qcom/pm660l.dtsi +index 8aa0a5078772b..88606b996d690 100644 +--- a/arch/arm64/boot/dts/qcom/pm660l.dtsi ++++ b/arch/arm64/boot/dts/qcom/pm660l.dtsi +@@ -74,8 +74,9 @@ pm660l_lpg: pwm { + pm660l_wled: leds@d800 { + compatible = "qcom,pm660l-wled"; + reg = <0xd800>, <0xd900>; +- interrupts = <0x3 0xd8 0x1 IRQ_TYPE_EDGE_RISING>; +- interrupt-names = "ovp"; ++ interrupts = <0x3 0xd8 0x1 IRQ_TYPE_EDGE_RISING>, ++ <0x3 0xd8 0x2 IRQ_TYPE_EDGE_RISING>; ++ interrupt-names = "ovp", "short"; + label = "backlight"; + + status = "disabled"; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-pm8350-fix-thermal-zone-name.patch b/queue-6.1/arm64-dts-qcom-pm8350-fix-thermal-zone-name.patch new file mode 100644 index 00000000000..d80d3a9810a --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-pm8350-fix-thermal-zone-name.patch @@ -0,0 +1,39 @@ +From e804686078b1a82034cb3390ba8c4eef05620c80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 15:30:21 +0300 +Subject: arm64: dts: qcom: pm8350: fix thermal zone name + +From: Dmitry Baryshkov + +[ Upstream commit 64f19c06f704846db5e4885ca63c689d9bef5723 ] + +The name of the thermal zone in pm8350.dtsi (pm8350c-thermal) conflicts +with the thermal zone in pm8350c.dtsi. Rename the thermal zone according +to the chip name. + +Fixes: 7a79b95f4288 ("arm64: dts: qcom: pm8350: add temp sensor and thermal zone config") +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230707123027.1510723-3-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/pm8350.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/pm8350.dtsi b/arch/arm64/boot/dts/qcom/pm8350.dtsi +index 2dfeb99300d74..9ed9ba23e81e4 100644 +--- a/arch/arm64/boot/dts/qcom/pm8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/pm8350.dtsi +@@ -8,7 +8,7 @@ + + / { + thermal-zones { +- pm8350_thermal: pm8350c-thermal { ++ pm8350_thermal: pm8350-thermal { + polling-delay-passive = <100>; + polling-delay = <0>; + thermal-sensors = <&pm8350_temp_alarm>; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-pm8350b-fix-thermal-zone-name.patch b/queue-6.1/arm64-dts-qcom-pm8350b-fix-thermal-zone-name.patch new file mode 100644 index 00000000000..fa5d1667c5b --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-pm8350b-fix-thermal-zone-name.patch @@ -0,0 +1,39 @@ +From 99a6aa91f6da8521e34885104b61d286e34a8e9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 15:30:22 +0300 +Subject: arm64: dts: qcom: pm8350b: fix thermal zone name + +From: Dmitry Baryshkov + +[ Upstream commit aad41d9e6c44dfe299cddab97528a5333f17bdfe ] + +The name of the thermal zone in pm8350b.dtsi (pm8350c-thermal) conflicts +with the thermal zone in pm8350c.dtsi. Rename the thermal zone according +to the chip name. + +Fixes: 5c1399299d9d ("arm64: dts: qcom: pm8350b: add temp sensor and thermal zone config") +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230707123027.1510723-4-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/pm8350b.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/pm8350b.dtsi b/arch/arm64/boot/dts/qcom/pm8350b.dtsi +index f1c7bd9d079c2..05c1058988927 100644 +--- a/arch/arm64/boot/dts/qcom/pm8350b.dtsi ++++ b/arch/arm64/boot/dts/qcom/pm8350b.dtsi +@@ -8,7 +8,7 @@ + + / { + thermal-zones { +- pm8350b_thermal: pm8350c-thermal { ++ pm8350b_thermal: pm8350b-thermal { + polling-delay-passive = <100>; + polling-delay = <0>; + thermal-sensors = <&pm8350b_temp_alarm>; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-pmi8994-add-missing-ovp-interrupt.patch b/queue-6.1/arm64-dts-qcom-pmi8994-add-missing-ovp-interrupt.patch new file mode 100644 index 00000000000..3f154a2b249 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-pmi8994-add-missing-ovp-interrupt.patch @@ -0,0 +1,41 @@ +From 09d2eb65083962145d000a0be850508eecd37e44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 22:00:28 +0200 +Subject: arm64: dts: qcom: pmi8994: Add missing OVP interrupt + +From: Konrad Dybcio + +[ Upstream commit 8db94432690371b1736e9a2566a9b3d8a73d5a97 ] + +Add the missing OVP interrupt. This fixes the schema warning: + +wled@d800: interrupt-names: ['short'] is too short + +Fixes: 37aa540cbd30 ("arm64: dts: qcom: pmi8994: Add WLED node") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230626-topic-bindingsfixups-v1-6-254ae8642e69@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/pmi8994.dtsi | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/pmi8994.dtsi b/arch/arm64/boot/dts/qcom/pmi8994.dtsi +index 82b60e988d0f5..49902a3e161d9 100644 +--- a/arch/arm64/boot/dts/qcom/pmi8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/pmi8994.dtsi +@@ -54,8 +54,9 @@ pmi8994_spmi_regulators: regulators { + pmi8994_wled: wled@d800 { + compatible = "qcom,pmi8994-wled"; + reg = <0xd800>, <0xd900>; +- interrupts = <3 0xd8 0x02 IRQ_TYPE_EDGE_RISING>; +- interrupt-names = "short"; ++ interrupts = <0x3 0xd8 0x1 IRQ_TYPE_EDGE_RISING>, ++ <0x3 0xd8 0x2 IRQ_TYPE_EDGE_RISING>; ++ interrupt-names = "ovp", "short"; + qcom,cabc; + qcom,external-pfet; + status = "disabled"; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-pmk8350-fix-adc-tm-compatible-string.patch b/queue-6.1/arm64-dts-qcom-pmk8350-fix-adc-tm-compatible-string.patch new file mode 100644 index 00000000000..91dd89923cc --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-pmk8350-fix-adc-tm-compatible-string.patch @@ -0,0 +1,41 @@ +From da0959355bbfeafeb401c3d91a0f11b9aec1dfb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 15:30:24 +0300 +Subject: arm64: dts: qcom: pmk8350: fix ADC-TM compatible string + +From: Dmitry Baryshkov + +[ Upstream commit 435a73d7377ceb29c1a22d2711dd85c831b40c45 ] + +The commit b2de43136058 ("arm64: dts: qcom: pmk8350: Add peripherals for +pmk8350") for the ADC TM (thermal monitoring device) have used the +compatible string from the vendor kernel ("qcom,adc-tm7"). Use the +proper compatible string that is defined in the upstream kernel +("qcom,spmi-adc-tm5-gen2"). + +Fixes: b2de43136058 ("arm64: dts: qcom: pmk8350: Add peripherals for pmk8350") +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230707123027.1510723-6-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/pmk8350.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/pmk8350.dtsi b/arch/arm64/boot/dts/qcom/pmk8350.dtsi +index f0d256d99e62e..29cfb6fca9bf7 100644 +--- a/arch/arm64/boot/dts/qcom/pmk8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/pmk8350.dtsi +@@ -44,7 +44,7 @@ pmk8350_vadc: adc@3100 { + }; + + pmk8350_adc_tm: adc-tm@3400 { +- compatible = "qcom,adc-tm7"; ++ compatible = "qcom,spmi-adc-tm5-gen2"; + reg = <0x3400>; + interrupts = <0x0 0x34 0x0 IRQ_TYPE_EDGE_RISING>; + #address-cells = <1>; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-pmr735b-fix-thermal-zone-name.patch b/queue-6.1/arm64-dts-qcom-pmr735b-fix-thermal-zone-name.patch new file mode 100644 index 00000000000..9e89695b5ac --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-pmr735b-fix-thermal-zone-name.patch @@ -0,0 +1,39 @@ +From f7674f2c159ca0ca1f3aff8684517870eaee8d5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 15:30:23 +0300 +Subject: arm64: dts: qcom: pmr735b: fix thermal zone name + +From: Dmitry Baryshkov + +[ Upstream commit 99f8cf491d546cd668236f573c7d846d3e94f2d6 ] + +The name of the thermal zone in pmr735b.dtsi (pmr735a-thermal) conflicts +with the thermal zone in pmr735a.dtsi. Rename the thermal zone according +to the chip name. + +Fixes: 6f3426b3dea4 ("arm64: dts: qcom: pmr735b: add temp sensor and thermal zone config") +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230707123027.1510723-5-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/pmr735b.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/pmr735b.dtsi b/arch/arm64/boot/dts/qcom/pmr735b.dtsi +index ec24c4478005a..f7473e2473224 100644 +--- a/arch/arm64/boot/dts/qcom/pmr735b.dtsi ++++ b/arch/arm64/boot/dts/qcom/pmr735b.dtsi +@@ -8,7 +8,7 @@ + + / { + thermal-zones { +- pmr735a_thermal: pmr735a-thermal { ++ pmr735b_thermal: pmr735b-thermal { + polling-delay-passive = <100>; + polling-delay = <0>; + thermal-sensors = <&pmr735b_temp_alarm>; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sc8280xp-add-missing-scm-interconnect.patch b/queue-6.1/arm64-dts-qcom-sc8280xp-add-missing-scm-interconnect.patch new file mode 100644 index 00000000000..57feed6a5fc --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sc8280xp-add-missing-scm-interconnect.patch @@ -0,0 +1,37 @@ +From de60cd7a72acf34c8054a5b05518efa6e9494110 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 17:56:16 +0200 +Subject: arm64: dts: qcom: sc8280xp: Add missing SCM interconnect + +From: Konrad Dybcio + +[ Upstream commit 0a69ccf20b0837db857abfc94d7e3bacf1cb771b ] + +The SCM interconnect path was missing. Add it. + +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Konrad Dybcio +Reviewed-by: Johan Hovold +Tested-by: Johan Hovold +Link: https://lore.kernel.org/r/20230622-topic-8280scmicc-v1-2-6ef318919ea5@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index 1afc960bab5c9..405835ad28bcd 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -396,6 +396,7 @@ CLUSTER_SLEEP_0: cluster-sleep-0 { + firmware { + scm: scm { + compatible = "qcom,scm-sc8280xp", "qcom,scm"; ++ interconnects = <&aggre2_noc MASTER_CRYPTO 0 &mc_virt SLAVE_EBI1 0>; + }; + }; + +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sc8280xp-crd-correct-vreg_misc_3p3-gp.patch b/queue-6.1/arm64-dts-qcom-sc8280xp-crd-correct-vreg_misc_3p3-gp.patch new file mode 100644 index 00000000000..9d8bcc779eb --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sc8280xp-crd-correct-vreg_misc_3p3-gp.patch @@ -0,0 +1,49 @@ +From 00bb35f7ab0d7c80341a9dab54b975ad79a4ae18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 13:39:14 -0700 +Subject: arm64: dts: qcom: sc8280xp-crd: Correct vreg_misc_3p3 GPIO + +From: Bjorn Andersson + +[ Upstream commit 9566b5271f68bdf6e69b7c511850e3fb75cd18be ] + +The vreg_misc_3p3 regulator is controlled by PMC8280_1 GPIO 2, not 1, on +the CRD. + +Fixes: ccd3517faf18 ("arm64: dts: qcom: sc8280xp: Add reference device") +Signed-off-by: Bjorn Andersson +Reviewed-by: Johan Hovold +Tested-by: Johan Hovold +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230620203915.141337-1-quic_bjorande@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp-crd.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts b/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts +index 5e30349efd204..38ec8acb7c40d 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts ++++ b/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts +@@ -57,7 +57,7 @@ vreg_misc_3p3: regulator-misc-3p3 { + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + +- gpio = <&pmc8280_1_gpios 1 GPIO_ACTIVE_HIGH>; ++ gpio = <&pmc8280_1_gpios 2 GPIO_ACTIVE_HIGH>; + enable-active-high; + + pinctrl-names = "default"; +@@ -364,7 +364,7 @@ edp_bl_reg_en: edp-bl-reg-en-state { + }; + + misc_3p3_reg_en: misc-3p3-reg-en-state { +- pins = "gpio1"; ++ pins = "gpio2"; + function = "normal"; + }; + }; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sc8280xp-x13s-unreserve-nc-pins.patch b/queue-6.1/arm64-dts-qcom-sc8280xp-x13s-unreserve-nc-pins.patch new file mode 100644 index 00000000000..cd97bf9714e --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sc8280xp-x13s-unreserve-nc-pins.patch @@ -0,0 +1,37 @@ +From 0a21600f51822093a18253cb32d39f690b455c8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 15:05:26 +0200 +Subject: arm64: dts: qcom: sc8280xp-x13s: Unreserve NC pins + +From: Konrad Dybcio + +[ Upstream commit 7868ed0144b33903e16a50485775f669c109e41a ] + +Pins 83-86 and 158-160 are NC, so there's no point in keeping them +reserved. Take care of that. + +Fixes: 32c231385ed4 ("arm64: dts: qcom: sc8280xp: add Lenovo Thinkpad X13s devicetree") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230803-topic-x13s_pin-v1-1-fae792274e89@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts +index b2b744bb8a538..49d15432aeabf 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts ++++ b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts +@@ -347,7 +347,7 @@ edp_bl_pwm: edp-bl-pwm-state { + }; + + &tlmm { +- gpio-reserved-ranges = <70 2>, <74 6>, <83 4>, <125 2>, <128 2>, <154 7>; ++ gpio-reserved-ranges = <70 2>, <74 6>, <125 2>, <128 2>, <154 4>; + + kybd_default: kybd-default-state { + disable { +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sdm845-add-missing-rpmh-power-domain-.patch b/queue-6.1/arm64-dts-qcom-sdm845-add-missing-rpmh-power-domain-.patch new file mode 100644 index 00000000000..c8c2af7fc50 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sdm845-add-missing-rpmh-power-domain-.patch @@ -0,0 +1,39 @@ +From 270c23a94d9c989d068b265821827b46380742c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 11:10:48 +0530 +Subject: arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC + +From: Manivannan Sadhasivam + +[ Upstream commit 4b6ea15c0a1122422b44bf6c47a3c22fc8d46777 ] + +GCC and it's GDSCs are under the RPMh CX power domain. So let's add the +missing RPMh power domain to the GCC node. + +Fixes: 6d4cf750d03a ("arm64: dts: sdm845: Add minimal dts/dtsi files for sdm845 SoC and MTP") +Reviewed-by: Konrad Dybcio +Co-developed-by: Krzysztof Kozlowski +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20230720054100.9940-4-manivannan.sadhasivam@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index b7ba70857d0ad..375c86633b5b9 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -1099,6 +1099,7 @@ gcc: clock-controller@100000 { + #clock-cells = <1>; + #reset-cells = <1>; + #power-domain-cells = <1>; ++ power-domains = <&rpmhpd SDM845_CX>; + }; + + qfprom@784000 { +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sdm845-fix-the-min-frequency-of-ice_c.patch b/queue-6.1/arm64-dts-qcom-sdm845-fix-the-min-frequency-of-ice_c.patch new file mode 100644 index 00000000000..fe540271bc8 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sdm845-fix-the-min-frequency-of-ice_c.patch @@ -0,0 +1,39 @@ +From 7bb12a7f6467bf9294312314fe6331aaf0645327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 11:10:49 +0530 +Subject: arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk" + +From: Manivannan Sadhasivam + +[ Upstream commit bbbef6e24bc4493602df68b052f6f48d48e3184a ] + +Minimum frequency of the "ice_core_clk" should be 75MHz as specified in the +downstream vendor devicetree. So fix it! + +https://git.codelinaro.org/clo/la/kernel/msm-4.9/-/blob/LA.UM.7.3.r1-09300-sdm845.0/arch/arm64/boot/dts/qcom/sdm845.dtsi + +Fixes: 433f9a57298f ("arm64: dts: sdm845: add Inline Crypto Engine registers and clock") +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20230720054100.9940-5-manivannan.sadhasivam@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 375c86633b5b9..52c9f5639f8a2 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -2521,7 +2521,7 @@ ufs_mem_hc: ufshc@1d84000 { + <0 0>, + <0 0>, + <0 0>, +- <0 300000000>; ++ <75000000 300000000>; + + status = "disabled"; + }; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sdm845-tama-set-serial-indices-and-st.patch b/queue-6.1/arm64-dts-qcom-sdm845-tama-set-serial-indices-and-st.patch new file mode 100644 index 00000000000..b8bceb3c0e8 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sdm845-tama-set-serial-indices-and-st.patch @@ -0,0 +1,48 @@ +From f9f549abae362acebccb03cb125f7f82e4fc5333 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 19:27:50 +0200 +Subject: arm64: dts: qcom: sdm845-tama: Set serial indices and stdout-path + +From: Konrad Dybcio + +[ Upstream commit 9acc60c3e2d449243e4c2126e3b56f1c4f7fd3bc ] + +UART6 is used for debug (routed via uSD pins) and UART9 is connected +to the bluetooth chip. + +Set indexed aliases to make the GENI UART driver happy and route serial +traffic through the debug uart by default. + +Fixes: 30a7f99befc6 ("arm64: dts: qcom: Add support for SONY Xperia XZ2 / XZ2C / XZ3 (Tama platform)") +Signed-off-by: Konrad Dybcio +Reviewed-by: Marijn Suijten +Link: https://lore.kernel.org/r/20230627-topic-tama_uart-v1-1-0fa790248db8@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi b/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi +index 51ee42e3c995c..d6918e6d19799 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi +@@ -14,6 +14,15 @@ / { + qcom,msm-id = <321 0x20001>; /* SDM845 v2.1 */ + qcom,board-id = <8 0>; + ++ aliases { ++ serial0 = &uart6; ++ serial1 = &uart9; ++ }; ++ ++ chosen { ++ stdout-path = "serial0:115200n8"; ++ }; ++ + gpio-keys { + compatible = "gpio-keys"; + +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sm6350-fix-zap-region.patch b/queue-6.1/arm64-dts-qcom-sm6350-fix-zap-region.patch new file mode 100644 index 00000000000..64e23e34502 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm6350-fix-zap-region.patch @@ -0,0 +1,55 @@ +From cfdaaa8dca326d3db30daaeefcec251cf7853a81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 13:35:37 +0200 +Subject: arm64: dts: qcom: sm6350: Fix ZAP region + +From: Konrad Dybcio + +[ Upstream commit 44bcded2be4fe9b9d0b6e48075c9947b75c0af63 ] + +The previous ZAP region definition was wrong. Fix it. +Note this is not a device-specific fixup, but a fixup to the generic +PIL load address. + +Fixes: 5f82b9cda61e ("arm64: dts: qcom: Add SM6350 device tree") +Signed-off-by: Konrad Dybcio +Reviewed-by: Luca Weiss +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230315-topic-lagoon_gpu-v2-6-afcdfb18bb13@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6350.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi +index 35f621ef9da54..34c8de4f43fba 100644 +--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi +@@ -306,11 +306,6 @@ pil_ipa_gsi_mem: memory@8b710000 { + no-map; + }; + +- pil_gpu_mem: memory@8b715400 { +- reg = <0 0x8b715400 0 0x2000>; +- no-map; +- }; +- + pil_modem_mem: memory@8b800000 { + reg = <0 0x8b800000 0 0xf800000>; + no-map; +@@ -331,6 +326,11 @@ removed_region: memory@c0000000 { + no-map; + }; + ++ pil_gpu_mem: memory@f0d00000 { ++ reg = <0 0xf0d00000 0 0x1000>; ++ no-map; ++ }; ++ + debug_region: memory@ffb00000 { + reg = <0 0xffb00000 0 0xc0000>; + no-map; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sm8150-fix-the-i2c7-interrupt.patch b/queue-6.1/arm64-dts-qcom-sm8150-fix-the-i2c7-interrupt.patch new file mode 100644 index 00000000000..c193255f67e --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8150-fix-the-i2c7-interrupt.patch @@ -0,0 +1,38 @@ +From 6cfd28a94c7cd1c03baf6c8229953aebfaf1875f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 10:53:21 +0800 +Subject: arm64: dts: qcom: sm8150: Fix the I2C7 interrupt + +From: Zeyan Li + +[ Upstream commit f9568d22ce06192a7e14bda3a29dc216659554ff ] + +I2C6 and I2C7 use the same interrupts, which is incorrect. +In the downstream kernel, I2C7 has interrupts of 608 instead of 607. + +Fixes: 81bee6953b58 ("arm64: dts: qcom: sm8150: add i2c nodes") +Signed-off-by: Zeyan Li +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/SY7P282MB378712225CBCEA95FE71554DB201A@SY7P282MB3787.AUSP282.PROD.OUTLOOK.COM +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi +index 78ae4b9eaa106..f049fb42e3ca8 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi +@@ -1196,7 +1196,7 @@ i2c7: i2c@89c000 { + dma-names = "tx", "rx"; + pinctrl-names = "default"; + pinctrl-0 = <&qup_i2c7_default>; +- interrupts = ; ++ interrupts = ; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sm8250-correct-dynamic-power-coeffici.patch b/queue-6.1/arm64-dts-qcom-sm8250-correct-dynamic-power-coeffici.patch new file mode 100644 index 00000000000..7db05c6c01d --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8250-correct-dynamic-power-coeffici.patch @@ -0,0 +1,92 @@ +From a6a77690c28675d2cdb37d501ea218a2a00f33d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 17:48:52 +0200 +Subject: arm64: dts: qcom: sm8250: correct dynamic power coefficients + +From: Vincent Guittot + +[ Upstream commit 775a5283c25d160b2a1359018c447bc518096547 ] + +sm8250 faces the same problem with its Energy Model as sdm845. The energy +cost of LITTLE cores is reported to be higher than medium or big cores + +EM computes the energy with formula: + +energy = OPP's cost / maximum cpu capacity * utilization + +On v6.4-rc6 we have: +max capacity of CPU0 = 284 +capacity of CPU0's OPP(1612800 Hz) = 253 +cost of CPU0's OPP(1612800 Hz) = 191704 + +max capacity of CPU4 = 871 +capacity of CPU4's OPP(710400 Hz) = 255 +cost of CPU4's OPP(710400 Hz) = 343217 + +Both OPPs have almost the same compute capacity but the estimated energy +per unit of utilization will be estimated to: + +energy CPU0 = 191704 / 284 * 1 = 675 +energy CPU4 = 343217 / 871 * 1 = 394 + +EM estimates that little CPU0 will consume 71% more than medium CPU4 for +the same compute capacity. According to [1], little consumes 25% less than +medium core for Coremark benchmark at those OPPs for the same duration. + +Set the dynamic-power-coefficient of CPU0-3 to 105 to fix the energy model +for little CPUs. + +[1] https://github.com/kdrag0n/freqbench/tree/master/results/sm8250/k30s + +Fixes: 6aabed5526ee ("arm64: dts: qcom: sm8250: Add CPU capacities and energy model") +Signed-off-by: Vincent Guittot +Link: https://lore.kernel.org/r/20230615154852.130076-1-vincent.guittot@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index e93955525a107..c27f88c9f7b2a 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -99,7 +99,7 @@ CPU0: cpu@0 { + reg = <0x0 0x0>; + enable-method = "psci"; + capacity-dmips-mhz = <448>; +- dynamic-power-coefficient = <205>; ++ dynamic-power-coefficient = <105>; + next-level-cache = <&L2_0>; + power-domains = <&CPU_PD0>; + power-domain-names = "psci"; +@@ -123,7 +123,7 @@ CPU1: cpu@100 { + reg = <0x0 0x100>; + enable-method = "psci"; + capacity-dmips-mhz = <448>; +- dynamic-power-coefficient = <205>; ++ dynamic-power-coefficient = <105>; + next-level-cache = <&L2_100>; + power-domains = <&CPU_PD1>; + power-domain-names = "psci"; +@@ -144,7 +144,7 @@ CPU2: cpu@200 { + reg = <0x0 0x200>; + enable-method = "psci"; + capacity-dmips-mhz = <448>; +- dynamic-power-coefficient = <205>; ++ dynamic-power-coefficient = <105>; + next-level-cache = <&L2_200>; + power-domains = <&CPU_PD2>; + power-domain-names = "psci"; +@@ -165,7 +165,7 @@ CPU3: cpu@300 { + reg = <0x0 0x300>; + enable-method = "psci"; + capacity-dmips-mhz = <448>; +- dynamic-power-coefficient = <205>; ++ dynamic-power-coefficient = <105>; + next-level-cache = <&L2_300>; + power-domains = <&CPU_PD3>; + power-domain-names = "psci"; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sm8250-edo-add-gpio-line-names-for-pm.patch b/queue-6.1/arm64-dts-qcom-sm8250-edo-add-gpio-line-names-for-pm.patch new file mode 100644 index 00000000000..12a88f99542 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8250-edo-add-gpio-line-names-for-pm.patch @@ -0,0 +1,164 @@ +From 3d7af7400a20902e83270632ed0fb307d4b3972b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 13:05:35 +0200 +Subject: arm64: dts: qcom: sm8250-edo: Add GPIO line names for PMIC GPIOs + +From: Konrad Dybcio + +[ Upstream commit 6b8a63350752c6a5e4b54f2de6174084652cd3cd ] + +Sony ever so graciously provides GPIO line names in their downstream +kernel (though sometimes they are not 100% accurate and you can judge +that by simply looking at them and with what drivers they are used). + +Add these to the PDX203&206 DTSIs to better document the hardware. + +Diff between 203 and 206: +pm8009_gpios +< "CAM_PWR_LD_EN", +> "NC", + +pm8150_gpios +< "NC", +> "G_ASSIST_N", +< "WLC_EN_N", /* GPIO_10 */ +> "NC", /* GPIO_10 */ +Which is due to 5 II having an additional Google Assistant hardware +button and 1 II having a wireless charger & different camera wiring +to accommodate the additional 3D iToF sensor. + +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230614-topic-edo_pinsgpiopmic-v2-2-6f90bba54c53@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: a422c6a91a66 ("arm64: dts: qcom: sm8250-edo: Rectify gpio-keys") +Signed-off-by: Sasha Levin +--- + .../qcom/sm8250-sony-xperia-edo-pdx203.dts | 50 +++++++++++++++++++ + .../qcom/sm8250-sony-xperia-edo-pdx206.dts | 50 +++++++++++++++++++ + 2 files changed, 100 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx203.dts b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx203.dts +index 84104d2b20101..62590c6bd3067 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx203.dts ++++ b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx203.dts +@@ -15,6 +15,56 @@ / { + + /delete-node/ &vreg_l7f_1p8; + ++&pm8009_gpios { ++ gpio-line-names = "NC", /* GPIO_1 */ ++ "CAM_PWR_LD_EN", ++ "WIDEC_PWR_EN", ++ "NC"; ++}; ++ ++&pm8150_gpios { ++ gpio-line-names = "VOL_DOWN_N", /* GPIO_1 */ ++ "OPTION_2", ++ "NC", ++ "PM_SLP_CLK_IN", ++ "OPTION_1", ++ "NC", ++ "NC", ++ "SP_ARI_PWR_ALARM", ++ "NC", ++ "NC"; /* GPIO_10 */ ++}; ++ ++&pm8150b_gpios { ++ gpio-line-names = "SNAPSHOT_N", /* GPIO_1 */ ++ "FOCUS_N", ++ "NC", ++ "NC", ++ "RF_LCD_ID_EN", ++ "NC", ++ "NC", ++ "LCD_ID", ++ "NC", ++ "WLC_EN_N", /* GPIO_10 */ ++ "NC", ++ "RF_ID"; ++}; ++ ++&pm8150l_gpios { ++ gpio-line-names = "NC", /* GPIO_1 */ ++ "PM3003A_EN", ++ "NC", ++ "NC", ++ "NC", ++ "AUX2_THERM", ++ "BB_HP_EN", ++ "FP_LDO_EN", ++ "PMX_RESET_N", ++ "AUX3_THERM", /* GPIO_10 */ ++ "DTV_PWR_EN", ++ "PM3003A_MODE"; ++}; ++ + &tlmm { + gpio-line-names = "AP_CTI_IN", /* GPIO_0 */ + "MDM2AP_ERR_FATAL", +diff --git a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx206.dts b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx206.dts +index 4b15de5e65e9b..65bad39ecda83 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx206.dts ++++ b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx206.dts +@@ -30,6 +30,56 @@ g-assist-key { + }; + }; + ++&pm8009_gpios { ++ gpio-line-names = "NC", /* GPIO_1 */ ++ "NC", ++ "WIDEC_PWR_EN", ++ "NC"; ++}; ++ ++&pm8150_gpios { ++ gpio-line-names = "VOL_DOWN_N", /* GPIO_1 */ ++ "OPTION_2", ++ "NC", ++ "PM_SLP_CLK_IN", ++ "OPTION_1", ++ "G_ASSIST_N", ++ "NC", ++ "SP_ARI_PWR_ALARM", ++ "NC", ++ "NC"; /* GPIO_10 */ ++}; ++ ++&pm8150b_gpios { ++ gpio-line-names = "SNAPSHOT_N", /* GPIO_1 */ ++ "FOCUS_N", ++ "NC", ++ "NC", ++ "RF_LCD_ID_EN", ++ "NC", ++ "NC", ++ "LCD_ID", ++ "NC", ++ "NC", /* GPIO_10 */ ++ "NC", ++ "RF_ID"; ++}; ++ ++&pm8150l_gpios { ++ gpio-line-names = "NC", /* GPIO_1 */ ++ "PM3003A_EN", ++ "NC", ++ "NC", ++ "NC", ++ "AUX2_THERM", ++ "BB_HP_EN", ++ "FP_LDO_EN", ++ "PMX_RESET_N", ++ "NC", /* GPIO_10 */ ++ "NC", ++ "PM3003A_MODE"; ++}; ++ + &tlmm { + gpio-line-names = "AP_CTI_IN", /* GPIO_0 */ + "MDM2AP_ERR_FATAL", +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sm8250-edo-add-gpio-line-names-for-tl.patch b/queue-6.1/arm64-dts-qcom-sm8250-edo-add-gpio-line-names-for-tl.patch new file mode 100644 index 00000000000..fa870b6c14b --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8250-edo-add-gpio-line-names-for-tl.patch @@ -0,0 +1,430 @@ +From 047b79ab6456d671bdd5fb05c3dcb0fc79bbf5fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 13:05:34 +0200 +Subject: arm64: dts: qcom: sm8250-edo: Add gpio line names for TLMM + +From: Konrad Dybcio + +[ Upstream commit 40b398beabdfe0e9088b13976e56b1dc706fe851 ] + +Sony ever so graciously provides GPIO line names in their downstream +kernel (though sometimes they are not 100% accurate and you can judge +that by simply looking at them and with what drivers they are used). + +Add these to the PDX203&206 DTSIs to better document the hardware. + +Diff between 203 and 206: +< "CAM_PWR_A_CS", +> "FRONTC_PWR_EN", +< "CAM4_MCLK", +< "TOF_RST_N", +> "NC", +> "NC", +< "WLC_I2C_SDA", +< "WLC_I2C_SCL", /* GPIO_120 */ +> "NC", +> "NC", +< "WLC_INT_N", +> "NC", + +Which makes sense, as 203 has a 3D iToF, slightly different camera +power wiring and WLC (WireLess Charging). + +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230614-topic-edo_pinsgpiopmic-v2-1-6f90bba54c53@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: a422c6a91a66 ("arm64: dts: qcom: sm8250-edo: Rectify gpio-keys") +Signed-off-by: Sasha Levin +--- + .../qcom/sm8250-sony-xperia-edo-pdx203.dts | 183 ++++++++++++++++++ + .../qcom/sm8250-sony-xperia-edo-pdx206.dts | 183 ++++++++++++++++++ + 2 files changed, 366 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx203.dts b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx203.dts +index 356a81698731a..84104d2b20101 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx203.dts ++++ b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx203.dts +@@ -14,3 +14,186 @@ / { + }; + + /delete-node/ &vreg_l7f_1p8; ++ ++&tlmm { ++ gpio-line-names = "AP_CTI_IN", /* GPIO_0 */ ++ "MDM2AP_ERR_FATAL", ++ "AP_CTI_OUT", ++ "MDM2AP_STATUS", ++ "NFC_I2C_SDA", ++ "NFC_I2C_SCL", ++ "NFC_EN", ++ "NFC_CLK_REQ", ++ "NFC_ESE_PWR_REQ", ++ "DVDT_WRT_DET_AND", ++ "SPK_AMP_RESET_N", /* GPIO_10 */ ++ "SPK_AMP_INT_N", ++ "APPS_I2C_1_SDA", ++ "APPS_I2C_1_SCL", ++ "NC", ++ "TX_GTR_THRES_IN", ++ "HST_BT_UART_CTS", ++ "HST_BT_UART_RFR", ++ "HST_BT_UART_TX", ++ "HST_BT_UART_RX", ++ "HST_WLAN_EN", /* GPIO_20 */ ++ "HST_BT_EN", ++ "RGBC_IR_PWR_EN", ++ "FP_INT_N", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NFC_ESE_SPI_MISO", ++ "NFC_ESE_SPI_MOSI", ++ "NFC_ESE_SPI_SCLK", /* GPIO_30 */ ++ "NFC_ESE_SPI_CS_N", ++ "WCD_RST_N", ++ "NC", ++ "SDM_DEBUG_UART_TX", ++ "SDM_DEBUG_UART_RX", ++ "TS_I2C_SDA", ++ "TS_I2C_SCL", ++ "TS_INT_N", ++ "FP_SPI_MISO", /* GPIO_40 */ ++ "FP_SPI_MOSI", ++ "FP_SPI_SCLK", ++ "FP_SPI_CS_N", ++ "APPS_I2C_0_SDA", ++ "APPS_I2C_0_SCL", ++ "DISP_ERR_FG", ++ "UIM2_DETECT_EN", ++ "NC", ++ "NC", ++ "NC", /* GPIO_50 */ ++ "NC", ++ "MDM_UART_CTS", ++ "MDM_UART_RFR", ++ "MDM_UART_TX", ++ "MDM_UART_RX", ++ "AP2MDM_STATUS", ++ "AP2MDM_ERR_FATAL", ++ "MDM_IPC_HS_UART_TX", ++ "MDM_IPC_HS_UART_RX", ++ "NC", /* GPIO_60 */ ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "USB_CC_DIR", ++ "DISP_VSYNC", ++ "NC", ++ "NC", ++ "CAM_PWR_B_CS", ++ "NC", /* GPIO_70 */ ++ "CAM_PWR_A_CS", ++ "SBU_SW_SEL", ++ "SBU_SW_OE", ++ "FP_RESET_N", ++ "FP_RESET_N", ++ "DISP_RESET_N", ++ "DEBUG_GPIO0", ++ "TRAY_DET", ++ "CAM2_RST_N", ++ "PCIE0_RST_N", ++ "PCIE0_CLK_REQ_N", /* GPIO_80 */ ++ "PCIE0_WAKE_N", ++ "DVDT_ENABLE", ++ "DVDT_WRT_DET_OR", ++ "NC", ++ "PCIE2_RST_N", ++ "PCIE2_CLK_REQ_N", ++ "PCIE2_WAKE_N", ++ "MDM_VFR_IRQ0", ++ "MDM_VFR_IRQ1", ++ "SW_SERVICE", /* GPIO_90 */ ++ "CAM_SOF", ++ "CAM1_RST_N", ++ "CAM0_RST_N", ++ "CAM0_MCLK", ++ "CAM1_MCLK", ++ "CAM2_MCLK", ++ "CAM3_MCLK", ++ "CAM4_MCLK", ++ "TOF_RST_N", ++ "NC", /* GPIO_100 */ ++ "CCI0_I2C_SDA", ++ "CCI0_I2C_SCL", ++ "CCI1_I2C_SDA", ++ "CCI1_I2C_SCL_", ++ "CCI2_I2C_SDA", ++ "CCI2_I2C_SCL", ++ "CCI3_I2C_SDA", ++ "CCI3_I2C_SCL", ++ "CAM3_RST_N", ++ "NFC_DWL_REQ", /* GPIO_110 */ ++ "NFC_IRQ", ++ "XVS", ++ "NC", ++ "RF_ID_EXTENSION", ++ "SPK_AMP_I2C_SDA", ++ "SPK_AMP_I2C_SCL", ++ "NC", ++ "NC", ++ "WLC_I2C_SDA", ++ "WLC_I2C_SCL", /* GPIO_120 */ ++ "ACC_COVER_OPEN", ++ "ALS_PROX_INT_N", ++ "ACCEL_INT", ++ "WLAN_SW_CTRL", ++ "CAMSENSOR_I2C_SDA", ++ "CAMSENSOR_I2C_SCL", ++ "UDON_SWITCH_SEL", ++ "WDOG_DISABLE", ++ "BAROMETER_INT", ++ "NC", /* GPIO_130 */ ++ "NC", ++ "FORCED_USB_BOOT", ++ "NC", ++ "NC", ++ "WLC_INT_N", ++ "NC", ++ "NC", ++ "RGBC_IR_INT", ++ "NC", ++ "NC", /* GPIO_140 */ ++ "NC", ++ "BT_SLIMBUS_CLK", ++ "BT_SLIMBUS_DATA", ++ "HW_ID_0", ++ "HW_ID_1", ++ "WCD_SWR_TX_CLK", ++ "WCD_SWR_TX_DATA0", ++ "WCD_SWR_TX_DATA1", ++ "WCD_SWR_RX_CLK", ++ "WCD_SWR_RX_DATA0", /* GPIO_150 */ ++ "WCD_SWR_RX_DATA1", ++ "SDM_DMIC_CLK1", ++ "SDM_DMIC_DATA1", ++ "SDM_DMIC_CLK2", ++ "SDM_DMIC_DATA2", ++ "SPK_AMP_I2S_CLK", ++ "SPK_AMP_I2S_WS", ++ "SPK_AMP_I2S_ASP_DIN", ++ "SPK_AMP_I2S_ASP_DOUT", ++ "COMPASS_I2C_SDA", /* GPIO_160 */ ++ "COMPASS_I2C_SCL", ++ "NC", ++ "NC", ++ "SSC_SPI_1_MISO", ++ "SSC_SPI_1_MOSI", ++ "SSC_SPI_1_CLK", ++ "SSC_SPI_1_CS_N", ++ "NC", ++ "NC", ++ "SSC_SENSOR_I2C_SDA", /* GPIO_170 */ ++ "SSC_SENSOR_I2C_SCL", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "HST_BLE_SNS_UART6_TX", ++ "HST_BLE_SNS_UART6_RX", ++ "HST_WLAN_UART_TX", ++ "HST_WLAN_UART_RX"; ++}; +diff --git a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx206.dts b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx206.dts +index 5ecf7dafb2ec4..4b15de5e65e9b 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx206.dts ++++ b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx206.dts +@@ -30,6 +30,189 @@ g-assist-key { + }; + }; + ++&tlmm { ++ gpio-line-names = "AP_CTI_IN", /* GPIO_0 */ ++ "MDM2AP_ERR_FATAL", ++ "AP_CTI_OUT", ++ "MDM2AP_STATUS", ++ "NFC_I2C_SDA", ++ "NFC_I2C_SCL", ++ "NFC_EN", ++ "NFC_CLK_REQ", ++ "NFC_ESE_PWR_REQ", ++ "DVDT_WRT_DET_AND", ++ "SPK_AMP_RESET_N", /* GPIO_10 */ ++ "SPK_AMP_INT_N", ++ "APPS_I2C_1_SDA", ++ "APPS_I2C_1_SCL", ++ "NC", ++ "TX_GTR_THRES_IN", ++ "HST_BT_UART_CTS", ++ "HST_BT_UART_RFR", ++ "HST_BT_UART_TX", ++ "HST_BT_UART_RX", ++ "HST_WLAN_EN", /* GPIO_20 */ ++ "HST_BT_EN", ++ "RGBC_IR_PWR_EN", ++ "FP_INT_N", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NFC_ESE_SPI_MISO", ++ "NFC_ESE_SPI_MOSI", ++ "NFC_ESE_SPI_SCLK", /* GPIO_30 */ ++ "NFC_ESE_SPI_CS_N", ++ "WCD_RST_N", ++ "NC", ++ "SDM_DEBUG_UART_TX", ++ "SDM_DEBUG_UART_RX", ++ "TS_I2C_SDA", ++ "TS_I2C_SCL", ++ "TS_INT_N", ++ "FP_SPI_MISO", /* GPIO_40 */ ++ "FP_SPI_MOSI", ++ "FP_SPI_SCLK", ++ "FP_SPI_CS_N", ++ "APPS_I2C_0_SDA", ++ "APPS_I2C_0_SCL", ++ "DISP_ERR_FG", ++ "UIM2_DETECT_EN", ++ "NC", ++ "NC", ++ "NC", /* GPIO_50 */ ++ "NC", ++ "MDM_UART_CTS", ++ "MDM_UART_RFR", ++ "MDM_UART_TX", ++ "MDM_UART_RX", ++ "AP2MDM_STATUS", ++ "AP2MDM_ERR_FATAL", ++ "MDM_IPC_HS_UART_TX", ++ "MDM_IPC_HS_UART_RX", ++ "NC", /* GPIO_60 */ ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "USB_CC_DIR", ++ "DISP_VSYNC", ++ "NC", ++ "NC", ++ "CAM_PWR_B_CS", ++ "NC", /* GPIO_70 */ ++ "FRONTC_PWR_EN", ++ "SBU_SW_SEL", ++ "SBU_SW_OE", ++ "FP_RESET_N", ++ "FP_RESET_N", ++ "DISP_RESET_N", ++ "DEBUG_GPIO0", ++ "TRAY_DET", ++ "CAM2_RST_N", ++ "PCIE0_RST_N", ++ "PCIE0_CLK_REQ_N", /* GPIO_80 */ ++ "PCIE0_WAKE_N", ++ "DVDT_ENABLE", ++ "DVDT_WRT_DET_OR", ++ "NC", ++ "PCIE2_RST_N", ++ "PCIE2_CLK_REQ_N", ++ "PCIE2_WAKE_N", ++ "MDM_VFR_IRQ0", ++ "MDM_VFR_IRQ1", ++ "SW_SERVICE", /* GPIO_90 */ ++ "CAM_SOF", ++ "CAM1_RST_N", ++ "CAM0_RST_N", ++ "CAM0_MCLK", ++ "CAM1_MCLK", ++ "CAM2_MCLK", ++ "CAM3_MCLK", ++ "NC", ++ "NC", ++ "NC", /* GPIO_100 */ ++ "CCI0_I2C_SDA", ++ "CCI0_I2C_SCL", ++ "CCI1_I2C_SDA", ++ "CCI1_I2C_SCL_", ++ "CCI2_I2C_SDA", ++ "CCI2_I2C_SCL", ++ "CCI3_I2C_SDA", ++ "CCI3_I2C_SCL", ++ "CAM3_RST_N", ++ "NFC_DWL_REQ", /* GPIO_110 */ ++ "NFC_IRQ", ++ "XVS", ++ "NC", ++ "RF_ID_EXTENSION", ++ "SPK_AMP_I2C_SDA", ++ "SPK_AMP_I2C_SCL", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "ACC_COVER_OPEN", ++ "ALS_PROX_INT_N", ++ "ACCEL_INT", ++ "WLAN_SW_CTRL", ++ "CAMSENSOR_I2C_SDA", ++ "CAMSENSOR_I2C_SCL", ++ "UDON_SWITCH_SEL", ++ "WDOG_DISABLE", ++ "BAROMETER_INT", ++ "NC", /* GPIO_130 */ ++ "NC", ++ "FORCED_USB_BOOT", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "RGBC_IR_INT", ++ "NC", ++ "NC", /* GPIO_140 */ ++ "NC", ++ "BT_SLIMBUS_CLK", ++ "BT_SLIMBUS_DATA", ++ "HW_ID_0", ++ "HW_ID_1", ++ "WCD_SWR_TX_CLK", ++ "WCD_SWR_TX_DATA0", ++ "WCD_SWR_TX_DATA1", ++ "WCD_SWR_RX_CLK", ++ "WCD_SWR_RX_DATA0", /* GPIO_150 */ ++ "WCD_SWR_RX_DATA1", ++ "SDM_DMIC_CLK1", ++ "SDM_DMIC_DATA1", ++ "SDM_DMIC_CLK2", ++ "SDM_DMIC_DATA2", ++ "SPK_AMP_I2S_CLK", ++ "SPK_AMP_I2S_WS", ++ "SPK_AMP_I2S_ASP_DIN", ++ "SPK_AMP_I2S_ASP_DOUT", ++ "COMPASS_I2C_SDA", /* GPIO_160 */ ++ "COMPASS_I2C_SCL", ++ "NC", ++ "NC", ++ "SSC_SPI_1_MISO", ++ "SSC_SPI_1_MOSI", ++ "SSC_SPI_1_CLK", ++ "SSC_SPI_1_CS_N", ++ "NC", ++ "NC", ++ "SSC_SENSOR_I2C_SDA", /* GPIO_170 */ ++ "SSC_SENSOR_I2C_SCL", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "HST_BLE_SNS_UART6_TX", ++ "HST_BLE_SNS_UART6_RX", ++ "HST_WLAN_UART_TX", ++ "HST_WLAN_UART_RX"; ++}; ++ + &vreg_l2f_1p3 { + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <1200000>; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sm8250-edo-rectify-gpio-keys.patch b/queue-6.1/arm64-dts-qcom-sm8250-edo-rectify-gpio-keys.patch new file mode 100644 index 00000000000..09f68da2fe4 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8250-edo-rectify-gpio-keys.patch @@ -0,0 +1,126 @@ +From 04527fc1fca9655212a96fef014549ee654e3661 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 13:05:37 +0200 +Subject: arm64: dts: qcom: sm8250-edo: Rectify gpio-keys + +From: Konrad Dybcio + +[ Upstream commit a422c6a91a667b309ca1a6c08b30dbfcf7d4e866 ] + +Set up the corresponding GPIOs properly and add the leftover hardware +buttons to mark this piece of the puzzle complete. + +Fixes: 46e14907c716 ("arm64: dts: qcom: sm8250-edo: Add hardware keys") +Reviewed-by: Marijn Suijten +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230614-topic-edo_pinsgpiopmic-v2-4-6f90bba54c53@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + .../qcom/sm8250-sony-xperia-edo-pdx206.dts | 10 ++++ + .../boot/dts/qcom/sm8250-sony-xperia-edo.dtsi | 54 ++++++++++++++++--- + 2 files changed, 58 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx206.dts b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx206.dts +index 65bad39ecda83..0e50661c1b4c1 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx206.dts ++++ b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo-pdx206.dts +@@ -20,6 +20,8 @@ &framebuffer { + }; + + &gpio_keys { ++ pinctrl-0 = <&focus_n &snapshot_n &vol_down_n &g_assist_n>; ++ + g-assist-key { + label = "Google Assistant Key"; + linux,code = ; +@@ -48,6 +50,14 @@ &pm8150_gpios { + "SP_ARI_PWR_ALARM", + "NC", + "NC"; /* GPIO_10 */ ++ ++ g_assist_n: g-assist-n-state { ++ pins = "gpio6"; ++ function = "normal"; ++ power-source = <1>; ++ bias-pull-up; ++ input-enable; ++ }; + }; + + &pm8150b_gpios { +diff --git a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi +index 390b90a8ddf70..259798a959749 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi +@@ -51,12 +51,26 @@ framebuffer: framebuffer@9c000000 { + gpio_keys: gpio-keys { + compatible = "gpio-keys"; + +- /* +- * Camera focus (light press) and camera snapshot (full press) +- * seem not to work properly.. Adding the former one stalls the CPU +- * and the latter kills the volume down key for whatever reason. In any +- * case, they are both on &pm8150b_gpios: camera focus(2), camera snapshot(1). +- */ ++ pinctrl-0 = <&focus_n &snapshot_n &vol_down_n>; ++ pinctrl-names = "default"; ++ ++ key-camera-focus { ++ label = "Camera Focus"; ++ linux,code = ; ++ gpios = <&pm8150b_gpios 2 GPIO_ACTIVE_LOW>; ++ debounce-interval = <15>; ++ linux,can-disable; ++ gpio-key,wakeup; ++ }; ++ ++ key-camera-snapshot { ++ label = "Camera Snapshot"; ++ linux,code = ; ++ gpios = <&pm8150b_gpios 1 GPIO_ACTIVE_LOW>; ++ debounce-interval = <15>; ++ linux,can-disable; ++ gpio-key,wakeup; ++ }; + + key-vol-down { + label = "Volume Down"; +@@ -546,6 +560,34 @@ &pcie2_phy { + vdda-pll-supply = <&vreg_l9a_1p2>; + }; + ++&pm8150_gpios { ++ vol_down_n: vol-down-n-state { ++ pins = "gpio1"; ++ function = "normal"; ++ power-source = <0>; ++ bias-pull-up; ++ input-enable; ++ }; ++}; ++ ++&pm8150b_gpios { ++ snapshot_n: snapshot-n-state { ++ pins = "gpio1"; ++ function = "normal"; ++ power-source = <0>; ++ bias-pull-up; ++ input-enable; ++ }; ++ ++ focus_n: focus-n-state { ++ pins = "gpio2"; ++ function = "normal"; ++ power-source = <0>; ++ bias-pull-up; ++ input-enable; ++ }; ++}; ++ + &pon_pwrkey { + status = "okay"; + }; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sm8250-mark-pcie-hosts-as-dma-coheren.patch b/queue-6.1/arm64-dts-qcom-sm8250-mark-pcie-hosts-as-dma-coheren.patch new file mode 100644 index 00000000000..bccd89ec341 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8250-mark-pcie-hosts-as-dma-coheren.patch @@ -0,0 +1,51 @@ +From e05494378336551aed31612ec4759a4b3e927cba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 14:23:17 +0200 +Subject: arm64: dts: qcom: sm8250: Mark PCIe hosts as DMA coherent + +From: Konrad Dybcio + +[ Upstream commit 339d38a436f30d0f874815eafc7de2257346bf26 ] + +The PCIe hosts on SM8250 are cache-coherent. Mark them as such. + +Fixes: e53bdfc00977 ("arm64: dts: qcom: sm8250: Add PCIe support") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230704-topic-8250_pcie_dmac-v1-1-799603a980b0@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index c27f88c9f7b2a..4d9b30f0b2841 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -1862,6 +1862,7 @@ pcie0: pci@1c00000 { + + pinctrl-names = "default"; + pinctrl-0 = <&pcie0_default_state>; ++ dma-coherent; + + status = "disabled"; + }; +@@ -1968,6 +1969,7 @@ pcie1: pci@1c08000 { + + pinctrl-names = "default"; + pinctrl-0 = <&pcie1_default_state>; ++ dma-coherent; + + status = "disabled"; + }; +@@ -2076,6 +2078,7 @@ pcie2: pci@1c10000 { + + pinctrl-names = "default"; + pinctrl-0 = <&pcie2_default_state>; ++ dma-coherent; + + status = "disabled"; + }; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sm8250-sony-xperia-correct-gpio-keys-.patch b/queue-6.1/arm64-dts-qcom-sm8250-sony-xperia-correct-gpio-keys-.patch new file mode 100644 index 00000000000..e8c137f2cf1 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8250-sony-xperia-correct-gpio-keys-.patch @@ -0,0 +1,48 @@ +From df8aaf48258f5fa89634171d723bc2ef579a4467 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 08:30:11 +0200 +Subject: arm64: dts: qcom: sm8250-sony-xperia: correct GPIO keys wakeup again + +From: Krzysztof Kozlowski + +[ Upstream commit b8fbeea0253211d97c579eae787274633d3eaf0d ] + +gpio-keys,wakeup is a deprecated property: + + m8250-sony-xperia-edo-pdx206.dtb: gpio-keys: key-camera-focus: Unevaluated properties are not allowed ('gpio-key,wakeup' was unexpected) + +Fixes: a422c6a91a66 ("arm64: dts: qcom: sm8250-edo: Rectify gpio-keys") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230711063011.16222-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi +index 259798a959749..3b710c6a326a5 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi +@@ -60,7 +60,7 @@ key-camera-focus { + gpios = <&pm8150b_gpios 2 GPIO_ACTIVE_LOW>; + debounce-interval = <15>; + linux,can-disable; +- gpio-key,wakeup; ++ wakeup-source; + }; + + key-camera-snapshot { +@@ -69,7 +69,7 @@ key-camera-snapshot { + gpios = <&pm8150b_gpios 1 GPIO_ACTIVE_LOW>; + debounce-interval = <15>; + linux,can-disable; +- gpio-key,wakeup; ++ wakeup-source; + }; + + key-vol-down { +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sm8350-add-missing-lmh-interrupts-to-.patch b/queue-6.1/arm64-dts-qcom-sm8350-add-missing-lmh-interrupts-to-.patch new file mode 100644 index 00000000000..ad0b8cc3d42 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8350-add-missing-lmh-interrupts-to-.patch @@ -0,0 +1,42 @@ +From 642f31700e401704a6df623b8b10700f2d51c455 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jul 2023 15:36:23 +0200 +Subject: arm64: dts: qcom: sm8350: Add missing LMH interrupts to cpufreq + +From: Konrad Dybcio + +[ Upstream commit 951151c2bb548e0f6b2c40ab4c48675f5342c914 ] + +Add the missing interrupts that communicate the hardware-managed +throttling to Linux. + +Fixes: ccbb3abb23a5 ("arm64: dts: qcom: sm8350: Add cpufreq node") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230705-topic-sm8350_fixes-v1-3-0f69f70ccb6a@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8350.dtsi | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi +index b91247856f9dc..0b5a1841d607d 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi +@@ -2072,6 +2072,13 @@ cpufreq_hw: cpufreq@18591000 { + <0 0x18593000 0 0x1000>; + reg-names = "freq-domain0", "freq-domain1", "freq-domain2"; + ++ interrupts = , ++ , ++ ; ++ interrupt-names = "dcvsh-irq-0", ++ "dcvsh-irq-1", ++ "dcvsh-irq-2"; ++ + clocks = <&rpmhcc RPMH_CXO_CLK>, <&gcc GCC_GPLL0>; + clock-names = "xo", "alternate"; + +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sm8350-fix-cpu-idle-state-residency-t.patch b/queue-6.1/arm64-dts-qcom-sm8350-fix-cpu-idle-state-residency-t.patch new file mode 100644 index 00000000000..1cf1b6e9285 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8350-fix-cpu-idle-state-residency-t.patch @@ -0,0 +1,50 @@ +From ee9278c5187eeae263a82dbcdfd929016993d954 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jul 2023 15:36:22 +0200 +Subject: arm64: dts: qcom: sm8350: Fix CPU idle state residency times + +From: Konrad Dybcio + +[ Upstream commit 91ce3693e2fb685f31d39605a5ad1fbd940804da ] + +The present values look to have been copypasted from 8150 or 8180. +Fix that. + +Fixes: 07ddb302811e ("arm64: dts: qcom: sm8350: Add CPU topology and idle-states") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230705-topic-sm8350_fixes-v1-2-0f69f70ccb6a@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8350.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi +index 7fd1c3f71c0f8..b91247856f9dc 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi +@@ -236,8 +236,8 @@ LITTLE_CPU_SLEEP_0: cpu-sleep-0-0 { + compatible = "arm,idle-state"; + idle-state-name = "silver-rail-power-collapse"; + arm,psci-suspend-param = <0x40000004>; +- entry-latency-us = <355>; +- exit-latency-us = <909>; ++ entry-latency-us = <360>; ++ exit-latency-us = <531>; + min-residency-us = <3934>; + local-timer-stop; + }; +@@ -246,8 +246,8 @@ BIG_CPU_SLEEP_0: cpu-sleep-1-0 { + compatible = "arm,idle-state"; + idle-state-name = "gold-rail-power-collapse"; + arm,psci-suspend-param = <0x40000004>; +- entry-latency-us = <241>; +- exit-latency-us = <1461>; ++ entry-latency-us = <702>; ++ exit-latency-us = <1061>; + min-residency-us = <4488>; + local-timer-stop; + }; +-- +2.40.1 + diff --git a/queue-6.1/arm64-dts-qcom-sm8350-use-proper-cpu-compatibles.patch b/queue-6.1/arm64-dts-qcom-sm8350-use-proper-cpu-compatibles.patch new file mode 100644 index 00000000000..4f9e7b479eb --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8350-use-proper-cpu-compatibles.patch @@ -0,0 +1,105 @@ +From a2e1eb2e984ebe8ad25df1dae8c853a40e3a2d57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 18:35:37 +0200 +Subject: arm64: dts: qcom: sm8350: Use proper CPU compatibles + +From: Konrad Dybcio + +[ Upstream commit 4390730cc12af25f7c997f477795f5f4200149c0 ] + +The Kryo names (once again) turned out to be fake. The CPUs report: + +0x412fd050 (CA55 r2p0) (0 - 3) +0x411fd410 (CA78 r1p1) (4 - 6) +0x411fd440 (CX1 r1p1) (7) + +Use the compatibles that reflect that. + +Fixes: b7e8f433a673 ("arm64: dts: qcom: Add basic devicetree support for SM8350 SoC") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230706-topic-sm8350-cpu-compat-v1-1-f8d6a1869781@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8350.dtsi | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi +index 0b5a1841d607d..b3245b13b2611 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi +@@ -63,7 +63,7 @@ cpus { + + CPU0: cpu@0 { + device_type = "cpu"; +- compatible = "qcom,kryo685"; ++ compatible = "arm,cortex-a55"; + reg = <0x0 0x0>; + enable-method = "psci"; + next-level-cache = <&L2_0>; +@@ -82,7 +82,7 @@ L3_0: l3-cache { + + CPU1: cpu@100 { + device_type = "cpu"; +- compatible = "qcom,kryo685"; ++ compatible = "arm,cortex-a55"; + reg = <0x0 0x100>; + enable-method = "psci"; + next-level-cache = <&L2_100>; +@@ -98,7 +98,7 @@ L2_100: l2-cache { + + CPU2: cpu@200 { + device_type = "cpu"; +- compatible = "qcom,kryo685"; ++ compatible = "arm,cortex-a55"; + reg = <0x0 0x200>; + enable-method = "psci"; + next-level-cache = <&L2_200>; +@@ -114,7 +114,7 @@ L2_200: l2-cache { + + CPU3: cpu@300 { + device_type = "cpu"; +- compatible = "qcom,kryo685"; ++ compatible = "arm,cortex-a55"; + reg = <0x0 0x300>; + enable-method = "psci"; + next-level-cache = <&L2_300>; +@@ -130,7 +130,7 @@ L2_300: l2-cache { + + CPU4: cpu@400 { + device_type = "cpu"; +- compatible = "qcom,kryo685"; ++ compatible = "arm,cortex-a78"; + reg = <0x0 0x400>; + enable-method = "psci"; + next-level-cache = <&L2_400>; +@@ -146,7 +146,7 @@ L2_400: l2-cache { + + CPU5: cpu@500 { + device_type = "cpu"; +- compatible = "qcom,kryo685"; ++ compatible = "arm,cortex-a78"; + reg = <0x0 0x500>; + enable-method = "psci"; + next-level-cache = <&L2_500>; +@@ -163,7 +163,7 @@ L2_500: l2-cache { + + CPU6: cpu@600 { + device_type = "cpu"; +- compatible = "qcom,kryo685"; ++ compatible = "arm,cortex-a78"; + reg = <0x0 0x600>; + enable-method = "psci"; + next-level-cache = <&L2_600>; +@@ -179,7 +179,7 @@ L2_600: l2-cache { + + CPU7: cpu@700 { + device_type = "cpu"; +- compatible = "qcom,kryo685"; ++ compatible = "arm,cortex-x1"; + reg = <0x0 0x700>; + enable-method = "psci"; + next-level-cache = <&L2_700>; +-- +2.40.1 + diff --git a/queue-6.1/arm64-fpsimd-only-provide-the-length-to-cpufeature-f.patch b/queue-6.1/arm64-fpsimd-only-provide-the-length-to-cpufeature-f.patch new file mode 100644 index 00000000000..6eb16afb87f --- /dev/null +++ b/queue-6.1/arm64-fpsimd-only-provide-the-length-to-cpufeature-f.patch @@ -0,0 +1,99 @@ +From df7a77ae87e642ff91b542a05c22a6d3a66d9fa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jul 2023 14:58:48 +0100 +Subject: arm64/fpsimd: Only provide the length to cpufeature for xCR registers + +From: Mark Brown + +[ Upstream commit 01948b09edc3fecf8486c57c2d2fb8b80886f3d0 ] + +For both SVE and SME we abuse the generic register field comparison +support in the cpufeature code as part of our detection of unsupported +variations in the vector lengths available to PEs, reporting the maximum +vector lengths via ZCR_EL1.LEN and SMCR_EL1.LEN. Since these are +configuration registers rather than identification registers the +assumptions the cpufeature code makes about how unknown bitfields behave +are invalid, leading to warnings when SME features like FA64 are enabled +and we hotplug a CPU: + + CPU features: SANITY CHECK: Unexpected variation in SYS_SMCR_EL1. Boot CPU: 0x0000000000000f, CPU3: 0x0000008000000f + CPU features: Unsupported CPU feature variation detected. + +SVE has no controls other than the vector length so is not yet impacted +but the same issue will apply there if any are defined. + +Since the only field we are interested in having the cpufeature code +handle is the length field and we use a custom read function to obtain +the value we can avoid these warnings by filtering out all other bits +when we return the register value, if we're doing that we don't need to +bother reading the register at all and can simply use the RDVL/RDSVL +value we were filling in instead. + +Fixes: 2e0f2478ea37 ("arm64/sve: Probe SVE capabilities and usable vector lengths") +FixeS: b42990d3bf77 ("arm64/sme: Identify supported SME vector lengths at boot") +Signed-off-by: Mark Brown +Reviewed-by: Catalin Marinas +Link: https://lore.kernel.org/r/20230731-arm64-sme-fa64-hotplug-v2-1-7714c00dd902@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/fpsimd.c | 22 ++++------------------ + 1 file changed, 4 insertions(+), 18 deletions(-) + +diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c +index 4aa579ff3125d..8c226d79abdfc 100644 +--- a/arch/arm64/kernel/fpsimd.c ++++ b/arch/arm64/kernel/fpsimd.c +@@ -1133,9 +1133,6 @@ void sve_kernel_enable(const struct arm64_cpu_capabilities *__always_unused p) + */ + u64 read_zcr_features(void) + { +- u64 zcr; +- unsigned int vq_max; +- + /* + * Set the maximum possible VL, and write zeroes to all other + * bits to see if they stick. +@@ -1143,12 +1140,8 @@ u64 read_zcr_features(void) + sve_kernel_enable(NULL); + write_sysreg_s(ZCR_ELx_LEN_MASK, SYS_ZCR_EL1); + +- zcr = read_sysreg_s(SYS_ZCR_EL1); +- zcr &= ~(u64)ZCR_ELx_LEN_MASK; /* find sticky 1s outside LEN field */ +- vq_max = sve_vq_from_vl(sve_get_vl()); +- zcr |= vq_max - 1; /* set LEN field to maximum effective value */ +- +- return zcr; ++ /* Return LEN value that would be written to get the maximum VL */ ++ return sve_vq_from_vl(sve_get_vl()) - 1; + } + + void __init sve_setup(void) +@@ -1292,9 +1285,6 @@ void fa64_kernel_enable(const struct arm64_cpu_capabilities *__always_unused p) + */ + u64 read_smcr_features(void) + { +- u64 smcr; +- unsigned int vq_max; +- + sme_kernel_enable(NULL); + + /* +@@ -1303,12 +1293,8 @@ u64 read_smcr_features(void) + write_sysreg_s(read_sysreg_s(SYS_SMCR_EL1) | SMCR_ELx_LEN_MASK, + SYS_SMCR_EL1); + +- smcr = read_sysreg_s(SYS_SMCR_EL1); +- smcr &= ~(u64)SMCR_ELx_LEN_MASK; /* Only the LEN field */ +- vq_max = sve_vq_from_vl(sme_get_vl()); +- smcr |= vq_max - 1; /* set LEN field to maximum effective value */ +- +- return smcr; ++ /* Return LEN value that would be written to get the maximum VL */ ++ return sve_vq_from_vl(sme_get_vl()) - 1; + } + + void __init sme_setup(void) +-- +2.40.1 + diff --git a/queue-6.1/arm64-mm-use-ptep_clear-instead-of-pte_clear-in-clea.patch b/queue-6.1/arm64-mm-use-ptep_clear-instead-of-pte_clear-in-clea.patch new file mode 100644 index 00000000000..d492b29ef94 --- /dev/null +++ b/queue-6.1/arm64-mm-use-ptep_clear-instead-of-pte_clear-in-clea.patch @@ -0,0 +1,44 @@ +From c37a34900578f5e3ccd3835759da07932851741c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 09:32:41 +0000 +Subject: arm64: mm: use ptep_clear() instead of pte_clear() in clear_flush() + +From: Qi Zheng + +[ Upstream commit 00de2c9f26b15f1a6f2af516dd8ec5f8d28189b7 ] + +In clear_flush(), the original pte may be a present entry, so we should +use ptep_clear() to let page_table_check track the pte clearing operation, +otherwise it may cause false positive in subsequent set_pte_at(). + +Link: https://lkml.kernel.org/r/20230810093241.1181142-1-qi.zheng@linux.dev +Fixes: 42b2547137f5 ("arm64/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK") +Signed-off-by: Qi Zheng +Acked-by: Will Deacon +Cc: Catalin Marinas +Cc: Kefeng Wang +Cc: Muchun Song +Cc: Pasha Tatashin +Cc: Qi Zheng +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/arm64/mm/hugetlbpage.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c +index 35e9a468d13e6..134dcf6bc650c 100644 +--- a/arch/arm64/mm/hugetlbpage.c ++++ b/arch/arm64/mm/hugetlbpage.c +@@ -236,7 +236,7 @@ static void clear_flush(struct mm_struct *mm, + unsigned long i, saddr = addr; + + for (i = 0; i < ncontig; i++, addr += pgsize, ptep++) +- pte_clear(mm, addr, ptep); ++ ptep_clear(mm, addr, ptep); + + flush_tlb_range(&vma, saddr, addr); + } +-- +2.40.1 + diff --git a/queue-6.1/arm64-ptrace-clean-up-error-handling-path-in-sve_set.patch b/queue-6.1/arm64-ptrace-clean-up-error-handling-path-in-sve_set.patch new file mode 100644 index 00000000000..c95501072d3 --- /dev/null +++ b/queue-6.1/arm64-ptrace-clean-up-error-handling-path-in-sve_set.patch @@ -0,0 +1,40 @@ +From aefc1a246b038d694e4db17179aa08a6f90f4981 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 19:55:05 +0200 +Subject: arm64/ptrace: Clean up error handling path in sve_set_common() + +From: Christophe JAILLET + +[ Upstream commit 5f69ca4229c7d8e23f238174827ee7aa49b0bcb2 ] + +All error handling paths go to 'out', except this one. Be consistent and +also branch to 'out' here. + +Fixes: e12310a0d30f ("arm64/sme: Implement ptrace support for streaming mode SVE registers") +Signed-off-by: Christophe JAILLET +Reviewed-by: Mark Brown +Reviewed-by: Anshuman Khandual +Link: https://lore.kernel.org/r/aa61301ed2dfd079b74b37f7fede5f179ac3087a.1689616473.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/ptrace.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c +index f606c942f514e..e1f6366b7ccdf 100644 +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -896,7 +896,8 @@ static int sve_set_common(struct task_struct *target, + break; + default: + WARN_ON_ONCE(1); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out; + } + + /* +-- +2.40.1 + diff --git a/queue-6.1/arm64-sme-don-t-use-streaming-mode-to-probe-the-maxi.patch b/queue-6.1/arm64-sme-don-t-use-streaming-mode-to-probe-the-maxi.patch new file mode 100644 index 00000000000..8da567603f4 --- /dev/null +++ b/queue-6.1/arm64-sme-don-t-use-streaming-mode-to-probe-the-maxi.patch @@ -0,0 +1,52 @@ +From 869596c1448f921fd61f5ee5182a012d10eba10d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Dec 2022 13:04:35 +0000 +Subject: arm64/sme: Don't use streaming mode to probe the maximum SME VL + +From: Mark Brown + +[ Upstream commit fcd3d2c082b2a19da2326b2b38ba5a05536dcd32 ] + +During development the architecture added the RDSVL instruction which means +we do not need to enter streaming mode to enumerate the SME VLs, use it +when we probe the maximum supported VL. Other users were already updated. + +No functional change. + +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20221223-arm64-sme-probe-max-v1-1-cbde68f67ad0@kernel.org +Signed-off-by: Catalin Marinas +Stable-dep-of: 01948b09edc3 ("arm64/fpsimd: Only provide the length to cpufeature for xCR registers") +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/fpsimd.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c +index 8cd59d387b90b..4aa579ff3125d 100644 +--- a/arch/arm64/kernel/fpsimd.c ++++ b/arch/arm64/kernel/fpsimd.c +@@ -1296,7 +1296,6 @@ u64 read_smcr_features(void) + unsigned int vq_max; + + sme_kernel_enable(NULL); +- sme_smstart_sm(); + + /* + * Set the maximum possible VL. +@@ -1306,11 +1305,9 @@ u64 read_smcr_features(void) + + smcr = read_sysreg_s(SYS_SMCR_EL1); + smcr &= ~(u64)SMCR_ELx_LEN_MASK; /* Only the LEN field */ +- vq_max = sve_vq_from_vl(sve_get_vl()); ++ vq_max = sve_vq_from_vl(sme_get_vl()); + smcr |= vq_max - 1; /* set LEN field to maximum effective value */ + +- sme_smstop_sm(); +- + return smcr; + } + +-- +2.40.1 + diff --git a/queue-6.1/arm64-tegra-fix-hsuart-for-jetson-agx-orin.patch b/queue-6.1/arm64-tegra-fix-hsuart-for-jetson-agx-orin.patch new file mode 100644 index 00000000000..812e6eace82 --- /dev/null +++ b/queue-6.1/arm64-tegra-fix-hsuart-for-jetson-agx-orin.patch @@ -0,0 +1,47 @@ +From 7d75b5d6f7e4986af333f4c3083d7bd2a9efb868 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 12:36:17 +0100 +Subject: arm64: tegra: Fix HSUART for Jetson AGX Orin + +From: Jon Hunter + +[ Upstream commit 861dbb2b15b1049113887fb95e856f7123eea0cc ] + +After commit 71de0a054d0e ("arm64: tegra: Drop serial clock-names and +reset-names") was applied, the HSUART failed to probe and the following +error is seen: + + serial-tegra 3100000.serial: Couldn't get the reset + serial-tegra: probe of 3100000.serial failed with error -2 + +Commit 71de0a054d0e ("arm64: tegra: Drop serial clock-names and +reset-names") is correct because the "reset-names" property is not +needed for 8250 UARTs. However, the "reset-names" is required for the +HSUART and should have been populated as part of commit ff578db7b693 +("arm64: tegra: Enable UART instance on 40-pin header") that +enabled the HSUART for Jetson AGX Orin. Fix this by populating the +"reset-names" property for the HSUART on Jetson AGX Orin. + +Fixes: ff578db7b693 ("arm64: tegra: Enable UART instance on 40-pin header") +Signed-off-by: Jon Hunter +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts +index 57ab753288144..f094011be9ed9 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts +@@ -2004,6 +2004,7 @@ interrupt-controller@2a40000 { + + serial@3100000 { + compatible = "nvidia,tegra194-hsuart"; ++ reset-names = "serial"; + status = "okay"; + }; + +-- +2.40.1 + diff --git a/queue-6.1/arm64-tegra-fix-hsuart-for-smaug.patch b/queue-6.1/arm64-tegra-fix-hsuart-for-smaug.patch new file mode 100644 index 00000000000..9d0bbed95bb --- /dev/null +++ b/queue-6.1/arm64-tegra-fix-hsuart-for-smaug.patch @@ -0,0 +1,48 @@ +From 92990f14fd0dafe4be82eea110da838afea1d30e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jul 2023 11:10:17 +0100 +Subject: arm64: tegra: Fix HSUART for Smaug + +From: Diogo Ivo + +[ Upstream commit 590bfe51838f6345a6a3288507661dc9b7208464 ] + +After commit 71de0a054d0e ("arm64: tegra: Drop serial clock-names and +reset-names") was applied, the HSUART failed to probe and the following +error is seen: + + serial-tegra 70006300.serial: Couldn't get the reset + serial-tegra: probe of 70006300.serial failed with error -2 + +Commit 71de0a054d0e ("arm64: tegra: Drop serial clock-names and +reset-names") is correct because the "reset-names" property is not +needed for 8250 UARTs. However, the "reset-names" is required for the +HSUART and should have been populated as part of commit a63c0cd83720c +("arm64: dts: tegra: smaug: Add Bluetooth node") that enabled the HSUART +for the Pixel C. Fix this by populating the "reset-names" property for +the HSUART on the Pixel C. + +Fixes: a63c0cd83720 ("arm64: dts: tegra: smaug: Add Bluetooth node") +Signed-off-by: Diogo Ivo +Reviewed-by: Jon Hunter +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +index 7c569695b7052..2b4dbfac84a70 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +@@ -1312,6 +1312,7 @@ serial@70006000 { + + uartd: serial@70006300 { + compatible = "nvidia,tegra30-hsuart"; ++ reset-names = "serial"; + status = "okay"; + + bluetooth { +-- +2.40.1 + diff --git a/queue-6.1/asoc-cs43130-fix-numerator-denominator-mixup.patch b/queue-6.1/asoc-cs43130-fix-numerator-denominator-mixup.patch new file mode 100644 index 00000000000..61431f9642f --- /dev/null +++ b/queue-6.1/asoc-cs43130-fix-numerator-denominator-mixup.patch @@ -0,0 +1,194 @@ +From 2c8b90aa898df6d24be55f18b93aa5b42b25610f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 16:32:29 +0100 +Subject: ASoC: cs43130: Fix numerator/denominator mixup + +From: Phil Elwell + +[ Upstream commit a9e7c964cea4fb1541cc81a11d1b2fd135f4cf38 ] + +In converting to using the standard u16_fract type, commit [1] made the +obvious mistake and failed to take account of the difference in +numerator and denominator ordering, breaking all uses of the cs43130 +codec. + +Fix it. + +[1] commit e14bd35ef446 ("ASoC: cs43130: Re-use generic struct u16_fract") + +Fixes: e14bd35ef446 ("ASoC: cs43130: Re-use generic struct u16_fract") +Signed-off-by: Phil Elwell +Reviewed-by: Andy Shevchenko +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20230621153229.1944132-1-phil@raspberrypi.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs43130.h | 138 ++++++++++++++++++------------------- + 1 file changed, 69 insertions(+), 69 deletions(-) + +diff --git a/sound/soc/codecs/cs43130.h b/sound/soc/codecs/cs43130.h +index 1dd8936743132..90e8895275e77 100644 +--- a/sound/soc/codecs/cs43130.h ++++ b/sound/soc/codecs/cs43130.h +@@ -381,88 +381,88 @@ struct cs43130_clk_gen { + + /* frm_size = 16 */ + static const struct cs43130_clk_gen cs43130_16_clk_gen[] = { +- { 22579200, 32000, .v = { 441, 10, }, }, +- { 22579200, 44100, .v = { 32, 1, }, }, +- { 22579200, 48000, .v = { 147, 5, }, }, +- { 22579200, 88200, .v = { 16, 1, }, }, +- { 22579200, 96000, .v = { 147, 10, }, }, +- { 22579200, 176400, .v = { 8, 1, }, }, +- { 22579200, 192000, .v = { 147, 20, }, }, +- { 22579200, 352800, .v = { 4, 1, }, }, +- { 22579200, 384000, .v = { 147, 40, }, }, +- { 24576000, 32000, .v = { 48, 1, }, }, +- { 24576000, 44100, .v = { 5120, 147, }, }, +- { 24576000, 48000, .v = { 32, 1, }, }, +- { 24576000, 88200, .v = { 2560, 147, }, }, +- { 24576000, 96000, .v = { 16, 1, }, }, +- { 24576000, 176400, .v = { 1280, 147, }, }, +- { 24576000, 192000, .v = { 8, 1, }, }, +- { 24576000, 352800, .v = { 640, 147, }, }, +- { 24576000, 384000, .v = { 4, 1, }, }, ++ { 22579200, 32000, .v = { 10, 441, }, }, ++ { 22579200, 44100, .v = { 1, 32, }, }, ++ { 22579200, 48000, .v = { 5, 147, }, }, ++ { 22579200, 88200, .v = { 1, 16, }, }, ++ { 22579200, 96000, .v = { 10, 147, }, }, ++ { 22579200, 176400, .v = { 1, 8, }, }, ++ { 22579200, 192000, .v = { 20, 147, }, }, ++ { 22579200, 352800, .v = { 1, 4, }, }, ++ { 22579200, 384000, .v = { 40, 147, }, }, ++ { 24576000, 32000, .v = { 1, 48, }, }, ++ { 24576000, 44100, .v = { 147, 5120, }, }, ++ { 24576000, 48000, .v = { 1, 32, }, }, ++ { 24576000, 88200, .v = { 147, 2560, }, }, ++ { 24576000, 96000, .v = { 1, 16, }, }, ++ { 24576000, 176400, .v = { 147, 1280, }, }, ++ { 24576000, 192000, .v = { 1, 8, }, }, ++ { 24576000, 352800, .v = { 147, 640, }, }, ++ { 24576000, 384000, .v = { 1, 4, }, }, + }; + + /* frm_size = 32 */ + static const struct cs43130_clk_gen cs43130_32_clk_gen[] = { +- { 22579200, 32000, .v = { 441, 20, }, }, +- { 22579200, 44100, .v = { 16, 1, }, }, +- { 22579200, 48000, .v = { 147, 10, }, }, +- { 22579200, 88200, .v = { 8, 1, }, }, +- { 22579200, 96000, .v = { 147, 20, }, }, +- { 22579200, 176400, .v = { 4, 1, }, }, +- { 22579200, 192000, .v = { 147, 40, }, }, +- { 22579200, 352800, .v = { 2, 1, }, }, +- { 22579200, 384000, .v = { 147, 80, }, }, +- { 24576000, 32000, .v = { 24, 1, }, }, +- { 24576000, 44100, .v = { 2560, 147, }, }, +- { 24576000, 48000, .v = { 16, 1, }, }, +- { 24576000, 88200, .v = { 1280, 147, }, }, +- { 24576000, 96000, .v = { 8, 1, }, }, +- { 24576000, 176400, .v = { 640, 147, }, }, +- { 24576000, 192000, .v = { 4, 1, }, }, +- { 24576000, 352800, .v = { 320, 147, }, }, +- { 24576000, 384000, .v = { 2, 1, }, }, ++ { 22579200, 32000, .v = { 20, 441, }, }, ++ { 22579200, 44100, .v = { 1, 16, }, }, ++ { 22579200, 48000, .v = { 10, 147, }, }, ++ { 22579200, 88200, .v = { 1, 8, }, }, ++ { 22579200, 96000, .v = { 20, 147, }, }, ++ { 22579200, 176400, .v = { 1, 4, }, }, ++ { 22579200, 192000, .v = { 40, 147, }, }, ++ { 22579200, 352800, .v = { 1, 2, }, }, ++ { 22579200, 384000, .v = { 80, 147, }, }, ++ { 24576000, 32000, .v = { 1, 24, }, }, ++ { 24576000, 44100, .v = { 147, 2560, }, }, ++ { 24576000, 48000, .v = { 1, 16, }, }, ++ { 24576000, 88200, .v = { 147, 1280, }, }, ++ { 24576000, 96000, .v = { 1, 8, }, }, ++ { 24576000, 176400, .v = { 147, 640, }, }, ++ { 24576000, 192000, .v = { 1, 4, }, }, ++ { 24576000, 352800, .v = { 147, 320, }, }, ++ { 24576000, 384000, .v = { 1, 2, }, }, + }; + + /* frm_size = 48 */ + static const struct cs43130_clk_gen cs43130_48_clk_gen[] = { +- { 22579200, 32000, .v = { 147, 100, }, }, +- { 22579200, 44100, .v = { 32, 3, }, }, +- { 22579200, 48000, .v = { 49, 5, }, }, +- { 22579200, 88200, .v = { 16, 3, }, }, +- { 22579200, 96000, .v = { 49, 10, }, }, +- { 22579200, 176400, .v = { 8, 3, }, }, +- { 22579200, 192000, .v = { 49, 20, }, }, +- { 22579200, 352800, .v = { 4, 3, }, }, +- { 22579200, 384000, .v = { 49, 40, }, }, +- { 24576000, 32000, .v = { 16, 1, }, }, +- { 24576000, 44100, .v = { 5120, 441, }, }, +- { 24576000, 48000, .v = { 32, 3, }, }, +- { 24576000, 88200, .v = { 2560, 441, }, }, +- { 24576000, 96000, .v = { 16, 3, }, }, +- { 24576000, 176400, .v = { 1280, 441, }, }, +- { 24576000, 192000, .v = { 8, 3, }, }, +- { 24576000, 352800, .v = { 640, 441, }, }, +- { 24576000, 384000, .v = { 4, 3, }, }, ++ { 22579200, 32000, .v = { 100, 147, }, }, ++ { 22579200, 44100, .v = { 3, 32, }, }, ++ { 22579200, 48000, .v = { 5, 49, }, }, ++ { 22579200, 88200, .v = { 3, 16, }, }, ++ { 22579200, 96000, .v = { 10, 49, }, }, ++ { 22579200, 176400, .v = { 3, 8, }, }, ++ { 22579200, 192000, .v = { 20, 49, }, }, ++ { 22579200, 352800, .v = { 3, 4, }, }, ++ { 22579200, 384000, .v = { 40, 49, }, }, ++ { 24576000, 32000, .v = { 1, 16, }, }, ++ { 24576000, 44100, .v = { 441, 5120, }, }, ++ { 24576000, 48000, .v = { 3, 32, }, }, ++ { 24576000, 88200, .v = { 441, 2560, }, }, ++ { 24576000, 96000, .v = { 3, 16, }, }, ++ { 24576000, 176400, .v = { 441, 1280, }, }, ++ { 24576000, 192000, .v = { 3, 8, }, }, ++ { 24576000, 352800, .v = { 441, 640, }, }, ++ { 24576000, 384000, .v = { 3, 4, }, }, + }; + + /* frm_size = 64 */ + static const struct cs43130_clk_gen cs43130_64_clk_gen[] = { +- { 22579200, 32000, .v = { 441, 40, }, }, +- { 22579200, 44100, .v = { 8, 1, }, }, +- { 22579200, 48000, .v = { 147, 20, }, }, +- { 22579200, 88200, .v = { 4, 1, }, }, +- { 22579200, 96000, .v = { 147, 40, }, }, +- { 22579200, 176400, .v = { 2, 1, }, }, +- { 22579200, 192000, .v = { 147, 80, }, }, ++ { 22579200, 32000, .v = { 40, 441, }, }, ++ { 22579200, 44100, .v = { 1, 8, }, }, ++ { 22579200, 48000, .v = { 20, 147, }, }, ++ { 22579200, 88200, .v = { 1, 4, }, }, ++ { 22579200, 96000, .v = { 40, 147, }, }, ++ { 22579200, 176400, .v = { 1, 2, }, }, ++ { 22579200, 192000, .v = { 80, 147, }, }, + { 22579200, 352800, .v = { 1, 1, }, }, +- { 24576000, 32000, .v = { 12, 1, }, }, +- { 24576000, 44100, .v = { 1280, 147, }, }, +- { 24576000, 48000, .v = { 8, 1, }, }, +- { 24576000, 88200, .v = { 640, 147, }, }, +- { 24576000, 96000, .v = { 4, 1, }, }, +- { 24576000, 176400, .v = { 320, 147, }, }, +- { 24576000, 192000, .v = { 2, 1, }, }, +- { 24576000, 352800, .v = { 160, 147, }, }, ++ { 24576000, 32000, .v = { 1, 12, }, }, ++ { 24576000, 44100, .v = { 147, 1280, }, }, ++ { 24576000, 48000, .v = { 1, 8, }, }, ++ { 24576000, 88200, .v = { 147, 640, }, }, ++ { 24576000, 96000, .v = { 1, 4, }, }, ++ { 24576000, 176400, .v = { 147, 320, }, }, ++ { 24576000, 192000, .v = { 1, 2, }, }, ++ { 24576000, 352800, .v = { 147, 160, }, }, + { 24576000, 384000, .v = { 1, 1, }, }, + }; + +-- +2.40.1 + diff --git a/queue-6.1/asoc-sof-amd-clear-dsp-to-host-interrupt-status.patch b/queue-6.1/asoc-sof-amd-clear-dsp-to-host-interrupt-status.patch new file mode 100644 index 00000000000..2134998d758 --- /dev/null +++ b/queue-6.1/asoc-sof-amd-clear-dsp-to-host-interrupt-status.patch @@ -0,0 +1,46 @@ +From 67bda1dab551d34207e1a39e57aa1d26dc7fc9e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Aug 2023 13:03:39 +0530 +Subject: ASoC: SOF: amd: clear dsp to host interrupt status + +From: Vijendar Mukunda + +[ Upstream commit 38592ae6dc9f84b7a994c43de2136b8115ca30f6 ] + +DSP_SW_INTR_STAT_OFFSET is a common interrupt register which will be +accessed by both ACP firmware and driver. This register contains register +bits corresponds to host to dsp interrupts and vice versa. + +when dsp to host interrupt is reported, only clear dsp to host +interrupt bit in DSP_SW_INTR_STAT_OFFSET. + +Fixes: 2e7c6652f9b8 ("ASoC: SOF: amd: Fix for handling spurious interrupts from DSP") + +Signed-off-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/20230823073340.2829821-7-Vijendar.Mukunda@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/amd/acp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/sof/amd/acp.c b/sound/soc/sof/amd/acp.c +index 8afd67ba1e5a3..f8d2372a758f4 100644 +--- a/sound/soc/sof/amd/acp.c ++++ b/sound/soc/sof/amd/acp.c +@@ -349,9 +349,9 @@ static irqreturn_t acp_irq_handler(int irq, void *dev_id) + unsigned int val; + + val = snd_sof_dsp_read(sdev, ACP_DSP_BAR, base + DSP_SW_INTR_STAT_OFFSET); +- if (val) { +- val |= ACP_DSP_TO_HOST_IRQ; +- snd_sof_dsp_write(sdev, ACP_DSP_BAR, base + DSP_SW_INTR_STAT_OFFSET, val); ++ if (val & ACP_DSP_TO_HOST_IRQ) { ++ snd_sof_dsp_write(sdev, ACP_DSP_BAR, base + DSP_SW_INTR_STAT_OFFSET, ++ ACP_DSP_TO_HOST_IRQ); + return IRQ_WAKE_THREAD; + } + +-- +2.40.1 + diff --git a/queue-6.1/asoc-stac9766-fix-build-errors-with-regmap_ac97.patch b/queue-6.1/asoc-stac9766-fix-build-errors-with-regmap_ac97.patch new file mode 100644 index 00000000000..91fdb19b81d --- /dev/null +++ b/queue-6.1/asoc-stac9766-fix-build-errors-with-regmap_ac97.patch @@ -0,0 +1,42 @@ +From 6c1645bb874f3998cc13bf1e267808b6ba229c33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 21:48:36 -0700 +Subject: ASoC: stac9766: fix build errors with REGMAP_AC97 + +From: Randy Dunlap + +[ Upstream commit c70064b96f509daa78f57992aeabcf274fb2fed4 ] + +Select REGMAP_AC97 to fix these build errors: + +ERROR: modpost: "regmap_ac97_default_volatile" [sound/soc/codecs/snd-soc-stac9766.ko] undefined! +ERROR: modpost: "__regmap_init_ac97" [sound/soc/codecs/snd-soc-stac9766.ko] undefined! + +Fixes: 6bbf787bb70c ("ASoC: stac9766: Convert to regmap") +Signed-off-by: Randy Dunlap +Cc: Lars-Peter Clausen +Cc: Mark Brown +Cc: Liam Girdwood +Cc: alsa-devel@alsa-project.org +Link: https://lore.kernel.org/r/20230701044836.18789-1-rdunlap@infradead.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index 965ae55fa1607..0904827e2f3db 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -1552,6 +1552,7 @@ config SND_SOC_STA529 + config SND_SOC_STAC9766 + tristate + depends on SND_SOC_AC97_BUS ++ select REGMAP_AC97 + + config SND_SOC_STI_SAS + tristate "codec Audio support for STI SAS codec" +-- +2.40.1 + diff --git a/queue-6.1/audit-fix-possible-soft-lockup-in-__audit_inode_chil.patch b/queue-6.1/audit-fix-possible-soft-lockup-in-__audit_inode_chil.patch new file mode 100644 index 00000000000..d3f472cd247 --- /dev/null +++ b/queue-6.1/audit-fix-possible-soft-lockup-in-__audit_inode_chil.patch @@ -0,0 +1,80 @@ +From 8899974618c2ec9338da0be32da0a7d034d66db3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Aug 2023 20:14:35 +0800 +Subject: audit: fix possible soft lockup in __audit_inode_child() + +From: Gaosheng Cui + +[ Upstream commit b59bc6e37237e37eadf50cd5de369e913f524463 ] + +Tracefs or debugfs maybe cause hundreds to thousands of PATH records, +too many PATH records maybe cause soft lockup. + +For example: + 1. CONFIG_KASAN=y && CONFIG_PREEMPTION=n + 2. auditctl -a exit,always -S open -k key + 3. sysctl -w kernel.watchdog_thresh=5 + 4. mkdir /sys/kernel/debug/tracing/instances/test + +There may be a soft lockup as follows: + watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498] + Kernel panic - not syncing: softlockup: hung tasks + Call trace: + dump_backtrace+0x0/0x30c + show_stack+0x20/0x30 + dump_stack+0x11c/0x174 + panic+0x27c/0x494 + watchdog_timer_fn+0x2bc/0x390 + __run_hrtimer+0x148/0x4fc + __hrtimer_run_queues+0x154/0x210 + hrtimer_interrupt+0x2c4/0x760 + arch_timer_handler_phys+0x48/0x60 + handle_percpu_devid_irq+0xe0/0x340 + __handle_domain_irq+0xbc/0x130 + gic_handle_irq+0x78/0x460 + el1_irq+0xb8/0x140 + __audit_inode_child+0x240/0x7bc + tracefs_create_file+0x1b8/0x2a0 + trace_create_file+0x18/0x50 + event_create_dir+0x204/0x30c + __trace_add_new_event+0xac/0x100 + event_trace_add_tracer+0xa0/0x130 + trace_array_create_dir+0x60/0x140 + trace_array_create+0x1e0/0x370 + instance_mkdir+0x90/0xd0 + tracefs_syscall_mkdir+0x68/0xa0 + vfs_mkdir+0x21c/0x34c + do_mkdirat+0x1b4/0x1d4 + __arm64_sys_mkdirat+0x4c/0x60 + el0_svc_common.constprop.0+0xa8/0x240 + do_el0_svc+0x8c/0xc0 + el0_svc+0x20/0x30 + el0_sync_handler+0xb0/0xb4 + el0_sync+0x160/0x180 + +Therefore, we add cond_resched() to __audit_inode_child() to fix it. + +Fixes: 5195d8e217a7 ("audit: dynamically allocate audit_names when not enough space is in the names array") +Signed-off-by: Gaosheng Cui +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + kernel/auditsc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index 9f8c05228d6d6..a2240f54fc224 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -2456,6 +2456,8 @@ void __audit_inode_child(struct inode *parent, + } + } + ++ cond_resched(); ++ + /* is there a matching child entry? */ + list_for_each_entry(n, &context->names_list, list) { + /* can only match entries that have a name */ +-- +2.40.1 + diff --git a/queue-6.1/block-cleanup-queue_wc_store.patch b/queue-6.1/block-cleanup-queue_wc_store.patch new file mode 100644 index 00000000000..00192353003 --- /dev/null +++ b/queue-6.1/block-cleanup-queue_wc_store.patch @@ -0,0 +1,53 @@ +From 5b347b7afc92b985c351b0a054cff1f6417ad259 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 11:42:38 +0200 +Subject: block: cleanup queue_wc_store + +From: Christoph Hellwig + +[ Upstream commit c4e21bcd0f9d01f9c5d6c52007f5541871a5b1de ] + +Get rid of the local queue_wc_store variable and handling setting and +clearing the QUEUE_FLAG_WC flag diretly instead the if / else if. + +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20230707094239.107968-2-hch@lst.de +Signed-off-by: Jens Axboe +Stable-dep-of: 43c9835b144c ("block: don't allow enabling a cache on devices that don't support it") +Signed-off-by: Sasha Levin +--- + block/blk-sysfs.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index e71b3b43927c0..4f34525bafac7 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -528,21 +528,13 @@ static ssize_t queue_wc_show(struct request_queue *q, char *page) + static ssize_t queue_wc_store(struct request_queue *q, const char *page, + size_t count) + { +- int set = -1; +- + if (!strncmp(page, "write back", 10)) +- set = 1; ++ blk_queue_flag_set(QUEUE_FLAG_WC, q); + else if (!strncmp(page, "write through", 13) || + !strncmp(page, "none", 4)) +- set = 0; +- +- if (set == -1) +- return -EINVAL; +- +- if (set) +- blk_queue_flag_set(QUEUE_FLAG_WC, q); +- else + blk_queue_flag_clear(QUEUE_FLAG_WC, q); ++ else ++ return -EINVAL; + + return count; + } +-- +2.40.1 + diff --git a/queue-6.1/block-don-t-allow-enabling-a-cache-on-devices-that-d.patch b/queue-6.1/block-don-t-allow-enabling-a-cache-on-devices-that-d.patch new file mode 100644 index 00000000000..529a1e0dbdd --- /dev/null +++ b/queue-6.1/block-don-t-allow-enabling-a-cache-on-devices-that-d.patch @@ -0,0 +1,89 @@ +From 1a6827900830ea949779145d93e043653f27cac9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 11:42:39 +0200 +Subject: block: don't allow enabling a cache on devices that don't support it + +From: Christoph Hellwig + +[ Upstream commit 43c9835b144c7ce29efe142d662529662a9eb376 ] + +Currently the write_cache attribute allows enabling the QUEUE_FLAG_WC +flag on devices that never claimed the capability. + +Fix that by adding a QUEUE_FLAG_HW_WC flag that is set by +blk_queue_write_cache and guards re-enabling the cache through sysfs. + +Note that any rescan that calls blk_queue_write_cache will still +re-enable the write cache as in the current code. + +Fixes: 93e9d8e836cb ("block: add ability to flag write back caching on a device") +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20230707094239.107968-3-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 7 +++++-- + block/blk-sysfs.c | 11 +++++++---- + include/linux/blkdev.h | 1 + + 3 files changed, 13 insertions(+), 6 deletions(-) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 291cf9df7fc29..86ff375c00ce4 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -824,10 +824,13 @@ EXPORT_SYMBOL(blk_set_queue_depth); + */ + void blk_queue_write_cache(struct request_queue *q, bool wc, bool fua) + { +- if (wc) ++ if (wc) { ++ blk_queue_flag_set(QUEUE_FLAG_HW_WC, q); + blk_queue_flag_set(QUEUE_FLAG_WC, q); +- else ++ } else { ++ blk_queue_flag_clear(QUEUE_FLAG_HW_WC, q); + blk_queue_flag_clear(QUEUE_FLAG_WC, q); ++ } + if (fua) + blk_queue_flag_set(QUEUE_FLAG_FUA, q); + else +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index 4f34525bafac7..a582ea0da74f5 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -528,13 +528,16 @@ static ssize_t queue_wc_show(struct request_queue *q, char *page) + static ssize_t queue_wc_store(struct request_queue *q, const char *page, + size_t count) + { +- if (!strncmp(page, "write back", 10)) ++ if (!strncmp(page, "write back", 10)) { ++ if (!test_bit(QUEUE_FLAG_HW_WC, &q->queue_flags)) ++ return -EINVAL; + blk_queue_flag_set(QUEUE_FLAG_WC, q); +- else if (!strncmp(page, "write through", 13) || +- !strncmp(page, "none", 4)) ++ } else if (!strncmp(page, "write through", 13) || ++ !strncmp(page, "none", 4)) { + blk_queue_flag_clear(QUEUE_FLAG_WC, q); +- else ++ } else { + return -EINVAL; ++ } + + return count; + } +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index 427e79ac72194..57674b3c58774 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -565,6 +565,7 @@ struct request_queue { + #define QUEUE_FLAG_NOXMERGES 9 /* No extended merges */ + #define QUEUE_FLAG_ADD_RANDOM 10 /* Contributes to random pool */ + #define QUEUE_FLAG_SAME_FORCE 12 /* force complete on same CPU */ ++#define QUEUE_FLAG_HW_WC 18 /* Write back caching supported */ + #define QUEUE_FLAG_INIT_DONE 14 /* queue is initialized */ + #define QUEUE_FLAG_STABLE_WRITES 15 /* don't modify blks until WB is done */ + #define QUEUE_FLAG_POLL 16 /* IO polling enabled if set */ +-- +2.40.1 + diff --git a/queue-6.1/block-mq-deadline-use-correct-way-to-throttling-writ.patch b/queue-6.1/block-mq-deadline-use-correct-way-to-throttling-writ.patch new file mode 100644 index 00000000000..654d0cb2ddb --- /dev/null +++ b/queue-6.1/block-mq-deadline-use-correct-way-to-throttling-writ.patch @@ -0,0 +1,67 @@ +From 64b6da4155abdcff968250b63ecd1d163d0b19cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 19:12:42 +0800 +Subject: block/mq-deadline: use correct way to throttling write requests + +From: Zhiguo Niu + +[ Upstream commit d47f9717e5cfd0dd8c0ba2ecfa47c38d140f1bb6 ] + +The original formula was inaccurate: +dd->async_depth = max(1UL, 3 * q->nr_requests / 4); + +For write requests, when we assign a tags from sched_tags, +data->shallow_depth will be passed to sbitmap_find_bit, +see the following code: + +nr = sbitmap_find_bit_in_word(&sb->map[index], + min_t (unsigned int, + __map_depth(sb, index), + depth), + alloc_hint, wrap); + +The smaller of data->shallow_depth and __map_depth(sb, index) +will be used as the maximum range when allocating bits. + +For a mmc device (one hw queue, deadline I/O scheduler): +q->nr_requests = sched_tags = 128, so according to the previous +calculation method, dd->async_depth = data->shallow_depth = 96, +and the platform is 64bits with 8 cpus, sched_tags.bitmap_tags.sb.shift=5, +sb.maps[]=32/32/32/32, 32 is smaller than 96, whether it is a read or +a write I/O, tags can be allocated to the maximum range each time, +which has not throttling effect. + +In addition, refer to the methods of bfg/kyber I/O scheduler, +limit ratiois are calculated base on sched_tags.bitmap_tags.sb.shift. + +This patch can throttle write requests really. + +Fixes: 07757588e507 ("block/mq-deadline: Reserve 25% of scheduler tags for synchronous requests") + +Signed-off-by: Zhiguo Niu +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/1691061162-22898-1-git-send-email-zhiguo.niu@unisoc.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/mq-deadline.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/mq-deadline.c b/block/mq-deadline.c +index f10c2a0d18d41..55e26065c2e27 100644 +--- a/block/mq-deadline.c ++++ b/block/mq-deadline.c +@@ -622,8 +622,9 @@ static void dd_depth_updated(struct blk_mq_hw_ctx *hctx) + struct request_queue *q = hctx->queue; + struct deadline_data *dd = q->elevator->elevator_data; + struct blk_mq_tags *tags = hctx->sched_tags; ++ unsigned int shift = tags->bitmap_tags.sb.shift; + +- dd->async_depth = max(1UL, 3 * q->nr_requests / 4); ++ dd->async_depth = max(1U, 3 * (1U << shift) / 4); + + sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, dd->async_depth); + } +-- +2.40.1 + diff --git a/queue-6.1/bluetooth-btusb-do-not-call-kfree_skb-under-spin_loc.patch b/queue-6.1/bluetooth-btusb-do-not-call-kfree_skb-under-spin_loc.patch new file mode 100644 index 00000000000..347dca9a7de --- /dev/null +++ b/queue-6.1/bluetooth-btusb-do-not-call-kfree_skb-under-spin_loc.patch @@ -0,0 +1,38 @@ +From 2509e8a0614df5b99e11643942e657a0915f25d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Aug 2023 11:46:37 +0800 +Subject: Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave() + +From: Jinjie Ruan + +[ Upstream commit 2a05334d7f91ff189692089c05fc48cc1d8204de ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with hardware interrupts being disabled. +So replace kfree_skb() with dev_kfree_skb_irq() under +spin_lock_irqsave(). Compile tested only. + +Fixes: baac6276c0a9 ("Bluetooth: btusb: handle mSBC audio over USB Endpoints") +Signed-off-by: Jinjie Ruan +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index d6f405763c56f..f2062c2a28da8 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -1984,7 +1984,7 @@ static int btusb_switch_alt_setting(struct hci_dev *hdev, int new_alts) + * alternate setting. + */ + spin_lock_irqsave(&data->rxlock, flags); +- kfree_skb(data->sco_skb); ++ dev_kfree_skb_irq(data->sco_skb); + data->sco_skb = NULL; + spin_unlock_irqrestore(&data->rxlock, flags); + +-- +2.40.1 + diff --git a/queue-6.1/bluetooth-fix-potential-use-after-free-when-clear-ke.patch b/queue-6.1/bluetooth-fix-potential-use-after-free-when-clear-ke.patch new file mode 100644 index 00000000000..13c73d0bd93 --- /dev/null +++ b/queue-6.1/bluetooth-fix-potential-use-after-free-when-clear-ke.patch @@ -0,0 +1,76 @@ +From 7fdeb584125528f20afea94a809cf7957df72928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Aug 2023 19:07:41 +0800 +Subject: Bluetooth: Fix potential use-after-free when clear keys + +From: Min Li + +[ Upstream commit 3673952cf0c6cf81b06c66a0b788abeeb02ff3ae ] + +Similar to commit c5d2b6fa26b5 ("Bluetooth: Fix use-after-free in +hci_remove_ltk/hci_remove_irk"). We can not access k after kfree_rcu() +call. + +Fixes: d7d41682efc2 ("Bluetooth: Fix Suspicious RCU usage warnings") +Signed-off-by: Min Li +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index d034bf2a999e1..26884447d72be 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -1074,9 +1074,9 @@ void hci_uuids_clear(struct hci_dev *hdev) + + void hci_link_keys_clear(struct hci_dev *hdev) + { +- struct link_key *key; ++ struct link_key *key, *tmp; + +- list_for_each_entry(key, &hdev->link_keys, list) { ++ list_for_each_entry_safe(key, tmp, &hdev->link_keys, list) { + list_del_rcu(&key->list); + kfree_rcu(key, rcu); + } +@@ -1084,9 +1084,9 @@ void hci_link_keys_clear(struct hci_dev *hdev) + + void hci_smp_ltks_clear(struct hci_dev *hdev) + { +- struct smp_ltk *k; ++ struct smp_ltk *k, *tmp; + +- list_for_each_entry(k, &hdev->long_term_keys, list) { ++ list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) { + list_del_rcu(&k->list); + kfree_rcu(k, rcu); + } +@@ -1094,9 +1094,9 @@ void hci_smp_ltks_clear(struct hci_dev *hdev) + + void hci_smp_irks_clear(struct hci_dev *hdev) + { +- struct smp_irk *k; ++ struct smp_irk *k, *tmp; + +- list_for_each_entry(k, &hdev->identity_resolving_keys, list) { ++ list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) { + list_del_rcu(&k->list); + kfree_rcu(k, rcu); + } +@@ -1104,9 +1104,9 @@ void hci_smp_irks_clear(struct hci_dev *hdev) + + void hci_blocked_keys_clear(struct hci_dev *hdev) + { +- struct blocked_key *b; ++ struct blocked_key *b, *tmp; + +- list_for_each_entry(b, &hdev->blocked_keys, list) { ++ list_for_each_entry_safe(b, tmp, &hdev->blocked_keys, list) { + list_del_rcu(&b->list); + kfree_rcu(b, rcu); + } +-- +2.40.1 + diff --git a/queue-6.1/bluetooth-hci_sync-avoid-use-after-free-in-dbg-for-h.patch b/queue-6.1/bluetooth-hci_sync-avoid-use-after-free-in-dbg-for-h.patch new file mode 100644 index 00000000000..d7f6a1c3fd5 --- /dev/null +++ b/queue-6.1/bluetooth-hci_sync-avoid-use-after-free-in-dbg-for-h.patch @@ -0,0 +1,47 @@ +From ec0a018a1bff222d7b5dd9ca575ab70a295d6fda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 11:14:45 -0700 +Subject: Bluetooth: hci_sync: Avoid use-after-free in dbg for + hci_add_adv_monitor() + +From: Manish Mandlik + +[ Upstream commit a2bcd2b63271a93a695fabbfbf459c603d956d48 ] + +KSAN reports use-after-free in hci_add_adv_monitor(). + +While adding an adv monitor, + hci_add_adv_monitor() calls -> + msft_add_monitor_pattern() calls -> + msft_add_monitor_sync() calls -> + msft_le_monitor_advertisement_cb() calls in an error case -> + hci_free_adv_monitor() which frees the *moniter. + +This is referenced by bt_dev_dbg() in hci_add_adv_monitor(). + +Fix the bt_dev_dbg() by using handle instead of monitor->handle. + +Fixes: b747a83690c8 ("Bluetooth: hci_sync: Refactor add Adv Monitor") +Signed-off-by: Manish Mandlik +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 561e8a77f64cd..146553c0054f6 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -1957,7 +1957,7 @@ int hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor) + case HCI_ADV_MONITOR_EXT_MSFT: + status = msft_add_monitor_pattern(hdev, monitor); + bt_dev_dbg(hdev, "add monitor %d msft status %d", +- monitor->handle, status); ++ handle, status); + break; + } + +-- +2.40.1 + diff --git a/queue-6.1/bluetooth-hci_sync-don-t-double-print-name-in-add-re.patch b/queue-6.1/bluetooth-hci_sync-don-t-double-print-name-in-add-re.patch new file mode 100644 index 00000000000..1f6d2d0d8fc --- /dev/null +++ b/queue-6.1/bluetooth-hci_sync-don-t-double-print-name-in-add-re.patch @@ -0,0 +1,67 @@ +From 7b6b600895c47710e185f66071b09f84cbc868f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 15:33:15 -0700 +Subject: Bluetooth: hci_sync: Don't double print name in add/remove + adv_monitor + +From: Douglas Anderson + +[ Upstream commit 6f55eea116ba3646fb5fbb31de703f8cf79d8214 ] + +The hci_add_adv_monitor() hci_remove_adv_monitor() functions call +bt_dev_dbg() to print some debug statements. The bt_dev_dbg() macro +automatically adds in the device's name. That means that we shouldn't +include the name in the bt_dev_dbg() calls. + +Suggested-by: Luiz Augusto von Dentz +Signed-off-by: Douglas Anderson +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: a2bcd2b63271 ("Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()") +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 26884447d72be..561e8a77f64cd 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -1949,14 +1949,14 @@ int hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor) + + switch (hci_get_adv_monitor_offload_ext(hdev)) { + case HCI_ADV_MONITOR_EXT_NONE: +- bt_dev_dbg(hdev, "%s add monitor %d status %d", hdev->name, ++ bt_dev_dbg(hdev, "add monitor %d status %d", + monitor->handle, status); + /* Message was not forwarded to controller - not an error */ + break; + + case HCI_ADV_MONITOR_EXT_MSFT: + status = msft_add_monitor_pattern(hdev, monitor); +- bt_dev_dbg(hdev, "%s add monitor %d msft status %d", hdev->name, ++ bt_dev_dbg(hdev, "add monitor %d msft status %d", + monitor->handle, status); + break; + } +@@ -1976,15 +1976,15 @@ static int hci_remove_adv_monitor(struct hci_dev *hdev, + + switch (hci_get_adv_monitor_offload_ext(hdev)) { + case HCI_ADV_MONITOR_EXT_NONE: /* also goes here when powered off */ +- bt_dev_dbg(hdev, "%s remove monitor %d status %d", hdev->name, ++ bt_dev_dbg(hdev, "remove monitor %d status %d", + monitor->handle, status); + goto free_monitor; + + case HCI_ADV_MONITOR_EXT_MSFT: + handle = monitor->handle; + status = msft_remove_monitor(hdev, monitor); +- bt_dev_dbg(hdev, "%s remove monitor %d msft status %d", +- hdev->name, handle, status); ++ bt_dev_dbg(hdev, "remove monitor %d msft status %d", ++ handle, status); + break; + } + +-- +2.40.1 + diff --git a/queue-6.1/bluetooth-nokia-fix-value-check-in-nokia_bluetooth_s.patch b/queue-6.1/bluetooth-nokia-fix-value-check-in-nokia_bluetooth_s.patch new file mode 100644 index 00000000000..59c74c9dfac --- /dev/null +++ b/queue-6.1/bluetooth-nokia-fix-value-check-in-nokia_bluetooth_s.patch @@ -0,0 +1,41 @@ +From 682d46a069a5e2daf256933014839860d81fddb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 21:30:00 +0800 +Subject: Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() + +From: Yuanjun Gong + +[ Upstream commit e8b5aed31355072faac8092ead4938ddec3111fd ] + +in nokia_bluetooth_serdev_probe(), check the return value of +clk_prepare_enable() and return the error code if +clk_prepare_enable() returns an unexpected value. + +Fixes: 7bb318680e86 ("Bluetooth: add nokia driver") +Signed-off-by: Yuanjun Gong +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_nokia.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/hci_nokia.c b/drivers/bluetooth/hci_nokia.c +index 05f7f6de6863d..97da0b2bfd17e 100644 +--- a/drivers/bluetooth/hci_nokia.c ++++ b/drivers/bluetooth/hci_nokia.c +@@ -734,7 +734,11 @@ static int nokia_bluetooth_serdev_probe(struct serdev_device *serdev) + return err; + } + +- clk_prepare_enable(sysclk); ++ err = clk_prepare_enable(sysclk); ++ if (err) { ++ dev_err(dev, "could not enable sysclk: %d", err); ++ return err; ++ } + btdev->sysclk_speed = clk_get_rate(sysclk); + clk_disable_unprepare(sysclk); + +-- +2.40.1 + diff --git a/queue-6.1/bpf-clear-the-probe_addr-for-uprobe.patch b/queue-6.1/bpf-clear-the-probe_addr-for-uprobe.patch new file mode 100644 index 00000000000..bef823d8b62 --- /dev/null +++ b/queue-6.1/bpf-clear-the-probe_addr-for-uprobe.patch @@ -0,0 +1,77 @@ +From f38093e5daa1bc0d428dbfb6d4ecf70d3a707094 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jul 2023 02:56:25 +0000 +Subject: bpf: Clear the probe_addr for uprobe + +From: Yafang Shao + +[ Upstream commit 5125e757e62f6c1d5478db4c2b61a744060ddf3f ] + +To avoid returning uninitialized or random values when querying the file +descriptor (fd) and accessing probe_addr, it is necessary to clear the +variable prior to its use. + +Fixes: 41bdc4b40ed6 ("bpf: introduce bpf subcommand BPF_TASK_FD_QUERY") +Signed-off-by: Yafang Shao +Acked-by: Yonghong Song +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/r/20230709025630.3735-6-laoar.shao@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/trace_events.h | 3 ++- + kernel/trace/bpf_trace.c | 2 +- + kernel/trace/trace_uprobe.c | 3 ++- + 3 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h +index 04c59f8d801f1..422f4ca656cf9 100644 +--- a/include/linux/trace_events.h ++++ b/include/linux/trace_events.h +@@ -863,7 +863,8 @@ extern int perf_uprobe_init(struct perf_event *event, + extern void perf_uprobe_destroy(struct perf_event *event); + extern int bpf_get_uprobe_info(const struct perf_event *event, + u32 *fd_type, const char **filename, +- u64 *probe_offset, bool perf_type_tracepoint); ++ u64 *probe_offset, u64 *probe_addr, ++ bool perf_type_tracepoint); + #endif + extern int ftrace_profile_set_filter(struct perf_event *event, int event_id, + char *filter_str); +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index ad04390883ada..9fc5db194027b 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -2390,7 +2390,7 @@ int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id, + #ifdef CONFIG_UPROBE_EVENTS + if (flags & TRACE_EVENT_FL_UPROBE) + err = bpf_get_uprobe_info(event, fd_type, buf, +- probe_offset, ++ probe_offset, probe_addr, + event->attr.type == PERF_TYPE_TRACEPOINT); + #endif + } +diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c +index 2ac06a642863a..127c78aec17db 100644 +--- a/kernel/trace/trace_uprobe.c ++++ b/kernel/trace/trace_uprobe.c +@@ -1418,7 +1418,7 @@ static void uretprobe_perf_func(struct trace_uprobe *tu, unsigned long func, + + int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type, + const char **filename, u64 *probe_offset, +- bool perf_type_tracepoint) ++ u64 *probe_addr, bool perf_type_tracepoint) + { + const char *pevent = trace_event_name(event->tp_event); + const char *group = event->tp_event->class->system; +@@ -1435,6 +1435,7 @@ int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type, + : BPF_FD_TYPE_UPROBE; + *filename = tu->filename; + *probe_offset = tu->offset; ++ *probe_addr = 0; + return 0; + } + #endif /* CONFIG_PERF_EVENTS */ +-- +2.40.1 + diff --git a/queue-6.1/bpf-fix-an-error-in-verifying-a-field-in-a-union.patch b/queue-6.1/bpf-fix-an-error-in-verifying-a-field-in-a-union.patch new file mode 100644 index 00000000000..f4e7e2480fb --- /dev/null +++ b/queue-6.1/bpf-fix-an-error-in-verifying-a-field-in-a-union.patch @@ -0,0 +1,80 @@ +From 838937252ffdd6bc3066e55f6f74d752c42d840e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 02:56:41 +0000 +Subject: bpf: Fix an error in verifying a field in a union + +From: Yafang Shao + +[ Upstream commit 33937607efa050d9e237e0c4ac4ada02d961c466 ] + +We are utilizing BPF LSM to monitor BPF operations within our container +environment. When we add support for raw_tracepoint, it hits below +error. + +; (const void *)attr->raw_tracepoint.name); +27: (79) r3 = *(u64 *)(r2 +0) +access beyond the end of member map_type (mend:4) in struct (anon) with off 0 size 8 + +It can be reproduced with below BPF prog. + +SEC("lsm/bpf") +int BPF_PROG(bpf_audit, int cmd, union bpf_attr *attr, unsigned int size) +{ + switch (cmd) { + case BPF_RAW_TRACEPOINT_OPEN: + bpf_printk("raw_tracepoint is %s", attr->raw_tracepoint.name); + break; + default: + break; + } + return 0; +} + +The reason is that when accessing a field in a union, such as bpf_attr, +if the field is located within a nested struct that is not the first +member of the union, it can result in incorrect field verification. + + union bpf_attr { + struct { + __u32 map_type; <<<< Actually it will find that field. + __u32 key_size; + __u32 value_size; + ... + }; + ... + struct { + __u64 name; <<<< We want to verify this field. + __u32 prog_fd; + } raw_tracepoint; + }; + +Considering the potential deep nesting levels, finding a perfect +solution to address this issue has proven challenging. Therefore, I +propose a solution where we simply skip the verification process if the +field in question is located within a union. + +Fixes: 7e3617a72df3 ("bpf: Add array support to btf_struct_access") +Signed-off-by: Yafang Shao +Link: https://lore.kernel.org/r/20230713025642.27477-4-laoar.shao@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index fb78bb26786fc..7582ec4fd4131 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -5788,7 +5788,7 @@ static int btf_struct_walk(struct bpf_verifier_log *log, const struct btf *btf, + * that also allows using an array of int as a scratch + * space. e.g. skb->cb[]. + */ +- if (off + size > mtrue_end) { ++ if (off + size > mtrue_end && !(*flag & PTR_UNTRUSTED)) { + bpf_log(log, + "access beyond the end of member %s (mend:%u) in struct %s with off %u size %u\n", + mname, mtrue_end, tname, off, size); +-- +2.40.1 + diff --git a/queue-6.1/bpf-net-support-so_reuseport-sockets-with-bpf_sk_ass.patch b/queue-6.1/bpf-net-support-so_reuseport-sockets-with-bpf_sk_ass.patch new file mode 100644 index 00000000000..f8953982de3 --- /dev/null +++ b/queue-6.1/bpf-net-support-so_reuseport-sockets-with-bpf_sk_ass.patch @@ -0,0 +1,332 @@ +From d3beaba9fbe2a4e2efbcc3fbae860410c59e85e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 17:30:11 +0200 +Subject: bpf, net: Support SO_REUSEPORT sockets with bpf_sk_assign + +From: Lorenz Bauer + +[ Upstream commit 9c02bec95954252c3c01bfbb3f7560e0b95ca955 ] + +Currently the bpf_sk_assign helper in tc BPF context refuses SO_REUSEPORT +sockets. This means we can't use the helper to steer traffic to Envoy, +which configures SO_REUSEPORT on its sockets. In turn, we're blocked +from removing TPROXY from our setup. + +The reason that bpf_sk_assign refuses such sockets is that the +bpf_sk_lookup helpers don't execute SK_REUSEPORT programs. Instead, +one of the reuseport sockets is selected by hash. This could cause +dispatch to the "wrong" socket: + + sk = bpf_sk_lookup_tcp(...) // select SO_REUSEPORT by hash + bpf_sk_assign(skb, sk) // SK_REUSEPORT wasn't executed + +Fixing this isn't as simple as invoking SK_REUSEPORT from the lookup +helpers unfortunately. In the tc context, L2 headers are at the start +of the skb, while SK_REUSEPORT expects L3 headers instead. + +Instead, we execute the SK_REUSEPORT program when the assigned socket +is pulled out of the skb, further up the stack. This creates some +trickiness with regards to refcounting as bpf_sk_assign will put both +refcounted and RCU freed sockets in skb->sk. reuseport sockets are RCU +freed. We can infer that the sk_assigned socket is RCU freed if the +reuseport lookup succeeds, but convincing yourself of this fact isn't +straight forward. Therefore we defensively check refcounting on the +sk_assign sock even though it's probably not required in practice. + +Fixes: 8e368dc72e86 ("bpf: Fix use of sk->sk_reuseport from sk_assign") +Fixes: cf7fbe660f2d ("bpf: Add socket assign support") +Co-developed-by: Daniel Borkmann +Signed-off-by: Daniel Borkmann +Cc: Joe Stringer +Link: https://lore.kernel.org/bpf/CACAyw98+qycmpQzKupquhkxbvWK4OFyDuuLMBNROnfWMZxUWeA@mail.gmail.com/ +Reviewed-by: Kuniyuki Iwashima +Signed-off-by: Lorenz Bauer +Link: https://lore.kernel.org/r/20230720-so-reuseport-v6-7-7021b683cdae@isovalent.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + include/net/inet6_hashtables.h | 56 +++++++++++++++++++++++++++++++--- + include/net/inet_hashtables.h | 49 +++++++++++++++++++++++++++-- + include/net/sock.h | 7 +++-- + include/uapi/linux/bpf.h | 3 -- + net/core/filter.c | 2 -- + net/ipv4/udp.c | 8 +++-- + net/ipv6/udp.c | 8 +++-- + tools/include/uapi/linux/bpf.h | 3 -- + 8 files changed, 115 insertions(+), 21 deletions(-) + +diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h +index f89320b6fee31..475e672b4facc 100644 +--- a/include/net/inet6_hashtables.h ++++ b/include/net/inet6_hashtables.h +@@ -94,6 +94,46 @@ static inline struct sock *__inet6_lookup(struct net *net, + daddr, hnum, dif, sdif); + } + ++static inline ++struct sock *inet6_steal_sock(struct net *net, struct sk_buff *skb, int doff, ++ const struct in6_addr *saddr, const __be16 sport, ++ const struct in6_addr *daddr, const __be16 dport, ++ bool *refcounted, inet6_ehashfn_t *ehashfn) ++{ ++ struct sock *sk, *reuse_sk; ++ bool prefetched; ++ ++ sk = skb_steal_sock(skb, refcounted, &prefetched); ++ if (!sk) ++ return NULL; ++ ++ if (!prefetched) ++ return sk; ++ ++ if (sk->sk_protocol == IPPROTO_TCP) { ++ if (sk->sk_state != TCP_LISTEN) ++ return sk; ++ } else if (sk->sk_protocol == IPPROTO_UDP) { ++ if (sk->sk_state != TCP_CLOSE) ++ return sk; ++ } else { ++ return sk; ++ } ++ ++ reuse_sk = inet6_lookup_reuseport(net, sk, skb, doff, ++ saddr, sport, daddr, ntohs(dport), ++ ehashfn); ++ if (!reuse_sk) ++ return sk; ++ ++ /* We've chosen a new reuseport sock which is never refcounted. This ++ * implies that sk also isn't refcounted. ++ */ ++ WARN_ON_ONCE(*refcounted); ++ ++ return reuse_sk; ++} ++ + static inline struct sock *__inet6_lookup_skb(struct inet_hashinfo *hashinfo, + struct sk_buff *skb, int doff, + const __be16 sport, +@@ -101,14 +141,20 @@ static inline struct sock *__inet6_lookup_skb(struct inet_hashinfo *hashinfo, + int iif, int sdif, + bool *refcounted) + { +- struct sock *sk = skb_steal_sock(skb, refcounted); +- ++ struct net *net = dev_net(skb_dst(skb)->dev); ++ const struct ipv6hdr *ip6h = ipv6_hdr(skb); ++ struct sock *sk; ++ ++ sk = inet6_steal_sock(net, skb, doff, &ip6h->saddr, sport, &ip6h->daddr, dport, ++ refcounted, inet6_ehashfn); ++ if (IS_ERR(sk)) ++ return NULL; + if (sk) + return sk; + +- return __inet6_lookup(dev_net(skb_dst(skb)->dev), hashinfo, skb, +- doff, &ipv6_hdr(skb)->saddr, sport, +- &ipv6_hdr(skb)->daddr, ntohs(dport), ++ return __inet6_lookup(net, hashinfo, skb, ++ doff, &ip6h->saddr, sport, ++ &ip6h->daddr, ntohs(dport), + iif, sdif, refcounted); + } + +diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h +index ddfa2e67fdb51..a1b8eb147ce73 100644 +--- a/include/net/inet_hashtables.h ++++ b/include/net/inet_hashtables.h +@@ -442,6 +442,46 @@ static inline struct sock *inet_lookup(struct net *net, + return sk; + } + ++static inline ++struct sock *inet_steal_sock(struct net *net, struct sk_buff *skb, int doff, ++ const __be32 saddr, const __be16 sport, ++ const __be32 daddr, const __be16 dport, ++ bool *refcounted, inet_ehashfn_t *ehashfn) ++{ ++ struct sock *sk, *reuse_sk; ++ bool prefetched; ++ ++ sk = skb_steal_sock(skb, refcounted, &prefetched); ++ if (!sk) ++ return NULL; ++ ++ if (!prefetched) ++ return sk; ++ ++ if (sk->sk_protocol == IPPROTO_TCP) { ++ if (sk->sk_state != TCP_LISTEN) ++ return sk; ++ } else if (sk->sk_protocol == IPPROTO_UDP) { ++ if (sk->sk_state != TCP_CLOSE) ++ return sk; ++ } else { ++ return sk; ++ } ++ ++ reuse_sk = inet_lookup_reuseport(net, sk, skb, doff, ++ saddr, sport, daddr, ntohs(dport), ++ ehashfn); ++ if (!reuse_sk) ++ return sk; ++ ++ /* We've chosen a new reuseport sock which is never refcounted. This ++ * implies that sk also isn't refcounted. ++ */ ++ WARN_ON_ONCE(*refcounted); ++ ++ return reuse_sk; ++} ++ + static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo, + struct sk_buff *skb, + int doff, +@@ -450,13 +490,18 @@ static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo, + const int sdif, + bool *refcounted) + { +- struct sock *sk = skb_steal_sock(skb, refcounted); ++ struct net *net = dev_net(skb_dst(skb)->dev); + const struct iphdr *iph = ip_hdr(skb); ++ struct sock *sk; + ++ sk = inet_steal_sock(net, skb, doff, iph->saddr, sport, iph->daddr, dport, ++ refcounted, inet_ehashfn); ++ if (IS_ERR(sk)) ++ return NULL; + if (sk) + return sk; + +- return __inet_lookup(dev_net(skb_dst(skb)->dev), hashinfo, skb, ++ return __inet_lookup(net, hashinfo, skb, + doff, iph->saddr, sport, + iph->daddr, dport, inet_iif(skb), sdif, + refcounted); +diff --git a/include/net/sock.h b/include/net/sock.h +index d1f936ed97556..3a8b2cc23b914 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -2852,20 +2852,23 @@ sk_is_refcounted(struct sock *sk) + * skb_steal_sock - steal a socket from an sk_buff + * @skb: sk_buff to steal the socket from + * @refcounted: is set to true if the socket is reference-counted ++ * @prefetched: is set to true if the socket was assigned from bpf + */ + static inline struct sock * +-skb_steal_sock(struct sk_buff *skb, bool *refcounted) ++skb_steal_sock(struct sk_buff *skb, bool *refcounted, bool *prefetched) + { + if (skb->sk) { + struct sock *sk = skb->sk; + + *refcounted = true; +- if (skb_sk_is_prefetched(skb)) ++ *prefetched = skb_sk_is_prefetched(skb); ++ if (*prefetched) + *refcounted = sk_is_refcounted(sk); + skb->destructor = NULL; + skb->sk = NULL; + return sk; + } ++ *prefetched = false; + *refcounted = false; + return NULL; + } +diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h +index 51b9aa640ad2a..1304bec5c97a0 100644 +--- a/include/uapi/linux/bpf.h ++++ b/include/uapi/linux/bpf.h +@@ -4079,9 +4079,6 @@ union bpf_attr { + * **-EOPNOTSUPP** if the operation is not supported, for example + * a call from outside of TC ingress. + * +- * **-ESOCKTNOSUPPORT** if the socket type is not supported +- * (reuseport). +- * + * long bpf_sk_assign(struct bpf_sk_lookup *ctx, struct bpf_sock *sk, u64 flags) + * Description + * Helper is overloaded depending on BPF program type. This +diff --git a/net/core/filter.c b/net/core/filter.c +index 9fd7c88b5db4e..ccc97d54d9a8b 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -7257,8 +7257,6 @@ BPF_CALL_3(bpf_sk_assign, struct sk_buff *, skb, struct sock *, sk, u64, flags) + return -EOPNOTSUPP; + if (unlikely(dev_net(skb->dev) != sock_net(sk))) + return -ENETUNREACH; +- if (unlikely(sk_fullsock(sk) && sk->sk_reuseport)) +- return -ESOCKTNOSUPPORT; + if (sk_unhashed(sk)) + return -EOPNOTSUPP; + if (sk_is_refcounted(sk) && +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 87686c9e4efca..58c2f8df5fd70 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -2442,7 +2442,11 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + if (udp4_csum_init(skb, uh, proto)) + goto csum_error; + +- sk = skb_steal_sock(skb, &refcounted); ++ sk = inet_steal_sock(net, skb, sizeof(struct udphdr), saddr, uh->source, daddr, uh->dest, ++ &refcounted, udp_ehashfn); ++ if (IS_ERR(sk)) ++ goto no_sk; ++ + if (sk) { + struct dst_entry *dst = skb_dst(skb); + int ret; +@@ -2463,7 +2467,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + sk = __udp4_lib_lookup_skb(skb, uh->source, uh->dest, udptable); + if (sk) + return udp_unicast_rcv_skb(sk, skb, uh); +- ++no_sk: + if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) + goto drop; + nf_reset_ct(skb); +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 3408376b1863b..91b757066c935 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -983,7 +983,11 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + goto csum_error; + + /* Check if the socket is already available, e.g. due to early demux */ +- sk = skb_steal_sock(skb, &refcounted); ++ sk = inet6_steal_sock(net, skb, sizeof(struct udphdr), saddr, uh->source, daddr, uh->dest, ++ &refcounted, udp6_ehashfn); ++ if (IS_ERR(sk)) ++ goto no_sk; ++ + if (sk) { + struct dst_entry *dst = skb_dst(skb); + int ret; +@@ -1017,7 +1021,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + goto report_csum_error; + return udp6_unicast_rcv_skb(sk, skb, uh); + } +- ++no_sk: + reason = SKB_DROP_REASON_NO_SOCKET; + + if (!uh->check) +diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h +index 51b9aa640ad2a..1304bec5c97a0 100644 +--- a/tools/include/uapi/linux/bpf.h ++++ b/tools/include/uapi/linux/bpf.h +@@ -4079,9 +4079,6 @@ union bpf_attr { + * **-EOPNOTSUPP** if the operation is not supported, for example + * a call from outside of TC ingress. + * +- * **-ESOCKTNOSUPPORT** if the socket type is not supported +- * (reuseport). +- * + * long bpf_sk_assign(struct bpf_sk_lookup *ctx, struct bpf_sock *sk, u64 flags) + * Description + * Helper is overloaded depending on BPF program type. This +-- +2.40.1 + diff --git a/queue-6.1/bpf-reject-unhashed-sockets-in-bpf_sk_assign.patch b/queue-6.1/bpf-reject-unhashed-sockets-in-bpf_sk_assign.patch new file mode 100644 index 00000000000..16c4f0a0812 --- /dev/null +++ b/queue-6.1/bpf-reject-unhashed-sockets-in-bpf_sk_assign.patch @@ -0,0 +1,96 @@ +From 0b1e87efecf0055fe952298a8dfb2da875bdc99e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 17:30:06 +0200 +Subject: bpf: reject unhashed sockets in bpf_sk_assign + +From: Lorenz Bauer + +[ Upstream commit 67312adc96b5a585970d03b62412847afe2c6b01 ] + +The semantics for bpf_sk_assign are as follows: + + sk = some_lookup_func() + bpf_sk_assign(skb, sk) + bpf_sk_release(sk) + +That is, the sk is not consumed by bpf_sk_assign. The function +therefore needs to make sure that sk lives long enough to be +consumed from __inet_lookup_skb. The path through the stack for a +TCPv4 packet is roughly: + + netif_receive_skb_core: takes RCU read lock + __netif_receive_skb_core: + sch_handle_ingress: + tcf_classify: + bpf_sk_assign() + deliver_ptype_list_skb: + deliver_skb: + ip_packet_type->func == ip_rcv: + ip_rcv_core: + ip_rcv_finish_core: + dst_input: + ip_local_deliver: + ip_local_deliver_finish: + ip_protocol_deliver_rcu: + tcp_v4_rcv: + __inet_lookup_skb: + skb_steal_sock + +The existing helper takes advantage of the fact that everything +happens in the same RCU critical section: for sockets with +SOCK_RCU_FREE set bpf_sk_assign never takes a reference. +skb_steal_sock then checks SOCK_RCU_FREE again and does sock_put +if necessary. + +This approach assumes that SOCK_RCU_FREE is never set on a sk +between bpf_sk_assign and skb_steal_sock, but this invariant is +violated by unhashed UDP sockets. A new UDP socket is created +in TCP_CLOSE state but without SOCK_RCU_FREE set. That flag is only +added in udp_lib_get_port() which happens when a socket is bound. + +When bpf_sk_assign was added it wasn't possible to access unhashed +UDP sockets from BPF, so this wasn't a problem. This changed +in commit 0c48eefae712 ("sock_map: Lift socket state restriction +for datagram sockets"), but the helper wasn't adjusted accordingly. +The following sequence of events will therefore lead to a refcount +leak: + +1. Add socket(AF_INET, SOCK_DGRAM) to a sockmap. +2. Pull socket out of sockmap and bpf_sk_assign it. Since + SOCK_RCU_FREE is not set we increment the refcount. +3. bind() or connect() the socket, setting SOCK_RCU_FREE. +4. skb_steal_sock will now set refcounted = false due to + SOCK_RCU_FREE. +5. tcp_v4_rcv() skips sock_put(). + +Fix the problem by rejecting unhashed sockets in bpf_sk_assign(). +This matches the behaviour of __inet_lookup_skb which is ultimately +the goal of bpf_sk_assign(). + +Fixes: cf7fbe660f2d ("bpf: Add socket assign support") +Cc: Joe Stringer +Signed-off-by: Lorenz Bauer +Reviewed-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/r/20230720-so-reuseport-v6-2-7021b683cdae@isovalent.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 419ce7c61bd6b..9fd7c88b5db4e 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -7259,6 +7259,8 @@ BPF_CALL_3(bpf_sk_assign, struct sk_buff *, skb, struct sock *, sk, u64, flags) + return -ENETUNREACH; + if (unlikely(sk_fullsock(sk) && sk->sk_reuseport)) + return -ESOCKTNOSUPPORT; ++ if (sk_unhashed(sk)) ++ return -EOPNOTSUPP; + if (sk_is_refcounted(sk) && + unlikely(!refcount_inc_not_zero(&sk->sk_refcnt))) + return -ENOENT; +-- +2.40.1 + diff --git a/queue-6.1/bpftool-define-a-local-bpf_perf_link-to-fix-accessin.patch b/queue-6.1/bpftool-define-a-local-bpf_perf_link-to-fix-accessin.patch new file mode 100644 index 00000000000..15b4ac1a09f --- /dev/null +++ b/queue-6.1/bpftool-define-a-local-bpf_perf_link-to-fix-accessin.patch @@ -0,0 +1,76 @@ +From 510899c0b7661db19ca203e8ef399b6ff5a28599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 10:54:23 +0100 +Subject: bpftool: Define a local bpf_perf_link to fix accessing its fields + +From: Alexander Lobakin + +[ Upstream commit 67a43462ee2405c94e985a747bdcb8e3a0d66203 ] + +When building bpftool with !CONFIG_PERF_EVENTS: + +skeleton/pid_iter.bpf.c:47:14: error: incomplete definition of type 'struct bpf_perf_link' + perf_link = container_of(link, struct bpf_perf_link, link); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +tools/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_helpers.h:74:22: note: expanded from macro 'container_of' + ((type *)(__mptr - offsetof(type, member))); \ + ^~~~~~~~~~~~~~~~~~~~~~ +tools/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_helpers.h:68:60: note: expanded from macro 'offsetof' + #define offsetof(TYPE, MEMBER) ((unsigned long)&((TYPE *)0)->MEMBER) + ~~~~~~~~~~~^ +skeleton/pid_iter.bpf.c:44:9: note: forward declaration of 'struct bpf_perf_link' + struct bpf_perf_link *perf_link; + ^ + +&bpf_perf_link is being defined and used only under the ifdef. +Define struct bpf_perf_link___local with the `preserve_access_index` +attribute inside the pid_iter BPF prog to allow compiling on any +configs. CO-RE will substitute it with the real struct bpf_perf_link +accesses later on. +container_of() uses offsetof(), which does the necessary CO-RE +relocation if the field is specified with `preserve_access_index` - as +is the case for struct bpf_perf_link___local. + +Fixes: cbdaf71f7e65 ("bpftool: Add bpf_cookie to link output") +Suggested-by: Andrii Nakryiko +Signed-off-by: Alexander Lobakin +Signed-off-by: Quentin Monnet +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20230707095425.168126-3-quentin@isovalent.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/skeleton/pid_iter.bpf.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/tools/bpf/bpftool/skeleton/pid_iter.bpf.c b/tools/bpf/bpftool/skeleton/pid_iter.bpf.c +index e2af8e5fb29ec..3a4c4f7d83d86 100644 +--- a/tools/bpf/bpftool/skeleton/pid_iter.bpf.c ++++ b/tools/bpf/bpftool/skeleton/pid_iter.bpf.c +@@ -15,6 +15,11 @@ enum bpf_obj_type { + BPF_OBJ_BTF, + }; + ++struct bpf_perf_link___local { ++ struct bpf_link link; ++ struct file *perf_file; ++} __attribute__((preserve_access_index)); ++ + struct perf_event___local { + u64 bpf_cookie; + } __attribute__((preserve_access_index)); +@@ -45,10 +50,10 @@ static __always_inline __u32 get_obj_id(void *ent, enum bpf_obj_type type) + /* could be used only with BPF_LINK_TYPE_PERF_EVENT links */ + static __u64 get_bpf_cookie(struct bpf_link *link) + { ++ struct bpf_perf_link___local *perf_link; + struct perf_event___local *event; +- struct bpf_perf_link *perf_link; + +- perf_link = container_of(link, struct bpf_perf_link, link); ++ perf_link = container_of(link, struct bpf_perf_link___local, link); + event = BPF_CORE_READ(perf_link, perf_file, private_data); + return BPF_CORE_READ(event, bpf_cookie); + } +-- +2.40.1 + diff --git a/queue-6.1/bpftool-use-a-local-bpf_perf_event_value-to-fix-acce.patch b/queue-6.1/bpftool-use-a-local-bpf_perf_event_value-to-fix-acce.patch new file mode 100644 index 00000000000..1f65ca26eb8 --- /dev/null +++ b/queue-6.1/bpftool-use-a-local-bpf_perf_event_value-to-fix-acce.patch @@ -0,0 +1,137 @@ +From c3f4aad6da8b7d88c9d02f74c8653d12a66bdfee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 10:54:25 +0100 +Subject: bpftool: Use a local bpf_perf_event_value to fix accessing its fields + +From: Alexander Lobakin + +[ Upstream commit 658ac06801315b739774a15796ff06913ef5cad5 ] + +Fix the following error when building bpftool: + + CLANG profiler.bpf.o + CLANG pid_iter.bpf.o +skeleton/profiler.bpf.c:18:21: error: invalid application of 'sizeof' to an incomplete type 'struct bpf_perf_event_value' + __uint(value_size, sizeof(struct bpf_perf_event_value)); + ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +tools/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_helpers.h:13:39: note: expanded from macro '__uint' +tools/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_helper_defs.h:7:8: note: forward declaration of 'struct bpf_perf_event_value' +struct bpf_perf_event_value; + ^ + +struct bpf_perf_event_value is being used in the kernel only when +CONFIG_BPF_EVENTS is enabled, so it misses a BTF entry then. +Define struct bpf_perf_event_value___local with the +`preserve_access_index` attribute inside the pid_iter BPF prog to +allow compiling on any configs. It is a full mirror of a UAPI +structure, so is compatible both with and w/o CO-RE. +bpf_perf_event_read_value() requires a pointer of the original type, +so a cast is needed. + +Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command") +Suggested-by: Andrii Nakryiko +Signed-off-by: Alexander Lobakin +Signed-off-by: Quentin Monnet +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20230707095425.168126-5-quentin@isovalent.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/skeleton/profiler.bpf.c | 27 ++++++++++++++--------- + 1 file changed, 17 insertions(+), 10 deletions(-) + +diff --git a/tools/bpf/bpftool/skeleton/profiler.bpf.c b/tools/bpf/bpftool/skeleton/profiler.bpf.c +index ce5b65e07ab10..2f80edc682f11 100644 +--- a/tools/bpf/bpftool/skeleton/profiler.bpf.c ++++ b/tools/bpf/bpftool/skeleton/profiler.bpf.c +@@ -4,6 +4,12 @@ + #include + #include + ++struct bpf_perf_event_value___local { ++ __u64 counter; ++ __u64 enabled; ++ __u64 running; ++} __attribute__((preserve_access_index)); ++ + /* map of perf event fds, num_cpu * num_metric entries */ + struct { + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); +@@ -15,14 +21,14 @@ struct { + struct { + __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); + __uint(key_size, sizeof(u32)); +- __uint(value_size, sizeof(struct bpf_perf_event_value)); ++ __uint(value_size, sizeof(struct bpf_perf_event_value___local)); + } fentry_readings SEC(".maps"); + + /* accumulated readings */ + struct { + __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); + __uint(key_size, sizeof(u32)); +- __uint(value_size, sizeof(struct bpf_perf_event_value)); ++ __uint(value_size, sizeof(struct bpf_perf_event_value___local)); + } accum_readings SEC(".maps"); + + /* sample counts, one per cpu */ +@@ -39,7 +45,7 @@ const volatile __u32 num_metric = 1; + SEC("fentry/XXX") + int BPF_PROG(fentry_XXX) + { +- struct bpf_perf_event_value *ptrs[MAX_NUM_MATRICS]; ++ struct bpf_perf_event_value___local *ptrs[MAX_NUM_MATRICS]; + u32 key = bpf_get_smp_processor_id(); + u32 i; + +@@ -53,10 +59,10 @@ int BPF_PROG(fentry_XXX) + } + + for (i = 0; i < num_metric && i < MAX_NUM_MATRICS; i++) { +- struct bpf_perf_event_value reading; ++ struct bpf_perf_event_value___local reading; + int err; + +- err = bpf_perf_event_read_value(&events, key, &reading, ++ err = bpf_perf_event_read_value(&events, key, (void *)&reading, + sizeof(reading)); + if (err) + return 0; +@@ -68,14 +74,14 @@ int BPF_PROG(fentry_XXX) + } + + static inline void +-fexit_update_maps(u32 id, struct bpf_perf_event_value *after) ++fexit_update_maps(u32 id, struct bpf_perf_event_value___local *after) + { +- struct bpf_perf_event_value *before, diff; ++ struct bpf_perf_event_value___local *before, diff; + + before = bpf_map_lookup_elem(&fentry_readings, &id); + /* only account samples with a valid fentry_reading */ + if (before && before->counter) { +- struct bpf_perf_event_value *accum; ++ struct bpf_perf_event_value___local *accum; + + diff.counter = after->counter - before->counter; + diff.enabled = after->enabled - before->enabled; +@@ -93,7 +99,7 @@ fexit_update_maps(u32 id, struct bpf_perf_event_value *after) + SEC("fexit/XXX") + int BPF_PROG(fexit_XXX) + { +- struct bpf_perf_event_value readings[MAX_NUM_MATRICS]; ++ struct bpf_perf_event_value___local readings[MAX_NUM_MATRICS]; + u32 cpu = bpf_get_smp_processor_id(); + u32 i, zero = 0; + int err; +@@ -102,7 +108,8 @@ int BPF_PROG(fexit_XXX) + /* read all events before updating the maps, to reduce error */ + for (i = 0; i < num_metric && i < MAX_NUM_MATRICS; i++) { + err = bpf_perf_event_read_value(&events, cpu + i * num_cpu, +- readings + i, sizeof(*readings)); ++ (void *)(readings + i), ++ sizeof(*readings)); + if (err) + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/bpftool-use-a-local-copy-of-bpf_link_type_perf_event.patch b/queue-6.1/bpftool-use-a-local-copy-of-bpf_link_type_perf_event.patch new file mode 100644 index 00000000000..143c99987cb --- /dev/null +++ b/queue-6.1/bpftool-use-a-local-copy-of-bpf_link_type_perf_event.patch @@ -0,0 +1,59 @@ +From caa2479116f1d44951bc7f4411d59b8c35a2522e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 10:54:24 +0100 +Subject: bpftool: Use a local copy of BPF_LINK_TYPE_PERF_EVENT in + pid_iter.bpf.c + +From: Quentin Monnet + +[ Upstream commit 44ba7b30e84fb40da2295e85a6d209e199fdc977 ] + +In order to allow the BPF program in bpftool's pid_iter.bpf.c to compile +correctly on hosts where vmlinux.h does not define +BPF_LINK_TYPE_PERF_EVENT (running kernel versions lower than 5.15, for +example), define and use a local copy of the enum value. This requires +LLVM 12 or newer to build the BPF program. + +Fixes: cbdaf71f7e65 ("bpftool: Add bpf_cookie to link output") +Signed-off-by: Quentin Monnet +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20230707095425.168126-4-quentin@isovalent.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/skeleton/pid_iter.bpf.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/tools/bpf/bpftool/skeleton/pid_iter.bpf.c b/tools/bpf/bpftool/skeleton/pid_iter.bpf.c +index 3a4c4f7d83d86..26004f0c5a6ae 100644 +--- a/tools/bpf/bpftool/skeleton/pid_iter.bpf.c ++++ b/tools/bpf/bpftool/skeleton/pid_iter.bpf.c +@@ -24,6 +24,10 @@ struct perf_event___local { + u64 bpf_cookie; + } __attribute__((preserve_access_index)); + ++enum bpf_link_type___local { ++ BPF_LINK_TYPE_PERF_EVENT___local = 7, ++}; ++ + extern const void bpf_link_fops __ksym; + extern const void bpf_map_fops __ksym; + extern const void bpf_prog_fops __ksym; +@@ -93,10 +97,13 @@ int iter(struct bpf_iter__task_file *ctx) + e.pid = task->tgid; + e.id = get_obj_id(file->private_data, obj_type); + +- if (obj_type == BPF_OBJ_LINK) { ++ if (obj_type == BPF_OBJ_LINK && ++ bpf_core_enum_value_exists(enum bpf_link_type___local, ++ BPF_LINK_TYPE_PERF_EVENT___local)) { + struct bpf_link *link = (struct bpf_link *) file->private_data; + +- if (BPF_CORE_READ(link, type) == BPF_LINK_TYPE_PERF_EVENT) { ++ if (link->type == bpf_core_enum_value(enum bpf_link_type___local, ++ BPF_LINK_TYPE_PERF_EVENT___local)) { + e.has_bpf_cookie = true; + e.bpf_cookie = get_bpf_cookie(link); + } +-- +2.40.1 + diff --git a/queue-6.1/bpftool-use-a-local-copy-of-perf_event-to-fix-access.patch b/queue-6.1/bpftool-use-a-local-copy-of-perf_event-to-fix-access.patch new file mode 100644 index 00000000000..59719184608 --- /dev/null +++ b/queue-6.1/bpftool-use-a-local-copy-of-perf_event-to-fix-access.patch @@ -0,0 +1,70 @@ +From c45f322a47203d819162be9904e4e97f2c79615d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 10:54:22 +0100 +Subject: bpftool: use a local copy of perf_event to fix accessing :: + Bpf_cookie + +From: Alexander Lobakin + +[ Upstream commit 4cbeeb0dc02f8ac7b975b2ab0080ace53d43d62a ] + +When CONFIG_PERF_EVENTS is not set, struct perf_event remains empty. +However, the structure is being used by bpftool indirectly via BTF. +This leads to: + +skeleton/pid_iter.bpf.c:49:30: error: no member named 'bpf_cookie' in 'struct perf_event' + return BPF_CORE_READ(event, bpf_cookie); + ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~ + +... + +skeleton/pid_iter.bpf.c:49:9: error: returning 'void' from a function with incompatible result type '__u64' (aka 'unsigned long long') + return BPF_CORE_READ(event, bpf_cookie); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Tools and samples can't use any CONFIG_ definitions, so the fields +used there should always be present. +Define struct perf_event___local with the `preserve_access_index` +attribute inside the pid_iter BPF prog to allow compiling on any +configs. CO-RE will substitute it with the real struct perf_event +accesses later on. + +Fixes: cbdaf71f7e65 ("bpftool: Add bpf_cookie to link output") +Suggested-by: Andrii Nakryiko +Signed-off-by: Alexander Lobakin +Signed-off-by: Quentin Monnet +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20230707095425.168126-2-quentin@isovalent.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/skeleton/pid_iter.bpf.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tools/bpf/bpftool/skeleton/pid_iter.bpf.c b/tools/bpf/bpftool/skeleton/pid_iter.bpf.c +index eb05ea53afb12..e2af8e5fb29ec 100644 +--- a/tools/bpf/bpftool/skeleton/pid_iter.bpf.c ++++ b/tools/bpf/bpftool/skeleton/pid_iter.bpf.c +@@ -15,6 +15,10 @@ enum bpf_obj_type { + BPF_OBJ_BTF, + }; + ++struct perf_event___local { ++ u64 bpf_cookie; ++} __attribute__((preserve_access_index)); ++ + extern const void bpf_link_fops __ksym; + extern const void bpf_map_fops __ksym; + extern const void bpf_prog_fops __ksym; +@@ -41,8 +45,8 @@ static __always_inline __u32 get_obj_id(void *ent, enum bpf_obj_type type) + /* could be used only with BPF_LINK_TYPE_PERF_EVENT links */ + static __u64 get_bpf_cookie(struct bpf_link *link) + { ++ struct perf_event___local *event; + struct bpf_perf_link *perf_link; +- struct perf_event *event; + + perf_link = container_of(link, struct bpf_perf_link, link); + event = BPF_CORE_READ(perf_link, perf_file, private_data); +-- +2.40.1 + diff --git a/queue-6.1/bus-ti-sysc-fix-build-warning-for-64-bit-build.patch b/queue-6.1/bus-ti-sysc-fix-build-warning-for-64-bit-build.patch new file mode 100644 index 00000000000..a17f8206fe6 --- /dev/null +++ b/queue-6.1/bus-ti-sysc-fix-build-warning-for-64-bit-build.patch @@ -0,0 +1,40 @@ +From 3d36fa1136774117a790f5551fe0996877cc4473 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 13:38:01 +0300 +Subject: bus: ti-sysc: Fix build warning for 64-bit build + +From: Tony Lindgren + +[ Upstream commit e1e1e9bb9d943ec690670a609a5f660ca10eaf85 ] + +Fix "warning: cast from pointer to integer of different size" on 64-bit +builds. + +Note that this is a cosmetic fix at this point as the driver is not yet +used for 64-bit systems. + +Fixes: feaa8baee82a ("bus: ti-sysc: Implement SoC revision handling") +Reviewed-by: Dhruva Gole +Reviewed-by: Nishanth Menon +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 9b7268bae66ab..0c933788d8575 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -3125,7 +3125,7 @@ static int sysc_init_static_data(struct sysc *ddata) + + match = soc_device_match(sysc_soc_match); + if (match && match->data) +- sysc_soc->soc = (int)match->data; ++ sysc_soc->soc = (enum sysc_soc)match->data; + + /* + * Check and warn about possible old incomplete dtb. We now want to see +-- +2.40.1 + diff --git a/queue-6.1/bus-ti-sysc-fix-cast-to-enum-warning.patch b/queue-6.1/bus-ti-sysc-fix-cast-to-enum-warning.patch new file mode 100644 index 00000000000..1232dfc9be2 --- /dev/null +++ b/queue-6.1/bus-ti-sysc-fix-cast-to-enum-warning.patch @@ -0,0 +1,38 @@ +From 52db2fa013fb0001016246f46793bca854a324d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Aug 2023 08:49:05 +0300 +Subject: bus: ti-sysc: Fix cast to enum warning + +From: Tony Lindgren + +[ Upstream commit de44bf2f7683347f75690ef6cf61a1d5ba8f0891 ] + +Fix warning for "cast to smaller integer type 'enum sysc_soc' from 'const +void *'". + +Cc: Nishanth Menon +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202308150723.ziuGCdM3-lkp@intel.com/ +Fixes: e1e1e9bb9d94 ("bus: ti-sysc: Fix build warning for 64-bit build") +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 0c933788d8575..ac36b01cf6d5d 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -3125,7 +3125,7 @@ static int sysc_init_static_data(struct sysc *ddata) + + match = soc_device_match(sysc_soc_match); + if (match && match->data) +- sysc_soc->soc = (enum sysc_soc)match->data; ++ sysc_soc->soc = (enum sysc_soc)(uintptr_t)match->data; + + /* + * Check and warn about possible old incomplete dtb. We now want to see +-- +2.40.1 + diff --git a/queue-6.1/can-gs_usb-gs_usb_receive_bulk_callback-count-rx-ove.patch b/queue-6.1/can-gs_usb-gs_usb_receive_bulk_callback-count-rx-ove.patch new file mode 100644 index 00000000000..28766e5aa74 --- /dev/null +++ b/queue-6.1/can-gs_usb-gs_usb_receive_bulk_callback-count-rx-ove.patch @@ -0,0 +1,50 @@ +From 07dda4bbec55565c6b0338cc45edc84e0f7ebaf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 11:23:37 +0200 +Subject: can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors + also in case of OOM + +From: Marc Kleine-Budde + +[ Upstream commit 6c8bc15f02b85bc8f47074110d8fd8caf7a1e42d ] + +In case of an RX overflow error from the CAN controller and an OOM +where no skb can be allocated, the error counters are not incremented. + +Fix this by first incrementing the error counters and then allocate +the skb. + +Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") +Link: https://lore.kernel.org/all/20230718-gs_usb-cleanups-v1-7-c3b9154ec605@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/gs_usb.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index 5858cbafbc965..264a0f764e011 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -626,6 +626,9 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) + } + + if (hf->flags & GS_CAN_FLAG_OVERFLOW) { ++ stats->rx_over_errors++; ++ stats->rx_errors++; ++ + skb = alloc_can_err_skb(netdev, &cf); + if (!skb) + goto resubmit_urb; +@@ -633,8 +636,6 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) + cf->can_id |= CAN_ERR_CRTL; + cf->len = CAN_ERR_DLC; + cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW; +- stats->rx_over_errors++; +- stats->rx_errors++; + netif_rx(skb); + } + +-- +2.40.1 + diff --git a/queue-6.1/cgroup-cpuset-inherit-parent-s-load-balance-state-in.patch b/queue-6.1/cgroup-cpuset-inherit-parent-s-load-balance-state-in.patch new file mode 100644 index 00000000000..387e54cf0e3 --- /dev/null +++ b/queue-6.1/cgroup-cpuset-inherit-parent-s-load-balance-state-in.patch @@ -0,0 +1,88 @@ +From 8d442556ba9de8e96d8ba01f908106e6f9145c62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 10:35:00 -0400 +Subject: cgroup/cpuset: Inherit parent's load balance state in v2 + +From: Waiman Long + +[ Upstream commit c8c926200c55454101f072a4b16c9ff5b8c9e56f ] + +Since commit f28e22441f35 ("cgroup/cpuset: Add a new isolated +cpus.partition type"), the CS_SCHED_LOAD_BALANCE bit of a v2 cpuset +can be on or off. The child cpusets of a partition root must have the +same setting as its parent or it may screw up the rebuilding of sched +domains. Fix this problem by making sure the a child v2 cpuset will +follows its parent cpuset load balance state unless the child cpuset +is a new partition root itself. + +Fixes: f28e22441f35 ("cgroup/cpuset: Add a new isolated cpus.partition type") +Signed-off-by: Waiman Long +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 33 ++++++++++++++++++++++++++++++--- + 1 file changed, 30 insertions(+), 3 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index db3e05b6b4dd2..79e6a5d4c29a1 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -1606,11 +1606,16 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp, + } + + /* +- * Skip the whole subtree if the cpumask remains the same +- * and has no partition root state and force flag not set. ++ * Skip the whole subtree if ++ * 1) the cpumask remains the same, ++ * 2) has no partition root state, ++ * 3) force flag not set, and ++ * 4) for v2 load balance state same as its parent. + */ + if (!cp->partition_root_state && !force && +- cpumask_equal(tmp->new_cpus, cp->effective_cpus)) { ++ cpumask_equal(tmp->new_cpus, cp->effective_cpus) && ++ (!cgroup_subsys_on_dfl(cpuset_cgrp_subsys) || ++ (is_sched_load_balance(parent) == is_sched_load_balance(cp)))) { + pos_css = css_rightmost_descendant(pos_css); + continue; + } +@@ -1693,6 +1698,20 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp, + + update_tasks_cpumask(cp, tmp->new_cpus); + ++ /* ++ * On default hierarchy, inherit the CS_SCHED_LOAD_BALANCE ++ * from parent if current cpuset isn't a valid partition root ++ * and their load balance states differ. ++ */ ++ if (cgroup_subsys_on_dfl(cpuset_cgrp_subsys) && ++ !is_partition_valid(cp) && ++ (is_sched_load_balance(parent) != is_sched_load_balance(cp))) { ++ if (is_sched_load_balance(parent)) ++ set_bit(CS_SCHED_LOAD_BALANCE, &cp->flags); ++ else ++ clear_bit(CS_SCHED_LOAD_BALANCE, &cp->flags); ++ } ++ + /* + * On legacy hierarchy, if the effective cpumask of any non- + * empty cpuset is changed, we need to rebuild sched domains. +@@ -3213,6 +3232,14 @@ static int cpuset_css_online(struct cgroup_subsys_state *css) + cs->use_parent_ecpus = true; + parent->child_ecpus_count++; + } ++ ++ /* ++ * For v2, clear CS_SCHED_LOAD_BALANCE if parent is isolated ++ */ ++ if (cgroup_subsys_on_dfl(cpuset_cgrp_subsys) && ++ !is_sched_load_balance(parent)) ++ clear_bit(CS_SCHED_LOAD_BALANCE, &cs->flags); ++ + spin_unlock_irq(&callback_lock); + + if (!test_bit(CGRP_CPUSET_CLONE_CHILDREN, &css->cgroup->flags)) +-- +2.40.1 + diff --git a/queue-6.1/cgroup-namespace-remove-unused-cgroup_namespaces_ini.patch b/queue-6.1/cgroup-namespace-remove-unused-cgroup_namespaces_ini.patch new file mode 100644 index 00000000000..9749e73b210 --- /dev/null +++ b/queue-6.1/cgroup-namespace-remove-unused-cgroup_namespaces_ini.patch @@ -0,0 +1,37 @@ +From 2be9996dc156e1d3850cd976785db063e627c4c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 11:25:28 +0000 +Subject: cgroup:namespace: Remove unused cgroup_namespaces_init() + +From: Lu Jialin + +[ Upstream commit 82b90b6c5b38e457c7081d50dff11ecbafc1e61a ] + +cgroup_namspace_init() just return 0. Therefore, there is no need to +call it during start_kernel. Just remove it. + +Fixes: a79a908fd2b0 ("cgroup: introduce cgroup namespaces") +Signed-off-by: Lu Jialin +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/namespace.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/kernel/cgroup/namespace.c b/kernel/cgroup/namespace.c +index 0d5c29879a50b..144a464e45c66 100644 +--- a/kernel/cgroup/namespace.c ++++ b/kernel/cgroup/namespace.c +@@ -149,9 +149,3 @@ const struct proc_ns_operations cgroupns_operations = { + .install = cgroupns_install, + .owner = cgroupns_owner, + }; +- +-static __init int cgroup_namespaces_init(void) +-{ +- return 0; +-} +-subsys_initcall(cgroup_namespaces_init); +-- +2.40.1 + diff --git a/queue-6.1/clk-imx-composite-8m-fix-clock-pauses-when-set_rate-.patch b/queue-6.1/clk-imx-composite-8m-fix-clock-pauses-when-set_rate-.patch new file mode 100644 index 00000000000..5d47c04e565 --- /dev/null +++ b/queue-6.1/clk-imx-composite-8m-fix-clock-pauses-when-set_rate-.patch @@ -0,0 +1,78 @@ +From b274ed6457860e9fa524eb1961a8cfd4bf240751 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Aug 2023 10:22:00 +0200 +Subject: clk: imx: composite-8m: fix clock pauses when set_rate would be a + no-op + +From: Ahmad Fatoum + +[ Upstream commit 4dd432d985ef258e3bc436e568fba4b987b59171 ] + +Reconfiguring the clock divider to the exact same value is observed +on an i.MX8MN to often cause a longer than usual clock pause, probably +because the divider restarts counting whenever the register is rewritten. + +This issue doesn't show up normally, because the clock framework will +take care to not call set_rate when the clock rate is the same. +However, when we reconfigure an upstream clock, the common code will +call set_rate with the newly calculated rate on all children, e.g.: + + - sai5 is running normally and divides Audio PLL out by 16. + - Audio PLL rate is increased by 32Hz (glitch-free kdiv change) + - rates for children are recalculated and rates are set recursively + - imx8m_clk_composite_divider_set_rate(sai5) is called with + 32/16 = 2Hz more + - imx8m_clk_composite_divider_set_rate computes same divider as before + - divider register is written, so it restarts counting from zero and + MCLK is briefly paused, so instead of e.g. 40ns, MCLK is low for 120ns. + +Some external clock consumers can be upset by such unexpected clock pauses, +so let's make sure we only rewrite the divider value when the value to be +written is actually different. + +Fixes: d3ff9728134e ("clk: imx: Add imx composite clock") +Signed-off-by: Ahmad Fatoum +Reviewed-by: Peng Fan +Link: https://lore.kernel.org/r/20230807082201.2332746-1-a.fatoum@pengutronix.de +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-composite-8m.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/imx/clk-composite-8m.c b/drivers/clk/imx/clk-composite-8m.c +index cbf0d7955a00a..3e9a092e136c1 100644 +--- a/drivers/clk/imx/clk-composite-8m.c ++++ b/drivers/clk/imx/clk-composite-8m.c +@@ -97,7 +97,7 @@ static int imx8m_clk_composite_divider_set_rate(struct clk_hw *hw, + int prediv_value; + int div_value; + int ret; +- u32 val; ++ u32 orig, val; + + ret = imx8m_clk_composite_compute_dividers(rate, parent_rate, + &prediv_value, &div_value); +@@ -106,13 +106,15 @@ static int imx8m_clk_composite_divider_set_rate(struct clk_hw *hw, + + spin_lock_irqsave(divider->lock, flags); + +- val = readl(divider->reg); +- val &= ~((clk_div_mask(divider->width) << divider->shift) | +- (clk_div_mask(PCG_DIV_WIDTH) << PCG_DIV_SHIFT)); ++ orig = readl(divider->reg); ++ val = orig & ~((clk_div_mask(divider->width) << divider->shift) | ++ (clk_div_mask(PCG_DIV_WIDTH) << PCG_DIV_SHIFT)); + + val |= (u32)(prediv_value - 1) << divider->shift; + val |= (u32)(div_value - 1) << PCG_DIV_SHIFT; +- writel(val, divider->reg); ++ ++ if (val != orig) ++ writel(val, divider->reg); + + spin_unlock_irqrestore(divider->lock, flags); + +-- +2.40.1 + diff --git a/queue-6.1/clk-imx-imx8ulp-update-spll2-type.patch b/queue-6.1/clk-imx-imx8ulp-update-spll2-type.patch new file mode 100644 index 00000000000..b65f9279365 --- /dev/null +++ b/queue-6.1/clk-imx-imx8ulp-update-spll2-type.patch @@ -0,0 +1,39 @@ +From 2cb59d3d454130c10cad5f92bd98aea516906f72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jun 2023 20:33:40 +0800 +Subject: clk: imx: imx8ulp: update SPLL2 type + +From: Peng Fan + +[ Upstream commit 7653a59be8af043adc4c09473975a860e6055ff9 ] + +The SPLL2 on iMX8ULP is different with other frac PLLs, it can +support VCO from 650Mhz to 1Ghz. Following the changes to pllv4, +use the new type IMX_PLLV4_IMX8ULP_1GHZ. + +Fixes: c43a801a5789 ("clk: imx: Add clock driver for imx8ulp") +Signed-off-by: Peng Fan +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20230625123340.4067536-2-peng.fan@oss.nxp.com +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8ulp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/imx/clk-imx8ulp.c b/drivers/clk/imx/clk-imx8ulp.c +index ca0e4a3aa454e..fa9121b3cf36a 100644 +--- a/drivers/clk/imx/clk-imx8ulp.c ++++ b/drivers/clk/imx/clk-imx8ulp.c +@@ -167,7 +167,7 @@ static int imx8ulp_clk_cgc1_init(struct platform_device *pdev) + clks[IMX8ULP_CLK_SPLL2_PRE_SEL] = imx_clk_hw_mux_flags("spll2_pre_sel", base + 0x510, 0, 1, pll_pre_sels, ARRAY_SIZE(pll_pre_sels), CLK_SET_PARENT_GATE); + clks[IMX8ULP_CLK_SPLL3_PRE_SEL] = imx_clk_hw_mux_flags("spll3_pre_sel", base + 0x610, 0, 1, pll_pre_sels, ARRAY_SIZE(pll_pre_sels), CLK_SET_PARENT_GATE); + +- clks[IMX8ULP_CLK_SPLL2] = imx_clk_hw_pllv4(IMX_PLLV4_IMX8ULP, "spll2", "spll2_pre_sel", base + 0x500); ++ clks[IMX8ULP_CLK_SPLL2] = imx_clk_hw_pllv4(IMX_PLLV4_IMX8ULP_1GHZ, "spll2", "spll2_pre_sel", base + 0x500); + clks[IMX8ULP_CLK_SPLL3] = imx_clk_hw_pllv4(IMX_PLLV4_IMX8ULP, "spll3", "spll3_pre_sel", base + 0x600); + clks[IMX8ULP_CLK_SPLL3_VCODIV] = imx_clk_hw_divider("spll3_vcodiv", "spll3", base + 0x604, 0, 6); + +-- +2.40.1 + diff --git a/queue-6.1/clk-imx-pllv4-fix-spll2-mult-range.patch b/queue-6.1/clk-imx-pllv4-fix-spll2-mult-range.patch new file mode 100644 index 00000000000..55ef74bc163 --- /dev/null +++ b/queue-6.1/clk-imx-pllv4-fix-spll2-mult-range.patch @@ -0,0 +1,150 @@ +From 0eff080f270a7c25663a91d105541b2c90a86637 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jun 2023 20:33:39 +0800 +Subject: clk: imx: pllv4: Fix SPLL2 MULT range + +From: Ye Li + +[ Upstream commit 3f0cdb945471f1abd1cf4d172190e9c489c5052a ] + +The SPLL2 on iMX8ULP is different with other frac PLLs, it can +support VCO from 650Mhz to 1Ghz. According to RM, the MULT is +using a range from 27 to 54, not some fixed values. If using +current PLL implementation, some clock rate can't be supported. + +Fix the issue by adding new type for the SPLL2 and use MULT range +to replace MULT table + +Fixes: 5f0601c47c33 ("clk: imx: Update the pllv4 to support imx8ulp") +Reviewed-by: Peng Fan +Reviewed-by: Jacky Bai +Signed-off-by: Ye Li +Signed-off-by: Peng Fan +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20230625123340.4067536-1-peng.fan@oss.nxp.com +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-pllv4.c | 46 +++++++++++++++++++++++++++++-------- + drivers/clk/imx/clk.h | 1 + + 2 files changed, 37 insertions(+), 10 deletions(-) + +diff --git a/drivers/clk/imx/clk-pllv4.c b/drivers/clk/imx/clk-pllv4.c +index 6e7e34571fc8d..9b136c951762c 100644 +--- a/drivers/clk/imx/clk-pllv4.c ++++ b/drivers/clk/imx/clk-pllv4.c +@@ -44,11 +44,15 @@ struct clk_pllv4 { + u32 cfg_offset; + u32 num_offset; + u32 denom_offset; ++ bool use_mult_range; + }; + + /* Valid PLL MULT Table */ + static const int pllv4_mult_table[] = {33, 27, 22, 20, 17, 16}; + ++/* Valid PLL MULT range, (max, min) */ ++static const int pllv4_mult_range[] = {54, 27}; ++ + #define to_clk_pllv4(__hw) container_of(__hw, struct clk_pllv4, hw) + + #define LOCK_TIMEOUT_US USEC_PER_MSEC +@@ -94,17 +98,30 @@ static unsigned long clk_pllv4_recalc_rate(struct clk_hw *hw, + static long clk_pllv4_round_rate(struct clk_hw *hw, unsigned long rate, + unsigned long *prate) + { ++ struct clk_pllv4 *pll = to_clk_pllv4(hw); + unsigned long parent_rate = *prate; + unsigned long round_rate, i; + u32 mfn, mfd = DEFAULT_MFD; + bool found = false; + u64 temp64; +- +- for (i = 0; i < ARRAY_SIZE(pllv4_mult_table); i++) { +- round_rate = parent_rate * pllv4_mult_table[i]; +- if (rate >= round_rate) { ++ u32 mult; ++ ++ if (pll->use_mult_range) { ++ temp64 = (u64)rate; ++ do_div(temp64, parent_rate); ++ mult = temp64; ++ if (mult >= pllv4_mult_range[1] && ++ mult <= pllv4_mult_range[0]) { ++ round_rate = parent_rate * mult; + found = true; +- break; ++ } ++ } else { ++ for (i = 0; i < ARRAY_SIZE(pllv4_mult_table); i++) { ++ round_rate = parent_rate * pllv4_mult_table[i]; ++ if (rate >= round_rate) { ++ found = true; ++ break; ++ } + } + } + +@@ -138,14 +155,20 @@ static long clk_pllv4_round_rate(struct clk_hw *hw, unsigned long rate, + return round_rate + (u32)temp64; + } + +-static bool clk_pllv4_is_valid_mult(unsigned int mult) ++static bool clk_pllv4_is_valid_mult(struct clk_pllv4 *pll, unsigned int mult) + { + int i; + + /* check if mult is in valid MULT table */ +- for (i = 0; i < ARRAY_SIZE(pllv4_mult_table); i++) { +- if (pllv4_mult_table[i] == mult) ++ if (pll->use_mult_range) { ++ if (mult >= pllv4_mult_range[1] && ++ mult <= pllv4_mult_range[0]) + return true; ++ } else { ++ for (i = 0; i < ARRAY_SIZE(pllv4_mult_table); i++) { ++ if (pllv4_mult_table[i] == mult) ++ return true; ++ } + } + + return false; +@@ -160,7 +183,7 @@ static int clk_pllv4_set_rate(struct clk_hw *hw, unsigned long rate, + + mult = rate / parent_rate; + +- if (!clk_pllv4_is_valid_mult(mult)) ++ if (!clk_pllv4_is_valid_mult(pll, mult)) + return -EINVAL; + + if (parent_rate <= MAX_MFD) +@@ -227,10 +250,13 @@ struct clk_hw *imx_clk_hw_pllv4(enum imx_pllv4_type type, const char *name, + + pll->base = base; + +- if (type == IMX_PLLV4_IMX8ULP) { ++ if (type == IMX_PLLV4_IMX8ULP || ++ type == IMX_PLLV4_IMX8ULP_1GHZ) { + pll->cfg_offset = IMX8ULP_PLL_CFG_OFFSET; + pll->num_offset = IMX8ULP_PLL_NUM_OFFSET; + pll->denom_offset = IMX8ULP_PLL_DENOM_OFFSET; ++ if (type == IMX_PLLV4_IMX8ULP_1GHZ) ++ pll->use_mult_range = true; + } else { + pll->cfg_offset = PLL_CFG_OFFSET; + pll->num_offset = PLL_NUM_OFFSET; +diff --git a/drivers/clk/imx/clk.h b/drivers/clk/imx/clk.h +index dd49f90110e8b..fb59131395f03 100644 +--- a/drivers/clk/imx/clk.h ++++ b/drivers/clk/imx/clk.h +@@ -46,6 +46,7 @@ enum imx_pll14xx_type { + enum imx_pllv4_type { + IMX_PLLV4_IMX7ULP, + IMX_PLLV4_IMX8ULP, ++ IMX_PLLV4_IMX8ULP_1GHZ, + }; + + enum imx_pfdv2_type { +-- +2.40.1 + diff --git a/queue-6.1/clk-imx8mp-fix-sai4-clock.patch b/queue-6.1/clk-imx8mp-fix-sai4-clock.patch new file mode 100644 index 00000000000..384abcf77b4 --- /dev/null +++ b/queue-6.1/clk-imx8mp-fix-sai4-clock.patch @@ -0,0 +1,49 @@ +From d022e61c1da37808eb435f97ef05820d1538b974 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jul 2023 16:21:49 +0200 +Subject: clk: imx8mp: fix sai4 clock + +From: Marco Felsch + +[ Upstream commit c30f600f1f41dcf5ef0fb02e9a201f9b2e8f31bd ] + +The reference manual don't mention a SAI4 hardware block. This would be +clock slice 78 which is skipped (TRM, page 237). Remove any reference to +this clock to align the driver with the reality. + +Fixes: 9c140d992676 ("clk: imx: Add support for i.MX8MP clock driver") +Acked-by: Stephen Boyd +Signed-off-by: Marco Felsch +Link: https://lore.kernel.org/r/20230731142150.3186650-1-m.felsch@pengutronix.de +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8mp.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c +index 05c02f4e2a143..3d0d8f2c02dc1 100644 +--- a/drivers/clk/imx/clk-imx8mp.c ++++ b/drivers/clk/imx/clk-imx8mp.c +@@ -177,10 +177,6 @@ static const char * const imx8mp_sai3_sels[] = {"osc_24m", "audio_pll1_out", "au + "video_pll1_out", "sys_pll1_133m", "osc_hdmi", + "clk_ext3", "clk_ext4", }; + +-static const char * const imx8mp_sai4_sels[] = {"osc_24m", "audio_pll1_out", "audio_pll2_out", +- "video_pll1_out", "sys_pll1_133m", "osc_hdmi", +- "clk_ext1", "clk_ext2", }; +- + static const char * const imx8mp_sai5_sels[] = {"osc_24m", "audio_pll1_out", "audio_pll2_out", + "video_pll1_out", "sys_pll1_133m", "osc_hdmi", + "clk_ext2", "clk_ext3", }; +@@ -566,7 +562,6 @@ static int imx8mp_clocks_probe(struct platform_device *pdev) + hws[IMX8MP_CLK_SAI1] = imx8m_clk_hw_composite("sai1", imx8mp_sai1_sels, ccm_base + 0xa580); + hws[IMX8MP_CLK_SAI2] = imx8m_clk_hw_composite("sai2", imx8mp_sai2_sels, ccm_base + 0xa600); + hws[IMX8MP_CLK_SAI3] = imx8m_clk_hw_composite("sai3", imx8mp_sai3_sels, ccm_base + 0xa680); +- hws[IMX8MP_CLK_SAI4] = imx8m_clk_hw_composite("sai4", imx8mp_sai4_sels, ccm_base + 0xa700); + hws[IMX8MP_CLK_SAI5] = imx8m_clk_hw_composite("sai5", imx8mp_sai5_sels, ccm_base + 0xa780); + hws[IMX8MP_CLK_SAI6] = imx8m_clk_hw_composite("sai6", imx8mp_sai6_sels, ccm_base + 0xa800); + hws[IMX8MP_CLK_ENET_QOS] = imx8m_clk_hw_composite("enet_qos", imx8mp_enet_qos_sels, ccm_base + 0xa880); +-- +2.40.1 + diff --git a/queue-6.1/clk-qcom-gcc-sc7180-fix-up-gcc_sdcc2_apps_clk_src.patch b/queue-6.1/clk-qcom-gcc-sc7180-fix-up-gcc_sdcc2_apps_clk_src.patch new file mode 100644 index 00000000000..87c337a229e --- /dev/null +++ b/queue-6.1/clk-qcom-gcc-sc7180-fix-up-gcc_sdcc2_apps_clk_src.patch @@ -0,0 +1,37 @@ +From e85cb68cacff5d9a6047e85f6575384de7b48e43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 21:05:02 +0200 +Subject: clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src + +From: David Wronek + +[ Upstream commit fd0b5ba87ad5709f0fd3d2bc4b7870494a75f96a ] + +Set .flags = CLK_OPS_PARENT_ENABLE to fix "gcc_sdcc2_apps_clk_src: rcg +didn't update its configuration" error. + +Fixes: 17269568f726 ("clk: qcom: Add Global Clock controller (GCC) driver for SC7180") +Signed-off-by: David Wronek +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230723190725.1619193-2-davidwronek@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sc7180.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/gcc-sc7180.c b/drivers/clk/qcom/gcc-sc7180.c +index 2d3980251e78e..5822db4f4f358 100644 +--- a/drivers/clk/qcom/gcc-sc7180.c ++++ b/drivers/clk/qcom/gcc-sc7180.c +@@ -667,6 +667,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = { + .name = "gcc_sdcc2_apps_clk_src", + .parent_data = gcc_parent_data_5, + .num_parents = ARRAY_SIZE(gcc_parent_data_5), ++ .flags = CLK_OPS_PARENT_ENABLE, + .ops = &clk_rcg2_floor_ops, + }, + }; +-- +2.40.1 + diff --git a/queue-6.1/clk-qcom-gcc-sc8280xp-add-emac-gdscs.patch b/queue-6.1/clk-qcom-gcc-sc8280xp-add-emac-gdscs.patch new file mode 100644 index 00000000000..61f36e3a719 --- /dev/null +++ b/queue-6.1/clk-qcom-gcc-sc8280xp-add-emac-gdscs.patch @@ -0,0 +1,75 @@ +From 26ad626953355fc6cca14361040cd7bd033e7079 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 14:15:39 -0500 +Subject: clk: qcom: gcc-sc8280xp: Add EMAC GDSCs + +From: Andrew Halaney + +[ Upstream commit 32c2f2a46db1322caaf78d5ea747ed5c56d2e353 ] + +Add the EMAC GDSCs to allow the EMAC hardware to be enabled. + +Acked-by: Stephen Boyd +Reviewed-by: Konrad Dybcio +Tested-by: Brian Masney +Signed-off-by: Andrew Halaney +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230413191541.1073027-2-ahalaney@redhat.com +Stable-dep-of: 2fd02de27054 ("clk: qcom: gcc-sc8280xp: Add missing GDSC flags") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sc8280xp.c | 18 ++++++++++++++++++ + include/dt-bindings/clock/qcom,gcc-sc8280xp.h | 2 ++ + 2 files changed, 20 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-sc8280xp.c b/drivers/clk/qcom/gcc-sc8280xp.c +index b3198784e1c3d..04a99dbaa57e0 100644 +--- a/drivers/clk/qcom/gcc-sc8280xp.c ++++ b/drivers/clk/qcom/gcc-sc8280xp.c +@@ -6873,6 +6873,22 @@ static struct gdsc usb30_sec_gdsc = { + .pwrsts = PWRSTS_RET_ON, + }; + ++static struct gdsc emac_0_gdsc = { ++ .gdscr = 0xaa004, ++ .pd = { ++ .name = "emac_0_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++}; ++ ++static struct gdsc emac_1_gdsc = { ++ .gdscr = 0xba004, ++ .pd = { ++ .name = "emac_1_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++}; ++ + static struct clk_regmap *gcc_sc8280xp_clocks[] = { + [GCC_AGGRE_NOC_PCIE0_TUNNEL_AXI_CLK] = &gcc_aggre_noc_pcie0_tunnel_axi_clk.clkr, + [GCC_AGGRE_NOC_PCIE1_TUNNEL_AXI_CLK] = &gcc_aggre_noc_pcie1_tunnel_axi_clk.clkr, +@@ -7351,6 +7367,8 @@ static struct gdsc *gcc_sc8280xp_gdscs[] = { + [USB30_MP_GDSC] = &usb30_mp_gdsc, + [USB30_PRIM_GDSC] = &usb30_prim_gdsc, + [USB30_SEC_GDSC] = &usb30_sec_gdsc, ++ [EMAC_0_GDSC] = &emac_0_gdsc, ++ [EMAC_1_GDSC] = &emac_1_gdsc, + }; + + static const struct clk_rcg_dfs_data gcc_dfs_clocks[] = { +diff --git a/include/dt-bindings/clock/qcom,gcc-sc8280xp.h b/include/dt-bindings/clock/qcom,gcc-sc8280xp.h +index cb2fb638825ca..721105ea4fad8 100644 +--- a/include/dt-bindings/clock/qcom,gcc-sc8280xp.h ++++ b/include/dt-bindings/clock/qcom,gcc-sc8280xp.h +@@ -492,5 +492,7 @@ + #define USB30_MP_GDSC 9 + #define USB30_PRIM_GDSC 10 + #define USB30_SEC_GDSC 11 ++#define EMAC_0_GDSC 12 ++#define EMAC_1_GDSC 13 + + #endif +-- +2.40.1 + diff --git a/queue-6.1/clk-qcom-gcc-sc8280xp-add-missing-gdsc-flags.patch b/queue-6.1/clk-qcom-gcc-sc8280xp-add-missing-gdsc-flags.patch new file mode 100644 index 00000000000..0833f5a4b8a --- /dev/null +++ b/queue-6.1/clk-qcom-gcc-sc8280xp-add-missing-gdsc-flags.patch @@ -0,0 +1,148 @@ +From e6e174892154f5375ed515f5e1d4bf8ed1669d4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 19:48:06 +0200 +Subject: clk: qcom: gcc-sc8280xp: Add missing GDSC flags + +From: Konrad Dybcio + +[ Upstream commit 2fd02de27054576a4a8c89302e2f77122c55e957 ] + +All of the 8280's GCC GDSCs can and should use the retain registers so +as not to lose their state when entering lower power modes. + +Fixes: d65d005f9a6c ("clk: qcom: add sc8280xp GCC driver") +Signed-off-by: Konrad Dybcio +Acked-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20230620-topic-sc8280_gccgdsc-v2-1-562c1428c10d@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sc8280xp.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-sc8280xp.c b/drivers/clk/qcom/gcc-sc8280xp.c +index 04a99dbaa57e0..43c518e5c986b 100644 +--- a/drivers/clk/qcom/gcc-sc8280xp.c ++++ b/drivers/clk/qcom/gcc-sc8280xp.c +@@ -6760,7 +6760,7 @@ static struct gdsc pcie_0_tunnel_gdsc = { + .name = "pcie_0_tunnel_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, +- .flags = VOTABLE, ++ .flags = VOTABLE | RETAIN_FF_ENABLE, + }; + + static struct gdsc pcie_1_tunnel_gdsc = { +@@ -6771,7 +6771,7 @@ static struct gdsc pcie_1_tunnel_gdsc = { + .name = "pcie_1_tunnel_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, +- .flags = VOTABLE, ++ .flags = VOTABLE | RETAIN_FF_ENABLE, + }; + + /* +@@ -6786,7 +6786,7 @@ static struct gdsc pcie_2a_gdsc = { + .name = "pcie_2a_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, +- .flags = VOTABLE | ALWAYS_ON, ++ .flags = VOTABLE | RETAIN_FF_ENABLE | ALWAYS_ON, + }; + + static struct gdsc pcie_2b_gdsc = { +@@ -6797,7 +6797,7 @@ static struct gdsc pcie_2b_gdsc = { + .name = "pcie_2b_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, +- .flags = VOTABLE | ALWAYS_ON, ++ .flags = VOTABLE | RETAIN_FF_ENABLE | ALWAYS_ON, + }; + + static struct gdsc pcie_3a_gdsc = { +@@ -6808,7 +6808,7 @@ static struct gdsc pcie_3a_gdsc = { + .name = "pcie_3a_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, +- .flags = VOTABLE | ALWAYS_ON, ++ .flags = VOTABLE | RETAIN_FF_ENABLE | ALWAYS_ON, + }; + + static struct gdsc pcie_3b_gdsc = { +@@ -6819,7 +6819,7 @@ static struct gdsc pcie_3b_gdsc = { + .name = "pcie_3b_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, +- .flags = VOTABLE | ALWAYS_ON, ++ .flags = VOTABLE | RETAIN_FF_ENABLE | ALWAYS_ON, + }; + + static struct gdsc pcie_4_gdsc = { +@@ -6830,7 +6830,7 @@ static struct gdsc pcie_4_gdsc = { + .name = "pcie_4_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, +- .flags = VOTABLE | ALWAYS_ON, ++ .flags = VOTABLE | RETAIN_FF_ENABLE | ALWAYS_ON, + }; + + static struct gdsc ufs_card_gdsc = { +@@ -6839,6 +6839,7 @@ static struct gdsc ufs_card_gdsc = { + .name = "ufs_card_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = RETAIN_FF_ENABLE, + }; + + static struct gdsc ufs_phy_gdsc = { +@@ -6847,6 +6848,7 @@ static struct gdsc ufs_phy_gdsc = { + .name = "ufs_phy_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = RETAIN_FF_ENABLE, + }; + + static struct gdsc usb30_mp_gdsc = { +@@ -6855,6 +6857,7 @@ static struct gdsc usb30_mp_gdsc = { + .name = "usb30_mp_gdsc", + }, + .pwrsts = PWRSTS_RET_ON, ++ .flags = RETAIN_FF_ENABLE, + }; + + static struct gdsc usb30_prim_gdsc = { +@@ -6863,6 +6866,7 @@ static struct gdsc usb30_prim_gdsc = { + .name = "usb30_prim_gdsc", + }, + .pwrsts = PWRSTS_RET_ON, ++ .flags = RETAIN_FF_ENABLE, + }; + + static struct gdsc usb30_sec_gdsc = { +@@ -6871,6 +6875,7 @@ static struct gdsc usb30_sec_gdsc = { + .name = "usb30_sec_gdsc", + }, + .pwrsts = PWRSTS_RET_ON, ++ .flags = RETAIN_FF_ENABLE, + }; + + static struct gdsc emac_0_gdsc = { +@@ -6879,6 +6884,7 @@ static struct gdsc emac_0_gdsc = { + .name = "emac_0_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = RETAIN_FF_ENABLE, + }; + + static struct gdsc emac_1_gdsc = { +@@ -6887,6 +6893,7 @@ static struct gdsc emac_1_gdsc = { + .name = "emac_1_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = RETAIN_FF_ENABLE, + }; + + static struct clk_regmap *gcc_sc8280xp_clocks[] = { +-- +2.40.1 + diff --git a/queue-6.1/clk-qcom-gcc-sc8280xp-add-missing-gdscs.patch b/queue-6.1/clk-qcom-gcc-sc8280xp-add-missing-gdscs.patch new file mode 100644 index 00000000000..faf567a6d2a --- /dev/null +++ b/queue-6.1/clk-qcom-gcc-sc8280xp-add-missing-gdscs.patch @@ -0,0 +1,143 @@ +From 7b1c4a9b009a8de33df532e8473207efa1e5a268 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 19:48:08 +0200 +Subject: clk: qcom: gcc-sc8280xp: Add missing GDSCs + +From: Konrad Dybcio + +[ Upstream commit 4712eb7ff85bd3dd09c6668b8de4080e02b3eea9 ] + +There are 10 more GDSCs that we've not been caring about, and by extension +(and perhaps even more importantly), not putting to sleep. Add them. + +Fixes: d65d005f9a6c ("clk: qcom: add sc8280xp GCC driver") +Signed-off-by: Konrad Dybcio +Acked-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20230620-topic-sc8280_gccgdsc-v2-3-562c1428c10d@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sc8280xp.c | 100 ++++++++++++++++++++++++++++++++ + 1 file changed, 100 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-sc8280xp.c b/drivers/clk/qcom/gcc-sc8280xp.c +index 43c518e5c986b..57bbd609151cd 100644 +--- a/drivers/clk/qcom/gcc-sc8280xp.c ++++ b/drivers/clk/qcom/gcc-sc8280xp.c +@@ -6896,6 +6896,96 @@ static struct gdsc emac_1_gdsc = { + .flags = RETAIN_FF_ENABLE, + }; + ++static struct gdsc usb4_1_gdsc = { ++ .gdscr = 0xb8004, ++ .pd = { ++ .name = "usb4_1_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++ .flags = RETAIN_FF_ENABLE, ++}; ++ ++static struct gdsc usb4_gdsc = { ++ .gdscr = 0x2a004, ++ .pd = { ++ .name = "usb4_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++ .flags = RETAIN_FF_ENABLE, ++}; ++ ++static struct gdsc hlos1_vote_mmnoc_mmu_tbu_hf0_gdsc = { ++ .gdscr = 0x7d050, ++ .pd = { ++ .name = "hlos1_vote_mmnoc_mmu_tbu_hf0_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++ .flags = VOTABLE, ++}; ++ ++static struct gdsc hlos1_vote_mmnoc_mmu_tbu_hf1_gdsc = { ++ .gdscr = 0x7d058, ++ .pd = { ++ .name = "hlos1_vote_mmnoc_mmu_tbu_hf1_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++ .flags = VOTABLE, ++}; ++ ++static struct gdsc hlos1_vote_mmnoc_mmu_tbu_sf0_gdsc = { ++ .gdscr = 0x7d054, ++ .pd = { ++ .name = "hlos1_vote_mmnoc_mmu_tbu_sf0_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++ .flags = VOTABLE, ++}; ++ ++static struct gdsc hlos1_vote_mmnoc_mmu_tbu_sf1_gdsc = { ++ .gdscr = 0x7d06c, ++ .pd = { ++ .name = "hlos1_vote_mmnoc_mmu_tbu_sf1_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++ .flags = VOTABLE, ++}; ++ ++static struct gdsc hlos1_vote_turing_mmu_tbu0_gdsc = { ++ .gdscr = 0x7d05c, ++ .pd = { ++ .name = "hlos1_vote_turing_mmu_tbu0_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++ .flags = VOTABLE, ++}; ++ ++static struct gdsc hlos1_vote_turing_mmu_tbu1_gdsc = { ++ .gdscr = 0x7d060, ++ .pd = { ++ .name = "hlos1_vote_turing_mmu_tbu1_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++ .flags = VOTABLE, ++}; ++ ++static struct gdsc hlos1_vote_turing_mmu_tbu2_gdsc = { ++ .gdscr = 0x7d0a0, ++ .pd = { ++ .name = "hlos1_vote_turing_mmu_tbu2_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++ .flags = VOTABLE, ++}; ++ ++static struct gdsc hlos1_vote_turing_mmu_tbu3_gdsc = { ++ .gdscr = 0x7d0a4, ++ .pd = { ++ .name = "hlos1_vote_turing_mmu_tbu3_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++ .flags = VOTABLE, ++}; ++ + static struct clk_regmap *gcc_sc8280xp_clocks[] = { + [GCC_AGGRE_NOC_PCIE0_TUNNEL_AXI_CLK] = &gcc_aggre_noc_pcie0_tunnel_axi_clk.clkr, + [GCC_AGGRE_NOC_PCIE1_TUNNEL_AXI_CLK] = &gcc_aggre_noc_pcie1_tunnel_axi_clk.clkr, +@@ -7376,6 +7466,16 @@ static struct gdsc *gcc_sc8280xp_gdscs[] = { + [USB30_SEC_GDSC] = &usb30_sec_gdsc, + [EMAC_0_GDSC] = &emac_0_gdsc, + [EMAC_1_GDSC] = &emac_1_gdsc, ++ [USB4_1_GDSC] = &usb4_1_gdsc, ++ [USB4_GDSC] = &usb4_gdsc, ++ [HLOS1_VOTE_MMNOC_MMU_TBU_HF0_GDSC] = &hlos1_vote_mmnoc_mmu_tbu_hf0_gdsc, ++ [HLOS1_VOTE_MMNOC_MMU_TBU_HF1_GDSC] = &hlos1_vote_mmnoc_mmu_tbu_hf1_gdsc, ++ [HLOS1_VOTE_MMNOC_MMU_TBU_SF0_GDSC] = &hlos1_vote_mmnoc_mmu_tbu_sf0_gdsc, ++ [HLOS1_VOTE_MMNOC_MMU_TBU_SF1_GDSC] = &hlos1_vote_mmnoc_mmu_tbu_sf1_gdsc, ++ [HLOS1_VOTE_TURING_MMU_TBU0_GDSC] = &hlos1_vote_turing_mmu_tbu0_gdsc, ++ [HLOS1_VOTE_TURING_MMU_TBU1_GDSC] = &hlos1_vote_turing_mmu_tbu1_gdsc, ++ [HLOS1_VOTE_TURING_MMU_TBU2_GDSC] = &hlos1_vote_turing_mmu_tbu2_gdsc, ++ [HLOS1_VOTE_TURING_MMU_TBU3_GDSC] = &hlos1_vote_turing_mmu_tbu3_gdsc, + }; + + static const struct clk_rcg_dfs_data gcc_dfs_clocks[] = { +-- +2.40.1 + diff --git a/queue-6.1/clk-qcom-gcc-sm6350-fix-gcc_sdcc2_apps_clk_src.patch b/queue-6.1/clk-qcom-gcc-sm6350-fix-gcc_sdcc2_apps_clk_src.patch new file mode 100644 index 00000000000..cd3cb7595d4 --- /dev/null +++ b/queue-6.1/clk-qcom-gcc-sm6350-fix-gcc_sdcc2_apps_clk_src.patch @@ -0,0 +1,38 @@ +From 7de4e871ca11c782cabecf03eb1eca4d70f16d96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 16:09:30 +0200 +Subject: clk: qcom: gcc-sm6350: Fix gcc_sdcc2_apps_clk_src + +From: Luca Weiss + +[ Upstream commit df04d166d1f346dbf740bbea64a3bed3e7f14c8d ] + +GPLL7 is not on by default, which causes a "gcc_sdcc2_apps_clk_src: rcg +didn't update its configuration" error when booting. Set .flags = +CLK_OPS_PARENT_ENABLE to fix the error. + +Fixes: 131abae905df ("clk: qcom: Add SM6350 GCC driver") +Signed-off-by: Luca Weiss +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230804-sm6350-sdcc2-v1-1-3d946927d37d@fairphone.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sm6350.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/gcc-sm6350.c b/drivers/clk/qcom/gcc-sm6350.c +index 9b4e4bb059635..cf4a7b6e0b23a 100644 +--- a/drivers/clk/qcom/gcc-sm6350.c ++++ b/drivers/clk/qcom/gcc-sm6350.c +@@ -641,6 +641,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = { + .name = "gcc_sdcc2_apps_clk_src", + .parent_data = gcc_parent_data_8, + .num_parents = ARRAY_SIZE(gcc_parent_data_8), ++ .flags = CLK_OPS_PARENT_ENABLE, + .ops = &clk_rcg2_floor_ops, + }, + }; +-- +2.40.1 + diff --git a/queue-6.1/clk-qcom-gcc-sm8250-fix-gcc_sdcc2_apps_clk_src.patch b/queue-6.1/clk-qcom-gcc-sm8250-fix-gcc_sdcc2_apps_clk_src.patch new file mode 100644 index 00000000000..ff802514b7d --- /dev/null +++ b/queue-6.1/clk-qcom-gcc-sm8250-fix-gcc_sdcc2_apps_clk_src.patch @@ -0,0 +1,40 @@ +From 6ead26041e0e1208dcbd5871a11f32f404db153d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Aug 2023 14:04:00 -0700 +Subject: clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src + +From: Patrick Whewell + +[ Upstream commit 783cb693828ce487cf0bc6ad16cbcf2caae6f8d9 ] + +GPLL9 is not on by default, which causes a "gcc_sdcc2_apps_clk_src: rcg +didn't update its configuration" error when booting. Set .flags = +CLK_OPS_PARENT_ENABLE to fix the error. + +Fixes: 3e5770921a88 ("clk: qcom: gcc: Add global clock controller driver for SM8250") +Reviewed-by: Konrad Dybcio +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Patrick Whewell +Reviewed-by: Vinod Koul +Link: https://lore.kernel.org/r/20230802210359.408-1-patrick.whewell@sightlineapplications.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sm8250.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/gcc-sm8250.c b/drivers/clk/qcom/gcc-sm8250.c +index a0ba37656b07b..30bd561461074 100644 +--- a/drivers/clk/qcom/gcc-sm8250.c ++++ b/drivers/clk/qcom/gcc-sm8250.c +@@ -721,6 +721,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = { + .name = "gcc_sdcc2_apps_clk_src", + .parent_data = gcc_parent_data_4, + .num_parents = ARRAY_SIZE(gcc_parent_data_4), ++ .flags = CLK_OPS_PARENT_ENABLE, + .ops = &clk_rcg2_floor_ops, + }, + }; +-- +2.40.1 + diff --git a/queue-6.1/clk-qcom-gcc-sm8450-use-floor-ops-for-sdcc-rcgs.patch b/queue-6.1/clk-qcom-gcc-sm8450-use-floor-ops-for-sdcc-rcgs.patch new file mode 100644 index 00000000000..758ed627731 --- /dev/null +++ b/queue-6.1/clk-qcom-gcc-sm8450-use-floor-ops-for-sdcc-rcgs.patch @@ -0,0 +1,48 @@ +From e671045b56b3c151eae7caa6a5fcdc7095a2edf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 19:35:53 +0200 +Subject: clk: qcom: gcc-sm8450: Use floor ops for SDCC RCGs + +From: Konrad Dybcio + +[ Upstream commit a27ac3806b0a0e6954fb5967223b8635242e5b8f ] + +Use the floor ops to prevent warnings like this at suspend exit and boot: + +mmc0: Card appears overclocked; req 800000 Hz, actual 25000000 Hz + +Fixes: db0c944ee92b ("clk: qcom: Add clock driver for SM8450") +Signed-off-by: Konrad Dybcio +Reviewed-by: Vinod Koul +Link: https://lore.kernel.org/r/20230811-topic-8450_clk-v1-1-88031478d548@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sm8450.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-sm8450.c b/drivers/clk/qcom/gcc-sm8450.c +index 666efa5ff9780..59c567e76d656 100644 +--- a/drivers/clk/qcom/gcc-sm8450.c ++++ b/drivers/clk/qcom/gcc-sm8450.c +@@ -904,7 +904,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = { + .parent_data = gcc_parent_data_7, + .num_parents = ARRAY_SIZE(gcc_parent_data_7), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +@@ -926,7 +926,7 @@ static struct clk_rcg2 gcc_sdcc4_apps_clk_src = { + .parent_data = gcc_parent_data_0, + .num_parents = ARRAY_SIZE(gcc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +-- +2.40.1 + diff --git a/queue-6.1/clk-qcom-gpucc-sm6350-fix-clock-source-names.patch b/queue-6.1/clk-qcom-gpucc-sm6350-fix-clock-source-names.patch new file mode 100644 index 00000000000..9f78bf4144c --- /dev/null +++ b/queue-6.1/clk-qcom-gpucc-sm6350-fix-clock-source-names.patch @@ -0,0 +1,47 @@ +From 5ee2b1bdabf31985cf1998f053cbc584540b35b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 13:35:33 +0200 +Subject: clk: qcom: gpucc-sm6350: Fix clock source names + +From: Konrad Dybcio + +[ Upstream commit 743913b343a3ec2510fe3c0dfaff03d049659922 ] + +fw_name for GCC inputs didn't match the bindings. Fix it. + +Fixes: 013804a727a0 ("clk: qcom: Add GPU clock controller driver for SM6350") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230315-topic-lagoon_gpu-v2-2-afcdfb18bb13@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gpucc-sm6350.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/qcom/gpucc-sm6350.c b/drivers/clk/qcom/gpucc-sm6350.c +index a9887d1f0ed71..0bcbba2a29436 100644 +--- a/drivers/clk/qcom/gpucc-sm6350.c ++++ b/drivers/clk/qcom/gpucc-sm6350.c +@@ -132,8 +132,8 @@ static const struct clk_parent_data gpu_cc_parent_data_0[] = { + { .index = DT_BI_TCXO, .fw_name = "bi_tcxo" }, + { .hw = &gpu_cc_pll0.clkr.hw }, + { .hw = &gpu_cc_pll1.clkr.hw }, +- { .index = DT_GPLL0_OUT_MAIN, .fw_name = "gcc_gpu_gpll0_clk" }, +- { .index = DT_GPLL0_OUT_MAIN_DIV, .fw_name = "gcc_gpu_gpll0_div_clk" }, ++ { .index = DT_GPLL0_OUT_MAIN, .fw_name = "gcc_gpu_gpll0_clk_src" }, ++ { .index = DT_GPLL0_OUT_MAIN_DIV, .fw_name = "gcc_gpu_gpll0_div_clk_src" }, + }; + + static const struct parent_map gpu_cc_parent_map_1[] = { +@@ -151,7 +151,7 @@ static const struct clk_parent_data gpu_cc_parent_data_1[] = { + { .hw = &gpu_cc_pll0.clkr.hw }, + { .hw = &gpu_cc_pll1.clkr.hw }, + { .hw = &gpu_cc_pll1.clkr.hw }, +- { .index = DT_GPLL0_OUT_MAIN, .fw_name = "gcc_gpu_gpll0_clk" }, ++ { .index = DT_GPLL0_OUT_MAIN, .fw_name = "gcc_gpu_gpll0_clk_src" }, + }; + + static const struct freq_tbl ftbl_gpu_cc_gmu_clk_src[] = { +-- +2.40.1 + diff --git a/queue-6.1/clk-qcom-gpucc-sm6350-introduce-index-based-clk-look.patch b/queue-6.1/clk-qcom-gpucc-sm6350-introduce-index-based-clk-look.patch new file mode 100644 index 00000000000..ca50cd4671d --- /dev/null +++ b/queue-6.1/clk-qcom-gpucc-sm6350-introduce-index-based-clk-look.patch @@ -0,0 +1,88 @@ +From ff6efc3c9bf8433a64483a31148a2ee439bad400 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 13:35:32 +0200 +Subject: clk: qcom: gpucc-sm6350: Introduce index-based clk lookup + +From: Konrad Dybcio + +[ Upstream commit f6f89d194e4ddcfe197ac8a05ed4161f642a5c68 ] + +Add the nowadays-prefered and marginally faster way of looking up parent +clocks in the device tree. It also allows for clock-names-independent +operation, so long as the order (which is enforced by schema) is kept. + +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230315-topic-lagoon_gpu-v2-1-afcdfb18bb13@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: 743913b343a3 ("clk: qcom: gpucc-sm6350: Fix clock source names") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gpucc-sm6350.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/qcom/gpucc-sm6350.c b/drivers/clk/qcom/gpucc-sm6350.c +index ef15185a99c31..a9887d1f0ed71 100644 +--- a/drivers/clk/qcom/gpucc-sm6350.c ++++ b/drivers/clk/qcom/gpucc-sm6350.c +@@ -24,6 +24,12 @@ + #define CX_GMU_CBCR_WAKE_MASK 0xF + #define CX_GMU_CBCR_WAKE_SHIFT 8 + ++enum { ++ DT_BI_TCXO, ++ DT_GPLL0_OUT_MAIN, ++ DT_GPLL0_OUT_MAIN_DIV, ++}; ++ + enum { + P_BI_TCXO, + P_GPLL0_OUT_MAIN, +@@ -61,6 +67,7 @@ static struct clk_alpha_pll gpu_cc_pll0 = { + .hw.init = &(struct clk_init_data){ + .name = "gpu_cc_pll0", + .parent_data = &(const struct clk_parent_data){ ++ .index = DT_BI_TCXO, + .fw_name = "bi_tcxo", + }, + .num_parents = 1, +@@ -104,6 +111,7 @@ static struct clk_alpha_pll gpu_cc_pll1 = { + .hw.init = &(struct clk_init_data){ + .name = "gpu_cc_pll1", + .parent_data = &(const struct clk_parent_data){ ++ .index = DT_BI_TCXO, + .fw_name = "bi_tcxo", + }, + .num_parents = 1, +@@ -121,11 +129,11 @@ static const struct parent_map gpu_cc_parent_map_0[] = { + }; + + static const struct clk_parent_data gpu_cc_parent_data_0[] = { +- { .fw_name = "bi_tcxo" }, ++ { .index = DT_BI_TCXO, .fw_name = "bi_tcxo" }, + { .hw = &gpu_cc_pll0.clkr.hw }, + { .hw = &gpu_cc_pll1.clkr.hw }, +- { .fw_name = "gcc_gpu_gpll0_clk" }, +- { .fw_name = "gcc_gpu_gpll0_div_clk" }, ++ { .index = DT_GPLL0_OUT_MAIN, .fw_name = "gcc_gpu_gpll0_clk" }, ++ { .index = DT_GPLL0_OUT_MAIN_DIV, .fw_name = "gcc_gpu_gpll0_div_clk" }, + }; + + static const struct parent_map gpu_cc_parent_map_1[] = { +@@ -138,12 +146,12 @@ static const struct parent_map gpu_cc_parent_map_1[] = { + }; + + static const struct clk_parent_data gpu_cc_parent_data_1[] = { +- { .fw_name = "bi_tcxo" }, ++ { .index = DT_BI_TCXO, .fw_name = "bi_tcxo" }, + { .hw = &crc_div.hw }, + { .hw = &gpu_cc_pll0.clkr.hw }, + { .hw = &gpu_cc_pll1.clkr.hw }, + { .hw = &gpu_cc_pll1.clkr.hw }, +- { .fw_name = "gcc_gpu_gpll0_clk" }, ++ { .index = DT_GPLL0_OUT_MAIN, .fw_name = "gcc_gpu_gpll0_clk" }, + }; + + static const struct freq_tbl ftbl_gpu_cc_gmu_clk_src[] = { +-- +2.40.1 + diff --git a/queue-6.1/clk-qcom-reset-use-the-correct-type-of-sleep-delay-b.patch b/queue-6.1/clk-qcom-reset-use-the-correct-type-of-sleep-delay-b.patch new file mode 100644 index 00000000000..6dcfd4c08ab --- /dev/null +++ b/queue-6.1/clk-qcom-reset-use-the-correct-type-of-sleep-delay-b.patch @@ -0,0 +1,40 @@ +From 27879ddb1f4db0553cb05e94cd95d18ecc04ea6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jul 2023 09:57:38 +0200 +Subject: clk: qcom: reset: Use the correct type of sleep/delay based on length + +From: Konrad Dybcio + +[ Upstream commit 181b66ee7cdd824797fc99b53bec29cf5630a04f ] + +Use the fsleep() helper that (based on the length of the delay, see: [1]) +chooses the correct sleep/delay functions. + +[1] https://www.kernel.org/doc/Documentation/timers/timers-howto.txt + +Fixes: 2cb8a39b6781 ("clk: qcom: reset: Allow specifying custom reset delay") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230726-topic-qcom_reset-v3-1-5958facd5db2@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/reset.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c +index 0e914ec7aeae1..e45e32804d2c7 100644 +--- a/drivers/clk/qcom/reset.c ++++ b/drivers/clk/qcom/reset.c +@@ -16,7 +16,8 @@ static int qcom_reset(struct reset_controller_dev *rcdev, unsigned long id) + struct qcom_reset_controller *rst = to_qcom_reset_controller(rcdev); + + rcdev->ops->assert(rcdev, id); +- udelay(rst->reset_map[id].udelay ?: 1); /* use 1 us as default */ ++ fsleep(rst->reset_map[id].udelay ?: 1); /* use 1 us as default */ ++ + rcdev->ops->deassert(rcdev, id); + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/clk-rockchip-rk3568-fix-pll-rate-setting-for-78.75mh.patch b/queue-6.1/clk-rockchip-rk3568-fix-pll-rate-setting-for-78.75mh.patch new file mode 100644 index 00000000000..46e521a86d5 --- /dev/null +++ b/queue-6.1/clk-rockchip-rk3568-fix-pll-rate-setting-for-78.75mh.patch @@ -0,0 +1,41 @@ +From 777f6b43b76a81329812008b64562962f55d3002 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 16:47:50 +0300 +Subject: clk: rockchip: rk3568: Fix PLL rate setting for 78.75MHz + +From: Alibek Omarov + +[ Upstream commit dafebd0f9a4f56b10d7fbda0bff1f540d16a2ea4 ] + +PLL rate on RK356x is calculated through the simple formula: +((24000000 / _refdiv) * _fbdiv) / (_postdiv1 * _postdiv2) + +The PLL rate setting for 78.75MHz seems to be copied from 96MHz +so this patch fixes it and configures it properly. + +Signed-off-by: Alibek Omarov +Fixes: 842f4cb72639 ("clk: rockchip: Add more PLL rates for rk3568") +Reviewed-by: Sascha Hauer +Link: https://lore.kernel.org/r/20230614134750.1056293-1-a1ba.omarov@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3568.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/rockchip/clk-rk3568.c b/drivers/clk/rockchip/clk-rk3568.c +index f85902e2590c7..2f54f630c8b65 100644 +--- a/drivers/clk/rockchip/clk-rk3568.c ++++ b/drivers/clk/rockchip/clk-rk3568.c +@@ -81,7 +81,7 @@ static struct rockchip_pll_rate_table rk3568_pll_rates[] = { + RK3036_PLL_RATE(108000000, 2, 45, 5, 1, 1, 0), + RK3036_PLL_RATE(100000000, 1, 150, 6, 6, 1, 0), + RK3036_PLL_RATE(96000000, 1, 96, 6, 4, 1, 0), +- RK3036_PLL_RATE(78750000, 1, 96, 6, 4, 1, 0), ++ RK3036_PLL_RATE(78750000, 4, 315, 6, 4, 1, 0), + RK3036_PLL_RATE(74250000, 2, 99, 4, 4, 1, 0), + { /* sentinel */ }, + }; +-- +2.40.1 + diff --git a/queue-6.1/clk-sunxi-ng-modify-mismatched-function-name.patch b/queue-6.1/clk-sunxi-ng-modify-mismatched-function-name.patch new file mode 100644 index 00000000000..066a8a8c0c4 --- /dev/null +++ b/queue-6.1/clk-sunxi-ng-modify-mismatched-function-name.patch @@ -0,0 +1,39 @@ +From a0be7ce4caeb18ed886011354352eefc06382bad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jul 2023 15:31:07 +0000 +Subject: clk: sunxi-ng: Modify mismatched function name + +From: Zhang Jianhua + +[ Upstream commit 075d9ca5b4e17f84fd1c744a405e69ec743be7f0 ] + +No functional modification involved. + +drivers/clk/sunxi-ng/ccu_mmc_timing.c:54: warning: expecting prototype for sunxi_ccu_set_mmc_timing_mode(). Prototype was for sunxi_ccu_get_mmc_timing_mode() instead + +Fixes: f6f64ed868d3 ("clk: sunxi-ng: Add interface to query or configure MMC timing modes.") +Signed-off-by: Zhang Jianhua +Reviewed-by: Randy Dunlap +Link: https://lore.kernel.org/r/20230722153107.2078179-1-chris.zjh@huawei.com +Signed-off-by: Jernej Skrabec +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu_mmc_timing.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/sunxi-ng/ccu_mmc_timing.c b/drivers/clk/sunxi-ng/ccu_mmc_timing.c +index de33414fc5c28..c6a6ce98ca03a 100644 +--- a/drivers/clk/sunxi-ng/ccu_mmc_timing.c ++++ b/drivers/clk/sunxi-ng/ccu_mmc_timing.c +@@ -43,7 +43,7 @@ int sunxi_ccu_set_mmc_timing_mode(struct clk *clk, bool new_mode) + EXPORT_SYMBOL_GPL(sunxi_ccu_set_mmc_timing_mode); + + /** +- * sunxi_ccu_set_mmc_timing_mode: Get the current MMC clock timing mode ++ * sunxi_ccu_get_mmc_timing_mode: Get the current MMC clock timing mode + * @clk: clock to query + * + * Returns 0 if the clock is in old timing mode, > 0 if it is in +-- +2.40.1 + diff --git a/queue-6.1/coresight-tmc-explicit-type-conversions-to-prevent-i.patch b/queue-6.1/coresight-tmc-explicit-type-conversions-to-prevent-i.patch new file mode 100644 index 00000000000..b7bd926191c --- /dev/null +++ b/queue-6.1/coresight-tmc-explicit-type-conversions-to-prevent-i.patch @@ -0,0 +1,89 @@ +From 61475aa4ca19ceb08a60649651e35236ee5ac97f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 16:15:14 +0800 +Subject: coresight: tmc: Explicit type conversions to prevent integer overflow + +From: Ruidong Tian + +[ Upstream commit fd380097cdb305582b7a1f9476391330299d2c59 ] + +Perf cs_etm session executed unexpectedly when AUX buffer > 1G. + + perf record -C 0 -m ,2G -e cs_etm// -- + [ perf record: Captured and wrote 2.615 MB perf.data ] + +Perf only collect about 2M perf data rather than 2G. This is becasuse +the operation, "nr_pages << PAGE_SHIFT", in coresight tmc driver, will +overflow when nr_pages >= 0x80000(correspond to 1G AUX buffer). The +overflow cause buffer allocation to fail, and TMC driver will alloc +minimal buffer size(1M). You can just get about 2M perf data(1M AUX +buffer + perf data header) at least. + +Explicit convert nr_pages to 64 bit to avoid overflow. + +Fixes: 22f429f19c41 ("coresight: etm-perf: Add support for ETR backend") +Fixes: 99443ea19e8b ("coresight: Add generic TMC sg table framework") +Fixes: 2e499bbc1a92 ("coresight: tmc: implementing TMC-ETF AUX space API") +Signed-off-by: Ruidong Tian +Reviewed-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230804081514.120171-2-tianruidong@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-tmc-etf.c | 2 +- + drivers/hwtracing/coresight/coresight-tmc-etr.c | 5 +++-- + drivers/hwtracing/coresight/coresight-tmc.h | 2 +- + 3 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c +index 4c4cbd1f72584..3f207999377f0 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c +@@ -428,7 +428,7 @@ static int tmc_set_etf_buffer(struct coresight_device *csdev, + return -EINVAL; + + /* wrap head around to the amount of space we have */ +- head = handle->head & ((buf->nr_pages << PAGE_SHIFT) - 1); ++ head = handle->head & (((unsigned long)buf->nr_pages << PAGE_SHIFT) - 1); + + /* find the page to write to */ + buf->cur = head / PAGE_SIZE; +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c +index 368f2e5a86278..1be0e5e0e80b2 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c +@@ -45,7 +45,8 @@ struct etr_perf_buffer { + }; + + /* Convert the perf index to an offset within the ETR buffer */ +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* Lower limit for ETR hardware buffer */ + #define TMC_ETR_PERF_MIN_BUF_SIZE SZ_1M +@@ -1249,7 +1250,7 @@ alloc_etr_buf(struct tmc_drvdata *drvdata, struct perf_event *event, + * than the size requested via sysfs. + */ + if ((nr_pages << PAGE_SHIFT) > drvdata->size) { +- etr_buf = tmc_alloc_etr_buf(drvdata, (nr_pages << PAGE_SHIFT), ++ etr_buf = tmc_alloc_etr_buf(drvdata, ((ssize_t)nr_pages << PAGE_SHIFT), + 0, node, NULL); + if (!IS_ERR(etr_buf)) + goto done; +diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h +index 66959557cf398..946aab12f9807 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc.h ++++ b/drivers/hwtracing/coresight/coresight-tmc.h +@@ -325,7 +325,7 @@ ssize_t tmc_sg_table_get_data(struct tmc_sg_table *sg_table, + static inline unsigned long + tmc_sg_table_buf_size(struct tmc_sg_table *sg_table) + { +- return sg_table->data_pages.nr_pages << PAGE_SHIFT; ++ return (unsigned long)sg_table->data_pages.nr_pages << PAGE_SHIFT; + } + + struct coresight_device *tmc_etr_get_catu_device(struct tmc_drvdata *drvdata); +-- +2.40.1 + diff --git a/queue-6.1/coresight-trbe-fix-trbe-potential-sleep-in-atomic-co.patch b/queue-6.1/coresight-trbe-fix-trbe-potential-sleep-in-atomic-co.patch new file mode 100644 index 00000000000..20cbd1c8b2e --- /dev/null +++ b/queue-6.1/coresight-trbe-fix-trbe-potential-sleep-in-atomic-co.patch @@ -0,0 +1,120 @@ +From e79e71621e5bf94cac55b1bb1c17dfe2ce9123d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 16:40:52 +0800 +Subject: coresight: trbe: Fix TRBE potential sleep in atomic context + +From: Junhao He + +[ Upstream commit c0a232f1e19e378c5c4e5973a996392942c80090 ] + +smp_call_function_single() will allocate an IPI interrupt vector to +the target processor and send a function call request to the interrupt +vector. After the target processor receives the IPI interrupt, it will +execute arm_trbe_remove_coresight_cpu() call request in the interrupt +handler. + +According to the device_unregister() stack information, if other process +is useing the device, the down_write() may sleep, and trigger deadlocks +or unexpected errors. + + arm_trbe_remove_coresight_cpu + coresight_unregister + device_unregister + device_del + kobject_del + __kobject_del + sysfs_remove_dir + kernfs_remove + down_write ---------> it may sleep + +Add a helper arm_trbe_disable_cpu() to disable TRBE precpu irq and reset +per TRBE. +Simply call arm_trbe_remove_coresight_cpu() directly without useing the +smp_call_function_single(), which is the same as registering the TRBE +coresight device. + +Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") +Signed-off-by: Junhao He +Link: https://lore.kernel.org/r/20230814093813.19152-2-hejunhao3@huawei.com +[ Remove duplicate cpumask checks during removal ] +Signed-off-by: Suzuki K Poulose +[ v3 - Remove the operation of assigning NULL to cpudata->drvdata ] +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230818084052.10116-1-hejunhao3@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-trbe.c | 32 +++++++++++--------- + 1 file changed, 17 insertions(+), 15 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index 1fc4fd79a1c69..925f6c9cecff4 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -1223,6 +1223,16 @@ static void arm_trbe_enable_cpu(void *info) + enable_percpu_irq(drvdata->irq, IRQ_TYPE_NONE); + } + ++static void arm_trbe_disable_cpu(void *info) ++{ ++ struct trbe_drvdata *drvdata = info; ++ struct trbe_cpudata *cpudata = this_cpu_ptr(drvdata->cpudata); ++ ++ disable_percpu_irq(drvdata->irq); ++ trbe_reset_local(cpudata); ++} ++ ++ + static void arm_trbe_register_coresight_cpu(struct trbe_drvdata *drvdata, int cpu) + { + struct trbe_cpudata *cpudata = per_cpu_ptr(drvdata->cpudata, cpu); +@@ -1324,18 +1334,12 @@ static void arm_trbe_probe_cpu(void *info) + cpumask_clear_cpu(cpu, &drvdata->supported_cpus); + } + +-static void arm_trbe_remove_coresight_cpu(void *info) ++static void arm_trbe_remove_coresight_cpu(struct trbe_drvdata *drvdata, int cpu) + { +- int cpu = smp_processor_id(); +- struct trbe_drvdata *drvdata = info; +- struct trbe_cpudata *cpudata = per_cpu_ptr(drvdata->cpudata, cpu); + struct coresight_device *trbe_csdev = coresight_get_percpu_sink(cpu); + +- disable_percpu_irq(drvdata->irq); +- trbe_reset_local(cpudata); + if (trbe_csdev) { + coresight_unregister(trbe_csdev); +- cpudata->drvdata = NULL; + coresight_set_percpu_sink(cpu, NULL); + } + } +@@ -1364,8 +1368,10 @@ static int arm_trbe_remove_coresight(struct trbe_drvdata *drvdata) + { + int cpu; + +- for_each_cpu(cpu, &drvdata->supported_cpus) +- smp_call_function_single(cpu, arm_trbe_remove_coresight_cpu, drvdata, 1); ++ for_each_cpu(cpu, &drvdata->supported_cpus) { ++ smp_call_function_single(cpu, arm_trbe_disable_cpu, drvdata, 1); ++ arm_trbe_remove_coresight_cpu(drvdata, cpu); ++ } + free_percpu(drvdata->cpudata); + return 0; + } +@@ -1404,12 +1410,8 @@ static int arm_trbe_cpu_teardown(unsigned int cpu, struct hlist_node *node) + { + struct trbe_drvdata *drvdata = hlist_entry_safe(node, struct trbe_drvdata, hotplug_node); + +- if (cpumask_test_cpu(cpu, &drvdata->supported_cpus)) { +- struct trbe_cpudata *cpudata = per_cpu_ptr(drvdata->cpudata, cpu); +- +- disable_percpu_irq(drvdata->irq); +- trbe_reset_local(cpudata); +- } ++ if (cpumask_test_cpu(cpu, &drvdata->supported_cpus)) ++ arm_trbe_disable_cpu(drvdata); + return 0; + } + +-- +2.40.1 + diff --git a/queue-6.1/cpufreq-amd-pstate-ut-fix-kernel-panic-when-loading-.patch b/queue-6.1/cpufreq-amd-pstate-ut-fix-kernel-panic-when-loading-.patch new file mode 100644 index 00000000000..a3f08bbb22d --- /dev/null +++ b/queue-6.1/cpufreq-amd-pstate-ut-fix-kernel-panic-when-loading-.patch @@ -0,0 +1,172 @@ +From 5e2779549b8d2f79b9f4d886ad8358f5ecd1bceb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 11:44:52 +0000 +Subject: cpufreq: amd-pstate-ut: Fix kernel panic when loading the driver + +From: Swapnil Sapkal + +[ Upstream commit 60dd283804479c4a52f995b713f448e2cd65b8c8 ] + +After loading the amd-pstate-ut driver, amd_pstate_ut_check_perf() +and amd_pstate_ut_check_freq() use cpufreq_cpu_get() to get the policy +of the CPU and mark it as busy. + +In these functions, cpufreq_cpu_put() should be used to release the +policy, but it is not, so any other entity trying to access the policy +is blocked indefinitely. + +One such scenario is when amd_pstate mode is changed, leading to the +following splat: + +[ 1332.103727] INFO: task bash:2929 blocked for more than 120 seconds. +[ 1332.110001] Not tainted 6.5.0-rc2-amd-pstate-ut #5 +[ 1332.115315] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 1332.123140] task:bash state:D stack:0 pid:2929 ppid:2873 flags:0x00004006 +[ 1332.123143] Call Trace: +[ 1332.123145] +[ 1332.123148] __schedule+0x3c1/0x16a0 +[ 1332.123154] ? _raw_read_lock_irqsave+0x2d/0x70 +[ 1332.123157] schedule+0x6f/0x110 +[ 1332.123160] schedule_timeout+0x14f/0x160 +[ 1332.123162] ? preempt_count_add+0x86/0xd0 +[ 1332.123165] __wait_for_common+0x92/0x190 +[ 1332.123168] ? __pfx_schedule_timeout+0x10/0x10 +[ 1332.123170] wait_for_completion+0x28/0x30 +[ 1332.123173] cpufreq_policy_put_kobj+0x4d/0x90 +[ 1332.123177] cpufreq_policy_free+0x157/0x1d0 +[ 1332.123178] ? preempt_count_add+0x58/0xd0 +[ 1332.123180] cpufreq_remove_dev+0xb6/0x100 +[ 1332.123182] subsys_interface_unregister+0x114/0x120 +[ 1332.123185] ? preempt_count_add+0x58/0xd0 +[ 1332.123187] ? __pfx_amd_pstate_change_driver_mode+0x10/0x10 +[ 1332.123190] cpufreq_unregister_driver+0x3b/0xd0 +[ 1332.123192] amd_pstate_change_driver_mode+0x1e/0x50 +[ 1332.123194] store_status+0xe9/0x180 +[ 1332.123197] dev_attr_store+0x1b/0x30 +[ 1332.123199] sysfs_kf_write+0x42/0x50 +[ 1332.123202] kernfs_fop_write_iter+0x143/0x1d0 +[ 1332.123204] vfs_write+0x2df/0x400 +[ 1332.123208] ksys_write+0x6b/0xf0 +[ 1332.123210] __x64_sys_write+0x1d/0x30 +[ 1332.123213] do_syscall_64+0x60/0x90 +[ 1332.123216] ? fpregs_assert_state_consistent+0x2e/0x50 +[ 1332.123219] ? exit_to_user_mode_prepare+0x49/0x1a0 +[ 1332.123223] ? irqentry_exit_to_user_mode+0xd/0x20 +[ 1332.123225] ? irqentry_exit+0x3f/0x50 +[ 1332.123226] ? exc_page_fault+0x8e/0x190 +[ 1332.123228] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 +[ 1332.123232] RIP: 0033:0x7fa74c514a37 +[ 1332.123234] RSP: 002b:00007ffe31dd0788 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +[ 1332.123238] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007fa74c514a37 +[ 1332.123239] RDX: 0000000000000008 RSI: 000055e27c447aa0 RDI: 0000000000000001 +[ 1332.123241] RBP: 000055e27c447aa0 R08: 00007fa74c5d1460 R09: 000000007fffffff +[ 1332.123242] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 +[ 1332.123244] R13: 00007fa74c61a780 R14: 00007fa74c616600 R15: 00007fa74c615a00 +[ 1332.123247] + +Fix this by calling cpufreq_cpu_put() wherever necessary. + +Fixes: 14eb1c96e3a3 ("cpufreq: amd-pstate: Add test module for amd-pstate driver") +Reviewed-by: Mario Limonciello +Reviewed-by: Meng Li +Reviewed-by: Wyes Karny +Suggested-by: Wyes Karny +Signed-off-by: Swapnil Sapkal +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/amd-pstate-ut.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/drivers/cpufreq/amd-pstate-ut.c b/drivers/cpufreq/amd-pstate-ut.c +index e7f452d221384..b448c8d6a16dd 100644 +--- a/drivers/cpufreq/amd-pstate-ut.c ++++ b/drivers/cpufreq/amd-pstate-ut.c +@@ -140,7 +140,7 @@ static void amd_pstate_ut_check_perf(u32 index) + if (ret) { + amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_FAIL; + pr_err("%s cppc_get_perf_caps ret=%d error!\n", __func__, ret); +- return; ++ goto skip_test; + } + + nominal_perf = cppc_perf.nominal_perf; +@@ -151,7 +151,7 @@ static void amd_pstate_ut_check_perf(u32 index) + if (ret) { + amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_FAIL; + pr_err("%s read CPPC_CAP1 ret=%d error!\n", __func__, ret); +- return; ++ goto skip_test; + } + + nominal_perf = AMD_CPPC_NOMINAL_PERF(cap1); +@@ -169,7 +169,7 @@ static void amd_pstate_ut_check_perf(u32 index) + nominal_perf, cpudata->nominal_perf, + lowest_nonlinear_perf, cpudata->lowest_nonlinear_perf, + lowest_perf, cpudata->lowest_perf); +- return; ++ goto skip_test; + } + + if (!((highest_perf >= nominal_perf) && +@@ -180,11 +180,15 @@ static void amd_pstate_ut_check_perf(u32 index) + pr_err("%s cpu%d highest=%d >= nominal=%d > lowest_nonlinear=%d > lowest=%d > 0, the formula is incorrect!\n", + __func__, cpu, highest_perf, nominal_perf, + lowest_nonlinear_perf, lowest_perf); +- return; ++ goto skip_test; + } ++ cpufreq_cpu_put(policy); + } + + amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_PASS; ++ return; ++skip_test: ++ cpufreq_cpu_put(policy); + } + + /* +@@ -212,14 +216,14 @@ static void amd_pstate_ut_check_freq(u32 index) + pr_err("%s cpu%d max=%d >= nominal=%d > lowest_nonlinear=%d > min=%d > 0, the formula is incorrect!\n", + __func__, cpu, cpudata->max_freq, cpudata->nominal_freq, + cpudata->lowest_nonlinear_freq, cpudata->min_freq); +- return; ++ goto skip_test; + } + + if (cpudata->min_freq != policy->min) { + amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_FAIL; + pr_err("%s cpu%d cpudata_min_freq=%d policy_min=%d, they should be equal!\n", + __func__, cpu, cpudata->min_freq, policy->min); +- return; ++ goto skip_test; + } + + if (cpudata->boost_supported) { +@@ -231,16 +235,20 @@ static void amd_pstate_ut_check_freq(u32 index) + pr_err("%s cpu%d policy_max=%d should be equal cpu_max=%d or cpu_nominal=%d !\n", + __func__, cpu, policy->max, cpudata->max_freq, + cpudata->nominal_freq); +- return; ++ goto skip_test; + } + } else { + amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_FAIL; + pr_err("%s cpu%d must support boost!\n", __func__, cpu); +- return; ++ goto skip_test; + } ++ cpufreq_cpu_put(policy); + } + + amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_PASS; ++ return; ++skip_test: ++ cpufreq_cpu_put(policy); + } + + static int __init amd_pstate_ut_init(void) +-- +2.40.1 + diff --git a/queue-6.1/cpufreq-amd-pstate-ut-remove-module-parameter-access.patch b/queue-6.1/cpufreq-amd-pstate-ut-remove-module-parameter-access.patch new file mode 100644 index 00000000000..ec7d75eb335 --- /dev/null +++ b/queue-6.1/cpufreq-amd-pstate-ut-remove-module-parameter-access.patch @@ -0,0 +1,68 @@ +From 721cf3606ccda3e2f550fda89772ed12b4e71260 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 11:44:51 +0000 +Subject: cpufreq: amd-pstate-ut: Remove module parameter access + +From: Swapnil Sapkal + +[ Upstream commit 8d6e5e8268e89979d86501dbb8385ce2e6154de1 ] + +In amd-pstate-ut, shared memory-based systems call +get_shared_mem() as part of amd_pstate_ut_check_enabled() +function. This function was written when CONFIG_X86_AMD_PSTATE +was tristate config and amd_pstate can be built as a module. + +Currently CONFIG_X86_AMD_PSTATE is a boolean config and module +parameter shared_mem is removed. But amd-pstate-ut code still +accesses this module parameter. Remove those accesses. + +Fixes: 456ca88d8a52 ("cpufreq: amd-pstate: change amd-pstate driver to be built-in type") +Reviewed-by: Mario Limonciello +Reviewed-by: Meng Li +Reviewed-by: Wyes Karny +Suggested-by: Wyes Karny +Signed-off-by: Swapnil Sapkal +[ rjw: Subject edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/amd-pstate-ut.c | 22 ++-------------------- + 1 file changed, 2 insertions(+), 20 deletions(-) + +diff --git a/drivers/cpufreq/amd-pstate-ut.c b/drivers/cpufreq/amd-pstate-ut.c +index e4a5b4d90f833..e7f452d221384 100644 +--- a/drivers/cpufreq/amd-pstate-ut.c ++++ b/drivers/cpufreq/amd-pstate-ut.c +@@ -64,27 +64,9 @@ static struct amd_pstate_ut_struct amd_pstate_ut_cases[] = { + static bool get_shared_mem(void) + { + bool result = false; +- char path[] = "/sys/module/amd_pstate/parameters/shared_mem"; +- char buf[5] = {0}; +- struct file *filp = NULL; +- loff_t pos = 0; +- ssize_t ret; +- +- if (!boot_cpu_has(X86_FEATURE_CPPC)) { +- filp = filp_open(path, O_RDONLY, 0); +- if (IS_ERR(filp)) +- pr_err("%s unable to open %s file!\n", __func__, path); +- else { +- ret = kernel_read(filp, &buf, sizeof(buf), &pos); +- if (ret < 0) +- pr_err("%s read %s file fail ret=%ld!\n", +- __func__, path, (long)ret); +- filp_close(filp, NULL); +- } + +- if ('Y' == *buf) +- result = true; +- } ++ if (!boot_cpu_has(X86_FEATURE_CPPC)) ++ result = true; + + return result; + } +-- +2.40.1 + diff --git a/queue-6.1/cpufreq-fix-the-race-condition-while-updating-the-tr.patch b/queue-6.1/cpufreq-fix-the-race-condition-while-updating-the-tr.patch new file mode 100644 index 00000000000..3f2bc39ccb1 --- /dev/null +++ b/queue-6.1/cpufreq-fix-the-race-condition-while-updating-the-tr.patch @@ -0,0 +1,81 @@ +From f13a4d1d9e5d09884bf47acd9964a48ac96439c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Aug 2023 07:03:18 +0000 +Subject: cpufreq: Fix the race condition while updating the transition_task of + policy + +From: Liao Chang + +[ Upstream commit 61bfbf7951ba561dcbdd5357702d3cbc2d447812 ] + +The field 'transition_task' of policy structure is used to track the +task which is performing the frequency transition. Using this field to +print a warning once detect a case where the same task is calling +_begin() again before completing the preivous frequency transition via +the _end(). + +However, there is a potential race condition in _end() and _begin() APIs +while updating the field 'transition_task' of policy, the scenario is +depicted below: + + Task A Task B + + /* 1st freq transition */ + Invoke _begin() { + ... + ... + } + /* 2nd freq transition */ + Invoke _begin() { + ... //waiting for A to + ... //clear + ... //transition_ongoing + ... //in _end() for + ... //the 1st transition + | + Change the frequency | + | + Invoke _end() { | + ... | + ... | + transition_ongoing = false; V + transition_ongoing = true; + transition_task = current; + transition_task = NULL; + ... //A overwrites the task + ... //performing the transition + ... //result in error warning. + } + +To fix this race condition, the transition_lock of policy structure is +now acquired before updating policy structure in _end() API. Which ensure +that only one task can update the 'transition_task' field at a time. + +Link: https://lore.kernel.org/all/b3c61d8a-d52d-3136-fbf0-d1de9f1ba411@huawei.com/ +Fixes: ca654dc3a93d ("cpufreq: Catch double invocations of cpufreq_freq_transition_begin/end") +Signed-off-by: Liao Chang +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 285ba51b31f60..c8912756fc06d 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -450,8 +450,10 @@ void cpufreq_freq_transition_end(struct cpufreq_policy *policy, + policy->cur, + policy->cpuinfo.max_freq); + ++ spin_lock(&policy->transition_lock); + policy->transition_ongoing = false; + policy->transition_task = NULL; ++ spin_unlock(&policy->transition_lock); + + wake_up(&policy->transition_wait); + } +-- +2.40.1 + diff --git a/queue-6.1/cpufreq-powernow-k8-use-related_cpus-instead-of-cpus.patch b/queue-6.1/cpufreq-powernow-k8-use-related_cpus-instead-of-cpus.patch new file mode 100644 index 00000000000..43568510862 --- /dev/null +++ b/queue-6.1/cpufreq-powernow-k8-use-related_cpus-instead-of-cpus.patch @@ -0,0 +1,39 @@ +From 29a424a142a1b50c2f009076cb5ec4b802e58383 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Aug 2023 09:51:13 +0000 +Subject: cpufreq: powernow-k8: Use related_cpus instead of cpus in + driver.exit() + +From: Liao Chang + +[ Upstream commit 03997da042dac73c69e60d91942c727c76828b65 ] + +Since the 'cpus' field of policy structure will become empty in the +cpufreq core API, it is better to use 'related_cpus' in the exit() +callback of driver. + +Fixes: c3274763bfc3 ("cpufreq: powernow-k8: Initialize per-cpu data-structures properly") +Signed-off-by: Liao Chang +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/powernow-k8.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c +index d289036beff23..b10f7a1b77f11 100644 +--- a/drivers/cpufreq/powernow-k8.c ++++ b/drivers/cpufreq/powernow-k8.c +@@ -1101,7 +1101,8 @@ static int powernowk8_cpu_exit(struct cpufreq_policy *pol) + + kfree(data->powernow_table); + kfree(data); +- for_each_cpu(cpu, pol->cpus) ++ /* pol->cpus will be empty here, use related_cpus instead. */ ++ for_each_cpu(cpu, pol->related_cpus) + per_cpu(powernow_data, cpu) = NULL; + + return 0; +-- +2.40.1 + diff --git a/queue-6.1/crypto-api-use-work-queue-in-crypto_destroy_instance.patch b/queue-6.1/crypto-api-use-work-queue-in-crypto_destroy_instance.patch new file mode 100644 index 00000000000..183bbf3b8dc --- /dev/null +++ b/queue-6.1/crypto-api-use-work-queue-in-crypto_destroy_instance.patch @@ -0,0 +1,95 @@ +From 2becc403b93da4f26a4287e01ca286e0ce32b8d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 17:59:28 +0800 +Subject: crypto: api - Use work queue in crypto_destroy_instance + +From: Herbert Xu + +[ Upstream commit 9ae4577bc077a7e32c3c7d442c95bc76865c0f17 ] + +The function crypto_drop_spawn expects to be called in process +context. However, when an instance is unregistered while it still +has active users, the last user may cause the instance to be freed +in atomic context. + +Fix this by delaying the freeing to a work queue. + +Fixes: 6bfd48096ff8 ("[CRYPTO] api: Added spawns") +Reported-by: Florent Revest +Reported-by: syzbot+d769eed29cc42d75e2a3@syzkaller.appspotmail.com +Reported-by: syzbot+610ec0671f51e838436e@syzkaller.appspotmail.com +Signed-off-by: Herbert Xu +Tested-by: Florent Revest +Acked-by: Florent Revest +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/algapi.c | 16 ++++++++++++++-- + include/crypto/algapi.h | 3 +++ + 2 files changed, 17 insertions(+), 2 deletions(-) + +diff --git a/crypto/algapi.c b/crypto/algapi.c +index 8c3a869cc43a9..5dc9ccdd5a510 100644 +--- a/crypto/algapi.c ++++ b/crypto/algapi.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #include "internal.h" + +@@ -74,15 +75,26 @@ static void crypto_free_instance(struct crypto_instance *inst) + inst->alg.cra_type->free(inst); + } + +-static void crypto_destroy_instance(struct crypto_alg *alg) ++static void crypto_destroy_instance_workfn(struct work_struct *w) + { +- struct crypto_instance *inst = (void *)alg; ++ struct crypto_instance *inst = container_of(w, struct crypto_instance, ++ free_work); + struct crypto_template *tmpl = inst->tmpl; + + crypto_free_instance(inst); + crypto_tmpl_put(tmpl); + } + ++static void crypto_destroy_instance(struct crypto_alg *alg) ++{ ++ struct crypto_instance *inst = container_of(alg, ++ struct crypto_instance, ++ alg); ++ ++ INIT_WORK(&inst->free_work, crypto_destroy_instance_workfn); ++ schedule_work(&inst->free_work); ++} ++ + /* + * This function adds a spawn to the list secondary_spawns which + * will be used at the end of crypto_remove_spawns to unregister +diff --git a/include/crypto/algapi.h b/include/crypto/algapi.h +index 224b860647083..939a3196bf002 100644 +--- a/include/crypto/algapi.h ++++ b/include/crypto/algapi.h +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + + #include + +@@ -60,6 +61,8 @@ struct crypto_instance { + struct crypto_spawn *spawns; + }; + ++ struct work_struct free_work; ++ + void *__ctx[] CRYPTO_MINALIGN_ATTR; + }; + +-- +2.40.1 + diff --git a/queue-6.1/crypto-caam-fix-unchecked-return-value-error.patch b/queue-6.1/crypto-caam-fix-unchecked-return-value-error.patch new file mode 100644 index 00000000000..c35c794cfed --- /dev/null +++ b/queue-6.1/crypto-caam-fix-unchecked-return-value-error.patch @@ -0,0 +1,44 @@ +From 4ce0fcee752fad6f854574efa4e966b39741917a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Aug 2023 12:55:25 +0200 +Subject: crypto: caam - fix unchecked return value error + +From: Gaurav Jain + +[ Upstream commit e30685204711a6be40dec2622606950ccd37dafe ] + +error: +Unchecked return value (CHECKED_RETURN) +check_return: Calling sg_miter_next without checking return value + +fix: +added check if(!sg_miter_next) + +Fixes: 8a2a0dd35f2e ("crypto: caam - strip input zeros from RSA input buffer") +Signed-off-by: Gaurav Jain +Signed-off-by: Meenakshi Aggarwal +Reviewed-by: Gaurav Jain +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/caam/caampkc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c +index 8867275767101..51b48b57266a6 100644 +--- a/drivers/crypto/caam/caampkc.c ++++ b/drivers/crypto/caam/caampkc.c +@@ -223,7 +223,9 @@ static int caam_rsa_count_leading_zeros(struct scatterlist *sgl, + if (len && *buff) + break; + +- sg_miter_next(&miter); ++ if (!sg_miter_next(&miter)) ++ break; ++ + buff = miter.addr; + len = miter.length; + +-- +2.40.1 + diff --git a/queue-6.1/crypto-qat-change-value-of-default-idle-filter.patch b/queue-6.1/crypto-qat-change-value-of-default-idle-filter.patch new file mode 100644 index 00000000000..71838a2b3cb --- /dev/null +++ b/queue-6.1/crypto-qat-change-value-of-default-idle-filter.patch @@ -0,0 +1,40 @@ +From fe85bcc8261ffd3b9d5a75547bc99091cc5324b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 10:26:35 +0100 +Subject: crypto: qat - change value of default idle filter + +From: Giovanni Cabiddu + +[ Upstream commit 0f942bdfe9d463be3073301519492f8d53c6b2d5 ] + +The power management configuration of 4xxx devices is too aggressive +and in some conditions the device might be prematurely put to a low +power state. +Increase the idle filter value to prevent that. +In future, this will be set by firmware. + +Fixes: e5745f34113b ("crypto: qat - enable power management for QAT GEN4") +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Damian Muszynski +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_gen4_pm.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_gen4_pm.h b/drivers/crypto/qat/qat_common/adf_gen4_pm.h +index f8f8a9ee29e5b..db4326933d1c0 100644 +--- a/drivers/crypto/qat/qat_common/adf_gen4_pm.h ++++ b/drivers/crypto/qat/qat_common/adf_gen4_pm.h +@@ -35,7 +35,7 @@ + #define ADF_GEN4_PM_MSG_PENDING BIT(0) + #define ADF_GEN4_PM_MSG_PAYLOAD_BIT_MASK GENMASK(28, 1) + +-#define ADF_GEN4_PM_DEFAULT_IDLE_FILTER (0x0) ++#define ADF_GEN4_PM_DEFAULT_IDLE_FILTER (0x6) + #define ADF_GEN4_PM_MAX_IDLE_FILTER (0x7) + + int adf_gen4_enable_pm(struct adf_accel_dev *accel_dev); +-- +2.40.1 + diff --git a/queue-6.1/crypto-stm32-properly-handle-pm_runtime_get-failing.patch b/queue-6.1/crypto-stm32-properly-handle-pm_runtime_get-failing.patch new file mode 100644 index 00000000000..e6064f06444 --- /dev/null +++ b/queue-6.1/crypto-stm32-properly-handle-pm_runtime_get-failing.patch @@ -0,0 +1,61 @@ +From fd34e07004381601107e1ac458258b22b3feeb38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jul 2023 18:54:54 +0200 +Subject: crypto: stm32 - Properly handle pm_runtime_get failing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit aec48805163338f8413118796c1dd035661b9140 ] + +If pm_runtime_get() (disguised as pm_runtime_resume_and_get()) fails, this +means the clk wasn't prepared and enabled. Returning early in this case +however is wrong as then the following resource frees are skipped and this +is never catched up. So do all the cleanups but clk_disable_unprepare(). + +Also don't emit a warning, as stm32_hash_runtime_resume() already emitted +one. + +Note that the return value of stm32_hash_remove() is mostly ignored by +the device core. The only effect of returning zero instead of an error +value is to suppress another warning in platform_remove(). So return 0 +even if pm_runtime_resume_and_get() failed. + +Fixes: 8b4d566de6a5 ("crypto: stm32/hash - Add power management support") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/stm32/stm32-hash.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c +index d33006d43f761..e3f765434d64e 100644 +--- a/drivers/crypto/stm32/stm32-hash.c ++++ b/drivers/crypto/stm32/stm32-hash.c +@@ -1566,9 +1566,7 @@ static int stm32_hash_remove(struct platform_device *pdev) + if (!hdev) + return -ENODEV; + +- ret = pm_runtime_resume_and_get(hdev->dev); +- if (ret < 0) +- return ret; ++ ret = pm_runtime_get_sync(hdev->dev); + + stm32_hash_unregister_algs(hdev); + +@@ -1584,7 +1582,8 @@ static int stm32_hash_remove(struct platform_device *pdev) + pm_runtime_disable(hdev->dev); + pm_runtime_put_noidle(hdev->dev); + +- clk_disable_unprepare(hdev->clk); ++ if (ret >= 0) ++ clk_disable_unprepare(hdev->clk); + + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/cteonxt2-pf-fix-backpressure-config-for-multiple-pfc.patch b/queue-6.1/cteonxt2-pf-fix-backpressure-config-for-multiple-pfc.patch new file mode 100644 index 00000000000..87ff3e22362 --- /dev/null +++ b/queue-6.1/cteonxt2-pf-fix-backpressure-config-for-multiple-pfc.patch @@ -0,0 +1,65 @@ +From 70b129dc5c0ce62fe34c2d45f0910f9c42e98b02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 13:40:32 +0530 +Subject: cteonxt2-pf: Fix backpressure config for multiple PFC priorities to + work simultaneously + +From: Suman Ghosh + +[ Upstream commit 597d0ec0e4ca6a912affea4cc94df08959e9ec74 ] + +MAC (CGX or RPM) asserts backpressure at TL3 or TL2 node of the egress +hierarchical scheduler tree depending on link level config done. If +there are multiple PFC priorities enabled at a time and for all such +flows to backoff, each priority will have to assert backpressure at +different TL3/TL2 scheduler nodes and these flows will need to submit +egress pkts to these nodes. + +Current PFC configuration has an issue where in only one backpressure +scheduler node is being allocated which is resulting in only one PFC +priority to work. This patch fixes this issue. + +Fixes: 99c969a83d82 ("octeontx2-pf: Add egress PFC support") +Signed-off-by: Suman Ghosh +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230824081032.436432-4-sumang@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c +index 6492749dd7c89..bfddbff7bcdfb 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c +@@ -70,7 +70,7 @@ static int otx2_pfc_txschq_alloc_one(struct otx2_nic *pfvf, u8 prio) + * link config level. These rest of the scheduler can be + * same as hw.txschq_list. + */ +- for (lvl = 0; lvl < pfvf->hw.txschq_link_cfg_lvl; lvl++) ++ for (lvl = 0; lvl <= pfvf->hw.txschq_link_cfg_lvl; lvl++) + req->schq[lvl] = 1; + + rc = otx2_sync_mbox_msg(&pfvf->mbox); +@@ -83,7 +83,7 @@ static int otx2_pfc_txschq_alloc_one(struct otx2_nic *pfvf, u8 prio) + return PTR_ERR(rsp); + + /* Setup transmit scheduler list */ +- for (lvl = 0; lvl < pfvf->hw.txschq_link_cfg_lvl; lvl++) { ++ for (lvl = 0; lvl <= pfvf->hw.txschq_link_cfg_lvl; lvl++) { + if (!rsp->schq[lvl]) + return -ENOSPC; + +@@ -128,7 +128,7 @@ static int otx2_pfc_txschq_stop_one(struct otx2_nic *pfvf, u8 prio) + int lvl; + + /* free PFC TLx nodes */ +- for (lvl = 0; lvl < pfvf->hw.txschq_link_cfg_lvl; lvl++) ++ for (lvl = 0; lvl <= pfvf->hw.txschq_link_cfg_lvl; lvl++) + otx2_txschq_free_one(pfvf, lvl, + pfvf->pfc_schq_list[lvl][prio]); + +-- +2.40.1 + diff --git a/queue-6.1/dma-buf-sync_file-fix-docs-syntax.patch b/queue-6.1/dma-buf-sync_file-fix-docs-syntax.patch new file mode 100644 index 00000000000..98aab6ccf3a --- /dev/null +++ b/queue-6.1/dma-buf-sync_file-fix-docs-syntax.patch @@ -0,0 +1,39 @@ +From 7c46e5a5723a80e53c4c98109402dcad6c06a13e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 07:49:41 -0700 +Subject: dma-buf/sync_file: Fix docs syntax + +From: Rob Clark + +[ Upstream commit 05d56d8079d510a2994039470f65bea85f0075ee ] + +Fixes the warning: + + include/uapi/linux/sync_file.h:77: warning: Function parameter or member 'num_fences' not described in 'sync_file_info' + +Fixes: 2d75c88fefb2 ("staging/android: refactor SYNC IOCTLs") +Signed-off-by: Rob Clark +Reviewed-by: Randy Dunlap +Link: https://lore.kernel.org/r/20230724145000.125880-1-robdclark@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/uapi/linux/sync_file.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/sync_file.h b/include/uapi/linux/sync_file.h +index ee2dcfb3d6602..d7f7c04a6e0c1 100644 +--- a/include/uapi/linux/sync_file.h ++++ b/include/uapi/linux/sync_file.h +@@ -52,7 +52,7 @@ struct sync_fence_info { + * @name: name of fence + * @status: status of fence. 1: signaled 0:active <0:error + * @flags: sync_file_info flags +- * @num_fences number of fences in the sync_file ++ * @num_fences: number of fences in the sync_file + * @pad: padding for 64-bit alignment, should always be zero + * @sync_fence_info: pointer to array of structs sync_fence_info with all + * fences in the sync_file +-- +2.40.1 + diff --git a/queue-6.1/dmaengine-idxd-modify-the-dependence-of-attribute-pa.patch b/queue-6.1/dmaengine-idxd-modify-the-dependence-of-attribute-pa.patch new file mode 100644 index 00000000000..d974efbe9d5 --- /dev/null +++ b/queue-6.1/dmaengine-idxd-modify-the-dependence-of-attribute-pa.patch @@ -0,0 +1,44 @@ +From 194875419dc429aa3ae2449c75e30f6a962a10c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 14:27:06 +0800 +Subject: dmaengine: idxd: Modify the dependence of attribute pasid_enabled + +From: Rex Zhang + +[ Upstream commit 50c5e6f41d5ad7c731c31135a30d0e4f0e4fea26 ] + +Kernel PASID and user PASID are separately enabled. User needs to know the +user PASID enabling status to decide how to use IDXD device in user space. +This is done via the attribute /sys/bus/dsa/devices/dsa0/pasid_enabled. +It's unnecessary for user to know the kernel PASID enabling status because +user won't use the kernel PASID. But instead of showing the user PASID +enabling status, the attribute shows the kernel PASID enabling status. Fix +the issue by showing the user PASID enabling status in the attribute. + +Fixes: 42a1b73852c4 ("dmaengine: idxd: Separate user and kernel pasid enabling") +Signed-off-by: Rex Zhang +Acked-by: Fenghua Yu +Acked-by: Dave Jiang +Link: https://lore.kernel.org/r/20230614062706.1743078-1-rex.zhang@intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c +index 18cd8151dee02..6e1e14b376e65 100644 +--- a/drivers/dma/idxd/sysfs.c ++++ b/drivers/dma/idxd/sysfs.c +@@ -1426,7 +1426,7 @@ static ssize_t pasid_enabled_show(struct device *dev, + { + struct idxd_device *idxd = confdev_to_idxd(dev); + +- return sysfs_emit(buf, "%u\n", device_pasid_enabled(idxd)); ++ return sysfs_emit(buf, "%u\n", device_user_pasid_enabled(idxd)); + } + static DEVICE_ATTR_RO(pasid_enabled); + +-- +2.40.1 + diff --git a/queue-6.1/dmaengine-ste_dma40-add-missing-irq-check-in-d40_pro.patch b/queue-6.1/dmaengine-ste_dma40-add-missing-irq-check-in-d40_pro.patch new file mode 100644 index 00000000000..5d21613fc74 --- /dev/null +++ b/queue-6.1/dmaengine-ste_dma40-add-missing-irq-check-in-d40_pro.patch @@ -0,0 +1,40 @@ +From 6188b255fe1ba673b758364ef0cd096bbe171d8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 14:41:08 +0000 +Subject: dmaengine: ste_dma40: Add missing IRQ check in d40_probe + +From: ruanjinjie + +[ Upstream commit c05ce6907b3d6e148b70f0bb5eafd61dcef1ddc1 ] + +Check for the return value of platform_get_irq(): if no interrupt +is specified, it wouldn't make sense to call request_irq(). + +Fixes: 8d318a50b3d7 ("DMAENGINE: Support for ST-Ericssons DMA40 block v3") +Signed-off-by: Ruan Jinjie +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20230724144108.2582917-1-ruanjinjie@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ste_dma40.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c +index f093e08c23b16..3b09fdc507e04 100644 +--- a/drivers/dma/ste_dma40.c ++++ b/drivers/dma/ste_dma40.c +@@ -3597,6 +3597,10 @@ static int __init d40_probe(struct platform_device *pdev) + spin_lock_init(&base->lcla_pool.lock); + + base->irq = platform_get_irq(pdev, 0); ++ if (base->irq < 0) { ++ ret = base->irq; ++ goto destroy_cache; ++ } + + ret = request_irq(base->irq, d40_handle_interrupt, 0, D40_NAME, base); + if (ret) { +-- +2.40.1 + diff --git a/queue-6.1/docs-abi-fix-spelling-grammar-in-sbefifo-timeout-int.patch b/queue-6.1/docs-abi-fix-spelling-grammar-in-sbefifo-timeout-int.patch new file mode 100644 index 00000000000..2e652570d31 --- /dev/null +++ b/queue-6.1/docs-abi-fix-spelling-grammar-in-sbefifo-timeout-int.patch @@ -0,0 +1,40 @@ +From 703a2a986d772ffc6bfc7424d31680ce6b06015a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jul 2023 22:23:05 -0700 +Subject: docs: ABI: fix spelling/grammar in SBEFIFO timeout interface + +From: Randy Dunlap + +[ Upstream commit 2cd9ec2a51474d4c0b4d2a061f2de7da34eff476 ] + +Correct spelling problems as identified by codespell. +Correct one grammar error. + +Fixes: 9a93de620e0a ("docs: ABI: testing: Document the SBEFIFO timeout interface") +Signed-off-by: Randy Dunlap +Cc: Eddie James +Cc: Joel Stanley +Link: https://lore.kernel.org/r/20230710052305.29611-1-rdunlap@infradead.org +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + Documentation/ABI/testing/sysfs-bus-fsi-devices-sbefifo | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/Documentation/ABI/testing/sysfs-bus-fsi-devices-sbefifo b/Documentation/ABI/testing/sysfs-bus-fsi-devices-sbefifo +index 531fe9d6b40aa..c7393b4dd2d88 100644 +--- a/Documentation/ABI/testing/sysfs-bus-fsi-devices-sbefifo ++++ b/Documentation/ABI/testing/sysfs-bus-fsi-devices-sbefifo +@@ -5,6 +5,6 @@ Description: + Indicates whether or not this SBE device has experienced a + timeout; i.e. the SBE did not respond within the time allotted + by the driver. A value of 1 indicates that a timeout has +- ocurred and no transfers have completed since the timeout. A +- value of 0 indicates that no timeout has ocurred, or if one +- has, more recent transfers have completed successful. ++ occurred and no transfers have completed since the timeout. A ++ value of 0 indicates that no timeout has occurred, or if one ++ has, more recent transfers have completed successfully. +-- +2.40.1 + diff --git a/queue-6.1/driver-core-call-dma_cleanup-on-the-test_remove-path.patch b/queue-6.1/driver-core-call-dma_cleanup-on-the-test_remove-path.patch new file mode 100644 index 00000000000..4c0794f5df8 --- /dev/null +++ b/queue-6.1/driver-core-call-dma_cleanup-on-the-test_remove-path.patch @@ -0,0 +1,45 @@ +From b273bf431e2b705fb273bb994382d4f7541fa3b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 14:40:46 -0300 +Subject: driver core: Call dma_cleanup() on the test_remove path + +From: Jason Gunthorpe + +[ Upstream commit f429378a9bf84d79a7e2cae05d2e3384cf7d68ba ] + +When test_remove is enabled really_probe() does not properly pair +dma_configure() with dma_remove(), it will end up calling dma_configure() +twice. This corrupts the owner_cnt and renders the group unusable with +VFIO/etc. + +Add the missing cleanup before going back to re_probe. + +Fixes: 25f3bcfc54bc ("driver core: Add dma_cleanup callback in bus_type") +Reported-by: Zenghui Yu +Tested-by: Zenghui Yu +Closes: https://lore.kernel.org/all/6472f254-c3c4-8610-4a37-8d9dfdd54ce8@huawei.com/ +Signed-off-by: Jason Gunthorpe +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/0-v2-4deed94e283e+40948-really_probe_dma_cleanup_jgg@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/dd.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index 97ab1468a8760..380a53b6aee81 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -674,6 +674,8 @@ static int really_probe(struct device *dev, struct device_driver *drv) + + device_remove(dev); + driver_sysfs_remove(dev); ++ if (dev->bus && dev->bus->dma_cleanup) ++ dev->bus->dma_cleanup(dev); + device_unbind_cleanup(dev); + + goto re_probe; +-- +2.40.1 + diff --git a/queue-6.1/driver-core-test_async-fix-an-error-code.patch b/queue-6.1/driver-core-test_async-fix-an-error-code.patch new file mode 100644 index 00000000000..b34378d5b92 --- /dev/null +++ b/queue-6.1/driver-core-test_async-fix-an-error-code.patch @@ -0,0 +1,37 @@ +From 23f743a89b0029e655a4862bebdbbbcedc34d750 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 10:03:49 +0300 +Subject: driver core: test_async: fix an error code + +From: Dan Carpenter + +[ Upstream commit 22d2381bbd70a5853c2ee77522f4965139672db9 ] + +The test_platform_device_register_node() function should return error +pointers instead of NULL. That is what the callers are expecting. + +Fixes: 57ea974fb871 ("driver core: Rewrite test_async_driver_probe to cover serialization and NUMA affinity") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/1e11ed19-e1f6-43d8-b352-474134b7c008@moroto.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/test/test_async_driver_probe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/test/test_async_driver_probe.c b/drivers/base/test/test_async_driver_probe.c +index 929410d0dd6fe..3465800baa6c8 100644 +--- a/drivers/base/test/test_async_driver_probe.c ++++ b/drivers/base/test/test_async_driver_probe.c +@@ -84,7 +84,7 @@ test_platform_device_register_node(char *name, int id, int nid) + + pdev = platform_device_alloc(name, id); + if (!pdev) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + if (nid != NUMA_NO_NODE) + set_dev_node(&pdev->dev, nid); +-- +2.40.1 + diff --git a/queue-6.1/drivers-base-free-devm-resources-when-unregistering-.patch b/queue-6.1/drivers-base-free-devm-resources-when-unregistering-.patch new file mode 100644 index 00000000000..f51a821365a --- /dev/null +++ b/queue-6.1/drivers-base-free-devm-resources-when-unregistering-.patch @@ -0,0 +1,64 @@ +From a23e370b7109a6d47d01e78213bf4579d1ac45bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 14:45:09 +0200 +Subject: drivers: base: Free devm resources when unregistering a device + +From: David Gow + +[ Upstream commit 699fb50d99039a50e7494de644f96c889279aca3 ] + +In the current code, devres_release_all() only gets called if the device +has a bus and has been probed. + +This leads to issues when using bus-less or driver-less devices where +the device might never get freed if a managed resource holds a reference +to the device. This is happening in the DRM framework for example. + +We should thus call devres_release_all() in the device_del() function to +make sure that the device-managed actions are properly executed when the +device is unregistered, even if it has neither a bus nor a driver. + +This is effectively the same change than commit 2f8d16a996da ("devres: +release resources on device_del()") that got reverted by commit +a525a3ddeaca ("driver core: free devres in device_release") over +memory leaks concerns. + +This patch effectively combines the two commits mentioned above to +release the resources both on device_del() and device_release() and get +the best of both worlds. + +Fixes: a525a3ddeaca ("driver core: free devres in device_release") +Signed-off-by: David Gow +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20230720-kunit-devm-inconsistencies-test-v3-3-6aa7e074f373@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/core.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index e30223c2672fc..af90bfb0cc3d8 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -3855,6 +3855,17 @@ void device_del(struct device *dev) + device_platform_notify_remove(dev); + device_links_purge(dev); + ++ /* ++ * If a device does not have a driver attached, we need to clean ++ * up any managed resources. We do this in device_release(), but ++ * it's never called (and we leak the device) if a managed ++ * resource holds a reference to the device. So release all ++ * managed resources here, like we do in driver_detach(). We ++ * still need to do so again in device_release() in case someone ++ * adds a new resource after this point, though. ++ */ ++ devres_release_all(dev); ++ + if (dev->bus) + blocking_notifier_call_chain(&dev->bus->p->bus_notifier, + BUS_NOTIFY_REMOVED_DEVICE, dev); +-- +2.40.1 + diff --git a/queue-6.1/drivers-clk-keystone-fix-parameter-judgment-in-_of_p.patch b/queue-6.1/drivers-clk-keystone-fix-parameter-judgment-in-_of_p.patch new file mode 100644 index 00000000000..2be132c7f8a --- /dev/null +++ b/queue-6.1/drivers-clk-keystone-fix-parameter-judgment-in-_of_p.patch @@ -0,0 +1,38 @@ +From 0f7a1b90ead092660c5864740b0b574644bae226 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jul 2023 18:22:46 +0800 +Subject: drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() + +From: Minjie Du + +[ Upstream commit a995c50db887ef97f3160775aef7d772635a6f6e ] + +The function clk_register_pll() may return NULL or an ERR_PTR. Don't +treat an ERR_PTR as valid. + +Signed-off-by: Minjie Du +Link: https://lore.kernel.org/r/20230712102246.10348-1-duminjie@vivo.com +Fixes: b9e0d40c0d83 ("clk: keystone: add Keystone PLL clock driver") +[sboyd@kernel.org: Reword commit text] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/keystone/pll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/keystone/pll.c b/drivers/clk/keystone/pll.c +index d59a7621bb204..ee5c72369334f 100644 +--- a/drivers/clk/keystone/pll.c ++++ b/drivers/clk/keystone/pll.c +@@ -209,7 +209,7 @@ static void __init _of_pll_clk_init(struct device_node *node, bool pllctrl) + } + + clk = clk_register_pll(NULL, node->name, parent_name, pll_data); +- if (clk) { ++ if (!IS_ERR_OR_NULL(clk)) { + of_clk_add_provider(node, of_clk_src_simple_get, clk); + return; + } +-- +2.40.1 + diff --git a/queue-6.1/drivers-hv-vmbus-don-t-dereference-acpi-root-object-.patch b/queue-6.1/drivers-hv-vmbus-don-t-dereference-acpi-root-object-.patch new file mode 100644 index 00000000000..28d04983d3c --- /dev/null +++ b/queue-6.1/drivers-hv-vmbus-don-t-dereference-acpi-root-object-.patch @@ -0,0 +1,92 @@ +From 524b216ae199b6067d8f6abe2e0797f03d6d98f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 20:40:18 +0200 +Subject: Drivers: hv: vmbus: Don't dereference ACPI root object handle + +From: Maciej S. Szmigiero + +[ Upstream commit 78e04bbff849b51b56f5925b1945db2c6e128b61 ] + +Since the commit referenced in the Fixes: tag below the VMBus client driver +is walking the ACPI namespace up from the VMBus ACPI device to the ACPI +namespace root object trying to find Hyper-V MMIO ranges. + +However, if it is not able to find them it ends trying to walk resources of +the ACPI namespace root object itself. +This object has all-ones handle, which causes a NULL pointer dereference +in the ACPI code (from dereferencing this pointer with an offset). + +This in turn causes an oops on boot with VMBus host implementations that do +not provide Hyper-V MMIO ranges in their VMBus ACPI device or its +ancestors. +The QEMU VMBus implementation is an example of such implementation. + +I guess providing these ranges is optional, since all tested Windows +versions seem to be able to use VMBus devices without them. + +Fix this by explicitly terminating the lookup at the ACPI namespace root +object. + +Note that Linux guests under KVM/QEMU do not use the Hyper-V PV interface +by default - they only do so if the KVM PV interface is missing or +disabled. + +Example stack trace of such oops: +[ 3.710827] ? __die+0x1f/0x60 +[ 3.715030] ? page_fault_oops+0x159/0x460 +[ 3.716008] ? exc_page_fault+0x73/0x170 +[ 3.716959] ? asm_exc_page_fault+0x22/0x30 +[ 3.717957] ? acpi_ns_lookup+0x7a/0x4b0 +[ 3.718898] ? acpi_ns_internalize_name+0x79/0xc0 +[ 3.720018] acpi_ns_get_node_unlocked+0xb5/0xe0 +[ 3.721120] ? acpi_ns_check_object_type+0xfe/0x200 +[ 3.722285] ? acpi_rs_convert_aml_to_resource+0x37/0x6e0 +[ 3.723559] ? down_timeout+0x3a/0x60 +[ 3.724455] ? acpi_ns_get_node+0x3a/0x60 +[ 3.725412] acpi_ns_get_node+0x3a/0x60 +[ 3.726335] acpi_ns_evaluate+0x1c3/0x2c0 +[ 3.727295] acpi_ut_evaluate_object+0x64/0x1b0 +[ 3.728400] acpi_rs_get_method_data+0x2b/0x70 +[ 3.729476] ? vmbus_platform_driver_probe+0x1d0/0x1d0 [hv_vmbus] +[ 3.730940] ? vmbus_platform_driver_probe+0x1d0/0x1d0 [hv_vmbus] +[ 3.732411] acpi_walk_resources+0x78/0xd0 +[ 3.733398] vmbus_platform_driver_probe+0x9f/0x1d0 [hv_vmbus] +[ 3.734802] platform_probe+0x3d/0x90 +[ 3.735684] really_probe+0x19b/0x400 +[ 3.736570] ? __device_attach_driver+0x100/0x100 +[ 3.737697] __driver_probe_device+0x78/0x160 +[ 3.738746] driver_probe_device+0x1f/0x90 +[ 3.739743] __driver_attach+0xc2/0x1b0 +[ 3.740671] bus_for_each_dev+0x70/0xc0 +[ 3.741601] bus_add_driver+0x10e/0x210 +[ 3.742527] driver_register+0x55/0xf0 +[ 3.744412] ? 0xffffffffc039a000 +[ 3.745207] hv_acpi_init+0x3c/0x1000 [hv_vmbus] + +Fixes: 7f163a6fd957 ("drivers:hv: Modify hv_vmbus to search for all MMIO ranges available.") +Signed-off-by: Maciej S. Szmigiero +Reviewed-by: Michael Kelley +Signed-off-by: Wei Liu +Link: https://lore.kernel.org/r/fd8e64ceeecfd1d95ff49021080cf699e88dbbde.1691606267.git.maciej.szmigiero@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/hv/vmbus_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index b03cb7ae7fd38..e9c3f1e826baa 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2452,7 +2452,8 @@ static int vmbus_acpi_add(struct acpi_device *device) + * Some ancestor of the vmbus acpi device (Gen1 or Gen2 + * firmware) is the VMOD that has the mmio ranges. Get that. + */ +- for (ancestor = acpi_dev_parent(device); ancestor; ++ for (ancestor = acpi_dev_parent(device); ++ ancestor && ancestor->handle != ACPI_ROOT_OBJECT; + ancestor = acpi_dev_parent(ancestor)) { + result = acpi_walk_resources(ancestor->handle, METHOD_NAME__CRS, + vmbus_walk_resources, NULL); +-- +2.40.1 + diff --git a/queue-6.1/drivers-usb-smsusb-fix-error-handling-code-in-smsusb.patch b/queue-6.1/drivers-usb-smsusb-fix-error-handling-code-in-smsusb.patch new file mode 100644 index 00000000000..41cf4e4cc67 --- /dev/null +++ b/queue-6.1/drivers-usb-smsusb-fix-error-handling-code-in-smsusb.patch @@ -0,0 +1,80 @@ +From a479e237ef3b12ee367f52f70c4c4fe6b52a1c5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 18:24:08 +0800 +Subject: drivers: usb: smsusb: fix error handling code in smsusb_init_device + +From: Dongliang Mu + +[ Upstream commit b9c7141f384097fa4fa67d2f72e5731d628aef7c ] + +The previous commit 4b208f8b561f ("[media] siano: register media controller +earlier")moves siano_media_device_register before smscore_register_device, +and adds corresponding error handling code if smscore_register_device +fails. However, it misses the following error handling code of +smsusb_init_device. + +Fix this by moving error handling code at the end of smsusb_init_device +and adding a goto statement in the following error handling parts. + +Fixes: 4b208f8b561f ("[media] siano: register media controller earlier") +Signed-off-by: Dongliang Mu +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/siano/smsusb.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c +index 640737d3b8aeb..8a39cac76c585 100644 +--- a/drivers/media/usb/siano/smsusb.c ++++ b/drivers/media/usb/siano/smsusb.c +@@ -455,12 +455,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) + rc = smscore_register_device(¶ms, &dev->coredev, 0, mdev); + if (rc < 0) { + pr_err("smscore_register_device(...) failed, rc %d\n", rc); +- smsusb_term_device(intf); +-#ifdef CONFIG_MEDIA_CONTROLLER_DVB +- media_device_unregister(mdev); +-#endif +- kfree(mdev); +- return rc; ++ goto err_unregister_device; + } + + smscore_set_board_id(dev->coredev, board_id); +@@ -477,8 +472,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) + rc = smsusb_start_streaming(dev); + if (rc < 0) { + pr_err("smsusb_start_streaming(...) failed\n"); +- smsusb_term_device(intf); +- return rc; ++ goto err_unregister_device; + } + + dev->state = SMSUSB_ACTIVE; +@@ -486,13 +480,20 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) + rc = smscore_start_device(dev->coredev); + if (rc < 0) { + pr_err("smscore_start_device(...) failed\n"); +- smsusb_term_device(intf); +- return rc; ++ goto err_unregister_device; + } + + pr_debug("device 0x%p created\n", dev); + + return rc; ++ ++err_unregister_device: ++ smsusb_term_device(intf); ++#ifdef CONFIG_MEDIA_CONTROLLER_DVB ++ media_device_unregister(mdev); ++#endif ++ kfree(mdev); ++ return rc; + } + + static int smsusb_probe(struct usb_interface *intf, +-- +2.40.1 + diff --git a/queue-6.1/drm-adv7511-fix-low-refresh-rate-register-for-adv753.patch b/queue-6.1/drm-adv7511-fix-low-refresh-rate-register-for-adv753.patch new file mode 100644 index 00000000000..07748c7bdb7 --- /dev/null +++ b/queue-6.1/drm-adv7511-fix-low-refresh-rate-register-for-adv753.patch @@ -0,0 +1,49 @@ +From eae66dc3833c7b030ef806ad8ab768d523f20db9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 09:01:43 +0300 +Subject: drm: adv7511: Fix low refresh rate register for ADV7533/5 + +From: Bogdan Togorean + +[ Upstream commit d281eeaa4de2636ff0c8e6ae387bb07b50e5fcbb ] + +For ADV7533 and ADV7535 low refresh rate is selected using +bits [3:2] of 0x4a main register. +So depending on ADV model write 0xfb or 0x4a register. + +Fixes: 2437e7cd88e8 ("drm/bridge: adv7533: Initial support for ADV7533") +Reviewed-by: Robert Foss +Reviewed-by: Nuno Sa +Signed-off-by: Bogdan Togorean +Signed-off-by: Alexandru Ardelean +Reviewed-by: Frieder Schrempf +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230719060143.63649-1-alex@shruggie.ro +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index 78b72739e5c3e..9f9874acfb2b7 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -786,8 +786,13 @@ static void adv7511_mode_set(struct adv7511 *adv7511, + else + low_refresh_rate = ADV7511_LOW_REFRESH_RATE_NONE; + +- regmap_update_bits(adv7511->regmap, 0xfb, +- 0x6, low_refresh_rate << 1); ++ if (adv7511->type == ADV7511) ++ regmap_update_bits(adv7511->regmap, 0xfb, ++ 0x6, low_refresh_rate << 1); ++ else ++ regmap_update_bits(adv7511->regmap, 0x4a, ++ 0xc, low_refresh_rate << 2); ++ + regmap_update_bits(adv7511->regmap, 0x17, + 0x60, (vsync_polarity << 6) | (hsync_polarity << 5)); + +-- +2.40.1 + diff --git a/queue-6.1/drm-amd-display-do-not-set-drr-on-pipe-commit.patch b/queue-6.1/drm-amd-display-do-not-set-drr-on-pipe-commit.patch new file mode 100644 index 00000000000..8ffe5864a4d --- /dev/null +++ b/queue-6.1/drm-amd-display-do-not-set-drr-on-pipe-commit.patch @@ -0,0 +1,73 @@ +From 865a491fce7af44d18e7540fbd14995d875a8bd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 22:29:31 -0400 +Subject: drm/amd/display: Do not set drr on pipe commit + +From: Wesley Chalmers + +[ Upstream commit e101bf95ea87ccc03ac2f48dfc0757c6364ff3c7 ] + +[WHY] +Writing to DRR registers such as OTG_V_TOTAL_MIN on the same frame as a +pipe commit can cause underflow. + +[HOW] +Move DMUB p-state delegate into optimze_bandwidth; enabling FAMS sets +optimized_required. + +This change expects that Freesync requests are blocked when +optimized_required is true. + +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Wesley Chalmers +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 6 ++++++ + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 7 +++++++ + 2 files changed, 13 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +index 4ef632864948e..21fae818ca28f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +@@ -2032,6 +2032,12 @@ void dcn20_optimize_bandwidth( + if (hubbub->funcs->program_compbuf_size) + hubbub->funcs->program_compbuf_size(hubbub, context->bw_ctx.bw.dcn.compbuf_size_kb, true); + ++ if (context->bw_ctx.bw.dcn.clk.fw_based_mclk_switching) { ++ dc_dmub_srv_p_state_delegate(dc, ++ true, context); ++ context->bw_ctx.bw.dcn.clk.p_state_change_support = true; ++ } ++ + dc->clk_mgr->funcs->update_clocks( + dc->clk_mgr, + context, +diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +index a1b312483d7f1..c97d3e81a83d2 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +@@ -987,11 +987,18 @@ void dcn30_set_disp_pattern_generator(const struct dc *dc, + void dcn30_prepare_bandwidth(struct dc *dc, + struct dc_state *context) + { ++ if (context->bw_ctx.bw.dcn.clk.fw_based_mclk_switching) { ++ dc->optimized_required = true; ++ context->bw_ctx.bw.dcn.clk.p_state_change_support = false; ++ } ++ + if (dc->clk_mgr->dc_mode_softmax_enabled) + if (dc->clk_mgr->clks.dramclk_khz <= dc->clk_mgr->bw_params->dc_mode_softmax_memclk * 1000 && + context->bw_ctx.bw.dcn.clk.dramclk_khz > dc->clk_mgr->bw_params->dc_mode_softmax_memclk * 1000) + dc->clk_mgr->funcs->set_max_memclk(dc->clk_mgr, dc->clk_mgr->bw_params->clk_table.entries[dc->clk_mgr->bw_params->clk_table.num_entries - 1].memclk_mhz); + + dcn20_prepare_bandwidth(dc, context); ++ ++ dc_dmub_srv_p_state_delegate(dc, false, context); + } + +-- +2.40.1 + diff --git a/queue-6.1/drm-amd-pm-fix-variable-dereferenced-issue-in-amdgpu.patch b/queue-6.1/drm-amd-pm-fix-variable-dereferenced-issue-in-amdgpu.patch new file mode 100644 index 00000000000..5a1ea2fdcb0 --- /dev/null +++ b/queue-6.1/drm-amd-pm-fix-variable-dereferenced-issue-in-amdgpu.patch @@ -0,0 +1,53 @@ +From 036173943d0e2fbabb0cecaf7301e3b564cecad4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Aug 2023 16:53:23 +0800 +Subject: drm/amd/pm: fix variable dereferenced issue in + amdgpu_device_attr_create() + +From: Yang Wang + +[ Upstream commit 25e6373a5b8efc623443f2699d2b929bf3067d76 ] + +- fix variable ('attr') dereferenced issue. +- using condition check instead of BUG_ON(). + +Fixes: 4e01847c38f7 ("drm/amdgpu: optimize amdgpu device attribute code") +Cc: Dan Carpenter +Signed-off-by: Yang Wang +Reviewed-by: Kenneth Feng +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/amdgpu_pm.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c +index 7d613118cb713..8472013ff38a2 100644 +--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c +@@ -2072,15 +2072,19 @@ static int amdgpu_device_attr_create(struct amdgpu_device *adev, + uint32_t mask, struct list_head *attr_list) + { + int ret = 0; +- struct device_attribute *dev_attr = &attr->dev_attr; +- const char *name = dev_attr->attr.name; + enum amdgpu_device_attr_states attr_states = ATTR_STATE_SUPPORTED; + struct amdgpu_device_attr_entry *attr_entry; ++ struct device_attribute *dev_attr; ++ const char *name; + + int (*attr_update)(struct amdgpu_device *adev, struct amdgpu_device_attr *attr, + uint32_t mask, enum amdgpu_device_attr_states *states) = default_attr_update; + +- BUG_ON(!attr); ++ if (!attr) ++ return -EINVAL; ++ ++ dev_attr = &attr->dev_attr; ++ name = dev_attr->attr.name; + + attr_update = attr->attr_update ? attr->attr_update : default_attr_update; + +-- +2.40.1 + diff --git a/queue-6.1/drm-amdgpu-avoid-integer-overflow-warning-in-amdgpu_.patch b/queue-6.1/drm-amdgpu-avoid-integer-overflow-warning-in-amdgpu_.patch new file mode 100644 index 00000000000..2ef8abc3360 --- /dev/null +++ b/queue-6.1/drm-amdgpu-avoid-integer-overflow-warning-in-amdgpu_.patch @@ -0,0 +1,52 @@ +From fc912d90924f62962542e85fb219d7ed91202970 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 13:11:51 +0200 +Subject: drm/amdgpu: avoid integer overflow warning in + amdgpu_device_resize_fb_bar() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +[ Upstream commit 822130b5e8834ab30ad410cf19a582e5014b9a85 ] + +On 32-bit architectures comparing a resource against a value larger than +U32_MAX can cause a warning: + +drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:1344:18: error: result of comparison of constant 4294967296 with expression of type 'resource_size_t' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare] + res->start > 0x100000000ull) + ~~~~~~~~~~ ^ ~~~~~~~~~~~~~~ + +As gcc does not warn about this in dead code, add an IS_ENABLED() check at +the start of the function. This will always return success but not actually resize +the BAR on 32-bit architectures without high memory, which is exactly what +we want here, as the driver can fall back to bank switching the VRAM +access. + +Fixes: 31b8adab3247 ("drm/amdgpu: require a root bus window above 4GB for BAR resize") +Reviewed-by: Christian König +Signed-off-by: Arnd Bergmann +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index e6427a00cf6d6..9aac9e755609d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -1212,6 +1212,9 @@ int amdgpu_device_resize_fb_bar(struct amdgpu_device *adev) + u16 cmd; + int r; + ++ if (!IS_ENABLED(CONFIG_PHYS_ADDR_T_64BIT)) ++ return 0; ++ + /* Bypass for VF */ + if (amdgpu_sriov_vf(adev)) + return 0; +-- +2.40.1 + diff --git a/queue-6.1/drm-amdgpu-update-min-to-min_t-in-amdgpu_info_ioctl.patch b/queue-6.1/drm-amdgpu-update-min-to-min_t-in-amdgpu_info_ioctl.patch new file mode 100644 index 00000000000..4a8b32791ed --- /dev/null +++ b/queue-6.1/drm-amdgpu-update-min-to-min_t-in-amdgpu_info_ioctl.patch @@ -0,0 +1,88 @@ +From aa14708c5d4e86d2748d64d8819b6ec5ece7a946 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 12:29:14 +0530 +Subject: drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivasan Shanmugam + +[ Upstream commit a0cc8e1512ad72c9f97cdcb76d42715730adaf62 ] + +Fixes the following: + +WARNING: min() should probably be min_t(size_t, size, sizeof(ip)) ++ ret = copy_to_user(out, &ip, min((size_t)size, sizeof(ip))); + +And other style fixes: + +WARNING: Prefer 'unsigned int' to bare use of 'unsigned' +WARNING: Missing a blank line after declarations + +Cc: Christian König +Cc: Alex Deucher +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index 4e42dcb1950f7..9e3313dd956ae 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -554,6 +554,7 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) + crtc = (struct drm_crtc *)minfo->crtcs[i]; + if (crtc && crtc->base.id == info->mode_crtc.id) { + struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc); ++ + ui32 = amdgpu_crtc->crtc_id; + found = 1; + break; +@@ -572,7 +573,7 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) + if (ret) + return ret; + +- ret = copy_to_user(out, &ip, min((size_t)size, sizeof(ip))); ++ ret = copy_to_user(out, &ip, min_t(size_t, size, sizeof(ip))); + return ret ? -EFAULT : 0; + } + case AMDGPU_INFO_HW_IP_COUNT: { +@@ -718,17 +719,18 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) + ? -EFAULT : 0; + } + case AMDGPU_INFO_READ_MMR_REG: { +- unsigned n, alloc_size; ++ unsigned int n, alloc_size; + uint32_t *regs; +- unsigned se_num = (info->read_mmr_reg.instance >> ++ unsigned int se_num = (info->read_mmr_reg.instance >> + AMDGPU_INFO_MMR_SE_INDEX_SHIFT) & + AMDGPU_INFO_MMR_SE_INDEX_MASK; +- unsigned sh_num = (info->read_mmr_reg.instance >> ++ unsigned int sh_num = (info->read_mmr_reg.instance >> + AMDGPU_INFO_MMR_SH_INDEX_SHIFT) & + AMDGPU_INFO_MMR_SH_INDEX_MASK; + + /* set full masks if the userspace set all bits +- * in the bitfields */ ++ * in the bitfields ++ */ + if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK) + se_num = 0xffffffff; + else if (se_num >= AMDGPU_GFX_MAX_SE) +@@ -852,7 +854,7 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) + return ret; + } + case AMDGPU_INFO_VCE_CLOCK_TABLE: { +- unsigned i; ++ unsigned int i; + struct drm_amdgpu_info_vce_clock_table vce_clk_table = {}; + struct amd_vce_state *vce_state; + +-- +2.40.1 + diff --git a/queue-6.1/drm-amdgpu-use-rmw-accessors-for-changing-lnkctl.patch b/queue-6.1/drm-amdgpu-use-rmw-accessors-for-changing-lnkctl.patch new file mode 100644 index 00000000000..0c103870838 --- /dev/null +++ b/queue-6.1/drm-amdgpu-use-rmw-accessors-for-changing-lnkctl.patch @@ -0,0 +1,144 @@ +From 4b927541f4eb3f197fbb3a9e59d9e17615a05e85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:04:57 +0300 +Subject: drm/amdgpu: Use RMW accessors for changing LNKCTL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit ce7d88110b9ed5f33fe79ea6d4ed049fb0e57bce ] + +Don't assume that only the driver would be accessing LNKCTL. ASPM policy +changes can trigger write to LNKCTL outside of driver's control. And in +the case of upstream bridge, the driver does not even own the device it's +changing the registers for. + +Use RMW capability accessors which do proper locking to avoid losing +concurrent updates to the register value. + +Suggested-by: Lukas Wunner +Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts") +Fixes: 62a37553414a ("drm/amdgpu: add si implementation v10") +Link: https://lore.kernel.org/r/20230717120503.15276-6-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Acked-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/cik.c | 36 +++++++++----------------------- + drivers/gpu/drm/amd/amdgpu/si.c | 36 +++++++++----------------------- + 2 files changed, 20 insertions(+), 52 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c +index de6d10390ab2f..9be6da37032a7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/cik.c ++++ b/drivers/gpu/drm/amd/amdgpu/cik.c +@@ -1574,17 +1574,8 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &bridge_cfg); +- pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL, +- &gpu_cfg); +- +- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16); +- +- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_set_word(adev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); + + tmp = RREG32_PCIE(ixPCIE_LC_STATUS1); + max_lw = (tmp & PCIE_LC_STATUS1__LC_DETECTED_LINK_WIDTH_MASK) >> +@@ -1637,21 +1628,14 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + msleep(100); + + /* linkctl */ +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, +- tmp16); +- +- pcie_capability_read_word(adev->pdev, +- PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(adev->pdev, +- PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ bridge_cfg & ++ PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_clear_and_set_word(adev->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ gpu_cfg & ++ PCI_EXP_LNKCTL_HAWD); + + /* linkctl2 */ + pcie_capability_read_word(root, PCI_EXP_LNKCTL2, +diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c +index 7f99e130acd06..fd34c2100bd96 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si.c ++++ b/drivers/gpu/drm/amd/amdgpu/si.c +@@ -2276,17 +2276,8 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &bridge_cfg); +- pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL, +- &gpu_cfg); +- +- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16); +- +- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_set_word(adev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); + + tmp = RREG32_PCIE(PCIE_LC_STATUS1); + max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT; +@@ -2331,21 +2322,14 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + + mdelay(100); + +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, +- tmp16); +- +- pcie_capability_read_word(adev->pdev, +- PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(adev->pdev, +- PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ bridge_cfg & ++ PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_clear_and_set_word(adev->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ gpu_cfg & ++ PCI_EXP_LNKCTL_HAWD); + + pcie_capability_read_word(root, PCI_EXP_LNKCTL2, + &tmp16); +-- +2.40.1 + diff --git a/queue-6.1/drm-armada-fix-off-by-one-error-in-armada_overlay_ge.patch b/queue-6.1/drm-armada-fix-off-by-one-error-in-armada_overlay_ge.patch new file mode 100644 index 00000000000..1d7eef28ea5 --- /dev/null +++ b/queue-6.1/drm-armada-fix-off-by-one-error-in-armada_overlay_ge.patch @@ -0,0 +1,52 @@ +From 20743842bfff29d395b8357067834d549061a900 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:25:40 +0200 +Subject: drm/armada: Fix off-by-one error in armada_overlay_get_property() + +From: Geert Uytterhoeven + +[ Upstream commit 5f0d984053f74983a287100a9519b2fabb785fb5 ] + +As ffs() returns one more than the index of the first bit set (zero +means no bits set), the color key mode value is shifted one position too +much. + +Fix this by using FIELD_GET() instead. + +Fixes: c96103b6c49ff9a8 ("drm/armada: move colorkey properties into overlay plane state") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Russell King (Oracle) +Signed-off-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/a4d779d954a7515ddbbf31cb0f0d8184c0e7c879.1689600265.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/armada/armada_overlay.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/armada/armada_overlay.c b/drivers/gpu/drm/armada/armada_overlay.c +index f21eb8fb76d87..3b9bd8ecda137 100644 +--- a/drivers/gpu/drm/armada/armada_overlay.c ++++ b/drivers/gpu/drm/armada/armada_overlay.c +@@ -4,6 +4,8 @@ + * Rewritten from the dovefb driver, and Armada510 manuals. + */ + ++#include ++ + #include + #include + #include +@@ -445,8 +447,8 @@ static int armada_overlay_get_property(struct drm_plane *plane, + drm_to_overlay_state(state)->colorkey_ug, + drm_to_overlay_state(state)->colorkey_vb, 0); + } else if (property == priv->colorkey_mode_prop) { +- *val = (drm_to_overlay_state(state)->colorkey_mode & +- CFG_CKMODE_MASK) >> ffs(CFG_CKMODE_MASK); ++ *val = FIELD_GET(CFG_CKMODE_MASK, ++ drm_to_overlay_state(state)->colorkey_mode); + } else if (property == priv->brightness_prop) { + *val = drm_to_overlay_state(state)->brightness + 256; + } else if (property == priv->contrast_prop) { +-- +2.40.1 + diff --git a/queue-6.1/drm-bridge-anx7625-use-common-macros-for-dp-power-se.patch b/queue-6.1/drm-bridge-anx7625-use-common-macros-for-dp-power-se.patch new file mode 100644 index 00000000000..ec100ee9524 --- /dev/null +++ b/queue-6.1/drm-bridge-anx7625-use-common-macros-for-dp-power-se.patch @@ -0,0 +1,56 @@ +From 7035b5d9a353b96c37abdf062f8cc82cb9177db4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jul 2023 17:09:27 +0800 +Subject: drm/bridge: anx7625: Use common macros for DP power sequencing + commands +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chen-Yu Tsai + +[ Upstream commit 2ba776f903cb7157e80b5f314fb0b4faf6ea6958 ] + +The DRM DP code has macros for the DP power sequencing commands. Use +them in the anx7625 driver instead of raw numbers. + +Fixes: 548b512e144f ("drm/bridge: anx7625: send DPCD command to downstream") +Fixes: 27f26359de9b ("drm/bridge: anx7625: Set downstream sink into normal status") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Nícolas F. R. A. Prado +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230710090929.1873646-1-wenst@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index 213263ad6a064..36ec9dedadfe1 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -933,8 +933,8 @@ static void anx7625_dp_start(struct anx7625_data *ctx) + + dev_dbg(dev, "set downstream sink into normal\n"); + /* Downstream sink enter into normal mode */ +- data = 1; +- ret = anx7625_aux_trans(ctx, DP_AUX_NATIVE_WRITE, 0x000600, 1, &data); ++ data = DP_SET_POWER_D0; ++ ret = anx7625_aux_trans(ctx, DP_AUX_NATIVE_WRITE, DP_SET_POWER, 1, &data); + if (ret < 0) + dev_err(dev, "IO error : set sink into normal mode fail\n"); + +@@ -973,8 +973,8 @@ static void anx7625_dp_stop(struct anx7625_data *ctx) + + dev_dbg(dev, "notify downstream enter into standby\n"); + /* Downstream monitor enter into standby mode */ +- data = 2; +- ret |= anx7625_aux_trans(ctx, DP_AUX_NATIVE_WRITE, 0x000600, 1, &data); ++ data = DP_SET_POWER_D3; ++ ret |= anx7625_aux_trans(ctx, DP_AUX_NATIVE_WRITE, DP_SET_POWER, 1, &data); + if (ret < 0) + DRM_DEV_ERROR(dev, "IO error : mute video fail\n"); + +-- +2.40.1 + diff --git a/queue-6.1/drm-bridge-anx7625-use-common-macros-for-hdcp-capabi.patch b/queue-6.1/drm-bridge-anx7625-use-common-macros-for-hdcp-capabi.patch new file mode 100644 index 00000000000..2b091fcdeab --- /dev/null +++ b/queue-6.1/drm-bridge-anx7625-use-common-macros-for-hdcp-capabi.patch @@ -0,0 +1,47 @@ +From 694215e0b6509dcf5d6e2fb36be1c1ad3f1d12f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jul 2023 17:12:01 +0800 +Subject: drm/bridge: anx7625: Use common macros for HDCP capabilities +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chen-Yu Tsai + +[ Upstream commit 41639b3a8b0f1f194dfe0577d99db70613f78626 ] + +The DRM DP code has macros for the DP HDCP capabilities. Use them in the +anx7625 driver instead of raw numbers. + +Fixes: cd1637c7e480 ("drm/bridge: anx7625: add HDCP support") +Suggested-by: Nícolas F. R. A. Prado +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230710091203.1874317-1-wenst@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index 36ec9dedadfe1..cf86cc05b7fca 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -874,11 +874,11 @@ static int anx7625_hdcp_enable(struct anx7625_data *ctx) + } + + /* Read downstream capability */ +- ret = anx7625_aux_trans(ctx, DP_AUX_NATIVE_READ, 0x68028, 1, &bcap); ++ ret = anx7625_aux_trans(ctx, DP_AUX_NATIVE_READ, DP_AUX_HDCP_BCAPS, 1, &bcap); + if (ret < 0) + return ret; + +- if (!(bcap & 0x01)) { ++ if (!(bcap & DP_BCAPS_HDCP_CAPABLE)) { + pr_warn("downstream not support HDCP 1.4, cap(%x).\n", bcap); + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/drm-bridge-dw-mipi-dsi-fix-enable-disable-of-dsi-con.patch b/queue-6.1/drm-bridge-dw-mipi-dsi-fix-enable-disable-of-dsi-con.patch new file mode 100644 index 00000000000..7253cc4d590 --- /dev/null +++ b/queue-6.1/drm-bridge-dw-mipi-dsi-fix-enable-disable-of-dsi-con.patch @@ -0,0 +1,192 @@ +From e1deec9d11000fcfda9cb7f5824de7d06e4dea10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Jun 2023 00:48:25 +0200 +Subject: drm: bridge: dw-mipi-dsi: Fix enable/disable of DSI controller + +From: Ondrej Jirman + +[ Upstream commit 05aa61334592adb230749ff465b103ee10e63936 ] + +Before this patch, booting to Linux VT and doing a simple: + + echo 2 > /sys/class/graphics/fb0/blank + echo 0 > /sys/class/graphics/fb0/blank + +would result in failures to re-enable the panel. Mode set callback is +called only once during boot in this scenario, while calls to +enable/disable callbacks are balanced afterwards. The driver doesn't +work unless userspace calls modeset before enabling the CRTC/connector. + +This patch moves enabling of the DSI host from mode_set into pre_enable +callback, and removes some old hacks where this bridge driver is +directly calling into other bridge driver's callbacks. + +pre_enable_prev_first flag is set on the panel's bridge so that panel +drivers will get their prepare function called between DSI host's +pre_enable and enable callbacks, so that they get a chance to +perform panel setup while DSI host is already enabled in command +mode. Otherwise panel's prepare would be called before DSI host +is enabled, and any DSI communication used in prepare callback +would fail. + +With all these changes, the enable/disable sequence is now well +balanced, and host's and panel's callbacks are called in proper order +documented in the drm_panel API documentation without needing the old +hacks. (Mainly that panel->prepare is called when DSI host is ready to +allow the panel driver to send DSI commands and vice versa during +disable.) + +Tested on Pinephone Pro. Trace of the callbacks follows. + +Before: + +[ 1.253882] dw-mipi-dsi-rockchip ff960000.dsi: mode_set +[ 1.290732] panel-himax-hx8394 ff960000.dsi.0: prepare +[ 1.475576] dw-mipi-dsi-rockchip ff960000.dsi: enable +[ 1.475593] panel-himax-hx8394 ff960000.dsi.0: enable + +echo 2 > /sys/class/graphics/fb0/blank + +[ 13.722799] panel-himax-hx8394 ff960000.dsi.0: disable +[ 13.774502] dw-mipi-dsi-rockchip ff960000.dsi: post_disable +[ 13.774526] panel-himax-hx8394 ff960000.dsi.0: unprepare + +echo 0 > /sys/class/graphics/fb0/blank + +[ 17.735796] panel-himax-hx8394 ff960000.dsi.0: prepare +[ 17.923522] dw-mipi-dsi-rockchip ff960000.dsi: enable +[ 17.923540] panel-himax-hx8394 ff960000.dsi.0: enable +[ 17.944330] dw-mipi-dsi-rockchip ff960000.dsi: failed to write command FIFO +[ 17.944335] panel-himax-hx8394 ff960000.dsi.0: sending command 0xb9 failed: -110 +[ 17.944340] panel-himax-hx8394 ff960000.dsi.0: Panel init sequence failed: -110 + +echo 2 > /sys/class/graphics/fb0/blank + +[ 431.148583] panel-himax-hx8394 ff960000.dsi.0: disable +[ 431.169259] dw-mipi-dsi-rockchip ff960000.dsi: failed to write command FIFO +[ 431.169268] panel-himax-hx8394 ff960000.dsi.0: Failed to enter sleep mode: -110 +[ 431.169282] dw-mipi-dsi-rockchip ff960000.dsi: post_disable +[ 431.169316] panel-himax-hx8394 ff960000.dsi.0: unprepare +[ 431.169357] pclk_mipi_dsi0 already disabled + +echo 0 > /sys/class/graphics/fb0/blank + +[ 432.796851] panel-himax-hx8394 ff960000.dsi.0: prepare +[ 432.981537] dw-mipi-dsi-rockchip ff960000.dsi: enable +[ 432.981568] panel-himax-hx8394 ff960000.dsi.0: enable +[ 433.002290] dw-mipi-dsi-rockchip ff960000.dsi: failed to write command FIFO +[ 433.002299] panel-himax-hx8394 ff960000.dsi.0: sending command 0xb9 failed: -110 +[ 433.002312] panel-himax-hx8394 ff960000.dsi.0: Panel init sequence failed: -110 + +----------------------------------------------------------------------- + +After: + +[ 1.248372] dw-mipi-dsi-rockchip ff960000.dsi: mode_set +[ 1.248704] dw-mipi-dsi-rockchip ff960000.dsi: pre_enable +[ 1.285377] panel-himax-hx8394 ff960000.dsi.0: prepare +[ 1.468392] dw-mipi-dsi-rockchip ff960000.dsi: enable +[ 1.468421] panel-himax-hx8394 ff960000.dsi.0: enable + +echo 2 > /sys/class/graphics/fb0/blank + +[ 16.210357] panel-himax-hx8394 ff960000.dsi.0: disable +[ 16.261315] dw-mipi-dsi-rockchip ff960000.dsi: post_disable +[ 16.261339] panel-himax-hx8394 ff960000.dsi.0: unprepare + +echo 0 > /sys/class/graphics/fb0/blank + +[ 19.161453] dw-mipi-dsi-rockchip ff960000.dsi: pre_enable +[ 19.197869] panel-himax-hx8394 ff960000.dsi.0: prepare +[ 19.382141] dw-mipi-dsi-rockchip ff960000.dsi: enable +[ 19.382158] panel-himax-hx8394 ff960000.dsi.0: enable + + (But depends on functionality intorduced in Linux 6.3, so this patch will + not build on older kernels when applied to older stable branches.) + +Fixes: 46fc51546d44 ("drm/bridge/synopsys: Add MIPI DSI host controller bridge") +Signed-off-by: Ondrej Jirman +Reviewed-by: Sam Ravnborg +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230617224915.1923630-1-megi@xff.cz +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c | 28 +++++++++++-------- + 1 file changed, 16 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c +index b2efecf7d1603..4291798bd70f5 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c +@@ -265,6 +265,7 @@ struct dw_mipi_dsi { + struct dw_mipi_dsi *master; /* dual-dsi master ptr */ + struct dw_mipi_dsi *slave; /* dual-dsi slave ptr */ + ++ struct drm_display_mode mode; + const struct dw_mipi_dsi_plat_data *plat_data; + }; + +@@ -332,6 +333,7 @@ static int dw_mipi_dsi_host_attach(struct mipi_dsi_host *host, + if (IS_ERR(bridge)) + return PTR_ERR(bridge); + ++ bridge->pre_enable_prev_first = true; + dsi->panel_bridge = bridge; + + drm_bridge_add(&dsi->bridge); +@@ -859,15 +861,6 @@ static void dw_mipi_dsi_bridge_post_atomic_disable(struct drm_bridge *bridge, + */ + dw_mipi_dsi_set_mode(dsi, 0); + +- /* +- * TODO Only way found to call panel-bridge post_disable & +- * panel unprepare before the dsi "final" disable... +- * This needs to be fixed in the drm_bridge framework and the API +- * needs to be updated to manage our own call chains... +- */ +- if (dsi->panel_bridge->funcs->post_disable) +- dsi->panel_bridge->funcs->post_disable(dsi->panel_bridge); +- + if (phy_ops->power_off) + phy_ops->power_off(dsi->plat_data->priv_data); + +@@ -942,15 +935,25 @@ static void dw_mipi_dsi_mode_set(struct dw_mipi_dsi *dsi, + phy_ops->power_on(dsi->plat_data->priv_data); + } + ++static void dw_mipi_dsi_bridge_atomic_pre_enable(struct drm_bridge *bridge, ++ struct drm_bridge_state *old_bridge_state) ++{ ++ struct dw_mipi_dsi *dsi = bridge_to_dsi(bridge); ++ ++ /* Power up the dsi ctl into a command mode */ ++ dw_mipi_dsi_mode_set(dsi, &dsi->mode); ++ if (dsi->slave) ++ dw_mipi_dsi_mode_set(dsi->slave, &dsi->mode); ++} ++ + static void dw_mipi_dsi_bridge_mode_set(struct drm_bridge *bridge, + const struct drm_display_mode *mode, + const struct drm_display_mode *adjusted_mode) + { + struct dw_mipi_dsi *dsi = bridge_to_dsi(bridge); + +- dw_mipi_dsi_mode_set(dsi, adjusted_mode); +- if (dsi->slave) +- dw_mipi_dsi_mode_set(dsi->slave, adjusted_mode); ++ /* Store the display mode for later use in pre_enable callback */ ++ drm_mode_copy(&dsi->mode, adjusted_mode); + } + + static void dw_mipi_dsi_bridge_atomic_enable(struct drm_bridge *bridge, +@@ -1004,6 +1007,7 @@ static const struct drm_bridge_funcs dw_mipi_dsi_bridge_funcs = { + .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state, + .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state, + .atomic_reset = drm_atomic_helper_bridge_reset, ++ .atomic_pre_enable = dw_mipi_dsi_bridge_atomic_pre_enable, + .atomic_enable = dw_mipi_dsi_bridge_atomic_enable, + .atomic_post_disable = dw_mipi_dsi_bridge_post_atomic_disable, + .mode_set = dw_mipi_dsi_bridge_mode_set, +-- +2.40.1 + diff --git a/queue-6.1/drm-bridge-tc358764-fix-debug-print-parameter-order.patch b/queue-6.1/drm-bridge-tc358764-fix-debug-print-parameter-order.patch new file mode 100644 index 00000000000..35044476db3 --- /dev/null +++ b/queue-6.1/drm-bridge-tc358764-fix-debug-print-parameter-order.patch @@ -0,0 +1,40 @@ +From 81779cc02d0891cdd81d37d18a23e1a0cd0f3fa5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 17:28:17 +0200 +Subject: drm/bridge: tc358764: Fix debug print parameter order + +From: Marek Vasut + +[ Upstream commit 7f947be02aab5b154427cb5b0fffe858fc387b02 ] + +The debug print parameters were swapped in the output and they were +printed as decimal values, both the hardware address and the value. +Update the debug print to print the parameters in correct order, and +use hexadecimal print for both address and value. + +Fixes: f38b7cca6d0e ("drm/bridge: tc358764: Add DSI to LVDS bridge driver") +Signed-off-by: Marek Vasut +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230615152817.359420-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358764.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/tc358764.c b/drivers/gpu/drm/bridge/tc358764.c +index 53259c12d7778..e0f583a88789d 100644 +--- a/drivers/gpu/drm/bridge/tc358764.c ++++ b/drivers/gpu/drm/bridge/tc358764.c +@@ -176,7 +176,7 @@ static void tc358764_read(struct tc358764 *ctx, u16 addr, u32 *val) + if (ret >= 0) + le32_to_cpus(val); + +- dev_dbg(ctx->dev, "read: %d, addr: %d\n", addr, *val); ++ dev_dbg(ctx->dev, "read: addr=0x%04x data=0x%08x\n", addr, *val); + } + + static void tc358764_write(struct tc358764 *ctx, u16 addr, u32 val) +-- +2.40.1 + diff --git a/queue-6.1/drm-etnaviv-fix-dumping-of-active-mmu-context.patch b/queue-6.1/drm-etnaviv-fix-dumping-of-active-mmu-context.patch new file mode 100644 index 00000000000..e24dffcf3db --- /dev/null +++ b/queue-6.1/drm-etnaviv-fix-dumping-of-active-mmu-context.patch @@ -0,0 +1,72 @@ +From 393e869f2b22604b597c9c5dc09379512b4fb55f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 16:38:10 +0200 +Subject: drm/etnaviv: fix dumping of active MMU context + +From: Lucas Stach + +[ Upstream commit 20faf2005ec85fa1a6acc9a74ff27de667f90576 ] + +gpu->mmu_context is the MMU context of the last job in the HW queue, which +isn't necessarily the same as the context from the bad job. Dump the MMU +context from the scheduler determined bad submit to make it work as intended. + +Fixes: 17e4660ae3d7 ("drm/etnaviv: implement per-process address spaces on MMUv2") +Signed-off-by: Lucas Stach +Reviewed-by: Christian Gmeiner +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_dump.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c +index f418e0b75772e..0edcf8ceb4a78 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c +@@ -125,9 +125,9 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit) + return; + etnaviv_dump_core = false; + +- mutex_lock(&gpu->mmu_context->lock); ++ mutex_lock(&submit->mmu_context->lock); + +- mmu_size = etnaviv_iommu_dump_size(gpu->mmu_context); ++ mmu_size = etnaviv_iommu_dump_size(submit->mmu_context); + + /* We always dump registers, mmu, ring, hanging cmdbuf and end marker */ + n_obj = 5; +@@ -157,7 +157,7 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit) + iter.start = __vmalloc(file_size, GFP_KERNEL | __GFP_NOWARN | + __GFP_NORETRY); + if (!iter.start) { +- mutex_unlock(&gpu->mmu_context->lock); ++ mutex_unlock(&submit->mmu_context->lock); + dev_warn(gpu->dev, "failed to allocate devcoredump file\n"); + return; + } +@@ -169,18 +169,18 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit) + memset(iter.hdr, 0, iter.data - iter.start); + + etnaviv_core_dump_registers(&iter, gpu); +- etnaviv_core_dump_mmu(&iter, gpu->mmu_context, mmu_size); ++ etnaviv_core_dump_mmu(&iter, submit->mmu_context, mmu_size); + etnaviv_core_dump_mem(&iter, ETDUMP_BUF_RING, gpu->buffer.vaddr, + gpu->buffer.size, + etnaviv_cmdbuf_get_va(&gpu->buffer, +- &gpu->mmu_context->cmdbuf_mapping)); ++ &submit->mmu_context->cmdbuf_mapping)); + + etnaviv_core_dump_mem(&iter, ETDUMP_BUF_CMD, + submit->cmdbuf.vaddr, submit->cmdbuf.size, + etnaviv_cmdbuf_get_va(&submit->cmdbuf, +- &gpu->mmu_context->cmdbuf_mapping)); ++ &submit->mmu_context->cmdbuf_mapping)); + +- mutex_unlock(&gpu->mmu_context->lock); ++ mutex_unlock(&submit->mmu_context->lock); + + /* Reserve space for the bomap */ + if (n_bomap_pages) { +-- +2.40.1 + diff --git a/queue-6.1/drm-hyperv-fix-a-compilation-issue-because-of-not-in.patch b/queue-6.1/drm-hyperv-fix-a-compilation-issue-because-of-not-in.patch new file mode 100644 index 00000000000..6fa57694616 --- /dev/null +++ b/queue-6.1/drm-hyperv-fix-a-compilation-issue-because-of-not-in.patch @@ -0,0 +1,51 @@ +From e857364299faea796d6499c9a48c2b16f1444ef8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jul 2023 18:05:14 +0800 +Subject: drm/hyperv: Fix a compilation issue because of not including + screen_info.h + +From: Sui Jingfeng + +[ Upstream commit 8d1077cf2e43b15fefd76ebec2b71541eb27ef2c ] + +Fixes the following build errors on arm64: + +drivers/video/fbdev/hyperv_fb.c: In function 'hvfb_getmem': +>> drivers/video/fbdev/hyperv_fb.c:1033:24: error: 'screen_info' undeclared (first use in this function) + 1033 | base = screen_info.lfb_base; + | ^~~~~~~~~~~ +drivers/video/fbdev/hyperv_fb.c:1033:24: note: each undeclared identifier is reported only once for each function it appears in + +>> drivers/gpu/drm/hyperv/hyperv_drm_drv.c:75:54: error: 'screen_info' undeclared (first use in this function) + 75 | drm_aperture_remove_conflicting_framebuffers(screen_info.lfb_base, + | ^~~~~~~~~~~ +drivers/gpu/drm/hyperv/hyperv_drm_drv.c:75:54: note: each undeclared identifier is reported only once for each function it appears in + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202307090823.nxnT8Kk5-lkp@intel.com/ +Fixes: 81d2393485f0 ("fbdev/hyperv-fb: Do not set struct fb_info.apertures") +Fixes: 8b0d13545b09 ("efi: Do not include from EFI header") +Signed-off-by: Sui Jingfeng +Reviewed-by: Thomas Zimmermann +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20230709100514.703759-1-suijingfeng@loongson.cn +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/hyperv/hyperv_drm_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/hyperv/hyperv_drm_drv.c b/drivers/gpu/drm/hyperv/hyperv_drm_drv.c +index 29ee0814bccc8..68050409dd26c 100644 +--- a/drivers/gpu/drm/hyperv/hyperv_drm_drv.c ++++ b/drivers/gpu/drm/hyperv/hyperv_drm_drv.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + + #include + #include +-- +2.40.1 + diff --git a/queue-6.1/drm-mediatek-dp-add-missing-error-checks-in-mtk_dp_p.patch b/queue-6.1/drm-mediatek-dp-add-missing-error-checks-in-mtk_dp_p.patch new file mode 100644 index 00000000000..95f89714f2c --- /dev/null +++ b/queue-6.1/drm-mediatek-dp-add-missing-error-checks-in-mtk_dp_p.patch @@ -0,0 +1,65 @@ +From cba878d15d6f39d59e125c71c8a79f15f4834d96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 09:32:24 +0200 +Subject: drm/mediatek: dp: Add missing error checks in + mtk_dp_parse_capabilities + +From: AngeloGioacchino Del Regno + +[ Upstream commit cfc146137a9f12e883ba64bc496b6da4d23f26d5 ] + +If reading the RX capabilities fails the training pattern will be set +wrongly: add error checking for drm_dp_read_dpcd_caps() and return if +anything went wrong with it. + +While at it, also add a less critical error check when writing to +clear the ESI0 IRQ vector. + +Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver") +Signed-off-by: AngeloGioacchino Del Regno +Tested-by: Chen-Yu Tsai +Reviewed-by: Alexandre Mergnat +Reviewed-by: CK Hu +Link: https://patchwork.kernel.org/project/dri-devel/patch/20230725073234.55892-2-angelogioacchino.delregno@collabora.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dp.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c +index 007af69e5026f..4c249939a6c3b 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dp.c ++++ b/drivers/gpu/drm/mediatek/mtk_dp.c +@@ -1588,7 +1588,9 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp) + u8 val; + ssize_t ret; + +- drm_dp_read_dpcd_caps(&mtk_dp->aux, mtk_dp->rx_cap); ++ ret = drm_dp_read_dpcd_caps(&mtk_dp->aux, mtk_dp->rx_cap); ++ if (ret < 0) ++ return ret; + + if (drm_dp_tps4_supported(mtk_dp->rx_cap)) + mtk_dp->train_info.channel_eq_pattern = DP_TRAINING_PATTERN_4; +@@ -1615,10 +1617,13 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp) + return ret == 0 ? -EIO : ret; + } + +- if (val) +- drm_dp_dpcd_writeb(&mtk_dp->aux, +- DP_DEVICE_SERVICE_IRQ_VECTOR_ESI0, +- val); ++ if (val) { ++ ret = drm_dp_dpcd_writeb(&mtk_dp->aux, ++ DP_DEVICE_SERVICE_IRQ_VECTOR_ESI0, ++ val); ++ if (ret < 0) ++ return ret; ++ } + } + + return 0; +-- +2.40.1 + diff --git a/queue-6.1/drm-mediatek-fix-potential-memory-leak-if-vmap-fail.patch b/queue-6.1/drm-mediatek-fix-potential-memory-leak-if-vmap-fail.patch new file mode 100644 index 00000000000..c900d334575 --- /dev/null +++ b/queue-6.1/drm-mediatek-fix-potential-memory-leak-if-vmap-fail.patch @@ -0,0 +1,45 @@ +From afcc7934cbb1c132dd0e9ba06d9ea2265b31f960 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 21:40:00 +0800 +Subject: drm/mediatek: Fix potential memory leak if vmap() fail + +From: Sui Jingfeng + +[ Upstream commit 379091e0f6d179d1a084c65de90fa44583b14a70 ] + +Also return -ENOMEM if such a failure happens, the implement should take +responsibility for the error handling. + +Fixes: 3df64d7b0a4f ("drm/mediatek: Implement gem prime vmap/vunmap function") +Reviewed-by: Matthias Brugger +Reviewed-by: Alexandre Mergnat +Signed-off-by: Sui Jingfeng +Reviewed-by: CK Hu +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/dri-devel/patch/20230706134000.130098-1-suijingfeng@loongson.cn/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +index 6c204ccfb9ece..1d0374a577a5e 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +@@ -242,7 +242,11 @@ int mtk_drm_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map) + + mtk_gem->kvaddr = vmap(mtk_gem->pages, npages, VM_MAP, + pgprot_writecombine(PAGE_KERNEL)); +- ++ if (!mtk_gem->kvaddr) { ++ kfree(sgt); ++ kfree(mtk_gem->pages); ++ return -ENOMEM; ++ } + out: + kfree(sgt); + iosys_map_set_vaddr(map, mtk_gem->kvaddr); +-- +2.40.1 + diff --git a/queue-6.1/drm-mediatek-remove-freeing-not-dynamic-allocated-me.patch b/queue-6.1/drm-mediatek-remove-freeing-not-dynamic-allocated-me.patch new file mode 100644 index 00000000000..fb460415cc5 --- /dev/null +++ b/queue-6.1/drm-mediatek-remove-freeing-not-dynamic-allocated-me.patch @@ -0,0 +1,62 @@ +From 07b4a6274c1cf5fa66d16f04e8420d9bb12fac15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jul 2023 17:49:05 +0800 +Subject: drm/mediatek: Remove freeing not dynamic allocated memory + +From: Jason-JH.Lin + +[ Upstream commit 27b9e2ea3f2757da26bb8280e46f7fdbb1acb219 ] + +Fixing the coverity issue of: +mtk_drm_cmdq_pkt_destroy frees address of mtk_crtc->cmdq_handle + +So remove the free function. + +Fixes: 7627122fd1c0 ("drm/mediatek: Add cmdq_handle in mtk_crtc") +Signed-off-by: Jason-JH.Lin +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: CK Hu +Reviewed-by: Alexandre Mergnat +Link: https://patchwork.kernel.org/project/dri-devel/patch/20230714094908.13087-2-jason-jh.lin@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +index 5071f1263216b..14ddfe3a6be77 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +@@ -115,10 +115,9 @@ static int mtk_drm_cmdq_pkt_create(struct cmdq_client *client, struct cmdq_pkt * + dma_addr_t dma_addr; + + pkt->va_base = kzalloc(size, GFP_KERNEL); +- if (!pkt->va_base) { +- kfree(pkt); ++ if (!pkt->va_base) + return -ENOMEM; +- } ++ + pkt->buf_size = size; + pkt->cl = (void *)client; + +@@ -128,7 +127,6 @@ static int mtk_drm_cmdq_pkt_create(struct cmdq_client *client, struct cmdq_pkt * + if (dma_mapping_error(dev, dma_addr)) { + dev_err(dev, "dma map failed, size=%u\n", (u32)(u64)size); + kfree(pkt->va_base); +- kfree(pkt); + return -ENOMEM; + } + +@@ -144,7 +142,6 @@ static void mtk_drm_cmdq_pkt_destroy(struct cmdq_pkt *pkt) + dma_unmap_single(client->chan->mbox->dev, pkt->pa_base, pkt->buf_size, + DMA_TO_DEVICE); + kfree(pkt->va_base); +- kfree(pkt); + } + #endif + +-- +2.40.1 + diff --git a/queue-6.1/drm-msm-a2xx-call-adreno_gpu_init-earlier.patch b/queue-6.1/drm-msm-a2xx-call-adreno_gpu_init-earlier.patch new file mode 100644 index 00000000000..e03247f6a0c --- /dev/null +++ b/queue-6.1/drm-msm-a2xx-call-adreno_gpu_init-earlier.patch @@ -0,0 +1,58 @@ +From 446392e2d5bdb8ccea2db0293ca68bbf3894ca0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 20:23:19 -0300 +Subject: drm/msm/a2xx: Call adreno_gpu_init() earlier + +From: Fabio Estevam + +[ Upstream commit db07ce5da8b26bfeaf437a676ae49bd3bb1eace6 ] + +The adreno_is_a20x() and adreno_is_a225() functions rely on the +GPU revision, but such information is retrieved inside adreno_gpu_init(), +which is called afterwards. + +Fix this problem by caling adreno_gpu_init() earlier, so that +the GPU information revision is available when adreno_is_a20x() +and adreno_is_a225() run. + +Tested on a imx53-qsb board. + +Fixes: 21af872cd8c6 ("drm/msm/adreno: add a2xx") +Signed-off-by: Fabio Estevam +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/543456/ +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a2xx_gpu.c b/drivers/gpu/drm/msm/adreno/a2xx_gpu.c +index 6c9a747eb4ad5..2428d6ac5fe96 100644 +--- a/drivers/gpu/drm/msm/adreno/a2xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a2xx_gpu.c +@@ -521,6 +521,10 @@ struct msm_gpu *a2xx_gpu_init(struct drm_device *dev) + gpu->perfcntrs = perfcntrs; + gpu->num_perfcntrs = ARRAY_SIZE(perfcntrs); + ++ ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1); ++ if (ret) ++ goto fail; ++ + if (adreno_is_a20x(adreno_gpu)) + adreno_gpu->registers = a200_registers; + else if (adreno_is_a225(adreno_gpu)) +@@ -528,10 +532,6 @@ struct msm_gpu *a2xx_gpu_init(struct drm_device *dev) + else + adreno_gpu->registers = a220_registers; + +- ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1); +- if (ret) +- goto fail; +- + if (!gpu->aspace) { + dev_err(dev->dev, "No memory protection without MMU\n"); + if (!allow_vram_carveout) { +-- +2.40.1 + diff --git a/queue-6.1/drm-msm-dpu-fix-the-irq-index-in-dpu_encoder_phys_wb.patch b/queue-6.1/drm-msm-dpu-fix-the-irq-index-in-dpu_encoder_phys_wb.patch new file mode 100644 index 00000000000..cd09cace5e7 --- /dev/null +++ b/queue-6.1/drm-msm-dpu-fix-the-irq-index-in-dpu_encoder_phys_wb.patch @@ -0,0 +1,43 @@ +From 6b4b218dd6e0dd258379f3d2425d18708a17bfd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Aug 2023 13:04:19 +0300 +Subject: drm/msm/dpu: fix the irq index in + dpu_encoder_phys_wb_wait_for_commit_done + +From: Dmitry Baryshkov + +[ Upstream commit d93cf453f51da168f4410ba73656f1e862096973 ] + +Since commit 1e7ac595fa46 ("drm/msm/dpu: pass irq to +dpu_encoder_helper_wait_for_irq()") the +dpu_encoder_phys_wb_wait_for_commit_done expects the IRQ index rather +than the IRQ index in phys_enc->intr table, however writeback got the +older invocation in place. This was unnoticed for several releases, but +now it's time to fix it. + +Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback") +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/550924/ +Link: https://lore.kernel.org/r/20230802100426.4184892-2-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +index 62f6ff6abf410..42c7e378d504d 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +@@ -460,7 +460,8 @@ static int dpu_encoder_phys_wb_wait_for_commit_done( + wait_info.atomic_cnt = &phys_enc->pending_kickoff_cnt; + wait_info.timeout_ms = KICKOFF_TIMEOUT_MS; + +- ret = dpu_encoder_helper_wait_for_irq(phys_enc, INTR_IDX_WB_DONE, ++ ret = dpu_encoder_helper_wait_for_irq(phys_enc, ++ phys_enc->irq[INTR_IDX_WB_DONE], + dpu_encoder_phys_wb_done_irq, &wait_info); + if (ret == -ETIMEDOUT) + _dpu_encoder_phys_wb_handle_wbdone_timeout(phys_enc); +-- +2.40.1 + diff --git a/queue-6.1/drm-msm-mdp5-don-t-leak-some-plane-state.patch b/queue-6.1/drm-msm-mdp5-don-t-leak-some-plane-state.patch new file mode 100644 index 00000000000..02d835b4152 --- /dev/null +++ b/queue-6.1/drm-msm-mdp5-don-t-leak-some-plane-state.patch @@ -0,0 +1,55 @@ +From 2b61af4dd73ab9c225d893cf0540abfe266a8a1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 22:45:21 +0200 +Subject: drm/msm/mdp5: Don't leak some plane state + +From: Daniel Vetter + +[ Upstream commit fd0ad3b2365c1c58aa5a761c18efc4817193beb6 ] + +Apparently no one noticed that mdp5 plane states leak like a sieve +ever since we introduced plane_state->commit refcount a few years ago +in 21a01abbe32a ("drm/atomic: Fix freeing connector/plane state too +early by tracking commits, v3.") + +Fix it by using the right helpers. + +Fixes: 21a01abbe32a ("drm/atomic: Fix freeing connector/plane state too early by tracking commits, v3.") +Cc: Maarten Lankhorst +Cc: Daniel Vetter +Cc: Rob Clark +Cc: Abhinav Kumar +Cc: Dmitry Baryshkov +Cc: linux-arm-msm@vger.kernel.org +Cc: freedreno@lists.freedesktop.org +Reported-and-tested-by: dorum@noisolation.com +Cc: dorum@noisolation.com +Signed-off-by: Daniel Vetter +Reviewed-by: Rob Clark +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/551236/ +Link: https://lore.kernel.org/r/20230803204521.928582-1-daniel.vetter@ffwll.ch +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +index bd2c4ac456017..0d5ff03cb0910 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +@@ -130,8 +130,7 @@ static void mdp5_plane_destroy_state(struct drm_plane *plane, + { + struct mdp5_plane_state *pstate = to_mdp5_plane_state(state); + +- if (state->fb) +- drm_framebuffer_put(state->fb); ++ __drm_atomic_helper_plane_destroy_state(state); + + kfree(pstate); + } +-- +2.40.1 + diff --git a/queue-6.1/drm-msm-update-dev-core-dump-to-not-print-backwards.patch b/queue-6.1/drm-msm-update-dev-core-dump-to-not-print-backwards.patch new file mode 100644 index 00000000000..22035464def --- /dev/null +++ b/queue-6.1/drm-msm-update-dev-core-dump-to-not-print-backwards.patch @@ -0,0 +1,40 @@ +From 089676510ca1a7389bb5f74e9a0db7d7be95177f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 18:24:40 -0700 +Subject: drm/msm: Update dev core dump to not print backwards + +From: Ryan McCann + +[ Upstream commit 903705111d863ed8ccf73465da77d232fc422ec1 ] + +Device core dump add block method adds hardware blocks to dumping queue +with stack behavior which causes the hardware blocks to be printed in +reverse order. Change the addition to dumping queue data structure +from "list_add" to "list_add_tail" for FIFO queue behavior. + +Fixes: 98659487b845 ("drm/msm: add support to take dpu snapshot") +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Signed-off-by: Ryan McCann +Patchwork: https://patchwork.freedesktop.org/patch/546200/ +Link: https://lore.kernel.org/r/20230622-devcoredump_patch-v5-1-67e8b66c4723@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c +index acfe1b31e0792..add72bbc28b17 100644 +--- a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c ++++ b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c +@@ -192,5 +192,5 @@ void msm_disp_snapshot_add_block(struct msm_disp_state *disp_state, u32 len, + new_blk->base_addr = base_addr; + + msm_disp_state_dump_regs(&new_blk->state, new_blk->size, base_addr); +- list_add(&new_blk->node, &disp_state->blocks); ++ list_add_tail(&new_blk->node, &disp_state->blocks); + } +-- +2.40.1 + diff --git a/queue-6.1/drm-panel-simple-add-missing-connector-type-and-pixe.patch b/queue-6.1/drm-panel-simple-add-missing-connector-type-and-pixe.patch new file mode 100644 index 00000000000..3b7f2dbadf3 --- /dev/null +++ b/queue-6.1/drm-panel-simple-add-missing-connector-type-and-pixe.patch @@ -0,0 +1,41 @@ +From 0cd007584a6528cef97264c3b538d2b989f8e705 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jul 2023 15:49:14 +0200 +Subject: drm/panel: simple: Add missing connector type and pixel format for + AUO T215HVN01 + +From: Marek Vasut + +[ Upstream commit 7a675a8fa598edb29a664a91adb80f0340649f6f ] + +The connector type and pixel format are missing for this panel, +add them to prevent various drivers from failing to determine +either of those parameters. + +Fixes: 7ee933a1d5c4 ("drm/panel: simple: Add support for AUO T215HVN01") +Signed-off-by: Marek Vasut +Reviewed-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20230709134914.449328-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 5e067ba7e5fba..0e8622ccd3a0f 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -1159,7 +1159,9 @@ static const struct panel_desc auo_t215hvn01 = { + .delay = { + .disable = 5, + .unprepare = 1000, +- } ++ }, ++ .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, ++ .connector_type = DRM_MODE_CONNECTOR_LVDS, + }; + + static const struct drm_display_mode avic_tm070ddh03_mode = { +-- +2.40.1 + diff --git a/queue-6.1/drm-radeon-use-rmw-accessors-for-changing-lnkctl.patch b/queue-6.1/drm-radeon-use-rmw-accessors-for-changing-lnkctl.patch new file mode 100644 index 00000000000..3fd1fb90a4a --- /dev/null +++ b/queue-6.1/drm-radeon-use-rmw-accessors-for-changing-lnkctl.patch @@ -0,0 +1,145 @@ +From 904781aca0b53e241134e89bd54f4af9fe6dda51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:04:58 +0300 +Subject: drm/radeon: Use RMW accessors for changing LNKCTL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 7189576e8a829130192b33c5b64e8a475369c776 ] + +Don't assume that only the driver would be accessing LNKCTL. ASPM policy +changes can trigger write to LNKCTL outside of driver's control. And in +the case of upstream bridge, the driver does not even own the device it's +changing the registers for. + +Use RMW capability accessors which do proper locking to avoid losing +concurrent updates to the register value. + +Suggested-by: Lukas Wunner +Fixes: 8a7cd27679d0 ("drm/radeon/cik: add support for pcie gen1/2/3 switching") +Fixes: b9d305dfb66c ("drm/radeon: implement pcie gen2/3 support for SI") +Link: https://lore.kernel.org/r/20230717120503.15276-7-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Acked-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/cik.c | 36 ++++++++++------------------------- + drivers/gpu/drm/radeon/si.c | 37 ++++++++++-------------------------- + 2 files changed, 20 insertions(+), 53 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index 5819737c21c67..a6f3c811ceb8e 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -9534,17 +9534,8 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &bridge_cfg); +- pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL, +- &gpu_cfg); +- +- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16); +- +- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_set_word(rdev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); + + tmp = RREG32_PCIE_PORT(PCIE_LC_STATUS1); + max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT; +@@ -9591,21 +9582,14 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + msleep(100); + + /* linkctl */ +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, +- tmp16); +- +- pcie_capability_read_word(rdev->pdev, +- PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(rdev->pdev, +- PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ bridge_cfg & ++ PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_clear_and_set_word(rdev->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ gpu_cfg & ++ PCI_EXP_LNKCTL_HAWD); + + /* linkctl2 */ + pcie_capability_read_word(root, PCI_EXP_LNKCTL2, +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index 8d5e4b25609d5..a91012447b56e 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -7131,17 +7131,8 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &bridge_cfg); +- pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL, +- &gpu_cfg); +- +- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16); +- +- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_set_word(rdev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); + + tmp = RREG32_PCIE(PCIE_LC_STATUS1); + max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT; +@@ -7188,22 +7179,14 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + msleep(100); + + /* linkctl */ +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(root, +- PCI_EXP_LNKCTL, +- tmp16); +- +- pcie_capability_read_word(rdev->pdev, +- PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(rdev->pdev, +- PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ bridge_cfg & ++ PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_clear_and_set_word(rdev->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ gpu_cfg & ++ PCI_EXP_LNKCTL_HAWD); + + /* linkctl2 */ + pcie_capability_read_word(root, PCI_EXP_LNKCTL2, +-- +2.40.1 + diff --git a/queue-6.1/drm-repaper-reduce-temporary-buffer-size-in-repaper_.patch b/queue-6.1/drm-repaper-reduce-temporary-buffer-size-in-repaper_.patch new file mode 100644 index 00000000000..4dbe1f3b1bf --- /dev/null +++ b/queue-6.1/drm-repaper-reduce-temporary-buffer-size-in-repaper_.patch @@ -0,0 +1,39 @@ +From ea21440c33b801d3e4aeea388badd1edd3f4dcc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 09:18:30 +0100 +Subject: drm/repaper: Reduce temporary buffer size in repaper_fb_dirty() + +From: Geert Uytterhoeven + +[ Upstream commit fedf429e071f6dbbe7a69dfc342492e037692018 ] + +As the temporary buffer is no longer used to store 8-bit grayscale data, +its size can be reduced to the size needed to store the monochrome +bitmap data. + +Fixes: 24c6bedefbe71de9 ("drm/repaper: Use format helper for xrgb8888 to monochrome conversion") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Javier Martinez Canillas +Signed-off-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20220317081830.1211400-6-geert@linux-m68k.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tiny/repaper.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tiny/repaper.c b/drivers/gpu/drm/tiny/repaper.c +index e62f4d16b2c6b..7e2b0e2241358 100644 +--- a/drivers/gpu/drm/tiny/repaper.c ++++ b/drivers/gpu/drm/tiny/repaper.c +@@ -533,7 +533,7 @@ static int repaper_fb_dirty(struct drm_framebuffer *fb) + DRM_DEBUG("Flushing [FB:%d] st=%ums\n", fb->base.id, + epd->factored_stage_time); + +- buf = kmalloc_array(fb->width, fb->height, GFP_KERNEL); ++ buf = kmalloc(fb->width * fb->height / 8, GFP_KERNEL); + if (!buf) { + ret = -ENOMEM; + goto out_exit; +-- +2.40.1 + diff --git a/queue-6.1/drm-tegra-dpaux-fix-incorrect-return-value-of-platfo.patch b/queue-6.1/drm-tegra-dpaux-fix-incorrect-return-value-of-platfo.patch new file mode 100644 index 00000000000..69f4844a27a --- /dev/null +++ b/queue-6.1/drm-tegra-dpaux-fix-incorrect-return-value-of-platfo.patch @@ -0,0 +1,37 @@ +From f418b36c552062506954d610d38f5adc0a22ffaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jul 2023 11:23:49 +0800 +Subject: drm/tegra: dpaux: Fix incorrect return value of platform_get_irq + +From: Yangtao Li + +[ Upstream commit 2a1ca44b654346cadfc538c4fb32eecd8daf3140 ] + +When platform_get_irq fails, we should return dpaux->irq +instead of -ENXIO. + +Fixes: 6b6b604215c6 ("drm/tegra: Add eDP support") +Signed-off-by: Yangtao Li +Signed-off-by: Thierry Reding +Link: https://patchwork.freedesktop.org/patch/msgid/20230710032355.72914-13-frank.li@vivo.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/dpaux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c +index 7dc681e2ee90b..d773ef4854188 100644 +--- a/drivers/gpu/drm/tegra/dpaux.c ++++ b/drivers/gpu/drm/tegra/dpaux.c +@@ -468,7 +468,7 @@ static int tegra_dpaux_probe(struct platform_device *pdev) + + dpaux->irq = platform_get_irq(pdev, 0); + if (dpaux->irq < 0) +- return -ENXIO; ++ return dpaux->irq; + + if (!pdev->dev.pm_domain) { + dpaux->rst = devm_reset_control_get(&pdev->dev, "dpaux"); +-- +2.40.1 + diff --git a/queue-6.1/drm-xlnx-zynqmp_dpsub-add-missing-check-for-dma_set_.patch b/queue-6.1/drm-xlnx-zynqmp_dpsub-add-missing-check-for-dma_set_.patch new file mode 100644 index 00000000000..4fb336c2dfa --- /dev/null +++ b/queue-6.1/drm-xlnx-zynqmp_dpsub-add-missing-check-for-dma_set_.patch @@ -0,0 +1,39 @@ +From 0a942626752e830a83851e081295f5a9fcfadaa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jun 2023 10:05:29 +0800 +Subject: drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask + +From: Jiasheng Jiang + +[ Upstream commit 1832fba7f9780aff67c96ad30f397c2d76141833 ] + +Add check for dma_set_mask() and return the error if it fails. + +Fixes: d76271d22694 ("drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Laurent Pinchart +Reviewed-by: Tomi Valkeinen +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c +index 1de2d927c32b0..fcaa958d841c9 100644 +--- a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c ++++ b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c +@@ -201,7 +201,9 @@ static int zynqmp_dpsub_probe(struct platform_device *pdev) + dpsub->dev = &pdev->dev; + platform_set_drvdata(pdev, dpsub); + +- dma_set_mask(dpsub->dev, DMA_BIT_MASK(ZYNQMP_DISP_MAX_DMA_BIT)); ++ ret = dma_set_mask(dpsub->dev, DMA_BIT_MASK(ZYNQMP_DISP_MAX_DMA_BIT)); ++ if (ret) ++ return ret; + + /* Try the reserved memory. Proceed if there's none. */ + of_reserved_mem_device_init(&pdev->dev); +-- +2.40.1 + diff --git a/queue-6.1/dt-bindings-clock-qcom-gcc-sc8280xp-add-missing-gdsc.patch b/queue-6.1/dt-bindings-clock-qcom-gcc-sc8280xp-add-missing-gdsc.patch new file mode 100644 index 00000000000..b18ced38832 --- /dev/null +++ b/queue-6.1/dt-bindings-clock-qcom-gcc-sc8280xp-add-missing-gdsc.patch @@ -0,0 +1,46 @@ +From 330ffc4762cf63875a03529ea0e6b53c8184688b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 19:48:07 +0200 +Subject: dt-bindings: clock: qcom,gcc-sc8280xp: Add missing GDSCs + +From: Konrad Dybcio + +[ Upstream commit 9eba4db02a88e7a810aabd70f7a6960f184f391f ] + +There are 10 more GDSCs that we've not been caring about, and by extension +(and perhaps even more importantly), not putting to sleep. Add them. + +Fixes: a66a82f2a55e ("dt-bindings: clock: Add Qualcomm SC8280XP GCC bindings") +Acked-by: Rob Herring +Signed-off-by: Konrad Dybcio +Acked-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20230620-topic-sc8280_gccgdsc-v2-2-562c1428c10d@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + include/dt-bindings/clock/qcom,gcc-sc8280xp.h | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/include/dt-bindings/clock/qcom,gcc-sc8280xp.h b/include/dt-bindings/clock/qcom,gcc-sc8280xp.h +index 721105ea4fad8..8454915917849 100644 +--- a/include/dt-bindings/clock/qcom,gcc-sc8280xp.h ++++ b/include/dt-bindings/clock/qcom,gcc-sc8280xp.h +@@ -494,5 +494,15 @@ + #define USB30_SEC_GDSC 11 + #define EMAC_0_GDSC 12 + #define EMAC_1_GDSC 13 ++#define USB4_1_GDSC 14 ++#define USB4_GDSC 15 ++#define HLOS1_VOTE_MMNOC_MMU_TBU_HF0_GDSC 16 ++#define HLOS1_VOTE_MMNOC_MMU_TBU_HF1_GDSC 17 ++#define HLOS1_VOTE_MMNOC_MMU_TBU_SF0_GDSC 18 ++#define HLOS1_VOTE_MMNOC_MMU_TBU_SF1_GDSC 19 ++#define HLOS1_VOTE_TURING_MMU_TBU0_GDSC 20 ++#define HLOS1_VOTE_TURING_MMU_TBU1_GDSC 21 ++#define HLOS1_VOTE_TURING_MMU_TBU2_GDSC 22 ++#define HLOS1_VOTE_TURING_MMU_TBU3_GDSC 23 + + #endif +-- +2.40.1 + diff --git a/queue-6.1/dt-bindings-extcon-maxim-max77843-restrict-connector.patch b/queue-6.1/dt-bindings-extcon-maxim-max77843-restrict-connector.patch new file mode 100644 index 00000000000..988b63ae450 --- /dev/null +++ b/queue-6.1/dt-bindings-extcon-maxim-max77843-restrict-connector.patch @@ -0,0 +1,35 @@ +From 4665cecee48ff1abd116e60d264626c2eceb685d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 10:01:40 +0200 +Subject: dt-bindings: extcon: maxim,max77843: restrict connector properties + +From: Krzysztof Kozlowski + +[ Upstream commit fb2c3f72e819254d8c76de95917e5f9ff232586c ] + +Do not allow any other properties in connector child, except what +usb-connector.yaml evaluates. + +Fixes: 9729cad0278b ("dt-bindings: extcon: maxim,max77843: Add MAX77843 bindings") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/extcon/maxim,max77843.yaml | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Documentation/devicetree/bindings/extcon/maxim,max77843.yaml b/Documentation/devicetree/bindings/extcon/maxim,max77843.yaml +index 1289605456408..55800fb0221d0 100644 +--- a/Documentation/devicetree/bindings/extcon/maxim,max77843.yaml ++++ b/Documentation/devicetree/bindings/extcon/maxim,max77843.yaml +@@ -23,6 +23,7 @@ properties: + + connector: + $ref: /schemas/connector/usb-connector.yaml# ++ unevaluatedProperties: false + + ports: + $ref: /schemas/graph.yaml#/properties/ports +-- +2.40.1 + diff --git a/queue-6.1/edac-igen6-fix-the-issue-of-no-error-events.patch b/queue-6.1/edac-igen6-fix-the-issue-of-no-error-events.patch new file mode 100644 index 00000000000..ae220d7e63b --- /dev/null +++ b/queue-6.1/edac-igen6-fix-the-issue-of-no-error-events.patch @@ -0,0 +1,65 @@ +From 174828f0a8e4864ae1c4c012765f02f020023038 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 16:04:27 +0800 +Subject: EDAC/igen6: Fix the issue of no error events + +From: Qiuxu Zhuo + +[ Upstream commit ce53ad81ed36c24aff075f94474adecfabfcf239 ] + +Current igen6_edac checks for pending errors before the registration +of the error handler. However, there is a possibility that the error +occurs during the registration process, leading to unhandled pending +errors and no future error events. This issue can be reproduced by +repeatedly injecting errors during the loading of the igen6_edac. + +Fix this issue by moving the pending error handler after the registration +of the error handler, ensuring that no pending errors are left unhandled. + +Fixes: 10590a9d4f23 ("EDAC/igen6: Add EDAC driver for Intel client SoCs using IBECC") +Reported-by: Ee Wey Lim +Tested-by: Ee Wey Lim +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/r/20230725080427.23883-1-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/igen6_edac.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c +index a07bbfd075d06..8ec70da8d84fe 100644 +--- a/drivers/edac/igen6_edac.c ++++ b/drivers/edac/igen6_edac.c +@@ -27,7 +27,7 @@ + #include "edac_mc.h" + #include "edac_module.h" + +-#define IGEN6_REVISION "v2.5" ++#define IGEN6_REVISION "v2.5.1" + + #define EDAC_MOD_STR "igen6_edac" + #define IGEN6_NMI_NAME "igen6_ibecc" +@@ -1216,9 +1216,6 @@ static int igen6_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + INIT_WORK(&ecclog_work, ecclog_work_cb); + init_irq_work(&ecclog_irq_work, ecclog_irq_work_cb); + +- /* Check if any pending errors before registering the NMI handler */ +- ecclog_handler(); +- + rc = register_err_handler(); + if (rc) + goto fail3; +@@ -1230,6 +1227,9 @@ static int igen6_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + goto fail4; + } + ++ /* Check if any pending errors before/during the registration of the error handler */ ++ ecclog_handler(); ++ + igen6_debug_setup(); + return 0; + fail4: +-- +2.40.1 + diff --git a/queue-6.1/eventfd-prevent-underflow-for-eventfd-semaphores.patch b/queue-6.1/eventfd-prevent-underflow-for-eventfd-semaphores.patch new file mode 100644 index 00000000000..275ef0d4440 --- /dev/null +++ b/queue-6.1/eventfd-prevent-underflow-for-eventfd-semaphores.patch @@ -0,0 +1,76 @@ +From 605c5b56bae644f8df2258113e3ed39dd11be2d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jul 2023 14:54:51 +0800 +Subject: eventfd: prevent underflow for eventfd semaphores + +From: Wen Yang + +[ Upstream commit 758b492047816a3158d027e9fca660bc5bcf20bf ] + +For eventfd with flag EFD_SEMAPHORE, when its ctx->count is 0, calling +eventfd_ctx_do_read will cause ctx->count to overflow to ULLONG_MAX. + +An underflow can happen with EFD_SEMAPHORE eventfds in at least the +following three subsystems: + +(1) virt/kvm/eventfd.c +(2) drivers/vfio/virqfd.c +(3) drivers/virt/acrn/irqfd.c + +where (2) and (3) are just modeled after (1). An eventfd must be +specified for use with the KVM_IRQFD ioctl(). This can also be an +EFD_SEMAPHORE eventfd. When the eventfd count is zero or has been +decremented to zero an underflow can be triggered when the irqfd is shut +down by raising the KVM_IRQFD_FLAG_DEASSIGN flag in the KVM_IRQFD +ioctl(): + + // ctx->count == 0 + kvm_vm_ioctl() + -> kvm_irqfd() + -> kvm_irqfd_deassign() + -> irqfd_deactivate() + -> irqfd_shutdown() + -> eventfd_ctx_remove_wait_queue(&cnt) + -> eventfd_ctx_do_read(&cnt) + +Userspace polling on the eventfd wouldn't notice the underflow because 1 +is always returned as the value from eventfd_read() while ctx->count +would've underflowed. It's not a huge deal because this should only be +happening when the irqfd is shutdown but we should still fix it and +avoid the spurious wakeup. + +Fixes: cb289d6244a3 ("eventfd - allow atomic read and waitqueue remove") +Signed-off-by: Wen Yang +Cc: Alexander Viro +Cc: Jens Axboe +Cc: Christian Brauner +Cc: Christoph Hellwig +Cc: Dylan Yudaken +Cc: David Woodhouse +Cc: Matthew Wilcox +Cc: linux-fsdevel@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Message-Id: +[brauner: rewrite commit message and add explanation how this underflow can happen] +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/eventfd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/eventfd.c b/fs/eventfd.c +index 249ca6c0b7843..4a60ea932e3d9 100644 +--- a/fs/eventfd.c ++++ b/fs/eventfd.c +@@ -189,7 +189,7 @@ void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt) + { + lockdep_assert_held(&ctx->wqh.lock); + +- *cnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count; ++ *cnt = ((ctx->flags & EFD_SEMAPHORE) && ctx->count) ? 1 : ctx->count; + ctx->count -= *cnt; + } + EXPORT_SYMBOL_GPL(eventfd_ctx_do_read); +-- +2.40.1 + diff --git a/queue-6.1/ext4-avoid-potential-data-overflow-in-next_linear_gr.patch b/queue-6.1/ext4-avoid-potential-data-overflow-in-next_linear_gr.patch new file mode 100644 index 00000000000..cbe67e32e5d --- /dev/null +++ b/queue-6.1/ext4-avoid-potential-data-overflow-in-next_linear_gr.patch @@ -0,0 +1,44 @@ +From b8289436523f5e2c96d4ba233e5b03fcbd4c98d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Aug 2023 22:31:56 +0800 +Subject: ext4: avoid potential data overflow in next_linear_group + +From: Kemeng Shi + +[ Upstream commit 60c672b7f2d1e5dd1774f2399b355c9314e709f8 ] + +ngroups is ext4_group_t (unsigned int) while next_linear_group treat it +in int. If ngroups is bigger than max number described by int, it will +be treat as a negative number. Then "return group + 1 >= ngroups ? 0 : +group + 1;" may keep returning 0. +Switch int to ext4_group_t in next_linear_group to fix the overflow. + +Fixes: 196e402adf2e ("ext4: improve cr 0 / cr 1 group scanning") +Signed-off-by: Kemeng Shi +Reviewed-by: Ritesh Harjani (IBM) +Link: https://lore.kernel.org/r/20230801143204.2284343-3-shikemeng@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 20d02cc0a17aa..016925b1a0908 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -966,8 +966,9 @@ static inline int should_optimize_scan(struct ext4_allocation_context *ac) + * Return next linear group for allocation. If linear traversal should not be + * performed, this function just returns the same group + */ +-static int +-next_linear_group(struct ext4_allocation_context *ac, int group, int ngroups) ++static ext4_group_t ++next_linear_group(struct ext4_allocation_context *ac, ext4_group_t group, ++ ext4_group_t ngroups) + { + if (!should_optimize_scan(ac)) + goto inc_and_return; +-- +2.40.1 + diff --git a/queue-6.1/ext4-correct-grp-validation-in-ext4_mb_good_group.patch b/queue-6.1/ext4-correct-grp-validation-in-ext4_mb_good_group.patch new file mode 100644 index 00000000000..2b9360bd4bd --- /dev/null +++ b/queue-6.1/ext4-correct-grp-validation-in-ext4_mb_good_group.patch @@ -0,0 +1,38 @@ +From 742529a4c2a01e6f4d1c00ceb4aed99f1000c936 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Aug 2023 22:31:55 +0800 +Subject: ext4: correct grp validation in ext4_mb_good_group + +From: Kemeng Shi + +[ Upstream commit a9ce5993a0f5c0887c8a1b4ffa3b8046fbcfdc93 ] + +Group corruption check will access memory of grp and will trigger kernel +crash if grp is NULL. So do NULL check before corruption check. + +Fixes: 5354b2af3406 ("ext4: allow ext4_get_group_info() to fail") +Signed-off-by: Kemeng Shi +Reviewed-by: Ritesh Harjani (IBM) +Link: https://lore.kernel.org/r/20230801143204.2284343-2-shikemeng@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 88ed64ebae3e7..20d02cc0a17aa 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -2401,7 +2401,7 @@ static bool ext4_mb_good_group(struct ext4_allocation_context *ac, + + BUG_ON(cr < 0 || cr >= 4); + +- if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(grp) || !grp)) ++ if (unlikely(!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp))) + return false; + + free = grp->bb_free; +-- +2.40.1 + diff --git a/queue-6.1/ext4-fix-unttached-inode-after-power-cut-with-orphan.patch b/queue-6.1/ext4-fix-unttached-inode-after-power-cut-with-orphan.patch new file mode 100644 index 00000000000..822f2987ed8 --- /dev/null +++ b/queue-6.1/ext4-fix-unttached-inode-after-power-cut-with-orphan.patch @@ -0,0 +1,91 @@ +From eea3beba9c00a7dc759ced470dcad91b94b667cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 21:20:11 +0800 +Subject: ext4: fix unttached inode after power cut with orphan file feature + enabled + +From: Zhihao Cheng + +[ Upstream commit 1524773425ae8113b0b782886366e68656b34e53 ] + +Running generic/475(filesystem consistent tests after power cut) could +easily trigger unattached inode error while doing fsck: + Unattached zero-length inode 39405. Clear? no + + Unattached inode 39405 + Connect to /lost+found? no + +Above inconsistence is caused by following process: + P1 P2 +ext4_create + inode = ext4_new_inode_start_handle // itable records nlink=1 + ext4_add_nondir + err = ext4_add_entry // ENOSPC + ext4_append + ext4_bread + ext4_getblk + ext4_map_blocks // returns ENOSPC + drop_nlink(inode) // won't be updated into disk inode + ext4_orphan_add(handle, inode) + ext4_orphan_file_add + ext4_journal_stop(handle) + jbd2_journal_commit_transaction // commit success + >> power cut << +ext4_fill_super + ext4_load_and_init_journal // itable records nlink=1 + ext4_orphan_cleanup + ext4_process_orphan + if (inode->i_nlink) // true, inode won't be deleted + +Then, allocated inode will be reserved on disk and corresponds to no +dentries, so e2fsck reports 'unattached inode' problem. + +The problem won't happen if orphan file feature is disabled, because +ext4_orphan_add() will update disk inode in orphan list mode. There +are several places not updating disk inode while putting inode into +orphan area, such as ext4_add_nondir(), ext4_symlink() and whiteout +in ext4_rename(). Fix it by updating inode into disk in all error +branches of these places. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217605 +Fixes: 02f310fcf47f ("ext4: Speedup ext4 orphan inode handling") +Signed-off-by: Zhihao Cheng +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230628132011.650383-1-chengzhihao1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/namei.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 0e1aeb9cb4a7c..6a08fc31a66de 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -2799,6 +2799,7 @@ static int ext4_add_nondir(handle_t *handle, + return err; + } + drop_nlink(inode); ++ ext4_mark_inode_dirty(handle, inode); + ext4_orphan_add(handle, inode); + unlock_new_inode(inode); + return err; +@@ -3436,6 +3437,7 @@ static int ext4_symlink(struct user_namespace *mnt_userns, struct inode *dir, + + err_drop_inode: + clear_nlink(inode); ++ ext4_mark_inode_dirty(handle, inode); + ext4_orphan_add(handle, inode); + unlock_new_inode(inode); + if (handle) +@@ -4021,6 +4023,7 @@ static int ext4_rename(struct user_namespace *mnt_userns, struct inode *old_dir, + ext4_resetent(handle, &old, + old.inode->i_ino, old_file_type); + drop_nlink(whiteout); ++ ext4_mark_inode_dirty(handle, whiteout); + ext4_orphan_add(handle, whiteout); + } + unlock_new_inode(whiteout); +-- +2.40.1 + diff --git a/queue-6.1/extcon-cht_wc-add-power_supply-dependency.patch b/queue-6.1/extcon-cht_wc-add-power_supply-dependency.patch new file mode 100644 index 00000000000..3a0551762fd --- /dev/null +++ b/queue-6.1/extcon-cht_wc-add-power_supply-dependency.patch @@ -0,0 +1,47 @@ +From d43117a9c00487702aa28029909324d354a0eb09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 15:28:49 +0200 +Subject: extcon: cht_wc: add POWER_SUPPLY dependency + +From: Arnd Bergmann + +[ Upstream commit d20a3a8a32e3fa564ff25da860c5fc1a97642dfe ] + +The driver fails to link when CONFIG_POWER_SUPPLY is disabled: + +x86_64-linux-ld: vmlinux.o: in function `cht_wc_extcon_psy_get_prop': +extcon-intel-cht-wc.c:(.text+0x15ccda7): undefined reference to `power_supply_get_drvdata' +x86_64-linux-ld: vmlinux.o: in function `cht_wc_extcon_pwrsrc_event': +extcon-intel-cht-wc.c:(.text+0x15cd3e9): undefined reference to `power_supply_changed' +x86_64-linux-ld: vmlinux.o: in function `cht_wc_extcon_probe': +extcon-intel-cht-wc.c:(.text+0x15cd596): undefined reference to `devm_power_supply_register' + +It should be possible to change the driver to not require this at +compile time and still provide other functions, but adding a hard +Kconfig dependency does not seem to have any practical downsides +and is simpler since the option is normally enabled anyway. + +Fixes: 66e31186cd2aa ("extcon: intel-cht-wc: Add support for registering a power_supply class-device") +Signed-off-by: Arnd Bergmann +Reviewed-by: Hans de Goede +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/extcon/Kconfig b/drivers/extcon/Kconfig +index 290186e44e6bd..4dd52a6a5b48d 100644 +--- a/drivers/extcon/Kconfig ++++ b/drivers/extcon/Kconfig +@@ -62,6 +62,7 @@ config EXTCON_INTEL_CHT_WC + tristate "Intel Cherrytrail Whiskey Cove PMIC extcon driver" + depends on INTEL_SOC_PMIC_CHTWC + depends on USB_SUPPORT ++ depends on POWER_SUPPLY + select USB_ROLE_SWITCH + help + Say Y here to enable extcon support for charger detection / control +-- +2.40.1 + diff --git a/queue-6.1/f2fs-fix-to-avoid-mmap-vs-set_compress_option-case.patch b/queue-6.1/f2fs-fix-to-avoid-mmap-vs-set_compress_option-case.patch new file mode 100644 index 00000000000..fbbc537ee9c --- /dev/null +++ b/queue-6.1/f2fs-fix-to-avoid-mmap-vs-set_compress_option-case.patch @@ -0,0 +1,115 @@ +From b4dadc893808370735633bebd5caafb84d6a2c7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 10:06:14 +0800 +Subject: f2fs: fix to avoid mmap vs set_compress_option case + +From: Chao Yu + +[ Upstream commit b5ab3276eb69cacf44ecfb11b2bfab73096ff4e4 ] + +Compression option in inode should not be changed after they have +been used, however, it may happen in below race case: + +Thread A Thread B +- f2fs_ioc_set_compress_option + - check f2fs_is_mmap_file() + - check get_dirty_pages() + - check F2FS_HAS_BLOCKS() + - f2fs_file_mmap + - set_inode_flag(FI_MMAP_FILE) + - fault + - do_page_mkwrite + - f2fs_vm_page_mkwrite + - f2fs_get_block_locked + - fault_dirty_shared_page + - set_page_dirty + - update i_compress_algorithm + - update i_log_cluster_size + - update i_cluster_size + +Avoid such race condition by covering f2fs_file_mmap() w/ i_sem lock, +meanwhile add mmap file check condition in f2fs_may_compress() as well. + +Fixes: e1e8debec656 ("f2fs: add F2FS_IOC_SET_COMPRESS_OPTION ioctl") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 3 ++- + fs/f2fs/file.c | 23 ++++++++++++++++++----- + 2 files changed, 20 insertions(+), 6 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 4d1e48c676fab..c2b7d09238941 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -4453,7 +4453,8 @@ static inline bool f2fs_low_mem_mode(struct f2fs_sb_info *sbi) + static inline bool f2fs_may_compress(struct inode *inode) + { + if (IS_SWAPFILE(inode) || f2fs_is_pinned_file(inode) || +- f2fs_is_atomic_file(inode) || f2fs_has_inline_data(inode)) ++ f2fs_is_atomic_file(inode) || f2fs_has_inline_data(inode) || ++ f2fs_is_mmap_file(inode)) + return false; + return S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode); + } +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 7b94f047cbf79..746c71716bead 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -530,7 +530,11 @@ static int f2fs_file_mmap(struct file *file, struct vm_area_struct *vma) + + file_accessed(file); + vma->vm_ops = &f2fs_file_vm_ops; ++ ++ f2fs_down_read(&F2FS_I(inode)->i_sem); + set_inode_flag(inode, FI_MMAP_FILE); ++ f2fs_up_read(&F2FS_I(inode)->i_sem); ++ + return 0; + } + +@@ -1927,12 +1931,19 @@ static int f2fs_setflags_common(struct inode *inode, u32 iflags, u32 mask) + int err = f2fs_convert_inline_inode(inode); + if (err) + return err; +- if (!f2fs_may_compress(inode)) +- return -EINVAL; +- if (S_ISREG(inode->i_mode) && F2FS_HAS_BLOCKS(inode)) ++ ++ f2fs_down_write(&F2FS_I(inode)->i_sem); ++ if (!f2fs_may_compress(inode) || ++ (S_ISREG(inode->i_mode) && ++ F2FS_HAS_BLOCKS(inode))) { ++ f2fs_up_write(&F2FS_I(inode)->i_sem); + return -EINVAL; +- if (set_compress_context(inode)) +- return -EOPNOTSUPP; ++ } ++ err = set_compress_context(inode); ++ f2fs_up_write(&F2FS_I(inode)->i_sem); ++ ++ if (err) ++ return err; + } + } + +@@ -3958,6 +3969,7 @@ static int f2fs_ioc_set_compress_option(struct file *filp, unsigned long arg) + file_start_write(filp); + inode_lock(inode); + ++ f2fs_down_write(&F2FS_I(inode)->i_sem); + if (f2fs_is_mmap_file(inode) || get_dirty_pages(inode)) { + ret = -EBUSY; + goto out; +@@ -3977,6 +3989,7 @@ static int f2fs_ioc_set_compress_option(struct file *filp, unsigned long arg) + f2fs_warn(sbi, "compression algorithm is successfully set, " + "but current kernel doesn't support this algorithm."); + out: ++ f2fs_up_write(&F2FS_I(inode)->i_sem); + inode_unlock(inode); + file_end_write(filp); + +-- +2.40.1 + diff --git a/queue-6.1/f2fs-judge-whether-discard_unit-is-section-only-when.patch b/queue-6.1/f2fs-judge-whether-discard_unit-is-section-only-when.patch new file mode 100644 index 00000000000..8027fe25fdc --- /dev/null +++ b/queue-6.1/f2fs-judge-whether-discard_unit-is-section-only-when.patch @@ -0,0 +1,62 @@ +From 31bd94b1d8a80f36af4ede2f6f0f2ff6f5ec617a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Nov 2022 20:29:28 +0800 +Subject: f2fs: judge whether discard_unit is section only when have + CONFIG_BLK_DEV_ZONED + +From: Yangtao Li + +[ Upstream commit b5a711acab305e04278c136c841ba37c589c16a1 ] + +The current logic, regardless of whether CONFIG_BLK_DEV_ZONED +is enabled or not, will judge whether discard_unit is SECTION, +when f2fs_sb_has_blkzoned. + +In fact, when CONFIG_BLK_DEV_ZONED is not enabled, this judgment +is a path that will never be accessed. At this time, -EINVAL will +be returned in the parse_options function, accompanied by the +message "Zoned block device support is not enabled". + +Let's wrap this discard_unit judgment with CONFIG_BLK_DEV_ZONED. + +Signed-off-by: Yangtao Li +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Stable-dep-of: 2bd4df8fcbc7 ("f2fs: Only lfs mode is allowed with zoned block device feature") +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index b6dad389fa144..d616ce3826e7a 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1285,19 +1285,18 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount) + * zone alignment optimization. This is optional for host-aware + * devices, but mandatory for host-managed zoned block devices. + */ +-#ifndef CONFIG_BLK_DEV_ZONED +- if (f2fs_sb_has_blkzoned(sbi)) { +- f2fs_err(sbi, "Zoned block device support is not enabled"); +- return -EINVAL; +- } +-#endif + if (f2fs_sb_has_blkzoned(sbi)) { ++#ifdef CONFIG_BLK_DEV_ZONED + if (F2FS_OPTION(sbi).discard_unit != + DISCARD_UNIT_SECTION) { + f2fs_info(sbi, "Zoned block device doesn't need small discard, set discard_unit=section by default"); + F2FS_OPTION(sbi).discard_unit = + DISCARD_UNIT_SECTION; + } ++#else ++ f2fs_err(sbi, "Zoned block device support is not enabled"); ++ return -EINVAL; ++#endif + } + + #ifdef CONFIG_F2FS_FS_COMPRESSION +-- +2.40.1 + diff --git a/queue-6.1/f2fs-only-lfs-mode-is-allowed-with-zoned-block-devic.patch b/queue-6.1/f2fs-only-lfs-mode-is-allowed-with-zoned-block-devic.patch new file mode 100644 index 00000000000..7ce09894be9 --- /dev/null +++ b/queue-6.1/f2fs-only-lfs-mode-is-allowed-with-zoned-block-devic.patch @@ -0,0 +1,52 @@ +From c27bdfdc6198a915c451a78debf3da7b5a17f7bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 22:28:42 +0800 +Subject: f2fs: Only lfs mode is allowed with zoned block device feature + +From: Chunhai Guo + +[ Upstream commit 2bd4df8fcbc72f58ce3c62ed021ab291ca42de0b ] + +Now f2fs support four block allocation modes: lfs, adaptive, +fragment:segment, fragment:block. Only lfs mode is allowed with zoned block +device feature. + +Fixes: 6691d940b0e0 ("f2fs: introduce fragment allocation mode mount option") +Signed-off-by: Chunhai Guo +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index d616ce3826e7a..2046f633fe57a 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -858,11 +858,6 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount) + if (!name) + return -ENOMEM; + if (!strcmp(name, "adaptive")) { +- if (f2fs_sb_has_blkzoned(sbi)) { +- f2fs_warn(sbi, "adaptive mode is not allowed with zoned block device feature"); +- kfree(name); +- return -EINVAL; +- } + F2FS_OPTION(sbi).fs_mode = FS_MODE_ADAPTIVE; + } else if (!strcmp(name, "lfs")) { + F2FS_OPTION(sbi).fs_mode = FS_MODE_LFS; +@@ -1293,6 +1288,11 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount) + F2FS_OPTION(sbi).discard_unit = + DISCARD_UNIT_SECTION; + } ++ ++ if (F2FS_OPTION(sbi).fs_mode != FS_MODE_LFS) { ++ f2fs_info(sbi, "Only lfs mode is allowed with zoned block device feature"); ++ return -EINVAL; ++ } + #else + f2fs_err(sbi, "Zoned block device support is not enabled"); + return -EINVAL; +-- +2.40.1 + diff --git a/queue-6.1/firmware-cs_dsp-fix-new-control-name-check.patch b/queue-6.1/firmware-cs_dsp-fix-new-control-name-check.patch new file mode 100644 index 00000000000..ef2cbd2593f --- /dev/null +++ b/queue-6.1/firmware-cs_dsp-fix-new-control-name-check.patch @@ -0,0 +1,43 @@ +From 39a191033c6720e21b72dd27d4ccee147d0280fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Aug 2023 12:29:08 -0500 +Subject: firmware: cs_dsp: Fix new control name check + +From: Vlad Karpovich + +[ Upstream commit 7ac1102b227b36550452b663fd39ab1c09378a95 ] + +Before adding a new FW control, its name is checked against +existing controls list. But the string length in strncmp used +to compare controls names is taken from the list, so if beginnings +of the controls are matching, then the new control is not created. +For example, if CAL_R control already exists, CAL_R_SELECTED +is not created. +The fix is to compare string lengths as well. + +Fixes: 6477960755fb ("ASoC: wm_adsp: Move check for control existence") +Signed-off-by: Vlad Karpovich +Link: https://lore.kernel.org/r/20230815172908.3454056-1-vkarpovi@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/firmware/cirrus/cs_dsp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c +index 81cc3d0f6eec1..81c5f94b1be11 100644 +--- a/drivers/firmware/cirrus/cs_dsp.c ++++ b/drivers/firmware/cirrus/cs_dsp.c +@@ -939,7 +939,8 @@ static int cs_dsp_create_control(struct cs_dsp *dsp, + ctl->alg_region.alg == alg_region->alg && + ctl->alg_region.type == alg_region->type) { + if ((!subname && !ctl->subname) || +- (subname && !strncmp(ctl->subname, subname, ctl->subname_len))) { ++ (subname && (ctl->subname_len == subname_len) && ++ !strncmp(ctl->subname, subname, ctl->subname_len))) { + if (!ctl->enabled) + ctl->enabled = 1; + return 0; +-- +2.40.1 + diff --git a/queue-6.1/firmware-meson_sm-fix-to-avoid-potential-null-pointe.patch b/queue-6.1/firmware-meson_sm-fix-to-avoid-potential-null-pointe.patch new file mode 100644 index 00000000000..b44bd28eb5d --- /dev/null +++ b/queue-6.1/firmware-meson_sm-fix-to-avoid-potential-null-pointe.patch @@ -0,0 +1,39 @@ +From d7859c02c38fcecb4cac2fcc0005205d316455d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jul 2023 22:13:38 +0800 +Subject: firmware: meson_sm: fix to avoid potential NULL pointer dereference + +From: Zhang Shurong + +[ Upstream commit f2ed165619c16577c02b703a114a1f6b52026df4 ] + +of_match_device() may fail and returns a NULL pointer. + +Fix this by checking the return value of of_match_device. + +Fixes: 8cde3c2153e8 ("firmware: meson_sm: Rework driver as a proper platform driver") +Signed-off-by: Zhang Shurong +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/tencent_AA08AAA6C4F34D53ADCE962E188A879B8206@qq.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + drivers/firmware/meson/meson_sm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c +index 77aa5c6398aa6..d081a6312627b 100644 +--- a/drivers/firmware/meson/meson_sm.c ++++ b/drivers/firmware/meson/meson_sm.c +@@ -292,6 +292,8 @@ static int __init meson_sm_probe(struct platform_device *pdev) + return -ENOMEM; + + chip = of_match_device(meson_sm_ids, dev)->data; ++ if (!chip) ++ return -EINVAL; + + if (chip->cmd_shmem_in_base) { + fw->sm_shmem_in_base = meson_sm_map_shmem(chip->cmd_shmem_in_base, +-- +2.40.1 + diff --git a/queue-6.1/firmware-ti_sci-use-system_state-to-determine-pollin.patch b/queue-6.1/firmware-ti_sci-use-system_state-to-determine-pollin.patch new file mode 100644 index 00000000000..2e0f5287043 --- /dev/null +++ b/queue-6.1/firmware-ti_sci-use-system_state-to-determine-pollin.patch @@ -0,0 +1,115 @@ +From 13757c065efcf0f53fa5fb080c6e84d349e933e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 08:03:29 -0500 +Subject: firmware: ti_sci: Use system_state to determine polling + +From: Nishanth Menon + +[ Upstream commit 9225bcdedf16297a346082e7d23b0e8434aa98ed ] + +Commit b9e8a7d950ff ("firmware: ti_sci: Switch transport to polled +mode during system suspend") aims to resolve issues with tisci +operations during system suspend operation. However, the system may +enter a no_irq stage in various other usage modes, including power-off +and restart. To determine if polling mode is appropriate, use the +system_state instead. + +While at this, drop the unused is_suspending state variable and +related helpers. + +Fixes: b9e8a7d950ff ("firmware: ti_sci: Switch transport to polled mode during system suspend") +Reported-by: Francesco Dolcini +Reported-by: Wadim Egorov +Tested-by: Francesco Dolcini # Toradex Verdin AM62 +Link: https://lore.kernel.org/r/20230620130329.4120443-1-nm@ti.com +Closes: https://lore.kernel.org/all/ZGeHMjlnob2GFyHF@francesco-nb.int.toradex.com/ +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + drivers/firmware/ti_sci.c | 36 ++---------------------------------- + 1 file changed, 2 insertions(+), 34 deletions(-) + +diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c +index 6281e7153b475..4c550cfbc086c 100644 +--- a/drivers/firmware/ti_sci.c ++++ b/drivers/firmware/ti_sci.c +@@ -97,7 +97,6 @@ struct ti_sci_desc { + * @node: list head + * @host_id: Host ID + * @users: Number of users of this instance +- * @is_suspending: Flag set to indicate in suspend path. + */ + struct ti_sci_info { + struct device *dev; +@@ -116,7 +115,6 @@ struct ti_sci_info { + u8 host_id; + /* protected by ti_sci_list_mutex */ + int users; +- bool is_suspending; + }; + + #define cl_to_ti_sci_info(c) container_of(c, struct ti_sci_info, cl) +@@ -418,14 +416,14 @@ static inline int ti_sci_do_xfer(struct ti_sci_info *info, + + ret = 0; + +- if (!info->is_suspending) { ++ if (system_state <= SYSTEM_RUNNING) { + /* And we wait for the response. */ + timeout = msecs_to_jiffies(info->desc->max_rx_timeout_ms); + if (!wait_for_completion_timeout(&xfer->done, timeout)) + ret = -ETIMEDOUT; + } else { + /* +- * If we are suspending, we cannot use wait_for_completion_timeout ++ * If we are !running, we cannot use wait_for_completion_timeout + * during noirq phase, so we must manually poll the completion. + */ + ret = read_poll_timeout_atomic(try_wait_for_completion, done_state, +@@ -3282,35 +3280,6 @@ static int tisci_reboot_handler(struct notifier_block *nb, unsigned long mode, + return NOTIFY_BAD; + } + +-static void ti_sci_set_is_suspending(struct ti_sci_info *info, bool is_suspending) +-{ +- info->is_suspending = is_suspending; +-} +- +-static int ti_sci_suspend(struct device *dev) +-{ +- struct ti_sci_info *info = dev_get_drvdata(dev); +- /* +- * We must switch operation to polled mode now as drivers and the genpd +- * layer may make late TI SCI calls to change clock and device states +- * from the noirq phase of suspend. +- */ +- ti_sci_set_is_suspending(info, true); +- +- return 0; +-} +- +-static int ti_sci_resume(struct device *dev) +-{ +- struct ti_sci_info *info = dev_get_drvdata(dev); +- +- ti_sci_set_is_suspending(info, false); +- +- return 0; +-} +- +-static DEFINE_SIMPLE_DEV_PM_OPS(ti_sci_pm_ops, ti_sci_suspend, ti_sci_resume); +- + /* Description for K2G */ + static const struct ti_sci_desc ti_sci_pmmc_k2g_desc = { + .default_host_id = 2, +@@ -3519,7 +3488,6 @@ static struct platform_driver ti_sci_driver = { + .driver = { + .name = "ti-sci", + .of_match_table = of_match_ptr(ti_sci_of_match), +- .pm = &ti_sci_pm_ops, + }, + }; + module_platform_driver(ti_sci_driver); +-- +2.40.1 + diff --git a/queue-6.1/fs-fix-error-checking-for-d_hash_and_lookup.patch b/queue-6.1/fs-fix-error-checking-for-d_hash_and_lookup.patch new file mode 100644 index 00000000000..bc640f61368 --- /dev/null +++ b/queue-6.1/fs-fix-error-checking-for-d_hash_and_lookup.patch @@ -0,0 +1,38 @@ +From 731d78f9dfade15068ebb5f03c25ac580dfa2203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 20:05:42 +0800 +Subject: fs: Fix error checking for d_hash_and_lookup() + +From: Wang Ming + +[ Upstream commit 0d5a4f8f775ff990142cdc810a84eae078589d27 ] + +The d_hash_and_lookup() function returns error pointers or NULL. +Most incorrect error checks were fixed, but the one in int path_pts() +was forgotten. + +Fixes: eedf265aa003 ("devpts: Make each mount of devpts an independent filesystem.") +Signed-off-by: Wang Ming +Message-Id: <20230713120555.7025-1-machel@vivo.com> +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/namei.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/namei.c b/fs/namei.c +index 5b3865ad9d052..4248647f1ab24 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -2859,7 +2859,7 @@ int path_pts(struct path *path) + dput(path->dentry); + path->dentry = parent; + child = d_hash_and_lookup(parent, &this); +- if (!child) ++ if (IS_ERR_OR_NULL(child)) + return -ENOENT; + + path->dentry = child; +-- +2.40.1 + diff --git a/queue-6.1/fs-lockd-avoid-possible-wrong-null-parameter.patch b/queue-6.1/fs-lockd-avoid-possible-wrong-null-parameter.patch new file mode 100644 index 00000000000..6f260038ffa --- /dev/null +++ b/queue-6.1/fs-lockd-avoid-possible-wrong-null-parameter.patch @@ -0,0 +1,43 @@ +From c15022f4f12be4e6b444a853cc533ba9b726eab0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 09:26:57 +0800 +Subject: fs: lockd: avoid possible wrong NULL parameter + +From: Su Hui + +[ Upstream commit de8d38cf44bac43e83bad28357ba84784c412752 ] + +clang's static analysis warning: fs/lockd/mon.c: line 293, column 2: +Null pointer passed as 2nd argument to memory copy function. + +Assuming 'hostname' is NULL and calling 'nsm_create_handle()', this will +pass NULL as 2nd argument to memory copy function 'memcpy()'. So return +NULL if 'hostname' is invalid. + +Fixes: 77a3ef33e2de ("NSM: More clean up of nsm_get_handle()") +Signed-off-by: Su Hui +Reviewed-by: Nick Desaulniers +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/lockd/mon.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c +index 1d9488cf05348..87a0f207df0b9 100644 +--- a/fs/lockd/mon.c ++++ b/fs/lockd/mon.c +@@ -276,6 +276,9 @@ static struct nsm_handle *nsm_create_handle(const struct sockaddr *sap, + { + struct nsm_handle *new; + ++ if (!hostname) ++ return NULL; ++ + new = kzalloc(sizeof(*new) + hostname_len + 1, GFP_KERNEL); + if (unlikely(new == NULL)) + return NULL; +-- +2.40.1 + diff --git a/queue-6.1/fs-ocfs2-namei-check-return-value-of-ocfs2_add_entry.patch b/queue-6.1/fs-ocfs2-namei-check-return-value-of-ocfs2_add_entry.patch new file mode 100644 index 00000000000..2626aeb51a8 --- /dev/null +++ b/queue-6.1/fs-ocfs2-namei-check-return-value-of-ocfs2_add_entry.patch @@ -0,0 +1,50 @@ +From 6251d3410d99942986f32c12380087ac8d8ce75b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 17:54:17 +0300 +Subject: fs: ocfs2: namei: check return value of ocfs2_add_entry() + +From: Artem Chernyshev + +[ Upstream commit 6b72e5f9e79360fce4f2be7fe81159fbdf4256a5 ] + +Process result of ocfs2_add_entry() in case we have an error +value. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Link: https://lkml.kernel.org/r/20230803145417.177649-1-artem.chernyshev@red-soft.ru +Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem") +Signed-off-by: Artem Chernyshev +Reviewed-by: Joseph Qi +Cc: Artem Chernyshev +Cc: Joel Becker +Cc: Kurt Hackel +Cc: Mark Fasheh +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/namei.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c +index 1c7ac433667df..04a8505bd97af 100644 +--- a/fs/ocfs2/namei.c ++++ b/fs/ocfs2/namei.c +@@ -1535,6 +1535,10 @@ static int ocfs2_rename(struct user_namespace *mnt_userns, + status = ocfs2_add_entry(handle, new_dentry, old_inode, + OCFS2_I(old_inode)->ip_blkno, + new_dir_bh, &target_insert); ++ if (status < 0) { ++ mlog_errno(status); ++ goto bail; ++ } + } + + old_inode->i_ctime = current_time(old_inode); +-- +2.40.1 + diff --git a/queue-6.1/fsi-aspeed-reset-master-errors-after-cfam-reset.patch b/queue-6.1/fsi-aspeed-reset-master-errors-after-cfam-reset.patch new file mode 100644 index 00000000000..c6a478e1020 --- /dev/null +++ b/queue-6.1/fsi-aspeed-reset-master-errors-after-cfam-reset.patch @@ -0,0 +1,38 @@ +From 12ff94b4150b4620c6771c5b16528200093060bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 14:56:50 -0500 +Subject: fsi: aspeed: Reset master errors after CFAM reset + +From: Eddie James + +[ Upstream commit 52300909f4670ac552bfeb33c1355b896eac8c06 ] + +It has been observed that sometimes the FSI master will return all 0xffs +after a CFAM has been taken out of reset, without presenting any error. +Resetting the FSI master errors resolves the issue. + +Fixes: 4a851d714ead ("fsi: aspeed: Support CFAM reset GPIO") +Signed-off-by: Eddie James +Link: https://lore.kernel.org/r/20230612195657.245125-8-eajames@linux.ibm.com +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + drivers/fsi/fsi-master-aspeed.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c +index 7cec1772820d3..5eccab175e86b 100644 +--- a/drivers/fsi/fsi-master-aspeed.c ++++ b/drivers/fsi/fsi-master-aspeed.c +@@ -454,6 +454,8 @@ static ssize_t cfam_reset_store(struct device *dev, struct device_attribute *att + gpiod_set_value(aspeed->cfam_reset_gpio, 1); + usleep_range(900, 1000); + gpiod_set_value(aspeed->cfam_reset_gpio, 0); ++ usleep_range(900, 1000); ++ opb_writel(aspeed, ctrl_base + FSI_MRESP0, cpu_to_be32(FSI_MRESP_RST_ALL_MASTER)); + mutex_unlock(&aspeed->lock); + trace_fsi_master_aspeed_cfam_reset(false); + +-- +2.40.1 + diff --git a/queue-6.1/hid-input-support-devices-sending-eraser-without-inv.patch b/queue-6.1/hid-input-support-devices-sending-eraser-without-inv.patch new file mode 100644 index 00000000000..8b4ec07b9e2 --- /dev/null +++ b/queue-6.1/hid-input-support-devices-sending-eraser-without-inv.patch @@ -0,0 +1,94 @@ +From 8199658f4b7af49db0964230001e9e6ab58cefb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 17:26:00 +0200 +Subject: HID: input: Support devices sending Eraser without Invert + +From: Illia Ostapyshyn + +[ Upstream commit 276e14e6c3993317257e1787e93b7166fbc30905 ] + +Some digitizers (notably XP-Pen Artist 24) do not report the Invert +usage when erasing. This causes the device to be permanently stuck with +the BTN_TOOL_RUBBER tool after sending Eraser, as Invert is the only +usage that can release the tool. In this state, Touch and Inrange are +no longer reported to userspace, rendering the pen unusable. + +Prior to commit 87562fcd1342 ("HID: input: remove the need for +HID_QUIRK_INVERT"), BTN_TOOL_RUBBER was never set and Eraser events were +simply translated into BTN_TOUCH without causing an inconsistent state. + +Introduce HID_QUIRK_NOINVERT for such digitizers and detect them during +hidinput_configure_usage(). This quirk causes the tool to be released +as soon as Eraser is reported as not set. Set BTN_TOOL_RUBBER in +input->keybit when mapping Eraser. + +Fixes: 87562fcd1342 ("HID: input: remove the need for HID_QUIRK_INVERT") +Co-developed-by: Nils Fuhler +Signed-off-by: Nils Fuhler +Signed-off-by: Illia Ostapyshyn +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 18 ++++++++++++++++-- + include/linux/hid.h | 1 + + 2 files changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 3acaaca888acd..77ee5e01e6111 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -961,6 +961,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + return; + + case 0x3c: /* Invert */ ++ device->quirks &= ~HID_QUIRK_NOINVERT; + map_key_clear(BTN_TOOL_RUBBER); + break; + +@@ -986,9 +987,13 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + case 0x45: /* ERASER */ + /* + * This event is reported when eraser tip touches the surface. +- * Actual eraser (BTN_TOOL_RUBBER) is set by Invert usage when +- * tool gets in proximity. ++ * Actual eraser (BTN_TOOL_RUBBER) is set and released either ++ * by Invert if tool reports proximity or by Eraser directly. + */ ++ if (!test_bit(BTN_TOOL_RUBBER, input->keybit)) { ++ device->quirks |= HID_QUIRK_NOINVERT; ++ set_bit(BTN_TOOL_RUBBER, input->keybit); ++ } + map_key_clear(BTN_TOUCH); + break; + +@@ -1532,6 +1537,15 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct + else if (report->tool != BTN_TOOL_RUBBER) + /* value is off, tool is not rubber, ignore */ + return; ++ else if (*quirks & HID_QUIRK_NOINVERT && ++ !test_bit(BTN_TOUCH, input->key)) { ++ /* ++ * There is no invert to release the tool, let hid_input ++ * send BTN_TOUCH with scancode and release the tool after. ++ */ ++ hid_report_release_tool(report, input, BTN_TOOL_RUBBER); ++ return; ++ } + + /* let hid-input set BTN_TOUCH */ + break; +diff --git a/include/linux/hid.h b/include/linux/hid.h +index 0a1ccc68e798a..784dd6b6046eb 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -357,6 +357,7 @@ struct hid_item { + #define HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP BIT(18) + #define HID_QUIRK_HAVE_SPECIAL_DRIVER BIT(19) + #define HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE BIT(20) ++#define HID_QUIRK_NOINVERT BIT(21) + #define HID_QUIRK_FULLSPEED_INTERVAL BIT(28) + #define HID_QUIRK_NO_INIT_REPORTS BIT(29) + #define HID_QUIRK_NO_IGNORE BIT(30) +-- +2.40.1 + diff --git a/queue-6.1/hid-logitech-dj-fix-error-handling-in-logi_dj_recv_s.patch b/queue-6.1/hid-logitech-dj-fix-error-handling-in-logi_dj_recv_s.patch new file mode 100644 index 00000000000..a8861f08aac --- /dev/null +++ b/queue-6.1/hid-logitech-dj-fix-error-handling-in-logi_dj_recv_s.patch @@ -0,0 +1,55 @@ +From 1675f1f0bc8251b351b08c645fc88e8cf3000584 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 03:16:35 -0700 +Subject: HID: logitech-dj: Fix error handling in + logi_dj_recv_switch_to_dj_mode() + +From: Nikita Zhandarovich + +[ Upstream commit 6f20d3261265885f6a6be4cda49d7019728760e0 ] + +Presently, if a call to logi_dj_recv_send_report() fails, we do +not learn about the error until after sending short +HID_OUTPUT_REPORT with hid_hw_raw_request(). +To handle this somewhat unlikely issue, return on error in +logi_dj_recv_send_report() (minding ugly sleep workaround) and +take into account the result of hid_hw_raw_request(). + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 6a9ddc897883 ("HID: logitech-dj: enable notifications on connect/disconnect") +Signed-off-by: Nikita Zhandarovich +Link: https://lore.kernel.org/r/20230613101635.77820-1-n.zhandarovich@fintech.ru +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-dj.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c +index c358778e070bc..08768e5accedc 100644 +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -1285,6 +1285,9 @@ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev, + * 50 msec should gives enough time to the receiver to be ready. + */ + msleep(50); ++ ++ if (retval) ++ return retval; + } + + /* +@@ -1306,7 +1309,7 @@ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev, + buf[5] = 0x09; + buf[6] = 0x00; + +- hid_hw_raw_request(hdev, REPORT_ID_HIDPP_SHORT, buf, ++ retval = hid_hw_raw_request(hdev, REPORT_ID_HIDPP_SHORT, buf, + HIDPP_REPORT_SHORT_LENGTH, HID_OUTPUT_REPORT, + HID_REQ_SET_REPORT); + +-- +2.40.1 + diff --git a/queue-6.1/hid-multitouch-correct-devm-device-reference-for-hid.patch b/queue-6.1/hid-multitouch-correct-devm-device-reference-for-hid.patch new file mode 100644 index 00000000000..1b6ecb88f9e --- /dev/null +++ b/queue-6.1/hid-multitouch-correct-devm-device-reference-for-hid.patch @@ -0,0 +1,67 @@ +From 9adf9c5f1fe55cb90a751cfa944d1a0e8524b77d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 06:14:33 +0000 +Subject: HID: multitouch: Correct devm device reference for hidinput input_dev + name + +From: Rahul Rameshbabu + +[ Upstream commit 4794394635293a3e74591351fff469cea7ad15a2 ] + +Reference the HID device rather than the input device for the devm +allocation of the input_dev name. Referencing the input_dev would lead to a +use-after-free when the input_dev was unregistered and subsequently fires a +uevent that depends on the name. At the point of firing the uevent, the +name would be freed by devres management. + +Use devm_kasprintf to simplify the logic for allocating memory and +formatting the input_dev name string. + +Reported-by: Maxime Ripard +Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92520f74b6cf6ffa8653f9c92643d4ae +Fixes: c08d46aa805b ("HID: multitouch: devm conversion") +Suggested-by: Maxime Ripard +Suggested-by: Dmitry Torokhov +Signed-off-by: Rahul Rameshbabu +Reviewed-by: Maxime Ripard +Link: https://lore.kernel.org/r/20230824061308.222021-3-sergeantsagara@protonmail.com +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index e31be0cb8b850..521b2ffb42449 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1594,7 +1594,6 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app) + static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) + { + struct mt_device *td = hid_get_drvdata(hdev); +- char *name; + const char *suffix = NULL; + struct mt_report_data *rdata; + struct mt_application *mt_application = NULL; +@@ -1645,15 +1644,9 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) + break; + } + +- if (suffix) { +- name = devm_kzalloc(&hi->input->dev, +- strlen(hdev->name) + strlen(suffix) + 2, +- GFP_KERNEL); +- if (name) { +- sprintf(name, "%s %s", hdev->name, suffix); +- hi->input->name = name; +- } +- } ++ if (suffix) ++ hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, ++ "%s %s", hdev->name, suffix); + + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/hid-uclogic-correct-devm-device-reference-for-hidinp.patch b/queue-6.1/hid-uclogic-correct-devm-device-reference-for-hidinp.patch new file mode 100644 index 00000000000..2b34677cc7d --- /dev/null +++ b/queue-6.1/hid-uclogic-correct-devm-device-reference-for-hidinp.patch @@ -0,0 +1,71 @@ +From c7a1a0314dee8d50a3960f773b42c4d45ba5be9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 06:14:17 +0000 +Subject: HID: uclogic: Correct devm device reference for hidinput input_dev + name + +From: Rahul Rameshbabu + +[ Upstream commit dd613a4e45f8d35f49a63a2064e5308fa5619e29 ] + +Reference the HID device rather than the input device for the devm +allocation of the input_dev name. Referencing the input_dev would lead to a +use-after-free when the input_dev was unregistered and subsequently fires a +uevent that depends on the name. At the point of firing the uevent, the +name would be freed by devres management. + +Use devm_kasprintf to simplify the logic for allocating memory and +formatting the input_dev name string. + +Reported-by: syzbot+3a0ebe8a52b89c63739d@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/ +Reported-by: Maxime Ripard +Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92520f74b6cf6ffa8653f9c92643d4ae +Fixes: cce2dbdf258e ("HID: uclogic: name the input nodes based on their tool") +Suggested-by: Maxime Ripard +Suggested-by: Dmitry Torokhov +Signed-off-by: Rahul Rameshbabu +Reviewed-by: Maxime Ripard +Link: https://lore.kernel.org/r/20230824061308.222021-2-sergeantsagara@protonmail.com +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-uclogic-core.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c +index bfbb51f8b5beb..39114d5c55a0e 100644 +--- a/drivers/hid/hid-uclogic-core.c ++++ b/drivers/hid/hid-uclogic-core.c +@@ -85,10 +85,8 @@ static int uclogic_input_configured(struct hid_device *hdev, + { + struct uclogic_drvdata *drvdata = hid_get_drvdata(hdev); + struct uclogic_params *params = &drvdata->params; +- char *name; + const char *suffix = NULL; + struct hid_field *field; +- size_t len; + size_t i; + const struct uclogic_params_frame *frame; + +@@ -146,14 +144,9 @@ static int uclogic_input_configured(struct hid_device *hdev, + } + } + +- if (suffix) { +- len = strlen(hdev->name) + 2 + strlen(suffix); +- name = devm_kzalloc(&hi->input->dev, len, GFP_KERNEL); +- if (name) { +- snprintf(name, len, "%s %s", hdev->name, suffix); +- hi->input->name = name; +- } +- } ++ if (suffix) ++ hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, ++ "%s %s", hdev->name, suffix); + + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/hwmon-tmp513-fix-the-channel-number-in-tmp51x_is_vis.patch b/queue-6.1/hwmon-tmp513-fix-the-channel-number-in-tmp51x_is_vis.patch new file mode 100644 index 00000000000..ee01c41f19d --- /dev/null +++ b/queue-6.1/hwmon-tmp513-fix-the-channel-number-in-tmp51x_is_vis.patch @@ -0,0 +1,39 @@ +From ac14d6430dd31f95467197d2f538ae3a714cc548 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 21:44:54 +0100 +Subject: hwmon: (tmp513) Fix the channel number in tmp51x_is_visible() + +From: Biju Das + +[ Upstream commit d103337e38e7e64c3d915029e947b1cb0b512737 ] + +The supported channels for this driver are {0..3}. Fix the incorrect +channel in tmp51x_is_visible(). + +Reported-by: Guenter Roeck +Closes: https://lore.kernel.org/all/ea0eccc0-a29f-41e4-9049-a1a13f8b16f1@roeck-us.net/ +Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.") +Signed-off-by: Biju Das +Link: https://lore.kernel.org/r/20230824204456.401580-2-biju.das.jz@bp.renesas.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/tmp513.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c +index 7d5f7441aceb1..b9a93ee9c2364 100644 +--- a/drivers/hwmon/tmp513.c ++++ b/drivers/hwmon/tmp513.c +@@ -434,7 +434,7 @@ static umode_t tmp51x_is_visible(const void *_data, + + switch (type) { + case hwmon_temp: +- if (data->id == tmp512 && channel == 4) ++ if (data->id == tmp512 && channel == 3) + return 0; + switch (attr) { + case hwmon_temp_input: +-- +2.40.1 + diff --git a/queue-6.1/hwrng-iproc-rng200-implement-suspend-and-resume-call.patch b/queue-6.1/hwrng-iproc-rng200-implement-suspend-and-resume-call.patch new file mode 100644 index 00000000000..7e72d91e1b0 --- /dev/null +++ b/queue-6.1/hwrng-iproc-rng200-implement-suspend-and-resume-call.patch @@ -0,0 +1,75 @@ +From 09fae9b34b4f5d8207367ca84b43a246efe08f34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 12:22:08 -0700 +Subject: hwrng: iproc-rng200 - Implement suspend and resume calls + +From: Florian Fainelli + +[ Upstream commit 8e03dd62e5be811efbf0cbeba47e79e793519105 ] + +Chips such as BCM7278 support system wide suspend/resume which will +cause the HWRNG block to lose its state and reset to its power on reset +register values. We need to cleanup and re-initialize the HWRNG for it +to be functional coming out of a system suspend cycle. + +Fixes: c3577f6100ca ("hwrng: iproc-rng200 - Add support for BCM7278") +Signed-off-by: Florian Fainelli +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/iproc-rng200.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/drivers/char/hw_random/iproc-rng200.c b/drivers/char/hw_random/iproc-rng200.c +index 06bc060534d81..c0df053cbe4b2 100644 +--- a/drivers/char/hw_random/iproc-rng200.c ++++ b/drivers/char/hw_random/iproc-rng200.c +@@ -182,6 +182,8 @@ static int iproc_rng200_probe(struct platform_device *pdev) + return PTR_ERR(priv->base); + } + ++ dev_set_drvdata(dev, priv); ++ + priv->rng.name = "iproc-rng200"; + priv->rng.read = iproc_rng200_read; + priv->rng.init = iproc_rng200_init; +@@ -199,6 +201,28 @@ static int iproc_rng200_probe(struct platform_device *pdev) + return 0; + } + ++static int __maybe_unused iproc_rng200_suspend(struct device *dev) ++{ ++ struct iproc_rng200_dev *priv = dev_get_drvdata(dev); ++ ++ iproc_rng200_cleanup(&priv->rng); ++ ++ return 0; ++} ++ ++static int __maybe_unused iproc_rng200_resume(struct device *dev) ++{ ++ struct iproc_rng200_dev *priv = dev_get_drvdata(dev); ++ ++ iproc_rng200_init(&priv->rng); ++ ++ return 0; ++} ++ ++static const struct dev_pm_ops iproc_rng200_pm_ops = { ++ SET_SYSTEM_SLEEP_PM_OPS(iproc_rng200_suspend, iproc_rng200_resume) ++}; ++ + static const struct of_device_id iproc_rng200_of_match[] = { + { .compatible = "brcm,bcm2711-rng200", }, + { .compatible = "brcm,bcm7211-rng200", }, +@@ -212,6 +236,7 @@ static struct platform_driver iproc_rng200_driver = { + .driver = { + .name = "iproc-rng200", + .of_match_table = iproc_rng200_of_match, ++ .pm = &iproc_rng200_pm_ops, + }, + .probe = iproc_rng200_probe, + }; +-- +2.40.1 + diff --git a/queue-6.1/hwrng-nomadik-keep-clock-enabled-while-hwrng-is-regi.patch b/queue-6.1/hwrng-nomadik-keep-clock-enabled-while-hwrng-is-regi.patch new file mode 100644 index 00000000000..c31669e0754 --- /dev/null +++ b/queue-6.1/hwrng-nomadik-keep-clock-enabled-while-hwrng-is-regi.patch @@ -0,0 +1,86 @@ +From ba92ba97181de1e141f80c9d3b11602350aa0bf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Jul 2023 19:35:02 +0200 +Subject: hwrng: nomadik - keep clock enabled while hwrng is registered + +From: Martin Kaiser + +[ Upstream commit 039980de89dc9dd757418d6f296e4126cc3f86c3 ] + +The nomadik driver uses devres to register itself with the hwrng core, +the driver will be unregistered from hwrng when its device goes out of +scope. This happens after the driver's remove function is called. + +However, nomadik's clock is disabled in the remove function. There's a +short timeframe where nomadik is still registered with the hwrng core +although its clock is disabled. I suppose the clock must be active to +access the hardware and serve requests from the hwrng core. + +Switch to devm_clk_get_enabled and let devres disable the clock and +unregister the hwrng. This avoids the race condition. + +Fixes: 3e75241be808 ("hwrng: drivers - Use device-managed registration API") +Signed-off-by: Martin Kaiser +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/nomadik-rng.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/drivers/char/hw_random/nomadik-rng.c b/drivers/char/hw_random/nomadik-rng.c +index e8f9621e79541..3774adf903a83 100644 +--- a/drivers/char/hw_random/nomadik-rng.c ++++ b/drivers/char/hw_random/nomadik-rng.c +@@ -13,8 +13,6 @@ + #include + #include + +-static struct clk *rng_clk; +- + static int nmk_rng_read(struct hwrng *rng, void *data, size_t max, bool wait) + { + void __iomem *base = (void __iomem *)rng->priv; +@@ -36,21 +34,20 @@ static struct hwrng nmk_rng = { + + static int nmk_rng_probe(struct amba_device *dev, const struct amba_id *id) + { ++ struct clk *rng_clk; + void __iomem *base; + int ret; + +- rng_clk = devm_clk_get(&dev->dev, NULL); ++ rng_clk = devm_clk_get_enabled(&dev->dev, NULL); + if (IS_ERR(rng_clk)) { + dev_err(&dev->dev, "could not get rng clock\n"); + ret = PTR_ERR(rng_clk); + return ret; + } + +- clk_prepare_enable(rng_clk); +- + ret = amba_request_regions(dev, dev->dev.init_name); + if (ret) +- goto out_clk; ++ return ret; + ret = -ENOMEM; + base = devm_ioremap(&dev->dev, dev->res.start, + resource_size(&dev->res)); +@@ -64,15 +61,12 @@ static int nmk_rng_probe(struct amba_device *dev, const struct amba_id *id) + + out_release: + amba_release_regions(dev); +-out_clk: +- clk_disable_unprepare(rng_clk); + return ret; + } + + static void nmk_rng_remove(struct amba_device *dev) + { + amba_release_regions(dev); +- clk_disable_unprepare(rng_clk); + } + + static const struct amba_id nmk_rng_ids[] = { +-- +2.40.1 + diff --git a/queue-6.1/hwrng-pic32-use-devm_clk_get_enabled.patch b/queue-6.1/hwrng-pic32-use-devm_clk_get_enabled.patch new file mode 100644 index 00000000000..20039f46ede --- /dev/null +++ b/queue-6.1/hwrng-pic32-use-devm_clk_get_enabled.patch @@ -0,0 +1,85 @@ +From 56036773912c587d5ff50817ef4fb6a8fa98315a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 19:32:01 +0200 +Subject: hwrng: pic32 - use devm_clk_get_enabled + +From: Martin Kaiser + +[ Upstream commit 6755ad74aac0fb1c79b14724feb81b2f6ff25847 ] + +Use devm_clk_get_enabled in the pic32 driver. Ensure that the clock is +enabled as long as the driver is registered with the hwrng core. + +Fixes: 7ea39973d1e5 ("hwrng: pic32 - Use device-managed registration API") +Signed-off-by: Martin Kaiser +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/pic32-rng.c | 19 +++++-------------- + 1 file changed, 5 insertions(+), 14 deletions(-) + +diff --git a/drivers/char/hw_random/pic32-rng.c b/drivers/char/hw_random/pic32-rng.c +index 99c8bd0859a14..e04a054e89307 100644 +--- a/drivers/char/hw_random/pic32-rng.c ++++ b/drivers/char/hw_random/pic32-rng.c +@@ -36,7 +36,6 @@ + struct pic32_rng { + void __iomem *base; + struct hwrng rng; +- struct clk *clk; + }; + + /* +@@ -70,6 +69,7 @@ static int pic32_rng_read(struct hwrng *rng, void *buf, size_t max, + static int pic32_rng_probe(struct platform_device *pdev) + { + struct pic32_rng *priv; ++ struct clk *clk; + u32 v; + int ret; + +@@ -81,13 +81,9 @@ static int pic32_rng_probe(struct platform_device *pdev) + if (IS_ERR(priv->base)) + return PTR_ERR(priv->base); + +- priv->clk = devm_clk_get(&pdev->dev, NULL); +- if (IS_ERR(priv->clk)) +- return PTR_ERR(priv->clk); +- +- ret = clk_prepare_enable(priv->clk); +- if (ret) +- return ret; ++ clk = devm_clk_get_enabled(&pdev->dev, NULL); ++ if (IS_ERR(clk)) ++ return PTR_ERR(clk); + + /* enable TRNG in enhanced mode */ + v = TRNGEN | TRNGMOD; +@@ -98,15 +94,11 @@ static int pic32_rng_probe(struct platform_device *pdev) + + ret = devm_hwrng_register(&pdev->dev, &priv->rng); + if (ret) +- goto err_register; ++ return ret; + + platform_set_drvdata(pdev, priv); + + return 0; +- +-err_register: +- clk_disable_unprepare(priv->clk); +- return ret; + } + + static int pic32_rng_remove(struct platform_device *pdev) +@@ -114,7 +106,6 @@ static int pic32_rng_remove(struct platform_device *pdev) + struct pic32_rng *rng = platform_get_drvdata(pdev); + + writel(0, rng->base + RNGCON); +- clk_disable_unprepare(rng->clk); + return 0; + } + +-- +2.40.1 + diff --git a/queue-6.1/ib-uverbs-fix-an-potential-error-pointer-dereference.patch b/queue-6.1/ib-uverbs-fix-an-potential-error-pointer-dereference.patch new file mode 100644 index 00000000000..8f42101fa43 --- /dev/null +++ b/queue-6.1/ib-uverbs-fix-an-potential-error-pointer-dereference.patch @@ -0,0 +1,42 @@ +From 54d96f75311790d68ba32bfe1d966b5115073614 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 10:25:25 +0800 +Subject: IB/uverbs: Fix an potential error pointer dereference + +From: Xiang Yang + +[ Upstream commit 26b7d1a27167e7adf75b150755e05d2bc123ce55 ] + +smatch reports the warning below: +drivers/infiniband/core/uverbs_std_types_counters.c:110 +ib_uverbs_handler_UVERBS_METHOD_COUNTERS_READ() error: 'uattr' +dereferencing possible ERR_PTR() + +The return value of uattr maybe ERR_PTR(-ENOENT), fix this by checking +the value of uattr before using it. + +Fixes: ebb6796bd397 ("IB/uverbs: Add read counters support") +Signed-off-by: Xiang Yang +Link: https://lore.kernel.org/r/20230804022525.1916766-1-xiangyang3@huawei.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/uverbs_std_types_counters.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/core/uverbs_std_types_counters.c b/drivers/infiniband/core/uverbs_std_types_counters.c +index 999da9c798668..381aa57976417 100644 +--- a/drivers/infiniband/core/uverbs_std_types_counters.c ++++ b/drivers/infiniband/core/uverbs_std_types_counters.c +@@ -107,6 +107,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_COUNTERS_READ)( + return ret; + + uattr = uverbs_attr_get(attrs, UVERBS_ATTR_READ_COUNTERS_BUFF); ++ if (IS_ERR(uattr)) ++ return PTR_ERR(uattr); + read_attr.ncounters = uattr->ptr_attr.len / sizeof(u64); + read_attr.counters_buff = uverbs_zalloc( + attrs, array_size(read_attr.ncounters, sizeof(u64))); +-- +2.40.1 + diff --git a/queue-6.1/ice-avoid-executing-commands-on-other-ports-when-dri.patch b/queue-6.1/ice-avoid-executing-commands-on-other-ports-when-dri.patch new file mode 100644 index 00000000000..1360a37bed5 --- /dev/null +++ b/queue-6.1/ice-avoid-executing-commands-on-other-ports-when-dri.patch @@ -0,0 +1,203 @@ +From 22e04ae2353dde946857526fa6f29554325376f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Aug 2023 08:18:14 -0700 +Subject: ice: avoid executing commands on other ports when driving sync + +From: Jacob Keller + +[ Upstream commit 0aacec49c29e7c5b1487e859b0c0a42388c34092 ] + +The ice hardware has a synchronization mechanism used to drive the +simultaneous application of commands on both PHY ports and the source timer +in the MAC. + +When issuing a sync via ice_ptp_exec_tmr_cmd(), the hardware will +simultaneously apply the commands programmed for the main timer and each +PHY port. Neither the main timer command register, nor the PHY port command +registers auto clear on command execution. + +During the execution of a timer command intended for a single port on E822 +devices, such as those used to configure a PHY during link up, the driver +is not correctly clearing the previous commands. + +This results in unintentionally executing the last programmed command on +the main timer and other PHY ports whenever performing reconfiguration on +E822 ports after link up. This results in unintended side effects on other +timers, depending on what command was previously programmed. + +To fix this, the driver must ensure that the main timer and all other PHY +ports are properly initialized to perform no action. + +The enumeration for timer commands does not include an enumeration value +for doing nothing. Introduce ICE_PTP_NOP for this purpose. When writing a +timer command to hardware, leave the command bits set to zero which +indicates that no operation should be performed on that port. + +Modify ice_ptp_one_port_cmd() to always initialize all ports. For all ports +other than the one being configured, write their timer command register to +ICE_PTP_NOP. This ensures that no side effect happens on the timer command. + +To fix this for the PHY ports, modify ice_ptp_one_port_cmd() to always +initialize all other ports to ICE_PTP_NOP. This ensures that no side +effects happen on the other ports. + +Call ice_ptp_src_cmd() with a command value if ICE_PTP_NOP in +ice_sync_phy_timer_e822() and ice_start_phy_timer_e822(). + +With both of these changes, the driver should no longer execute a stale +command on the main timer or another PHY port when reconfiguring one of the +PHY ports after link up. + +Fixes: 3a7496234d17 ("ice: implement basic E822 PTP support") +Signed-off-by: Siddaraju DH +Signed-off-by: Jacob Keller +Tested-by: Sunitha Mekala (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ptp_hw.c | 55 +++++++++++++++++++-- + drivers/net/ethernet/intel/ice/ice_ptp_hw.h | 3 +- + 2 files changed, 52 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c +index 772b1f566d6ed..813acd6a4b469 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c ++++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c +@@ -131,6 +131,8 @@ static void ice_ptp_src_cmd(struct ice_hw *hw, enum ice_ptp_tmr_cmd cmd) + case READ_TIME: + cmd_val |= GLTSYN_CMD_READ_TIME; + break; ++ case ICE_PTP_NOP: ++ break; + } + + wr32(hw, GLTSYN_CMD, cmd_val); +@@ -1200,18 +1202,18 @@ ice_ptp_read_port_capture(struct ice_hw *hw, u8 port, u64 *tx_ts, u64 *rx_ts) + } + + /** +- * ice_ptp_one_port_cmd - Prepare a single PHY port for a timer command ++ * ice_ptp_write_port_cmd_e822 - Prepare a single PHY port for a timer command + * @hw: pointer to HW struct + * @port: Port to which cmd has to be sent + * @cmd: Command to be sent to the port + * + * Prepare the requested port for an upcoming timer sync command. + * +- * Note there is no equivalent of this operation on E810, as that device +- * always handles all external PHYs internally. ++ * Do not use this function directly. If you want to configure exactly one ++ * port, use ice_ptp_one_port_cmd() instead. + */ + static int +-ice_ptp_one_port_cmd(struct ice_hw *hw, u8 port, enum ice_ptp_tmr_cmd cmd) ++ice_ptp_write_port_cmd_e822(struct ice_hw *hw, u8 port, enum ice_ptp_tmr_cmd cmd) + { + u32 cmd_val, val; + u8 tmr_idx; +@@ -1235,6 +1237,8 @@ ice_ptp_one_port_cmd(struct ice_hw *hw, u8 port, enum ice_ptp_tmr_cmd cmd) + case ADJ_TIME_AT_TIME: + cmd_val |= PHY_CMD_ADJ_TIME_AT_TIME; + break; ++ case ICE_PTP_NOP: ++ break; + } + + /* Tx case */ +@@ -1280,6 +1284,39 @@ ice_ptp_one_port_cmd(struct ice_hw *hw, u8 port, enum ice_ptp_tmr_cmd cmd) + return 0; + } + ++/** ++ * ice_ptp_one_port_cmd - Prepare one port for a timer command ++ * @hw: pointer to the HW struct ++ * @configured_port: the port to configure with configured_cmd ++ * @configured_cmd: timer command to prepare on the configured_port ++ * ++ * Prepare the configured_port for the configured_cmd, and prepare all other ++ * ports for ICE_PTP_NOP. This causes the configured_port to execute the ++ * desired command while all other ports perform no operation. ++ */ ++static int ++ice_ptp_one_port_cmd(struct ice_hw *hw, u8 configured_port, ++ enum ice_ptp_tmr_cmd configured_cmd) ++{ ++ u8 port; ++ ++ for (port = 0; port < ICE_NUM_EXTERNAL_PORTS; port++) { ++ enum ice_ptp_tmr_cmd cmd; ++ int err; ++ ++ if (port == configured_port) ++ cmd = configured_cmd; ++ else ++ cmd = ICE_PTP_NOP; ++ ++ err = ice_ptp_write_port_cmd_e822(hw, port, cmd); ++ if (err) ++ return err; ++ } ++ ++ return 0; ++} ++ + /** + * ice_ptp_port_cmd_e822 - Prepare all ports for a timer command + * @hw: pointer to the HW struct +@@ -1296,7 +1333,7 @@ ice_ptp_port_cmd_e822(struct ice_hw *hw, enum ice_ptp_tmr_cmd cmd) + for (port = 0; port < ICE_NUM_EXTERNAL_PORTS; port++) { + int err; + +- err = ice_ptp_one_port_cmd(hw, port, cmd); ++ err = ice_ptp_write_port_cmd_e822(hw, port, cmd); + if (err) + return err; + } +@@ -2245,6 +2282,9 @@ static int ice_sync_phy_timer_e822(struct ice_hw *hw, u8 port) + if (err) + goto err_unlock; + ++ /* Do not perform any action on the main timer */ ++ ice_ptp_src_cmd(hw, ICE_PTP_NOP); ++ + /* Issue the sync to activate the time adjustment */ + ice_ptp_exec_tmr_cmd(hw); + +@@ -2371,6 +2411,9 @@ ice_start_phy_timer_e822(struct ice_hw *hw, u8 port, bool bypass) + if (err) + return err; + ++ /* Do not perform any action on the main timer */ ++ ice_ptp_src_cmd(hw, ICE_PTP_NOP); ++ + ice_ptp_exec_tmr_cmd(hw); + + err = ice_read_phy_reg_e822(hw, port, P_REG_PS, &val); +@@ -2914,6 +2957,8 @@ static int ice_ptp_port_cmd_e810(struct ice_hw *hw, enum ice_ptp_tmr_cmd cmd) + case ADJ_TIME_AT_TIME: + cmd_val = GLTSYN_CMD_ADJ_INIT_TIME; + break; ++ case ICE_PTP_NOP: ++ return 0; + } + + /* Read, modify, write */ +diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.h b/drivers/net/ethernet/intel/ice/ice_ptp_hw.h +index 2bda64c76abc3..071f545aa85e8 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.h ++++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.h +@@ -9,7 +9,8 @@ enum ice_ptp_tmr_cmd { + INIT_INCVAL, + ADJ_TIME, + ADJ_TIME_AT_TIME, +- READ_TIME ++ READ_TIME, ++ ICE_PTP_NOP, + }; + + enum ice_ptp_serdes { +-- +2.40.1 + diff --git a/queue-6.1/ice-ice_aq_check_events-fix-off-by-one-check-when-fi.patch b/queue-6.1/ice-ice_aq_check_events-fix-off-by-one-check-when-fi.patch new file mode 100644 index 00000000000..ece8d340838 --- /dev/null +++ b/queue-6.1/ice-ice_aq_check_events-fix-off-by-one-check-when-fi.patch @@ -0,0 +1,60 @@ +From a7e45a45253f42fae641af362596bf34ed272304 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Aug 2023 17:54:15 -0400 +Subject: ice: ice_aq_check_events: fix off-by-one check when filling buffer + +From: Przemek Kitszel + +[ Upstream commit e1e8a142c43336e3d25bfa1cb3a4ae7d00875c48 ] + +Allow task's event buffer to be filled also in the case that it's size +is exactly the size of the message. + +Fixes: d69ea414c9b4 ("ice: implement device flash update via devlink") +Reviewed-by: Jacob Keller +Signed-off-by: Przemek Kitszel +Reviewed-by: Simon Horman +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 7a00d297be3a9..3f98781e74b28 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -1356,6 +1356,7 @@ int ice_aq_wait_for_event(struct ice_pf *pf, u16 opcode, unsigned long timeout, + static void ice_aq_check_events(struct ice_pf *pf, u16 opcode, + struct ice_rq_event_info *event) + { ++ struct ice_rq_event_info *task_ev; + struct ice_aq_task *task; + bool found = false; + +@@ -1364,15 +1365,15 @@ static void ice_aq_check_events(struct ice_pf *pf, u16 opcode, + if (task->state || task->opcode != opcode) + continue; + +- memcpy(&task->event->desc, &event->desc, sizeof(event->desc)); +- task->event->msg_len = event->msg_len; ++ task_ev = task->event; ++ memcpy(&task_ev->desc, &event->desc, sizeof(event->desc)); ++ task_ev->msg_len = event->msg_len; + + /* Only copy the data buffer if a destination was set */ +- if (task->event->msg_buf && +- task->event->buf_len > event->buf_len) { +- memcpy(task->event->msg_buf, event->msg_buf, ++ if (task_ev->msg_buf && task_ev->buf_len >= event->buf_len) { ++ memcpy(task_ev->msg_buf, event->msg_buf, + event->buf_len); +- task->event->buf_len = event->buf_len; ++ task_ev->buf_len = event->buf_len; + } + + task->state = ICE_AQ_TASK_COMPLETE; +-- +2.40.1 + diff --git a/queue-6.1/iio-accel-adxl313-fix-adxl313_i2c_id-table.patch b/queue-6.1/iio-accel-adxl313-fix-adxl313_i2c_id-table.patch new file mode 100644 index 00000000000..c5f07afbc29 --- /dev/null +++ b/queue-6.1/iio-accel-adxl313-fix-adxl313_i2c_id-table.patch @@ -0,0 +1,43 @@ +From 31835aae6dd8cd600dd0efe076b22781ef2a8cb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 18:16:23 +0100 +Subject: iio: accel: adxl313: Fix adxl313_i2c_id[] table + +From: Biju Das + +[ Upstream commit f636554c4cd1c644109cc525900a056495b86cc9 ] + +The .driver_data in adxl313_i2c_id[] for adxl312 and adxl314 is +wrong. Fix this issue by adding corresponding adxl31x_chip_info +data. + +Reported-by: Jonathan Cameron +Closes: https://lore.kernel.org/all/20230722172832.04ad7738@jic23-huawei +Fixes: a7a1c60bc4c9 ("drivers: iio: accel: adxl312 and adxl314 support") +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230725171624.331283-2-biju.das.jz@bp.renesas.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/adxl313_i2c.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/accel/adxl313_i2c.c b/drivers/iio/accel/adxl313_i2c.c +index 99cc7fc294882..68785bd3ef2f0 100644 +--- a/drivers/iio/accel/adxl313_i2c.c ++++ b/drivers/iio/accel/adxl313_i2c.c +@@ -40,8 +40,8 @@ static const struct regmap_config adxl31x_i2c_regmap_config[] = { + + static const struct i2c_device_id adxl313_i2c_id[] = { + { .name = "adxl312", .driver_data = (kernel_ulong_t)&adxl31x_chip_info[ADXL312] }, +- { .name = "adxl313", .driver_data = (kernel_ulong_t)&adxl31x_chip_info[ADXL312] }, +- { .name = "adxl314", .driver_data = (kernel_ulong_t)&adxl31x_chip_info[ADXL312] }, ++ { .name = "adxl313", .driver_data = (kernel_ulong_t)&adxl31x_chip_info[ADXL313] }, ++ { .name = "adxl314", .driver_data = (kernel_ulong_t)&adxl31x_chip_info[ADXL314] }, + { } + }; + +-- +2.40.1 + diff --git a/queue-6.1/ima-remove-deprecated-ima_trusted_keyring-kconfig.patch b/queue-6.1/ima-remove-deprecated-ima_trusted_keyring-kconfig.patch new file mode 100644 index 00000000000..92f29e15486 --- /dev/null +++ b/queue-6.1/ima-remove-deprecated-ima_trusted_keyring-kconfig.patch @@ -0,0 +1,45 @@ +From bc6475c8a4506458f0de734ee7fe43291ac79d6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 12:44:47 -0400 +Subject: ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig + +From: Nayna Jain + +[ Upstream commit 5087fd9e80e539d2163accd045b73da64de7de95 ] + +Time to remove "IMA_TRUSTED_KEYRING". + +Fixes: f4dc37785e9b ("integrity: define '.evm' as a builtin 'trusted' keyring") # v4.5+ +Signed-off-by: Nayna Jain +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/Kconfig | 12 ------------ + 1 file changed, 12 deletions(-) + +diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig +index 60a511c6b583e..c17660bf5f347 100644 +--- a/security/integrity/ima/Kconfig ++++ b/security/integrity/ima/Kconfig +@@ -248,18 +248,6 @@ config IMA_APPRAISE_MODSIG + The modsig keyword can be used in the IMA policy to allow a hook + to accept such signatures. + +-config IMA_TRUSTED_KEYRING +- bool "Require all keys on the .ima keyring be signed (deprecated)" +- depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING +- depends on INTEGRITY_ASYMMETRIC_KEYS +- select INTEGRITY_TRUSTED_KEYRING +- default y +- help +- This option requires that all keys added to the .ima +- keyring be signed by a key on the system trusted keyring. +- +- This option is deprecated in favor of INTEGRITY_TRUSTED_KEYRING +- + config IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY + bool "Permit keys validly signed by a built-in or secondary CA cert (EXPERIMENTAL)" + depends on SYSTEM_TRUSTED_KEYRING +-- +2.40.1 + diff --git a/queue-6.1/interconnect-qcom-bcm-voter-improve-enable_mask-hand.patch b/queue-6.1/interconnect-qcom-bcm-voter-improve-enable_mask-hand.patch new file mode 100644 index 00000000000..4e280951efb --- /dev/null +++ b/queue-6.1/interconnect-qcom-bcm-voter-improve-enable_mask-hand.patch @@ -0,0 +1,97 @@ +From 4133d6a8ceb4577eb3e57ab30941a35b243fc91d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Aug 2023 01:16:15 +0200 +Subject: interconnect: qcom: bcm-voter: Improve enable_mask handling + +From: Konrad Dybcio + +[ Upstream commit a1f4170dec440f023601d57e49227b784074d218 ] + +We don't need all the complex arithmetic for BCMs utilizing enable_mask, +as all we need to do is to determine whether there's any user (or +keepalive) asking for it to be on. + +Separate the logic for such BCMs for a small speed boost. + +Suggested-by: Bjorn Andersson +Reviewed-by: Bjorn Andersson +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230811-topic-icc_fix_1he-v2-1-0620af8ac133@linaro.org +Signed-off-by: Georgi Djakov +Stable-dep-of: 1a70ca71547b ("interconnect: qcom: bcm-voter: Use enable_maks for keepalive voting") +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/bcm-voter.c | 43 ++++++++++++++++++++++----- + 1 file changed, 36 insertions(+), 7 deletions(-) + +diff --git a/drivers/interconnect/qcom/bcm-voter.c b/drivers/interconnect/qcom/bcm-voter.c +index d5f2a6b5376bd..d857eb8838b95 100644 +--- a/drivers/interconnect/qcom/bcm-voter.c ++++ b/drivers/interconnect/qcom/bcm-voter.c +@@ -58,6 +58,36 @@ static u64 bcm_div(u64 num, u32 base) + return num; + } + ++/* BCMs with enable_mask use one-hot-encoding for on/off signaling */ ++static void bcm_aggregate_mask(struct qcom_icc_bcm *bcm) ++{ ++ struct qcom_icc_node *node; ++ int bucket, i; ++ ++ for (bucket = 0; bucket < QCOM_ICC_NUM_BUCKETS; bucket++) { ++ bcm->vote_x[bucket] = 0; ++ bcm->vote_y[bucket] = 0; ++ ++ for (i = 0; i < bcm->num_nodes; i++) { ++ node = bcm->nodes[i]; ++ ++ /* If any vote in this bucket exists, keep the BCM enabled */ ++ if (node->sum_avg[bucket] || node->max_peak[bucket]) { ++ bcm->vote_x[bucket] = 0; ++ bcm->vote_y[bucket] = bcm->enable_mask; ++ break; ++ } ++ } ++ } ++ ++ if (bcm->keepalive) { ++ bcm->vote_x[QCOM_ICC_BUCKET_AMC] = 1; ++ bcm->vote_x[QCOM_ICC_BUCKET_WAKE] = 1; ++ bcm->vote_y[QCOM_ICC_BUCKET_AMC] = 1; ++ bcm->vote_y[QCOM_ICC_BUCKET_WAKE] = 1; ++ } ++} ++ + static void bcm_aggregate(struct qcom_icc_bcm *bcm) + { + struct qcom_icc_node *node; +@@ -83,11 +113,6 @@ static void bcm_aggregate(struct qcom_icc_bcm *bcm) + + temp = agg_peak[bucket] * bcm->vote_scale; + bcm->vote_y[bucket] = bcm_div(temp, bcm->aux_data.unit); +- +- if (bcm->enable_mask && (bcm->vote_x[bucket] || bcm->vote_y[bucket])) { +- bcm->vote_x[bucket] = 0; +- bcm->vote_y[bucket] = bcm->enable_mask; +- } + } + + if (bcm->keepalive && bcm->vote_x[QCOM_ICC_BUCKET_AMC] == 0 && +@@ -260,8 +285,12 @@ int qcom_icc_bcm_voter_commit(struct bcm_voter *voter) + return 0; + + mutex_lock(&voter->lock); +- list_for_each_entry(bcm, &voter->commit_list, list) +- bcm_aggregate(bcm); ++ list_for_each_entry(bcm, &voter->commit_list, list) { ++ if (bcm->enable_mask) ++ bcm_aggregate_mask(bcm); ++ else ++ bcm_aggregate(bcm); ++ } + + /* + * Pre sort the BCMs based on VCD for ease of generating a command list +-- +2.40.1 + diff --git a/queue-6.1/interconnect-qcom-bcm-voter-use-enable_maks-for-keep.patch b/queue-6.1/interconnect-qcom-bcm-voter-use-enable_maks-for-keep.patch new file mode 100644 index 00000000000..e81ad2e0b6a --- /dev/null +++ b/queue-6.1/interconnect-qcom-bcm-voter-use-enable_maks-for-keep.patch @@ -0,0 +1,48 @@ +From 1fe95ab8445e4c6935fc04543a48efa44998ee67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Aug 2023 01:16:16 +0200 +Subject: interconnect: qcom: bcm-voter: Use enable_maks for keepalive voting + +From: Konrad Dybcio + +[ Upstream commit 1a70ca71547be051769f0628aa09717694f508f0 ] + +BCMs with an enable_mask expect to only have that specific value written +to them. The current implementation only works by miracle for BCMs with +enable mask == BIT(0), as the minimal vote we've been using so far just +so happens to be equal to that. + +Use the correct value with keepalive voting. + +Fixes: d8630f050d3f ("interconnect: qcom: Add support for mask-based BCMs") +Reported-by: Bjorn Andersson +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230811-topic-icc_fix_1he-v2-2-0620af8ac133@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/bcm-voter.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/interconnect/qcom/bcm-voter.c b/drivers/interconnect/qcom/bcm-voter.c +index d857eb8838b95..a2d437a05a11f 100644 +--- a/drivers/interconnect/qcom/bcm-voter.c ++++ b/drivers/interconnect/qcom/bcm-voter.c +@@ -81,10 +81,10 @@ static void bcm_aggregate_mask(struct qcom_icc_bcm *bcm) + } + + if (bcm->keepalive) { +- bcm->vote_x[QCOM_ICC_BUCKET_AMC] = 1; +- bcm->vote_x[QCOM_ICC_BUCKET_WAKE] = 1; +- bcm->vote_y[QCOM_ICC_BUCKET_AMC] = 1; +- bcm->vote_y[QCOM_ICC_BUCKET_WAKE] = 1; ++ bcm->vote_x[QCOM_ICC_BUCKET_AMC] = bcm->enable_mask; ++ bcm->vote_x[QCOM_ICC_BUCKET_WAKE] = bcm->enable_mask; ++ bcm->vote_y[QCOM_ICC_BUCKET_AMC] = bcm->enable_mask; ++ bcm->vote_y[QCOM_ICC_BUCKET_WAKE] = bcm->enable_mask; + } + } + +-- +2.40.1 + diff --git a/queue-6.1/interconnect-qcom-qcm2290-enable-sync-state.patch b/queue-6.1/interconnect-qcom-qcm2290-enable-sync-state.patch new file mode 100644 index 00000000000..ad5f8be1e25 --- /dev/null +++ b/queue-6.1/interconnect-qcom-qcm2290-enable-sync-state.patch @@ -0,0 +1,40 @@ +From a96a731d825bd89b0c744696a88d86e29850f481 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 12:49:22 +0200 +Subject: interconnect: qcom: qcm2290: Enable sync state + +From: Konrad Dybcio + +[ Upstream commit 4e048e9b7a160f7112069c0ec2947be15f3e8154 ] + +Enable the generic .sync_state callback to ensure there are no +outstanding votes that would waste power. + +Generally one would need a bunch of interface clocks to access the QoS +registers when trying to go over all possible nodes during sync_state, +but QCM2290 surprisingly does not seem to require any such handling. + +Fixes: 1a14b1ac3935 ("interconnect: qcom: Add QCM2290 driver support") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230720-topic-qcm2290_icc-v2-2-a2ceb9d3e713@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/qcm2290.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/interconnect/qcom/qcm2290.c b/drivers/interconnect/qcom/qcm2290.c +index a29cdb4fac03f..82a2698ad66b1 100644 +--- a/drivers/interconnect/qcom/qcm2290.c ++++ b/drivers/interconnect/qcom/qcm2290.c +@@ -1355,6 +1355,7 @@ static struct platform_driver qcm2290_noc_driver = { + .driver = { + .name = "qnoc-qcm2290", + .of_match_table = qcm2290_noc_of_match, ++ .sync_state = icc_sync_state, + }, + }; + module_platform_driver(qcm2290_noc_driver); +-- +2.40.1 + diff --git a/queue-6.1/interconnect-qcom-sm8450-enable-sync_state.patch b/queue-6.1/interconnect-qcom-sm8450-enable-sync_state.patch new file mode 100644 index 00000000000..eaa2f51e956 --- /dev/null +++ b/queue-6.1/interconnect-qcom-sm8450-enable-sync_state.patch @@ -0,0 +1,37 @@ +From 016cc823bec05ac14065d08f4b3ae3e9c627c793 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 19:34:57 +0200 +Subject: interconnect: qcom: sm8450: Enable sync_state + +From: Konrad Dybcio + +[ Upstream commit 16862f1b2110eca6330e5be6d804e1a08e06a202 ] + +Enable sync_state on sm8450 so that the interconnect votes actually mean +anything and aren't just pinned to INT_MAX. + +Fixes: fafc114a468e ("interconnect: qcom: Add SM8450 interconnect provider driver") +Signed-off-by: Konrad Dybcio +Reviewed-by: Vinod Koul +Link: https://lore.kernel.org/r/20230811-topic-8450_syncstate-v1-1-69ae5552a18b@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/sm8450.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/interconnect/qcom/sm8450.c b/drivers/interconnect/qcom/sm8450.c +index e64c214b40209..d6e582a02e628 100644 +--- a/drivers/interconnect/qcom/sm8450.c ++++ b/drivers/interconnect/qcom/sm8450.c +@@ -1886,6 +1886,7 @@ static struct platform_driver qnoc_driver = { + .driver = { + .name = "qnoc-sm8450", + .of_match_table = qnoc_of_match, ++ .sync_state = icc_sync_state, + }, + }; + +-- +2.40.1 + diff --git a/queue-6.1/io_uring-fix-drain-stalls-by-invalid-sqe.patch b/queue-6.1/io_uring-fix-drain-stalls-by-invalid-sqe.patch new file mode 100644 index 00000000000..aa67c816276 --- /dev/null +++ b/queue-6.1/io_uring-fix-drain-stalls-by-invalid-sqe.patch @@ -0,0 +1,41 @@ +From 04c56e521099f5825b966c96ac876411838846fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 13:21:41 +0100 +Subject: io_uring: fix drain stalls by invalid SQE + +From: Pavel Begunkov + +[ Upstream commit cfdbaa3a291d6fd2cb4a1a70d74e63b4abc2f5ec ] + +cq_extra is protected by ->completion_lock, which io_get_sqe() misses. +The bug is harmless as it doesn't happen in real life, requires invalid +SQ index array and racing with submission, and only messes up the +userspace, i.e. stall requests execution but will be cleaned up on +ring destruction. + +Fixes: 15641e427070f ("io_uring: don't cache number of dropped SQEs") +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/66096d54651b1a60534bb2023f2947f09f50ef73.1691538547.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io_uring.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index b0e47fe1eb4bb..e15abe26a0e61 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -2240,7 +2240,9 @@ static const struct io_uring_sqe *io_get_sqe(struct io_ring_ctx *ctx) + } + + /* drop invalid entries */ ++ spin_lock(&ctx->completion_lock); + ctx->cq_extra--; ++ spin_unlock(&ctx->completion_lock); + WRITE_ONCE(ctx->rings->sq_dropped, + READ_ONCE(ctx->rings->sq_dropped) + 1); + return NULL; +-- +2.40.1 + diff --git a/queue-6.1/iomap-remove-large-folio-handling-in-iomap_invalidat.patch b/queue-6.1/iomap-remove-large-folio-handling-in-iomap_invalidat.patch new file mode 100644 index 00000000000..4c836ff61a8 --- /dev/null +++ b/queue-6.1/iomap-remove-large-folio-handling-in-iomap_invalidat.patch @@ -0,0 +1,46 @@ +From c8c92a9c1777da8d279746bdee2a5ee7c624f6e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 18:09:11 -0400 +Subject: iomap: Remove large folio handling in iomap_invalidate_folio() + +From: Matthew Wilcox (Oracle) + +[ Upstream commit a221ab717c43147f728d93513923ba3528f861bf ] + +We do not need to release the iomap_page in iomap_invalidate_folio() +to allow the folio to be split. The splitting code will call +->release_folio() if there is still per-fs private data attached to +the folio. At that point, we will check if the folio is still dirty +and decline to release the iomap_page. It is possible to trigger the +warning in perfectly legitimate circumstances (eg if a disk read fails, +we do a partial write to the folio, then we truncate the folio), which +will cause those writes to be lost. + +Fixes: 60d8231089f0 ("iomap: Support large folios in invalidatepage") +Signed-off-by: Matthew Wilcox (Oracle) +Reviewed-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/iomap/buffered-io.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c +index 91ee0b308e13d..a0a4d8de82cad 100644 +--- a/fs/iomap/buffered-io.c ++++ b/fs/iomap/buffered-io.c +@@ -488,11 +488,6 @@ void iomap_invalidate_folio(struct folio *folio, size_t offset, size_t len) + WARN_ON_ONCE(folio_test_writeback(folio)); + folio_cancel_dirty(folio); + iomap_page_release(folio); +- } else if (folio_test_large(folio)) { +- /* Must release the iop so the page can be split */ +- WARN_ON_ONCE(!folio_test_uptodate(folio) && +- folio_test_dirty(folio)); +- iomap_page_release(folio); + } + } + EXPORT_SYMBOL_GPL(iomap_invalidate_folio); +-- +2.40.1 + diff --git a/queue-6.1/iommu-amd-iommu_v2-fix-pasid_state-refcount-dec-hit-.patch b/queue-6.1/iommu-amd-iommu_v2-fix-pasid_state-refcount-dec-hit-.patch new file mode 100644 index 00000000000..19f40c96d01 --- /dev/null +++ b/queue-6.1/iommu-amd-iommu_v2-fix-pasid_state-refcount-dec-hit-.patch @@ -0,0 +1,54 @@ +From 52ac5ec7076554a241d5ff367fa45cba0bc23a17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 10:51:45 +0000 +Subject: iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on + pasid unbind + +From: Daniel Marcovitch + +[ Upstream commit 534103bcd52ca9c1fecbc70e717b4a538dc4ded8 ] + +When unbinding pasid - a race condition exists vs outstanding page faults. + +To prevent this, the pasid_state object contains a refcount. + * set to 1 on pasid bind + * incremented on each ppr notification start + * decremented on each ppr notification done + * decremented on pasid unbind + +Since refcount_dec assumes that refcount will never reach 0: + the current implementation causes the following to be invoked on + pasid unbind: + REFCOUNT_WARN("decrement hit 0; leaking memory") + +Fix this issue by changing refcount_dec to refcount_dec_and_test +to explicitly handle refcount=1. + +Fixes: 8bc54824da4e ("iommu/amd: Convert from atomic_t to refcount_t on pasid_state->count") +Signed-off-by: Daniel Marcovitch +Signed-off-by: Vasant Hegde +Link: https://lore.kernel.org/r/20230609105146.7773-2-vasant.hegde@amd.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/iommu_v2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/amd/iommu_v2.c b/drivers/iommu/amd/iommu_v2.c +index 75355ddca6575..4caa023048a08 100644 +--- a/drivers/iommu/amd/iommu_v2.c ++++ b/drivers/iommu/amd/iommu_v2.c +@@ -262,8 +262,8 @@ static void put_pasid_state(struct pasid_state *pasid_state) + + static void put_pasid_state_wait(struct pasid_state *pasid_state) + { +- refcount_dec(&pasid_state->count); +- wait_event(pasid_state->wq, !refcount_read(&pasid_state->count)); ++ if (!refcount_dec_and_test(&pasid_state->count)) ++ wait_event(pasid_state->wq, !refcount_read(&pasid_state->count)); + free_pasid_state(pasid_state); + } + +-- +2.40.1 + diff --git a/queue-6.1/iommu-mediatek-fix-two-iommu-share-pagetable-issue.patch b/queue-6.1/iommu-mediatek-fix-two-iommu-share-pagetable-issue.patch new file mode 100644 index 00000000000..3b3cc610317 --- /dev/null +++ b/queue-6.1/iommu-mediatek-fix-two-iommu-share-pagetable-issue.patch @@ -0,0 +1,100 @@ +From fd45c204fb836b50b8248ac8638b6b4652275080 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 17:02:22 +0800 +Subject: iommu/mediatek: Fix two IOMMU share pagetable issue + +From: Chengci.Xu + +[ Upstream commit cf69ef46dbd980a0b1c956d668e066a73e0acd0f ] + +Prepare for mt8188 to fix a two IOMMU HWs share pagetable issue. + +We have two MM IOMMU HWs in mt8188, one is VPP-IOMMU, the other is +VDO-IOMMU. The 2 MM IOMMU HWs share pagetable don't work in this case: + a) VPP-IOMMU probe firstly. + b) VDO-IOMMU probe. + c) The master for VDO-IOMMU probe (means frstdata is vpp-iommu). + d) The master in another domain probe. No matter it is vdo or vpp. +Then it still create a new pagetable in step d). The problem is +"frstdata->bank[0]->m4u_dom" was not initialized. Then when d) enter, it +still create a new one. + +In this patch, we create a new variable "share_dom" for this share +pgtable case, it should be helpful for readable. and put all the share +pgtable logic in the mtk_iommu_domain_finalise. + +In mt8195, the master of VPP-IOMMU probes before than VDO-IOMMU +from its dtsi node sequence, we don't see this issue in it. Prepare for +mt8188. + +Fixes: 645b87c190c9 ("iommu/mediatek: Fix 2 HW sharing pgtable issue") +Signed-off-by: Chengci.Xu +Signed-off-by: Yong Wu +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Alexandre Mergnat +Link: https://lore.kernel.org/r/20230602090227.7264-3-yong.wu@mediatek.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/mtk_iommu.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c +index 5ff8982712e0f..9673cd60c84fc 100644 +--- a/drivers/iommu/mtk_iommu.c ++++ b/drivers/iommu/mtk_iommu.c +@@ -223,6 +223,8 @@ struct mtk_iommu_data { + struct device *smicomm_dev; + + struct mtk_iommu_bank_data *bank; ++ struct mtk_iommu_domain *share_dom; /* For 2 HWs share pgtable */ ++ + struct regmap *pericfg; + struct mutex mutex; /* Protect m4u_group/m4u_dom above */ + +@@ -574,15 +576,14 @@ static int mtk_iommu_domain_finalise(struct mtk_iommu_domain *dom, + struct mtk_iommu_data *data, + unsigned int region_id) + { ++ struct mtk_iommu_domain *share_dom = data->share_dom; + const struct mtk_iommu_iova_region *region; +- struct mtk_iommu_domain *m4u_dom; +- +- /* Always use bank0 in sharing pgtable case */ +- m4u_dom = data->bank[0].m4u_dom; +- if (m4u_dom) { +- dom->iop = m4u_dom->iop; +- dom->cfg = m4u_dom->cfg; +- dom->domain.pgsize_bitmap = m4u_dom->cfg.pgsize_bitmap; ++ ++ /* Always use share domain in sharing pgtable case */ ++ if (MTK_IOMMU_HAS_FLAG(data->plat_data, SHARE_PGTABLE) && share_dom) { ++ dom->iop = share_dom->iop; ++ dom->cfg = share_dom->cfg; ++ dom->domain.pgsize_bitmap = share_dom->cfg.pgsize_bitmap; + goto update_iova_region; + } + +@@ -612,6 +613,9 @@ static int mtk_iommu_domain_finalise(struct mtk_iommu_domain *dom, + /* Update our support page sizes bitmap */ + dom->domain.pgsize_bitmap = dom->cfg.pgsize_bitmap; + ++ if (MTK_IOMMU_HAS_FLAG(data->plat_data, SHARE_PGTABLE)) ++ data->share_dom = dom; ++ + update_iova_region: + /* Update the iova region for this domain */ + region = data->plat_data->iova_region + region_id; +@@ -662,7 +666,9 @@ static int mtk_iommu_attach_device(struct iommu_domain *domain, + /* Data is in the frstdata in sharing pgtable case. */ + frstdata = mtk_iommu_get_frst_data(hw_list); + ++ mutex_lock(&frstdata->mutex); + ret = mtk_iommu_domain_finalise(dom, frstdata, region_id); ++ mutex_unlock(&frstdata->mutex); + if (ret) { + mutex_unlock(&dom->mutex); + return -ENODEV; +-- +2.40.1 + diff --git a/queue-6.1/iommu-mediatek-remove-unused-mapping-member-from-mtk.patch b/queue-6.1/iommu-mediatek-remove-unused-mapping-member-from-mtk.patch new file mode 100644 index 00000000000..92f46403489 --- /dev/null +++ b/queue-6.1/iommu-mediatek-remove-unused-mapping-member-from-mtk.patch @@ -0,0 +1,40 @@ +From d32a7b196d2ca1ebbfbd4af1d1025bb8bc84e2cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 10:42:58 +0800 +Subject: iommu/mediatek: Remove unused "mapping" member from mtk_iommu_data + +From: Yong Wu + +[ Upstream commit 9ff894edd542618dad2fef538f8272c620a501db ] + +Just remove a unused variable that only is for mtk_iommu_v1. + +Signed-off-by: Yong Wu +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Matthias Brugger +Link: https://lore.kernel.org/r/20221018024258.19073-7-yong.wu@mediatek.com +Signed-off-by: Joerg Roedel +Stable-dep-of: cf69ef46dbd9 ("iommu/mediatek: Fix two IOMMU share pagetable issue") +Signed-off-by: Sasha Levin +--- + drivers/iommu/mtk_iommu.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c +index 2ae5a6058a34a..5ff8982712e0f 100644 +--- a/drivers/iommu/mtk_iommu.c ++++ b/drivers/iommu/mtk_iommu.c +@@ -223,10 +223,7 @@ struct mtk_iommu_data { + struct device *smicomm_dev; + + struct mtk_iommu_bank_data *bank; +- +- struct dma_iommu_mapping *mapping; /* For mtk_iommu_v1.c */ + struct regmap *pericfg; +- + struct mutex mutex; /* Protect m4u_group/m4u_dom above */ + + /* +-- +2.40.1 + diff --git a/queue-6.1/iommu-qcom-disable-and-reset-context-bank-before-pro.patch b/queue-6.1/iommu-qcom-disable-and-reset-context-bank-before-pro.patch new file mode 100644 index 00000000000..2889159b553 --- /dev/null +++ b/queue-6.1/iommu-qcom-disable-and-reset-context-bank-before-pro.patch @@ -0,0 +1,47 @@ +From bcdc7421e2531b4e5398e269a3585c3b4851dea8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 11:27:39 +0200 +Subject: iommu/qcom: Disable and reset context bank before programming + +From: AngeloGioacchino Del Regno + +[ Upstream commit 9f3fef23d9b5a858a6e6d5f478bb1b6b76265e76 ] + +Writing the new TTBRs, TCRs and MAIRs on a previously enabled +context bank may trigger a context fault, resulting in firmware +driven AP resets: change the domain initialization programming +sequence to disable the context bank(s) and to also clear the +related fault address (CB_FAR) and fault status (CB_FSR) +registers before writing new values to TTBR0/1, TCR/TCR2, MAIR0/1. + +Fixes: 0ae349a0f33f ("iommu/qcom: Add qcom_iommu") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230622092742.74819-4-angelogioacchino.delregno@collabora.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu/qcom_iommu.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c +index 3869c3ecda8cd..5b9cb9fcc352b 100644 +--- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c ++++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c +@@ -273,6 +273,13 @@ static int qcom_iommu_init_domain(struct iommu_domain *domain, + ctx->secure_init = true; + } + ++ /* Disable context bank before programming */ ++ iommu_writel(ctx, ARM_SMMU_CB_SCTLR, 0); ++ ++ /* Clear context bank fault address fault status registers */ ++ iommu_writel(ctx, ARM_SMMU_CB_FAR, 0); ++ iommu_writel(ctx, ARM_SMMU_CB_FSR, ARM_SMMU_FSR_FAULT); ++ + /* TTBRs */ + iommu_writeq(ctx, ARM_SMMU_CB_TTBR0, + pgtbl_cfg.arm_lpae_s1_cfg.ttbr | +-- +2.40.1 + diff --git a/queue-6.1/iommu-rockchip-fix-directory-table-address-encoding.patch b/queue-6.1/iommu-rockchip-fix-directory-table-address-encoding.patch new file mode 100644 index 00000000000..ee94f72b7e0 --- /dev/null +++ b/queue-6.1/iommu-rockchip-fix-directory-table-address-encoding.patch @@ -0,0 +1,156 @@ +From 9989f592c24c174dc0d325a5f97b5788f55bd0e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 18:25:45 +0000 +Subject: iommu: rockchip: Fix directory table address encoding + +From: Jonas Karlman + +[ Upstream commit 6df63b7ebdaf5fcd75dceedf6967d0761e56eca1 ] + +The physical address to the directory table is currently encoded using +the following bit layout for IOMMU v2. + + 31:12 - Address bit 31:0 + 11: 4 - Address bit 39:32 + +This is also the bit layout used by the vendor kernel. + +However, testing has shown that addresses to the directory/page tables +and memory pages are all encoded using the same bit layout. + +IOMMU v1: + 31:12 - Address bit 31:0 + +IOMMU v2: + 31:12 - Address bit 31:0 + 11: 8 - Address bit 35:32 + 7: 4 - Address bit 39:36 + +Change to use the mk_dtentries ops to encode the directory table address +correctly. The value written to DTE_ADDR may include the valid bit set, +a bit that is ignored and DTE_ADDR reg read it back as 0. + +This also update the bit layout comment for the page address and the +number of nybbles that are read back for DTE_ADDR comment. + +These changes render the dte_addr_phys and dma_addr_dte ops unused and +is removed. + +Fixes: 227014b33f62 ("iommu: rockchip: Add internal ops to handle variants") +Fixes: c55356c534aa ("iommu: rockchip: Add support for iommu v2") +Fixes: c987b65a574f ("iommu/rockchip: Fix physical address decoding") +Signed-off-by: Jonas Karlman +Reviewed-by: Robin Murphy +Link: https://lore.kernel.org/r/20230617182540.3091374-2-jonas@kwiboo.se +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/rockchip-iommu.c | 43 ++++------------------------------ + 1 file changed, 5 insertions(+), 38 deletions(-) + +diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c +index f7e9b56be174f..43bb577a26e59 100644 +--- a/drivers/iommu/rockchip-iommu.c ++++ b/drivers/iommu/rockchip-iommu.c +@@ -98,8 +98,6 @@ struct rk_iommu_ops { + phys_addr_t (*pt_address)(u32 dte); + u32 (*mk_dtentries)(dma_addr_t pt_dma); + u32 (*mk_ptentries)(phys_addr_t page, int prot); +- phys_addr_t (*dte_addr_phys)(u32 addr); +- u32 (*dma_addr_dte)(dma_addr_t dt_dma); + u64 dma_bit_mask; + }; + +@@ -277,8 +275,8 @@ static u32 rk_mk_pte(phys_addr_t page, int prot) + /* + * In v2: + * 31:12 - Page address bit 31:0 +- * 11:9 - Page address bit 34:32 +- * 8:4 - Page address bit 39:35 ++ * 11: 8 - Page address bit 35:32 ++ * 7: 4 - Page address bit 39:36 + * 3 - Security + * 2 - Writable + * 1 - Readable +@@ -505,7 +503,7 @@ static int rk_iommu_force_reset(struct rk_iommu *iommu) + + /* + * Check if register DTE_ADDR is working by writing DTE_ADDR_DUMMY +- * and verifying that upper 5 nybbles are read back. ++ * and verifying that upper 5 (v1) or 7 (v2) nybbles are read back. + */ + for (i = 0; i < iommu->num_mmu; i++) { + dte_addr = rk_ops->pt_address(DTE_ADDR_DUMMY); +@@ -530,33 +528,6 @@ static int rk_iommu_force_reset(struct rk_iommu *iommu) + return 0; + } + +-static inline phys_addr_t rk_dte_addr_phys(u32 addr) +-{ +- return (phys_addr_t)addr; +-} +- +-static inline u32 rk_dma_addr_dte(dma_addr_t dt_dma) +-{ +- return dt_dma; +-} +- +-#define DT_HI_MASK GENMASK_ULL(39, 32) +-#define DTE_BASE_HI_MASK GENMASK(11, 4) +-#define DT_SHIFT 28 +- +-static inline phys_addr_t rk_dte_addr_phys_v2(u32 addr) +-{ +- u64 addr64 = addr; +- return (phys_addr_t)(addr64 & RK_DTE_PT_ADDRESS_MASK) | +- ((addr64 & DTE_BASE_HI_MASK) << DT_SHIFT); +-} +- +-static inline u32 rk_dma_addr_dte_v2(dma_addr_t dt_dma) +-{ +- return (dt_dma & RK_DTE_PT_ADDRESS_MASK) | +- ((dt_dma & DT_HI_MASK) >> DT_SHIFT); +-} +- + static void log_iova(struct rk_iommu *iommu, int index, dma_addr_t iova) + { + void __iomem *base = iommu->bases[index]; +@@ -576,7 +547,7 @@ static void log_iova(struct rk_iommu *iommu, int index, dma_addr_t iova) + page_offset = rk_iova_page_offset(iova); + + mmu_dte_addr = rk_iommu_read(base, RK_MMU_DTE_ADDR); +- mmu_dte_addr_phys = rk_ops->dte_addr_phys(mmu_dte_addr); ++ mmu_dte_addr_phys = rk_ops->pt_address(mmu_dte_addr); + + dte_addr_phys = mmu_dte_addr_phys + (4 * dte_index); + dte_addr = phys_to_virt(dte_addr_phys); +@@ -966,7 +937,7 @@ static int rk_iommu_enable(struct rk_iommu *iommu) + + for (i = 0; i < iommu->num_mmu; i++) { + rk_iommu_write(iommu->bases[i], RK_MMU_DTE_ADDR, +- rk_ops->dma_addr_dte(rk_domain->dt_dma)); ++ rk_ops->mk_dtentries(rk_domain->dt_dma)); + rk_iommu_base_command(iommu->bases[i], RK_MMU_CMD_ZAP_CACHE); + rk_iommu_write(iommu->bases[i], RK_MMU_INT_MASK, RK_MMU_IRQ_MASK); + } +@@ -1373,8 +1344,6 @@ static struct rk_iommu_ops iommu_data_ops_v1 = { + .pt_address = &rk_dte_pt_address, + .mk_dtentries = &rk_mk_dte, + .mk_ptentries = &rk_mk_pte, +- .dte_addr_phys = &rk_dte_addr_phys, +- .dma_addr_dte = &rk_dma_addr_dte, + .dma_bit_mask = DMA_BIT_MASK(32), + }; + +@@ -1382,8 +1351,6 @@ static struct rk_iommu_ops iommu_data_ops_v2 = { + .pt_address = &rk_dte_pt_address_v2, + .mk_dtentries = &rk_mk_dte_v2, + .mk_ptentries = &rk_mk_pte_v2, +- .dte_addr_phys = &rk_dte_addr_phys_v2, +- .dma_addr_dte = &rk_dma_addr_dte_v2, + .dma_bit_mask = DMA_BIT_MASK(40), + }; + +-- +2.40.1 + diff --git a/queue-6.1/iommu-sprd-add-missing-force_aperture.patch b/queue-6.1/iommu-sprd-add-missing-force_aperture.patch new file mode 100644 index 00000000000..21d42eb24d8 --- /dev/null +++ b/queue-6.1/iommu-sprd-add-missing-force_aperture.patch @@ -0,0 +1,37 @@ +From d05f6dcc972e1a03dd298f78a5b4ad387620818c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 14:36:05 -0300 +Subject: iommu/sprd: Add missing force_aperture + +From: Jason Gunthorpe + +[ Upstream commit d48a51286c698f7fe8efc688f23a532f4fe9a904 ] + +force_aperture was intended to false only by GART drivers that have an +identity translation outside the aperture. This does not describe sprd, so +add the missing 'force_aperture = true'. + +Fixes: b23e4fc4e3fa ("iommu: add Unisoc IOMMU basic driver") +Signed-off-by: Jason Gunthorpe +Acked-by: Chunyan Zhang +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/sprd-iommu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iommu/sprd-iommu.c b/drivers/iommu/sprd-iommu.c +index fadd2c907222b..8261066de07d7 100644 +--- a/drivers/iommu/sprd-iommu.c ++++ b/drivers/iommu/sprd-iommu.c +@@ -147,6 +147,7 @@ static struct iommu_domain *sprd_iommu_domain_alloc(unsigned int domain_type) + + dom->domain.geometry.aperture_start = 0; + dom->domain.geometry.aperture_end = SZ_256M - 1; ++ dom->domain.geometry.force_aperture = true; + + return &dom->domain; + } +-- +2.40.1 + diff --git a/queue-6.1/iommu-vt-d-fix-to-flush-cache-of-pasid-directory-tab.patch b/queue-6.1/iommu-vt-d-fix-to-flush-cache-of-pasid-directory-tab.patch new file mode 100644 index 00000000000..b6daeebf980 --- /dev/null +++ b/queue-6.1/iommu-vt-d-fix-to-flush-cache-of-pasid-directory-tab.patch @@ -0,0 +1,44 @@ +From ac99bd895749e2a1cccaa1379831f6220b062d79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 20:48:04 +0800 +Subject: iommu/vt-d: Fix to flush cache of PASID directory table + +From: Yanfei Xu + +[ Upstream commit 8a3b8e63f8371c1247b7aa24ff9c5312f1a6948b ] + +Even the PCI devices don't support pasid capability, PASID table is +mandatory for a PCI device in scalable mode. However flushing cache +of pasid directory table for these devices are not taken after pasid +table is allocated as the "size" of table is zero. Fix it by +calculating the size by page order. + +Found this when reading the code, no real problem encountered for now. + +Fixes: 194b3348bdbb ("iommu/vt-d: Fix PASID directory pointer coherency") +Suggested-by: Lu Baolu +Signed-off-by: Yanfei Xu +Link: https://lore.kernel.org/r/20230616081045.721873-1-yanfei.xu@intel.com +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/pasid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c +index a39aab66a01b1..3f03039e5cce5 100644 +--- a/drivers/iommu/intel/pasid.c ++++ b/drivers/iommu/intel/pasid.c +@@ -127,7 +127,7 @@ int intel_pasid_alloc_table(struct device *dev) + info->pasid_table = pasid_table; + + if (!ecap_coherent(info->iommu->ecap)) +- clflush_cache_range(pasid_table->table, size); ++ clflush_cache_range(pasid_table->table, (1 << order) * PAGE_SIZE); + + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/ipmi-ssif-add-check-for-kstrdup.patch b/queue-6.1/ipmi-ssif-add-check-for-kstrdup.patch new file mode 100644 index 00000000000..b29e137ac58 --- /dev/null +++ b/queue-6.1/ipmi-ssif-add-check-for-kstrdup.patch @@ -0,0 +1,40 @@ +From 904310a8752a43a4099f4a74651c3cac225694eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 17:28:02 +0800 +Subject: ipmi:ssif: Add check for kstrdup + +From: Jiasheng Jiang + +[ Upstream commit c5586d0f711e9744d0cade39b0c4a2d116a333ca ] + +Add check for the return value of kstrdup() and return the error +if it fails in order to avoid NULL pointer dereference. + +Fixes: c4436c9149c5 ("ipmi_ssif: avoid registering duplicate ssif interface") +Signed-off-by: Jiasheng Jiang +Message-Id: <20230619092802.35384-1-jiasheng@iscas.ac.cn> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_ssif.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index d48061ec27dd9..e94d0750d5cc5 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -1603,6 +1603,11 @@ static int ssif_add_infos(struct i2c_client *client) + info->addr_src = SI_ACPI; + info->client = client; + info->adapter_name = kstrdup(client->adapter->name, GFP_KERNEL); ++ if (!info->adapter_name) { ++ kfree(info); ++ return -ENOMEM; ++ } ++ + info->binfo.addr = client->addr; + list_add_tail(&info->link, &ssif_infos); + return 0; +-- +2.40.1 + diff --git a/queue-6.1/ipmi-ssif-fix-a-memory-leak-when-scanning-for-an-ada.patch b/queue-6.1/ipmi-ssif-fix-a-memory-leak-when-scanning-for-an-ada.patch new file mode 100644 index 00000000000..c8dffe09b35 --- /dev/null +++ b/queue-6.1/ipmi-ssif-fix-a-memory-leak-when-scanning-for-an-ada.patch @@ -0,0 +1,37 @@ +From 159239d87846b61ff293006ec5ac62c233e784f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 11:43:33 -0500 +Subject: ipmi:ssif: Fix a memory leak when scanning for an adapter + +From: Corey Minyard + +[ Upstream commit b8d72e32e1453d37ee5c8a219f24e7eeadc471ef ] + +The adapter scan ssif_info_find() sets info->adapter_name if the adapter +info came from SMBIOS, as it's not set in that case. However, this +function can be called more than once, and it will leak the adapter name +if it had already been set. So check for NULL before setting it. + +Fixes: c4436c9149c5 ("ipmi_ssif: avoid registering duplicate ssif interface") +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_ssif.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index e94d0750d5cc5..248459f97c67b 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -1403,7 +1403,7 @@ static struct ssif_addr_info *ssif_info_find(unsigned short addr, + restart: + list_for_each_entry(info, &ssif_infos, link) { + if (info->binfo.addr == addr) { +- if (info->addr_src == SI_SMBIOS) ++ if (info->addr_src == SI_SMBIOS && !info->adapter_name) + info->adapter_name = kstrdup(adapter_name, + GFP_KERNEL); + +-- +2.40.1 + diff --git a/queue-6.1/irqchip-loongson-eiointc-fix-return-value-checking-o.patch b/queue-6.1/irqchip-loongson-eiointc-fix-return-value-checking-o.patch new file mode 100644 index 00000000000..d02d5287054 --- /dev/null +++ b/queue-6.1/irqchip-loongson-eiointc-fix-return-value-checking-o.patch @@ -0,0 +1,42 @@ +From dcbd49abbdbf02bbd664b5cd5d31412e527e8c6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 17:58:04 +0800 +Subject: irqchip/loongson-eiointc: Fix return value checking of eiointc_index +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bibo Mao + +[ Upstream commit 2e99b73afde18853754c5fae8e8d1a66fe5e3f64 ] + +Return value of function eiointc_index is int, however it is converted +into uint32_t and then compared smaller than zero, this will cause logic +problem. + +Fixes: dd281e1a1a93 ("irqchip: Add Loongson Extended I/O interrupt controller support") +Signed-off-by: Bibo Mao +Reviewed-by: Philippe Mathieu-Daudé +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230811095805.2974722-2-maobibo@loongson.cn +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-loongson-eiointc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-loongson-eiointc.c b/drivers/irqchip/irq-loongson-eiointc.c +index ac04aeaa2d308..3d99b8bdd8ef1 100644 +--- a/drivers/irqchip/irq-loongson-eiointc.c ++++ b/drivers/irqchip/irq-loongson-eiointc.c +@@ -145,7 +145,7 @@ static int eiointc_router_init(unsigned int cpu) + int i, bit; + uint32_t data; + uint32_t node = cpu_to_eio_node(cpu); +- uint32_t index = eiointc_index(node); ++ int index = eiointc_index(node); + + if (index < 0) { + pr_err("Error: invalid nodemap!\n"); +-- +2.40.1 + diff --git a/queue-6.1/jfs-validate-max-amount-of-blocks-before-allocation.patch b/queue-6.1/jfs-validate-max-amount-of-blocks-before-allocation.patch new file mode 100644 index 00000000000..ab971edb300 --- /dev/null +++ b/queue-6.1/jfs-validate-max-amount-of-blocks-before-allocation.patch @@ -0,0 +1,42 @@ +From 36165ec8bb5b87dbe15e7e284bd166a582204c23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Aug 2023 20:32:16 +0300 +Subject: jfs: validate max amount of blocks before allocation. + +From: Alexei Filippov + +[ Upstream commit 0225e10972fa809728b8d4c1bd2772b3ec3fdb57 ] + +The lack of checking bmp->db_max_freebud in extBalloc() can lead to +shift out of bounds, so this patch prevents undefined behavior, because +bmp->db_max_freebud == -1 only if there is no free space. + +Signed-off-by: Aleksei Filippov +Signed-off-by: Dave Kleikamp +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-and-tested-by: syzbot+5f088f29593e6b4c8db8@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?id=01abadbd6ae6a08b1f1987aa61554c6b3ac19ff2 +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_extent.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/jfs/jfs_extent.c b/fs/jfs/jfs_extent.c +index ae99a7e232eeb..a82751e6c47f9 100644 +--- a/fs/jfs/jfs_extent.c ++++ b/fs/jfs/jfs_extent.c +@@ -311,6 +311,11 @@ extBalloc(struct inode *ip, s64 hint, s64 * nblocks, s64 * blkno) + * blocks in the map. in that case, we'll start off with the + * maximum free. + */ ++ ++ /* give up if no space left */ ++ if (bmp->db_maxfreebud == -1) ++ return -ENOSPC; ++ + max = (s64) 1 << bmp->db_maxfreebud; + if (*nblocks >= max && *nblocks > nbperpage) + nb = nblks = (max > nbperpage) ? max : nbperpage; +-- +2.40.1 + diff --git a/queue-6.1/kbuild-rust_is_available-add-check-for-bindgen-invoc.patch b/queue-6.1/kbuild-rust_is_available-add-check-for-bindgen-invoc.patch new file mode 100644 index 00000000000..d11a24f9389 --- /dev/null +++ b/queue-6.1/kbuild-rust_is_available-add-check-for-bindgen-invoc.patch @@ -0,0 +1,92 @@ +From 56e972967b46deb4e7a23714972542e700cbff50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 02:16:25 +0200 +Subject: kbuild: rust_is_available: add check for `bindgen` invocation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Miguel Ojeda + +[ Upstream commit 52cae7f28ed6c3992489f16bb355f5b623f0912e ] + +`scripts/rust_is_available.sh` calls `bindgen` with a special +header in order to check whether the `libclang` version in use +is suitable. + +However, the invocation itself may fail if, for instance, `bindgen` +cannot locate `libclang`. This is fine for Kconfig (since the +script will still fail and therefore disable Rust as it should), +but it is pretty confusing for users of the `rustavailable` target +given the error will be unrelated: + + ./scripts/rust_is_available.sh: 21: arithmetic expression: expecting primary: "100000 * + 100 * + " + make: *** [Makefile:1816: rustavailable] Error 2 + +Instead, run the `bindgen` invocation independently in a previous +step, saving its output and return code. If it fails, then show +the user a proper error message. Otherwise, continue as usual +with the saved output. + +Since the previous patch we show a reference to the docs, and +the docs now explain how `bindgen` looks for `libclang`, +thus the error message can leverage the documentation, avoiding +duplication here (and making users aware of the setup guide in +the documentation). + +Reported-by: Nick Desaulniers +Link: https://lore.kernel.org/rust-for-linux/CAKwvOdm5JT4wbdQQYuW+RT07rCi6whGBM2iUAyg8A1CmLXG6Nw@mail.gmail.com/ +Reported-by: François Valenduc +Closes: https://github.com/Rust-for-Linux/linux/issues/934 +Reported-by: Alexandru Radovici +Closes: https://github.com/Rust-for-Linux/linux/pull/921 +Reported-by: Matthew Leach +Closes: https://lore.kernel.org/rust-for-linux/20230507084116.1099067-1-dev@mattleach.net/ +Fixes: 78521f3399ab ("scripts: add `rust_is_available.sh`") +Reviewed-by: Martin Rodriguez Reboredo +Reviewed-by: Masahiro Yamada +Reviewed-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20230616001631.463536-6-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Signed-off-by: Sasha Levin +--- + scripts/rust_is_available.sh | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/scripts/rust_is_available.sh b/scripts/rust_is_available.sh +index 0c9be438e4cd3..c965895d80b97 100755 +--- a/scripts/rust_is_available.sh ++++ b/scripts/rust_is_available.sh +@@ -90,8 +90,28 @@ if [ "$rust_bindings_generator_cversion" -gt "$rust_bindings_generator_min_cvers + fi + + # Check that the `libclang` used by the Rust bindings generator is suitable. ++# ++# In order to do that, first invoke `bindgen` to get the `libclang` version ++# found by `bindgen`. This step may already fail if, for instance, `libclang` ++# is not found, thus inform the user in such a case. ++bindgen_libclang_output=$( \ ++ LC_ALL=C "$BINDGEN" $(dirname $0)/rust_is_available_bindgen_libclang.h 2>&1 >/dev/null ++) || bindgen_libclang_code=$? ++if [ -n "$bindgen_libclang_code" ]; then ++ echo >&2 "***" ++ echo >&2 "*** Running '$BINDGEN' to check the libclang version (used by the Rust" ++ echo >&2 "*** bindings generator) failed with code $bindgen_libclang_code. This may be caused by" ++ echo >&2 "*** a failure to locate libclang. See output and docs below for details:" ++ echo >&2 "***" ++ echo >&2 "$bindgen_libclang_output" ++ echo >&2 "***" ++ exit 1 ++fi ++ ++# `bindgen` returned successfully, thus use the output to check that the version ++# of the `libclang` found by the Rust bindings generator is suitable. + bindgen_libclang_version=$( \ +- LC_ALL=C "$BINDGEN" $(dirname $0)/rust_is_available_bindgen_libclang.h 2>&1 >/dev/null \ ++ echo "$bindgen_libclang_output" \ + | grep -F 'clang version ' \ + | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' \ + | head -n 1 \ +-- +2.40.1 + diff --git a/queue-6.1/kbuild-rust_is_available-fix-confusion-when-a-versio.patch b/queue-6.1/kbuild-rust_is_available-fix-confusion-when-a-versio.patch new file mode 100644 index 00000000000..9c964ce4939 --- /dev/null +++ b/queue-6.1/kbuild-rust_is_available-fix-confusion-when-a-versio.patch @@ -0,0 +1,60 @@ +From d60f253e0adb90585d471d7375e557448e7e992e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 02:16:27 +0200 +Subject: kbuild: rust_is_available: fix confusion when a version appears in + the path + +From: Miguel Ojeda + +[ Upstream commit 9eb7e20e0c5cd069457845f965b3e8a7d736ecb7 ] + +`bindgen`'s output for `libclang`'s version check contains paths, which +in turn may contain strings that look like version numbers [1][2]: + + .../6.1.0-dev/.../rust_is_available_bindgen_libclang.h:2:9: warning: clang version 11.1.0 [-W#pragma-messages], err: false + +which the script will pick up as the version instead of the latter. + +It is also the case that versions may appear after the actual version +(e.g. distribution's version text), which was the reason behind `head` [3]: + + .../rust-is-available-bindgen-libclang.h:2:9: warning: clang version 13.0.0 (Fedora 13.0.0-3.fc35) [-W#pragma-messages], err: false + +Thus instead ask for a match after the `clang version` string. + +Reported-by: Jordan Isaacs +Closes: https://github.com/Rust-for-Linux/linux/issues/942 [1] +Reported-by: "Ethan D. Twardy" +Closes: https://lore.kernel.org/rust-for-linux/20230528131802.6390-2-ethan.twardy@gmail.com/ [2] +Reported-by: Tiago Lam +Closes: https://github.com/Rust-for-Linux/linux/pull/789 [3] +Fixes: 78521f3399ab ("scripts: add `rust_is_available.sh`") +Reviewed-by: Martin Rodriguez Reboredo +Reviewed-by: Ethan Twardy +Tested-by: Ethan Twardy +Reviewed-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20230616001631.463536-8-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Signed-off-by: Sasha Levin +--- + scripts/rust_is_available.sh | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/scripts/rust_is_available.sh b/scripts/rust_is_available.sh +index c965895d80b97..7a925d2b20fc7 100755 +--- a/scripts/rust_is_available.sh ++++ b/scripts/rust_is_available.sh +@@ -112,9 +112,7 @@ fi + # of the `libclang` found by the Rust bindings generator is suitable. + bindgen_libclang_version=$( \ + echo "$bindgen_libclang_output" \ +- | grep -F 'clang version ' \ +- | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' \ +- | head -n 1 \ ++ | sed -nE 's:.*clang version ([0-9]+\.[0-9]+\.[0-9]+).*:\1:p' + ) + bindgen_libclang_min_version=$($min_tool_version llvm) + bindgen_libclang_cversion=$(get_canonical_version $bindgen_libclang_version) +-- +2.40.1 + diff --git a/queue-6.1/kbuild-rust_is_available-fix-version-check-when-cc-h.patch b/queue-6.1/kbuild-rust_is_available-fix-version-check-when-cc-h.patch new file mode 100644 index 00000000000..e41dfc8ca1b --- /dev/null +++ b/queue-6.1/kbuild-rust_is_available-fix-version-check-when-cc-h.patch @@ -0,0 +1,53 @@ +From c170dd2fae5001555d54eebb180617969d9c874f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 02:16:22 +0200 +Subject: kbuild: rust_is_available: fix version check when CC has multiple + arguments + +From: Russell Currey + +[ Upstream commit dee3a6b819c96fc8b1907577f585fd66f5c0fefe ] + +rust_is_available.sh uses cc-version.sh to identify which C compiler is +in use, as scripts/Kconfig.include does. cc-version.sh isn't designed to +be able to handle multiple arguments in one variable, i.e. "ccache clang". +Its invocation in rust_is_available.sh quotes "$CC", which makes +$1 == "ccache clang" instead of the intended $1 == ccache & $2 == clang. + +cc-version.sh could also be changed to handle having "ccache clang" as one +argument, but it only has the one consumer upstream, making it simpler to +fix the caller here. + +Signed-off-by: Russell Currey +Fixes: 78521f3399ab ("scripts: add `rust_is_available.sh`") +Link: https://github.com/Rust-for-Linux/linux/pull/873 +[ Reworded title prefix and reflow line to 75 columns. ] +Reviewed-by: Martin Rodriguez Reboredo +Reviewed-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20230616001631.463536-3-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Signed-off-by: Sasha Levin +--- + scripts/rust_is_available.sh | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/scripts/rust_is_available.sh b/scripts/rust_is_available.sh +index f43a010eaf305..0c9be438e4cd3 100755 +--- a/scripts/rust_is_available.sh ++++ b/scripts/rust_is_available.sh +@@ -113,10 +113,10 @@ fi + # + # In the future, we might be able to perform a full version check, see + # https://github.com/rust-lang/rust-bindgen/issues/2138. +-cc_name=$($(dirname $0)/cc-version.sh "$CC" | cut -f1 -d' ') ++cc_name=$($(dirname $0)/cc-version.sh $CC | cut -f1 -d' ') + if [ "$cc_name" = Clang ]; then + clang_version=$( \ +- LC_ALL=C "$CC" --version 2>/dev/null \ ++ LC_ALL=C $CC --version 2>/dev/null \ + | sed -nE '1s:.*version ([0-9]+\.[0-9]+\.[0-9]+).*:\1:p' + ) + if [ "$clang_version" != "$bindgen_libclang_version" ]; then +-- +2.40.1 + diff --git a/queue-6.1/kbuild-rust_is_available-remove-v-option.patch b/queue-6.1/kbuild-rust_is_available-remove-v-option.patch new file mode 100644 index 00000000000..3fdbe707d69 --- /dev/null +++ b/queue-6.1/kbuild-rust_is_available-remove-v-option.patch @@ -0,0 +1,213 @@ +From d183d785096a342cd350dd397e914c9e11c2abfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 02:16:21 +0200 +Subject: kbuild: rust_is_available: remove -v option + +From: Masahiro Yamada + +[ Upstream commit d824d2f98565e7c4cb1b862c230198fbe1a968be ] + +The -v option is passed when this script is invoked from Makefile, +but not when invoked from Kconfig. + +As you can see in scripts/Kconfig.include, the 'success' macro suppresses +stdout and stderr anyway, so this script does not need to be quiet. + +Signed-off-by: Masahiro Yamada +Reviewed-by: Miguel Ojeda +Tested-by: Miguel Ojeda +Reviewed-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20230109061436.3146442-1-masahiroy@kernel.org +[ Reworded prefix to match the others in the patch series. ] +Reviewed-by: Martin Rodriguez Reboredo +Link: https://lore.kernel.org/r/20230616001631.463536-2-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Stable-dep-of: dee3a6b819c9 ("kbuild: rust_is_available: fix version check when CC has multiple arguments") +Signed-off-by: Sasha Levin +--- + Makefile | 4 +- + scripts/rust_is_available.sh | 96 +++++++++++++++--------------------- + 2 files changed, 42 insertions(+), 58 deletions(-) + +diff --git a/Makefile b/Makefile +index 82aaa3ae7395b..c627e0bdb19f9 100644 +--- a/Makefile ++++ b/Makefile +@@ -1291,7 +1291,7 @@ prepare0: archprepare + # All the preparing.. + prepare: prepare0 + ifdef CONFIG_RUST +- $(Q)$(CONFIG_SHELL) $(srctree)/scripts/rust_is_available.sh -v ++ $(Q)$(CONFIG_SHELL) $(srctree)/scripts/rust_is_available.sh + $(Q)$(MAKE) $(build)=rust + endif + +@@ -1817,7 +1817,7 @@ $(DOC_TARGETS): + # "Is Rust available?" target + PHONY += rustavailable + rustavailable: +- $(Q)$(CONFIG_SHELL) $(srctree)/scripts/rust_is_available.sh -v && echo "Rust is available!" ++ $(Q)$(CONFIG_SHELL) $(srctree)/scripts/rust_is_available.sh && echo "Rust is available!" + + # Documentation target + # +diff --git a/scripts/rust_is_available.sh b/scripts/rust_is_available.sh +index aebbf19139709..f43a010eaf305 100755 +--- a/scripts/rust_is_available.sh ++++ b/scripts/rust_is_available.sh +@@ -2,8 +2,6 @@ + # SPDX-License-Identifier: GPL-2.0 + # + # Tests whether a suitable Rust toolchain is available. +-# +-# Pass `-v` for human output and more checks (as warnings). + + set -e + +@@ -23,21 +21,17 @@ get_canonical_version() + + # Check that the Rust compiler exists. + if ! command -v "$RUSTC" >/dev/null; then +- if [ "$1" = -v ]; then +- echo >&2 "***" +- echo >&2 "*** Rust compiler '$RUSTC' could not be found." +- echo >&2 "***" +- fi ++ echo >&2 "***" ++ echo >&2 "*** Rust compiler '$RUSTC' could not be found." ++ echo >&2 "***" + exit 1 + fi + + # Check that the Rust bindings generator exists. + if ! command -v "$BINDGEN" >/dev/null; then +- if [ "$1" = -v ]; then +- echo >&2 "***" +- echo >&2 "*** Rust bindings generator '$BINDGEN' could not be found." +- echo >&2 "***" +- fi ++ echo >&2 "***" ++ echo >&2 "*** Rust bindings generator '$BINDGEN' could not be found." ++ echo >&2 "***" + exit 1 + fi + +@@ -53,16 +47,14 @@ rust_compiler_min_version=$($min_tool_version rustc) + rust_compiler_cversion=$(get_canonical_version $rust_compiler_version) + rust_compiler_min_cversion=$(get_canonical_version $rust_compiler_min_version) + if [ "$rust_compiler_cversion" -lt "$rust_compiler_min_cversion" ]; then +- if [ "$1" = -v ]; then +- echo >&2 "***" +- echo >&2 "*** Rust compiler '$RUSTC' is too old." +- echo >&2 "*** Your version: $rust_compiler_version" +- echo >&2 "*** Minimum version: $rust_compiler_min_version" +- echo >&2 "***" +- fi ++ echo >&2 "***" ++ echo >&2 "*** Rust compiler '$RUSTC' is too old." ++ echo >&2 "*** Your version: $rust_compiler_version" ++ echo >&2 "*** Minimum version: $rust_compiler_min_version" ++ echo >&2 "***" + exit 1 + fi +-if [ "$1" = -v ] && [ "$rust_compiler_cversion" -gt "$rust_compiler_min_cversion" ]; then ++if [ "$rust_compiler_cversion" -gt "$rust_compiler_min_cversion" ]; then + echo >&2 "***" + echo >&2 "*** Rust compiler '$RUSTC' is too new. This may or may not work." + echo >&2 "*** Your version: $rust_compiler_version" +@@ -82,16 +74,14 @@ rust_bindings_generator_min_version=$($min_tool_version bindgen) + rust_bindings_generator_cversion=$(get_canonical_version $rust_bindings_generator_version) + rust_bindings_generator_min_cversion=$(get_canonical_version $rust_bindings_generator_min_version) + if [ "$rust_bindings_generator_cversion" -lt "$rust_bindings_generator_min_cversion" ]; then +- if [ "$1" = -v ]; then +- echo >&2 "***" +- echo >&2 "*** Rust bindings generator '$BINDGEN' is too old." +- echo >&2 "*** Your version: $rust_bindings_generator_version" +- echo >&2 "*** Minimum version: $rust_bindings_generator_min_version" +- echo >&2 "***" +- fi ++ echo >&2 "***" ++ echo >&2 "*** Rust bindings generator '$BINDGEN' is too old." ++ echo >&2 "*** Your version: $rust_bindings_generator_version" ++ echo >&2 "*** Minimum version: $rust_bindings_generator_min_version" ++ echo >&2 "***" + exit 1 + fi +-if [ "$1" = -v ] && [ "$rust_bindings_generator_cversion" -gt "$rust_bindings_generator_min_cversion" ]; then ++if [ "$rust_bindings_generator_cversion" -gt "$rust_bindings_generator_min_cversion" ]; then + echo >&2 "***" + echo >&2 "*** Rust bindings generator '$BINDGEN' is too new. This may or may not work." + echo >&2 "*** Your version: $rust_bindings_generator_version" +@@ -110,13 +100,11 @@ bindgen_libclang_min_version=$($min_tool_version llvm) + bindgen_libclang_cversion=$(get_canonical_version $bindgen_libclang_version) + bindgen_libclang_min_cversion=$(get_canonical_version $bindgen_libclang_min_version) + if [ "$bindgen_libclang_cversion" -lt "$bindgen_libclang_min_cversion" ]; then +- if [ "$1" = -v ]; then +- echo >&2 "***" +- echo >&2 "*** libclang (used by the Rust bindings generator '$BINDGEN') is too old." +- echo >&2 "*** Your version: $bindgen_libclang_version" +- echo >&2 "*** Minimum version: $bindgen_libclang_min_version" +- echo >&2 "***" +- fi ++ echo >&2 "***" ++ echo >&2 "*** libclang (used by the Rust bindings generator '$BINDGEN') is too old." ++ echo >&2 "*** Your version: $bindgen_libclang_version" ++ echo >&2 "*** Minimum version: $bindgen_libclang_min_version" ++ echo >&2 "***" + exit 1 + fi + +@@ -125,21 +113,19 @@ fi + # + # In the future, we might be able to perform a full version check, see + # https://github.com/rust-lang/rust-bindgen/issues/2138. +-if [ "$1" = -v ]; then +- cc_name=$($(dirname $0)/cc-version.sh "$CC" | cut -f1 -d' ') +- if [ "$cc_name" = Clang ]; then +- clang_version=$( \ +- LC_ALL=C "$CC" --version 2>/dev/null \ +- | sed -nE '1s:.*version ([0-9]+\.[0-9]+\.[0-9]+).*:\1:p' +- ) +- if [ "$clang_version" != "$bindgen_libclang_version" ]; then +- echo >&2 "***" +- echo >&2 "*** libclang (used by the Rust bindings generator '$BINDGEN')" +- echo >&2 "*** version does not match Clang's. This may be a problem." +- echo >&2 "*** libclang version: $bindgen_libclang_version" +- echo >&2 "*** Clang version: $clang_version" +- echo >&2 "***" +- fi ++cc_name=$($(dirname $0)/cc-version.sh "$CC" | cut -f1 -d' ') ++if [ "$cc_name" = Clang ]; then ++ clang_version=$( \ ++ LC_ALL=C "$CC" --version 2>/dev/null \ ++ | sed -nE '1s:.*version ([0-9]+\.[0-9]+\.[0-9]+).*:\1:p' ++ ) ++ if [ "$clang_version" != "$bindgen_libclang_version" ]; then ++ echo >&2 "***" ++ echo >&2 "*** libclang (used by the Rust bindings generator '$BINDGEN')" ++ echo >&2 "*** version does not match Clang's. This may be a problem." ++ echo >&2 "*** libclang version: $bindgen_libclang_version" ++ echo >&2 "*** Clang version: $clang_version" ++ echo >&2 "***" + fi + fi + +@@ -150,11 +136,9 @@ rustc_sysroot=$("$RUSTC" $KRUSTFLAGS --print sysroot) + rustc_src=${RUST_LIB_SRC:-"$rustc_sysroot/lib/rustlib/src/rust/library"} + rustc_src_core="$rustc_src/core/src/lib.rs" + if [ ! -e "$rustc_src_core" ]; then +- if [ "$1" = -v ]; then +- echo >&2 "***" +- echo >&2 "*** Source code for the 'core' standard library could not be found" +- echo >&2 "*** at '$rustc_src_core'." +- echo >&2 "***" +- fi ++ echo >&2 "***" ++ echo >&2 "*** Source code for the 'core' standard library could not be found" ++ echo >&2 "*** at '$rustc_src_core'." ++ echo >&2 "***" + exit 1 + fi +-- +2.40.1 + diff --git a/queue-6.1/kernfs-add-stub-helper-for-kernfs_generic_poll.patch b/queue-6.1/kernfs-add-stub-helper-for-kernfs_generic_poll.patch new file mode 100644 index 00000000000..a76476474e9 --- /dev/null +++ b/queue-6.1/kernfs-add-stub-helper-for-kernfs_generic_poll.patch @@ -0,0 +1,48 @@ +From 9362d42329c8b31ed4699a99b35dc34450f6948a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 14:18:16 +0200 +Subject: kernfs: add stub helper for kernfs_generic_poll() + +From: Arnd Bergmann + +[ Upstream commit 79038a99445f69c5d28494dd4f8c6f0509f65b2e ] + +In some randconfig builds, kernfs ends up being disabled, so there is no prototype +for kernfs_generic_poll() + +In file included from kernel/sched/build_utility.c:97: +kernel/sched/psi.c:1479:3: error: implicit declaration of function 'kernfs_generic_poll' is invalid in C99 [-Werror,-Wimplicit-function-declaration] + kernfs_generic_poll(t->of, wait); + ^ + +Add a stub helper for it, as we have it for other kernfs functions. + +Fixes: aff037078ecae ("sched/psi: use kernfs polling functions for PSI trigger polling") +Fixes: 147e1a97c4a0b ("fs: kernfs: add poll file operation") +Signed-off-by: Arnd Bergmann +Reviewed-by: Chengming Zhou +Link: https://lore.kernel.org/r/20230724121823.1357562-1-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/kernfs.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h +index 73f5c120def88..2a36f3218b510 100644 +--- a/include/linux/kernfs.h ++++ b/include/linux/kernfs.h +@@ -550,6 +550,10 @@ static inline int kernfs_setattr(struct kernfs_node *kn, + const struct iattr *iattr) + { return -ENOSYS; } + ++static inline __poll_t kernfs_generic_poll(struct kernfs_open_file *of, ++ struct poll_table_struct *pt) ++{ return -ENOSYS; } ++ + static inline void kernfs_notify(struct kernfs_node *kn) { } + + static inline int kernfs_xattr_get(struct kernfs_node *kn, const char *name, +-- +2.40.1 + diff --git a/queue-6.1/kvm-vfio-ensure-kvg-instance-stays-around-in-kvm_vfi.patch b/queue-6.1/kvm-vfio-ensure-kvg-instance-stays-around-in-kvm_vfi.patch new file mode 100644 index 00000000000..adebdbbb7a8 --- /dev/null +++ b/queue-6.1/kvm-vfio-ensure-kvg-instance-stays-around-in-kvm_vfi.patch @@ -0,0 +1,55 @@ +From e4538abab83e23f2fd0cbac3a9c7965f929e9932 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jul 2023 15:45:32 -0700 +Subject: kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add() + +From: Dmitry Torokhov + +[ Upstream commit 9e0f4f2918c2ff145d3dedee862d9919a6ed5812 ] + +kvm_vfio_group_add() creates kvg instance, links it to kv->group_list, +and calls kvm_vfio_file_set_kvm() with kvg->file as an argument after +dropping kv->lock. If we race group addition and deletion calls, kvg +instance may get freed by the time we get around to calling +kvm_vfio_file_set_kvm(). + +Previous iterations of the code did not reference kvg->file outside of +the critical section, but used a temporary variable. Still, they had +similar problem of the file reference being owned by kvg structure and +potential for kvm_vfio_group_del() dropping it before +kvm_vfio_group_add() had a chance to complete. + +Fix this by moving call to kvm_vfio_file_set_kvm() under the protection +of kv->lock. We already call it while holding the same lock when vfio +group is being deleted, so it should be safe here as well. + +Fixes: 2fc1bec15883 ("kvm: set/clear kvm to/from vfio_group when group add/delete") +Reviewed-by: Alex Williamson +Signed-off-by: Dmitry Torokhov +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20230714224538.404793-1-dmitry.torokhov@gmail.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + virt/kvm/vfio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c +index af3d0cf06e4c6..365d30779768a 100644 +--- a/virt/kvm/vfio.c ++++ b/virt/kvm/vfio.c +@@ -180,10 +180,10 @@ static int kvm_vfio_file_add(struct kvm_device *dev, unsigned int fd) + list_add_tail(&kvf->node, &kv->file_list); + + kvm_arch_start_assignment(dev->kvm); ++ kvm_vfio_file_set_kvm(kvf->file, dev->kvm); + + mutex_unlock(&kv->lock); + +- kvm_vfio_file_set_kvm(kvf->file, dev->kvm); + kvm_vfio_update_coherency(dev); + + return 0; +-- +2.40.1 + diff --git a/queue-6.1/kvm-vfio-prepare-for-accepting-vfio-device-fd.patch b/queue-6.1/kvm-vfio-prepare-for-accepting-vfio-device-fd.patch new file mode 100644 index 00000000000..ba0bacbe820 --- /dev/null +++ b/queue-6.1/kvm-vfio-prepare-for-accepting-vfio-device-fd.patch @@ -0,0 +1,309 @@ +From 4efe5b9553f5efb9642e62276b2b63fdd338a069 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 06:55:29 -0700 +Subject: kvm/vfio: Prepare for accepting vfio device fd + +From: Yi Liu + +[ Upstream commit 2f99073a722beef5f74f3b0f32bda227ba3df1e0 ] + +This renames kvm_vfio_group related helpers to prepare for accepting +vfio device fd. No functional change is intended. + +Reviewed-by: Kevin Tian +Reviewed-by: Eric Auger +Reviewed-by: Jason Gunthorpe +Tested-by: Terrence Xu +Tested-by: Nicolin Chen +Tested-by: Matthew Rosato +Tested-by: Yanting Jiang +Tested-by: Shameer Kolothum +Tested-by: Zhenzhong Duan +Signed-off-by: Yi Liu +Link: https://lore.kernel.org/r/20230718135551.6592-5-yi.l.liu@intel.com +Signed-off-by: Alex Williamson +Stable-dep-of: 9e0f4f2918c2 ("kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add()") +Signed-off-by: Sasha Levin +--- + virt/kvm/vfio.c | 115 ++++++++++++++++++++++++------------------------ + 1 file changed, 58 insertions(+), 57 deletions(-) + +diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c +index 9584eb57e0eda..af3d0cf06e4c6 100644 +--- a/virt/kvm/vfio.c ++++ b/virt/kvm/vfio.c +@@ -21,7 +21,7 @@ + #include + #endif + +-struct kvm_vfio_group { ++struct kvm_vfio_file { + struct list_head node; + struct file *file; + #ifdef CONFIG_SPAPR_TCE_IOMMU +@@ -30,7 +30,7 @@ struct kvm_vfio_group { + }; + + struct kvm_vfio { +- struct list_head group_list; ++ struct list_head file_list; + struct mutex lock; + bool noncoherent; + }; +@@ -98,34 +98,35 @@ static struct iommu_group *kvm_vfio_file_iommu_group(struct file *file) + } + + static void kvm_spapr_tce_release_vfio_group(struct kvm *kvm, +- struct kvm_vfio_group *kvg) ++ struct kvm_vfio_file *kvf) + { +- if (WARN_ON_ONCE(!kvg->iommu_group)) ++ if (WARN_ON_ONCE(!kvf->iommu_group)) + return; + +- kvm_spapr_tce_release_iommu_group(kvm, kvg->iommu_group); +- iommu_group_put(kvg->iommu_group); +- kvg->iommu_group = NULL; ++ kvm_spapr_tce_release_iommu_group(kvm, kvf->iommu_group); ++ iommu_group_put(kvf->iommu_group); ++ kvf->iommu_group = NULL; + } + #endif + + /* +- * Groups can use the same or different IOMMU domains. If the same then +- * adding a new group may change the coherency of groups we've previously +- * been told about. We don't want to care about any of that so we retest +- * each group and bail as soon as we find one that's noncoherent. This +- * means we only ever [un]register_noncoherent_dma once for the whole device. ++ * Groups/devices can use the same or different IOMMU domains. If the same ++ * then adding a new group/device may change the coherency of groups/devices ++ * we've previously been told about. We don't want to care about any of ++ * that so we retest each group/device and bail as soon as we find one that's ++ * noncoherent. This means we only ever [un]register_noncoherent_dma once ++ * for the whole device. + */ + static void kvm_vfio_update_coherency(struct kvm_device *dev) + { + struct kvm_vfio *kv = dev->private; + bool noncoherent = false; +- struct kvm_vfio_group *kvg; ++ struct kvm_vfio_file *kvf; + + mutex_lock(&kv->lock); + +- list_for_each_entry(kvg, &kv->group_list, node) { +- if (!kvm_vfio_file_enforced_coherent(kvg->file)) { ++ list_for_each_entry(kvf, &kv->file_list, node) { ++ if (!kvm_vfio_file_enforced_coherent(kvf->file)) { + noncoherent = true; + break; + } +@@ -143,10 +144,10 @@ static void kvm_vfio_update_coherency(struct kvm_device *dev) + mutex_unlock(&kv->lock); + } + +-static int kvm_vfio_group_add(struct kvm_device *dev, unsigned int fd) ++static int kvm_vfio_file_add(struct kvm_device *dev, unsigned int fd) + { + struct kvm_vfio *kv = dev->private; +- struct kvm_vfio_group *kvg; ++ struct kvm_vfio_file *kvf; + struct file *filp; + int ret; + +@@ -162,27 +163,27 @@ static int kvm_vfio_group_add(struct kvm_device *dev, unsigned int fd) + + mutex_lock(&kv->lock); + +- list_for_each_entry(kvg, &kv->group_list, node) { +- if (kvg->file == filp) { ++ list_for_each_entry(kvf, &kv->file_list, node) { ++ if (kvf->file == filp) { + ret = -EEXIST; + goto err_unlock; + } + } + +- kvg = kzalloc(sizeof(*kvg), GFP_KERNEL_ACCOUNT); +- if (!kvg) { ++ kvf = kzalloc(sizeof(*kvf), GFP_KERNEL_ACCOUNT); ++ if (!kvf) { + ret = -ENOMEM; + goto err_unlock; + } + +- kvg->file = filp; +- list_add_tail(&kvg->node, &kv->group_list); ++ kvf->file = filp; ++ list_add_tail(&kvf->node, &kv->file_list); + + kvm_arch_start_assignment(dev->kvm); + + mutex_unlock(&kv->lock); + +- kvm_vfio_file_set_kvm(kvg->file, dev->kvm); ++ kvm_vfio_file_set_kvm(kvf->file, dev->kvm); + kvm_vfio_update_coherency(dev); + + return 0; +@@ -193,10 +194,10 @@ static int kvm_vfio_group_add(struct kvm_device *dev, unsigned int fd) + return ret; + } + +-static int kvm_vfio_group_del(struct kvm_device *dev, unsigned int fd) ++static int kvm_vfio_file_del(struct kvm_device *dev, unsigned int fd) + { + struct kvm_vfio *kv = dev->private; +- struct kvm_vfio_group *kvg; ++ struct kvm_vfio_file *kvf; + struct fd f; + int ret; + +@@ -208,18 +209,18 @@ static int kvm_vfio_group_del(struct kvm_device *dev, unsigned int fd) + + mutex_lock(&kv->lock); + +- list_for_each_entry(kvg, &kv->group_list, node) { +- if (kvg->file != f.file) ++ list_for_each_entry(kvf, &kv->file_list, node) { ++ if (kvf->file != f.file) + continue; + +- list_del(&kvg->node); ++ list_del(&kvf->node); + kvm_arch_end_assignment(dev->kvm); + #ifdef CONFIG_SPAPR_TCE_IOMMU +- kvm_spapr_tce_release_vfio_group(dev->kvm, kvg); ++ kvm_spapr_tce_release_vfio_group(dev->kvm, kvf); + #endif +- kvm_vfio_file_set_kvm(kvg->file, NULL); +- fput(kvg->file); +- kfree(kvg); ++ kvm_vfio_file_set_kvm(kvf->file, NULL); ++ fput(kvf->file); ++ kfree(kvf); + ret = 0; + break; + } +@@ -234,12 +235,12 @@ static int kvm_vfio_group_del(struct kvm_device *dev, unsigned int fd) + } + + #ifdef CONFIG_SPAPR_TCE_IOMMU +-static int kvm_vfio_group_set_spapr_tce(struct kvm_device *dev, +- void __user *arg) ++static int kvm_vfio_file_set_spapr_tce(struct kvm_device *dev, ++ void __user *arg) + { + struct kvm_vfio_spapr_tce param; + struct kvm_vfio *kv = dev->private; +- struct kvm_vfio_group *kvg; ++ struct kvm_vfio_file *kvf; + struct fd f; + int ret; + +@@ -254,20 +255,20 @@ static int kvm_vfio_group_set_spapr_tce(struct kvm_device *dev, + + mutex_lock(&kv->lock); + +- list_for_each_entry(kvg, &kv->group_list, node) { +- if (kvg->file != f.file) ++ list_for_each_entry(kvf, &kv->file_list, node) { ++ if (kvf->file != f.file) + continue; + +- if (!kvg->iommu_group) { +- kvg->iommu_group = kvm_vfio_file_iommu_group(kvg->file); +- if (WARN_ON_ONCE(!kvg->iommu_group)) { ++ if (!kvf->iommu_group) { ++ kvf->iommu_group = kvm_vfio_file_iommu_group(kvf->file); ++ if (WARN_ON_ONCE(!kvf->iommu_group)) { + ret = -EIO; + goto err_fdput; + } + } + + ret = kvm_spapr_tce_attach_iommu_group(dev->kvm, param.tablefd, +- kvg->iommu_group); ++ kvf->iommu_group); + break; + } + +@@ -278,8 +279,8 @@ static int kvm_vfio_group_set_spapr_tce(struct kvm_device *dev, + } + #endif + +-static int kvm_vfio_set_group(struct kvm_device *dev, long attr, +- void __user *arg) ++static int kvm_vfio_set_file(struct kvm_device *dev, long attr, ++ void __user *arg) + { + int32_t __user *argp = arg; + int32_t fd; +@@ -288,16 +289,16 @@ static int kvm_vfio_set_group(struct kvm_device *dev, long attr, + case KVM_DEV_VFIO_GROUP_ADD: + if (get_user(fd, argp)) + return -EFAULT; +- return kvm_vfio_group_add(dev, fd); ++ return kvm_vfio_file_add(dev, fd); + + case KVM_DEV_VFIO_GROUP_DEL: + if (get_user(fd, argp)) + return -EFAULT; +- return kvm_vfio_group_del(dev, fd); ++ return kvm_vfio_file_del(dev, fd); + + #ifdef CONFIG_SPAPR_TCE_IOMMU + case KVM_DEV_VFIO_GROUP_SET_SPAPR_TCE: +- return kvm_vfio_group_set_spapr_tce(dev, arg); ++ return kvm_vfio_file_set_spapr_tce(dev, arg); + #endif + } + +@@ -309,8 +310,8 @@ static int kvm_vfio_set_attr(struct kvm_device *dev, + { + switch (attr->group) { + case KVM_DEV_VFIO_GROUP: +- return kvm_vfio_set_group(dev, attr->attr, +- u64_to_user_ptr(attr->addr)); ++ return kvm_vfio_set_file(dev, attr->attr, ++ u64_to_user_ptr(attr->addr)); + } + + return -ENXIO; +@@ -339,16 +340,16 @@ static int kvm_vfio_has_attr(struct kvm_device *dev, + static void kvm_vfio_release(struct kvm_device *dev) + { + struct kvm_vfio *kv = dev->private; +- struct kvm_vfio_group *kvg, *tmp; ++ struct kvm_vfio_file *kvf, *tmp; + +- list_for_each_entry_safe(kvg, tmp, &kv->group_list, node) { ++ list_for_each_entry_safe(kvf, tmp, &kv->file_list, node) { + #ifdef CONFIG_SPAPR_TCE_IOMMU +- kvm_spapr_tce_release_vfio_group(dev->kvm, kvg); ++ kvm_spapr_tce_release_vfio_group(dev->kvm, kvf); + #endif +- kvm_vfio_file_set_kvm(kvg->file, NULL); +- fput(kvg->file); +- list_del(&kvg->node); +- kfree(kvg); ++ kvm_vfio_file_set_kvm(kvf->file, NULL); ++ fput(kvf->file); ++ list_del(&kvf->node); ++ kfree(kvf); + kvm_arch_end_assignment(dev->kvm); + } + +@@ -382,7 +383,7 @@ static int kvm_vfio_create(struct kvm_device *dev, u32 type) + if (!kv) + return -ENOMEM; + +- INIT_LIST_HEAD(&kv->group_list); ++ INIT_LIST_HEAD(&kv->file_list); + mutex_init(&kv->lock); + + dev->private = kv; +-- +2.40.1 + diff --git a/queue-6.1/leds-fix-bug_on-check-for-led_color_id_multi-that-is.patch b/queue-6.1/leds-fix-bug_on-check-for-led_color_id_multi-that-is.patch new file mode 100644 index 00000000000..acec3bcdedb --- /dev/null +++ b/queue-6.1/leds-fix-bug_on-check-for-led_color_id_multi-that-is.patch @@ -0,0 +1,54 @@ +From 810695d072c17cdcbe1158c1d6aed941e158f625 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Aug 2023 17:16:23 +0200 +Subject: leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit c3f853184bed04105682383c2971798c572226b5 ] + +At the time we call + BUG_ON(props.color == LED_COLOR_ID_MULTI); +the props variable is still initialized to zero. + +Call the BUG_ON only after we parse fwnode into props. + +Fixes: 77dce3a22e89 ("leds: disallow /sys/class/leds/*:multi:* for now") +Signed-off-by: Marek Behún +Link: https://lore.kernel.org/r/20230801151623.30387-1-kabel@kernel.org +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/led-core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c +index 4a97cb7457888..aad8bc44459fe 100644 +--- a/drivers/leds/led-core.c ++++ b/drivers/leds/led-core.c +@@ -419,15 +419,15 @@ int led_compose_name(struct device *dev, struct led_init_data *init_data, + struct fwnode_handle *fwnode = init_data->fwnode; + const char *devicename = init_data->devicename; + +- /* We want to label LEDs that can produce full range of colors +- * as RGB, not multicolor */ +- BUG_ON(props.color == LED_COLOR_ID_MULTI); +- + if (!led_classdev_name) + return -EINVAL; + + led_parse_fwnode_props(dev, fwnode, &props); + ++ /* We want to label LEDs that can produce full range of colors ++ * as RGB, not multicolor */ ++ BUG_ON(props.color == LED_COLOR_ID_MULTI); ++ + if (props.label) { + /* + * If init_data.devicename is NULL, then it indicates that +-- +2.40.1 + diff --git a/queue-6.1/leds-multicolor-use-rounded-division-when-calculatin.patch b/queue-6.1/leds-multicolor-use-rounded-division-when-calculatin.patch new file mode 100644 index 00000000000..9d9097afc4f --- /dev/null +++ b/queue-6.1/leds-multicolor-use-rounded-division-when-calculatin.patch @@ -0,0 +1,68 @@ +From 3c7107ae2687c69507a98b7252eaa72b85fc6131 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Aug 2023 14:49:31 +0200 +Subject: leds: multicolor: Use rounded division when calculating color + components +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 065d099f1be58187e6629273c50b948a02b7e1bf ] + +Given channel intensity, LED brightness and max LED brightness, the +multicolor LED framework helper led_mc_calc_color_components() computes +the color channel brightness as + + chan_brightness = brightness * chan_intensity / max_brightness + +Consider the situation when (brightness, intensity, max_brightness) is +for example (16, 15, 255), then chan_brightness is computed to 0 +although the fractional divison would give 0.94, which should be rounded +to 1. + +Use DIV_ROUND_CLOSEST here for the division to give more realistic +component computation: + + chan_brightness = DIV_ROUND_CLOSEST(brightness * chan_intensity, + max_brightness) + +Fixes: 55d5d3b46b08 ("leds: multicolor: Introduce a multicolor class definition") +Signed-off-by: Marek Behún +Link: https://lore.kernel.org/r/20230801124931.8661-1-kabel@kernel.org +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/led-class-multicolor.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/leds/led-class-multicolor.c b/drivers/leds/led-class-multicolor.c +index e317408583df9..ec62a48116135 100644 +--- a/drivers/leds/led-class-multicolor.c ++++ b/drivers/leds/led-class-multicolor.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -19,9 +20,10 @@ int led_mc_calc_color_components(struct led_classdev_mc *mcled_cdev, + int i; + + for (i = 0; i < mcled_cdev->num_colors; i++) +- mcled_cdev->subled_info[i].brightness = brightness * +- mcled_cdev->subled_info[i].intensity / +- led_cdev->max_brightness; ++ mcled_cdev->subled_info[i].brightness = ++ DIV_ROUND_CLOSEST(brightness * ++ mcled_cdev->subled_info[i].intensity, ++ led_cdev->max_brightness); + + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/leds-pwm-fix-error-code-in-led_pwm_create_fwnode.patch b/queue-6.1/leds-pwm-fix-error-code-in-led_pwm_create_fwnode.patch new file mode 100644 index 00000000000..27e64a314d1 --- /dev/null +++ b/queue-6.1/leds-pwm-fix-error-code-in-led_pwm_create_fwnode.patch @@ -0,0 +1,37 @@ +From bb7190d2d415d2599885b46740f505f9bdbab065 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 09:13:34 +0300 +Subject: leds: pwm: Fix error code in led_pwm_create_fwnode() + +From: Dan Carpenter + +[ Upstream commit cadb2de2a7fd9e955381307de3eddfcc386c208e ] + +Negative -EINVAL was intended, not positive EINVAL. Fix it. + +Fixes: 95138e01275e ("leds: pwm: Make error handling more robust") +Signed-off-by: Dan Carpenter +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/a33b981a-b2c4-4dc2-b00a-626a090d2f11@moroto.mountain +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-pwm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c +index 6832180c1c54f..cc892ecd52408 100644 +--- a/drivers/leds/leds-pwm.c ++++ b/drivers/leds/leds-pwm.c +@@ -146,7 +146,7 @@ static int led_pwm_create_fwnode(struct device *dev, struct led_pwm_priv *priv) + led.name = to_of_node(fwnode)->name; + + if (!led.name) { +- ret = EINVAL; ++ ret = -EINVAL; + goto err_child_out; + } + +-- +2.40.1 + diff --git a/queue-6.1/leds-trigger-tty-do-not-use-led_on-off-constants-use.patch b/queue-6.1/leds-trigger-tty-do-not-use-led_on-off-constants-use.patch new file mode 100644 index 00000000000..5a7bc505e55 --- /dev/null +++ b/queue-6.1/leds-trigger-tty-do-not-use-led_on-off-constants-use.patch @@ -0,0 +1,78 @@ +From 08f17a898c6ce135267bdb3d13e2f91d908f1bbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Aug 2023 11:07:53 +0200 +Subject: leds: trigger: tty: Do not use LED_ON/OFF constants, use + led_blink_set_oneshot instead +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 730094577e0c37e1bc40be37cbd41f71b0a8a2a4 ] + +The tty LED trigger uses the obsolete LED_ON & LED_OFF constants when +setting LED brightness. This is bad because the LED_ON constant is equal +to 1, and so when activating the tty LED trigger on a LED class device +with max_brightness greater than 1, the LED is dimmer than it can be +(when max_brightness is 255, the LED is very dimm indeed; some devices +translate 1/255 to 0, so the LED is OFF all the time). + +Instead of directly setting brightness to a specific value, use the +led_blink_set_oneshot() function from LED core to configure the blink. +This function takes the current configured brightness as blink +brightness if not zero, and max brightness otherwise. + +This also changes the behavior of the TTY LED trigger. Previously if +rx/tx stats kept changing, the LED was ON all the time they kept +changing. With this patch the LED will blink on TTY activity. + +Fixes: fd4a641ac88f ("leds: trigger: implement a tty trigger") +Signed-off-by: Marek Behún +Link: https://lore.kernel.org/r/20230802090753.13611-1-kabel@kernel.org +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/trigger/ledtrig-tty.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/leds/trigger/ledtrig-tty.c b/drivers/leds/trigger/ledtrig-tty.c +index f62db7e520b52..8ae0d2d284aff 100644 +--- a/drivers/leds/trigger/ledtrig-tty.c ++++ b/drivers/leds/trigger/ledtrig-tty.c +@@ -7,6 +7,8 @@ + #include + #include + ++#define LEDTRIG_TTY_INTERVAL 50 ++ + struct ledtrig_tty_data { + struct led_classdev *led_cdev; + struct delayed_work dwork; +@@ -122,17 +124,19 @@ static void ledtrig_tty_work(struct work_struct *work) + + if (icount.rx != trigger_data->rx || + icount.tx != trigger_data->tx) { +- led_set_brightness_sync(trigger_data->led_cdev, LED_ON); ++ unsigned long interval = LEDTRIG_TTY_INTERVAL; ++ ++ led_blink_set_oneshot(trigger_data->led_cdev, &interval, ++ &interval, 0); + + trigger_data->rx = icount.rx; + trigger_data->tx = icount.tx; +- } else { +- led_set_brightness_sync(trigger_data->led_cdev, LED_OFF); + } + + out: + mutex_unlock(&trigger_data->mutex); +- schedule_delayed_work(&trigger_data->dwork, msecs_to_jiffies(100)); ++ schedule_delayed_work(&trigger_data->dwork, ++ msecs_to_jiffies(LEDTRIG_TTY_INTERVAL * 2)); + } + + static struct attribute *ledtrig_tty_attrs[] = { +-- +2.40.1 + diff --git a/queue-6.1/libbpf-fix-realloc-api-handling-in-zero-sized-edge-c.patch b/queue-6.1/libbpf-fix-realloc-api-handling-in-zero-sized-edge-c.patch new file mode 100644 index 00000000000..d3d1f5c3977 --- /dev/null +++ b/queue-6.1/libbpf-fix-realloc-api-handling-in-zero-sized-edge-c.patch @@ -0,0 +1,98 @@ +From 16aa91bed74741e33804444dd5b70c45ecabec3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jul 2023 19:41:50 -0700 +Subject: libbpf: Fix realloc API handling in zero-sized edge cases + +From: Andrii Nakryiko + +[ Upstream commit 8a0260dbf6553c969248b6530cafadac46562f47 ] + +realloc() and reallocarray() can either return NULL or a special +non-NULL pointer, if their size argument is zero. This requires a bit +more care to handle NULL-as-valid-result situation differently from +NULL-as-error case. This has caused real issues before ([0]), and just +recently bit again in production when performing bpf_program__attach_usdt(). + +This patch fixes 4 places that do or potentially could suffer from this +mishandling of NULL, including the reported USDT-related one. + +There are many other places where realloc()/reallocarray() is used and +NULL is always treated as an error value, but all those have guarantees +that their size is always non-zero, so those spot don't need any extra +handling. + + [0] d08ab82f59d5 ("libbpf: Fix double-free when linker processes empty sections") + +Fixes: 999783c8bbda ("libbpf: Wire up spec management and other arch-independent USDT logic") +Fixes: b63b3c490eee ("libbpf: Add bpf_program__set_insns function") +Fixes: 697f104db8a6 ("libbpf: Support custom SEC() handlers") +Fixes: b12688267280 ("libbpf: Change the order of data and text relocations.") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20230711024150.1566433-1-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 15 ++++++++++++--- + tools/lib/bpf/usdt.c | 5 ++++- + 2 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index b9a29d1053765..eeb2693128d8a 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -6063,7 +6063,11 @@ static int append_subprog_relos(struct bpf_program *main_prog, struct bpf_progra + if (main_prog == subprog) + return 0; + relos = libbpf_reallocarray(main_prog->reloc_desc, new_cnt, sizeof(*relos)); +- if (!relos) ++ /* if new count is zero, reallocarray can return a valid NULL result; ++ * in this case the previous pointer will be freed, so we *have to* ++ * reassign old pointer to the new value (even if it's NULL) ++ */ ++ if (!relos && new_cnt) + return -ENOMEM; + if (subprog->nr_reloc) + memcpy(relos + main_prog->nr_reloc, subprog->reloc_desc, +@@ -8345,7 +8349,8 @@ int bpf_program__set_insns(struct bpf_program *prog, + return -EBUSY; + + insns = libbpf_reallocarray(prog->insns, new_insn_cnt, sizeof(*insns)); +- if (!insns) { ++ /* NULL is a valid return from reallocarray if the new count is zero */ ++ if (!insns && new_insn_cnt) { + pr_warn("prog '%s': failed to realloc prog code\n", prog->name); + return -ENOMEM; + } +@@ -8640,7 +8645,11 @@ int libbpf_unregister_prog_handler(int handler_id) + + /* try to shrink the array, but it's ok if we couldn't */ + sec_defs = libbpf_reallocarray(custom_sec_defs, custom_sec_def_cnt, sizeof(*sec_defs)); +- if (sec_defs) ++ /* if new count is zero, reallocarray can return a valid NULL result; ++ * in this case the previous pointer will be freed, so we *have to* ++ * reassign old pointer to the new value (even if it's NULL) ++ */ ++ if (sec_defs || custom_sec_def_cnt == 0) + custom_sec_defs = sec_defs; + + return 0; +diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c +index 49f3c3b7f6095..af1cb30556b46 100644 +--- a/tools/lib/bpf/usdt.c ++++ b/tools/lib/bpf/usdt.c +@@ -852,8 +852,11 @@ static int bpf_link_usdt_detach(struct bpf_link *link) + * system is so exhausted on memory, it's the least of user's + * concerns, probably. + * So just do our best here to return those IDs to usdt_manager. ++ * Another edge case when we can legitimately get NULL is when ++ * new_cnt is zero, which can happen in some edge cases, so we ++ * need to be careful about that. + */ +- if (new_free_ids) { ++ if (new_free_ids || new_cnt == 0) { + memcpy(new_free_ids + man->free_spec_cnt, usdt_link->spec_ids, + usdt_link->spec_cnt * sizeof(*usdt_link->spec_ids)); + man->free_spec_ids = new_free_ids; +-- +2.40.1 + diff --git a/queue-6.1/lwt-check-lwtunnel_xmit_continue-strictly.patch b/queue-6.1/lwt-check-lwtunnel_xmit_continue-strictly.patch new file mode 100644 index 00000000000..bc034a3ce8b --- /dev/null +++ b/queue-6.1/lwt-check-lwtunnel_xmit_continue-strictly.patch @@ -0,0 +1,78 @@ +From efbf7b2e6a7032064daed17f2edb9da734fac78e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 19:58:14 -0700 +Subject: lwt: Check LWTUNNEL_XMIT_CONTINUE strictly + +From: Yan Zhai + +[ Upstream commit a171fbec88a2c730b108c7147ac5e7b2f5a02b47 ] + +LWTUNNEL_XMIT_CONTINUE is implicitly assumed in ip(6)_finish_output2, +such that any positive return value from a xmit hook could cause +unexpected continue behavior, despite that related skb may have been +freed. This could be error-prone for future xmit hook ops. One of the +possible errors is to return statuses of dst_output directly. + +To make the code safer, redefine LWTUNNEL_XMIT_CONTINUE value to +distinguish from dst_output statuses and check the continue +condition explicitly. + +Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure") +Suggested-by: Dan Carpenter +Signed-off-by: Yan Zhai +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/96b939b85eda00e8df4f7c080f770970a4c5f698.1692326837.git.yan@cloudflare.com +Signed-off-by: Sasha Levin +--- + include/net/lwtunnel.h | 5 ++++- + net/ipv4/ip_output.c | 2 +- + net/ipv6/ip6_output.c | 2 +- + 3 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h +index 6f15e6fa154e6..53bd2d02a4f0d 100644 +--- a/include/net/lwtunnel.h ++++ b/include/net/lwtunnel.h +@@ -16,9 +16,12 @@ + #define LWTUNNEL_STATE_INPUT_REDIRECT BIT(1) + #define LWTUNNEL_STATE_XMIT_REDIRECT BIT(2) + ++/* LWTUNNEL_XMIT_CONTINUE should be distinguishable from dst_output return ++ * values (NET_XMIT_xxx and NETDEV_TX_xxx in linux/netdevice.h) for safety. ++ */ + enum { + LWTUNNEL_XMIT_DONE, +- LWTUNNEL_XMIT_CONTINUE, ++ LWTUNNEL_XMIT_CONTINUE = 0x100, + }; + + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index acfe58d2f1dd7..ebd2cea5b7d7a 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -214,7 +214,7 @@ static int ip_finish_output2(struct net *net, struct sock *sk, struct sk_buff *s + if (lwtunnel_xmit_redirect(dst->lwtstate)) { + int res = lwtunnel_xmit(skb); + +- if (res < 0 || res == LWTUNNEL_XMIT_DONE) ++ if (res != LWTUNNEL_XMIT_CONTINUE) + return res; + } + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 95a55c6630add..34192f7a166fb 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -112,7 +112,7 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * + if (lwtunnel_xmit_redirect(dst->lwtstate)) { + int res = lwtunnel_xmit(skb); + +- if (res < 0 || res == LWTUNNEL_XMIT_DONE) ++ if (res != LWTUNNEL_XMIT_CONTINUE) + return res; + } + +-- +2.40.1 + diff --git a/queue-6.1/lwt-fix-return-values-of-bpf-xmit-ops.patch b/queue-6.1/lwt-fix-return-values-of-bpf-xmit-ops.patch new file mode 100644 index 00000000000..23c535f8a9f --- /dev/null +++ b/queue-6.1/lwt-fix-return-values-of-bpf-xmit-ops.patch @@ -0,0 +1,63 @@ +From cab138712e1ae2126ec9082e53806beac818ed99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 19:58:11 -0700 +Subject: lwt: Fix return values of BPF xmit ops + +From: Yan Zhai + +[ Upstream commit 29b22badb7a84b783e3a4fffca16f7768fb31205 ] + +BPF encap ops can return different types of positive values, such like +NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function +skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return +values would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in +ip(6)_finish_output2. When this happens, skbs that have been freed would +continue to the neighbor subsystem, causing use-after-free bug and +kernel crashes. + +To fix the incorrect behavior, skb_do_redirect return values can be +simply discarded, the same as tc-egress behavior. On the other hand, +bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU +information. Thus convert its return values to avoid the conflict with +LWTUNNEL_XMIT_CONTINUE. + +Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure") +Reported-by: Jordan Griege +Suggested-by: Martin KaFai Lau +Suggested-by: Stanislav Fomichev +Signed-off-by: Yan Zhai +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/0d2b878186cfe215fec6b45769c1cd0591d3628d.1692326837.git.yan@cloudflare.com +Signed-off-by: Sasha Levin +--- + net/core/lwt_bpf.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c +index 8b6b5e72b2179..4a0797f0a154b 100644 +--- a/net/core/lwt_bpf.c ++++ b/net/core/lwt_bpf.c +@@ -60,9 +60,8 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt, + ret = BPF_OK; + } else { + skb_reset_mac_header(skb); +- ret = skb_do_redirect(skb); +- if (ret == 0) +- ret = BPF_REDIRECT; ++ skb_do_redirect(skb); ++ ret = BPF_REDIRECT; + } + break; + +@@ -255,7 +254,7 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb) + + err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb); + if (unlikely(err)) +- return err; ++ return net_xmit_errno(err); + + /* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */ + return LWTUNNEL_XMIT_DONE; +-- +2.40.1 + diff --git a/queue-6.1/mac80211-make-ieee80211_tx_info-padding-explicit.patch b/queue-6.1/mac80211-make-ieee80211_tx_info-padding-explicit.patch new file mode 100644 index 00000000000..771361e6ec5 --- /dev/null +++ b/queue-6.1/mac80211-make-ieee80211_tx_info-padding-explicit.patch @@ -0,0 +1,61 @@ +From 0438d6d7c90db8a37bab5291e79407933d75bd42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 17:24:00 +0200 +Subject: mac80211: make ieee80211_tx_info padding explicit + +From: Arnd Bergmann + +[ Upstream commit a7a2ef0c4b3efbd7d6f3fabd87dbbc0b3f2de5af ] + +While looking at a bug, I got rather confused by the layout of the +'status' field in ieee80211_tx_info. Apparently, the intention is that +status_driver_data[] is used for driver specific data, and fills up the +size of the union to 40 bytes, just like the other ones. + +This is indeed what actually happens, but only because of the +combination of two mistakes: + + - "void *status_driver_data[18 / sizeof(void *)];" is intended + to be 18 bytes long but is actually two bytes shorter because of + rounding-down in the division, to a multiple of the pointer + size (4 bytes or 8 bytes). + + - The other fields combined are intended to be 22 bytes long, but + are actually 24 bytes because of padding in front of the + unaligned tx_time member, and in front of the pointer array. + +The two mistakes cancel out. so the size ends up fine, but it seems +more helpful to make this explicit, by having a multiple of 8 bytes +in the size calculation and explicitly describing the padding. + +Fixes: ea5907db2a9cc ("mac80211: fix struct ieee80211_tx_info size") +Fixes: 02219b3abca59 ("mac80211: add WMM admission control support") +Signed-off-by: Arnd Bergmann +Reviewed-by: Kees Cook +Link: https://lore.kernel.org/r/20230623152443.2296825-2-arnd@kernel.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + include/net/mac80211.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/include/net/mac80211.h b/include/net/mac80211.h +index 8a338c33118f9..43173204d6d5e 100644 +--- a/include/net/mac80211.h ++++ b/include/net/mac80211.h +@@ -1141,9 +1141,11 @@ struct ieee80211_tx_info { + u8 ampdu_ack_len; + u8 ampdu_len; + u8 antenna; ++ u8 pad; + u16 tx_time; + u8 flags; +- void *status_driver_data[18 / sizeof(void *)]; ++ u8 pad2; ++ void *status_driver_data[16 / sizeof(void *)]; + } status; + struct { + struct ieee80211_tx_rate driver_rates[ +-- +2.40.1 + diff --git a/queue-6.1/md-add-error_handlers-for-raid0-and-linear.patch b/queue-6.1/md-add-error_handlers-for-raid0-and-linear.patch new file mode 100644 index 00000000000..4a0f6e6785a --- /dev/null +++ b/queue-6.1/md-add-error_handlers-for-raid0-and-linear.patch @@ -0,0 +1,150 @@ +From a8968ec2531764605e9fa2ef5212161ac782fd6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 14:03:17 +0100 +Subject: md: add error_handlers for raid0 and linear + +From: Mariusz Tkaczyk + +[ Upstream commit c31fea2f8e2a72c817f318016bbc327095175a9f ] + +After the commit 9631abdbf406c("md: Set MD_BROKEN for RAID1 and RAID10") +MD_BROKEN must be set if array is failed because state_store() checks it. +If it is set then -EBUSY is returned to userspace. + +For raid0 and linear MD_BROKEN is not set by error_handler(). As a result +mdadm is unable to trigger clean-up actions. It is a regression. + +This patch adds appropriate error_handler for raid0 and linear. The +error handler sets MD_BROKEN for this device. + +Reviewed-by: Xiao Ni +Signed-off-by: Mariusz Tkaczyk +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230306130317.3418-1-mariusz.tkaczyk@linux.intel.com +Stable-dep-of: 319ff40a5427 ("md/raid0: Fix performance regression for large sequential writes") +Signed-off-by: Sasha Levin +--- + drivers/md/md-linear.c | 14 +++++++++++++- + drivers/md/md.c | 3 +++ + drivers/md/md.h | 10 ++-------- + drivers/md/raid0.c | 14 +++++++++++++- + 4 files changed, 31 insertions(+), 10 deletions(-) + +diff --git a/drivers/md/md-linear.c b/drivers/md/md-linear.c +index 6e7797b4e7381..4eb72b9dd9336 100644 +--- a/drivers/md/md-linear.c ++++ b/drivers/md/md-linear.c +@@ -223,7 +223,8 @@ static bool linear_make_request(struct mddev *mddev, struct bio *bio) + bio_sector < start_sector)) + goto out_of_bounds; + +- if (unlikely(is_mddev_broken(tmp_dev->rdev, "linear"))) { ++ if (unlikely(is_rdev_broken(tmp_dev->rdev))) { ++ md_error(mddev, tmp_dev->rdev); + bio_io_error(bio); + return true; + } +@@ -270,6 +271,16 @@ static void linear_status (struct seq_file *seq, struct mddev *mddev) + seq_printf(seq, " %dk rounding", mddev->chunk_sectors / 2); + } + ++static void linear_error(struct mddev *mddev, struct md_rdev *rdev) ++{ ++ if (!test_and_set_bit(MD_BROKEN, &mddev->flags)) { ++ char *md_name = mdname(mddev); ++ ++ pr_crit("md/linear%s: Disk failure on %pg detected, failing array.\n", ++ md_name, rdev->bdev); ++ } ++} ++ + static void linear_quiesce(struct mddev *mddev, int state) + { + } +@@ -286,6 +297,7 @@ static struct md_personality linear_personality = + .hot_add_disk = linear_add, + .size = linear_size, + .quiesce = linear_quiesce, ++ .error_handler = linear_error, + }; + + static int __init linear_init (void) +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 443837fe6291e..b65d8bf54924b 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -7992,6 +7992,9 @@ void md_error(struct mddev *mddev, struct md_rdev *rdev) + return; + mddev->pers->error_handler(mddev, rdev); + ++ if (mddev->pers->level == 0 || mddev->pers->level == LEVEL_LINEAR) ++ return; ++ + if (mddev->degraded && !test_bit(MD_BROKEN, &mddev->flags)) + set_bit(MD_RECOVERY_RECOVER, &mddev->recovery); + sysfs_notify_dirent_safe(rdev->sysfs_state); +diff --git a/drivers/md/md.h b/drivers/md/md.h +index 64f8182a3dfc6..4f0b480974552 100644 +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -790,15 +790,9 @@ extern void mddev_destroy_serial_pool(struct mddev *mddev, struct md_rdev *rdev, + struct md_rdev *md_find_rdev_nr_rcu(struct mddev *mddev, int nr); + struct md_rdev *md_find_rdev_rcu(struct mddev *mddev, dev_t dev); + +-static inline bool is_mddev_broken(struct md_rdev *rdev, const char *md_type) ++static inline bool is_rdev_broken(struct md_rdev *rdev) + { +- if (!disk_live(rdev->bdev->bd_disk)) { +- if (!test_and_set_bit(MD_BROKEN, &rdev->mddev->flags)) +- pr_warn("md: %s: %s array has a missing/failed member\n", +- mdname(rdev->mddev), md_type); +- return true; +- } +- return false; ++ return !disk_live(rdev->bdev->bd_disk); + } + + static inline void rdev_dec_pending(struct md_rdev *rdev, struct mddev *mddev) +diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c +index 0f7c3b3c62b25..d1ac73fcd8529 100644 +--- a/drivers/md/raid0.c ++++ b/drivers/md/raid0.c +@@ -615,8 +615,9 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio) + return true; + } + +- if (unlikely(is_mddev_broken(tmp_dev, "raid0"))) { ++ if (unlikely(is_rdev_broken(tmp_dev))) { + bio_io_error(bio); ++ md_error(mddev, tmp_dev); + return true; + } + +@@ -638,6 +639,16 @@ static void raid0_status(struct seq_file *seq, struct mddev *mddev) + return; + } + ++static void raid0_error(struct mddev *mddev, struct md_rdev *rdev) ++{ ++ if (!test_and_set_bit(MD_BROKEN, &mddev->flags)) { ++ char *md_name = mdname(mddev); ++ ++ pr_crit("md/raid0%s: Disk failure on %pg detected, failing array.\n", ++ md_name, rdev->bdev); ++ } ++} ++ + static void *raid0_takeover_raid45(struct mddev *mddev) + { + struct md_rdev *rdev; +@@ -813,6 +824,7 @@ static struct md_personality raid0_personality= + .size = raid0_size, + .takeover = raid0_takeover, + .quiesce = raid0_quiesce, ++ .error_handler = raid0_error, + }; + + static int __init raid0_init (void) +-- +2.40.1 + diff --git a/queue-6.1/md-change-active_io-to-percpu.patch b/queue-6.1/md-change-active_io-to-percpu.patch new file mode 100644 index 00000000000..acef2fcf43c --- /dev/null +++ b/queue-6.1/md-change-active_io-to-percpu.patch @@ -0,0 +1,188 @@ +From 7f91ab075307b8f79effb31c3a45b631f0a8be22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 13:17:10 +0800 +Subject: md: Change active_io to percpu + +From: Xiao Ni + +[ Upstream commit 72adae23a72cb12e2ef0dcd7c0aa042867f27998 ] + +Now the type of active_io is atomic. It's used to count how many ios are +in the submitting process and it's added and decreased very time. But it +only needs to check if it's zero when suspending the raid. So we can +switch atomic to percpu to improve the performance. + +After switching active_io to percpu type, we use the state of active_io +to judge if the raid device is suspended. And we don't need to wake up +->sb_wait in md_handle_request anymore. It's done in the callback function +which is registered when initing active_io. The argument mddev->suspended +is only used to count how many users are trying to set raid to suspend +state. + +Signed-off-by: Xiao Ni +Signed-off-by: Song Liu +Stable-dep-of: e24ed04389f9 ("md: restore 'noio_flag' for the last mddev_resume()") +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 43 ++++++++++++++++++++++++------------------- + drivers/md/md.h | 2 +- + 2 files changed, 25 insertions(+), 20 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index abb6c03c85b29..1c44294c625a4 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -370,10 +370,7 @@ static DEFINE_SPINLOCK(all_mddevs_lock); + + static bool is_md_suspended(struct mddev *mddev) + { +- if (mddev->suspended) +- return true; +- else +- return false; ++ return percpu_ref_is_dying(&mddev->active_io); + } + /* Rather than calling directly into the personality make_request function, + * IO requests come here first so that we can check if the device is +@@ -400,12 +397,10 @@ static bool is_suspended(struct mddev *mddev, struct bio *bio) + void md_handle_request(struct mddev *mddev, struct bio *bio) + { + check_suspended: +- rcu_read_lock(); + if (is_suspended(mddev, bio)) { + DEFINE_WAIT(__wait); + /* Bail out if REQ_NOWAIT is set for the bio */ + if (bio->bi_opf & REQ_NOWAIT) { +- rcu_read_unlock(); + bio_wouldblock_error(bio); + return; + } +@@ -414,23 +409,19 @@ void md_handle_request(struct mddev *mddev, struct bio *bio) + TASK_UNINTERRUPTIBLE); + if (!is_suspended(mddev, bio)) + break; +- rcu_read_unlock(); + schedule(); +- rcu_read_lock(); + } + finish_wait(&mddev->sb_wait, &__wait); + } +- atomic_inc(&mddev->active_io); +- rcu_read_unlock(); ++ if (!percpu_ref_tryget_live(&mddev->active_io)) ++ goto check_suspended; + + if (!mddev->pers->make_request(mddev, bio)) { +- atomic_dec(&mddev->active_io); +- wake_up(&mddev->sb_wait); ++ percpu_ref_put(&mddev->active_io); + goto check_suspended; + } + +- if (atomic_dec_and_test(&mddev->active_io) && is_md_suspended(mddev)) +- wake_up(&mddev->sb_wait); ++ percpu_ref_put(&mddev->active_io); + } + EXPORT_SYMBOL(md_handle_request); + +@@ -478,11 +469,10 @@ void mddev_suspend(struct mddev *mddev) + lockdep_assert_held(&mddev->reconfig_mutex); + if (mddev->suspended++) + return; +- synchronize_rcu(); + wake_up(&mddev->sb_wait); + set_bit(MD_ALLOW_SB_UPDATE, &mddev->flags); +- smp_mb__after_atomic(); +- wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0); ++ percpu_ref_kill(&mddev->active_io); ++ wait_event(mddev->sb_wait, percpu_ref_is_zero(&mddev->active_io)); + mddev->pers->quiesce(mddev, 1); + clear_bit_unlock(MD_ALLOW_SB_UPDATE, &mddev->flags); + wait_event(mddev->sb_wait, !test_bit(MD_UPDATING_SB, &mddev->flags)); +@@ -500,6 +490,7 @@ void mddev_resume(struct mddev *mddev) + lockdep_assert_held(&mddev->reconfig_mutex); + if (--mddev->suspended) + return; ++ percpu_ref_resurrect(&mddev->active_io); + wake_up(&mddev->sb_wait); + mddev->pers->quiesce(mddev, 0); + +@@ -678,7 +669,6 @@ void mddev_init(struct mddev *mddev) + timer_setup(&mddev->safemode_timer, md_safemode_timeout, 0); + atomic_set(&mddev->active, 1); + atomic_set(&mddev->openers, 0); +- atomic_set(&mddev->active_io, 0); + spin_lock_init(&mddev->lock); + atomic_set(&mddev->flush_pending, 0); + init_waitqueue_head(&mddev->sb_wait); +@@ -5786,6 +5776,12 @@ static void md_safemode_timeout(struct timer_list *t) + } + + static int start_dirty_degraded; ++static void active_io_release(struct percpu_ref *ref) ++{ ++ struct mddev *mddev = container_of(ref, struct mddev, active_io); ++ ++ wake_up(&mddev->sb_wait); ++} + + int md_run(struct mddev *mddev) + { +@@ -5866,10 +5862,15 @@ int md_run(struct mddev *mddev) + nowait = nowait && bdev_nowait(rdev->bdev); + } + ++ err = percpu_ref_init(&mddev->active_io, active_io_release, ++ PERCPU_REF_ALLOW_REINIT, GFP_KERNEL); ++ if (err) ++ return err; ++ + if (!bioset_initialized(&mddev->bio_set)) { + err = bioset_init(&mddev->bio_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS); + if (err) +- return err; ++ goto exit_active_io; + } + if (!bioset_initialized(&mddev->sync_set)) { + err = bioset_init(&mddev->sync_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS); +@@ -6057,6 +6058,8 @@ int md_run(struct mddev *mddev) + bioset_exit(&mddev->sync_set); + exit_bio_set: + bioset_exit(&mddev->bio_set); ++exit_active_io: ++ percpu_ref_exit(&mddev->active_io); + return err; + } + EXPORT_SYMBOL_GPL(md_run); +@@ -6283,6 +6286,7 @@ void md_stop(struct mddev *mddev) + */ + __md_stop_writes(mddev); + __md_stop(mddev); ++ percpu_ref_exit(&mddev->active_io); + bioset_exit(&mddev->bio_set); + bioset_exit(&mddev->sync_set); + } +@@ -7852,6 +7856,7 @@ static void md_free_disk(struct gendisk *disk) + struct mddev *mddev = disk->private_data; + + percpu_ref_exit(&mddev->writes_pending); ++ percpu_ref_exit(&mddev->active_io); + bioset_exit(&mddev->bio_set); + bioset_exit(&mddev->sync_set); + +diff --git a/drivers/md/md.h b/drivers/md/md.h +index b4e2d8b87b611..64f8182a3dfc6 100644 +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -315,7 +315,7 @@ struct mddev { + unsigned long sb_flags; + + int suspended; +- atomic_t active_io; ++ struct percpu_ref active_io; + int ro; + int sysfs_active; /* set when sysfs deletes + * are happening, so run/ +-- +2.40.1 + diff --git a/queue-6.1/md-factor-out-is_md_suspended-helper.patch b/queue-6.1/md-factor-out-is_md_suspended-helper.patch new file mode 100644 index 00000000000..b4f29e3f8f1 --- /dev/null +++ b/queue-6.1/md-factor-out-is_md_suspended-helper.patch @@ -0,0 +1,86 @@ +From 8c11edfb4d4ffa1268f57ad77df4193d1ac0373f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 13:17:09 +0800 +Subject: md: Factor out is_md_suspended helper + +From: Xiao Ni + +[ Upstream commit d19329133d25ad3dc32f8a62635692cb2f189014 ] + +This helper function will be used in next patch. It's easy for +understanding. + +Signed-off-by: Xiao Ni +Signed-off-by: Song Liu +Stable-dep-of: e24ed04389f9 ("md: restore 'noio_flag' for the last mddev_resume()") +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 45daba0eb9310..abb6c03c85b29 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -368,6 +368,13 @@ EXPORT_SYMBOL_GPL(md_new_event); + static LIST_HEAD(all_mddevs); + static DEFINE_SPINLOCK(all_mddevs_lock); + ++static bool is_md_suspended(struct mddev *mddev) ++{ ++ if (mddev->suspended) ++ return true; ++ else ++ return false; ++} + /* Rather than calling directly into the personality make_request function, + * IO requests come here first so that we can check if the device is + * being suspended pending a reconfiguration. +@@ -377,7 +384,7 @@ static DEFINE_SPINLOCK(all_mddevs_lock); + */ + static bool is_suspended(struct mddev *mddev, struct bio *bio) + { +- if (mddev->suspended) ++ if (is_md_suspended(mddev)) + return true; + if (bio_data_dir(bio) != WRITE) + return false; +@@ -422,7 +429,7 @@ void md_handle_request(struct mddev *mddev, struct bio *bio) + goto check_suspended; + } + +- if (atomic_dec_and_test(&mddev->active_io) && mddev->suspended) ++ if (atomic_dec_and_test(&mddev->active_io) && is_md_suspended(mddev)) + wake_up(&mddev->sb_wait); + } + EXPORT_SYMBOL(md_handle_request); +@@ -6238,7 +6245,7 @@ EXPORT_SYMBOL_GPL(md_stop_writes); + static void mddev_detach(struct mddev *mddev) + { + md_bitmap_wait_behind_writes(mddev); +- if (mddev->pers && mddev->pers->quiesce && !mddev->suspended) { ++ if (mddev->pers && mddev->pers->quiesce && !is_md_suspended(mddev)) { + mddev->pers->quiesce(mddev, 1); + mddev->pers->quiesce(mddev, 0); + } +@@ -8548,7 +8555,7 @@ bool md_write_start(struct mddev *mddev, struct bio *bi) + return true; + wait_event(mddev->sb_wait, + !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags) || +- mddev->suspended); ++ is_md_suspended(mddev)); + if (test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags)) { + percpu_ref_put(&mddev->writes_pending); + return false; +@@ -9276,7 +9283,7 @@ void md_check_recovery(struct mddev *mddev) + wake_up(&mddev->sb_wait); + } + +- if (mddev->suspended) ++ if (is_md_suspended(mddev)) + return; + + if (mddev->bitmap) +-- +2.40.1 + diff --git a/queue-6.1/md-md-bitmap-hold-reconfig_mutex-in-backlog_store.patch b/queue-6.1/md-md-bitmap-hold-reconfig_mutex-in-backlog_store.patch new file mode 100644 index 00000000000..c4c21d30bb5 --- /dev/null +++ b/queue-6.1/md-md-bitmap-hold-reconfig_mutex-in-backlog_store.patch @@ -0,0 +1,62 @@ +From 718989d7aea3cb9168a554d04b6fcfee80a92464 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 16:37:27 +0800 +Subject: md/md-bitmap: hold 'reconfig_mutex' in backlog_store() + +From: Yu Kuai + +[ Upstream commit 44abfa6a95df425c0660d56043020b67e6d93ab8 ] + +Several reasons why 'reconfig_mutex' should be held: + +1) rdev_for_each() is not safe to be called without the lock, because + rdev can be removed concurrently. +2) mddev_destroy_serial_pool() and mddev_create_serial_pool() should not + be called concurrently. +3) mddev_suspend() from mddev_destroy/create_serial_pool() should be + protected by the lock. + +Fixes: 10c92fca636e ("md-bitmap: create and destroy wb_info_pool with the change of backlog") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20230706083727.608914-3-yukuai1@huaweicloud.com +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index 8553f028825a1..5200bba63708e 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -2481,6 +2481,10 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len) + if (backlog > COUNTER_MAX) + return -EINVAL; + ++ rv = mddev_lock(mddev); ++ if (rv) ++ return rv; ++ + /* + * Without write mostly device, it doesn't make sense to set + * backlog for max_write_behind. +@@ -2494,6 +2498,7 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len) + if (!has_write_mostly) { + pr_warn_ratelimited("%s: can't set backlog, no write mostly device available\n", + mdname(mddev)); ++ mddev_unlock(mddev); + return -EINVAL; + } + +@@ -2509,6 +2514,8 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len) + } + if (old_mwb != backlog) + md_bitmap_update_sb(mddev->bitmap); ++ ++ mddev_unlock(mddev); + return len; + } + +-- +2.40.1 + diff --git a/queue-6.1/md-md-bitmap-remove-unnecessary-local-variable-in-ba.patch b/queue-6.1/md-md-bitmap-remove-unnecessary-local-variable-in-ba.patch new file mode 100644 index 00000000000..9c3ca09cd1b --- /dev/null +++ b/queue-6.1/md-md-bitmap-remove-unnecessary-local-variable-in-ba.patch @@ -0,0 +1,37 @@ +From 992bff30b0150e7c8781437b4806dfe5e9538c00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 16:37:26 +0800 +Subject: md/md-bitmap: remove unnecessary local variable in backlog_store() + +From: Yu Kuai + +[ Upstream commit b4d129640f194ffc4cc64c3e97f98ae944c072e8 ] + +Local variable is definied first in the beginning of backlog_store(), +there is no need to define it again. + +Fixes: 8c13ab115b57 ("md/bitmap: don't set max_write_behind if there is no write mostly device") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20230706083727.608914-2-yukuai1@huaweicloud.com +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index 8bbeeec70905c..8553f028825a1 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -2504,8 +2504,6 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len) + mddev_destroy_serial_pool(mddev, NULL, false); + } else if (backlog && !mddev->serial_info_pool) { + /* serial_info_pool is needed since backlog is not zero */ +- struct md_rdev *rdev; +- + rdev_for_each(rdev, mddev) + mddev_create_serial_pool(mddev, rdev, false); + } +-- +2.40.1 + diff --git a/queue-6.1/md-raid0-account-for-split-bio-in-iostat-accounting.patch b/queue-6.1/md-raid0-account-for-split-bio-in-iostat-accounting.patch new file mode 100644 index 00000000000..733112b538c --- /dev/null +++ b/queue-6.1/md-raid0-account-for-split-bio-in-iostat-accounting.patch @@ -0,0 +1,73 @@ +From 73edd32c23caa7b92cbdb5c0d6d730f1e879e4d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Aug 2023 14:13:55 -0400 +Subject: md: raid0: account for split bio in iostat accounting + +From: David Jeffery + +[ Upstream commit cc22b5407e9ca76adb7efeed843146510b1b72a5 ] + +When a bio is split by md raid0, the newly created bio will not be tracked +by md for I/O accounting. Only the portion of I/O still assigned to the +original bio which was reduced by the split will be accounted for. This +results in md iostat data sometimes showing I/O values far below the actual +amount of data being sent through md. + +md_account_bio() needs to be called for all bio generated by the bio split. + +A simple example of the issue was generated using a raid0 device on partitions +to the same device. Since all raid0 I/O then goes to one device, it makes it +easy to see a gap between the md device and its sd storage. Reading an lvm +device on top of the md device, the iostat output (some 0 columns and extra +devices removed to make the data more compact) was: + +Device tps kB_read/s kB_wrtn/s kB_dscd/s kB_read +md2 0.00 0.00 0.00 0.00 0 +sde 0.00 0.00 0.00 0.00 0 +md2 1364.00 411496.00 0.00 0.00 411496 +sde 1734.00 646144.00 0.00 0.00 646144 +md2 1699.00 510680.00 0.00 0.00 510680 +sde 2155.00 802784.00 0.00 0.00 802784 +md2 803.00 241480.00 0.00 0.00 241480 +sde 1016.00 377888.00 0.00 0.00 377888 +md2 0.00 0.00 0.00 0.00 0 +sde 0.00 0.00 0.00 0.00 0 + +I/O was generated doing large direct I/O reads (12M) with dd to a linear +lvm volume on top of the 4 leg raid0 device. + +The md2 reads were showing as roughly 2/3 of the reads to the sde device +containing all of md2's raid partitions. The sum of reads to sde was +1826816 kB, which was the expected amount as it was the amount read by +dd. With the patch, the total reads from md will match the reads from +sde and be consistent with the amount of I/O generated. + +Fixes: 10764815ff47 ("md: add io accounting for raid0 and raid5") +Signed-off-by: David Jeffery +Tested-by: Laurence Oberman +Reviewed-by: Laurence Oberman +Reviewed-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230816181433.13289-1-djeffery@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid0.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c +index 595856948dff8..7c6a0b4437d8f 100644 +--- a/drivers/md/raid0.c ++++ b/drivers/md/raid0.c +@@ -565,8 +565,7 @@ static void raid0_map_submit_bio(struct mddev *mddev, struct bio *bio) + sector_t bio_sector = bio->bi_iter.bi_sector; + sector_t sector = bio_sector; + +- if (bio->bi_pool != &mddev->bio_set) +- md_account_bio(mddev, &bio); ++ md_account_bio(mddev, &bio); + + zone = find_zone(mddev->private, §or); + switch (conf->layout) { +-- +2.40.1 + diff --git a/queue-6.1/md-raid0-factor-out-helper-for-mapping-and-submittin.patch b/queue-6.1/md-raid0-factor-out-helper-for-mapping-and-submittin.patch new file mode 100644 index 00000000000..f81e74d8ea5 --- /dev/null +++ b/queue-6.1/md-raid0-factor-out-helper-for-mapping-and-submittin.patch @@ -0,0 +1,146 @@ +From 343b68d52e70634561441b8e42cf16ff23f7ab76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 11:27:07 +0200 +Subject: md/raid0: Factor out helper for mapping and submitting a bio + +From: Jan Kara + +[ Upstream commit af50e20afb401cc203bd2a9ff62ece0ae4976103 ] + +Factor out helper function for mapping and submitting a bio out of +raid0_make_request(). We will use it later for submitting both parts of +a split bio. + +Signed-off-by: Jan Kara +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20230814092720.3931-1-jack@suse.cz +Signed-off-by: Song Liu +Stable-dep-of: 319ff40a5427 ("md/raid0: Fix performance regression for large sequential writes") +Signed-off-by: Sasha Levin +--- + drivers/md/raid0.c | 79 +++++++++++++++++++++++----------------------- + 1 file changed, 40 insertions(+), 39 deletions(-) + +diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c +index d1ac73fcd8529..d3c55f2e9b185 100644 +--- a/drivers/md/raid0.c ++++ b/drivers/md/raid0.c +@@ -557,54 +557,21 @@ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio) + bio_endio(bio); + } + +-static bool raid0_make_request(struct mddev *mddev, struct bio *bio) ++static void raid0_map_submit_bio(struct mddev *mddev, struct bio *bio) + { + struct r0conf *conf = mddev->private; + struct strip_zone *zone; + struct md_rdev *tmp_dev; +- sector_t bio_sector; +- sector_t sector; +- sector_t orig_sector; +- unsigned chunk_sects; +- unsigned sectors; +- +- if (unlikely(bio->bi_opf & REQ_PREFLUSH) +- && md_flush_request(mddev, bio)) +- return true; +- +- if (unlikely((bio_op(bio) == REQ_OP_DISCARD))) { +- raid0_handle_discard(mddev, bio); +- return true; +- } +- +- bio_sector = bio->bi_iter.bi_sector; +- sector = bio_sector; +- chunk_sects = mddev->chunk_sectors; +- +- sectors = chunk_sects - +- (likely(is_power_of_2(chunk_sects)) +- ? (sector & (chunk_sects-1)) +- : sector_div(sector, chunk_sects)); +- +- /* Restore due to sector_div */ +- sector = bio_sector; +- +- if (sectors < bio_sectors(bio)) { +- struct bio *split = bio_split(bio, sectors, GFP_NOIO, +- &mddev->bio_set); +- bio_chain(split, bio); +- submit_bio_noacct(bio); +- bio = split; +- } ++ sector_t bio_sector = bio->bi_iter.bi_sector; ++ sector_t sector = bio_sector; + + if (bio->bi_pool != &mddev->bio_set) + md_account_bio(mddev, &bio); + +- orig_sector = sector; + zone = find_zone(mddev->private, §or); + switch (conf->layout) { + case RAID0_ORIG_LAYOUT: +- tmp_dev = map_sector(mddev, zone, orig_sector, §or); ++ tmp_dev = map_sector(mddev, zone, bio_sector, §or); + break; + case RAID0_ALT_MULTIZONE_LAYOUT: + tmp_dev = map_sector(mddev, zone, sector, §or); +@@ -612,13 +579,13 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio) + default: + WARN(1, "md/raid0:%s: Invalid layout\n", mdname(mddev)); + bio_io_error(bio); +- return true; ++ return; + } + + if (unlikely(is_rdev_broken(tmp_dev))) { + bio_io_error(bio); + md_error(mddev, tmp_dev); +- return true; ++ return; + } + + bio_set_dev(bio, tmp_dev->bdev); +@@ -630,6 +597,40 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio) + bio_sector); + mddev_check_write_zeroes(mddev, bio); + submit_bio_noacct(bio); ++} ++ ++static bool raid0_make_request(struct mddev *mddev, struct bio *bio) ++{ ++ sector_t sector; ++ unsigned chunk_sects; ++ unsigned sectors; ++ ++ if (unlikely(bio->bi_opf & REQ_PREFLUSH) ++ && md_flush_request(mddev, bio)) ++ return true; ++ ++ if (unlikely((bio_op(bio) == REQ_OP_DISCARD))) { ++ raid0_handle_discard(mddev, bio); ++ return true; ++ } ++ ++ sector = bio->bi_iter.bi_sector; ++ chunk_sects = mddev->chunk_sectors; ++ ++ sectors = chunk_sects - ++ (likely(is_power_of_2(chunk_sects)) ++ ? (sector & (chunk_sects-1)) ++ : sector_div(sector, chunk_sects)); ++ ++ if (sectors < bio_sectors(bio)) { ++ struct bio *split = bio_split(bio, sectors, GFP_NOIO, ++ &mddev->bio_set); ++ bio_chain(split, bio); ++ submit_bio_noacct(bio); ++ bio = split; ++ } ++ ++ raid0_map_submit_bio(mddev, bio); + return true; + } + +-- +2.40.1 + diff --git a/queue-6.1/md-raid0-fix-performance-regression-for-large-sequen.patch b/queue-6.1/md-raid0-fix-performance-regression-for-large-sequen.patch new file mode 100644 index 00000000000..cf297f6e867 --- /dev/null +++ b/queue-6.1/md-raid0-fix-performance-regression-for-large-sequen.patch @@ -0,0 +1,91 @@ +From 99f46036c5648b6e8b5294c8f9c8438065be2b94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 11:27:08 +0200 +Subject: md/raid0: Fix performance regression for large sequential writes + +From: Jan Kara + +[ Upstream commit 319ff40a542736d67e5bce18635de35d0e7a0bff ] + +Commit f00d7c85be9e ("md/raid0: fix up bio splitting.") among other +things changed how bio that needs to be split is submitted. Before this +commit, we have split the bio, mapped and submitted each part. After +this commit, we map only the first part of the split bio and submit the +second part unmapped. Due to bio sorting in __submit_bio_noacct() this +results in the following request ordering: + + 9,0 18 1181 0.525037895 15995 Q WS 1479315464 + 63392 + + Split off chunk-sized (1024 sectors) request: + + 9,0 18 1182 0.629019647 15995 X WS 1479315464 / 1479316488 + + Request is unaligned to the chunk so it's split in + raid0_make_request(). This is the first part mapped and punted to + bio_list: + + 8,0 18 7053 0.629020455 15995 A WS 739921928 + 1016 <- (9,0) 1479315464 + + Now raid0_make_request() returns, second part is postponed on + bio_list. __submit_bio_noacct() resorts the bio_list, mapped request + is submitted to the underlying device: + + 8,0 18 7054 0.629022782 15995 G WS 739921928 + 1016 + + Now we take another request from the bio_list which is the remainder + of the original huge request. Split off another chunk-sized bit from + it and the situation repeats: + + 9,0 18 1183 0.629024499 15995 X WS 1479316488 / 1479317512 + 8,16 18 6998 0.629025110 15995 A WS 739921928 + 1016 <- (9,0) 1479316488 + 8,16 18 6999 0.629026728 15995 G WS 739921928 + 1016 + ... + 9,0 18 1184 0.629032940 15995 X WS 1479317512 / 1479318536 [libnetacq-write] + 8,0 18 7059 0.629033294 15995 A WS 739922952 + 1016 <- (9,0) 1479317512 + 8,0 18 7060 0.629033902 15995 G WS 739922952 + 1016 + ... + + This repeats until we consume the whole original huge request. Now we + finally get to processing the second parts of the split off requests + (in reverse order): + + 8,16 18 7181 0.629161384 15995 A WS 739952640 + 8 <- (9,0) 1479377920 + 8,0 18 7239 0.629162140 15995 A WS 739952640 + 8 <- (9,0) 1479376896 + 8,16 18 7186 0.629163881 15995 A WS 739951616 + 8 <- (9,0) 1479375872 + 8,0 18 7242 0.629164421 15995 A WS 739951616 + 8 <- (9,0) 1479374848 + ... + +I guess it is obvious that this IO pattern is extremely inefficient way +to perform sequential IO. It also makes bio_list to grow to rather long +lengths. + +Change raid0_make_request() to map both parts of the split bio. Since we +know we are provided with at most chunk-sized bios, we will always need +to split the incoming bio at most once. + +Fixes: f00d7c85be9e ("md/raid0: fix up bio splitting.") +Signed-off-by: Jan Kara +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20230814092720.3931-2-jack@suse.cz +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c +index d3c55f2e9b185..595856948dff8 100644 +--- a/drivers/md/raid0.c ++++ b/drivers/md/raid0.c +@@ -626,7 +626,7 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio) + struct bio *split = bio_split(bio, sectors, GFP_NOIO, + &mddev->bio_set); + bio_chain(split, bio); +- submit_bio_noacct(bio); ++ raid0_map_submit_bio(mddev, bio); + bio = split; + } + +-- +2.40.1 + diff --git a/queue-6.1/md-raid1-free-the-r1bio-before-waiting-for-blocked-r.patch b/queue-6.1/md-raid1-free-the-r1bio-before-waiting-for-blocked-r.patch new file mode 100644 index 00000000000..72b60d5c0bb --- /dev/null +++ b/queue-6.1/md-raid1-free-the-r1bio-before-waiting-for-blocked-r.patch @@ -0,0 +1,55 @@ +From 1c25c10a5eb0a12dbb9139f1085b4cdd39c4f80a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 21:53:55 +0800 +Subject: md/raid1: free the r1bio before waiting for blocked rdev + +From: Xueshi Hu + +[ Upstream commit 992db13a4aee766c8bfbf046ad15c2db5fa7cab8 ] + +Raid1 reshape will change mempool and r1conf::raid_disks which are +needed to free r1bio. allow_barrier() make a concurrent raid1_reshape() +possible. So, free the in-flight r1bio before waiting blocked rdev. + +Fixes: 6bfe0b499082 ("md: support blocking writes to an array on device failure") +Reviewed-by: Yu Kuai +Signed-off-by: Xueshi Hu +Link: https://lore.kernel.org/r/20230814135356.1113639-3-xueshi.hu@smartx.com +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid1.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index ac64c587191b9..433db7007f88b 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1370,6 +1370,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, + return; + } + ++ retry_write: + r1_bio = alloc_r1bio(mddev, bio); + r1_bio->sectors = max_write_sectors; + +@@ -1385,7 +1386,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, + */ + + disks = conf->raid_disks * 2; +- retry_write: + blocked_rdev = NULL; + rcu_read_lock(); + max_sectors = r1_bio->sectors; +@@ -1465,7 +1465,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, + for (j = 0; j < i; j++) + if (r1_bio->bios[j]) + rdev_dec_pending(conf->mirrors[j].rdev, mddev); +- r1_bio->state = 0; ++ free_r1bio(r1_bio); + allow_barrier(conf, bio->bi_iter.bi_sector); + + if (bio->bi_opf & REQ_NOWAIT) { +-- +2.40.1 + diff --git a/queue-6.1/md-raid1-hold-the-barrier-until-handle_read_error-fi.patch b/queue-6.1/md-raid1-hold-the-barrier-until-handle_read_error-fi.patch new file mode 100644 index 00000000000..c55863e7582 --- /dev/null +++ b/queue-6.1/md-raid1-hold-the-barrier-until-handle_read_error-fi.patch @@ -0,0 +1,53 @@ +From e44ddc7acda0b43c6b76e82589d60c92547eea34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 21:53:56 +0800 +Subject: md/raid1: hold the barrier until handle_read_error() finishes + +From: Xueshi Hu + +[ Upstream commit c069da449a13669ffa754fd971747e7e17e7d691 ] + +handle_read_error() will call allow_barrier() to match the former barrier +raising. However, it should put the allow_barrier() at the end to avoid a +concurrent raid reshape. + +Fixes: 689389a06ce7 ("md/raid1: simplify handle_read_error().") +Reviewed-by: Yu Kuai +Signed-off-by: Xueshi Hu +Link: https://lore.kernel.org/r/20230814135356.1113639-4-xueshi.hu@smartx.com +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid1.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 433db7007f88b..2d9372e6b5961 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -2495,6 +2495,7 @@ static void handle_read_error(struct r1conf *conf, struct r1bio *r1_bio) + struct mddev *mddev = conf->mddev; + struct bio *bio; + struct md_rdev *rdev; ++ sector_t sector; + + clear_bit(R1BIO_ReadError, &r1_bio->state); + /* we got a read error. Maybe the drive is bad. Maybe just +@@ -2524,12 +2525,13 @@ static void handle_read_error(struct r1conf *conf, struct r1bio *r1_bio) + } + + rdev_dec_pending(rdev, conf->mddev); +- allow_barrier(conf, r1_bio->sector); ++ sector = r1_bio->sector; + bio = r1_bio->master_bio; + + /* Reuse the old r1_bio so that the IO_BLOCKED settings are preserved */ + r1_bio->state = 0; + raid1_read_request(mddev, bio, r1_bio->sectors, r1_bio); ++ allow_barrier(conf, sector); + } + + static void raid1d(struct md_thread *thread) +-- +2.40.1 + diff --git a/queue-6.1/md-raid10-factor-out-dereference_rdev_and_rrdev.patch b/queue-6.1/md-raid10-factor-out-dereference_rdev_and_rrdev.patch new file mode 100644 index 00000000000..639b3cfdab1 --- /dev/null +++ b/queue-6.1/md-raid10-factor-out-dereference_rdev_and_rrdev.patch @@ -0,0 +1,74 @@ +From 789b47b4c3a5844648a15666dfb0fd3dd5249071 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Jul 2023 16:05:28 +0800 +Subject: md/raid10: factor out dereference_rdev_and_rrdev() + +From: Li Nan + +[ Upstream commit b99f8fd2d91eb734f13098aa1cf337edaca454b7 ] + +Factor out a helper to get 'rdev' and 'replacement' from config->mirrors. +Just to make code cleaner and prepare to fix the bug of io loss while +'replacement' replace 'rdev'. + +There is no functional change. + +Signed-off-by: Li Nan +Link: https://lore.kernel.org/r/20230701080529.2684932-3-linan666@huaweicloud.com +Signed-off-by: Song Liu +Stable-dep-of: 673643490b9a ("md/raid10: use dereference_rdev_and_rrdev() to get devices") +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 29 ++++++++++++++++++++--------- + 1 file changed, 20 insertions(+), 9 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index d2098fcd6a270..49bb79f48f362 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1317,6 +1317,25 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, + } + } + ++static struct md_rdev *dereference_rdev_and_rrdev(struct raid10_info *mirror, ++ struct md_rdev **prrdev) ++{ ++ struct md_rdev *rdev, *rrdev; ++ ++ rrdev = rcu_dereference(mirror->replacement); ++ /* ++ * Read replacement first to prevent reading both rdev and ++ * replacement as NULL during replacement replace rdev. ++ */ ++ smp_mb(); ++ rdev = rcu_dereference(mirror->rdev); ++ if (rdev == rrdev) ++ rrdev = NULL; ++ ++ *prrdev = rrdev; ++ return rdev; ++} ++ + static void wait_blocked_dev(struct mddev *mddev, struct r10bio *r10_bio) + { + int i; +@@ -1460,15 +1479,7 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, + int d = r10_bio->devs[i].devnum; + struct md_rdev *rdev, *rrdev; + +- rrdev = rcu_dereference(conf->mirrors[d].replacement); +- /* +- * Read replacement first to prevent reading both rdev and +- * replacement as NULL during replacement replace rdev. +- */ +- smp_mb(); +- rdev = rcu_dereference(conf->mirrors[d].rdev); +- if (rdev == rrdev) +- rrdev = NULL; ++ rdev = dereference_rdev_and_rrdev(&conf->mirrors[d], &rrdev); + if (rdev && (test_bit(Faulty, &rdev->flags))) + rdev = NULL; + if (rrdev && (test_bit(Faulty, &rrdev->flags))) +-- +2.40.1 + diff --git a/queue-6.1/md-raid10-use-dereference_rdev_and_rrdev-to-get-devi.patch b/queue-6.1/md-raid10-use-dereference_rdev_and_rrdev-to-get-devi.patch new file mode 100644 index 00000000000..f032e6b6a80 --- /dev/null +++ b/queue-6.1/md-raid10-use-dereference_rdev_and_rrdev-to-get-devi.patch @@ -0,0 +1,59 @@ +From ad8f1ef7f9c2b2a28bf1662af05d921556e68bfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Jul 2023 16:05:29 +0800 +Subject: md/raid10: use dereference_rdev_and_rrdev() to get devices + +From: Li Nan + +[ Upstream commit 673643490b9a0eb3b25633abe604f62b8f63dba1 ] + +Commit 2ae6aaf76912 ("md/raid10: fix io loss while replacement replace +rdev") reads replacement first to prevent io loss. However, there are same +issue in wait_blocked_dev() and raid10_handle_discard(), too. Fix it by +using dereference_rdev_and_rrdev() to get devices. + +Fixes: d30588b2731f ("md/raid10: improve raid10 discard request") +Fixes: f2e7e269a752 ("md/raid10: pull the code that wait for blocked dev into one function") +Signed-off-by: Li Nan +Link: https://lore.kernel.org/r/20230701080529.2684932-4-linan666@huaweicloud.com +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 49bb79f48f362..7b318e7e8d459 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1346,11 +1346,9 @@ static void wait_blocked_dev(struct mddev *mddev, struct r10bio *r10_bio) + blocked_rdev = NULL; + rcu_read_lock(); + for (i = 0; i < conf->copies; i++) { +- struct md_rdev *rdev = rcu_dereference(conf->mirrors[i].rdev); +- struct md_rdev *rrdev = rcu_dereference( +- conf->mirrors[i].replacement); +- if (rdev == rrdev) +- rrdev = NULL; ++ struct md_rdev *rdev, *rrdev; ++ ++ rdev = dereference_rdev_and_rrdev(&conf->mirrors[i], &rrdev); + if (rdev && unlikely(test_bit(Blocked, &rdev->flags))) { + atomic_inc(&rdev->nr_pending); + blocked_rdev = rdev; +@@ -1786,10 +1784,9 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio) + */ + rcu_read_lock(); + for (disk = 0; disk < geo->raid_disks; disk++) { +- struct md_rdev *rdev = rcu_dereference(conf->mirrors[disk].rdev); +- struct md_rdev *rrdev = rcu_dereference( +- conf->mirrors[disk].replacement); ++ struct md_rdev *rdev, *rrdev; + ++ rdev = dereference_rdev_and_rrdev(&conf->mirrors[disk], &rrdev); + r10_bio->devs[disk].bio = NULL; + r10_bio->devs[disk].repl_bio = NULL; + +-- +2.40.1 + diff --git a/queue-6.1/md-raid5-cache-fix-a-deadlock-in-r5l_exit_log.patch b/queue-6.1/md-raid5-cache-fix-a-deadlock-in-r5l_exit_log.patch new file mode 100644 index 00000000000..6aaa0cd66f2 --- /dev/null +++ b/queue-6.1/md-raid5-cache-fix-a-deadlock-in-r5l_exit_log.patch @@ -0,0 +1,63 @@ +From d71530f1a97fc80d9a5f05e54b9799720b4ea651 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jul 2023 17:17:27 +0800 +Subject: md/raid5-cache: fix a deadlock in r5l_exit_log() + +From: Yu Kuai + +[ Upstream commit a705b11b358dee677aad80630e7608b2d5f56691 ] + +Commit b13015af94cf ("md/raid5-cache: Clear conf->log after finishing +work") introduce a new problem: + +// caller hold reconfig_mutex +r5l_exit_log + flush_work(&log->disable_writeback_work) + r5c_disable_writeback_async + wait_event + /* + * conf->log is not NULL, and mddev_trylock() + * will fail, wait_event() can never pass. + */ + conf->log = NULL + +Fix this problem by setting 'config->log' to NULL before wake_up() as it +used to be, so that wait_event() from r5c_disable_writeback_async() can +exist. In the meantime, move forward md_unregister_thread() so that +null-ptr-deref this commit fixed can still be fixed. + +Fixes: b13015af94cf ("md/raid5-cache: Clear conf->log after finishing work") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20230708091727.1417894-1-yukuai1@huaweicloud.com +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid5-cache.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c +index 832d8566e1656..477e3ae17545a 100644 +--- a/drivers/md/raid5-cache.c ++++ b/drivers/md/raid5-cache.c +@@ -3166,12 +3166,15 @@ void r5l_exit_log(struct r5conf *conf) + { + struct r5l_log *log = conf->log; + +- /* Ensure disable_writeback_work wakes up and exits */ +- wake_up(&conf->mddev->sb_wait); +- flush_work(&log->disable_writeback_work); + md_unregister_thread(&log->reclaim_thread); + ++ /* ++ * 'reconfig_mutex' is held by caller, set 'confg->log' to NULL to ++ * ensure disable_writeback_work wakes up and exits. ++ */ + conf->log = NULL; ++ wake_up(&conf->mddev->sb_wait); ++ flush_work(&log->disable_writeback_work); + + mempool_exit(&log->meta_pool); + bioset_exit(&log->bs); +-- +2.40.1 + diff --git a/queue-6.1/md-raid5-cache-fix-null-ptr-deref-for-r5l_flush_stri.patch b/queue-6.1/md-raid5-cache-fix-null-ptr-deref-for-r5l_flush_stri.patch new file mode 100644 index 00000000000..2835dead997 --- /dev/null +++ b/queue-6.1/md-raid5-cache-fix-null-ptr-deref-for-r5l_flush_stri.patch @@ -0,0 +1,76 @@ +From a810a6f44aaec84f329fde5bd469028811bd0569 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Aug 2023 18:49:12 +0800 +Subject: md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() + +From: Yu Kuai + +[ Upstream commit 0d0bd28c500173bfca78aa840f8f36d261ef1765 ] + +r5l_flush_stripe_to_raid() will check if the list 'flushing_ios' is +empty, and then submit 'flush_bio', however, r5l_log_flush_endio() +is clearing the list first and then clear the bio, which will cause +null-ptr-deref: + +T1: submit flush io +raid5d + handle_active_stripes + r5l_flush_stripe_to_raid + // list is empty + // add 'io_end_ios' to the list + bio_init + submit_bio + // io1 + +T2: io1 is done +r5l_log_flush_endio + list_splice_tail_init + // clear the list + T3: submit new flush io + ... + r5l_flush_stripe_to_raid + // list is empty + // add 'io_end_ios' to the list + bio_init + bio_uninit + // clear bio->bi_blkg + submit_bio + // null-ptr-deref + +Fix this problem by clearing bio before clearing the list in +r5l_log_flush_endio(). + +Fixes: 0dd00cba99c3 ("raid5-cache: fully initialize flush_bio when needed") +Reported-and-tested-by: Corey Hickey +Closes: https://lore.kernel.org/all/cddd7213-3dfd-4ab7-a3ac-edd54d74a626@fatooh.org/ +Signed-off-by: Yu Kuai +Reviewed-by: Christoph Hellwig +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid5-cache.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c +index 477e3ae17545a..eb66d0bfe39d2 100644 +--- a/drivers/md/raid5-cache.c ++++ b/drivers/md/raid5-cache.c +@@ -1260,14 +1260,13 @@ static void r5l_log_flush_endio(struct bio *bio) + + if (bio->bi_status) + md_error(log->rdev->mddev, log->rdev); ++ bio_uninit(bio); + + spin_lock_irqsave(&log->io_list_lock, flags); + list_for_each_entry(io, &log->flushing_ios, log_sibling) + r5l_io_run_stripes(io); + list_splice_tail_init(&log->flushing_ios, &log->finished_ios); + spin_unlock_irqrestore(&log->io_list_lock, flags); +- +- bio_uninit(bio); + } + + /* +-- +2.40.1 + diff --git a/queue-6.1/md-restore-noio_flag-for-the-last-mddev_resume.patch b/queue-6.1/md-restore-noio_flag-for-the-last-mddev_resume.patch new file mode 100644 index 00000000000..1cade0161fe --- /dev/null +++ b/queue-6.1/md-restore-noio_flag-for-the-last-mddev_resume.patch @@ -0,0 +1,49 @@ +From 96f5449948922fbff23c2db3a5a53b51892de076 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 09:29:31 +0800 +Subject: md: restore 'noio_flag' for the last mddev_resume() + +From: Yu Kuai + +[ Upstream commit e24ed04389f9619e0aaef615a8948633c182a8b0 ] + +memalloc_noio_save() is called for the first mddev_suspend(), and +repeated mddev_suspend() only increase 'suspended'. However, +memalloc_noio_restore() is also called for the first mddev_resume(), +which means that memory reclaim will be enabled before the last +mddev_resume() is called, while the array is still suspended. + +Fix this problem by restore 'noio_flag' for the last mddev_resume(). + +Fixes: 78f57ef9d50a ("md: use memalloc scope APIs in mddev_suspend()/mddev_resume()") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20230628012931.88911-3-yukuai1@huaweicloud.com +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 1c44294c625a4..443837fe6291e 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -485,11 +485,13 @@ EXPORT_SYMBOL_GPL(mddev_suspend); + + void mddev_resume(struct mddev *mddev) + { +- /* entred the memalloc scope from mddev_suspend() */ +- memalloc_noio_restore(mddev->noio_flag); + lockdep_assert_held(&mddev->reconfig_mutex); + if (--mddev->suspended) + return; ++ ++ /* entred the memalloc scope from mddev_suspend() */ ++ memalloc_noio_restore(mddev->noio_flag); ++ + percpu_ref_resurrect(&mddev->active_io); + wake_up(&mddev->sb_wait); + mddev->pers->quiesce(mddev, 0); +-- +2.40.1 + diff --git a/queue-6.1/media-ad5820-drop-unsupported-ad5823-from-i2c_-and-o.patch b/queue-6.1/media-ad5820-drop-unsupported-ad5823-from-i2c_-and-o.patch new file mode 100644 index 00000000000..bbf7c026368 --- /dev/null +++ b/queue-6.1/media-ad5820-drop-unsupported-ad5823-from-i2c_-and-o.patch @@ -0,0 +1,66 @@ +From a3a23758897d2ae0e788f89bc9365a16e52bd0df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Jun 2023 20:17:40 +0200 +Subject: media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id + tables + +From: Hans de Goede + +[ Upstream commit f126ff7e4024f6704e6ec0d4137037568708a3c7 ] + +The supported ad5820 and ad5821 VCMs both use a single 16 bit register +which is written by sending 2 bytes with the data directly after sending +the i2c-client address. + +The ad5823 OTOH has a more typical i2c / smbus device setup with multiple +8 bit registers where the first byte send after the i2c-client address is +the register address and the actual data only starts from the second byte +after the i2c-client address. + +The ad5823 i2c_ and of_device_id-s was added at the same time as +the ad5821 ids with as rationale: + +""" +Some camera modules also refer that AD5823 is a replacement of AD5820: +https://download.kamami.com/p564094-OV8865_DS.pdf +""" + +The AD5823 may be an electrical and functional replacement of the AD5820, +but from a software pov it is not compatible at all and it is going to +need its own driver, drop its id from the ad5820 driver. + +Fixes: b8bf73136bae ("media: ad5820: Add support for ad5821 and ad5823") +Cc: Pavel Machek +Cc: Ricardo Ribalda Delgado +Signed-off-by: Hans de Goede +Reviewed-by: Ricardo Ribalda +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ad5820.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/media/i2c/ad5820.c b/drivers/media/i2c/ad5820.c +index a12fedcc3a1ce..088c29c4e2529 100644 +--- a/drivers/media/i2c/ad5820.c ++++ b/drivers/media/i2c/ad5820.c +@@ -356,7 +356,6 @@ static void ad5820_remove(struct i2c_client *client) + static const struct i2c_device_id ad5820_id_table[] = { + { "ad5820", 0 }, + { "ad5821", 0 }, +- { "ad5823", 0 }, + { } + }; + MODULE_DEVICE_TABLE(i2c, ad5820_id_table); +@@ -364,7 +363,6 @@ MODULE_DEVICE_TABLE(i2c, ad5820_id_table); + static const struct of_device_id ad5820_of_table[] = { + { .compatible = "adi,ad5820" }, + { .compatible = "adi,ad5821" }, +- { .compatible = "adi,ad5823" }, + { } + }; + MODULE_DEVICE_TABLE(of, ad5820_of_table); +-- +2.40.1 + diff --git a/queue-6.1/media-amphion-add-helper-function-to-get-id-name.patch b/queue-6.1/media-amphion-add-helper-function-to-get-id-name.patch new file mode 100644 index 00000000000..076a513f9bd --- /dev/null +++ b/queue-6.1/media-amphion-add-helper-function-to-get-id-name.patch @@ -0,0 +1,240 @@ +From 84f3aae1c9ca212aa4be46d04eeb03f367202ec7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 17:14:08 +0800 +Subject: media: amphion: add helper function to get id name + +From: Ming Qian + +[ Upstream commit 12cd8b8ac02525977b2e860a877add10e8ce7468 ] + +convert numbers into meaningful names, +then it can improve the log readability + +Fixes: 9f599f351e86 ("media: amphion: add vpu core driver") +Signed-off-by: Ming Qian +Reviewed-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vdec.c | 9 +-- + drivers/media/platform/amphion/vpu.h | 3 + + drivers/media/platform/amphion/vpu_cmds.c | 11 ++-- + drivers/media/platform/amphion/vpu_dbg.c | 6 +- + drivers/media/platform/amphion/vpu_helpers.c | 61 ++++++++++++++++++++ + drivers/media/platform/amphion/vpu_msgs.c | 2 +- + 6 files changed, 79 insertions(+), 13 deletions(-) + +diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c +index 8edb313cd6358..b4cdd23c38af2 100644 +--- a/drivers/media/platform/amphion/vdec.c ++++ b/drivers/media/platform/amphion/vdec.c +@@ -249,7 +249,8 @@ static int vdec_update_state(struct vpu_inst *inst, enum vpu_codec_state state, + vdec->state = VPU_CODEC_STATE_DYAMIC_RESOLUTION_CHANGE; + + if (inst->state != pre_state) +- vpu_trace(inst->dev, "[%d] %d -> %d\n", inst->id, pre_state, inst->state); ++ vpu_trace(inst->dev, "[%d] %s -> %s\n", inst->id, ++ vpu_codec_state_name(pre_state), vpu_codec_state_name(inst->state)); + + if (inst->state == VPU_CODEC_STATE_DYAMIC_RESOLUTION_CHANGE) + vdec_handle_resolution_change(inst); +@@ -994,8 +995,8 @@ static int vdec_response_frame(struct vpu_inst *inst, struct vb2_v4l2_buffer *vb + return -EINVAL; + } + +- dev_dbg(inst->dev, "[%d] state = %d, alloc fs %d, tag = 0x%x\n", +- inst->id, inst->state, vbuf->vb2_buf.index, vdec->seq_tag); ++ dev_dbg(inst->dev, "[%d] state = %s, alloc fs %d, tag = 0x%x\n", ++ inst->id, vpu_codec_state_name(inst->state), vbuf->vb2_buf.index, vdec->seq_tag); + vpu_buf = to_vpu_vb2_buffer(vbuf); + + memset(&info, 0, sizeof(info)); +@@ -1354,7 +1355,7 @@ static void vdec_abort(struct vpu_inst *inst) + struct vpu_rpc_buffer_desc desc; + int ret; + +- vpu_trace(inst->dev, "[%d] state = %d\n", inst->id, inst->state); ++ vpu_trace(inst->dev, "[%d] state = %s\n", inst->id, vpu_codec_state_name(inst->state)); + + vdec->aborting = true; + vpu_iface_add_scode(inst, SCODE_PADDING_ABORT); +diff --git a/drivers/media/platform/amphion/vpu.h b/drivers/media/platform/amphion/vpu.h +index 048c23c2bf4db..deb2288d42904 100644 +--- a/drivers/media/platform/amphion/vpu.h ++++ b/drivers/media/platform/amphion/vpu.h +@@ -353,6 +353,9 @@ void vpu_inst_record_flow(struct vpu_inst *inst, u32 flow); + int vpu_core_driver_init(void); + void vpu_core_driver_exit(void); + ++const char *vpu_id_name(u32 id); ++const char *vpu_codec_state_name(enum vpu_codec_state state); ++ + extern bool debug; + #define vpu_trace(dev, fmt, arg...) \ + do { \ +diff --git a/drivers/media/platform/amphion/vpu_cmds.c b/drivers/media/platform/amphion/vpu_cmds.c +index fa581ba6bab2d..647d94554fb5d 100644 +--- a/drivers/media/platform/amphion/vpu_cmds.c ++++ b/drivers/media/platform/amphion/vpu_cmds.c +@@ -98,7 +98,7 @@ static struct vpu_cmd_t *vpu_alloc_cmd(struct vpu_inst *inst, u32 id, void *data + cmd->id = id; + ret = vpu_iface_pack_cmd(inst->core, cmd->pkt, inst->id, id, data); + if (ret) { +- dev_err(inst->dev, "iface pack cmd(%d) fail\n", id); ++ dev_err(inst->dev, "iface pack cmd %s fail\n", vpu_id_name(id)); + vfree(cmd->pkt); + vfree(cmd); + return NULL; +@@ -125,14 +125,14 @@ static int vpu_session_process_cmd(struct vpu_inst *inst, struct vpu_cmd_t *cmd) + { + int ret; + +- dev_dbg(inst->dev, "[%d]send cmd(0x%x)\n", inst->id, cmd->id); ++ dev_dbg(inst->dev, "[%d]send cmd %s\n", inst->id, vpu_id_name(cmd->id)); + vpu_iface_pre_send_cmd(inst); + ret = vpu_cmd_send(inst->core, cmd->pkt); + if (!ret) { + vpu_iface_post_send_cmd(inst); + vpu_inst_record_flow(inst, cmd->id); + } else { +- dev_err(inst->dev, "[%d] iface send cmd(0x%x) fail\n", inst->id, cmd->id); ++ dev_err(inst->dev, "[%d] iface send cmd %s fail\n", inst->id, vpu_id_name(cmd->id)); + } + + return ret; +@@ -149,7 +149,8 @@ static void vpu_process_cmd_request(struct vpu_inst *inst) + list_for_each_entry_safe(cmd, tmp, &inst->cmd_q, list) { + list_del_init(&cmd->list); + if (vpu_session_process_cmd(inst, cmd)) +- dev_err(inst->dev, "[%d] process cmd(%d) fail\n", inst->id, cmd->id); ++ dev_err(inst->dev, "[%d] process cmd %s fail\n", ++ inst->id, vpu_id_name(cmd->id)); + if (cmd->request) { + inst->pending = (void *)cmd; + break; +@@ -339,7 +340,7 @@ static int vpu_session_send_cmd(struct vpu_inst *inst, u32 id, void *data) + + exit: + if (ret) +- dev_err(inst->dev, "[%d] send cmd(0x%x) fail\n", inst->id, id); ++ dev_err(inst->dev, "[%d] send cmd %s fail\n", inst->id, vpu_id_name(id)); + + return ret; + } +diff --git a/drivers/media/platform/amphion/vpu_dbg.c b/drivers/media/platform/amphion/vpu_dbg.c +index 260f1c4b8f8dc..bf8aded76e141 100644 +--- a/drivers/media/platform/amphion/vpu_dbg.c ++++ b/drivers/media/platform/amphion/vpu_dbg.c +@@ -67,7 +67,7 @@ static int vpu_dbg_instance(struct seq_file *s, void *data) + num = scnprintf(str, sizeof(str), "tgig = %d,pid = %d\n", inst->tgid, inst->pid); + if (seq_write(s, str, num)) + return 0; +- num = scnprintf(str, sizeof(str), "state = %d\n", inst->state); ++ num = scnprintf(str, sizeof(str), "state = %s\n", vpu_codec_state_name(inst->state)); + if (seq_write(s, str, num)) + return 0; + num = scnprintf(str, sizeof(str), +@@ -188,9 +188,9 @@ static int vpu_dbg_instance(struct seq_file *s, void *data) + + if (!inst->flows[idx]) + continue; +- num = scnprintf(str, sizeof(str), "\t[%s]0x%x\n", ++ num = scnprintf(str, sizeof(str), "\t[%s] %s\n", + inst->flows[idx] >= VPU_MSG_ID_NOOP ? "M" : "C", +- inst->flows[idx]); ++ vpu_id_name(inst->flows[idx])); + if (seq_write(s, str, num)) { + mutex_unlock(&inst->core->cmd_lock); + return 0; +diff --git a/drivers/media/platform/amphion/vpu_helpers.c b/drivers/media/platform/amphion/vpu_helpers.c +index e9aeb3453dfcb..2e78666322f02 100644 +--- a/drivers/media/platform/amphion/vpu_helpers.c ++++ b/drivers/media/platform/amphion/vpu_helpers.c +@@ -11,6 +11,7 @@ + #include + #include + #include "vpu.h" ++#include "vpu_defs.h" + #include "vpu_core.h" + #include "vpu_rpc.h" + #include "vpu_helpers.h" +@@ -412,3 +413,63 @@ int vpu_find_src_by_dst(struct vpu_pair *pairs, u32 cnt, u32 dst) + + return -EINVAL; + } ++ ++const char *vpu_id_name(u32 id) ++{ ++ switch (id) { ++ case VPU_CMD_ID_NOOP: return "noop"; ++ case VPU_CMD_ID_CONFIGURE_CODEC: return "configure codec"; ++ case VPU_CMD_ID_START: return "start"; ++ case VPU_CMD_ID_STOP: return "stop"; ++ case VPU_CMD_ID_ABORT: return "abort"; ++ case VPU_CMD_ID_RST_BUF: return "reset buf"; ++ case VPU_CMD_ID_SNAPSHOT: return "snapshot"; ++ case VPU_CMD_ID_FIRM_RESET: return "reset firmware"; ++ case VPU_CMD_ID_UPDATE_PARAMETER: return "update parameter"; ++ case VPU_CMD_ID_FRAME_ENCODE: return "encode frame"; ++ case VPU_CMD_ID_SKIP: return "skip"; ++ case VPU_CMD_ID_FS_ALLOC: return "alloc fb"; ++ case VPU_CMD_ID_FS_RELEASE: return "release fb"; ++ case VPU_CMD_ID_TIMESTAMP: return "timestamp"; ++ case VPU_CMD_ID_DEBUG: return "debug"; ++ case VPU_MSG_ID_RESET_DONE: return "reset done"; ++ case VPU_MSG_ID_START_DONE: return "start done"; ++ case VPU_MSG_ID_STOP_DONE: return "stop done"; ++ case VPU_MSG_ID_ABORT_DONE: return "abort done"; ++ case VPU_MSG_ID_BUF_RST: return "buf reset done"; ++ case VPU_MSG_ID_MEM_REQUEST: return "mem request"; ++ case VPU_MSG_ID_PARAM_UPD_DONE: return "param upd done"; ++ case VPU_MSG_ID_FRAME_INPUT_DONE: return "frame input done"; ++ case VPU_MSG_ID_ENC_DONE: return "encode done"; ++ case VPU_MSG_ID_DEC_DONE: return "frame display"; ++ case VPU_MSG_ID_FRAME_REQ: return "fb request"; ++ case VPU_MSG_ID_FRAME_RELEASE: return "fb release"; ++ case VPU_MSG_ID_SEQ_HDR_FOUND: return "seq hdr found"; ++ case VPU_MSG_ID_RES_CHANGE: return "resolution change"; ++ case VPU_MSG_ID_PIC_HDR_FOUND: return "pic hdr found"; ++ case VPU_MSG_ID_PIC_DECODED: return "picture decoded"; ++ case VPU_MSG_ID_PIC_EOS: return "eos"; ++ case VPU_MSG_ID_FIFO_LOW: return "fifo low"; ++ case VPU_MSG_ID_BS_ERROR: return "bs error"; ++ case VPU_MSG_ID_UNSUPPORTED: return "unsupported"; ++ case VPU_MSG_ID_FIRMWARE_XCPT: return "exception"; ++ case VPU_MSG_ID_PIC_SKIPPED: return "skipped"; ++ } ++ return ""; ++} ++ ++const char *vpu_codec_state_name(enum vpu_codec_state state) ++{ ++ switch (state) { ++ case VPU_CODEC_STATE_DEINIT: return "initialization"; ++ case VPU_CODEC_STATE_CONFIGURED: return "configured"; ++ case VPU_CODEC_STATE_START: return "start"; ++ case VPU_CODEC_STATE_STARTED: return "started"; ++ case VPU_CODEC_STATE_ACTIVE: return "active"; ++ case VPU_CODEC_STATE_SEEK: return "seek"; ++ case VPU_CODEC_STATE_STOP: return "stop"; ++ case VPU_CODEC_STATE_DRAIN: return "drain"; ++ case VPU_CODEC_STATE_DYAMIC_RESOLUTION_CHANGE: return "resolution change"; ++ } ++ return ""; ++} +diff --git a/drivers/media/platform/amphion/vpu_msgs.c b/drivers/media/platform/amphion/vpu_msgs.c +index 92672a802b492..f9eb488d1b5e2 100644 +--- a/drivers/media/platform/amphion/vpu_msgs.c ++++ b/drivers/media/platform/amphion/vpu_msgs.c +@@ -210,7 +210,7 @@ static int vpu_session_handle_msg(struct vpu_inst *inst, struct vpu_rpc_event *m + return -EINVAL; + + msg_id = ret; +- dev_dbg(inst->dev, "[%d] receive event(0x%x)\n", inst->id, msg_id); ++ dev_dbg(inst->dev, "[%d] receive event(%s)\n", inst->id, vpu_id_name(msg_id)); + + for (i = 0; i < ARRAY_SIZE(handlers); i++) { + if (handlers[i].id == msg_id) { +-- +2.40.1 + diff --git a/queue-6.1/media-amphion-ensure-the-bitops-don-t-cross-boundari.patch b/queue-6.1/media-amphion-ensure-the-bitops-don-t-cross-boundari.patch new file mode 100644 index 00000000000..ccf11df7bd4 --- /dev/null +++ b/queue-6.1/media-amphion-ensure-the-bitops-don-t-cross-boundari.patch @@ -0,0 +1,38 @@ +From 513b201172bb84c6a710dd711a8722203baa7499 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 17:50:13 +0800 +Subject: media: amphion: ensure the bitops don't cross boundaries + +From: Ming Qian + +[ Upstream commit 5bd28eae48589694ff4e5badb03bf75dae695b3f ] + +the supported_instance_count determine the instance index range, +it shouldn't exceed the bits number of instance_mask, +otherwise the bitops of instance_mask may cross boundaries + +Fixes: 9f599f351e86 ("media: amphion: add vpu core driver") +Reviewed-by: Nicolas Dufresne +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vpu_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c +index be80410682681..9add73b9b45f9 100644 +--- a/drivers/media/platform/amphion/vpu_core.c ++++ b/drivers/media/platform/amphion/vpu_core.c +@@ -88,6 +88,8 @@ static int vpu_core_boot_done(struct vpu_core *core) + + core->supported_instance_count = min(core->supported_instance_count, count); + } ++ if (core->supported_instance_count >= BITS_PER_TYPE(core->instance_mask)) ++ core->supported_instance_count = BITS_PER_TYPE(core->instance_mask); + core->fw_version = fw_version; + vpu_core_set_state(core, VPU_CORE_ACTIVE); + +-- +2.40.1 + diff --git a/queue-6.1/media-amphion-fix-checked_return-issues-reported-by-.patch b/queue-6.1/media-amphion-fix-checked_return-issues-reported-by-.patch new file mode 100644 index 00000000000..25526f26e1b --- /dev/null +++ b/queue-6.1/media-amphion-fix-checked_return-issues-reported-by-.patch @@ -0,0 +1,99 @@ +From 371393388119c3c0ec9df7325da3c707e7bd77d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 17:50:09 +0800 +Subject: media: amphion: fix CHECKED_RETURN issues reported by coverity + +From: Ming Qian + +[ Upstream commit b237b058adbc7825da9c8f358f1ff3f0467d623a ] + +calling "vpu_cmd_send/vpu_get_buffer_state/vpu_session_alloc_fs" +without checking return value + +Fixes: 9f599f351e86 ("media: amphion: add vpu core driver") +Reviewed-by: Nicolas Dufresne +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vdec.c | 5 ++++- + drivers/media/platform/amphion/vpu_cmds.c | 3 ++- + drivers/media/platform/amphion/vpu_dbg.c | 11 +++++++++-- + 3 files changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c +index b4cdd23c38af2..dc35a87e628ec 100644 +--- a/drivers/media/platform/amphion/vdec.c ++++ b/drivers/media/platform/amphion/vdec.c +@@ -957,6 +957,7 @@ static int vdec_response_frame_abnormal(struct vpu_inst *inst) + { + struct vdec_t *vdec = inst->priv; + struct vpu_fs_info info; ++ int ret; + + if (!vdec->req_frame_count) + return 0; +@@ -964,7 +965,9 @@ static int vdec_response_frame_abnormal(struct vpu_inst *inst) + memset(&info, 0, sizeof(info)); + info.type = MEM_RES_FRAME; + info.tag = vdec->seq_tag + 0xf0; +- vpu_session_alloc_fs(inst, &info); ++ ret = vpu_session_alloc_fs(inst, &info); ++ if (ret) ++ return ret; + vdec->req_frame_count--; + + return 0; +diff --git a/drivers/media/platform/amphion/vpu_cmds.c b/drivers/media/platform/amphion/vpu_cmds.c +index 647d94554fb5d..7e137f276c3b1 100644 +--- a/drivers/media/platform/amphion/vpu_cmds.c ++++ b/drivers/media/platform/amphion/vpu_cmds.c +@@ -306,7 +306,8 @@ static void vpu_core_keep_active(struct vpu_core *core) + + dev_dbg(core->dev, "try to wake up\n"); + mutex_lock(&core->cmd_lock); +- vpu_cmd_send(core, &pkt); ++ if (vpu_cmd_send(core, &pkt)) ++ dev_err(core->dev, "fail to keep active\n"); + mutex_unlock(&core->cmd_lock); + } + +diff --git a/drivers/media/platform/amphion/vpu_dbg.c b/drivers/media/platform/amphion/vpu_dbg.c +index bf8aded76e141..f105da82d92f9 100644 +--- a/drivers/media/platform/amphion/vpu_dbg.c ++++ b/drivers/media/platform/amphion/vpu_dbg.c +@@ -50,6 +50,13 @@ static char *vpu_stat_name[] = { + [VPU_BUF_STATE_ERROR] = "error", + }; + ++static inline const char *to_vpu_stat_name(int state) ++{ ++ if (state <= VPU_BUF_STATE_ERROR) ++ return vpu_stat_name[state]; ++ return "unknown"; ++} ++ + static int vpu_dbg_instance(struct seq_file *s, void *data) + { + struct vpu_inst *inst = s->private; +@@ -141,7 +148,7 @@ static int vpu_dbg_instance(struct seq_file *s, void *data) + num = scnprintf(str, sizeof(str), + "output [%2d] state = %10s, %8s\n", + i, vb2_stat_name[vb->state], +- vpu_stat_name[vpu_get_buffer_state(vbuf)]); ++ to_vpu_stat_name(vpu_get_buffer_state(vbuf))); + if (seq_write(s, str, num)) + return 0; + } +@@ -156,7 +163,7 @@ static int vpu_dbg_instance(struct seq_file *s, void *data) + num = scnprintf(str, sizeof(str), + "capture[%2d] state = %10s, %8s\n", + i, vb2_stat_name[vb->state], +- vpu_stat_name[vpu_get_buffer_state(vbuf)]); ++ to_vpu_stat_name(vpu_get_buffer_state(vbuf))); + if (seq_write(s, str, num)) + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/media-amphion-fix-reverse_inull-issues-reported-by-c.patch b/queue-6.1/media-amphion-fix-reverse_inull-issues-reported-by-c.patch new file mode 100644 index 00000000000..0d71c2fefbb --- /dev/null +++ b/queue-6.1/media-amphion-fix-reverse_inull-issues-reported-by-c.patch @@ -0,0 +1,61 @@ +From 527523d9216e5e198e5be38b4606ffb3e25b8eef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 17:50:10 +0800 +Subject: media: amphion: fix REVERSE_INULL issues reported by coverity + +From: Ming Qian + +[ Upstream commit 79d3bafaecc13bccab1ebbd28a15e669c5a4cdaf ] + +null-checking of a pointor is suggested before dereferencing it + +Fixes: 9f599f351e86 ("media: amphion: add vpu core driver") +Reviewed-by: Nicolas Dufresne +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/venc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/amphion/venc.c b/drivers/media/platform/amphion/venc.c +index e8cb22da938e6..1df2b35c1a240 100644 +--- a/drivers/media/platform/amphion/venc.c ++++ b/drivers/media/platform/amphion/venc.c +@@ -278,7 +278,7 @@ static int venc_g_parm(struct file *file, void *fh, struct v4l2_streamparm *parm + { + struct vpu_inst *inst = to_inst(file); + struct venc_t *venc = inst->priv; +- struct v4l2_fract *timeperframe = &parm->parm.capture.timeperframe; ++ struct v4l2_fract *timeperframe; + + if (!parm) + return -EINVAL; +@@ -289,6 +289,7 @@ static int venc_g_parm(struct file *file, void *fh, struct v4l2_streamparm *parm + if (!vpu_helper_check_type(inst, parm->type)) + return -EINVAL; + ++ timeperframe = &parm->parm.capture.timeperframe; + parm->parm.capture.capability = V4L2_CAP_TIMEPERFRAME; + parm->parm.capture.readbuffers = 0; + timeperframe->numerator = venc->params.frame_rate.numerator; +@@ -301,7 +302,7 @@ static int venc_s_parm(struct file *file, void *fh, struct v4l2_streamparm *parm + { + struct vpu_inst *inst = to_inst(file); + struct venc_t *venc = inst->priv; +- struct v4l2_fract *timeperframe = &parm->parm.capture.timeperframe; ++ struct v4l2_fract *timeperframe; + unsigned long n, d; + + if (!parm) +@@ -313,6 +314,7 @@ static int venc_s_parm(struct file *file, void *fh, struct v4l2_streamparm *parm + if (!vpu_helper_check_type(inst, parm->type)) + return -EINVAL; + ++ timeperframe = &parm->parm.capture.timeperframe; + if (!timeperframe->numerator) + timeperframe->numerator = venc->params.frame_rate.numerator; + if (!timeperframe->denominator) +-- +2.40.1 + diff --git a/queue-6.1/media-amphion-fix-uninit-issues-reported-by-coverity.patch b/queue-6.1/media-amphion-fix-uninit-issues-reported-by-coverity.patch new file mode 100644 index 00000000000..879a1c7af9b --- /dev/null +++ b/queue-6.1/media-amphion-fix-uninit-issues-reported-by-coverity.patch @@ -0,0 +1,81 @@ +From fc4fc237ec184cc97d93f86fc94bd4c614ef2a4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 17:50:11 +0800 +Subject: media: amphion: fix UNINIT issues reported by coverity + +From: Ming Qian + +[ Upstream commit c224d0497a31ea2d173e1ea16af308945bff9037 ] + +using uninitialized value may introduce risk + +Fixes: 9f599f351e86 ("media: amphion: add vpu core driver") +Reviewed-by: Nicolas Dufresne +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vpu_msgs.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/platform/amphion/vpu_msgs.c b/drivers/media/platform/amphion/vpu_msgs.c +index f9eb488d1b5e2..d0ead051f7d18 100644 +--- a/drivers/media/platform/amphion/vpu_msgs.c ++++ b/drivers/media/platform/amphion/vpu_msgs.c +@@ -32,7 +32,7 @@ static void vpu_session_handle_start_done(struct vpu_inst *inst, struct vpu_rpc_ + + static void vpu_session_handle_mem_request(struct vpu_inst *inst, struct vpu_rpc_event *pkt) + { +- struct vpu_pkt_mem_req_data req_data; ++ struct vpu_pkt_mem_req_data req_data = { 0 }; + + vpu_iface_unpack_msg_data(inst->core, pkt, (void *)&req_data); + vpu_trace(inst->dev, "[%d] %d:%d %d:%d %d:%d\n", +@@ -80,7 +80,7 @@ static void vpu_session_handle_resolution_change(struct vpu_inst *inst, struct v + + static void vpu_session_handle_enc_frame_done(struct vpu_inst *inst, struct vpu_rpc_event *pkt) + { +- struct vpu_enc_pic_info info; ++ struct vpu_enc_pic_info info = { 0 }; + + vpu_iface_unpack_msg_data(inst->core, pkt, (void *)&info); + dev_dbg(inst->dev, "[%d] frame id = %d, wptr = 0x%x, size = %d\n", +@@ -90,7 +90,7 @@ static void vpu_session_handle_enc_frame_done(struct vpu_inst *inst, struct vpu_ + + static void vpu_session_handle_frame_request(struct vpu_inst *inst, struct vpu_rpc_event *pkt) + { +- struct vpu_fs_info fs; ++ struct vpu_fs_info fs = { 0 }; + + vpu_iface_unpack_msg_data(inst->core, pkt, &fs); + call_void_vop(inst, event_notify, VPU_MSG_ID_FRAME_REQ, &fs); +@@ -107,7 +107,7 @@ static void vpu_session_handle_frame_release(struct vpu_inst *inst, struct vpu_r + info.type = inst->out_format.type; + call_void_vop(inst, buf_done, &info); + } else if (inst->core->type == VPU_CORE_TYPE_DEC) { +- struct vpu_fs_info fs; ++ struct vpu_fs_info fs = { 0 }; + + vpu_iface_unpack_msg_data(inst->core, pkt, &fs); + call_void_vop(inst, event_notify, VPU_MSG_ID_FRAME_RELEASE, &fs); +@@ -122,7 +122,7 @@ static void vpu_session_handle_input_done(struct vpu_inst *inst, struct vpu_rpc_ + + static void vpu_session_handle_pic_decoded(struct vpu_inst *inst, struct vpu_rpc_event *pkt) + { +- struct vpu_dec_pic_info info; ++ struct vpu_dec_pic_info info = { 0 }; + + vpu_iface_unpack_msg_data(inst->core, pkt, (void *)&info); + call_void_vop(inst, get_one_frame, &info); +@@ -130,7 +130,7 @@ static void vpu_session_handle_pic_decoded(struct vpu_inst *inst, struct vpu_rpc + + static void vpu_session_handle_pic_done(struct vpu_inst *inst, struct vpu_rpc_event *pkt) + { +- struct vpu_dec_pic_info info; ++ struct vpu_dec_pic_info info = { 0 }; + struct vpu_frame_info frame; + + memset(&frame, 0, sizeof(frame)); +-- +2.40.1 + diff --git a/queue-6.1/media-amphion-fix-unused_value-issue-reported-by-cov.patch b/queue-6.1/media-amphion-fix-unused_value-issue-reported-by-cov.patch new file mode 100644 index 00000000000..ec1bed04699 --- /dev/null +++ b/queue-6.1/media-amphion-fix-unused_value-issue-reported-by-cov.patch @@ -0,0 +1,37 @@ +From 00dafcfc14aeb7ae1051502a4d3f98cb8189ace9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 17:50:12 +0800 +Subject: media: amphion: fix UNUSED_VALUE issue reported by coverity + +From: Ming Qian + +[ Upstream commit cf6a06354989c41b536be8e094561ee16223cf1f ] + +assign value '-EINVAL' to ret, but the stored value is overwritten +before it can be used + +Fixes: 9f599f351e86 ("media: amphion: add vpu core driver") +Reviewed-by: Nicolas Dufresne +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vpu_cmds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/amphion/vpu_cmds.c b/drivers/media/platform/amphion/vpu_cmds.c +index 7e137f276c3b1..235b71398d403 100644 +--- a/drivers/media/platform/amphion/vpu_cmds.c ++++ b/drivers/media/platform/amphion/vpu_cmds.c +@@ -315,7 +315,7 @@ static int vpu_session_send_cmd(struct vpu_inst *inst, u32 id, void *data) + { + unsigned long key; + int sync = false; +- int ret = -EINVAL; ++ int ret; + + if (inst->id < 0) + return -EINVAL; +-- +2.40.1 + diff --git a/queue-6.1/media-amphion-reinit-vpu-if-reqbufs-output-0.patch b/queue-6.1/media-amphion-reinit-vpu-if-reqbufs-output-0.patch new file mode 100644 index 00000000000..ab4f78311d4 --- /dev/null +++ b/queue-6.1/media-amphion-reinit-vpu-if-reqbufs-output-0.patch @@ -0,0 +1,70 @@ +From 808215d21637f2d9040e925fa93a89f94f880a0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 15:48:46 +0800 +Subject: media: amphion: reinit vpu if reqbufs output 0 + +From: Ming Qian + +[ Upstream commit 73e3f09292a0492a3fe0f87a8170a74f12624c5e ] + +according to v4l2 stateful decoder document 4.5.1.3. State Machine, +the state should change from seek to initialization +if call VIDIOC_REQBUFS(OUTPUT, 0). + +so reinit the vpu decoder if reqbufs output 0 + +Fixes: 6de8d628df6e ("media: amphion: add v4l2 m2m vpu decoder stateful driver") +Signed-off-by: Ming Qian +Tested-by: Nicolas Dufresne +Reviewed-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vdec.c | 2 -- + drivers/media/platform/amphion/vpu_v4l2.c | 7 ++++++- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c +index c08b5a2bfc1df..8edb313cd6358 100644 +--- a/drivers/media/platform/amphion/vdec.c ++++ b/drivers/media/platform/amphion/vdec.c +@@ -1407,9 +1407,7 @@ static void vdec_release(struct vpu_inst *inst) + { + if (inst->id != VPU_INST_NULL_ID) + vpu_trace(inst->dev, "[%d]\n", inst->id); +- vpu_inst_lock(inst); + vdec_stop(inst, true); +- vpu_inst_unlock(inst); + } + + static void vdec_cleanup(struct vpu_inst *inst) +diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c +index a74953191c221..e5c8e1a753ccd 100644 +--- a/drivers/media/platform/amphion/vpu_v4l2.c ++++ b/drivers/media/platform/amphion/vpu_v4l2.c +@@ -404,6 +404,11 @@ static int vpu_vb2_queue_setup(struct vb2_queue *vq, + for (i = 0; i < cur_fmt->num_planes; i++) + psize[i] = cur_fmt->sizeimage[i]; + ++ if (V4L2_TYPE_IS_OUTPUT(vq->type) && inst->state == VPU_CODEC_STATE_SEEK) { ++ vpu_trace(inst->dev, "reinit when VIDIOC_REQBUFS(OUTPUT, 0)\n"); ++ call_void_vop(inst, release); ++ } ++ + return 0; + } + +@@ -688,9 +693,9 @@ int vpu_v4l2_close(struct file *file) + v4l2_m2m_ctx_release(inst->fh.m2m_ctx); + inst->fh.m2m_ctx = NULL; + } ++ call_void_vop(inst, release); + vpu_inst_unlock(inst); + +- call_void_vop(inst, release); + vpu_inst_unregister(inst); + vpu_inst_put(inst); + +-- +2.40.1 + diff --git a/queue-6.1/media-cec-core-add-adap_nb_transmit_canceled-callbac.patch b/queue-6.1/media-cec-core-add-adap_nb_transmit_canceled-callbac.patch new file mode 100644 index 00000000000..1dee49e3184 --- /dev/null +++ b/queue-6.1/media-cec-core-add-adap_nb_transmit_canceled-callbac.patch @@ -0,0 +1,81 @@ +From beb069e3217903f00a940eacbbc501382393562d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 15:58:37 +0200 +Subject: media: cec: core: add adap_nb_transmit_canceled() callback + +From: Hans Verkuil + +[ Upstream commit da53c36ddd3f118a525a04faa8c47ca471e6c467 ] + +A potential deadlock was found by Zheng Zhang with a local syzkaller +instance. + +The problem is that when a non-blocking CEC transmit is canceled by calling +cec_data_cancel, that in turn can call the high-level received() driver +callback, which can call cec_transmit_msg() to transmit a new message. + +The cec_data_cancel() function is called with the adap->lock mutex held, +and cec_transmit_msg() tries to take that same lock. + +The root cause is that the received() callback can either be used to pass +on a received message (and then adap->lock is not held), or to report a +canceled transmit (and then adap->lock is held). + +This is confusing, so create a new low-level adap_nb_transmit_canceled +callback that reports back that a non-blocking transmit was canceled. + +And the received() callback is only called when a message is received, +as was the case before commit f9d0ecbf56f4 ("media: cec: correctly pass +on reply results") complicated matters. + +Reported-by: Zheng Zhang +Signed-off-by: Hans Verkuil +Fixes: f9d0ecbf56f4 ("media: cec: correctly pass on reply results") +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/core/cec-adap.c | 4 ++-- + include/media/cec.h | 6 ++++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c +index b1512f9c5895c..aed3e51d6d354 100644 +--- a/drivers/media/cec/core/cec-adap.c ++++ b/drivers/media/cec/core/cec-adap.c +@@ -385,8 +385,8 @@ static void cec_data_cancel(struct cec_data *data, u8 tx_status, u8 rx_status) + cec_queue_msg_monitor(adap, &data->msg, 1); + + if (!data->blocking && data->msg.sequence) +- /* Allow drivers to process the message first */ +- call_op(adap, received, &data->msg); ++ /* Allow drivers to react to a canceled transmit */ ++ call_void_op(adap, adap_nb_transmit_canceled, &data->msg); + + cec_data_completed(data); + } +diff --git a/include/media/cec.h b/include/media/cec.h +index abee41ae02d0e..6556cc161dc0a 100644 +--- a/include/media/cec.h ++++ b/include/media/cec.h +@@ -121,14 +121,16 @@ struct cec_adap_ops { + void (*adap_configured)(struct cec_adapter *adap, bool configured); + int (*adap_transmit)(struct cec_adapter *adap, u8 attempts, + u32 signal_free_time, struct cec_msg *msg); ++ void (*adap_nb_transmit_canceled)(struct cec_adapter *adap, ++ const struct cec_msg *msg); + void (*adap_status)(struct cec_adapter *adap, struct seq_file *file); + void (*adap_free)(struct cec_adapter *adap); + +- /* Error injection callbacks */ ++ /* Error injection callbacks, called without adap->lock held */ + int (*error_inj_show)(struct cec_adapter *adap, struct seq_file *sf); + bool (*error_inj_parse_line)(struct cec_adapter *adap, char *line); + +- /* High-level CEC message callback */ ++ /* High-level CEC message callback, called without adap->lock held */ + int (*received)(struct cec_adapter *adap, struct cec_msg *msg); + }; + +-- +2.40.1 + diff --git a/queue-6.1/media-cec-core-add-adap_unconfigured-callback.patch b/queue-6.1/media-cec-core-add-adap_unconfigured-callback.patch new file mode 100644 index 00000000000..d1d99394754 --- /dev/null +++ b/queue-6.1/media-cec-core-add-adap_unconfigured-callback.patch @@ -0,0 +1,81 @@ +From 35d5d030e0677017247f273edf41a323bc47e7c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 15:58:38 +0200 +Subject: media: cec: core: add adap_unconfigured() callback + +From: Hans Verkuil + +[ Upstream commit 948a77aaecf202f722cf2264025f9987e5bd5c26 ] + +The adap_configured() callback was called with the adap->lock mutex +held if the 'configured' argument was false, and without the adap->lock +mutex held if that argument was true. + +That was very confusing, and so split this up in a adap_unconfigured() +callback and a high-level configured() callback. + +This also makes it easier to understand when the mutex is held: all +low-level adap_* callbacks are called with the mutex held. All other +callbacks are called without that mutex held. + +Signed-off-by: Hans Verkuil +Fixes: f1b57164305d ("media: cec: add optional adap_configured callback") +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/core/cec-adap.c | 4 ++-- + include/media/cec.h | 5 +++-- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c +index aed3e51d6d354..4bc2a705029e6 100644 +--- a/drivers/media/cec/core/cec-adap.c ++++ b/drivers/media/cec/core/cec-adap.c +@@ -1345,7 +1345,7 @@ static void cec_adap_unconfigure(struct cec_adapter *adap) + cec_flush(adap); + wake_up_interruptible(&adap->kthread_waitq); + cec_post_state_event(adap); +- call_void_op(adap, adap_configured, false); ++ call_void_op(adap, adap_unconfigured); + } + + /* +@@ -1536,7 +1536,7 @@ static int cec_config_thread_func(void *arg) + adap->kthread_config = NULL; + complete(&adap->config_completion); + mutex_unlock(&adap->lock); +- call_void_op(adap, adap_configured, true); ++ call_void_op(adap, configured); + return 0; + + unconfigure: +diff --git a/include/media/cec.h b/include/media/cec.h +index 6556cc161dc0a..9c007f83569aa 100644 +--- a/include/media/cec.h ++++ b/include/media/cec.h +@@ -113,12 +113,12 @@ struct cec_fh { + #define CEC_FREE_TIME_TO_USEC(ft) ((ft) * 2400) + + struct cec_adap_ops { +- /* Low-level callbacks */ ++ /* Low-level callbacks, called with adap->lock held */ + int (*adap_enable)(struct cec_adapter *adap, bool enable); + int (*adap_monitor_all_enable)(struct cec_adapter *adap, bool enable); + int (*adap_monitor_pin_enable)(struct cec_adapter *adap, bool enable); + int (*adap_log_addr)(struct cec_adapter *adap, u8 logical_addr); +- void (*adap_configured)(struct cec_adapter *adap, bool configured); ++ void (*adap_unconfigured)(struct cec_adapter *adap); + int (*adap_transmit)(struct cec_adapter *adap, u8 attempts, + u32 signal_free_time, struct cec_msg *msg); + void (*adap_nb_transmit_canceled)(struct cec_adapter *adap, +@@ -131,6 +131,7 @@ struct cec_adap_ops { + bool (*error_inj_parse_line)(struct cec_adapter *adap, char *line); + + /* High-level CEC message callback, called without adap->lock held */ ++ void (*configured)(struct cec_adapter *adap); + int (*received)(struct cec_adapter *adap, struct cec_msg *msg); + }; + +-- +2.40.1 + diff --git a/queue-6.1/media-cx24120-add-retval-check-for-cx24120_message_s.patch b/queue-6.1/media-cx24120-add-retval-check-for-cx24120_message_s.patch new file mode 100644 index 00000000000..485c9fc1879 --- /dev/null +++ b/queue-6.1/media-cx24120-add-retval-check-for-cx24120_message_s.patch @@ -0,0 +1,40 @@ +From 5f097bed0e18701fe0a18d9ab9dfa803ee2b0cb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 01:55:01 -0700 +Subject: media: cx24120: Add retval check for cx24120_message_send() + +From: Daniil Dulov + +[ Upstream commit 96002c0ac824e1773d3f706b1f92e2a9f2988047 ] + +If cx24120_message_send() returns error, we should keep local struct +unchanged. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 5afc9a25be8d ("[media] Add support for TechniSat Skystar S2") +Signed-off-by: Daniil Dulov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/cx24120.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-frontends/cx24120.c b/drivers/media/dvb-frontends/cx24120.c +index d8acd582c7111..0f778660c72b8 100644 +--- a/drivers/media/dvb-frontends/cx24120.c ++++ b/drivers/media/dvb-frontends/cx24120.c +@@ -973,7 +973,9 @@ static void cx24120_set_clock_ratios(struct dvb_frontend *fe) + cmd.arg[8] = (clock_ratios_table[idx].rate >> 8) & 0xff; + cmd.arg[9] = (clock_ratios_table[idx].rate >> 0) & 0xff; + +- cx24120_message_send(state, &cmd); ++ ret = cx24120_message_send(state, &cmd); ++ if (ret != 0) ++ return; + + /* Calculate ber window rates for stat work */ + cx24120_calculate_ber_window(state, clock_ratios_table[idx].rate); +-- +2.40.1 + diff --git a/queue-6.1/media-dib7000p-fix-potential-division-by-zero.patch b/queue-6.1/media-dib7000p-fix-potential-division-by-zero.patch new file mode 100644 index 00000000000..42e42ea1f19 --- /dev/null +++ b/queue-6.1/media-dib7000p-fix-potential-division-by-zero.patch @@ -0,0 +1,39 @@ +From 0f4c107ebf31c095113ba10e44cb7257c0582cbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 06:38:32 -0700 +Subject: media: dib7000p: Fix potential division by zero + +From: Daniil Dulov + +[ Upstream commit a1db7b2c5533fc67e2681eb5efc921a67bc7d5b8 ] + +Variable loopdiv can be assigned 0, then it is used as a denominator, +without checking it for 0. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 713d54a8bd81 ("[media] DiB7090: add support for the dib7090 based") +Signed-off-by: Daniil Dulov +Signed-off-by: Hans Verkuil +[hverkuil: (bw != NULL) -> bw] +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/dib7000p.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c +index a90d2f51868ff..632534eff0ffa 100644 +--- a/drivers/media/dvb-frontends/dib7000p.c ++++ b/drivers/media/dvb-frontends/dib7000p.c +@@ -497,7 +497,7 @@ static int dib7000p_update_pll(struct dvb_frontend *fe, struct dibx000_bandwidth + prediv = reg_1856 & 0x3f; + loopdiv = (reg_1856 >> 6) & 0x3f; + +- if ((bw != NULL) && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) { ++ if (loopdiv && bw && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) { + dprintk("Updating pll (prediv: old = %d new = %d ; loopdiv : old = %d new = %d)\n", prediv, bw->pll_prediv, loopdiv, bw->pll_ratio); + reg_1856 &= 0xf000; + reg_1857 = dib7000p_read_word(state, 1857); +-- +2.40.1 + diff --git a/queue-6.1/media-dvb-usb-m920x-fix-a-potential-memory-leak-in-m.patch b/queue-6.1/media-dvb-usb-m920x-fix-a-potential-memory-leak-in-m.patch new file mode 100644 index 00000000000..cd50210a640 --- /dev/null +++ b/queue-6.1/media-dvb-usb-m920x-fix-a-potential-memory-leak-in-m.patch @@ -0,0 +1,50 @@ +From 2d49bdf3476240f5cc8a15a45d779c9418d8b921 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 May 2023 07:58:36 +0200 +Subject: media: dvb-usb: m920x: Fix a potential memory leak in + m920x_i2c_xfer() + +From: Christophe JAILLET + +[ Upstream commit ea9ef6c2e001c5dc94bee35ebd1c8a98621cf7b8 ] + +'read' is freed when it is known to be NULL, but not when a read error +occurs. + +Revert the logic to avoid a small leak, should a m920x_read() call fail. + +Fixes: a2ab06d7c4d6 ("media: m920x: don't use stack on USB reads") +Signed-off-by: Christophe JAILLET +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/m920x.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb/m920x.c b/drivers/media/usb/dvb-usb/m920x.c +index 548199cd86f60..11f4f0455f155 100644 +--- a/drivers/media/usb/dvb-usb/m920x.c ++++ b/drivers/media/usb/dvb-usb/m920x.c +@@ -277,7 +277,6 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu + char *read = kmalloc(1, GFP_KERNEL); + if (!read) { + ret = -ENOMEM; +- kfree(read); + goto unlock; + } + +@@ -288,8 +287,10 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu + + if ((ret = m920x_read(d->udev, M9206_I2C, 0x0, + 0x20 | stop, +- read, 1)) != 0) ++ read, 1)) != 0) { ++ kfree(read); + goto unlock; ++ } + msg[i].buf[j] = read[0]; + } + +-- +2.40.1 + diff --git a/queue-6.1/media-go7007-remove-redundant-if-statement.patch b/queue-6.1/media-go7007-remove-redundant-if-statement.patch new file mode 100644 index 00000000000..2d11b20e218 --- /dev/null +++ b/queue-6.1/media-go7007-remove-redundant-if-statement.patch @@ -0,0 +1,43 @@ +From 6b224c4c9b4ca04ed860bbd7bcc72d25d6bcc953 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 19:40:07 +0200 +Subject: media: go7007: Remove redundant if statement + +From: Colin Ian King + +[ Upstream commit f33cb49081da0ec5af0888f8ecbd566bd326eed1 ] + +The if statement that compares msgs[i].len != 3 is always false because +it is in a code block where msg[i].len is equal to 3. The check is +redundant and can be removed. + +As detected by cppcheck static analysis: +drivers/media/usb/go7007/go7007-i2c.c:168:20: warning: Opposite inner +'if' condition leads to a dead code block. [oppositeInnerCondition] + +Link: https://lore.kernel.org/linux-media/20230727174007.635572-1-colin.i.king@gmail.com + +Fixes: 866b8695d67e ("Staging: add the go7007 video driver") +Signed-off-by: Colin Ian King +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/go7007/go7007-i2c.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/media/usb/go7007/go7007-i2c.c b/drivers/media/usb/go7007/go7007-i2c.c +index 38339dd2f83f7..2880370e45c8b 100644 +--- a/drivers/media/usb/go7007/go7007-i2c.c ++++ b/drivers/media/usb/go7007/go7007-i2c.c +@@ -165,8 +165,6 @@ static int go7007_i2c_master_xfer(struct i2c_adapter *adapter, + } else if (msgs[i].len == 3) { + if (msgs[i].flags & I2C_M_RD) + return -EIO; +- if (msgs[i].len != 3) +- return -EIO; + if (go7007_i2c_xfer(go, msgs[i].addr, 0, + (msgs[i].buf[0] << 8) | msgs[i].buf[1], + 0x01, &msgs[i].buf[2]) < 0) +-- +2.40.1 + diff --git a/queue-6.1/media-i2c-ov2680-set-v4l2_ctrl_flag_modify_layout-on.patch b/queue-6.1/media-i2c-ov2680-set-v4l2_ctrl_flag_modify_layout-on.patch new file mode 100644 index 00000000000..256e08e4421 --- /dev/null +++ b/queue-6.1/media-i2c-ov2680-set-v4l2_ctrl_flag_modify_layout-on.patch @@ -0,0 +1,41 @@ +From 2d0431e27de242a0e34b83c289bff1ed0374207c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 15:21:45 +0000 +Subject: media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips + +From: Dave Stevenson + +[ Upstream commit 66274280b2c745d380508dc27b9a4dfd736e5eda ] + +The driver changes the Bayer order based on the flips, but +does not define the control correctly with the +V4L2_CTRL_FLAG_MODIFY_LAYOUT flag. + +Add the V4L2_CTRL_FLAG_MODIFY_LAYOUT flag. + +Signed-off-by: Dave Stevenson +Acked-by: Rui Miguel Silva +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: 7b5a42e6ae71 ("media: ov2680: Remove auto-gain and auto-exposure controls") +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index de66d3395a4dd..54153bf66bddc 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -967,6 +967,8 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor) + + ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE; + ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE; ++ ctrls->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT; ++ ctrls->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT; + + v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true); + v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true); +-- +2.40.1 + diff --git a/queue-6.1/media-i2c-rdacm21-fix-uninitialized-value.patch b/queue-6.1/media-i2c-rdacm21-fix-uninitialized-value.patch new file mode 100644 index 00000000000..50d257c101a --- /dev/null +++ b/queue-6.1/media-i2c-rdacm21-fix-uninitialized-value.patch @@ -0,0 +1,41 @@ +From 2754be5ab5c7c6e188ebe4a485742494038016ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 15:33:37 +0200 +Subject: media: i2c: rdacm21: Fix uninitialized value + +From: Jacopo Mondi + +[ Upstream commit 33c7ae8f49e3413c81e879e1fdfcea4c5516e37b ] + +Fix the following smatch warning: + +drivers/media/i2c/rdacm21.c:373 ov10640_check_id() error: uninitialized +symbol 'val'. + +Initialize 'val' to 0 in the ov10640_check_id() function. + +Fixes: 2b821698dc73 ("media: i2c: rdacm21: Power up OV10640 before OV490") +Reported-by: Hans Verkuil +Signed-off-by: Jacopo Mondi +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/rdacm21.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/rdacm21.c b/drivers/media/i2c/rdacm21.c +index 9ccc56c30d3b0..d269c541ebe4c 100644 +--- a/drivers/media/i2c/rdacm21.c ++++ b/drivers/media/i2c/rdacm21.c +@@ -351,7 +351,7 @@ static void ov10640_power_up(struct rdacm21_device *dev) + static int ov10640_check_id(struct rdacm21_device *dev) + { + unsigned int i; +- u8 val; ++ u8 val = 0; + + /* Read OV10640 ID to test communications. */ + for (i = 0; i < OV10640_PID_TIMEOUT; ++i) { +-- +2.40.1 + diff --git a/queue-6.1/media-i2c-tvp5150-check-return-value-of-devm_kasprin.patch b/queue-6.1/media-i2c-tvp5150-check-return-value-of-devm_kasprin.patch new file mode 100644 index 00000000000..527f1623180 --- /dev/null +++ b/queue-6.1/media-i2c-tvp5150-check-return-value-of-devm_kasprin.patch @@ -0,0 +1,41 @@ +From 26f1de36fd20f48bf4377caf8edb45ecdd8a0821 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 12:30:30 +0200 +Subject: media: i2c: tvp5150: check return value of devm_kasprintf() + +From: Claudiu Beznea + +[ Upstream commit 26ce7054d804be73935b9268d6e0ecf2fbbc8aef ] + +devm_kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 0556f1d580d4 ("media: tvp5150: add input source selection of_graph support") +Signed-off-by: Claudiu Beznea +Reviewed-by: Marco Felsch +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/tvp5150.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c +index 859f1cb2fa744..84f87c016f9b5 100644 +--- a/drivers/media/i2c/tvp5150.c ++++ b/drivers/media/i2c/tvp5150.c +@@ -2068,6 +2068,10 @@ static int tvp5150_parse_dt(struct tvp5150 *decoder, struct device_node *np) + tvpc->ent.name = devm_kasprintf(dev, GFP_KERNEL, "%s %s", + v4l2c->name, v4l2c->label ? + v4l2c->label : ""); ++ if (!tvpc->ent.name) { ++ ret = -ENOMEM; ++ goto err_free; ++ } + } + + ep_np = of_graph_get_endpoint_by_regs(np, TVP5150_PAD_VID_OUT, 0); +-- +2.40.1 + diff --git a/queue-6.1/media-mediatek-vcodec-fix-potential-double-free.patch b/queue-6.1/media-mediatek-vcodec-fix-potential-double-free.patch new file mode 100644 index 00000000000..d7cd6c9d548 --- /dev/null +++ b/queue-6.1/media-mediatek-vcodec-fix-potential-double-free.patch @@ -0,0 +1,47 @@ +From c32687ec0e208fd9a0b5a395ca7ce8a8a6caaa40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 16:05:39 +0300 +Subject: media: mediatek: vcodec: fix potential double free + +From: Dan Carpenter + +[ Upstream commit be40f524b6edac4fb9a98ef79620fd9b9497a998 ] + +The "lat_buf->private_data" needs to be set to NULL to prevent a +double free. How this would happen is if vdec_msg_queue_init() failed +twice in a row and on the second time it failed earlier than on the +first time. + +The vdec_msg_queue_init() function has a loop which does: + for (i = 0; i < NUM_BUFFER_COUNT; i++) { + +Each iteration initializes one element in the msg_queue->lat_buf[] array +and then the clean up function vdec_msg_queue_deinit() frees each +element of the msg_queue->lat_buf[] array. This clean up code relies +on the assumption that every element is either initialized or zeroed. +Leaving a freed pointer which is non-zero breaks the assumption. + +Fixes: b199fe46f35c ("media: mtk-vcodec: Add msg queue feature for lat and core architecture") +Signed-off-by: Dan Carpenter +Reviewed-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +index 03f8d7cd8eddc..675f62814f94e 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +@@ -246,6 +246,7 @@ void vdec_msg_queue_deinit(struct vdec_msg_queue *msg_queue, + mtk_vcodec_mem_free(ctx, mem); + + kfree(lat_buf->private_data); ++ lat_buf->private_data = NULL; + } + } + +-- +2.40.1 + diff --git a/queue-6.1/media-mediatek-vcodec-fix-resource-leaks-in-vdec_msg.patch b/queue-6.1/media-mediatek-vcodec-fix-resource-leaks-in-vdec_msg.patch new file mode 100644 index 00000000000..44c453a406e --- /dev/null +++ b/queue-6.1/media-mediatek-vcodec-fix-resource-leaks-in-vdec_msg.patch @@ -0,0 +1,44 @@ +From a2dea6d0e0ff9db228c7d2b07718893a907d0223 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 16:06:47 +0300 +Subject: media: mediatek: vcodec: fix resource leaks in vdec_msg_queue_init() + +From: Dan Carpenter + +[ Upstream commit cf10b0bb503c974ba049d6f888b21178be20a962 ] + +If we encounter any error in the vdec_msg_queue_init() then we need +to set "msg_queue->wdma_addr.size = 0;". Normally, this is done +inside the vdec_msg_queue_deinit() function. However, if the +first call to allocate &msg_queue->wdma_addr fails, then the +vdec_msg_queue_deinit() function is a no-op. For that situation, just +set the size to zero explicitly and return. + +There were two other error paths which did not clean up before returning. +Change those error paths to goto mem_alloc_err. + +Fixes: b199fe46f35c ("media: mtk-vcodec: Add msg queue feature for lat and core architecture") +Fixes: 2f5d0aef37c6 ("media: mediatek: vcodec: support stateless AV1 decoder") +Signed-off-by: Dan Carpenter +Reviewed-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +index 675f62814f94e..a81212c0ade9d 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +@@ -313,6 +313,7 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue, + err = mtk_vcodec_mem_alloc(ctx, &msg_queue->wdma_addr); + if (err) { + mtk_v4l2_err("failed to allocate wdma_addr buf"); ++ msg_queue->wdma_addr.size = 0; + return -ENOMEM; + } + msg_queue->wdma_rptr_addr = msg_queue->wdma_addr.dma_addr; +-- +2.40.1 + diff --git a/queue-6.1/media-mediatek-vcodec-return-null-if-no-vdec_fb-is-f.patch b/queue-6.1/media-mediatek-vcodec-return-null-if-no-vdec_fb-is-f.patch new file mode 100644 index 00000000000..c5b003869bd --- /dev/null +++ b/queue-6.1/media-mediatek-vcodec-return-null-if-no-vdec_fb-is-f.patch @@ -0,0 +1,43 @@ +From 91868bdf8bdf9d0cadb17b86f4ce160dc4f2018f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jul 2023 17:14:41 +0800 +Subject: media: mediatek: vcodec: Return NULL if no vdec_fb is found + +From: Irui Wang + +[ Upstream commit dfa2d6e07432270330ae191f50a0e70636a4cd2b ] + +"fb_use_list" is used to store used or referenced frame buffers for +vp9 stateful decoder. "NULL" should be returned when getting target +frame buffer failed from "fb_use_list", not a random unexpected one. + +Fixes: f77e89854b3e ("[media] vcodec: mediatek: Add Mediatek VP9 Video Decoder Driver") +Signed-off-by: Irui Wang +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c +index 70b8383f7c8ec..a27a109d8d144 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c ++++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_if.c +@@ -226,10 +226,11 @@ static struct vdec_fb *vp9_rm_from_fb_use_list(struct vdec_vp9_inst + if (fb->base_y.va == addr) { + list_move_tail(&node->list, + &inst->available_fb_node_list); +- break; ++ return fb; + } + } +- return fb; ++ ++ return NULL; + } + + static void vp9_add_to_fb_free_list(struct vdec_vp9_inst *inst, +-- +2.40.1 + diff --git a/queue-6.1/media-mtk-jpeg-fix-use-after-free-bug-due-to-uncance.patch b/queue-6.1/media-mtk-jpeg-fix-use-after-free-bug-due-to-uncance.patch new file mode 100644 index 00000000000..43461f22d47 --- /dev/null +++ b/queue-6.1/media-mtk-jpeg-fix-use-after-free-bug-due-to-uncance.patch @@ -0,0 +1,55 @@ +From 78ada2c70cbbcc5377ef1bac859f4ae9946af86f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 17:24:14 +0800 +Subject: media: mtk-jpeg: Fix use after free bug due to uncanceled work + +From: Zheng Wang + +[ Upstream commit c677d7ae83141d390d1253abebafa49c962afb52 ] + +In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with +mtk_jpeg_job_timeout_work. Then mtk_jpeg_dec_device_run +and mtk_jpeg_enc_device_run may be called to start the +work. +If we remove the module which will call mtk_jpeg_remove +to make cleanup, there may be a unfinished work. The +possible sequence is as follows, which will cause a +typical UAF bug. + +Fix it by canceling the work before cleanup in the mtk_jpeg_remove + +CPU0 CPU1 + + |mtk_jpeg_job_timeout_work +mtk_jpeg_remove | + v4l2_m2m_release | + kfree(m2m_dev); | + | + | v4l2_m2m_get_curr_priv + | m2m_dev->curr_ctx //use +Fixes: b2f0d2724ba4 ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder Driver") +Signed-off-by: Zheng Wang +Reviewed-by: Alexandre Mergnat +Reviewed-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +index 3071b61946c3b..e9a4f8abd21c5 100644 +--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c ++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +@@ -1412,6 +1412,7 @@ static int mtk_jpeg_remove(struct platform_device *pdev) + { + struct mtk_jpeg_dev *jpeg = platform_get_drvdata(pdev); + ++ cancel_delayed_work_sync(&jpeg->job_timeout_work); + pm_runtime_disable(&pdev->dev); + video_unregister_device(jpeg->vdev); + v4l2_m2m_release(jpeg->m2m_dev); +-- +2.40.1 + diff --git a/queue-6.1/media-ov2680-add-ov2680_fill_format-helper-function.patch b/queue-6.1/media-ov2680-add-ov2680_fill_format-helper-function.patch new file mode 100644 index 00000000000..d109cb9145a --- /dev/null +++ b/queue-6.1/media-ov2680-add-ov2680_fill_format-helper-function.patch @@ -0,0 +1,146 @@ +From 56e2cc0cf551bbd02a205a7ae3c08cd4e6a0118b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 11:33:21 +0200 +Subject: media: ov2680: Add ov2680_fill_format() helper function + +From: Hans de Goede + +[ Upstream commit 6d6849b2203f3244b575ba01d3e41ee19aa2cadf ] + +Add a ov2680_fill_format() helper function and use this everywhere were +a v4l2_mbus_framefmt struct needs to be filled in so that the driver always +fills it consistently. + +This is a preparation patch for fixing ov2680_set_fmt() +which == V4L2_SUBDEV_FORMAT_TRY calls not properly filling in +the passed in v4l2_mbus_framefmt struct. + +Note that for ov2680_init_cfg() this now simply always fills +the try_fmt struct of the passed in sd_state. This is correct because +ov2680_init_cfg() is never called with a NULL sd_state so the old +sd_state check is not necessary. + +Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver") +Acked-by: Rui Miguel Silva +Reviewed-by: Daniel Scally +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 49 +++++++++++++++++++++----------------- + 1 file changed, 27 insertions(+), 22 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index 4f7ff23ef8973..6e0e8d21d189f 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -54,6 +54,9 @@ + #define OV2680_WIDTH_MAX 1600 + #define OV2680_HEIGHT_MAX 1200 + ++#define OV2680_DEFAULT_WIDTH 800 ++#define OV2680_DEFAULT_HEIGHT 600 ++ + enum ov2680_mode_id { + OV2680_MODE_QUXGA_800_600, + OV2680_MODE_720P_1280_720, +@@ -315,7 +318,8 @@ static void ov2680_power_down(struct ov2680_dev *sensor) + usleep_range(5000, 10000); + } + +-static void ov2680_set_bayer_order(struct ov2680_dev *sensor) ++static void ov2680_set_bayer_order(struct ov2680_dev *sensor, ++ struct v4l2_mbus_framefmt *fmt) + { + int hv_flip = 0; + +@@ -325,7 +329,19 @@ static void ov2680_set_bayer_order(struct ov2680_dev *sensor) + if (sensor->ctrls.hflip && sensor->ctrls.hflip->val) + hv_flip += 2; + +- sensor->fmt.code = ov2680_hv_flip_bayer_order[hv_flip]; ++ fmt->code = ov2680_hv_flip_bayer_order[hv_flip]; ++} ++ ++static void ov2680_fill_format(struct ov2680_dev *sensor, ++ struct v4l2_mbus_framefmt *fmt, ++ unsigned int width, unsigned int height) ++{ ++ memset(fmt, 0, sizeof(*fmt)); ++ fmt->width = width; ++ fmt->height = height; ++ fmt->field = V4L2_FIELD_NONE; ++ fmt->colorspace = V4L2_COLORSPACE_SRGB; ++ ov2680_set_bayer_order(sensor, fmt); + } + + static int ov2680_set_vflip(struct ov2680_dev *sensor, s32 val) +@@ -340,7 +356,7 @@ static int ov2680_set_vflip(struct ov2680_dev *sensor, s32 val) + if (ret < 0) + return ret; + +- ov2680_set_bayer_order(sensor); ++ ov2680_set_bayer_order(sensor, &sensor->fmt); + return 0; + } + +@@ -356,7 +372,7 @@ static int ov2680_set_hflip(struct ov2680_dev *sensor, s32 val) + if (ret < 0) + return ret; + +- ov2680_set_bayer_order(sensor); ++ ov2680_set_bayer_order(sensor, &sensor->fmt); + return 0; + } + +@@ -614,10 +630,7 @@ static int ov2680_set_fmt(struct v4l2_subdev *sd, + goto unlock; + } + +- fmt->width = mode->width; +- fmt->height = mode->height; +- fmt->code = sensor->fmt.code; +- fmt->colorspace = sensor->fmt.colorspace; ++ ov2680_fill_format(sensor, fmt, mode->width, mode->height); + + sensor->current_mode = mode; + sensor->fmt = format->format; +@@ -632,16 +645,11 @@ static int ov2680_set_fmt(struct v4l2_subdev *sd, + static int ov2680_init_cfg(struct v4l2_subdev *sd, + struct v4l2_subdev_state *sd_state) + { +- struct v4l2_subdev_format fmt = { +- .which = sd_state ? V4L2_SUBDEV_FORMAT_TRY +- : V4L2_SUBDEV_FORMAT_ACTIVE, +- .format = { +- .width = 800, +- .height = 600, +- } +- }; ++ struct ov2680_dev *sensor = to_ov2680_dev(sd); + +- return ov2680_set_fmt(sd, sd_state, &fmt); ++ ov2680_fill_format(sensor, &sd_state->pads[0].try_fmt, ++ OV2680_DEFAULT_WIDTH, OV2680_DEFAULT_HEIGHT); ++ return 0; + } + + static int ov2680_enum_frame_size(struct v4l2_subdev *sd, +@@ -740,11 +748,8 @@ static int ov2680_mode_init(struct ov2680_dev *sensor) + const struct ov2680_mode_info *init_mode; + + /* set initial mode */ +- sensor->fmt.code = MEDIA_BUS_FMT_SBGGR10_1X10; +- sensor->fmt.width = 800; +- sensor->fmt.height = 600; +- sensor->fmt.field = V4L2_FIELD_NONE; +- sensor->fmt.colorspace = V4L2_COLORSPACE_SRGB; ++ ov2680_fill_format(sensor, &sensor->fmt, ++ OV2680_DEFAULT_WIDTH, OV2680_DEFAULT_HEIGHT); + + sensor->frame_interval.denominator = OV2680_FRAME_RATE; + sensor->frame_interval.numerator = 1; +-- +2.40.1 + diff --git a/queue-6.1/media-ov2680-don-t-take-the-lock-for-try_fmt-calls.patch b/queue-6.1/media-ov2680-don-t-take-the-lock-for-try_fmt-calls.patch new file mode 100644 index 00000000000..b6c123bc079 --- /dev/null +++ b/queue-6.1/media-ov2680-don-t-take-the-lock-for-try_fmt-calls.patch @@ -0,0 +1,67 @@ +From 3475b686bdb72c5929d4867bbf265e48d733137a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 11:33:20 +0200 +Subject: media: ov2680: Don't take the lock for try_fmt calls + +From: Hans de Goede + +[ Upstream commit e521b9cc1a49de677f4fc65909ce4877fbf7b113 ] + +On ov2680_set_fmt() calls with format->which == V4L2_SUBDEV_FORMAT_TRY, +ov2680_set_fmt() does not talk to the sensor. + +So in this case there is no need to lock the sensor->lock mutex or +to check that the sensor is streaming. + +Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver") +Acked-by: Rui Miguel Silva +Reviewed-by: Daniel Scally +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 20 +++++++++----------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index de11a5fb03659..4f7ff23ef8973 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -595,24 +595,22 @@ static int ov2680_set_fmt(struct v4l2_subdev *sd, + if (format->pad != 0) + return -EINVAL; + +- mutex_lock(&sensor->lock); +- +- if (sensor->is_streaming) { +- ret = -EBUSY; +- goto unlock; +- } +- + mode = v4l2_find_nearest_size(ov2680_mode_data, + ARRAY_SIZE(ov2680_mode_data), width, + height, fmt->width, fmt->height); +- if (!mode) { +- ret = -EINVAL; +- goto unlock; +- } ++ if (!mode) ++ return -EINVAL; + + if (format->which == V4L2_SUBDEV_FORMAT_TRY) { + try_fmt = v4l2_subdev_get_try_format(sd, sd_state, 0); + format->format = *try_fmt; ++ return 0; ++ } ++ ++ mutex_lock(&sensor->lock); ++ ++ if (sensor->is_streaming) { ++ ret = -EBUSY; + goto unlock; + } + +-- +2.40.1 + diff --git a/queue-6.1/media-ov2680-fix-ov2680_bayer_order.patch b/queue-6.1/media-ov2680-fix-ov2680_bayer_order.patch new file mode 100644 index 00000000000..34726588ff5 --- /dev/null +++ b/queue-6.1/media-ov2680-fix-ov2680_bayer_order.patch @@ -0,0 +1,117 @@ +From cf0d02257490053d5d039b618c865e0d537fba85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 11:33:17 +0200 +Subject: media: ov2680: Fix ov2680_bayer_order() + +From: Hans de Goede + +[ Upstream commit 50a7bad4e0a37d7018ab6fe843dd84bc6b2ecf72 ] + +The index into ov2680_hv_flip_bayer_order[] should be 0-3, but +ov2680_bayer_order() was using 0 + BIT(2) + (BIT(2) << 1) as +max index, while the intention was to use: 0 + 1 + 2 as max index. + +Fix the index calculation in ov2680_bayer_order(), while at it +also just use the ctrl values rather then reading them back using +a slow i2c-read transaction. + +This also allows making the function void, since there now are +no more i2c-reads to error check. + +Note the check for the ctrls being NULL is there to allow +adding an ov2680_fill_format() helper later, which will call +ov2680_set_bayer_order() during probe() before the ctrls are created. + +[Sakari Ailus: Change all users of ov2680_set_bayer_order() here] + +Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver") +Reviewed-by: Daniel Scally +Acked-by: Rui Miguel Silva +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 33 ++++++++++++++------------------- + 1 file changed, 14 insertions(+), 19 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index 42efd60c6a96b..7d072448c8530 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -315,26 +315,17 @@ static void ov2680_power_down(struct ov2680_dev *sensor) + usleep_range(5000, 10000); + } + +-static int ov2680_bayer_order(struct ov2680_dev *sensor) ++static void ov2680_set_bayer_order(struct ov2680_dev *sensor) + { +- u32 format1; +- u32 format2; +- u32 hv_flip; +- int ret; +- +- ret = ov2680_read_reg(sensor, OV2680_REG_FORMAT1, &format1); +- if (ret < 0) +- return ret; ++ int hv_flip = 0; + +- ret = ov2680_read_reg(sensor, OV2680_REG_FORMAT2, &format2); +- if (ret < 0) +- return ret; ++ if (sensor->ctrls.vflip && sensor->ctrls.vflip->val) ++ hv_flip += 1; + +- hv_flip = (format2 & BIT(2) << 1) | (format1 & BIT(2)); ++ if (sensor->ctrls.hflip && sensor->ctrls.hflip->val) ++ hv_flip += 2; + + sensor->fmt.code = ov2680_hv_flip_bayer_order[hv_flip]; +- +- return 0; + } + + static int ov2680_vflip_enable(struct ov2680_dev *sensor) +@@ -345,7 +336,8 @@ static int ov2680_vflip_enable(struct ov2680_dev *sensor) + if (ret < 0) + return ret; + +- return ov2680_bayer_order(sensor); ++ ov2680_set_bayer_order(sensor); ++ return 0; + } + + static int ov2680_vflip_disable(struct ov2680_dev *sensor) +@@ -356,7 +348,8 @@ static int ov2680_vflip_disable(struct ov2680_dev *sensor) + if (ret < 0) + return ret; + +- return ov2680_bayer_order(sensor); ++ ov2680_set_bayer_order(sensor); ++ return 0; + } + + static int ov2680_hflip_enable(struct ov2680_dev *sensor) +@@ -367,7 +360,8 @@ static int ov2680_hflip_enable(struct ov2680_dev *sensor) + if (ret < 0) + return ret; + +- return ov2680_bayer_order(sensor); ++ ov2680_set_bayer_order(sensor); ++ return 0; + } + + static int ov2680_hflip_disable(struct ov2680_dev *sensor) +@@ -378,7 +372,8 @@ static int ov2680_hflip_disable(struct ov2680_dev *sensor) + if (ret < 0) + return ret; + +- return ov2680_bayer_order(sensor); ++ ov2680_set_bayer_order(sensor); ++ return 0; + } + + static int ov2680_test_pattern_set(struct ov2680_dev *sensor, int value) +-- +2.40.1 + diff --git a/queue-6.1/media-ov2680-fix-ov2680_set_fmt-which-v4l2_subdev_fo.patch b/queue-6.1/media-ov2680-fix-ov2680_set_fmt-which-v4l2_subdev_fo.patch new file mode 100644 index 00000000000..679b35e0cbc --- /dev/null +++ b/queue-6.1/media-ov2680-fix-ov2680_set_fmt-which-v4l2_subdev_fo.patch @@ -0,0 +1,95 @@ +From 5b2268ea7fd2896327c5165fd9824c5b5515c14b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 11:33:22 +0200 +Subject: media: ov2680: Fix ov2680_set_fmt() which == V4L2_SUBDEV_FORMAT_TRY + not working + +From: Hans de Goede + +[ Upstream commit c0e97a4b4f20639f74cd5809b42ba6cbf9736a7d ] + +ov2680_set_fmt() which == V4L2_SUBDEV_FORMAT_TRY was getting +the try_fmt v4l2_mbus_framefmt struct from the passed in sd_state +and then storing the contents of that into the return by reference +format->format struct. + +While the right thing to do would be filling format->format based on +the just looked up mode and then store the results of that in +sd_state->pads[0].try_fmt . + +Before the previous change introducing ov2680_fill_format() this +resulted in ov2680_set_fmt() which == V4L2_SUBDEV_FORMAT_TRY always +returning the zero-ed out sd_state->pads[0].try_fmt in format->format +breaking callers using this. + +After the introduction of ov2680_fill_format() which at least +initializes sd_state->pads[0].try_fmt properly, format->format +is now always being filled with the default 800x600 mode set by +ov2680_init_cfg() independent of the actual requested mode. + +Move the filling of format->format with ov2680_fill_format() to +before the if (which == V4L2_SUBDEV_FORMAT_TRY) and then store +the filled in format->format in sd_state->pads[0].try_fmt to +fix this. + +Note this removes the fmt local variable because IMHO having a local +variable which points to a sub-struct of one of the function arguments +just leads to confusion when reading the code. + +Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver") +Acked-by: Rui Miguel Silva +Reviewed-by: Daniel Scally +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index 6e0e8d21d189f..a24344ef9852c 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -603,7 +603,6 @@ static int ov2680_set_fmt(struct v4l2_subdev *sd, + struct v4l2_subdev_format *format) + { + struct ov2680_dev *sensor = to_ov2680_dev(sd); +- struct v4l2_mbus_framefmt *fmt = &format->format; + struct v4l2_mbus_framefmt *try_fmt; + const struct ov2680_mode_info *mode; + int ret = 0; +@@ -612,14 +611,18 @@ static int ov2680_set_fmt(struct v4l2_subdev *sd, + return -EINVAL; + + mode = v4l2_find_nearest_size(ov2680_mode_data, +- ARRAY_SIZE(ov2680_mode_data), width, +- height, fmt->width, fmt->height); ++ ARRAY_SIZE(ov2680_mode_data), ++ width, height, ++ format->format.width, ++ format->format.height); + if (!mode) + return -EINVAL; + ++ ov2680_fill_format(sensor, &format->format, mode->width, mode->height); ++ + if (format->which == V4L2_SUBDEV_FORMAT_TRY) { + try_fmt = v4l2_subdev_get_try_format(sd, sd_state, 0); +- format->format = *try_fmt; ++ *try_fmt = format->format; + return 0; + } + +@@ -630,8 +633,6 @@ static int ov2680_set_fmt(struct v4l2_subdev *sd, + goto unlock; + } + +- ov2680_fill_format(sensor, fmt, mode->width, mode->height); +- + sensor->current_mode = mode; + sensor->fmt = format->format; + sensor->mode_pending_changes = true; +-- +2.40.1 + diff --git a/queue-6.1/media-ov2680-fix-regulators-being-left-enabled-on-ov.patch b/queue-6.1/media-ov2680-fix-regulators-being-left-enabled-on-ov.patch new file mode 100644 index 00000000000..08aecd4925a --- /dev/null +++ b/queue-6.1/media-ov2680-fix-regulators-being-left-enabled-on-ov.patch @@ -0,0 +1,64 @@ +From 7acdfee37e225a949f45e12e4055c5665affe4f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 11:33:23 +0200 +Subject: media: ov2680: Fix regulators being left enabled on ov2680_power_on() + errors + +From: Hans de Goede + +[ Upstream commit 84b4bd7e0d98166aa32fd470e672721190492eae ] + +When the ov2680_power_on() "sensor soft reset failed" path is hit during +probe() the WARN() about putting an enabled regulator at +drivers/regulator/core.c:2398 triggers 3 times (once for each regulator), +filling dmesg with backtraces. + +Fix this by properly disabling the regulators on ov2680_power_on() errors. + +Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver") +Reviewed-by: Daniel Scally +Acked-by: Rui Miguel Silva +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index a24344ef9852c..8943e4e78a0df 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -475,7 +475,7 @@ static int ov2680_power_on(struct ov2680_dev *sensor) + ret = ov2680_write_reg(sensor, OV2680_REG_SOFT_RESET, 0x01); + if (ret != 0) { + dev_err(dev, "sensor soft reset failed\n"); +- return ret; ++ goto err_disable_regulators; + } + usleep_range(1000, 2000); + } else { +@@ -485,7 +485,7 @@ static int ov2680_power_on(struct ov2680_dev *sensor) + + ret = clk_prepare_enable(sensor->xvclk); + if (ret < 0) +- return ret; ++ goto err_disable_regulators; + + sensor->is_enabled = true; + +@@ -495,6 +495,10 @@ static int ov2680_power_on(struct ov2680_dev *sensor) + ov2680_stream_disable(sensor); + + return 0; ++ ++err_disable_regulators: ++ regulator_bulk_disable(OV2680_NUM_SUPPLIES, sensor->supplies); ++ return ret; + } + + static int ov2680_s_power(struct v4l2_subdev *sd, int on) +-- +2.40.1 + diff --git a/queue-6.1/media-ov2680-fix-vflip-hflip-set-functions.patch b/queue-6.1/media-ov2680-fix-vflip-hflip-set-functions.patch new file mode 100644 index 00000000000..3aed859c647 --- /dev/null +++ b/queue-6.1/media-ov2680-fix-vflip-hflip-set-functions.patch @@ -0,0 +1,118 @@ +From b6c88db2c566b69b977551367fb02f083f99a542 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 11:33:18 +0200 +Subject: media: ov2680: Fix vflip / hflip set functions + +From: Hans de Goede + +[ Upstream commit d5d08ad330c9ccebc5e066fda815423a290f48b0 ] + +ov2680_vflip_disable() / ov2680_hflip_disable() pass BIT(0) instead of +0 as value to ov2680_mod_reg(). + +While fixing this also: + +1. Stop having separate enable/disable functions for hflip / vflip +2. Move the is_streaming check, which is unique to hflip / vflip + into the ov2680_set_?flip() functions. + +for a nice code cleanup. + +Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver") +Reviewed-by: Daniel Scally +Acked-by: Rui Miguel Silva +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 50 +++++++++----------------------------- + 1 file changed, 12 insertions(+), 38 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index 7d072448c8530..c999a898dfe77 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -328,23 +328,15 @@ static void ov2680_set_bayer_order(struct ov2680_dev *sensor) + sensor->fmt.code = ov2680_hv_flip_bayer_order[hv_flip]; + } + +-static int ov2680_vflip_enable(struct ov2680_dev *sensor) ++static int ov2680_set_vflip(struct ov2680_dev *sensor, s32 val) + { + int ret; + +- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, BIT(2), BIT(2)); +- if (ret < 0) +- return ret; +- +- ov2680_set_bayer_order(sensor); +- return 0; +-} +- +-static int ov2680_vflip_disable(struct ov2680_dev *sensor) +-{ +- int ret; ++ if (sensor->is_streaming) ++ return -EBUSY; + +- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, BIT(2), BIT(0)); ++ ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, ++ BIT(2), val ? BIT(2) : 0); + if (ret < 0) + return ret; + +@@ -352,23 +344,15 @@ static int ov2680_vflip_disable(struct ov2680_dev *sensor) + return 0; + } + +-static int ov2680_hflip_enable(struct ov2680_dev *sensor) ++static int ov2680_set_hflip(struct ov2680_dev *sensor, s32 val) + { + int ret; + +- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, BIT(2), BIT(2)); +- if (ret < 0) +- return ret; +- +- ov2680_set_bayer_order(sensor); +- return 0; +-} +- +-static int ov2680_hflip_disable(struct ov2680_dev *sensor) +-{ +- int ret; ++ if (sensor->is_streaming) ++ return -EBUSY; + +- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, BIT(2), BIT(0)); ++ ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, ++ BIT(2), val ? BIT(2) : 0); + if (ret < 0) + return ret; + +@@ -722,19 +706,9 @@ static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl) + case V4L2_CID_EXPOSURE: + return ov2680_exposure_set(sensor, ctrl->val); + case V4L2_CID_VFLIP: +- if (sensor->is_streaming) +- return -EBUSY; +- if (ctrl->val) +- return ov2680_vflip_enable(sensor); +- else +- return ov2680_vflip_disable(sensor); ++ return ov2680_set_vflip(sensor, ctrl->val); + case V4L2_CID_HFLIP: +- if (sensor->is_streaming) +- return -EBUSY; +- if (ctrl->val) +- return ov2680_hflip_enable(sensor); +- else +- return ov2680_hflip_disable(sensor); ++ return ov2680_set_hflip(sensor, ctrl->val); + case V4L2_CID_TEST_PATTERN: + return ov2680_test_pattern_set(sensor, ctrl->val); + default: +-- +2.40.1 + diff --git a/queue-6.1/media-ov2680-remove-auto-gain-and-auto-exposure-cont.patch b/queue-6.1/media-ov2680-remove-auto-gain-and-auto-exposure-cont.patch new file mode 100644 index 00000000000..d924ad95fca --- /dev/null +++ b/queue-6.1/media-ov2680-remove-auto-gain-and-auto-exposure-cont.patch @@ -0,0 +1,331 @@ +From e06482c2232dd1fe129845013dced7d75480303f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 11:33:16 +0200 +Subject: media: ov2680: Remove auto-gain and auto-exposure controls + +From: Hans de Goede + +[ Upstream commit 7b5a42e6ae71927359ea67a2c22570ba97fa4059 ] + +Quoting the OV2680 datasheet: + +"3.2 exposure and gain control + +In the OV2680, the exposure time and gain are set manually from an external +controller. The OV2680 supports manual gain and exposure control only for +normal applications, no auto mode." + +And indeed testing with the atomisp_ov2680 fork of ov2680.c has shown that +auto-exposure and auto-gain do not work. + +Note that the code setting the auto-exposure flag was broken, callers +of ov2680_exposure_set() were directly passing !!ctrls->auto_exp->val as +"bool auto_exp" value, but ctrls->auto_exp is a menu control with: + +enum v4l2_exposure_auto_type { + V4L2_EXPOSURE_AUTO = 0, + V4L2_EXPOSURE_MANUAL = 1, + ... + +So instead of passing !!ctrls->auto_exp->val they should have been passing +ctrls->auto_exp->val == V4L2_EXPOSURE_AUTO, iow the passed value was +inverted of what it should have been. + +Also remove ov2680_g_volatile_ctrl() since without auto support the gain +and exposure controls are not volatile. + +This also fixes the control values not being properly applied in +ov2680_mode_set(). The 800x600 mode register-list also sets gain, +exposure and vflip overriding the last set ctrl values. + +ov2680_mode_set() does call ov2680_gain_set() and ov2680_exposure_set() +but did this before writing the mode register-list, so these values +would still be overridden by the mode register-list. + +Add a v4l2_ctrl_handler_setup() call after writing the mode register-list +to restore all ctrl values. Also remove the ctrls->gain->is_new check from +ov2680_gain_set() so that the gain always gets restored properly. + +Last since ov2680_mode_set() now calls v4l2_ctrl_handler_setup(), remove +the v4l2_ctrl_handler_setup() call after ov2680_mode_restore() since +ov2680_mode_restore() calls ov2680_mode_set(). + +Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver") +Reviewed-by: Daniel Scally +Acked-by: Rui Miguel Silva +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 161 ++++--------------------------------- + 1 file changed, 17 insertions(+), 144 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index 54153bf66bddc..42efd60c6a96b 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -85,15 +85,8 @@ struct ov2680_mode_info { + + struct ov2680_ctrls { + struct v4l2_ctrl_handler handler; +- struct { +- struct v4l2_ctrl *auto_exp; +- struct v4l2_ctrl *exposure; +- }; +- struct { +- struct v4l2_ctrl *auto_gain; +- struct v4l2_ctrl *gain; +- }; +- ++ struct v4l2_ctrl *exposure; ++ struct v4l2_ctrl *gain; + struct v4l2_ctrl *hflip; + struct v4l2_ctrl *vflip; + struct v4l2_ctrl *test_pattern; +@@ -143,6 +136,7 @@ static const struct reg_value ov2680_setting_30fps_QUXGA_800_600[] = { + {0x380e, 0x02}, {0x380f, 0x84}, {0x3811, 0x04}, {0x3813, 0x04}, + {0x3814, 0x31}, {0x3815, 0x31}, {0x3820, 0xc0}, {0x4008, 0x00}, + {0x4009, 0x03}, {0x4837, 0x1e}, {0x3501, 0x4e}, {0x3502, 0xe0}, ++ {0x3503, 0x03}, + }; + + static const struct reg_value ov2680_setting_30fps_720P_1280_720[] = { +@@ -405,69 +399,15 @@ static int ov2680_test_pattern_set(struct ov2680_dev *sensor, int value) + return 0; + } + +-static int ov2680_gain_set(struct ov2680_dev *sensor, bool auto_gain) +-{ +- struct ov2680_ctrls *ctrls = &sensor->ctrls; +- u32 gain; +- int ret; +- +- ret = ov2680_mod_reg(sensor, OV2680_REG_R_MANUAL, BIT(1), +- auto_gain ? 0 : BIT(1)); +- if (ret < 0) +- return ret; +- +- if (auto_gain || !ctrls->gain->is_new) +- return 0; +- +- gain = ctrls->gain->val; +- +- ret = ov2680_write_reg16(sensor, OV2680_REG_GAIN_PK, gain); +- +- return 0; +-} +- +-static int ov2680_gain_get(struct ov2680_dev *sensor) +-{ +- u32 gain; +- int ret; +- +- ret = ov2680_read_reg16(sensor, OV2680_REG_GAIN_PK, &gain); +- if (ret) +- return ret; +- +- return gain; +-} +- +-static int ov2680_exposure_set(struct ov2680_dev *sensor, bool auto_exp) ++static int ov2680_gain_set(struct ov2680_dev *sensor, u32 gain) + { +- struct ov2680_ctrls *ctrls = &sensor->ctrls; +- u32 exp; +- int ret; +- +- ret = ov2680_mod_reg(sensor, OV2680_REG_R_MANUAL, BIT(0), +- auto_exp ? 0 : BIT(0)); +- if (ret < 0) +- return ret; +- +- if (auto_exp || !ctrls->exposure->is_new) +- return 0; +- +- exp = (u32)ctrls->exposure->val; +- exp <<= 4; +- +- return ov2680_write_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, exp); ++ return ov2680_write_reg16(sensor, OV2680_REG_GAIN_PK, gain); + } + +-static int ov2680_exposure_get(struct ov2680_dev *sensor) ++static int ov2680_exposure_set(struct ov2680_dev *sensor, u32 exp) + { +- int ret; +- u32 exp; +- +- ret = ov2680_read_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, &exp); +- if (ret) +- return ret; +- +- return exp >> 4; ++ return ov2680_write_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, ++ exp << 4); + } + + static int ov2680_stream_enable(struct ov2680_dev *sensor) +@@ -482,33 +422,17 @@ static int ov2680_stream_disable(struct ov2680_dev *sensor) + + static int ov2680_mode_set(struct ov2680_dev *sensor) + { +- struct ov2680_ctrls *ctrls = &sensor->ctrls; + int ret; + +- ret = ov2680_gain_set(sensor, false); +- if (ret < 0) +- return ret; +- +- ret = ov2680_exposure_set(sensor, false); ++ ret = ov2680_load_regs(sensor, sensor->current_mode); + if (ret < 0) + return ret; + +- ret = ov2680_load_regs(sensor, sensor->current_mode); ++ /* Restore value of all ctrls */ ++ ret = __v4l2_ctrl_handler_setup(&sensor->ctrls.handler); + if (ret < 0) + return ret; + +- if (ctrls->auto_gain->val) { +- ret = ov2680_gain_set(sensor, true); +- if (ret < 0) +- return ret; +- } +- +- if (ctrls->auto_exp->val == V4L2_EXPOSURE_AUTO) { +- ret = ov2680_exposure_set(sensor, true); +- if (ret < 0) +- return ret; +- } +- + sensor->mode_pending_changes = false; + + return 0; +@@ -590,15 +514,10 @@ static int ov2680_s_power(struct v4l2_subdev *sd, int on) + else + ret = ov2680_power_off(sensor); + +- mutex_unlock(&sensor->lock); +- +- if (on && ret == 0) { +- ret = v4l2_ctrl_handler_setup(&sensor->ctrls.handler); +- if (ret < 0) +- return ret; +- ++ if (on && ret == 0) + ret = ov2680_mode_restore(sensor); +- } ++ ++ mutex_unlock(&sensor->lock); + + return ret; + } +@@ -794,52 +713,19 @@ static int ov2680_enum_frame_interval(struct v4l2_subdev *sd, + return 0; + } + +-static int ov2680_g_volatile_ctrl(struct v4l2_ctrl *ctrl) +-{ +- struct v4l2_subdev *sd = ctrl_to_sd(ctrl); +- struct ov2680_dev *sensor = to_ov2680_dev(sd); +- struct ov2680_ctrls *ctrls = &sensor->ctrls; +- int val; +- +- if (!sensor->is_enabled) +- return 0; +- +- switch (ctrl->id) { +- case V4L2_CID_GAIN: +- val = ov2680_gain_get(sensor); +- if (val < 0) +- return val; +- ctrls->gain->val = val; +- break; +- case V4L2_CID_EXPOSURE: +- val = ov2680_exposure_get(sensor); +- if (val < 0) +- return val; +- ctrls->exposure->val = val; +- break; +- } +- +- return 0; +-} +- + static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl) + { + struct v4l2_subdev *sd = ctrl_to_sd(ctrl); + struct ov2680_dev *sensor = to_ov2680_dev(sd); +- struct ov2680_ctrls *ctrls = &sensor->ctrls; + + if (!sensor->is_enabled) + return 0; + + switch (ctrl->id) { +- case V4L2_CID_AUTOGAIN: +- return ov2680_gain_set(sensor, !!ctrl->val); + case V4L2_CID_GAIN: +- return ov2680_gain_set(sensor, !!ctrls->auto_gain->val); +- case V4L2_CID_EXPOSURE_AUTO: +- return ov2680_exposure_set(sensor, !!ctrl->val); ++ return ov2680_gain_set(sensor, ctrl->val); + case V4L2_CID_EXPOSURE: +- return ov2680_exposure_set(sensor, !!ctrls->auto_exp->val); ++ return ov2680_exposure_set(sensor, ctrl->val); + case V4L2_CID_VFLIP: + if (sensor->is_streaming) + return -EBUSY; +@@ -864,7 +750,6 @@ static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl) + } + + static const struct v4l2_ctrl_ops ov2680_ctrl_ops = { +- .g_volatile_ctrl = ov2680_g_volatile_ctrl, + .s_ctrl = ov2680_s_ctrl, + }; + +@@ -936,7 +821,7 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor) + if (ret < 0) + return ret; + +- v4l2_ctrl_handler_init(hdl, 7); ++ v4l2_ctrl_handler_init(hdl, 5); + + hdl->lock = &sensor->lock; + +@@ -948,16 +833,9 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor) + ARRAY_SIZE(test_pattern_menu) - 1, + 0, 0, test_pattern_menu); + +- ctrls->auto_exp = v4l2_ctrl_new_std_menu(hdl, ops, +- V4L2_CID_EXPOSURE_AUTO, +- V4L2_EXPOSURE_MANUAL, 0, +- V4L2_EXPOSURE_AUTO); +- + ctrls->exposure = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_EXPOSURE, + 0, 32767, 1, 0); + +- ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_AUTOGAIN, +- 0, 1, 1, 1); + ctrls->gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_GAIN, 0, 2047, 1, 0); + + if (hdl->error) { +@@ -965,14 +843,9 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor) + goto cleanup_entity; + } + +- ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE; +- ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE; + ctrls->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT; + ctrls->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT; + +- v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true); +- v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true); +- + sensor->sd.ctrl_handler = hdl; + + ret = v4l2_async_register_subdev(&sensor->sd); +-- +2.40.1 + diff --git a/queue-6.1/media-ov2680-remove-video_v4l2_subdev_api-ifdef-s.patch b/queue-6.1/media-ov2680-remove-video_v4l2_subdev_api-ifdef-s.patch new file mode 100644 index 00000000000..99fe7827a52 --- /dev/null +++ b/queue-6.1/media-ov2680-remove-video_v4l2_subdev_api-ifdef-s.patch @@ -0,0 +1,99 @@ +From 96fa6b4a90ec9046859e245be979e26f0011cb63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 11:33:19 +0200 +Subject: media: ov2680: Remove VIDEO_V4L2_SUBDEV_API ifdef-s + +From: Hans de Goede + +[ Upstream commit 49c282d5a8c5f4d1d9088622bec792294c716010 ] + +VIDEO_V4L2_SUBDEV_API is now automatically selected in Kconfig +for all sensor drivers. Remove the ifdef CONFIG_VIDEO_V4L2_SUBDEV_API +checks. + +This is a preparation patch for fixing ov2680_set_fmt() +which == V4L2_SUBDEV_FORMAT_TRY calls not properly filling in +the passed in v4l2_mbus_framefmt struct. + +Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver") +Reviewed-by: Daniel Scally +Acked-by: Rui Miguel Silva +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 16 ++-------------- + 1 file changed, 2 insertions(+), 14 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index c999a898dfe77..de11a5fb03659 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -562,7 +562,6 @@ static int ov2680_get_fmt(struct v4l2_subdev *sd, + { + struct ov2680_dev *sensor = to_ov2680_dev(sd); + struct v4l2_mbus_framefmt *fmt = NULL; +- int ret = 0; + + if (format->pad != 0) + return -EINVAL; +@@ -570,22 +569,17 @@ static int ov2680_get_fmt(struct v4l2_subdev *sd, + mutex_lock(&sensor->lock); + + if (format->which == V4L2_SUBDEV_FORMAT_TRY) { +-#ifdef CONFIG_VIDEO_V4L2_SUBDEV_API + fmt = v4l2_subdev_get_try_format(&sensor->sd, sd_state, + format->pad); +-#else +- ret = -EINVAL; +-#endif + } else { + fmt = &sensor->fmt; + } + +- if (fmt) +- format->format = *fmt; ++ format->format = *fmt; + + mutex_unlock(&sensor->lock); + +- return ret; ++ return 0; + } + + static int ov2680_set_fmt(struct v4l2_subdev *sd, +@@ -594,9 +588,7 @@ static int ov2680_set_fmt(struct v4l2_subdev *sd, + { + struct ov2680_dev *sensor = to_ov2680_dev(sd); + struct v4l2_mbus_framefmt *fmt = &format->format; +-#ifdef CONFIG_VIDEO_V4L2_SUBDEV_API + struct v4l2_mbus_framefmt *try_fmt; +-#endif + const struct ov2680_mode_info *mode; + int ret = 0; + +@@ -619,10 +611,8 @@ static int ov2680_set_fmt(struct v4l2_subdev *sd, + } + + if (format->which == V4L2_SUBDEV_FORMAT_TRY) { +-#ifdef CONFIG_VIDEO_V4L2_SUBDEV_API + try_fmt = v4l2_subdev_get_try_format(sd, sd_state, 0); + format->format = *try_fmt; +-#endif + goto unlock; + } + +@@ -780,9 +770,7 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor) + v4l2_i2c_subdev_init(&sensor->sd, sensor->i2c_client, + &ov2680_subdev_ops); + +-#ifdef CONFIG_VIDEO_V4L2_SUBDEV_API + sensor->sd.flags = V4L2_SUBDEV_FL_HAS_DEVNODE; +-#endif + sensor->pad.flags = MEDIA_PAD_FL_SOURCE; + sensor->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR; + +-- +2.40.1 + diff --git a/queue-6.1/media-ov5640-enable-mipi-interface-in-ov5640_set_pow.patch b/queue-6.1/media-ov5640-enable-mipi-interface-in-ov5640_set_pow.patch new file mode 100644 index 00000000000..efd696042aa --- /dev/null +++ b/queue-6.1/media-ov5640-enable-mipi-interface-in-ov5640_set_pow.patch @@ -0,0 +1,51 @@ +From 8902d07fe1ff9eed60f05cac38fcfad7958d819e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Aug 2023 16:47:25 +0200 +Subject: media: ov5640: Enable MIPI interface in ov5640_set_power_mipi() + +From: Marek Vasut + +[ Upstream commit 98cb72d3b9c5e03b10fa993752ecfcbd9c572d8c ] + +Set OV5640_REG_IO_MIPI_CTRL00 bit 2 to 1 instead of 0, since 1 means +MIPI CSI2 interface, while 0 means CPI parallel interface. + +In the ov5640_set_power_mipi() the interface should obviously be set +to MIPI CSI2 since this functions is used to power up the sensor when +operated in MIPI CSI2 mode. The sensor should not be in CPI mode in +that case. + +This fixes a corner case where capturing the first frame on i.MX8MN +with CSI/ISI resulted in corrupted frame. + +Fixes: aa4bb8b8838f ("media: ov5640: Re-work MIPI startup sequence") +Reviewed-by: Jacopo Mondi +Tested-by: Jacopo Mondi # [Test on imx6q] +Signed-off-by: Marek Vasut +Tested-by: Jai Luthra # [Test on bplay, sk-am62] +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov5640.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index cc23ff2067f6a..f76bcb395cffa 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -2531,9 +2531,9 @@ static int ov5640_set_power_mipi(struct ov5640_dev *sensor, bool on) + * "ov5640_set_stream_mipi()") + * [4] = 0 : Power up MIPI HS Tx + * [3] = 0 : Power up MIPI LS Rx +- * [2] = 0 : MIPI interface disabled ++ * [2] = 1 : MIPI interface enabled + */ +- ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x40); ++ ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x44); + if (ret) + return ret; + +-- +2.40.1 + diff --git a/queue-6.1/media-ov5640-fix-initial-resetb-state-and-annotate-t.patch b/queue-6.1/media-ov5640-fix-initial-resetb-state-and-annotate-t.patch new file mode 100644 index 00000000000..067edf77646 --- /dev/null +++ b/queue-6.1/media-ov5640-fix-initial-resetb-state-and-annotate-t.patch @@ -0,0 +1,72 @@ +From e4f8fbdac810e92ee5013354cd0f93eaad9dc2c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 00:21:16 +0200 +Subject: media: ov5640: Fix initial RESETB state and annotate timings + +From: Marek Vasut + +[ Upstream commit a210df337c5f5c2cd82f36c9dbb154ec63365c80 ] + +The initial state of RESETB input signal of OV5640 should be +asserted, i.e. the sensor should be in reset. This is not the +case, make it so. + +Since the subsequent assertion of RESETB signal is no longer +necessary and the timing of the power sequencing could be +slightly adjusted, add annotations to the delays which match +OV5640 datasheet rev. 2.03, both: + figure 2-3 power up timing with internal DVDD + figure 2-4 power up timing with external DVDD source + +The 5..10ms delay between PWDN assertion and RESETB assertion +is not even documented in the power sequencing diagram, and +with this reset fix, it is no longer even necessary. + +Fixes: 19a81c1426c1 ("[media] add Omnivision OV5640 sensor driver") +Reported-by: Jacopo Mondi +Signed-off-by: Marek Vasut +Reviewed-by: Jacopo Mondi +Tested-by: Jai Luthra +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov5640.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index f76bcb395cffa..2ee832426736d 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -2441,16 +2441,13 @@ static void ov5640_power(struct ov5640_dev *sensor, bool enable) + static void ov5640_powerup_sequence(struct ov5640_dev *sensor) + { + if (sensor->pwdn_gpio) { +- gpiod_set_value_cansleep(sensor->reset_gpio, 0); ++ gpiod_set_value_cansleep(sensor->reset_gpio, 1); + + /* camera power cycle */ + ov5640_power(sensor, false); +- usleep_range(5000, 10000); ++ usleep_range(5000, 10000); /* t2 */ + ov5640_power(sensor, true); +- usleep_range(5000, 10000); +- +- gpiod_set_value_cansleep(sensor->reset_gpio, 1); +- usleep_range(1000, 2000); ++ usleep_range(1000, 2000); /* t3 */ + + gpiod_set_value_cansleep(sensor->reset_gpio, 0); + } else { +@@ -2458,7 +2455,7 @@ static void ov5640_powerup_sequence(struct ov5640_dev *sensor) + ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, + OV5640_REG_SYS_CTRL0_SW_RST); + } +- usleep_range(20000, 25000); ++ usleep_range(20000, 25000); /* t4 */ + + /* + * software standby: allows registers programming; +-- +2.40.1 + diff --git a/queue-6.1/media-ov5640-fix-low-resolution-image-abnormal-issue.patch b/queue-6.1/media-ov5640-fix-low-resolution-image-abnormal-issue.patch new file mode 100644 index 00000000000..beaf4174576 --- /dev/null +++ b/queue-6.1/media-ov5640-fix-low-resolution-image-abnormal-issue.patch @@ -0,0 +1,64 @@ +From 4754cd29ab3425b622113b257b895e4fe10a6e2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 04:43:40 +0200 +Subject: media: ov5640: fix low resolution image abnormal issue + +From: Guoniu.zhou + +[ Upstream commit a828002f38c5ee49d3f0c0e64c0f0caa1aec8dc2 ] + +OV5640 will output abnormal image data when work at low resolution +(320x240, 176x144 and 160x120) after switching from high resolution, +such as 1080P, the time interval between high and low switching must +be less than 1000ms in order to OV5640 don't enter suspend state during +the time. + +The reason is by 0x3824 value don't restore to initialize value when +do resolution switching. In high resolution setting array, 0x3824 is +set to 0x04, but low resolution setting array remove 0x3824 in commit +db15c1957a2d ("media: ov5640: Remove duplicated mode settings"). So +when do resolution switching from high to low, such as 1080P to 320x240, +and the time interval is less than auto suspend delay time which means +global initialize setting array will not be loaded, the output image +data are abnormal. Hence move 0x3824 from ov5640_init_setting[] table +to ov5640_setting_low_res[] table and also move 0x4407 0x460b, 0x460c +to avoid same issue. + +Fixes: db15c1957a2d ("media: ov5640: Remove duplicated mode settings") +Signed-off-by: Guoniu.zhou +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov5640.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index 267f514023e72..cc23ff2067f6a 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -557,9 +557,7 @@ static const struct reg_value ov5640_init_setting[] = { + {0x4001, 0x02, 0, 0}, {0x4004, 0x02, 0, 0}, {0x3000, 0x00, 0, 0}, + {0x3002, 0x1c, 0, 0}, {0x3004, 0xff, 0, 0}, {0x3006, 0xc3, 0, 0}, + {0x302e, 0x08, 0, 0}, {0x4300, 0x3f, 0, 0}, +- {0x501f, 0x00, 0, 0}, {0x4407, 0x04, 0, 0}, +- {0x440e, 0x00, 0, 0}, {0x460b, 0x35, 0, 0}, {0x460c, 0x22, 0, 0}, +- {0x4837, 0x0a, 0, 0}, {0x3824, 0x02, 0, 0}, ++ {0x501f, 0x00, 0, 0}, {0x440e, 0x00, 0, 0}, {0x4837, 0x0a, 0, 0}, + {0x5000, 0xa7, 0, 0}, {0x5001, 0xa3, 0, 0}, {0x5180, 0xff, 0, 0}, + {0x5181, 0xf2, 0, 0}, {0x5182, 0x00, 0, 0}, {0x5183, 0x14, 0, 0}, + {0x5184, 0x25, 0, 0}, {0x5185, 0x24, 0, 0}, {0x5186, 0x09, 0, 0}, +@@ -623,7 +621,8 @@ static const struct reg_value ov5640_setting_low_res[] = { + {0x3a0a, 0x00, 0, 0}, {0x3a0b, 0xf6, 0, 0}, {0x3a0e, 0x03, 0, 0}, + {0x3a0d, 0x04, 0, 0}, {0x3a14, 0x03, 0, 0}, {0x3a15, 0xd8, 0, 0}, + {0x4001, 0x02, 0, 0}, {0x4004, 0x02, 0, 0}, +- {0x4407, 0x04, 0, 0}, {0x5001, 0xa3, 0, 0}, ++ {0x4407, 0x04, 0, 0}, {0x460b, 0x35, 0, 0}, {0x460c, 0x22, 0, 0}, ++ {0x3824, 0x02, 0, 0}, {0x5001, 0xa3, 0, 0}, + }; + + static const struct reg_value ov5640_setting_720P_1280_720[] = { +-- +2.40.1 + diff --git a/queue-6.1/media-rkvdec-increase-max-supported-height-for-h.264.patch b/queue-6.1/media-rkvdec-increase-max-supported-height-for-h.264.patch new file mode 100644 index 00000000000..daf0ad633ba --- /dev/null +++ b/queue-6.1/media-rkvdec-increase-max-supported-height-for-h.264.patch @@ -0,0 +1,37 @@ +From e22af16d79a26bb942c3d63f4265e22e708225a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 17:06:11 +0200 +Subject: media: rkvdec: increase max supported height for H.264 + +From: Benjamin Gaignard + +[ Upstream commit f000e6ca2d60fefd02a180a57df2c4162fa0c1b7 ] + +After testing it is possible for the hardware to decode H264 +bistream with a height up to 2560. + +Signed-off-by: Benjamin Gaignard +Fixes: cd33c830448ba ("media: rkvdec: Add the rkvdec driver") +Reviewed-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/staging/media/rkvdec/rkvdec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c +index 82806f198074a..a9bd1e71ea487 100644 +--- a/drivers/staging/media/rkvdec/rkvdec.c ++++ b/drivers/staging/media/rkvdec/rkvdec.c +@@ -120,7 +120,7 @@ static const struct rkvdec_coded_fmt_desc rkvdec_coded_fmts[] = { + .max_width = 4096, + .step_width = 16, + .min_height = 48, +- .max_height = 2304, ++ .max_height = 2560, + .step_height = 16, + }, + .ctrls = &rkvdec_h264_ctrls, +-- +2.40.1 + diff --git a/queue-6.1/media-v4l2-core-fix-a-potential-resource-leak-in-v4l.patch b/queue-6.1/media-v4l2-core-fix-a-potential-resource-leak-in-v4l.patch new file mode 100644 index 00000000000..8b104ad7c7c --- /dev/null +++ b/queue-6.1/media-v4l2-core-fix-a-potential-resource-leak-in-v4l.patch @@ -0,0 +1,71 @@ +From 514435a073b9a0ec85c3c71f07f0d4c824dc0d96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 20:31:05 +0200 +Subject: media: v4l2-core: Fix a potential resource leak in + v4l2_fwnode_parse_link() + +From: Christophe JAILLET + +[ Upstream commit d7b13edd4cb4bfa335b6008ab867ac28582d3e5c ] + +If fwnode_graph_get_remote_endpoint() fails, 'fwnode' is known to be NULL, +so fwnode_handle_put() is a no-op. + +Release the reference taken from a previous fwnode_graph_get_port_parent() +call instead. + +Also handle fwnode_graph_get_port_parent() failures. + +In order to fix these issues, add an error handling path to the function +and the needed gotos. + +Fixes: ca50c197bd96 ("[media] v4l: fwnode: Support generic fwnode for parsing standardised properties") +Signed-off-by: Christophe JAILLET +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-fwnode.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c +index 3d85a8600f576..69c8b3b656860 100644 +--- a/drivers/media/v4l2-core/v4l2-fwnode.c ++++ b/drivers/media/v4l2-core/v4l2-fwnode.c +@@ -551,19 +551,29 @@ int v4l2_fwnode_parse_link(struct fwnode_handle *fwnode, + link->local_id = fwep.id; + link->local_port = fwep.port; + link->local_node = fwnode_graph_get_port_parent(fwnode); ++ if (!link->local_node) ++ return -ENOLINK; + + fwnode = fwnode_graph_get_remote_endpoint(fwnode); +- if (!fwnode) { +- fwnode_handle_put(fwnode); +- return -ENOLINK; +- } ++ if (!fwnode) ++ goto err_put_local_node; + + fwnode_graph_parse_endpoint(fwnode, &fwep); + link->remote_id = fwep.id; + link->remote_port = fwep.port; + link->remote_node = fwnode_graph_get_port_parent(fwnode); ++ if (!link->remote_node) ++ goto err_put_remote_endpoint; + + return 0; ++ ++err_put_remote_endpoint: ++ fwnode_handle_put(fwnode); ++ ++err_put_local_node: ++ fwnode_handle_put(link->local_node); ++ ++ return -ENOLINK; + } + EXPORT_SYMBOL_GPL(v4l2_fwnode_parse_link); + +-- +2.40.1 + diff --git a/queue-6.1/media-venus-hfi_venus-only-consider-sys_idle_indicat.patch b/queue-6.1/media-venus-hfi_venus-only-consider-sys_idle_indicat.patch new file mode 100644 index 00000000000..83557a27501 --- /dev/null +++ b/queue-6.1/media-venus-hfi_venus-only-consider-sys_idle_indicat.patch @@ -0,0 +1,69 @@ +From 5b69dd18ded8112c10abbaa33b491f6ef0cbef71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 14:30:35 +0200 +Subject: media: venus: hfi_venus: Only consider sys_idle_indicator on V1 + +From: Konrad Dybcio + +[ Upstream commit 6283e4834c69fa93a108efa18c6aa09c7e626f49 ] + +As per information from Qualcomm [1], this property is not really +supported beyond msm8916 (HFI V1) and some newer HFI versions really +dislike receiving it, going as far as crashing the device. + +Only consider toggling it (via the module option) on HFIV1. +While at it, get rid of the global static variable (which defaulted +to zero) which was never explicitly assigned to for V1. + +Note: [1] is a reply to the actual message in question, as lore did not +properly receive some of the emails.. + +[1] https://lore.kernel.org/lkml/955cd520-3881-0c22-d818-13fe9a47e124@linaro.org/ +Fixes: 7ed9e0b3393c ("media: venus: hfi, vdec: v6 Add IS_V6() to existing IS_V4() if locations") +Signed-off-by: Konrad Dybcio +Signed-off-by: Stanimir Varbanov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/hfi_venus.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c +index 2ad40b3945b0b..bff435abd59ba 100644 +--- a/drivers/media/platform/qcom/venus/hfi_venus.c ++++ b/drivers/media/platform/qcom/venus/hfi_venus.c +@@ -131,7 +131,6 @@ struct venus_hfi_device { + + static bool venus_pkt_debug; + int venus_fw_debug = HFI_DEBUG_MSG_ERROR | HFI_DEBUG_MSG_FATAL; +-static bool venus_sys_idle_indicator; + static bool venus_fw_low_power_mode = true; + static int venus_hw_rsp_timeout = 1000; + static bool venus_fw_coverage; +@@ -947,17 +946,12 @@ static int venus_sys_set_default_properties(struct venus_hfi_device *hdev) + if (ret) + dev_warn(dev, "setting fw debug msg ON failed (%d)\n", ret); + +- /* +- * Idle indicator is disabled by default on some 4xx firmware versions, +- * enable it explicitly in order to make suspend functional by checking +- * WFI (wait-for-interrupt) bit. +- */ +- if (IS_V4(hdev->core) || IS_V6(hdev->core)) +- venus_sys_idle_indicator = true; +- +- ret = venus_sys_set_idle_message(hdev, venus_sys_idle_indicator); +- if (ret) +- dev_warn(dev, "setting idle response ON failed (%d)\n", ret); ++ /* HFI_PROPERTY_SYS_IDLE_INDICATOR is not supported beyond 8916 (HFI V1) */ ++ if (IS_V1(hdev->core)) { ++ ret = venus_sys_set_idle_message(hdev, false); ++ if (ret) ++ dev_warn(dev, "setting idle response ON failed (%d)\n", ret); ++ } + + ret = venus_sys_set_power_control(hdev, venus_fw_low_power_mode); + if (ret) +-- +2.40.1 + diff --git a/queue-6.1/mlxsw-core_hwmon-adjust-module-label-names-based-on-.patch b/queue-6.1/mlxsw-core_hwmon-adjust-module-label-names-based-on-.patch new file mode 100644 index 00000000000..e19aaf593ee --- /dev/null +++ b/queue-6.1/mlxsw-core_hwmon-adjust-module-label-names-based-on-.patch @@ -0,0 +1,62 @@ +From e7b30694e22cd52eeac5ebe9430c910ca97ce389 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 15:43:10 +0200 +Subject: mlxsw: core_hwmon: Adjust module label names based on MTCAP sensor + counter +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vadim Pasternak + +[ Upstream commit 3fc134a07438055fc93ce1bbacf2702ddd09500c ] + +Transceiver module temperature sensors are indexed after ASIC and +platform sensors. The current label printing method does not take this +into account and simply prints the index of the transceiver module +sensor. + +On new systems that have platform sensors this results in incorrect +(shifted) transceiver module labels being printed: + +$ sensors +[...] +front panel 002: +37.0°C (crit = +70.0°C, emerg = +75.0°C) +front panel 003: +47.0°C (crit = +70.0°C, emerg = +75.0°C) +[...] + +Fix by taking the sensor count into account. After the fix: + +$ sensors +[...] +front panel 001: +37.0°C (crit = +70.0°C, emerg = +75.0°C) +front panel 002: +47.0°C (crit = +70.0°C, emerg = +75.0°C) +[...] + +Fixes: a53779de6a0e ("mlxsw: core: Add QSFP module temperature label attribute to hwmon") +Signed-off-by: Vadim Pasternak +Reviewed-by: Ido Schimmel +Signed-off-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c +index 70735068cf292..0fd290d776ffe 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c +@@ -405,7 +405,8 @@ mlxsw_hwmon_module_temp_label_show(struct device *dev, + container_of(attr, struct mlxsw_hwmon_attr, dev_attr); + + return sprintf(buf, "front panel %03u\n", +- mlxsw_hwmon_attr->type_index); ++ mlxsw_hwmon_attr->type_index + 1 - ++ mlxsw_hwmon_attr->mlxsw_hwmon_dev->sensor_count); + } + + static ssize_t +-- +2.40.1 + diff --git a/queue-6.1/mlxsw-i2c-fix-chunk-size-setting-in-output-mailbox-b.patch b/queue-6.1/mlxsw-i2c-fix-chunk-size-setting-in-output-mailbox-b.patch new file mode 100644 index 00000000000..4ff7d217831 --- /dev/null +++ b/queue-6.1/mlxsw-i2c-fix-chunk-size-setting-in-output-mailbox-b.patch @@ -0,0 +1,43 @@ +From e43b2aee31c8bb47eec56d8f24ba53df985908ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 15:43:08 +0200 +Subject: mlxsw: i2c: Fix chunk size setting in output mailbox buffer + +From: Vadim Pasternak + +[ Upstream commit 146c7c330507c0384bf29d567186632bfe975927 ] + +The driver reads commands output from the output mailbox. If the size +of the output mailbox is not a multiple of the transaction / +block size, then the driver will not issue enough read transactions +to read the entire output, which can result in driver initialization +errors. + +Fix by determining the number of transactions using DIV_ROUND_UP(). + +Fixes: 3029a693beda ("mlxsw: i2c: Allow flexible setting of I2C transactions size") +Signed-off-by: Vadim Pasternak +Reviewed-by: Ido Schimmel +Signed-off-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/i2c.c b/drivers/net/ethernet/mellanox/mlxsw/i2c.c +index f5f5f8dc3d190..26e05f129e35a 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/i2c.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/i2c.c +@@ -444,7 +444,7 @@ mlxsw_i2c_cmd(struct device *dev, u16 opcode, u32 in_mod, size_t in_mbox_size, + } else { + /* No input mailbox is case of initialization query command. */ + reg_size = MLXSW_I2C_MAX_DATA_SIZE; +- num = reg_size / mlxsw_i2c->block_size; ++ num = DIV_ROUND_UP(reg_size, mlxsw_i2c->block_size); + + if (mutex_lock_interruptible(&mlxsw_i2c->cmd.lock) < 0) { + dev_err(&client->dev, "Could not acquire lock"); +-- +2.40.1 + diff --git a/queue-6.1/mlxsw-i2c-limit-single-transaction-buffer-size.patch b/queue-6.1/mlxsw-i2c-limit-single-transaction-buffer-size.patch new file mode 100644 index 00000000000..1e51f76ec07 --- /dev/null +++ b/queue-6.1/mlxsw-i2c-limit-single-transaction-buffer-size.patch @@ -0,0 +1,56 @@ +From d6ce77a9dda57fed79fdfe3d839508ba71538e89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 15:43:09 +0200 +Subject: mlxsw: i2c: Limit single transaction buffer size + +From: Vadim Pasternak + +[ Upstream commit d7248f1cc835bd80e936dc5b2d94b149bdd0077d ] + +Maximum size of buffer is obtained from underlying I2C adapter and in +case adapter allows I2C transaction buffer size greater than 100 bytes, +transaction will fail due to firmware limitation. + +As a result driver will fail initialization. + +Limit the maximum size of transaction buffer by 100 bytes to fit to +firmware. + +Remove unnecessary calculation: +max_t(u16, MLXSW_I2C_BLK_DEF, quirk_size). +This condition can not happened. + +Fixes: 3029a693beda ("mlxsw: i2c: Allow flexible setting of I2C transactions size") +Signed-off-by: Vadim Pasternak +Reviewed-by: Petr Machata +Signed-off-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/i2c.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/i2c.c b/drivers/net/ethernet/mellanox/mlxsw/i2c.c +index 26e05f129e35a..3beefc167da91 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/i2c.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/i2c.c +@@ -48,6 +48,7 @@ + #define MLXSW_I2C_MBOX_SIZE_BITS 12 + #define MLXSW_I2C_ADDR_BUF_SIZE 4 + #define MLXSW_I2C_BLK_DEF 32 ++#define MLXSW_I2C_BLK_MAX 100 + #define MLXSW_I2C_RETRY 5 + #define MLXSW_I2C_TIMEOUT_MSECS 5000 + #define MLXSW_I2C_MAX_DATA_SIZE 256 +@@ -653,7 +654,7 @@ static int mlxsw_i2c_probe(struct i2c_client *client, + return -EOPNOTSUPP; + } + +- mlxsw_i2c->block_size = max_t(u16, MLXSW_I2C_BLK_DEF, ++ mlxsw_i2c->block_size = min_t(u16, MLXSW_I2C_BLK_MAX, + min_t(u16, quirks->max_read_len, + quirks->max_write_len)); + } else { +-- +2.40.1 + diff --git a/queue-6.1/mtd-rawnand-brcmnand-fix-mtd-oobsize.patch b/queue-6.1/mtd-rawnand-brcmnand-fix-mtd-oobsize.patch new file mode 100644 index 00000000000..233976b7b2e --- /dev/null +++ b/queue-6.1/mtd-rawnand-brcmnand-fix-mtd-oobsize.patch @@ -0,0 +1,62 @@ +From 02f2752aeb5c04cc84f6a9bd423934385ac477d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 11:29:09 -0700 +Subject: mtd: rawnand: brcmnand: Fix mtd oobsize + +From: William Zhang + +[ Upstream commit 60177390fa061c62d156f4a546e3efd90df3c183 ] + +brcmnand controller can only access the flash spare area up to certain +bytes based on the ECC level. It can be less than the actual flash spare +area size. For example, for many NAND chip supporting ECC BCH-8, it has +226 bytes spare area. But controller can only uses 218 bytes. So brcmand +driver overrides the mtd oobsize with the controller's accessible spare +area size. When the nand base driver utilizes the nand_device object, it +resets the oobsize back to the actual flash spare aprea size from +nand_memory_organization structure and controller may not able to access +all the oob area as mtd advises. + +This change fixes the issue by overriding the oobsize in the +nand_memory_organization structure to the controller's accessible spare +area size. + +Fixes: a7ab085d7c16 ("mtd: rawnand: Initialize the nand_device object") +Signed-off-by: William Zhang +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230706182909.79151-6-william.zhang@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/brcmnand/brcmnand.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +index 2e9c2e2d9c9f7..d8418d7fcc372 100644 +--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +@@ -2612,6 +2612,8 @@ static int brcmnand_setup_dev(struct brcmnand_host *host) + struct nand_chip *chip = &host->chip; + const struct nand_ecc_props *requirements = + nanddev_get_ecc_requirements(&chip->base); ++ struct nand_memory_organization *memorg = ++ nanddev_get_memorg(&chip->base); + struct brcmnand_controller *ctrl = host->ctrl; + struct brcmnand_cfg *cfg = &host->hwcfg; + char msg[128]; +@@ -2633,10 +2635,11 @@ static int brcmnand_setup_dev(struct brcmnand_host *host) + if (cfg->spare_area_size > ctrl->max_oob) + cfg->spare_area_size = ctrl->max_oob; + /* +- * Set oobsize to be consistent with controller's spare_area_size, as +- * the rest is inaccessible. ++ * Set mtd and memorg oobsize to be consistent with controller's ++ * spare_area_size, as the rest is inaccessible. + */ + mtd->oobsize = cfg->spare_area_size * (mtd->writesize >> FC_SHIFT); ++ memorg->oobsize = mtd->oobsize; + + cfg->device_size = mtd->size; + cfg->block_size = mtd->erasesize; +-- +2.40.1 + diff --git a/queue-6.1/mtd-rawnand-fsmc-handle-clk-prepare-error-in-fsmc_na.patch b/queue-6.1/mtd-rawnand-fsmc-handle-clk-prepare-error-in-fsmc_na.patch new file mode 100644 index 00000000000..27eabf807c1 --- /dev/null +++ b/queue-6.1/mtd-rawnand-fsmc-handle-clk-prepare-error-in-fsmc_na.patch @@ -0,0 +1,44 @@ +From 4ab2752dcfb40e0cd89a61f6fa39ea8cbbaaa457 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 19:58:39 +0800 +Subject: mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume() + +From: Yi Yang + +[ Upstream commit a5a88125d00612586e941ae13e7fcf36ba8f18a7 ] + +In fsmc_nand_resume(), the return value of clk_prepare_enable() should be +checked since it might fail. + +Fixes: e25da1c07dfb ("mtd: fsmc_nand: Add clk_{un}prepare() support") +Signed-off-by: Yi Yang +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230817115839.10192-1-yiyang13@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/fsmc_nand.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c +index 6b2bda815b880..17786e1331e6d 100644 +--- a/drivers/mtd/nand/raw/fsmc_nand.c ++++ b/drivers/mtd/nand/raw/fsmc_nand.c +@@ -1202,9 +1202,14 @@ static int fsmc_nand_suspend(struct device *dev) + static int fsmc_nand_resume(struct device *dev) + { + struct fsmc_nand_data *host = dev_get_drvdata(dev); ++ int ret; + + if (host) { +- clk_prepare_enable(host->clk); ++ ret = clk_prepare_enable(host->clk); ++ if (ret) { ++ dev_err(dev, "failed to enable clk\n"); ++ return ret; ++ } + if (host->dev_timings) + fsmc_nand_setup(host, host->dev_timings); + nand_reset(&host->nand, 0); +-- +2.40.1 + diff --git a/queue-6.1/mtd-spi-nor-check-bus-width-while-setting-qe-bit.patch b/queue-6.1/mtd-spi-nor-check-bus-width-while-setting-qe-bit.patch new file mode 100644 index 00000000000..510c724ab12 --- /dev/null +++ b/queue-6.1/mtd-spi-nor-check-bus-width-while-setting-qe-bit.patch @@ -0,0 +1,63 @@ +From 352c84c5849cc907e512d81d8c5d0117a6cd4a04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 14:42:23 +0800 +Subject: mtd: spi-nor: Check bus width while setting QE bit + +From: Hsin-Yi Wang + +[ Upstream commit f01d8155a92e33cdaa85d20bfbe6c441907b3c1f ] + +spi_nor_write_16bit_sr_and_check() should also check if bus width is +4 before setting QE bit. + +Fixes: 39d1e3340c73 ("mtd: spi-nor: Fix clearing of QE bit on lock()/unlock()") +Suggested-by: Michael Walle +Suggested-by: Tudor Ambarus +Signed-off-by: Hsin-Yi Wang +Reviewed-by: Michael Walle +Link: https://lore.kernel.org/r/20230818064524.1229100-2-hsinyi@chromium.org +Signed-off-by: Tudor Ambarus +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/core.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c +index dc4d86ceee447..a9000b0ebe690 100644 +--- a/drivers/mtd/spi-nor/core.c ++++ b/drivers/mtd/spi-nor/core.c +@@ -770,21 +770,22 @@ static int spi_nor_write_16bit_sr_and_check(struct spi_nor *nor, u8 sr1) + ret = spi_nor_read_cr(nor, &sr_cr[1]); + if (ret) + return ret; +- } else if (nor->params->quad_enable) { ++ } else if (spi_nor_get_protocol_width(nor->read_proto) == 4 && ++ spi_nor_get_protocol_width(nor->write_proto) == 4 && ++ nor->params->quad_enable) { + /* + * If the Status Register 2 Read command (35h) is not + * supported, we should at least be sure we don't + * change the value of the SR2 Quad Enable bit. + * +- * We can safely assume that when the Quad Enable method is +- * set, the value of the QE bit is one, as a consequence of the +- * nor->params->quad_enable() call. ++ * When the Quad Enable method is set and the buswidth is 4, we ++ * can safely assume that the value of the QE bit is one, as a ++ * consequence of the nor->params->quad_enable() call. + * +- * We can safely assume that the Quad Enable bit is present in +- * the Status Register 2 at BIT(1). According to the JESD216 +- * revB standard, BFPT DWORDS[15], bits 22:20, the 16-bit +- * Write Status (01h) command is available just for the cases +- * in which the QE bit is described in SR2 at BIT(1). ++ * According to the JESD216 revB standard, BFPT DWORDS[15], ++ * bits 22:20, the 16-bit Write Status (01h) command is ++ * available just for the cases in which the QE bit is ++ * described in SR2 at BIT(1). + */ + sr_cr[1] = SR2_QUAD_EN_BIT1; + } else { +-- +2.40.1 + diff --git a/queue-6.1/net-annotate-data-races-around-sk-sk_lingertime.patch b/queue-6.1/net-annotate-data-races-around-sk-sk_lingertime.patch new file mode 100644 index 00000000000..a47889e7430 --- /dev/null +++ b/queue-6.1/net-annotate-data-races-around-sk-sk_lingertime.patch @@ -0,0 +1,133 @@ +From de4c4122189a3b193c4e6a9d2393e0402ac38cd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Aug 2023 04:06:46 +0000 +Subject: net: annotate data-races around sk->sk_lingertime + +From: Eric Dumazet + +[ Upstream commit bc1fb82ae11753c5dec53c667a055dc37796dbd2 ] + +sk_getsockopt() runs locklessly. This means sk->sk_lingertime +can be read while other threads are changing its value. + +Other reads also happen without socket lock being held, +and must be annotated. + +Remove preprocessor logic using BITS_PER_LONG, compilers +are smart enough to figure this by themselves. + +v2: fixed a clang W=1 (-Wtautological-constant-out-of-range-compare) warning + (Jakub) + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 2 +- + net/bluetooth/sco.c | 2 +- + net/core/sock.c | 18 +++++++++--------- + net/sched/em_meta.c | 2 +- + net/smc/af_smc.c | 2 +- + 5 files changed, 13 insertions(+), 13 deletions(-) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index 699e4f400df29..5cd2e775915be 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -1394,7 +1394,7 @@ static int iso_sock_release(struct socket *sock) + + iso_sock_close(sk); + +- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && ++ if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) && + !(current->flags & PF_EXITING)) { + lock_sock(sk); + err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index 1755f91a66f6a..6d4168cfeb563 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -1255,7 +1255,7 @@ static int sco_sock_release(struct socket *sock) + + sco_sock_close(sk); + +- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && ++ if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) && + !(current->flags & PF_EXITING)) { + lock_sock(sk); + err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); +diff --git a/net/core/sock.c b/net/core/sock.c +index 8b91d9f911336..fc475845c94d5 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -793,7 +793,7 @@ EXPORT_SYMBOL(sock_set_reuseport); + void sock_no_linger(struct sock *sk) + { + lock_sock(sk); +- sk->sk_lingertime = 0; ++ WRITE_ONCE(sk->sk_lingertime, 0); + sock_set_flag(sk, SOCK_LINGER); + release_sock(sk); + } +@@ -1219,15 +1219,15 @@ int sk_setsockopt(struct sock *sk, int level, int optname, + ret = -EFAULT; + break; + } +- if (!ling.l_onoff) ++ if (!ling.l_onoff) { + sock_reset_flag(sk, SOCK_LINGER); +- else { +-#if (BITS_PER_LONG == 32) +- if ((unsigned int)ling.l_linger >= MAX_SCHEDULE_TIMEOUT/HZ) +- sk->sk_lingertime = MAX_SCHEDULE_TIMEOUT; ++ } else { ++ unsigned long t_sec = ling.l_linger; ++ ++ if (t_sec >= MAX_SCHEDULE_TIMEOUT / HZ) ++ WRITE_ONCE(sk->sk_lingertime, MAX_SCHEDULE_TIMEOUT); + else +-#endif +- sk->sk_lingertime = (unsigned int)ling.l_linger * HZ; ++ WRITE_ONCE(sk->sk_lingertime, t_sec * HZ); + sock_set_flag(sk, SOCK_LINGER); + } + break; +@@ -1678,7 +1678,7 @@ int sk_getsockopt(struct sock *sk, int level, int optname, + case SO_LINGER: + lv = sizeof(v.ling); + v.ling.l_onoff = sock_flag(sk, SOCK_LINGER); +- v.ling.l_linger = sk->sk_lingertime / HZ; ++ v.ling.l_linger = READ_ONCE(sk->sk_lingertime) / HZ; + break; + + case SO_BSDCOMPAT: +diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c +index b1f1b49d35edf..6f2f135aab676 100644 +--- a/net/sched/em_meta.c ++++ b/net/sched/em_meta.c +@@ -502,7 +502,7 @@ META_COLLECTOR(int_sk_lingertime) + *err = -1; + return; + } +- dst->value = sk->sk_lingertime / HZ; ++ dst->value = READ_ONCE(sk->sk_lingertime) / HZ; + } + + META_COLLECTOR(int_sk_err_qlen) +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 84219c5121bc2..f774d840759d6 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1807,7 +1807,7 @@ void smc_close_non_accepted(struct sock *sk) + lock_sock(sk); + if (!sk->sk_lingertime) + /* wait for peer closing */ +- sk->sk_lingertime = SMC_MAX_STREAM_WAIT_TIMEOUT; ++ WRITE_ONCE(sk->sk_lingertime, SMC_MAX_STREAM_WAIT_TIMEOUT); + __smc_release(smc); + release_sock(sk); + sock_put(sk); /* sock_hold above */ +-- +2.40.1 + diff --git a/queue-6.1/net-arcnet-do-not-call-kfree_skb-under-local_irq_dis.patch b/queue-6.1/net-arcnet-do-not-call-kfree_skb-under-local_irq_dis.patch new file mode 100644 index 00000000000..b6d163723b4 --- /dev/null +++ b/queue-6.1/net-arcnet-do-not-call-kfree_skb-under-local_irq_dis.patch @@ -0,0 +1,38 @@ +From 26bca528ad06ce2bae3625092c4af88bb1204b0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 14:43:36 +0800 +Subject: net: arcnet: Do not call kfree_skb() under local_irq_disable() + +From: Jinjie Ruan + +[ Upstream commit 786c96e92fb9e854cb8b0cb7399bb2fb28e15c4b ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with hardware interrupts being disabled. +So replace kfree_skb() with dev_kfree_skb_irq() under +local_irq_disable(). Compile tested only. + +Fixes: 05fcd31cc472 ("arcnet: add err_skb package for package status feedback") +Signed-off-by: Jinjie Ruan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/arcnet/arcnet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c +index 1bad1866ae462..a48220f91a2df 100644 +--- a/drivers/net/arcnet/arcnet.c ++++ b/drivers/net/arcnet/arcnet.c +@@ -468,7 +468,7 @@ static void arcnet_reply_tasklet(struct tasklet_struct *t) + + ret = sock_queue_err_skb(sk, ackskb); + if (ret) +- kfree_skb(ackskb); ++ dev_kfree_skb_irq(ackskb); + + local_irq_enable(); + }; +-- +2.40.1 + diff --git a/queue-6.1/net-export-inet_lookup_reuseport-and-inet6_lookup_re.patch b/queue-6.1/net-export-inet_lookup_reuseport-and-inet6_lookup_re.patch new file mode 100644 index 00000000000..afeddbca1f7 --- /dev/null +++ b/queue-6.1/net-export-inet_lookup_reuseport-and-inet6_lookup_re.patch @@ -0,0 +1,163 @@ +From 54234a8d6225eeb23998faa12da812998995c956 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 17:30:07 +0200 +Subject: net: export inet_lookup_reuseport and inet6_lookup_reuseport + +From: Lorenz Bauer + +[ Upstream commit ce796e60b3b196b61fcc565df195443cbb846ef0 ] + +Rename the existing reuseport helpers for IPv4 and IPv6 so that they +can be invoked in the follow up commit. Export them so that building +DCCP and IPv6 as a module works. + +No change in functionality. + +Reviewed-by: Kuniyuki Iwashima +Signed-off-by: Lorenz Bauer +Link: https://lore.kernel.org/r/20230720-so-reuseport-v6-3-7021b683cdae@isovalent.com +Signed-off-by: Martin KaFai Lau +Stable-dep-of: 9c02bec95954 ("bpf, net: Support SO_REUSEPORT sockets with bpf_sk_assign") +Signed-off-by: Sasha Levin +--- + include/net/inet6_hashtables.h | 7 +++++++ + include/net/inet_hashtables.h | 5 +++++ + net/ipv4/inet_hashtables.c | 15 ++++++++------- + net/ipv6/inet6_hashtables.c | 19 ++++++++++--------- + 4 files changed, 30 insertions(+), 16 deletions(-) + +diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h +index 56f1286583d3c..032ddab48f8f8 100644 +--- a/include/net/inet6_hashtables.h ++++ b/include/net/inet6_hashtables.h +@@ -48,6 +48,13 @@ struct sock *__inet6_lookup_established(struct net *net, + const u16 hnum, const int dif, + const int sdif); + ++struct sock *inet6_lookup_reuseport(struct net *net, struct sock *sk, ++ struct sk_buff *skb, int doff, ++ const struct in6_addr *saddr, ++ __be16 sport, ++ const struct in6_addr *daddr, ++ unsigned short hnum); ++ + struct sock *inet6_lookup_listener(struct net *net, + struct inet_hashinfo *hashinfo, + struct sk_buff *skb, int doff, +diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h +index 99bd823e97f62..8734f3488f5d0 100644 +--- a/include/net/inet_hashtables.h ++++ b/include/net/inet_hashtables.h +@@ -379,6 +379,11 @@ struct sock *__inet_lookup_established(struct net *net, + const __be32 daddr, const u16 hnum, + const int dif, const int sdif); + ++struct sock *inet_lookup_reuseport(struct net *net, struct sock *sk, ++ struct sk_buff *skb, int doff, ++ __be32 saddr, __be16 sport, ++ __be32 daddr, unsigned short hnum); ++ + static inline struct sock * + inet_lookup_established(struct net *net, struct inet_hashinfo *hashinfo, + const __be32 saddr, const __be16 sport, +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index c19b462662ad0..6ed92624c95c4 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -332,10 +332,10 @@ static inline int compute_score(struct sock *sk, struct net *net, + return score; + } + +-static inline struct sock *lookup_reuseport(struct net *net, struct sock *sk, +- struct sk_buff *skb, int doff, +- __be32 saddr, __be16 sport, +- __be32 daddr, unsigned short hnum) ++struct sock *inet_lookup_reuseport(struct net *net, struct sock *sk, ++ struct sk_buff *skb, int doff, ++ __be32 saddr, __be16 sport, ++ __be32 daddr, unsigned short hnum) + { + struct sock *reuse_sk = NULL; + u32 phash; +@@ -346,6 +346,7 @@ static inline struct sock *lookup_reuseport(struct net *net, struct sock *sk, + } + return reuse_sk; + } ++EXPORT_SYMBOL_GPL(inet_lookup_reuseport); + + /* + * Here are some nice properties to exploit here. The BSD API +@@ -369,8 +370,8 @@ static struct sock *inet_lhash2_lookup(struct net *net, + sk_nulls_for_each_rcu(sk, node, &ilb2->nulls_head) { + score = compute_score(sk, net, hnum, daddr, dif, sdif); + if (score > hiscore) { +- result = lookup_reuseport(net, sk, skb, doff, +- saddr, sport, daddr, hnum); ++ result = inet_lookup_reuseport(net, sk, skb, doff, ++ saddr, sport, daddr, hnum); + if (result) + return result; + +@@ -399,7 +400,7 @@ static inline struct sock *inet_lookup_run_bpf(struct net *net, + if (no_reuseport || IS_ERR_OR_NULL(sk)) + return sk; + +- reuse_sk = lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum); ++ reuse_sk = inet_lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum); + if (reuse_sk) + sk = reuse_sk; + return sk; +diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c +index b64b49012655e..b7c56867314ed 100644 +--- a/net/ipv6/inet6_hashtables.c ++++ b/net/ipv6/inet6_hashtables.c +@@ -111,12 +111,12 @@ static inline int compute_score(struct sock *sk, struct net *net, + return score; + } + +-static inline struct sock *lookup_reuseport(struct net *net, struct sock *sk, +- struct sk_buff *skb, int doff, +- const struct in6_addr *saddr, +- __be16 sport, +- const struct in6_addr *daddr, +- unsigned short hnum) ++struct sock *inet6_lookup_reuseport(struct net *net, struct sock *sk, ++ struct sk_buff *skb, int doff, ++ const struct in6_addr *saddr, ++ __be16 sport, ++ const struct in6_addr *daddr, ++ unsigned short hnum) + { + struct sock *reuse_sk = NULL; + u32 phash; +@@ -127,6 +127,7 @@ static inline struct sock *lookup_reuseport(struct net *net, struct sock *sk, + } + return reuse_sk; + } ++EXPORT_SYMBOL_GPL(inet6_lookup_reuseport); + + /* called with rcu_read_lock() */ + static struct sock *inet6_lhash2_lookup(struct net *net, +@@ -143,8 +144,8 @@ static struct sock *inet6_lhash2_lookup(struct net *net, + sk_nulls_for_each_rcu(sk, node, &ilb2->nulls_head) { + score = compute_score(sk, net, hnum, daddr, dif, sdif); + if (score > hiscore) { +- result = lookup_reuseport(net, sk, skb, doff, +- saddr, sport, daddr, hnum); ++ result = inet6_lookup_reuseport(net, sk, skb, doff, ++ saddr, sport, daddr, hnum); + if (result) + return result; + +@@ -175,7 +176,7 @@ static inline struct sock *inet6_lookup_run_bpf(struct net *net, + if (no_reuseport || IS_ERR_OR_NULL(sk)) + return sk; + +- reuse_sk = lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum); ++ reuse_sk = inet6_lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum); + if (reuse_sk) + sk = reuse_sk; + return sk; +-- +2.40.1 + diff --git a/queue-6.1/net-fix-slab-out-of-bounds-in-inet-6-_steal_sock.patch b/queue-6.1/net-fix-slab-out-of-bounds-in-inet-6-_steal_sock.patch new file mode 100644 index 00000000000..fd20519497e --- /dev/null +++ b/queue-6.1/net-fix-slab-out-of-bounds-in-inet-6-_steal_sock.patch @@ -0,0 +1,63 @@ +From cb889400f6dac86d95708d710ed5885dc9b8d78f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Aug 2023 09:53:41 +0100 +Subject: net: Fix slab-out-of-bounds in inet[6]_steal_sock + +From: Lorenz Bauer + +[ Upstream commit 8897562f67b3e61ad736cd5c9f307447d33280e4 ] + +Kumar reported a KASAN splat in tcp_v6_rcv: + + bash-5.2# ./test_progs -t btf_skc_cls_ingress + ... + [ 51.810085] BUG: KASAN: slab-out-of-bounds in tcp_v6_rcv+0x2d7d/0x3440 + [ 51.810458] Read of size 2 at addr ffff8881053f038c by task test_progs/226 + +The problem is that inet[6]_steal_sock accesses sk->sk_protocol without +accounting for request or timewait sockets. To fix this we can't just +check sock_common->skc_reuseport since that flag is present on timewait +sockets. + +Instead, add a fullsock check to avoid the out of bands access of sk_protocol. + +Fixes: 9c02bec95954 ("bpf, net: Support SO_REUSEPORT sockets with bpf_sk_assign") +Reported-by: Kumar Kartikeya Dwivedi +Signed-off-by: Lorenz Bauer +Link: https://lore.kernel.org/r/20230815-bpf-next-v2-1-95126eaa4c1b@isovalent.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + include/net/inet6_hashtables.h | 2 +- + include/net/inet_hashtables.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h +index 475e672b4facc..12780b8fb5630 100644 +--- a/include/net/inet6_hashtables.h ++++ b/include/net/inet6_hashtables.h +@@ -107,7 +107,7 @@ struct sock *inet6_steal_sock(struct net *net, struct sk_buff *skb, int doff, + if (!sk) + return NULL; + +- if (!prefetched) ++ if (!prefetched || !sk_fullsock(sk)) + return sk; + + if (sk->sk_protocol == IPPROTO_TCP) { +diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h +index a1b8eb147ce73..9414cb4e6e624 100644 +--- a/include/net/inet_hashtables.h ++++ b/include/net/inet_hashtables.h +@@ -455,7 +455,7 @@ struct sock *inet_steal_sock(struct net *net, struct sk_buff *skb, int doff, + if (!sk) + return NULL; + +- if (!prefetched) ++ if (!prefetched || !sk_fullsock(sk)) + return sk; + + if (sk->sk_protocol == IPPROTO_TCP) { +-- +2.40.1 + diff --git a/queue-6.1/net-memcg-fix-scope-of-sockmem-pressure-indicators.patch b/queue-6.1/net-memcg-fix-scope-of-sockmem-pressure-indicators.patch new file mode 100644 index 00000000000..5c4a3310dd3 --- /dev/null +++ b/queue-6.1/net-memcg-fix-scope-of-sockmem-pressure-indicators.patch @@ -0,0 +1,86 @@ +From 2f3f8d2a05351310ea5c5e61a32c1765a6882c0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 15:09:11 +0800 +Subject: net-memcg: Fix scope of sockmem pressure indicators + +From: Abel Wu + +[ Upstream commit ac8a52962164a50e693fa021d3564d7745b83a7f ] + +Now there are two indicators of socket memory pressure sit inside +struct mem_cgroup, socket_pressure and tcpmem_pressure, indicating +memory reclaim pressure in memcg->memory and ->tcpmem respectively. + +When in legacy mode (cgroupv1), the socket memory is charged into +->tcpmem which is independent of ->memory, so socket_pressure has +nothing to do with socket's pressure at all. Things could be worse +by taking socket_pressure into consideration in legacy mode, as a +pressure in ->memory can lead to premature reclamation/throttling +in socket. + +While for the default mode (cgroupv2), the socket memory is charged +into ->memory, and ->tcpmem/->tcpmem_pressure are simply not used. + +So {socket,tcpmem}_pressure are only used in default/legacy mode +respectively for indicating socket memory pressure. This patch fixes +the pieces of code that make mixed use of both. + +Fixes: 8e8ae645249b ("mm: memcontrol: hook up vmpressure to socket pressure") +Signed-off-by: Abel Wu +Acked-by: Shakeel Butt +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/memcontrol.h | 9 +++++++-- + mm/vmpressure.c | 8 ++++++++ + 2 files changed, 15 insertions(+), 2 deletions(-) + +diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h +index e039763029563..099521835cd14 100644 +--- a/include/linux/memcontrol.h ++++ b/include/linux/memcontrol.h +@@ -283,6 +283,11 @@ struct mem_cgroup { + atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS]; + atomic_long_t memory_events_local[MEMCG_NR_MEMORY_EVENTS]; + ++ /* ++ * Hint of reclaim pressure for socket memroy management. Note ++ * that this indicator should NOT be used in legacy cgroup mode ++ * where socket memory is accounted/charged separately. ++ */ + unsigned long socket_pressure; + + /* Legacy tcp memory accounting */ +@@ -1704,8 +1709,8 @@ void mem_cgroup_sk_alloc(struct sock *sk); + void mem_cgroup_sk_free(struct sock *sk); + static inline bool mem_cgroup_under_socket_pressure(struct mem_cgroup *memcg) + { +- if (!cgroup_subsys_on_dfl(memory_cgrp_subsys) && memcg->tcpmem_pressure) +- return true; ++ if (!cgroup_subsys_on_dfl(memory_cgrp_subsys)) ++ return !!memcg->tcpmem_pressure; + do { + if (time_before(jiffies, READ_ONCE(memcg->socket_pressure))) + return true; +diff --git a/mm/vmpressure.c b/mm/vmpressure.c +index b52644771cc43..22c6689d93027 100644 +--- a/mm/vmpressure.c ++++ b/mm/vmpressure.c +@@ -244,6 +244,14 @@ void vmpressure(gfp_t gfp, struct mem_cgroup *memcg, bool tree, + if (mem_cgroup_disabled()) + return; + ++ /* ++ * The in-kernel users only care about the reclaim efficiency ++ * for this @memcg rather than the whole subtree, and there ++ * isn't and won't be any in-kernel user in a legacy cgroup. ++ */ ++ if (!cgroup_subsys_on_dfl(memory_cgrp_subsys) && !tree) ++ return; ++ + vmpr = memcg_to_vmpressure(memcg); + + /* +-- +2.40.1 + diff --git a/queue-6.1/net-mlx5-use-rmw-accessors-for-changing-lnkctl.patch b/queue-6.1/net-mlx5-use-rmw-accessors-for-changing-lnkctl.patch new file mode 100644 index 00000000000..2f8ff0bd70a --- /dev/null +++ b/queue-6.1/net-mlx5-use-rmw-accessors-for-changing-lnkctl.patch @@ -0,0 +1,57 @@ +From 249aa91a8959c3309fccd5406af04fe3d87a8e66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:04:59 +0300 +Subject: net/mlx5: Use RMW accessors for changing LNKCTL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 30de872537bda526664d7a20b646adfb3e7ce6e6 ] + +Don't assume that only the driver would be accessing LNKCTL of the upstream +bridge. ASPM policy changes can trigger write to LNKCTL outside of driver's +control. + +Use RMW capability accessors which do proper locking to avoid losing +concurrent updates to the register value. + +Suggested-by: Lukas Wunner +Fixes: eabe8e5e88f5 ("net/mlx5: Handle sync reset now event") +Link: https://lore.kernel.org/r/20230717120503.15276-8-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Reviewed-by: Moshe Shemesh +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +index d219f8417d93a..dec1492da74de 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +@@ -319,16 +319,11 @@ static int mlx5_pci_link_toggle(struct mlx5_core_dev *dev) + pci_cfg_access_lock(sdev); + } + /* PCI link toggle */ +- err = pci_read_config_word(bridge, cap + PCI_EXP_LNKCTL, ®16); +- if (err) +- return err; +- reg16 |= PCI_EXP_LNKCTL_LD; +- err = pci_write_config_word(bridge, cap + PCI_EXP_LNKCTL, reg16); ++ err = pcie_capability_set_word(bridge, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_LD); + if (err) + return err; + msleep(500); +- reg16 &= ~PCI_EXP_LNKCTL_LD; +- err = pci_write_config_word(bridge, cap + PCI_EXP_LNKCTL, reg16); ++ err = pcie_capability_clear_word(bridge, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_LD); + if (err) + return err; + +-- +2.40.1 + diff --git a/queue-6.1/net-remove-duplicate-reuseport_lookup-functions.patch b/queue-6.1/net-remove-duplicate-reuseport_lookup-functions.patch new file mode 100644 index 00000000000..66332944191 --- /dev/null +++ b/queue-6.1/net-remove-duplicate-reuseport_lookup-functions.patch @@ -0,0 +1,365 @@ +From 3cf7940a98d9e474fc7a560b2484a54d5c728b17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 17:30:08 +0200 +Subject: net: remove duplicate reuseport_lookup functions + +From: Lorenz Bauer + +[ Upstream commit 0f495f7617229772403e683033abc473f0f0553c ] + +There are currently four copies of reuseport_lookup: one each for +(TCP, UDP)x(IPv4, IPv6). This forces us to duplicate all callers of +those functions as well. This is already the case for sk_lookup +helpers (inet,inet6,udp4,udp6)_lookup_run_bpf. + +There are two differences between the reuseport_lookup helpers: + +1. They call different hash functions depending on protocol +2. UDP reuseport_lookup checks that sk_state != TCP_ESTABLISHED + +Move the check for sk_state into the caller and use the INDIRECT_CALL +infrastructure to cut down the helpers to one per IP version. + +Reviewed-by: Kuniyuki Iwashima +Signed-off-by: Lorenz Bauer +Link: https://lore.kernel.org/r/20230720-so-reuseport-v6-4-7021b683cdae@isovalent.com +Signed-off-by: Martin KaFai Lau +Stable-dep-of: 9c02bec95954 ("bpf, net: Support SO_REUSEPORT sockets with bpf_sk_assign") +Signed-off-by: Sasha Levin +--- + include/net/inet6_hashtables.h | 11 ++++++++- + include/net/inet_hashtables.h | 15 ++++++++----- + net/ipv4/inet_hashtables.c | 20 +++++++++++------ + net/ipv4/udp.c | 34 +++++++++++----------------- + net/ipv6/inet6_hashtables.c | 14 ++++++++---- + net/ipv6/udp.c | 41 +++++++++++++--------------------- + 6 files changed, 72 insertions(+), 63 deletions(-) + +diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h +index 032ddab48f8f8..f89320b6fee31 100644 +--- a/include/net/inet6_hashtables.h ++++ b/include/net/inet6_hashtables.h +@@ -48,12 +48,21 @@ struct sock *__inet6_lookup_established(struct net *net, + const u16 hnum, const int dif, + const int sdif); + ++typedef u32 (inet6_ehashfn_t)(const struct net *net, ++ const struct in6_addr *laddr, const u16 lport, ++ const struct in6_addr *faddr, const __be16 fport); ++ ++inet6_ehashfn_t inet6_ehashfn; ++ ++INDIRECT_CALLABLE_DECLARE(inet6_ehashfn_t udp6_ehashfn); ++ + struct sock *inet6_lookup_reuseport(struct net *net, struct sock *sk, + struct sk_buff *skb, int doff, + const struct in6_addr *saddr, + __be16 sport, + const struct in6_addr *daddr, +- unsigned short hnum); ++ unsigned short hnum, ++ inet6_ehashfn_t *ehashfn); + + struct sock *inet6_lookup_listener(struct net *net, + struct inet_hashinfo *hashinfo, +diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h +index 8734f3488f5d0..ddfa2e67fdb51 100644 +--- a/include/net/inet_hashtables.h ++++ b/include/net/inet_hashtables.h +@@ -379,10 +379,19 @@ struct sock *__inet_lookup_established(struct net *net, + const __be32 daddr, const u16 hnum, + const int dif, const int sdif); + ++typedef u32 (inet_ehashfn_t)(const struct net *net, ++ const __be32 laddr, const __u16 lport, ++ const __be32 faddr, const __be16 fport); ++ ++inet_ehashfn_t inet_ehashfn; ++ ++INDIRECT_CALLABLE_DECLARE(inet_ehashfn_t udp_ehashfn); ++ + struct sock *inet_lookup_reuseport(struct net *net, struct sock *sk, + struct sk_buff *skb, int doff, + __be32 saddr, __be16 sport, +- __be32 daddr, unsigned short hnum); ++ __be32 daddr, unsigned short hnum, ++ inet_ehashfn_t *ehashfn); + + static inline struct sock * + inet_lookup_established(struct net *net, struct inet_hashinfo *hashinfo, +@@ -453,10 +462,6 @@ static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo, + refcounted); + } + +-u32 inet6_ehashfn(const struct net *net, +- const struct in6_addr *laddr, const u16 lport, +- const struct in6_addr *faddr, const __be16 fport); +- + static inline void sk_daddr_set(struct sock *sk, __be32 addr) + { + sk->sk_daddr = addr; /* alias of inet_daddr */ +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 6ed92624c95c4..970da5b2bfe9c 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -28,9 +28,9 @@ + #include + #include + +-static u32 inet_ehashfn(const struct net *net, const __be32 laddr, +- const __u16 lport, const __be32 faddr, +- const __be16 fport) ++u32 inet_ehashfn(const struct net *net, const __be32 laddr, ++ const __u16 lport, const __be32 faddr, ++ const __be16 fport) + { + static u32 inet_ehash_secret __read_mostly; + +@@ -39,6 +39,7 @@ static u32 inet_ehashfn(const struct net *net, const __be32 laddr, + return __inet_ehashfn(laddr, lport, faddr, fport, + inet_ehash_secret + net_hash_mix(net)); + } ++EXPORT_SYMBOL_GPL(inet_ehashfn); + + /* This function handles inet_sock, but also timewait and request sockets + * for IPv4/IPv6. +@@ -332,16 +333,20 @@ static inline int compute_score(struct sock *sk, struct net *net, + return score; + } + ++INDIRECT_CALLABLE_DECLARE(inet_ehashfn_t udp_ehashfn); ++ + struct sock *inet_lookup_reuseport(struct net *net, struct sock *sk, + struct sk_buff *skb, int doff, + __be32 saddr, __be16 sport, +- __be32 daddr, unsigned short hnum) ++ __be32 daddr, unsigned short hnum, ++ inet_ehashfn_t *ehashfn) + { + struct sock *reuse_sk = NULL; + u32 phash; + + if (sk->sk_reuseport) { +- phash = inet_ehashfn(net, daddr, hnum, saddr, sport); ++ phash = INDIRECT_CALL_2(ehashfn, udp_ehashfn, inet_ehashfn, ++ net, daddr, hnum, saddr, sport); + reuse_sk = reuseport_select_sock(sk, phash, skb, doff); + } + return reuse_sk; +@@ -371,7 +376,7 @@ static struct sock *inet_lhash2_lookup(struct net *net, + score = compute_score(sk, net, hnum, daddr, dif, sdif); + if (score > hiscore) { + result = inet_lookup_reuseport(net, sk, skb, doff, +- saddr, sport, daddr, hnum); ++ saddr, sport, daddr, hnum, inet_ehashfn); + if (result) + return result; + +@@ -400,7 +405,8 @@ static inline struct sock *inet_lookup_run_bpf(struct net *net, + if (no_reuseport || IS_ERR_OR_NULL(sk)) + return sk; + +- reuse_sk = inet_lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum); ++ reuse_sk = inet_lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum, ++ inet_ehashfn); + if (reuse_sk) + sk = reuse_sk; + return sk; +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 42c1f7d9a980a..87686c9e4efca 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -400,9 +400,9 @@ static int compute_score(struct sock *sk, struct net *net, + return score; + } + +-static u32 udp_ehashfn(const struct net *net, const __be32 laddr, +- const __u16 lport, const __be32 faddr, +- const __be16 fport) ++INDIRECT_CALLABLE_SCOPE ++u32 udp_ehashfn(const struct net *net, const __be32 laddr, const __u16 lport, ++ const __be32 faddr, const __be16 fport) + { + static u32 udp_ehash_secret __read_mostly; + +@@ -412,22 +412,6 @@ static u32 udp_ehashfn(const struct net *net, const __be32 laddr, + udp_ehash_secret + net_hash_mix(net)); + } + +-static struct sock *lookup_reuseport(struct net *net, struct sock *sk, +- struct sk_buff *skb, +- __be32 saddr, __be16 sport, +- __be32 daddr, unsigned short hnum) +-{ +- struct sock *reuse_sk = NULL; +- u32 hash; +- +- if (sk->sk_reuseport && sk->sk_state != TCP_ESTABLISHED) { +- hash = udp_ehashfn(net, daddr, hnum, saddr, sport); +- reuse_sk = reuseport_select_sock(sk, hash, skb, +- sizeof(struct udphdr)); +- } +- return reuse_sk; +-} +- + /* called with rcu_read_lock() */ + static struct sock *udp4_lib_lookup2(struct net *net, + __be32 saddr, __be16 sport, +@@ -446,7 +430,14 @@ static struct sock *udp4_lib_lookup2(struct net *net, + daddr, hnum, dif, sdif); + if (score > badness) { + badness = score; +- result = lookup_reuseport(net, sk, skb, saddr, sport, daddr, hnum); ++ ++ if (sk->sk_state == TCP_ESTABLISHED) { ++ result = sk; ++ continue; ++ } ++ ++ result = inet_lookup_reuseport(net, sk, skb, sizeof(struct udphdr), ++ saddr, sport, daddr, hnum, udp_ehashfn); + if (!result) { + result = sk; + continue; +@@ -485,7 +476,8 @@ static struct sock *udp4_lookup_run_bpf(struct net *net, + if (no_reuseport || IS_ERR_OR_NULL(sk)) + return sk; + +- reuse_sk = lookup_reuseport(net, sk, skb, saddr, sport, daddr, hnum); ++ reuse_sk = inet_lookup_reuseport(net, sk, skb, sizeof(struct udphdr), ++ saddr, sport, daddr, hnum, udp_ehashfn); + if (reuse_sk) + sk = reuse_sk; + return sk; +diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c +index b7c56867314ed..3616225c89ef6 100644 +--- a/net/ipv6/inet6_hashtables.c ++++ b/net/ipv6/inet6_hashtables.c +@@ -39,6 +39,7 @@ u32 inet6_ehashfn(const struct net *net, + return __inet6_ehashfn(lhash, lport, fhash, fport, + inet6_ehash_secret + net_hash_mix(net)); + } ++EXPORT_SYMBOL_GPL(inet6_ehashfn); + + /* + * Sockets in TCP_CLOSE state are _always_ taken out of the hash, so +@@ -111,18 +112,22 @@ static inline int compute_score(struct sock *sk, struct net *net, + return score; + } + ++INDIRECT_CALLABLE_DECLARE(inet6_ehashfn_t udp6_ehashfn); ++ + struct sock *inet6_lookup_reuseport(struct net *net, struct sock *sk, + struct sk_buff *skb, int doff, + const struct in6_addr *saddr, + __be16 sport, + const struct in6_addr *daddr, +- unsigned short hnum) ++ unsigned short hnum, ++ inet6_ehashfn_t *ehashfn) + { + struct sock *reuse_sk = NULL; + u32 phash; + + if (sk->sk_reuseport) { +- phash = inet6_ehashfn(net, daddr, hnum, saddr, sport); ++ phash = INDIRECT_CALL_INET(ehashfn, udp6_ehashfn, inet6_ehashfn, ++ net, daddr, hnum, saddr, sport); + reuse_sk = reuseport_select_sock(sk, phash, skb, doff); + } + return reuse_sk; +@@ -145,7 +150,7 @@ static struct sock *inet6_lhash2_lookup(struct net *net, + score = compute_score(sk, net, hnum, daddr, dif, sdif); + if (score > hiscore) { + result = inet6_lookup_reuseport(net, sk, skb, doff, +- saddr, sport, daddr, hnum); ++ saddr, sport, daddr, hnum, inet6_ehashfn); + if (result) + return result; + +@@ -176,7 +181,8 @@ static inline struct sock *inet6_lookup_run_bpf(struct net *net, + if (no_reuseport || IS_ERR_OR_NULL(sk)) + return sk; + +- reuse_sk = inet6_lookup_reuseport(net, sk, skb, doff, saddr, sport, daddr, hnum); ++ reuse_sk = inet6_lookup_reuseport(net, sk, skb, doff, ++ saddr, sport, daddr, hnum, inet6_ehashfn); + if (reuse_sk) + sk = reuse_sk; + return sk; +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 64b36c2ba774a..3408376b1863b 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -70,11 +70,12 @@ int udpv6_init_sock(struct sock *sk) + return 0; + } + +-static u32 udp6_ehashfn(const struct net *net, +- const struct in6_addr *laddr, +- const u16 lport, +- const struct in6_addr *faddr, +- const __be16 fport) ++INDIRECT_CALLABLE_SCOPE ++u32 udp6_ehashfn(const struct net *net, ++ const struct in6_addr *laddr, ++ const u16 lport, ++ const struct in6_addr *faddr, ++ const __be16 fport) + { + static u32 udp6_ehash_secret __read_mostly; + static u32 udp_ipv6_hash_secret __read_mostly; +@@ -159,24 +160,6 @@ static int compute_score(struct sock *sk, struct net *net, + return score; + } + +-static struct sock *lookup_reuseport(struct net *net, struct sock *sk, +- struct sk_buff *skb, +- const struct in6_addr *saddr, +- __be16 sport, +- const struct in6_addr *daddr, +- unsigned int hnum) +-{ +- struct sock *reuse_sk = NULL; +- u32 hash; +- +- if (sk->sk_reuseport && sk->sk_state != TCP_ESTABLISHED) { +- hash = udp6_ehashfn(net, daddr, hnum, saddr, sport); +- reuse_sk = reuseport_select_sock(sk, hash, skb, +- sizeof(struct udphdr)); +- } +- return reuse_sk; +-} +- + /* called with rcu_read_lock() */ + static struct sock *udp6_lib_lookup2(struct net *net, + const struct in6_addr *saddr, __be16 sport, +@@ -194,7 +177,14 @@ static struct sock *udp6_lib_lookup2(struct net *net, + daddr, hnum, dif, sdif); + if (score > badness) { + badness = score; +- result = lookup_reuseport(net, sk, skb, saddr, sport, daddr, hnum); ++ ++ if (sk->sk_state == TCP_ESTABLISHED) { ++ result = sk; ++ continue; ++ } ++ ++ result = inet6_lookup_reuseport(net, sk, skb, sizeof(struct udphdr), ++ saddr, sport, daddr, hnum, udp6_ehashfn); + if (!result) { + result = sk; + continue; +@@ -234,7 +224,8 @@ static inline struct sock *udp6_lookup_run_bpf(struct net *net, + if (no_reuseport || IS_ERR_OR_NULL(sk)) + return sk; + +- reuse_sk = lookup_reuseport(net, sk, skb, saddr, sport, daddr, hnum); ++ reuse_sk = inet6_lookup_reuseport(net, sk, skb, sizeof(struct udphdr), ++ saddr, sport, daddr, hnum, udp6_ehashfn); + if (reuse_sk) + sk = reuse_sk; + return sk; +-- +2.40.1 + diff --git a/queue-6.1/net-sched-sch_hfsc-ensure-inner-classes-have-fsc-cur.patch b/queue-6.1/net-sched-sch_hfsc-ensure-inner-classes-have-fsc-cur.patch new file mode 100644 index 00000000000..492d4bd5107 --- /dev/null +++ b/queue-6.1/net-sched-sch_hfsc-ensure-inner-classes-have-fsc-cur.patch @@ -0,0 +1,44 @@ +From 2e597bb402d7394caea92f5c6ea736956e6cc51c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 01:49:05 -0700 +Subject: net/sched: sch_hfsc: Ensure inner classes have fsc curve + +From: Budimir Markovic + +[ Upstream commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f ] + +HFSC assumes that inner classes have an fsc curve, but it is currently +possible for classes without an fsc curve to become parents. This leads +to bugs including a use-after-free. + +Don't allow non-root classes without HFSC_FSC to become parents. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Budimir Markovic +Signed-off-by: Budimir Markovic +Acked-by: Jamal Hadi Salim +Link: https://lore.kernel.org/r/20230824084905.422-1-markovicbudimir@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_hfsc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c +index 70b0c5873d326..61d52594ff6d8 100644 +--- a/net/sched/sch_hfsc.c ++++ b/net/sched/sch_hfsc.c +@@ -1012,6 +1012,10 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid, + if (parent == NULL) + return -ENOENT; + } ++ if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) { ++ NL_SET_ERR_MSG(extack, "Invalid parent - parent class must have FSC"); ++ return -EINVAL; ++ } + + if (classid == 0 || TC_H_MAJ(classid ^ sch->handle) != 0) + return -EINVAL; +-- +2.40.1 + diff --git a/queue-6.1/net-tcp-fix-unexcepted-socket-die-when-snd_wnd-is-0.patch b/queue-6.1/net-tcp-fix-unexcepted-socket-die-when-snd_wnd-is-0.patch new file mode 100644 index 00000000000..a571692afa7 --- /dev/null +++ b/queue-6.1/net-tcp-fix-unexcepted-socket-die-when-snd_wnd-is-0.patch @@ -0,0 +1,83 @@ +From fcaaedaa1125754190392bb7cbcaaaf1c9d33cef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 10:55:29 +0800 +Subject: net: tcp: fix unexcepted socket die when snd_wnd is 0 + +From: Menglong Dong + +[ Upstream commit e89688e3e97868451a5d05b38a9d2633d6785cd4 ] + +In tcp_retransmit_timer(), a window shrunk connection will be regarded +as timeout if 'tcp_jiffies32 - tp->rcv_tstamp > TCP_RTO_MAX'. This is not +right all the time. + +The retransmits will become zero-window probes in tcp_retransmit_timer() +if the 'snd_wnd==0'. Therefore, the icsk->icsk_rto will come up to +TCP_RTO_MAX sooner or later. + +However, the timer can be delayed and be triggered after 122877ms, not +TCP_RTO_MAX, as I tested. + +Therefore, 'tcp_jiffies32 - tp->rcv_tstamp > TCP_RTO_MAX' is always true +once the RTO come up to TCP_RTO_MAX, and the socket will die. + +Fix this by replacing the 'tcp_jiffies32' with '(u32)icsk->icsk_timeout', +which is exact the timestamp of the timeout. + +However, "tp->rcv_tstamp" can restart from idle, then tp->rcv_tstamp +could already be a long time (minutes or hours) in the past even on the +first RTO. So we double check the timeout with the duration of the +retransmission. + +Meanwhile, making "2 * TCP_RTO_MAX" as the timeout to avoid the socket +dying too soon. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Link: https://lore.kernel.org/netdev/CADxym3YyMiO+zMD4zj03YPM3FBi-1LHi6gSD2XT8pyAMM096pg@mail.gmail.com/ +Signed-off-by: Menglong Dong +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_timer.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index cf354c29ec123..44b49f7d1a9e6 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -441,6 +441,22 @@ static void tcp_fastopen_synack_timer(struct sock *sk, struct request_sock *req) + req->timeout << req->num_timeout, TCP_RTO_MAX); + } + ++static bool tcp_rtx_probe0_timed_out(const struct sock *sk, ++ const struct sk_buff *skb) ++{ ++ const struct tcp_sock *tp = tcp_sk(sk); ++ const int timeout = TCP_RTO_MAX * 2; ++ u32 rcv_delta, rtx_delta; ++ ++ rcv_delta = inet_csk(sk)->icsk_timeout - tp->rcv_tstamp; ++ if (rcv_delta <= timeout) ++ return false; ++ ++ rtx_delta = (u32)msecs_to_jiffies(tcp_time_stamp(tp) - ++ (tp->retrans_stamp ?: tcp_skb_timestamp(skb))); ++ ++ return rtx_delta > timeout; ++} + + /** + * tcp_retransmit_timer() - The TCP retransmit timeout handler +@@ -506,7 +522,7 @@ void tcp_retransmit_timer(struct sock *sk) + tp->snd_una, tp->snd_nxt); + } + #endif +- if (tcp_jiffies32 - tp->rcv_tstamp > TCP_RTO_MAX) { ++ if (tcp_rtx_probe0_timed_out(sk, skb)) { + tcp_write_err(sk); + goto out; + } +-- +2.40.1 + diff --git a/queue-6.1/netrom-deny-concurrent-connect.patch b/queue-6.1/netrom-deny-concurrent-connect.patch new file mode 100644 index 00000000000..c38678c5780 --- /dev/null +++ b/queue-6.1/netrom-deny-concurrent-connect.patch @@ -0,0 +1,139 @@ +From 718f570d968f25f05e112354bd22dca01e83acfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 09:50:59 -0700 +Subject: netrom: Deny concurrent connect(). + +From: Kuniyuki Iwashima + +[ Upstream commit c2f8fd7949603efb03908e05abbf7726748c8de3 ] + +syzkaller reported null-ptr-deref [0] related to AF_NETROM. +This is another self-accept issue from the strace log. [1] + +syz-executor creates an AF_NETROM socket and calls connect(), which +is blocked at that time. Then, sk->sk_state is TCP_SYN_SENT and +sock->state is SS_CONNECTING. + + [pid 5059] socket(AF_NETROM, SOCK_SEQPACKET, 0) = 4 + [pid 5059] connect(4, {sa_family=AF_NETROM, sa_data="..." + +Another thread calls connect() concurrently, which finally fails +with -EINVAL. However, the problem here is the socket state is +reset even while the first connect() is blocked. + + [pid 5060] connect(4, NULL, 0 + [pid 5060] <... connect resumed>) = -1 EINVAL (Invalid argument) + +As sk->state is TCP_CLOSE and sock->state is SS_UNCONNECTED, the +following listen() succeeds. Then, the first connect() looks up +itself as a listener and puts skb into the queue with skb->sk itself. +As a result, the next accept() gets another FD of itself as 3, and +the first connect() finishes. + + [pid 5060] listen(4, 0 + [pid 5060] <... listen resumed>) = 0 + [pid 5060] accept(4, NULL, NULL + [pid 5060] <... accept resumed>) = 3 + [pid 5059] <... connect resumed>) = 0 + +Then, accept4() is called but blocked, which causes the general protection +fault later. + + [pid 5059] accept4(4, NULL, 0x20000400, SOCK_NONBLOCK + +After that, another self-accept occurs by accept() and writev(). + + [pid 5060] accept(4, NULL, NULL + [pid 5061] writev(3, [{iov_base=...}] + [pid 5061] <... writev resumed>) = 99 + [pid 5060] <... accept resumed>) = 6 + +Finally, the leader thread close()s all FDs. Since the three FDs +reference the same socket, nr_release() does the cleanup for it +three times, and the remaining accept4() causes the following fault. + + [pid 5058] close(3) = 0 + [pid 5058] close(4) = 0 + [pid 5058] close(5) = -1 EBADF (Bad file descriptor) + [pid 5058] close(6) = 0 + [pid 5058] <... exit_group resumed>) = ? + [ 83.456055][ T5059] general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN + +To avoid the issue, we need to return an error for connect() if +another connect() is in progress, as done in __inet_stream_connect(). + +[0]: +general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] +CPU: 0 PID: 5059 Comm: syz-executor.0 Not tainted 6.5.0-rc5-syzkaller-00194-gace0ab3a4b54 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 +RIP: 0010:__lock_acquire+0x109/0x5de0 kernel/locking/lockdep.c:5012 +Code: 45 85 c9 0f 84 cc 0e 00 00 44 8b 05 11 6e 23 0b 45 85 c0 0f 84 be 0d 00 00 48 ba 00 00 00 00 00 fc ff df 4c 89 d1 48 c1 e9 03 <80> 3c 11 00 0f 85 e8 40 00 00 49 81 3a a0 69 48 90 0f 84 96 0d 00 +RSP: 0018:ffffc90003d6f9e0 EFLAGS: 00010006 +RAX: ffff8880244c8000 RBX: 1ffff920007adf6c RCX: 0000000000000003 +RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000018 +RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000001 +R10: 0000000000000018 R11: 0000000000000000 R12: 0000000000000000 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 +FS: 00007f51d519a6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f51d5158d58 CR3: 000000002943f000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + lock_acquire kernel/locking/lockdep.c:5761 [inline] + lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5726 + __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] + _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162 + prepare_to_wait+0x47/0x380 kernel/sched/wait.c:269 + nr_accept+0x20d/0x650 net/netrom/af_netrom.c:798 + do_accept+0x3a6/0x570 net/socket.c:1872 + __sys_accept4_file net/socket.c:1913 [inline] + __sys_accept4+0x99/0x120 net/socket.c:1943 + __do_sys_accept4 net/socket.c:1954 [inline] + __se_sys_accept4 net/socket.c:1951 [inline] + __x64_sys_accept4+0x96/0x100 net/socket.c:1951 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f51d447cae9 +Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f51d519a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 +RAX: ffffffffffffffda RBX: 00007f51d459bf80 RCX: 00007f51d447cae9 +RDX: 0000000020000400 RSI: 0000000000000000 RDI: 0000000000000004 +RBP: 00007f51d44c847a R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000000 +R13: 000000000000000b R14: 00007f51d459bf80 R15: 00007ffc25c34e48 + + +Link: https://syzkaller.appspot.com/text?tag=CrashLog&x=152cdb63a80000 [1] +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: syzbot+666c97e4686410e79649@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=666c97e4686410e79649 +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/netrom/af_netrom.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index 5a4cb796150f5..ec5747969f964 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -660,6 +660,11 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr, + goto out_release; + } + ++ if (sock->state == SS_CONNECTING) { ++ err = -EALREADY; ++ goto out_release; ++ } ++ + sk->sk_state = TCP_CLOSE; + sock->state = SS_UNCONNECTED; + +-- +2.40.1 + diff --git a/queue-6.1/nfs-blocklayout-use-the-passed-in-gfp-flags.patch b/queue-6.1/nfs-blocklayout-use-the-passed-in-gfp-flags.patch new file mode 100644 index 00000000000..119e0e871a3 --- /dev/null +++ b/queue-6.1/nfs-blocklayout-use-the-passed-in-gfp-flags.patch @@ -0,0 +1,47 @@ +From 6a48de5a051d4c254d531fb8ada8f2eb5b62d6ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 11:08:46 +0300 +Subject: nfs/blocklayout: Use the passed in gfp flags + +From: Dan Carpenter + +[ Upstream commit 08b45fcb2d4675f6182fe0edc0d8b1fe604051fa ] + +This allocation should use the passed in GFP_ flags instead of +GFP_KERNEL. One places where this matters is in filelayout_pg_init_write() +which uses GFP_NOFS as the allocation flags. + +Fixes: 5c83746a0cf2 ("pnfs/blocklayout: in-kernel GETDEVICEINFO XDR parsing") +Signed-off-by: Dan Carpenter +Reviewed-by: Christoph Hellwig +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/blocklayout/dev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c +index fea5f8821da5e..ce2ea62397972 100644 +--- a/fs/nfs/blocklayout/dev.c ++++ b/fs/nfs/blocklayout/dev.c +@@ -402,7 +402,7 @@ bl_parse_concat(struct nfs_server *server, struct pnfs_block_dev *d, + int ret, i; + + d->children = kcalloc(v->concat.volumes_count, +- sizeof(struct pnfs_block_dev), GFP_KERNEL); ++ sizeof(struct pnfs_block_dev), gfp_mask); + if (!d->children) + return -ENOMEM; + +@@ -431,7 +431,7 @@ bl_parse_stripe(struct nfs_server *server, struct pnfs_block_dev *d, + int ret, i; + + d->children = kcalloc(v->stripe.volumes_count, +- sizeof(struct pnfs_block_dev), GFP_KERNEL); ++ sizeof(struct pnfs_block_dev), gfp_mask); + if (!d->children) + return -ENOMEM; + +-- +2.40.1 + diff --git a/queue-6.1/nfs-guard-against-readdir-loop-when-entry-names-exce.patch b/queue-6.1/nfs-guard-against-readdir-loop-when-entry-names-exce.patch new file mode 100644 index 00000000000..bc93b74aa58 --- /dev/null +++ b/queue-6.1/nfs-guard-against-readdir-loop-when-entry-names-exce.patch @@ -0,0 +1,57 @@ +From 103b02a2c321255dcb69b6b2954ee18e84622167 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Aug 2023 14:22:38 -0400 +Subject: NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN + +From: Benjamin Coddington + +[ Upstream commit f67b55b6588bcf9316a1e6e8d529100a5aa3ebe6 ] + +Commit 64cfca85bacd asserts the only valid return values for +nfs2/3_decode_dirent should not include -ENAMETOOLONG, but for a server +that sends a filename3 which exceeds MAXNAMELEN in a READDIR response the +client's behavior will be to endlessly retry the operation. + +We could map -ENAMETOOLONG into -EBADCOOKIE, but that would produce +truncated listings without any error. The client should return an error +for this case to clearly assert that the server implementation must be +corrected. + +Fixes: 64cfca85bacd ("NFS: Return valid errors from nfs2/3_decode_dirent()") +Signed-off-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs2xdr.c | 2 +- + fs/nfs/nfs3xdr.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c +index 05c3b4b2b3dd8..c190938142960 100644 +--- a/fs/nfs/nfs2xdr.c ++++ b/fs/nfs/nfs2xdr.c +@@ -949,7 +949,7 @@ int nfs2_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + + error = decode_filename_inline(xdr, &entry->name, &entry->len); + if (unlikely(error)) +- return -EAGAIN; ++ return error == -ENAMETOOLONG ? -ENAMETOOLONG : -EAGAIN; + + /* + * The type (size and byte order) of nfscookie isn't defined in +diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c +index 3b0b650c9c5ab..60f032be805ae 100644 +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -1991,7 +1991,7 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + + error = decode_inline_filename3(xdr, &entry->name, &entry->len); + if (unlikely(error)) +- return -EAGAIN; ++ return error == -ENAMETOOLONG ? -ENAMETOOLONG : -EAGAIN; + + error = decode_cookie3(xdr, &new_cookie); + if (unlikely(error)) +-- +2.40.1 + diff --git a/queue-6.1/nfsd-da_addr_body-field-missing-in-some-getdeviceinf.patch b/queue-6.1/nfsd-da_addr_body-field-missing-in-some-getdeviceinf.patch new file mode 100644 index 00000000000..fb18d0f07f8 --- /dev/null +++ b/queue-6.1/nfsd-da_addr_body-field-missing-in-some-getdeviceinf.patch @@ -0,0 +1,139 @@ +From a17319084e879eef0ff2f16c3840279ec2c3169a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Aug 2023 10:20:52 -0400 +Subject: NFSD: da_addr_body field missing in some GETDEVICEINFO replies + +From: Chuck Lever + +[ Upstream commit 6372e2ee629894433fe6107d7048536a3280a284 ] + +The XDR specification in RFC 8881 looks like this: + +struct device_addr4 { + layouttype4 da_layout_type; + opaque da_addr_body<>; +}; + +struct GETDEVICEINFO4resok { + device_addr4 gdir_device_addr; + bitmap4 gdir_notification; +}; + +union GETDEVICEINFO4res switch (nfsstat4 gdir_status) { +case NFS4_OK: + GETDEVICEINFO4resok gdir_resok4; +case NFS4ERR_TOOSMALL: + count4 gdir_mincount; +default: + void; +}; + +Looking at nfsd4_encode_getdeviceinfo() .... + +When the client provides a zero gd_maxcount, then the Linux NFS +server implementation encodes the da_layout_type field and then +skips the da_addr_body field completely, proceeding directly to +encode gdir_notification field. + +There does not appear to be an option in the specification to skip +encoding da_addr_body. Moreover, Section 18.40.3 says: + +> If the client wants to just update or turn off notifications, it +> MAY send a GETDEVICEINFO operation with gdia_maxcount set to zero. +> In that event, if the device ID is valid, the reply's da_addr_body +> field of the gdir_device_addr field will be of zero length. + +Since the layout drivers are responsible for encoding the +da_addr_body field, put this fix inside the ->encode_getdeviceinfo +methods. + +Fixes: 9cf514ccfacb ("nfsd: implement pNFS operations") +Reviewed-by: Christoph Hellwig +Cc: Tom Haynes +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/blocklayoutxdr.c | 9 +++++++++ + fs/nfsd/flexfilelayoutxdr.c | 9 +++++++++ + fs/nfsd/nfs4xdr.c | 25 +++++++++++-------------- + 3 files changed, 29 insertions(+), 14 deletions(-) + +diff --git a/fs/nfsd/blocklayoutxdr.c b/fs/nfsd/blocklayoutxdr.c +index 442543304930b..2455dc8be18a8 100644 +--- a/fs/nfsd/blocklayoutxdr.c ++++ b/fs/nfsd/blocklayoutxdr.c +@@ -82,6 +82,15 @@ nfsd4_block_encode_getdeviceinfo(struct xdr_stream *xdr, + int len = sizeof(__be32), ret, i; + __be32 *p; + ++ /* ++ * See paragraph 5 of RFC 8881 S18.40.3. ++ */ ++ if (!gdp->gd_maxcount) { ++ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT) ++ return nfserr_resource; ++ return nfs_ok; ++ } ++ + p = xdr_reserve_space(xdr, len + sizeof(__be32)); + if (!p) + return nfserr_resource; +diff --git a/fs/nfsd/flexfilelayoutxdr.c b/fs/nfsd/flexfilelayoutxdr.c +index e81d2a5cf381e..bb205328e043d 100644 +--- a/fs/nfsd/flexfilelayoutxdr.c ++++ b/fs/nfsd/flexfilelayoutxdr.c +@@ -85,6 +85,15 @@ nfsd4_ff_encode_getdeviceinfo(struct xdr_stream *xdr, + int addr_len; + __be32 *p; + ++ /* ++ * See paragraph 5 of RFC 8881 S18.40.3. ++ */ ++ if (!gdp->gd_maxcount) { ++ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT) ++ return nfserr_resource; ++ return nfs_ok; ++ } ++ + /* len + padding for two strings */ + addr_len = 16 + da->netaddr.netid_len + da->netaddr.addr_len; + ver_len = 20; +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 8f90a87ee9ca0..89a579be042e5 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -4571,20 +4571,17 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr, + + *p++ = cpu_to_be32(gdev->gd_layout_type); + +- /* If maxcount is 0 then just update notifications */ +- if (gdev->gd_maxcount != 0) { +- ops = nfsd4_layout_ops[gdev->gd_layout_type]; +- nfserr = ops->encode_getdeviceinfo(xdr, gdev); +- if (nfserr) { +- /* +- * We don't bother to burden the layout drivers with +- * enforcing gd_maxcount, just tell the client to +- * come back with a bigger buffer if it's not enough. +- */ +- if (xdr->buf->len + 4 > gdev->gd_maxcount) +- goto toosmall; +- return nfserr; +- } ++ ops = nfsd4_layout_ops[gdev->gd_layout_type]; ++ nfserr = ops->encode_getdeviceinfo(xdr, gdev); ++ if (nfserr) { ++ /* ++ * We don't bother to burden the layout drivers with ++ * enforcing gd_maxcount, just tell the client to ++ * come back with a bigger buffer if it's not enough. ++ */ ++ if (xdr->buf->len + 4 > gdev->gd_maxcount) ++ goto toosmall; ++ return nfserr; + } + + if (gdev->gd_notify_types) { +-- +2.40.1 + diff --git a/queue-6.1/nfsv4.2-fix-handling-of-copy-err_offload_no_req.patch b/queue-6.1/nfsv4.2-fix-handling-of-copy-err_offload_no_req.patch new file mode 100644 index 00000000000..e30d5cc1be8 --- /dev/null +++ b/queue-6.1/nfsv4.2-fix-handling-of-copy-err_offload_no_req.patch @@ -0,0 +1,40 @@ +From 11437996b35c4e3e74a6f08f5abd88a07d00b277 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 16:43:53 -0400 +Subject: NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ + +From: Olga Kornievskaia + +[ Upstream commit 5690eed941ab7e33c3c3d6b850100cabf740f075 ] + +If the client sent a synchronous copy and the server replied with +ERR_OFFLOAD_NO_REQ indicating that it wants an asynchronous +copy instead, the client should retry with asynchronous copy. + +Fixes: 539f57b3e0fd ("NFS handle COPY ERR_OFFLOAD_NO_REQS") +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs42proc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c +index 7c33bba179d2f..d903ea10410c2 100644 +--- a/fs/nfs/nfs42proc.c ++++ b/fs/nfs/nfs42proc.c +@@ -470,8 +470,9 @@ ssize_t nfs42_proc_copy(struct file *src, loff_t pos_src, + continue; + } + break; +- } else if (err == -NFS4ERR_OFFLOAD_NO_REQS && !args.sync) { +- args.sync = true; ++ } else if (err == -NFS4ERR_OFFLOAD_NO_REQS && ++ args.sync != res.synchronous) { ++ args.sync = res.synchronous; + dst_exception.retry = 1; + continue; + } else if ((err == -ESTALE || +-- +2.40.1 + diff --git a/queue-6.1/nfsv4.2-fix-read_plus-size-calculations.patch b/queue-6.1/nfsv4.2-fix-read_plus-size-calculations.patch new file mode 100644 index 00000000000..01ccecd71d0 --- /dev/null +++ b/queue-6.1/nfsv4.2-fix-read_plus-size-calculations.patch @@ -0,0 +1,59 @@ +From a200dd46a4fd328d953c20ce2dda4475d000b195 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 17:02:54 -0400 +Subject: NFSv4.2: Fix READ_PLUS size calculations + +From: Anna Schumaker + +[ Upstream commit 8d18f6c5bb864d97a730f471c56cdecf313efe64 ] + +I bump the decode_read_plus_maxsz to account for hole segments, but I +need to subtract out this increase when calling +rpc_prepare_reply_pages() so the common case of single data segment +replies can be directly placed into the xdr pages without needing to be +shifted around. + +Reported-by: Chuck Lever +Fixes: d3b00a802c845 ("NFS: Replace the READ_PLUS decoding code") +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs42xdr.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c +index ef3b150970ff6..75765382cc0e6 100644 +--- a/fs/nfs/nfs42xdr.c ++++ b/fs/nfs/nfs42xdr.c +@@ -51,10 +51,16 @@ + (1 /* data_content4 */ + \ + 2 /* data_info4.di_offset */ + \ + 1 /* data_info4.di_length */) ++#define NFS42_READ_PLUS_HOLE_SEGMENT_SIZE \ ++ (1 /* data_content4 */ + \ ++ 2 /* data_info4.di_offset */ + \ ++ 2 /* data_info4.di_length */) ++#define READ_PLUS_SEGMENT_SIZE_DIFF (NFS42_READ_PLUS_HOLE_SEGMENT_SIZE - \ ++ NFS42_READ_PLUS_DATA_SEGMENT_SIZE) + #define decode_read_plus_maxsz (op_decode_hdr_maxsz + \ + 1 /* rpr_eof */ + \ + 1 /* rpr_contents count */ + \ +- NFS42_READ_PLUS_DATA_SEGMENT_SIZE) ++ NFS42_READ_PLUS_HOLE_SEGMENT_SIZE) + #define encode_seek_maxsz (op_encode_hdr_maxsz + \ + encode_stateid_maxsz + \ + 2 /* offset */ + \ +@@ -781,8 +787,8 @@ static void nfs4_xdr_enc_read_plus(struct rpc_rqst *req, + encode_putfh(xdr, args->fh, &hdr); + encode_read_plus(xdr, args, &hdr); + +- rpc_prepare_reply_pages(req, args->pages, args->pgbase, +- args->count, hdr.replen); ++ rpc_prepare_reply_pages(req, args->pages, args->pgbase, args->count, ++ hdr.replen - READ_PLUS_SEGMENT_SIZE_DIFF); + encode_nops(&hdr); + } + +-- +2.40.1 + diff --git a/queue-6.1/nfsv4.2-fix-read_plus-smatch-warnings.patch b/queue-6.1/nfsv4.2-fix-read_plus-smatch-warnings.patch new file mode 100644 index 00000000000..44650cbff00 --- /dev/null +++ b/queue-6.1/nfsv4.2-fix-read_plus-smatch-warnings.patch @@ -0,0 +1,50 @@ +From 133dc6a4589bf952531ff4d98c5e346fc459ae05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 May 2023 17:27:08 -0400 +Subject: NFSv4.2: Fix READ_PLUS smatch warnings + +From: Anna Schumaker + +[ Upstream commit bb05a617f06b7a882e19c4f475b8e37f14d9ceac ] + +Smatch reports: + fs/nfs/nfs42xdr.c:1131 decode_read_plus() warn: missing error code? 'status' + +Which Dan suggests to fix by doing a hardcoded "return 0" from the +"if (segments == 0)" check. + +Additionally, smatch reports that the "status = -EIO" assignment is not +used. This patch addresses both these issues. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202305222209.6l5VM2lL-lkp@intel.com/ +Fixes: d3b00a802c845 ("NFS: Replace the READ_PLUS decoding code") +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs42xdr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c +index 08c1dd094f010..ae034a1c53efd 100644 +--- a/fs/nfs/nfs42xdr.c ++++ b/fs/nfs/nfs42xdr.c +@@ -1135,13 +1135,12 @@ static int decode_read_plus(struct xdr_stream *xdr, struct nfs_pgio_res *res) + res->eof = be32_to_cpup(p++); + segments = be32_to_cpup(p++); + if (segments == 0) +- return status; ++ return 0; + + segs = kmalloc_array(segments, sizeof(*segs), GFP_KERNEL); + if (!segs) + return -ENOMEM; + +- status = -EIO; + for (i = 0; i < segments; i++) { + status = decode_read_plus_segment(xdr, &segs[i]); + if (status < 0) +-- +2.40.1 + diff --git a/queue-6.1/nfsv4.2-fix-up-read_plus-alignment.patch b/queue-6.1/nfsv4.2-fix-up-read_plus-alignment.patch new file mode 100644 index 00000000000..6ed86e7198a --- /dev/null +++ b/queue-6.1/nfsv4.2-fix-up-read_plus-alignment.patch @@ -0,0 +1,45 @@ +From efec07e90f8e820ab4d8e548c58bfe28b2498dfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Nov 2022 13:15:26 -0500 +Subject: NFSv4.2: Fix up READ_PLUS alignment + +From: Anna Schumaker + +[ Upstream commit f8527028a7e52da884055c401abc04e0b0c84285 ] + +Assume that the first segment will be a DATA segment, and place the data +directly into the xdr pages so it doesn't need to be shifted. + +Signed-off-by: Anna Schumaker +Signed-off-by: Trond Myklebust +Stable-dep-of: 8d18f6c5bb86 ("NFSv4.2: Fix READ_PLUS size calculations") +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs42xdr.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c +index ae034a1c53efd..ef3b150970ff6 100644 +--- a/fs/nfs/nfs42xdr.c ++++ b/fs/nfs/nfs42xdr.c +@@ -47,13 +47,14 @@ + #define decode_deallocate_maxsz (op_decode_hdr_maxsz) + #define encode_read_plus_maxsz (op_encode_hdr_maxsz + \ + encode_stateid_maxsz + 3) +-#define NFS42_READ_PLUS_SEGMENT_SIZE (1 /* data_content4 */ + \ ++#define NFS42_READ_PLUS_DATA_SEGMENT_SIZE \ ++ (1 /* data_content4 */ + \ + 2 /* data_info4.di_offset */ + \ +- 2 /* data_info4.di_length */) ++ 1 /* data_info4.di_length */) + #define decode_read_plus_maxsz (op_decode_hdr_maxsz + \ + 1 /* rpr_eof */ + \ + 1 /* rpr_contents count */ + \ +- 2 * NFS42_READ_PLUS_SEGMENT_SIZE) ++ NFS42_READ_PLUS_DATA_SEGMENT_SIZE) + #define encode_seek_maxsz (op_encode_hdr_maxsz + \ + encode_stateid_maxsz + \ + 2 /* offset */ + \ +-- +2.40.1 + diff --git a/queue-6.1/nfsv4.2-rework-scratch-handling-for-read_plus.patch b/queue-6.1/nfsv4.2-rework-scratch-handling-for-read_plus.patch new file mode 100644 index 00000000000..d6d2c2dc2d1 --- /dev/null +++ b/queue-6.1/nfsv4.2-rework-scratch-handling-for-read_plus.patch @@ -0,0 +1,118 @@ +From 52845ff6959f19851197234a0663c28055e3e378 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 15:16:52 -0400 +Subject: NFSv4.2: Rework scratch handling for READ_PLUS + +From: Anna Schumaker + +[ Upstream commit fbd2a05f29a95d5b42b294bf47e55a711424965b ] + +Instead of using a tiny, static scratch buffer, we should use a kmalloc()-ed +buffer that is allocated when checking for read plus usage. This lets us +use the buffer before decoding any part of the READ_PLUS operation +instead of setting it right before segment decoding, meaning it should +be a little more robust. + +Signed-off-by: Anna Schumaker +Stable-dep-of: bb05a617f06b ("NFSv4.2: Fix READ_PLUS smatch warnings") +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs42xdr.c | 4 ++-- + fs/nfs/nfs4proc.c | 17 ++++++++++++----- + include/linux/nfs_xdr.h | 1 + + 3 files changed, 15 insertions(+), 7 deletions(-) + +diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c +index 2fd465cab631d..08c1dd094f010 100644 +--- a/fs/nfs/nfs42xdr.c ++++ b/fs/nfs/nfs42xdr.c +@@ -1121,7 +1121,6 @@ static int decode_read_plus(struct xdr_stream *xdr, struct nfs_pgio_res *res) + uint32_t segments; + struct read_plus_segment *segs; + int status, i; +- char scratch_buf[16]; + __be32 *p; + + status = decode_op_hdr(xdr, OP_READ_PLUS); +@@ -1142,7 +1141,6 @@ static int decode_read_plus(struct xdr_stream *xdr, struct nfs_pgio_res *res) + if (!segs) + return -ENOMEM; + +- xdr_set_scratch_buffer(xdr, &scratch_buf, sizeof(scratch_buf)); + status = -EIO; + for (i = 0; i < segments; i++) { + status = decode_read_plus_segment(xdr, &segs[i]); +@@ -1347,6 +1345,8 @@ static int nfs4_xdr_dec_read_plus(struct rpc_rqst *rqstp, + struct compound_hdr hdr; + int status; + ++ xdr_set_scratch_buffer(xdr, res->scratch, sizeof(res->scratch)); ++ + status = decode_compound_hdr(xdr, &hdr); + if (status) + goto out; +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 1044305e77996..3f96ccc386c34 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -5446,6 +5446,8 @@ static bool nfs4_read_plus_not_supported(struct rpc_task *task, + + static int nfs4_read_done(struct rpc_task *task, struct nfs_pgio_header *hdr) + { ++ if (hdr->res.scratch) ++ kfree(hdr->res.scratch); + if (!nfs4_sequence_done(task, &hdr->res.seq_res)) + return -EAGAIN; + if (nfs4_read_stateid_changed(task, &hdr->args)) +@@ -5459,17 +5461,22 @@ static int nfs4_read_done(struct rpc_task *task, struct nfs_pgio_header *hdr) + } + + #if defined CONFIG_NFS_V4_2 && defined CONFIG_NFS_V4_2_READ_PLUS +-static void nfs42_read_plus_support(struct nfs_pgio_header *hdr, ++static bool nfs42_read_plus_support(struct nfs_pgio_header *hdr, + struct rpc_message *msg) + { + /* Note: We don't use READ_PLUS with pNFS yet */ +- if (nfs_server_capable(hdr->inode, NFS_CAP_READ_PLUS) && !hdr->ds_clp) ++ if (nfs_server_capable(hdr->inode, NFS_CAP_READ_PLUS) && !hdr->ds_clp) { + msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_READ_PLUS]; ++ hdr->res.scratch = kmalloc(32, GFP_KERNEL); ++ return hdr->res.scratch != NULL; ++ } ++ return false; + } + #else +-static void nfs42_read_plus_support(struct nfs_pgio_header *hdr, ++static bool nfs42_read_plus_support(struct nfs_pgio_header *hdr, + struct rpc_message *msg) + { ++ return false; + } + #endif /* CONFIG_NFS_V4_2 */ + +@@ -5479,8 +5486,8 @@ static void nfs4_proc_read_setup(struct nfs_pgio_header *hdr, + hdr->timestamp = jiffies; + if (!hdr->pgio_done_cb) + hdr->pgio_done_cb = nfs4_read_done_cb; +- msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_READ]; +- nfs42_read_plus_support(hdr, msg); ++ if (!nfs42_read_plus_support(hdr, msg)) ++ msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_READ]; + nfs4_init_sequence(&hdr->args.seq_args, &hdr->res.seq_res, 0, 0); + } + +diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h +index e86cf6642d212..2fd973d188c47 100644 +--- a/include/linux/nfs_xdr.h ++++ b/include/linux/nfs_xdr.h +@@ -670,6 +670,7 @@ struct nfs_pgio_res { + struct { + unsigned int replen; /* used by read */ + int eof; /* used by read */ ++ void * scratch; /* used by read */ + }; + struct { + struct nfs_writeverf * verf; /* used by write */ +-- +2.40.1 + diff --git a/queue-6.1/nvdimm-fix-dereference-after-free-in-register_nvdimm.patch b/queue-6.1/nvdimm-fix-dereference-after-free-in-register_nvdimm.patch new file mode 100644 index 00000000000..a385a4d475d --- /dev/null +++ b/queue-6.1/nvdimm-fix-dereference-after-free-in-register_nvdimm.patch @@ -0,0 +1,43 @@ +From cc83ca152257f078717a577614f57c8bf2986a73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 19:41:03 +0800 +Subject: nvdimm: Fix dereference after free in register_nvdimm_pmu() + +From: Konstantin Meskhidze + +[ Upstream commit 08ca6906a4b7e48f8e93b7c1f49a742a415be6d5 ] + +'nd_pmu->pmu.attr_groups' is dereferenced in function +'nvdimm_pmu_free_hotplug_memory' call after it has been freed. Because in +function 'nvdimm_pmu_free_hotplug_memory' memory pointed by the fields of +'nd_pmu->pmu.attr_groups' is deallocated it is necessary to call 'kfree' +after 'nvdimm_pmu_free_hotplug_memory'. + +Fixes: 0fab1ba6ad6b ("drivers/nvdimm: Add perf interface to expose nvdimm performance stats") +Co-developed-by: Ivanov Mikhail +Signed-off-by: Konstantin Meskhidze +Reviewed-by: Jeff Moyer +Link: https://lore.kernel.org/r/20230817114103.754977-1-konstantin.meskhidze@huawei.com +Signed-off-by: Dave Jiang +Signed-off-by: Sasha Levin +--- + drivers/nvdimm/nd_perf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvdimm/nd_perf.c b/drivers/nvdimm/nd_perf.c +index 14881c4e03e6b..2b6dc80d8fb5b 100644 +--- a/drivers/nvdimm/nd_perf.c ++++ b/drivers/nvdimm/nd_perf.c +@@ -308,8 +308,8 @@ int register_nvdimm_pmu(struct nvdimm_pmu *nd_pmu, struct platform_device *pdev) + + rc = perf_pmu_register(&nd_pmu->pmu, nd_pmu->pmu.name, -1); + if (rc) { +- kfree(nd_pmu->pmu.attr_groups); + nvdimm_pmu_free_hotplug_memory(nd_pmu); ++ kfree(nd_pmu->pmu.attr_groups); + return rc; + } + +-- +2.40.1 + diff --git a/queue-6.1/nvdimm-fix-memleak-of-pmu-attr_groups-in-unregister_.patch b/queue-6.1/nvdimm-fix-memleak-of-pmu-attr_groups-in-unregister_.patch new file mode 100644 index 00000000000..53186891789 --- /dev/null +++ b/queue-6.1/nvdimm-fix-memleak-of-pmu-attr_groups-in-unregister_.patch @@ -0,0 +1,39 @@ +From 0a48491c8b30202e68379948d55bc9757288afe7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 19:59:45 +0800 +Subject: nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu() + +From: Konstantin Meskhidze + +[ Upstream commit 85ae42c72142346645e63c33835da947dfa008b3 ] + +Memory pointed by 'nd_pmu->pmu.attr_groups' is allocated in function +'register_nvdimm_pmu' and is lost after 'kfree(nd_pmu)' call in function +'unregister_nvdimm_pmu'. + +Fixes: 0fab1ba6ad6b ("drivers/nvdimm: Add perf interface to expose nvdimm performance stats") +Co-developed-by: Ivanov Mikhail +Signed-off-by: Konstantin Meskhidze +Reviewed-by: Jeff Moyer +Link: https://lore.kernel.org/r/20230817115945.771826-1-konstantin.meskhidze@huawei.com +Signed-off-by: Dave Jiang +Signed-off-by: Sasha Levin +--- + drivers/nvdimm/nd_perf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvdimm/nd_perf.c b/drivers/nvdimm/nd_perf.c +index 433bbb68ae641..14881c4e03e6b 100644 +--- a/drivers/nvdimm/nd_perf.c ++++ b/drivers/nvdimm/nd_perf.c +@@ -324,6 +324,7 @@ void unregister_nvdimm_pmu(struct nvdimm_pmu *nd_pmu) + { + perf_pmu_unregister(&nd_pmu->pmu); + nvdimm_pmu_free_hotplug_memory(nd_pmu); ++ kfree(nd_pmu->pmu.attr_groups); + kfree(nd_pmu); + } + EXPORT_SYMBOL_GPL(unregister_nvdimm_pmu); +-- +2.40.1 + diff --git a/queue-6.1/octeontx2-pf-fix-pfc-tx-scheduler-free.patch b/queue-6.1/octeontx2-pf-fix-pfc-tx-scheduler-free.patch new file mode 100644 index 00000000000..4e917b1ace8 --- /dev/null +++ b/queue-6.1/octeontx2-pf-fix-pfc-tx-scheduler-free.patch @@ -0,0 +1,67 @@ +From 529cc4acb9ebcd100fd70c1fd40196047fe03fc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 13:40:30 +0530 +Subject: octeontx2-pf: Fix PFC TX scheduler free + +From: Suman Ghosh + +[ Upstream commit a9ac2e18779597f280d68a5b5f5bdd51a34080fa ] + +During PFC TX schedulers free, flag TXSCHQ_FREE_ALL was being set +which caused free up all schedulers other than the PFC schedulers. +This patch fixes that to free only the PFC Tx schedulers. + +Fixes: 99c969a83d82 ("octeontx2-pf: Add egress PFC support") +Signed-off-by: Suman Ghosh +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230824081032.436432-2-sumang@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/marvell/octeontx2/nic/otx2_common.c | 1 + + .../ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 15 ++++----------- + 2 files changed, 5 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +index dd97731f81698..011355e73696e 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +@@ -773,6 +773,7 @@ void otx2_txschq_free_one(struct otx2_nic *pfvf, u16 lvl, u16 schq) + + mutex_unlock(&pfvf->mbox.lock); + } ++EXPORT_SYMBOL(otx2_txschq_free_one); + + void otx2_txschq_stop(struct otx2_nic *pfvf) + { +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c +index ccaf97bb1ce03..6492749dd7c89 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c +@@ -125,19 +125,12 @@ int otx2_pfc_txschq_alloc(struct otx2_nic *pfvf) + + static int otx2_pfc_txschq_stop_one(struct otx2_nic *pfvf, u8 prio) + { +- struct nix_txsch_free_req *free_req; ++ int lvl; + +- mutex_lock(&pfvf->mbox.lock); + /* free PFC TLx nodes */ +- free_req = otx2_mbox_alloc_msg_nix_txsch_free(&pfvf->mbox); +- if (!free_req) { +- mutex_unlock(&pfvf->mbox.lock); +- return -ENOMEM; +- } +- +- free_req->flags = TXSCHQ_FREE_ALL; +- otx2_sync_mbox_msg(&pfvf->mbox); +- mutex_unlock(&pfvf->mbox.lock); ++ for (lvl = 0; lvl < pfvf->hw.txschq_link_cfg_lvl; lvl++) ++ otx2_txschq_free_one(pfvf, lvl, ++ pfvf->pfc_schq_list[lvl][prio]); + + pfvf->pfc_alloc_status[prio] = false; + return 0; +-- +2.40.1 + diff --git a/queue-6.1/octeontx2-pf-refactor-schedular-queue-alloc-free-cal.patch b/queue-6.1/octeontx2-pf-refactor-schedular-queue-alloc-free-cal.patch new file mode 100644 index 00000000000..837627dd16c --- /dev/null +++ b/queue-6.1/octeontx2-pf-refactor-schedular-queue-alloc-free-cal.patch @@ -0,0 +1,322 @@ +From 9dff8b607074de40a0cf330accf4c8b1d6fda0a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 May 2023 14:21:39 +0530 +Subject: octeontx2-pf: Refactor schedular queue alloc/free calls + +From: Hariprasad Kelam + +[ Upstream commit 6b4b2ded9c4282deea421eef144ab0ced954721c ] + +1. Upon txschq free request, the transmit schedular config in hardware +is not getting reset. This patch adds necessary changes to do the same. + +2. Current implementation calls txschq alloc during interface +initialization and in response handler updates the default txschq array. +This creates a problem for htb offload where txsch alloc will be called +for every tc class. This patch addresses the issue by reading txschq +response in mbox caller function instead in the response handler. + +3. Current otx2_txschq_stop routine tries to free all txschq nodes +allocated to the interface. This creates a problem for htb offload. +This patch introduces the otx2_txschq_free_one to free txschq in a +given level. + +Signed-off-by: Hariprasad Kelam +Signed-off-by: Naveen Mamindlapalli +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: David S. Miller +Stable-dep-of: a9ac2e187795 ("octeontx2-pf: Fix PFC TX scheduler free") +Signed-off-by: Sasha Levin +--- + .../ethernet/marvell/octeontx2/af/rvu_nix.c | 45 +++++++++++++ + .../marvell/octeontx2/nic/otx2_common.c | 67 ++++++++++++------- + .../marvell/octeontx2/nic/otx2_common.h | 3 +- + .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 13 +--- + .../ethernet/marvell/octeontx2/nic/otx2_vf.c | 4 -- + 5 files changed, 94 insertions(+), 38 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 5541e284cd3f0..c85e0180d96da 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -1691,6 +1691,42 @@ handle_txschq_shaper_update(struct rvu *rvu, int blkaddr, int nixlf, + return true; + } + ++static void nix_reset_tx_schedule(struct rvu *rvu, int blkaddr, ++ int lvl, int schq) ++{ ++ u64 tlx_parent = 0, tlx_schedule = 0; ++ ++ switch (lvl) { ++ case NIX_TXSCH_LVL_TL2: ++ tlx_parent = NIX_AF_TL2X_PARENT(schq); ++ tlx_schedule = NIX_AF_TL2X_SCHEDULE(schq); ++ break; ++ case NIX_TXSCH_LVL_TL3: ++ tlx_parent = NIX_AF_TL3X_PARENT(schq); ++ tlx_schedule = NIX_AF_TL3X_SCHEDULE(schq); ++ break; ++ case NIX_TXSCH_LVL_TL4: ++ tlx_parent = NIX_AF_TL4X_PARENT(schq); ++ tlx_schedule = NIX_AF_TL4X_SCHEDULE(schq); ++ break; ++ case NIX_TXSCH_LVL_MDQ: ++ /* no need to reset SMQ_CFG as HW clears this CSR ++ * on SMQ flush ++ */ ++ tlx_parent = NIX_AF_MDQX_PARENT(schq); ++ tlx_schedule = NIX_AF_MDQX_SCHEDULE(schq); ++ break; ++ default: ++ return; ++ } ++ ++ if (tlx_parent) ++ rvu_write64(rvu, blkaddr, tlx_parent, 0x0); ++ ++ if (tlx_schedule) ++ rvu_write64(rvu, blkaddr, tlx_schedule, 0x0); ++} ++ + /* Disable shaping of pkts by a scheduler queue + * at a given scheduler level. + */ +@@ -2040,6 +2076,7 @@ int rvu_mbox_handler_nix_txsch_alloc(struct rvu *rvu, + pfvf_map[schq] = TXSCH_MAP(pcifunc, 0); + nix_reset_tx_linkcfg(rvu, blkaddr, lvl, schq); + nix_reset_tx_shaping(rvu, blkaddr, nixlf, lvl, schq); ++ nix_reset_tx_schedule(rvu, blkaddr, lvl, schq); + } + + for (idx = 0; idx < req->schq[lvl]; idx++) { +@@ -2049,6 +2086,7 @@ int rvu_mbox_handler_nix_txsch_alloc(struct rvu *rvu, + pfvf_map[schq] = TXSCH_MAP(pcifunc, 0); + nix_reset_tx_linkcfg(rvu, blkaddr, lvl, schq); + nix_reset_tx_shaping(rvu, blkaddr, nixlf, lvl, schq); ++ nix_reset_tx_schedule(rvu, blkaddr, lvl, schq); + } + } + +@@ -2137,6 +2175,7 @@ static int nix_txschq_free(struct rvu *rvu, u16 pcifunc) + continue; + nix_reset_tx_linkcfg(rvu, blkaddr, lvl, schq); + nix_clear_tx_xoff(rvu, blkaddr, lvl, schq); ++ nix_reset_tx_shaping(rvu, blkaddr, nixlf, lvl, schq); + } + } + nix_clear_tx_xoff(rvu, blkaddr, NIX_TXSCH_LVL_TL1, +@@ -2175,6 +2214,7 @@ static int nix_txschq_free(struct rvu *rvu, u16 pcifunc) + for (schq = 0; schq < txsch->schq.max; schq++) { + if (TXSCH_MAP_FUNC(txsch->pfvf_map[schq]) != pcifunc) + continue; ++ nix_reset_tx_schedule(rvu, blkaddr, lvl, schq); + rvu_free_rsrc(&txsch->schq, schq); + txsch->pfvf_map[schq] = TXSCH_MAP(0, NIX_TXSCHQ_FREE); + } +@@ -2234,6 +2274,9 @@ static int nix_txschq_free_one(struct rvu *rvu, + */ + nix_clear_tx_xoff(rvu, blkaddr, lvl, schq); + ++ nix_reset_tx_linkcfg(rvu, blkaddr, lvl, schq); ++ nix_reset_tx_shaping(rvu, blkaddr, nixlf, lvl, schq); ++ + /* Flush if it is a SMQ. Onus of disabling + * TL2/3 queue links before SMQ flush is on user + */ +@@ -2243,6 +2286,8 @@ static int nix_txschq_free_one(struct rvu *rvu, + goto err; + } + ++ nix_reset_tx_schedule(rvu, blkaddr, lvl, schq); ++ + /* Free the resource */ + rvu_free_rsrc(&txsch->schq, schq); + txsch->pfvf_map[schq] = TXSCH_MAP(0, NIX_TXSCHQ_FREE); +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +index 8a41ad8ca04f1..dd97731f81698 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +@@ -716,7 +716,8 @@ EXPORT_SYMBOL(otx2_smq_flush); + int otx2_txsch_alloc(struct otx2_nic *pfvf) + { + struct nix_txsch_alloc_req *req; +- int lvl; ++ struct nix_txsch_alloc_rsp *rsp; ++ int lvl, schq, rc; + + /* Get memory to put this msg */ + req = otx2_mbox_alloc_msg_nix_txsch_alloc(&pfvf->mbox); +@@ -726,33 +727,68 @@ int otx2_txsch_alloc(struct otx2_nic *pfvf) + /* Request one schq per level */ + for (lvl = 0; lvl < NIX_TXSCH_LVL_CNT; lvl++) + req->schq[lvl] = 1; ++ rc = otx2_sync_mbox_msg(&pfvf->mbox); ++ if (rc) ++ return rc; + +- return otx2_sync_mbox_msg(&pfvf->mbox); ++ rsp = (struct nix_txsch_alloc_rsp *) ++ otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr); ++ if (IS_ERR(rsp)) ++ return PTR_ERR(rsp); ++ ++ /* Setup transmit scheduler list */ ++ for (lvl = 0; lvl < NIX_TXSCH_LVL_CNT; lvl++) ++ for (schq = 0; schq < rsp->schq[lvl]; schq++) ++ pfvf->hw.txschq_list[lvl][schq] = ++ rsp->schq_list[lvl][schq]; ++ ++ pfvf->hw.txschq_link_cfg_lvl = rsp->link_cfg_lvl; ++ ++ return 0; + } + +-int otx2_txschq_stop(struct otx2_nic *pfvf) ++void otx2_txschq_free_one(struct otx2_nic *pfvf, u16 lvl, u16 schq) + { + struct nix_txsch_free_req *free_req; +- int lvl, schq, err; ++ int err; + + mutex_lock(&pfvf->mbox.lock); +- /* Free the transmit schedulers */ ++ + free_req = otx2_mbox_alloc_msg_nix_txsch_free(&pfvf->mbox); + if (!free_req) { + mutex_unlock(&pfvf->mbox.lock); +- return -ENOMEM; ++ netdev_err(pfvf->netdev, ++ "Failed alloc txschq free req\n"); ++ return; + } + +- free_req->flags = TXSCHQ_FREE_ALL; ++ free_req->schq_lvl = lvl; ++ free_req->schq = schq; ++ + err = otx2_sync_mbox_msg(&pfvf->mbox); ++ if (err) { ++ netdev_err(pfvf->netdev, ++ "Failed stop txschq %d at level %d\n", schq, lvl); ++ } ++ + mutex_unlock(&pfvf->mbox.lock); ++} ++ ++void otx2_txschq_stop(struct otx2_nic *pfvf) ++{ ++ int lvl, schq; ++ ++ /* free non QOS TLx nodes */ ++ for (lvl = 0; lvl < NIX_TXSCH_LVL_CNT; lvl++) ++ otx2_txschq_free_one(pfvf, lvl, ++ pfvf->hw.txschq_list[lvl][0]); + + /* Clear the txschq list */ + for (lvl = 0; lvl < NIX_TXSCH_LVL_CNT; lvl++) { + for (schq = 0; schq < MAX_TXSCHQ_PER_FUNC; schq++) + pfvf->hw.txschq_list[lvl][schq] = 0; + } +- return err; ++ + } + + void otx2_sqb_flush(struct otx2_nic *pfvf) +@@ -1629,21 +1665,6 @@ void mbox_handler_cgx_fec_stats(struct otx2_nic *pfvf, + pfvf->hw.cgx_fec_uncorr_blks += rsp->fec_uncorr_blks; + } + +-void mbox_handler_nix_txsch_alloc(struct otx2_nic *pf, +- struct nix_txsch_alloc_rsp *rsp) +-{ +- int lvl, schq; +- +- /* Setup transmit scheduler list */ +- for (lvl = 0; lvl < NIX_TXSCH_LVL_CNT; lvl++) +- for (schq = 0; schq < rsp->schq[lvl]; schq++) +- pf->hw.txschq_list[lvl][schq] = +- rsp->schq_list[lvl][schq]; +- +- pf->hw.txschq_link_cfg_lvl = rsp->link_cfg_lvl; +-} +-EXPORT_SYMBOL(mbox_handler_nix_txsch_alloc); +- + void mbox_handler_npa_lf_alloc(struct otx2_nic *pfvf, + struct npa_lf_alloc_rsp *rsp) + { +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +index 241016ca64d05..8a9793b06769f 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +@@ -917,7 +917,8 @@ int otx2_config_nix(struct otx2_nic *pfvf); + int otx2_config_nix_queues(struct otx2_nic *pfvf); + int otx2_txschq_config(struct otx2_nic *pfvf, int lvl, int prio, bool pfc_en); + int otx2_txsch_alloc(struct otx2_nic *pfvf); +-int otx2_txschq_stop(struct otx2_nic *pfvf); ++void otx2_txschq_stop(struct otx2_nic *pfvf); ++void otx2_txschq_free_one(struct otx2_nic *pfvf, u16 lvl, u16 schq); + void otx2_sqb_flush(struct otx2_nic *pfvf); + int __otx2_alloc_rbuf(struct otx2_nic *pfvf, struct otx2_pool *pool, + dma_addr_t *dma); +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index c236dba80ff1a..17e546d0d7e55 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -791,10 +791,6 @@ static void otx2_process_pfaf_mbox_msg(struct otx2_nic *pf, + case MBOX_MSG_NIX_LF_ALLOC: + mbox_handler_nix_lf_alloc(pf, (struct nix_lf_alloc_rsp *)msg); + break; +- case MBOX_MSG_NIX_TXSCH_ALLOC: +- mbox_handler_nix_txsch_alloc(pf, +- (struct nix_txsch_alloc_rsp *)msg); +- break; + case MBOX_MSG_NIX_BP_ENABLE: + mbox_handler_nix_bp_enable(pf, (struct nix_bp_cfg_rsp *)msg); + break; +@@ -1517,8 +1513,7 @@ static int otx2_init_hw_resources(struct otx2_nic *pf) + otx2_free_cq_res(pf); + otx2_ctx_disable(mbox, NIX_AQ_CTYPE_RQ, false); + err_free_txsch: +- if (otx2_txschq_stop(pf)) +- dev_err(pf->dev, "%s failed to stop TX schedulers\n", __func__); ++ otx2_txschq_stop(pf); + err_free_sq_ptrs: + otx2_sq_free_sqbs(pf); + err_free_rq_ptrs: +@@ -1553,15 +1548,13 @@ static void otx2_free_hw_resources(struct otx2_nic *pf) + struct mbox *mbox = &pf->mbox; + struct otx2_cq_queue *cq; + struct msg_req *req; +- int qidx, err; ++ int qidx; + + /* Ensure all SQE are processed */ + otx2_sqb_flush(pf); + + /* Stop transmission */ +- err = otx2_txschq_stop(pf); +- if (err) +- dev_err(pf->dev, "RVUPF: Failed to stop/free TX schedulers\n"); ++ otx2_txschq_stop(pf); + + #ifdef CONFIG_DCB + if (pf->pfc_en) +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +index 53366dbfbf27c..f8f0c01f62a14 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +@@ -70,10 +70,6 @@ static void otx2vf_process_vfaf_mbox_msg(struct otx2_nic *vf, + case MBOX_MSG_NIX_LF_ALLOC: + mbox_handler_nix_lf_alloc(vf, (struct nix_lf_alloc_rsp *)msg); + break; +- case MBOX_MSG_NIX_TXSCH_ALLOC: +- mbox_handler_nix_txsch_alloc(vf, +- (struct nix_txsch_alloc_rsp *)msg); +- break; + case MBOX_MSG_NIX_BP_ENABLE: + mbox_handler_nix_bp_enable(vf, (struct nix_bp_cfg_rsp *)msg); + break; +-- +2.40.1 + diff --git a/queue-6.1/of-overlay-call-of_changeset_init-early.patch b/queue-6.1/of-overlay-call-of_changeset_init-early.patch new file mode 100644 index 00000000000..e8d62a3b6af --- /dev/null +++ b/queue-6.1/of-overlay-call-of_changeset_init-early.patch @@ -0,0 +1,56 @@ +From 35568270c1821b9a18b6672c6589d58fa77381da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jul 2023 10:50:28 +0200 +Subject: of: overlay: Call of_changeset_init() early + +From: Geert Uytterhoeven + +[ Upstream commit a9515ff4fb142b690a0d2b58782b15903b990dba ] + +When of_overlay_fdt_apply() fails, the changeset may be partially +applied, and the caller is still expected to call of_overlay_remove() to +clean up this partial state. + +However, of_overlay_apply() calls of_resolve_phandles() before +init_overlay_changeset(). Hence if the overlay fails to apply due to an +unresolved symbol, the overlay_changeset.cset.entries list is still +uninitialized, and cleanup will crash with a NULL-pointer dereference in +overlay_removal_is_ok(). + +Fix this by moving the call to of_changeset_init() from +init_overlay_changeset() to of_overlay_fdt_apply(), where all other +early initialization is done. + +Fixes: f948d6d8b792bb90 ("of: overlay: avoid race condition between applying multiple overlays") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/4f1d6d74b61cba2599026adb6d1948ae559ce91f.1690533838.git.geert+renesas@glider.be +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/overlay.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c +index 5289975bad708..4402871b5c0c0 100644 +--- a/drivers/of/overlay.c ++++ b/drivers/of/overlay.c +@@ -752,8 +752,6 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs) + if (!of_node_is_root(ovcs->overlay_root)) + pr_debug("%s() ovcs->overlay_root is not root\n", __func__); + +- of_changeset_init(&ovcs->cset); +- + cnt = 0; + + /* fragment nodes */ +@@ -1013,6 +1011,7 @@ int of_overlay_fdt_apply(const void *overlay_fdt, u32 overlay_fdt_size, + + INIT_LIST_HEAD(&ovcs->ovcs_list); + list_add_tail(&ovcs->ovcs_list, &ovcs_list); ++ of_changeset_init(&ovcs->cset); + + /* + * Must create permanent copy of FDT because of_fdt_unflatten_tree() +-- +2.40.1 + diff --git a/queue-6.1/of-unittest-fix-null-pointer-dereferencing-in-of_uni.patch b/queue-6.1/of-unittest-fix-null-pointer-dereferencing-in-of_uni.patch new file mode 100644 index 00000000000..a235a3ac17b --- /dev/null +++ b/queue-6.1/of-unittest-fix-null-pointer-dereferencing-in-of_uni.patch @@ -0,0 +1,74 @@ +From 099cf4360d64e044a892a6c52dfdd963ce8cd8b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 16:02:46 +0800 +Subject: of: unittest: fix null pointer dereferencing in + of_unittest_find_node_by_name() + +From: Ruan Jinjie + +[ Upstream commit d6ce4f0ea19c32f10867ed93d8386924326ab474 ] + +when kmalloc() fail to allocate memory in kasprintf(), name +or full_name will be NULL, strcmp() will cause +null pointer dereference. + +Fixes: 0d638a07d3a1 ("of: Convert to using %pOF instead of full_name") +Signed-off-by: Ruan Jinjie +Link: https://lore.kernel.org/r/20230727080246.519539-1-ruanjinjie@huawei.com +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/unittest.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 9be6ed47a1ce4..b815b8862e187 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -70,7 +70,7 @@ static void __init of_unittest_find_node_by_name(void) + + np = of_find_node_by_path("/testcase-data"); + name = kasprintf(GFP_KERNEL, "%pOF", np); +- unittest(np && !strcmp("/testcase-data", name), ++ unittest(np && name && !strcmp("/testcase-data", name), + "find /testcase-data failed\n"); + of_node_put(np); + kfree(name); +@@ -81,14 +81,14 @@ static void __init of_unittest_find_node_by_name(void) + + np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-a"); + name = kasprintf(GFP_KERNEL, "%pOF", np); +- unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name), ++ unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name), + "find /testcase-data/phandle-tests/consumer-a failed\n"); + of_node_put(np); + kfree(name); + + np = of_find_node_by_path("testcase-alias"); + name = kasprintf(GFP_KERNEL, "%pOF", np); +- unittest(np && !strcmp("/testcase-data", name), ++ unittest(np && name && !strcmp("/testcase-data", name), + "find testcase-alias failed\n"); + of_node_put(np); + kfree(name); +@@ -99,7 +99,7 @@ static void __init of_unittest_find_node_by_name(void) + + np = of_find_node_by_path("testcase-alias/phandle-tests/consumer-a"); + name = kasprintf(GFP_KERNEL, "%pOF", np); +- unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name), ++ unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name), + "find testcase-alias/phandle-tests/consumer-a failed\n"); + of_node_put(np); + kfree(name); +@@ -1379,6 +1379,8 @@ static void attach_node_and_children(struct device_node *np) + const char *full_name; + + full_name = kasprintf(GFP_KERNEL, "%pOF", np); ++ if (!full_name) ++ return; + + if (!strcmp(full_name, "/__local_fixups__") || + !strcmp(full_name, "/__fixups__")) { +-- +2.40.1 + diff --git a/queue-6.1/of-unittest-fix-overlay-type-in-apply-revert-check.patch b/queue-6.1/of-unittest-fix-overlay-type-in-apply-revert-check.patch new file mode 100644 index 00000000000..165e45965a6 --- /dev/null +++ b/queue-6.1/of-unittest-fix-overlay-type-in-apply-revert-check.patch @@ -0,0 +1,42 @@ +From ad5cbc6f00c21b6cff92b0a0224a21c7910e4575 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jul 2023 10:50:29 +0200 +Subject: of: unittest: Fix overlay type in apply/revert check + +From: Geert Uytterhoeven + +[ Upstream commit 6becf8f845ae1f0b1cfed395bbeccbd23654162d ] + +The removal check in of_unittest_apply_revert_overlay_check() +always uses the platform device overlay type, while it should use the +actual overlay type, as passed as a parameter to the function. + +This has no impact on any current test, as all tests calling +of_unittest_apply_revert_overlay_check() use the platform device overlay +type. + +Fixes: d5e75500ca401d31 ("of: unitest: Add I2C overlay unit tests.") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/ba0234c41ba808f10112094f88792beeb6dbaedf.1690533838.git.geert+renesas@glider.be +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/unittest.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index b815b8862e187..edd2342598e49 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -2062,7 +2062,7 @@ static int __init of_unittest_apply_revert_overlay_check(int overlay_nr, + of_unittest_untrack_overlay(save_ovcs_id); + + /* unittest device must be again in before state */ +- if (of_unittest_device_exists(unittest_nr, PDEV_OVERLAY) != before) { ++ if (of_unittest_device_exists(unittest_nr, ovtype) != before) { + unittest(0, "%s with device @\"%s\" %s\n", + overlay_name_from_nr(overlay_nr), + unittest_path(unittest_nr, ovtype), +-- +2.40.1 + diff --git a/queue-6.1/opp-fix-passing-0-to-ptr_err-in-_opp_attach_genpd.patch b/queue-6.1/opp-fix-passing-0-to-ptr_err-in-_opp_attach_genpd.patch new file mode 100644 index 00000000000..4cdb777b0d7 --- /dev/null +++ b/queue-6.1/opp-fix-passing-0-to-ptr_err-in-_opp_attach_genpd.patch @@ -0,0 +1,41 @@ +From e47ddfeceb969a0f5c828f6d9da476e7bf98c0f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 18:16:34 +0530 +Subject: OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd() + +From: Manivannan Sadhasivam + +[ Upstream commit d920920f85a82c1c806a4143871a0e8f534732f2 ] + +If dev_pm_domain_attach_by_name() returns NULL, then 0 will be passed to +PTR_ERR() as reported by the smatch warning below: + +drivers/opp/core.c:2456 _opp_attach_genpd() warn: passing zero to 'PTR_ERR' + +Fix it by checking for the non-NULL virt_dev pointer before passing it to +PTR_ERR. Otherwise return -ENODEV. + +Fixes: 4ea9496cbc95 ("opp: Fix error check in dev_pm_opp_attach_genpd()") +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index d707214069ca9..f0d70ecc0271b 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -2372,7 +2372,7 @@ static int _opp_attach_genpd(struct opp_table *opp_table, struct device *dev, + + virt_dev = dev_pm_domain_attach_by_name(dev, *name); + if (IS_ERR_OR_NULL(virt_dev)) { +- ret = PTR_ERR(virt_dev) ? : -ENODEV; ++ ret = virt_dev ? PTR_ERR(virt_dev) : -ENODEV; + dev_err(dev, "Couldn't attach to pm_domain: %d\n", ret); + goto err; + } +-- +2.40.1 + diff --git a/queue-6.1/pci-add-locking-to-rmw-pci-express-capability-regist.patch b/queue-6.1/pci-add-locking-to-rmw-pci-express-capability-regist.patch new file mode 100644 index 00000000000..0ba00e24f00 --- /dev/null +++ b/queue-6.1/pci-add-locking-to-rmw-pci-express-capability-regist.patch @@ -0,0 +1,171 @@ +From 43c43ca3463aa4979b7c13f4956b83b905e6a575 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:04:53 +0300 +Subject: PCI: Add locking to RMW PCI Express Capability Register accessors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 5e70d0acf0825f439079736080350371f8d6699a ] + +Many places in the kernel write the Link Control and Root Control PCI +Express Capability Registers without proper concurrency control and this +could result in losing the changes one of the writers intended to make. + +Add pcie_cap_lock spinlock into the struct pci_dev and use it to protect +bit changes made in the RMW capability accessors. Protect only a selected +set of registers by differentiating the RMW accessor internally to +locked/unlocked variants using a wrapper which has the same signature as +pcie_capability_clear_and_set_word(). As the Capability Register (pos) +given to the wrapper is always a constant, the compiler should be able to +simplify all the dead-code away. + +So far only the Link Control Register (ASPM, hotplug, link retraining, +various drivers) and the Root Control Register (AER & PME) seem to +require RMW locking. + +Suggested-by: Lukas Wunner +Fixes: c7f486567c1d ("PCI PM: PCIe PME root port service driver") +Fixes: f12eb72a268b ("PCI/ASPM: Use PCI Express Capability accessors") +Fixes: 7d715a6c1ae5 ("PCI: add PCI Express ASPM support") +Fixes: affa48de8417 ("staging/rdma/hfi1: Add support for enabling/disabling PCIe ASPM") +Fixes: 849a9366cba9 ("misc: rtsx: Add support new chip rts5228 mmc: rtsx: Add support MMC_CAP2_NO_MMC") +Fixes: 3d1e7aa80d1c ("misc: rtsx: Use pcie_capability_clear_and_set_word() for PCI_EXP_LNKCTL") +Fixes: c0e5f4e73a71 ("misc: rtsx: Add support for RTS5261") +Fixes: 3df4fce739e2 ("misc: rtsx: separate aspm mode into MODE_REG and MODE_CFG") +Fixes: 121e9c6b5c4c ("misc: rtsx: modify and fix init_hw function") +Fixes: 19f3bd548f27 ("mfd: rtsx: Remove LCTLR defination") +Fixes: 773ccdfd9cc6 ("mfd: rtsx: Read vendor setting from config space") +Fixes: 8275b77a1513 ("mfd: rts5249: Add support for RTS5250S power saving") +Fixes: 5da4e04ae480 ("misc: rtsx: Add support for RTS5260") +Fixes: 0f49bfbd0f2e ("tg3: Use PCI Express Capability accessors") +Fixes: 5e7dfd0fb94a ("tg3: Prevent corruption at 10 / 100Mbps w CLKREQ") +Fixes: b726e493e8dc ("r8169: sync existing 8168 device hardware start sequences with vendor driver") +Fixes: e6de30d63eb1 ("r8169: more 8168dp support.") +Fixes: 8a06127602de ("Bluetooth: hci_bcm4377: Add new driver for BCM4377 PCIe boards") +Fixes: 6f461f6c7c96 ("e1000e: enable/disable ASPM L0s and L1 and ERT according to hardware errata") +Fixes: 1eae4eb2a1c7 ("e1000e: Disable L1 ASPM power savings for 82573 mobile variants") +Fixes: 8060e169e02f ("ath9k: Enable extended synch for AR9485 to fix L0s recovery issue") +Fixes: 69ce674bfa69 ("ath9k: do btcoex ASPM disabling at initialization time") +Fixes: f37f05503575 ("mt76: mt76x2e: disable pcie_aspm by default") +Link: https://lore.kernel.org/r/20230717120503.15276-2-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Reviewed-by: "Rafael J. Wysocki" +Signed-off-by: Sasha Levin +--- + drivers/pci/access.c | 20 +++++++++++++++++--- + drivers/pci/probe.c | 1 + + include/linux/pci.h | 34 ++++++++++++++++++++++++++++++++-- + 3 files changed, 50 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/access.c b/drivers/pci/access.c +index 708c7529647fd..3d20f9c51efe7 100644 +--- a/drivers/pci/access.c ++++ b/drivers/pci/access.c +@@ -491,8 +491,8 @@ int pcie_capability_write_dword(struct pci_dev *dev, int pos, u32 val) + } + EXPORT_SYMBOL(pcie_capability_write_dword); + +-int pcie_capability_clear_and_set_word(struct pci_dev *dev, int pos, +- u16 clear, u16 set) ++int pcie_capability_clear_and_set_word_unlocked(struct pci_dev *dev, int pos, ++ u16 clear, u16 set) + { + int ret; + u16 val; +@@ -506,7 +506,21 @@ int pcie_capability_clear_and_set_word(struct pci_dev *dev, int pos, + + return ret; + } +-EXPORT_SYMBOL(pcie_capability_clear_and_set_word); ++EXPORT_SYMBOL(pcie_capability_clear_and_set_word_unlocked); ++ ++int pcie_capability_clear_and_set_word_locked(struct pci_dev *dev, int pos, ++ u16 clear, u16 set) ++{ ++ unsigned long flags; ++ int ret; ++ ++ spin_lock_irqsave(&dev->pcie_cap_lock, flags); ++ ret = pcie_capability_clear_and_set_word_unlocked(dev, pos, clear, set); ++ spin_unlock_irqrestore(&dev->pcie_cap_lock, flags); ++ ++ return ret; ++} ++EXPORT_SYMBOL(pcie_capability_clear_and_set_word_locked); + + int pcie_capability_clear_and_set_dword(struct pci_dev *dev, int pos, + u32 clear, u32 set) +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index e3a1dc6432bcd..843e4a58788e3 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -2312,6 +2312,7 @@ struct pci_dev *pci_alloc_dev(struct pci_bus *bus) + .end = -1, + }; + ++ spin_lock_init(&dev->pcie_cap_lock); + #ifdef CONFIG_PCI_MSI + raw_spin_lock_init(&dev->msi_lock); + #endif +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 4ea8de6890bea..eccaf1abea79d 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -466,6 +466,7 @@ struct pci_dev { + pci_dev_flags_t dev_flags; + atomic_t enable_cnt; /* pci_enable_device has been called */ + ++ spinlock_t pcie_cap_lock; /* Protects RMW ops in capability accessors */ + u32 saved_config_space[16]; /* Config space saved at suspend time */ + struct hlist_head saved_cap_space; + int rom_attr_enabled; /* Display of ROM attribute enabled? */ +@@ -1209,11 +1210,40 @@ int pcie_capability_read_word(struct pci_dev *dev, int pos, u16 *val); + int pcie_capability_read_dword(struct pci_dev *dev, int pos, u32 *val); + int pcie_capability_write_word(struct pci_dev *dev, int pos, u16 val); + int pcie_capability_write_dword(struct pci_dev *dev, int pos, u32 val); +-int pcie_capability_clear_and_set_word(struct pci_dev *dev, int pos, +- u16 clear, u16 set); ++int pcie_capability_clear_and_set_word_unlocked(struct pci_dev *dev, int pos, ++ u16 clear, u16 set); ++int pcie_capability_clear_and_set_word_locked(struct pci_dev *dev, int pos, ++ u16 clear, u16 set); + int pcie_capability_clear_and_set_dword(struct pci_dev *dev, int pos, + u32 clear, u32 set); + ++/** ++ * pcie_capability_clear_and_set_word - RMW accessor for PCI Express Capability Registers ++ * @dev: PCI device structure of the PCI Express device ++ * @pos: PCI Express Capability Register ++ * @clear: Clear bitmask ++ * @set: Set bitmask ++ * ++ * Perform a Read-Modify-Write (RMW) operation using @clear and @set ++ * bitmasks on PCI Express Capability Register at @pos. Certain PCI Express ++ * Capability Registers are accessed concurrently in RMW fashion, hence ++ * require locking which is handled transparently to the caller. ++ */ ++static inline int pcie_capability_clear_and_set_word(struct pci_dev *dev, ++ int pos, ++ u16 clear, u16 set) ++{ ++ switch (pos) { ++ case PCI_EXP_LNKCTL: ++ case PCI_EXP_RTCTL: ++ return pcie_capability_clear_and_set_word_locked(dev, pos, ++ clear, set); ++ default: ++ return pcie_capability_clear_and_set_word_unlocked(dev, pos, ++ clear, set); ++ } ++} ++ + static inline int pcie_capability_set_word(struct pci_dev *dev, int pos, + u16 set) + { +-- +2.40.1 + diff --git a/queue-6.1/pci-allow-drivers-to-request-exclusive-config-region.patch b/queue-6.1/pci-allow-drivers-to-request-exclusive-config-region.patch new file mode 100644 index 00000000000..392cee0c7a4 --- /dev/null +++ b/queue-6.1/pci-allow-drivers-to-request-exclusive-config-region.patch @@ -0,0 +1,189 @@ +From 62017548c3a2d02ebac34d7fa63cbf2b39d5a36b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Sep 2022 14:57:10 -0700 +Subject: PCI: Allow drivers to request exclusive config regions + +From: Ira Weiny + +[ Upstream commit 278294798ac9118412c9624a801d3f20f2279363 ] + +PCI config space access from user space has traditionally been +unrestricted with writes being an understood risk for device operation. + +Unfortunately, device breakage or odd behavior from config writes lacks +indicators that can leave driver writers confused when evaluating +failures. This is especially true with the new PCIe Data Object +Exchange (DOE) mailbox protocol where backdoor shenanigans from user +space through things such as vendor defined protocols may affect device +operation without complete breakage. + +A prior proposal restricted read and writes completely.[1] Greg and +Bjorn pointed out that proposal is flawed for a couple of reasons. +First, lspci should always be allowed and should not interfere with any +device operation. Second, setpci is a valuable tool that is sometimes +necessary and it should not be completely restricted.[2] Finally +methods exist for full lock of device access if required. + +Even though access should not be restricted it would be nice for driver +writers to be able to flag critical parts of the config space such that +interference from user space can be detected. + +Introduce pci_request_config_region_exclusive() to mark exclusive config +regions. Such regions trigger a warning and kernel taint if accessed +via user space. + +Create pci_warn_once() to restrict the user from spamming the log. + +[1] https://lore.kernel.org/all/161663543465.1867664.5674061943008380442.stgit@dwillia2-desk3.amr.corp.intel.com/ +[2] https://lore.kernel.org/all/YF8NGeGv9vYcMfTV@kroah.com/ + +Cc: Bjorn Helgaas +Cc: Greg Kroah-Hartman +Reviewed-by: Jonathan Cameron +Suggested-by: Dan Williams +Signed-off-by: Ira Weiny +Acked-by: Greg Kroah-Hartman +Acked-by: Bjorn Helgaas +Link: https://lore.kernel.org/r/20220926215711.2893286-2-ira.weiny@intel.com +Signed-off-by: Dan Williams +Stable-dep-of: 5e70d0acf082 ("PCI: Add locking to RMW PCI Express Capability Register accessors") +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-sysfs.c | 7 +++++++ + drivers/pci/probe.c | 6 ++++++ + include/linux/ioport.h | 2 ++ + include/linux/pci.h | 17 +++++++++++++++++ + kernel/resource.c | 13 ++++++++----- + 5 files changed, 40 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c +index ba38fc47d35e9..dd0d9d9bc5097 100644 +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -756,6 +756,13 @@ static ssize_t pci_write_config(struct file *filp, struct kobject *kobj, + if (ret) + return ret; + ++ if (resource_is_exclusive(&dev->driver_exclusive_resource, off, ++ count)) { ++ pci_warn_once(dev, "%s: Unexpected write to kernel-exclusive config offset %llx", ++ current->comm, off); ++ add_taint(TAINT_USER, LOCKDEP_STILL_OK); ++ } ++ + if (off > dev->cfg_size) + return 0; + if (off + count > dev->cfg_size) { +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 7170516298b0b..e3a1dc6432bcd 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -2306,6 +2306,12 @@ struct pci_dev *pci_alloc_dev(struct pci_bus *bus) + INIT_LIST_HEAD(&dev->bus_list); + dev->dev.type = &pci_dev_type; + dev->bus = pci_bus_get(bus); ++ dev->driver_exclusive_resource = (struct resource) { ++ .name = "PCI Exclusive", ++ .start = 0, ++ .end = -1, ++ }; ++ + #ifdef CONFIG_PCI_MSI + raw_spin_lock_init(&dev->msi_lock); + #endif +diff --git a/include/linux/ioport.h b/include/linux/ioport.h +index 27642ca15d932..4ae3c541ea6f4 100644 +--- a/include/linux/ioport.h ++++ b/include/linux/ioport.h +@@ -318,6 +318,8 @@ extern void __devm_release_region(struct device *dev, struct resource *parent, + resource_size_t start, resource_size_t n); + extern int iomem_map_sanity_check(resource_size_t addr, unsigned long size); + extern bool iomem_is_exclusive(u64 addr); ++extern bool resource_is_exclusive(struct resource *resource, u64 addr, ++ resource_size_t size); + + extern int + walk_system_ram_range(unsigned long start_pfn, unsigned long nr_pages, +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 9f617ffdb863f..4ea8de6890bea 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -409,6 +409,7 @@ struct pci_dev { + */ + unsigned int irq; + struct resource resource[DEVICE_COUNT_RESOURCE]; /* I/O and memory regions + expansion ROMs */ ++ struct resource driver_exclusive_resource; /* driver exclusive resource ranges */ + + bool match_driver; /* Skip attaching driver */ + +@@ -1408,6 +1409,21 @@ int pci_request_selected_regions(struct pci_dev *, int, const char *); + int pci_request_selected_regions_exclusive(struct pci_dev *, int, const char *); + void pci_release_selected_regions(struct pci_dev *, int); + ++static inline __must_check struct resource * ++pci_request_config_region_exclusive(struct pci_dev *pdev, unsigned int offset, ++ unsigned int len, const char *name) ++{ ++ return __request_region(&pdev->driver_exclusive_resource, offset, len, ++ name, IORESOURCE_EXCLUSIVE); ++} ++ ++static inline void pci_release_config_region(struct pci_dev *pdev, ++ unsigned int offset, ++ unsigned int len) ++{ ++ __release_region(&pdev->driver_exclusive_resource, offset, len); ++} ++ + /* drivers/pci/bus.c */ + void pci_add_resource(struct list_head *resources, struct resource *res); + void pci_add_resource_offset(struct list_head *resources, struct resource *res, +@@ -2487,6 +2503,7 @@ void pci_uevent_ers(struct pci_dev *pdev, enum pci_ers_result err_type); + #define pci_crit(pdev, fmt, arg...) dev_crit(&(pdev)->dev, fmt, ##arg) + #define pci_err(pdev, fmt, arg...) dev_err(&(pdev)->dev, fmt, ##arg) + #define pci_warn(pdev, fmt, arg...) dev_warn(&(pdev)->dev, fmt, ##arg) ++#define pci_warn_once(pdev, fmt, arg...) dev_warn_once(&(pdev)->dev, fmt, ##arg) + #define pci_notice(pdev, fmt, arg...) dev_notice(&(pdev)->dev, fmt, ##arg) + #define pci_info(pdev, fmt, arg...) dev_info(&(pdev)->dev, fmt, ##arg) + #define pci_dbg(pdev, fmt, arg...) dev_dbg(&(pdev)->dev, fmt, ##arg) +diff --git a/kernel/resource.c b/kernel/resource.c +index 1aeeededdd4c8..8f52f88009652 100644 +--- a/kernel/resource.c ++++ b/kernel/resource.c +@@ -1693,18 +1693,15 @@ static int strict_iomem_checks; + * + * Returns true if exclusive to the kernel, otherwise returns false. + */ +-bool iomem_is_exclusive(u64 addr) ++bool resource_is_exclusive(struct resource *root, u64 addr, resource_size_t size) + { + const unsigned int exclusive_system_ram = IORESOURCE_SYSTEM_RAM | + IORESOURCE_EXCLUSIVE; + bool skip_children = false, err = false; +- int size = PAGE_SIZE; + struct resource *p; + +- addr = addr & PAGE_MASK; +- + read_lock(&resource_lock); +- for_each_resource(&iomem_resource, p, skip_children) { ++ for_each_resource(root, p, skip_children) { + if (p->start >= addr + size) + break; + if (p->end < addr) { +@@ -1743,6 +1740,12 @@ bool iomem_is_exclusive(u64 addr) + return err; + } + ++bool iomem_is_exclusive(u64 addr) ++{ ++ return resource_is_exclusive(&iomem_resource, addr & PAGE_MASK, ++ PAGE_SIZE); ++} ++ + struct resource_entry *resource_list_create_entry(struct resource *res, + size_t extra_size) + { +-- +2.40.1 + diff --git a/queue-6.1/pci-apple-initialize-pcie-nvecs-before-use.patch b/queue-6.1/pci-apple-initialize-pcie-nvecs-before-use.patch new file mode 100644 index 00000000000..92da1a17c02 --- /dev/null +++ b/queue-6.1/pci-apple-initialize-pcie-nvecs-before-use.patch @@ -0,0 +1,64 @@ +From 64e989879b1b5f62186b349b4ebd08673856eabe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Mar 2023 14:34:53 +0100 +Subject: PCI: apple: Initialize pcie->nvecs before use +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sven Peter + +[ Upstream commit d8650c0c2aa2e413594e4cb0faafa9958c1d7782 ] + +The apple_pcie_setup_port() function computes ilog2(pcie->nvecs) to set +up the number of MSIs available for each port. However, it's called +before apple_msi_init(), which initializes pcie->nvecs. + +Luckily, pcie->nvecs is part of kzalloc()-ed structure and, as such, +initialized as zero. ilog2(0) happens to be 0xffffffff which then simply +configures more MSIs in hardware than we have. This doesn't break +anything because we never hand out those vectors. + +Thus, swap the order of the two calls so that the correctly initialized +value is then used. + +[kwilczynski: commit log] +Link: https://lore.kernel.org/linux-pci/20230311133453.63246-1-sven@svenpeter.dev +Fixes: 476c41ed4597 ("PCI: apple: Implement MSI support") +Signed-off-by: Sven Peter +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Marc Zyngier +Reviewed-by: Alyssa Rosenzweig +Reviewed-by: Eric Curtin +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-apple.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pcie-apple.c b/drivers/pci/controller/pcie-apple.c +index 66f37e403a09c..2340dab6cd5bd 100644 +--- a/drivers/pci/controller/pcie-apple.c ++++ b/drivers/pci/controller/pcie-apple.c +@@ -783,6 +783,10 @@ static int apple_pcie_init(struct pci_config_window *cfg) + cfg->priv = pcie; + INIT_LIST_HEAD(&pcie->ports); + ++ ret = apple_msi_init(pcie); ++ if (ret) ++ return ret; ++ + for_each_child_of_node(dev->of_node, of_port) { + ret = apple_pcie_setup_port(pcie, of_port); + if (ret) { +@@ -792,7 +796,7 @@ static int apple_pcie_init(struct pci_config_window *cfg) + } + } + +- return apple_msi_init(pcie); ++ return 0; + } + + static int apple_pcie_probe(struct platform_device *pdev) +-- +2.40.1 + diff --git a/queue-6.1/pci-aspm-use-rmw-accessors-for-changing-lnkctl.patch b/queue-6.1/pci-aspm-use-rmw-accessors-for-changing-lnkctl.patch new file mode 100644 index 00000000000..a691745b89c --- /dev/null +++ b/queue-6.1/pci-aspm-use-rmw-accessors-for-changing-lnkctl.patch @@ -0,0 +1,105 @@ +From 878e21a14d9c62889221c6d6903c223b1988ea15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:04:56 +0300 +Subject: PCI/ASPM: Use RMW accessors for changing LNKCTL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit e09060b3b6b4661278ff8e1b7b81a37d5ea86eae ] + +Don't assume that the device is fully under the control of ASPM and use RMW +capability accessors which do proper locking to avoid losing concurrent +updates to the register values. + +If configuration fails in pcie_aspm_configure_common_clock(), the +function attempts to restore the old PCI_EXP_LNKCTL_CCC settings. Store +only the old PCI_EXP_LNKCTL_CCC bit for the relevant devices rather +than the content of the whole LNKCTL registers. It aligns better with +how pcie_lnkctl_clear_and_set() expects its parameter and makes the +code more obvious to understand. + +Suggested-by: Lukas Wunner +Fixes: 2a42d9dba784 ("PCIe: ASPM: Break out of endless loop waiting for PCI config bits to switch") +Fixes: 7d715a6c1ae5 ("PCI: add PCI Express ASPM support") +Link: https://lore.kernel.org/r/20230717120503.15276-5-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Acked-by: "Rafael J. Wysocki" +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/aspm.c | 30 +++++++++++++----------------- + 1 file changed, 13 insertions(+), 17 deletions(-) + +diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c +index 07166a4ec27ad..7e89cdbd446fc 100644 +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -250,7 +250,7 @@ static int pcie_retrain_link(struct pcie_link_state *link) + static void pcie_aspm_configure_common_clock(struct pcie_link_state *link) + { + int same_clock = 1; +- u16 reg16, parent_reg, child_reg[8]; ++ u16 reg16, ccc, parent_old_ccc, child_old_ccc[8]; + struct pci_dev *child, *parent = link->pdev; + struct pci_bus *linkbus = parent->subordinate; + /* +@@ -272,6 +272,7 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link) + + /* Port might be already in common clock mode */ + pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16); ++ parent_old_ccc = reg16 & PCI_EXP_LNKCTL_CCC; + if (same_clock && (reg16 & PCI_EXP_LNKCTL_CCC)) { + bool consistent = true; + +@@ -288,34 +289,29 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link) + pci_info(parent, "ASPM: current common clock configuration is inconsistent, reconfiguring\n"); + } + ++ ccc = same_clock ? PCI_EXP_LNKCTL_CCC : 0; + /* Configure downstream component, all functions */ + list_for_each_entry(child, &linkbus->devices, bus_list) { + pcie_capability_read_word(child, PCI_EXP_LNKCTL, ®16); +- child_reg[PCI_FUNC(child->devfn)] = reg16; +- if (same_clock) +- reg16 |= PCI_EXP_LNKCTL_CCC; +- else +- reg16 &= ~PCI_EXP_LNKCTL_CCC; +- pcie_capability_write_word(child, PCI_EXP_LNKCTL, reg16); ++ child_old_ccc[PCI_FUNC(child->devfn)] = reg16 & PCI_EXP_LNKCTL_CCC; ++ pcie_capability_clear_and_set_word(child, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_CCC, ccc); + } + + /* Configure upstream component */ +- pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16); +- parent_reg = reg16; +- if (same_clock) +- reg16 |= PCI_EXP_LNKCTL_CCC; +- else +- reg16 &= ~PCI_EXP_LNKCTL_CCC; +- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16); ++ pcie_capability_clear_and_set_word(parent, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_CCC, ccc); + + if (pcie_retrain_link(link)) { + + /* Training failed. Restore common clock configurations */ + pci_err(parent, "ASPM: Could not configure common clock\n"); + list_for_each_entry(child, &linkbus->devices, bus_list) +- pcie_capability_write_word(child, PCI_EXP_LNKCTL, +- child_reg[PCI_FUNC(child->devfn)]); +- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, parent_reg); ++ pcie_capability_clear_and_set_word(child, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_CCC, ++ child_old_ccc[PCI_FUNC(child->devfn)]); ++ pcie_capability_clear_and_set_word(parent, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_CCC, parent_old_ccc); + } + } + +-- +2.40.1 + diff --git a/queue-6.1/pci-doe-fix-destroy_work_on_stack-race.patch b/queue-6.1/pci-doe-fix-destroy_work_on_stack-race.patch new file mode 100644 index 00000000000..63dd3c2745c --- /dev/null +++ b/queue-6.1/pci-doe-fix-destroy_work_on_stack-race.patch @@ -0,0 +1,61 @@ +From 2fd280eee439411c8fc9a5921dcf199b5a58e723 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 11:29:42 -0700 +Subject: PCI/DOE: Fix destroy_work_on_stack() race + +From: Ira Weiny + +[ Upstream commit e3a3a097eaebaf234a482b4d2f9f18fe989208c1 ] + +The following debug object splat was observed in testing: + + ODEBUG: free active (active state 0) object: 0000000097d23782 object type: work_struct hint: doe_statemachine_work+0x0/0x510 + WARNING: CPU: 1 PID: 71 at lib/debugobjects.c:514 debug_print_object+0x7d/0xb0 + ... + Workqueue: pci 0000:36:00.0 DOE [1 doe_statemachine_work + RIP: 0010:debug_print_object+0x7d/0xb0 + ... + Call Trace: + ? debug_print_object+0x7d/0xb0 + ? __pfx_doe_statemachine_work+0x10/0x10 + debug_object_free.part.0+0x11b/0x150 + doe_statemachine_work+0x45e/0x510 + process_one_work+0x1d4/0x3c0 + +This occurs because destroy_work_on_stack() was called after signaling +the completion in the calling thread. This creates a race between +destroy_work_on_stack() and the task->work struct going out of scope in +pci_doe(). + +Signal the work complete after destroying the work struct. This is safe +because signal_task_complete() is the final thing the work item does and +the workqueue code is careful not to access the work struct after. + +Fixes: abf04be0e707 ("PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=y") +Link: https://lore.kernel.org/r/20230726-doe-fix-v1-1-af07e614d4dd@intel.com +Signed-off-by: Ira Weiny +Signed-off-by: Bjorn Helgaas +Reviewed-by: Lukas Wunner +Acked-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/pci/doe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/doe.c b/drivers/pci/doe.c +index e5e9b287b9766..c1776f82b7fce 100644 +--- a/drivers/pci/doe.c ++++ b/drivers/pci/doe.c +@@ -223,8 +223,8 @@ static int pci_doe_recv_resp(struct pci_doe_mb *doe_mb, struct pci_doe_task *tas + static void signal_task_complete(struct pci_doe_task *task, int rv) + { + task->rv = rv; +- task->complete(task); + destroy_work_on_stack(&task->work); ++ task->complete(task); + } + + static void signal_task_abort(struct pci_doe_task *task, int rv) +-- +2.40.1 + diff --git a/queue-6.1/pci-mark-nvidia-t4-gpus-to-avoid-bus-reset.patch b/queue-6.1/pci-mark-nvidia-t4-gpus-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..65f33a700f1 --- /dev/null +++ b/queue-6.1/pci-mark-nvidia-t4-gpus-to-avoid-bus-reset.patch @@ -0,0 +1,38 @@ +From 0454867f6d4986495e3493a24ff05a0af242247e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 20:34:11 +0800 +Subject: PCI: Mark NVIDIA T4 GPUs to avoid bus reset + +From: Wu Zongyong + +[ Upstream commit d5af729dc2071273f14cbb94abbc60608142fd83 ] + +NVIDIA T4 GPUs do not work with SBR. This problem is found when the T4 card +is direct attached to a Root Port only. Avoid bus reset by marking T4 GPUs +PCI_DEV_FLAGS_NO_BUS_RESET. + +Fixes: 4c207e7121fa ("PCI: Mark some NVIDIA GPUs to avoid bus reset") +Link: https://lore.kernel.org/r/2dcebea53a6eb9bd212ec6d8974af2e5e0333ef6.1681129861.git.wuzongyong@linux.alibaba.com +Signed-off-by: Wu Zongyong +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 472fa2c8ebcec..d6fe44a5270d5 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3631,7 +3631,7 @@ static void quirk_no_bus_reset(struct pci_dev *dev) + */ + static void quirk_nvidia_no_bus_reset(struct pci_dev *dev) + { +- if ((dev->device & 0xffc0) == 0x2340) ++ if ((dev->device & 0xffc0) == 0x2340 || dev->device == 0x1eb8) + quirk_no_bus_reset(dev); + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, +-- +2.40.1 + diff --git a/queue-6.1/pci-microchip-correct-the-ded-and-sec-interrupt-bit-.patch b/queue-6.1/pci-microchip-correct-the-ded-and-sec-interrupt-bit-.patch new file mode 100644 index 00000000000..606ed01b9d1 --- /dev/null +++ b/queue-6.1/pci-microchip-correct-the-ded-and-sec-interrupt-bit-.patch @@ -0,0 +1,48 @@ +From 834d842733c5b8bfa96a63f3ed5024d09bb7d3ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jul 2023 14:13:55 +0100 +Subject: PCI: microchip: Correct the DED and SEC interrupt bit offsets + +From: Daire McNamara + +[ Upstream commit 6d473a5a26136edf55c435a1c433e52910e03926 ] + +The SEC and DED interrupt bits are laid out the wrong way round so the SEC +interrupt handler attempts to mask, unmask, and clear the DED interrupt +and vice versa. Correct the bit offsets so that each interrupt handler +operates properly. + +Link: https://lore.kernel.org/r/20230728131401.1615724-2-daire.mcnamara@microchip.com +Fixes: 6f15a9c9f941 ("PCI: microchip: Add Microchip PolarFire PCIe controller driver") +Signed-off-by: Daire McNamara +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-microchip-host.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/pci/controller/pcie-microchip-host.c b/drivers/pci/controller/pcie-microchip-host.c +index 7263d175b5adb..5ba101efd9326 100644 +--- a/drivers/pci/controller/pcie-microchip-host.c ++++ b/drivers/pci/controller/pcie-microchip-host.c +@@ -167,12 +167,12 @@ + #define EVENT_PCIE_DLUP_EXIT 2 + #define EVENT_SEC_TX_RAM_SEC_ERR 3 + #define EVENT_SEC_RX_RAM_SEC_ERR 4 +-#define EVENT_SEC_AXI2PCIE_RAM_SEC_ERR 5 +-#define EVENT_SEC_PCIE2AXI_RAM_SEC_ERR 6 ++#define EVENT_SEC_PCIE2AXI_RAM_SEC_ERR 5 ++#define EVENT_SEC_AXI2PCIE_RAM_SEC_ERR 6 + #define EVENT_DED_TX_RAM_DED_ERR 7 + #define EVENT_DED_RX_RAM_DED_ERR 8 +-#define EVENT_DED_AXI2PCIE_RAM_DED_ERR 9 +-#define EVENT_DED_PCIE2AXI_RAM_DED_ERR 10 ++#define EVENT_DED_PCIE2AXI_RAM_DED_ERR 9 ++#define EVENT_DED_AXI2PCIE_RAM_DED_ERR 10 + #define EVENT_LOCAL_DMA_END_ENGINE_0 11 + #define EVENT_LOCAL_DMA_END_ENGINE_1 12 + #define EVENT_LOCAL_DMA_ERROR_ENGINE_0 13 +-- +2.40.1 + diff --git a/queue-6.1/pci-pciehp-use-rmw-accessors-for-changing-lnkctl.patch b/queue-6.1/pci-pciehp-use-rmw-accessors-for-changing-lnkctl.patch new file mode 100644 index 00000000000..a14a2cd9959 --- /dev/null +++ b/queue-6.1/pci-pciehp-use-rmw-accessors-for-changing-lnkctl.patch @@ -0,0 +1,54 @@ +From 7710d404ad0d6040acd676978075b10ae3d25e67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:04:55 +0300 +Subject: PCI: pciehp: Use RMW accessors for changing LNKCTL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 5f75f96c61039151c193775d776fde42477eace1 ] + +As hotplug is not the only driver touching LNKCTL, use the RMW capability +accessor which handles concurrent changes correctly. + +Suggested-by: Lukas Wunner +Fixes: 7f822999e12a ("PCI: pciehp: Add Disable/enable link functions") +Link: https://lore.kernel.org/r/20230717120503.15276-4-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Acked-by: "Rafael J. Wysocki" +Signed-off-by: Sasha Levin +--- + drivers/pci/hotplug/pciehp_hpc.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c +index 112c8f401ac4e..358f077284cbe 100644 +--- a/drivers/pci/hotplug/pciehp_hpc.c ++++ b/drivers/pci/hotplug/pciehp_hpc.c +@@ -332,17 +332,11 @@ int pciehp_check_link_status(struct controller *ctrl) + static int __pciehp_link_set(struct controller *ctrl, bool enable) + { + struct pci_dev *pdev = ctrl_dev(ctrl); +- u16 lnk_ctrl; + +- pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &lnk_ctrl); ++ pcie_capability_clear_and_set_word(pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_LD, ++ enable ? 0 : PCI_EXP_LNKCTL_LD); + +- if (enable) +- lnk_ctrl &= ~PCI_EXP_LNKCTL_LD; +- else +- lnk_ctrl |= PCI_EXP_LNKCTL_LD; +- +- pcie_capability_write_word(pdev, PCI_EXP_LNKCTL, lnk_ctrl); +- ctrl_dbg(ctrl, "%s: lnk_ctrl = %x\n", __func__, lnk_ctrl); + return 0; + } + +-- +2.40.1 + diff --git a/queue-6.1/pci-qcom-ep-switch-mhi-bus-master-clock-off-during-l.patch b/queue-6.1/pci-qcom-ep-switch-mhi-bus-master-clock-off-during-l.patch new file mode 100644 index 00000000000..bb7f9be9fff --- /dev/null +++ b/queue-6.1/pci-qcom-ep-switch-mhi-bus-master-clock-off-during-l.patch @@ -0,0 +1,49 @@ +From bda88ff02761c91a876c695e9f9c7212b5dede01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 19:40:36 +0530 +Subject: PCI: qcom-ep: Switch MHI bus master clock off during L1SS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Manivannan Sadhasivam + +[ Upstream commit b9cbc06049cb6b7a322d708c2098195fb9fdcc4c ] + +Currently, as part of the qcom_pcie_perst_deassert() function, instead +of writing the updated value to clear PARF_MSTR_AXI_CLK_EN, the variable +"val" is re-read. + +This must be fixed to ensure that the master clock supplied to the MHI +bus is correctly gated during L1.1/L1.2 to save power. + +Thus, replace the line that re-reads "val" with a line that writes the +updated value to the register to clear PARF_MSTR_AXI_CLK_EN. + +[kwilczynski: commit log] +Fixes: c457ac029e44 ("PCI: qcom-ep: Gate Master AXI clock to MHI bus during L1SS") +Link: https://lore.kernel.org/linux-pci/20230627141036.11600-1-manivannan.sadhasivam@linaro.org +Reported-by: Krzysztof Wilczyński +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-qcom-ep.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-qcom-ep.c b/drivers/pci/controller/dwc/pcie-qcom-ep.c +index 6d0d1b759ca24..d4c566c1c8725 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom-ep.c ++++ b/drivers/pci/controller/dwc/pcie-qcom-ep.c +@@ -410,7 +410,7 @@ static int qcom_pcie_perst_deassert(struct dw_pcie *pci) + /* Gate Master AXI clock to MHI bus during L1SS */ + val = readl_relaxed(pcie_ep->parf + PARF_MHI_CLOCK_RESET_CTRL); + val &= ~PARF_MSTR_AXI_CLK_EN; +- val = readl_relaxed(pcie_ep->parf + PARF_MHI_CLOCK_RESET_CTRL); ++ writel_relaxed(val, pcie_ep->parf + PARF_MHI_CLOCK_RESET_CTRL); + + dw_pcie_ep_init_notify(&pcie_ep->pci.ep); + +-- +2.40.1 + diff --git a/queue-6.1/perf-imx_ddr-don-t-enable-counter0-if-none-of-4-coun.patch b/queue-6.1/perf-imx_ddr-don-t-enable-counter0-if-none-of-4-coun.patch new file mode 100644 index 00000000000..a75fa07decd --- /dev/null +++ b/queue-6.1/perf-imx_ddr-don-t-enable-counter0-if-none-of-4-coun.patch @@ -0,0 +1,90 @@ +From 0b1243c37fb759ae0a232c36ffc95914809e5e29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 09:54:38 +0800 +Subject: perf/imx_ddr: don't enable counter0 if none of 4 counters are used + +From: Xu Yang + +[ Upstream commit f4e2bd91ddf5e8543cbe7ad80b3fba3d2dc63fa3 ] + +In current driver, counter0 will be enabled after ddr_perf_pmu_enable() +is called even though none of the 4 counters are used. This will cause +counter0 continue to count until ddr_perf_pmu_disabled() is called. If +pmu is not disabled all the time, the pmu interrupt will be asserted +from time to time due to counter0 will overflow and irq handler will +clear it. It's not an expected behavior. This patch will not enable +counter0 if none of 4 counters are used. + +Fixes: 9a66d36cc7ac ("drivers/perf: imx_ddr: Add DDR performance counter support to perf") +Signed-off-by: Xu Yang +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20230811015438.1999307-2-xu.yang_2@nxp.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/fsl_imx8_ddr_perf.c | 24 +++++++++--------------- + 1 file changed, 9 insertions(+), 15 deletions(-) + +diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c +index 8e058e08fe810..cd4ce2b4906d1 100644 +--- a/drivers/perf/fsl_imx8_ddr_perf.c ++++ b/drivers/perf/fsl_imx8_ddr_perf.c +@@ -102,6 +102,7 @@ struct ddr_pmu { + const struct fsl_ddr_devtype_data *devtype_data; + int irq; + int id; ++ int active_counter; + }; + + static ssize_t ddr_perf_identifier_show(struct device *dev, +@@ -496,6 +497,10 @@ static void ddr_perf_event_start(struct perf_event *event, int flags) + + ddr_perf_counter_enable(pmu, event->attr.config, counter, true); + ++ if (!pmu->active_counter++) ++ ddr_perf_counter_enable(pmu, EVENT_CYCLES_ID, ++ EVENT_CYCLES_COUNTER, true); ++ + hwc->state = 0; + } + +@@ -550,6 +555,10 @@ static void ddr_perf_event_stop(struct perf_event *event, int flags) + ddr_perf_counter_enable(pmu, event->attr.config, counter, false); + ddr_perf_event_update(event); + ++ if (!--pmu->active_counter) ++ ddr_perf_counter_enable(pmu, EVENT_CYCLES_ID, ++ EVENT_CYCLES_COUNTER, false); ++ + hwc->state |= PERF_HES_STOPPED; + } + +@@ -568,25 +577,10 @@ static void ddr_perf_event_del(struct perf_event *event, int flags) + + static void ddr_perf_pmu_enable(struct pmu *pmu) + { +- struct ddr_pmu *ddr_pmu = to_ddr_pmu(pmu); +- +- /* enable cycle counter if cycle is not active event list */ +- if (ddr_pmu->events[EVENT_CYCLES_COUNTER] == NULL) +- ddr_perf_counter_enable(ddr_pmu, +- EVENT_CYCLES_ID, +- EVENT_CYCLES_COUNTER, +- true); + } + + static void ddr_perf_pmu_disable(struct pmu *pmu) + { +- struct ddr_pmu *ddr_pmu = to_ddr_pmu(pmu); +- +- if (ddr_pmu->events[EVENT_CYCLES_COUNTER] == NULL) +- ddr_perf_counter_enable(ddr_pmu, +- EVENT_CYCLES_ID, +- EVENT_CYCLES_COUNTER, +- false); + } + + static int ddr_perf_init(struct ddr_pmu *pmu, void __iomem *base, +-- +2.40.1 + diff --git a/queue-6.1/phy-rockchip-inno-hdmi-do-not-power-on-rk3328-post-p.patch b/queue-6.1/phy-rockchip-inno-hdmi-do-not-power-on-rk3328-post-p.patch new file mode 100644 index 00000000000..6cd3931f586 --- /dev/null +++ b/queue-6.1/phy-rockchip-inno-hdmi-do-not-power-on-rk3328-post-p.patch @@ -0,0 +1,55 @@ +From 91232c463434f1b331df912dadb0a3fc54fe9c9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 17:10:21 +0000 +Subject: phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write + +From: Jonas Karlman + +[ Upstream commit 19a1d46bd699940a496d3b0d4e142ef99834988c ] + +inno_write is used to configure 0xaa reg, that also hold the +POST_PLL_POWER_DOWN bit. +When POST_PLL_REFCLK_SEL_TMDS is configured the power down bit is not +taken into consideration. + +Fix this by keeping the power down bit until configuration is complete. +Also reorder the reg write order for consistency. + +Fixes: 53706a116863 ("phy: add Rockchip Innosilicon hdmi phy") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20230615171005.2251032-5-jonas@kwiboo.se +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-inno-hdmi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +index 15a008a1ac7b9..2556caf475c0c 100644 +--- a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c ++++ b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +@@ -1023,9 +1023,10 @@ inno_hdmi_phy_rk3328_power_on(struct inno_hdmi_phy *inno, + + inno_write(inno, 0xac, RK3328_POST_PLL_FB_DIV_7_0(cfg->fbdiv)); + if (cfg->postdiv == 1) { +- inno_write(inno, 0xaa, RK3328_POST_PLL_REFCLK_SEL_TMDS); + inno_write(inno, 0xab, RK3328_POST_PLL_FB_DIV_8(cfg->fbdiv) | + RK3328_POST_PLL_PRE_DIV(cfg->prediv)); ++ inno_write(inno, 0xaa, RK3328_POST_PLL_REFCLK_SEL_TMDS | ++ RK3328_POST_PLL_POWER_DOWN); + } else { + v = (cfg->postdiv / 2) - 1; + v &= RK3328_POST_PLL_POST_DIV_MASK; +@@ -1033,7 +1034,8 @@ inno_hdmi_phy_rk3328_power_on(struct inno_hdmi_phy *inno, + inno_write(inno, 0xab, RK3328_POST_PLL_FB_DIV_8(cfg->fbdiv) | + RK3328_POST_PLL_PRE_DIV(cfg->prediv)); + inno_write(inno, 0xaa, RK3328_POST_PLL_POST_DIV_ENABLE | +- RK3328_POST_PLL_REFCLK_SEL_TMDS); ++ RK3328_POST_PLL_REFCLK_SEL_TMDS | ++ RK3328_POST_PLL_POWER_DOWN); + } + + for (v = 0; v < 14; v++) +-- +2.40.1 + diff --git a/queue-6.1/phy-rockchip-inno-hdmi-round-fractal-pixclock-in-rk3.patch b/queue-6.1/phy-rockchip-inno-hdmi-round-fractal-pixclock-in-rk3.patch new file mode 100644 index 00000000000..e6ea8c38bb0 --- /dev/null +++ b/queue-6.1/phy-rockchip-inno-hdmi-round-fractal-pixclock-in-rk3.patch @@ -0,0 +1,50 @@ +From d53f2e0834dec22b8bed9ca85ee1dce7ac478b16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 17:10:19 +0000 +Subject: phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate + +From: Zheng Yang + +[ Upstream commit d5ef343c1d62bc4c4c2c393af654a41cb34b449f ] + +inno_hdmi_phy_rk3328_clk_recalc_rate() is returning a rate not found +in the pre pll config table when the fractal divider is used. +This can prevent proper power_on because a tmdsclock for the new rate +is not found in the pre pll config table. + +Fix this by saving and returning a rounded pixel rate that exist +in the pre pll config table. + +Fixes: 53706a116863 ("phy: add Rockchip Innosilicon hdmi phy") +Signed-off-by: Zheng Yang +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20230615171005.2251032-3-jonas@kwiboo.se +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-inno-hdmi.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +index 15339338aae35..15a008a1ac7b9 100644 +--- a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c ++++ b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +@@ -745,10 +745,12 @@ unsigned long inno_hdmi_phy_rk3328_clk_recalc_rate(struct clk_hw *hw, + do_div(vco, (nd * (no_a == 1 ? no_b : no_a) * no_d * 2)); + } + +- inno->pixclock = vco; +- dev_dbg(inno->dev, "%s rate %lu\n", __func__, inno->pixclock); ++ inno->pixclock = DIV_ROUND_CLOSEST((unsigned long)vco, 1000) * 1000; + +- return vco; ++ dev_dbg(inno->dev, "%s rate %lu vco %llu\n", ++ __func__, inno->pixclock, vco); ++ ++ return inno->pixclock; + } + + static long inno_hdmi_phy_rk3328_clk_round_rate(struct clk_hw *hw, +-- +2.40.1 + diff --git a/queue-6.1/phy-rockchip-inno-hdmi-use-correct-vco_div_5-macro-o.patch b/queue-6.1/phy-rockchip-inno-hdmi-use-correct-vco_div_5-macro-o.patch new file mode 100644 index 00000000000..b39b2de0af2 --- /dev/null +++ b/queue-6.1/phy-rockchip-inno-hdmi-use-correct-vco_div_5-macro-o.patch @@ -0,0 +1,41 @@ +From 725fd0b4925d6f8abf96550dfd1768171e538189 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 17:10:17 +0000 +Subject: phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328 + +From: Jonas Karlman + +[ Upstream commit 644c06dfbd0da713f772abf0a8f8581ac78e6264 ] + +inno_hdmi_phy_rk3328_clk_set_rate() is using the RK3228 macro +when configuring vco_div_5 on RK3328. + +Fix this by using correct vco_div_5 macro for RK3328. + +Fixes: 53706a116863 ("phy: add Rockchip Innosilicon hdmi phy") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20230615171005.2251032-2-jonas@kwiboo.se +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-inno-hdmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +index 80acca4e9e146..15339338aae35 100644 +--- a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c ++++ b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +@@ -790,8 +790,8 @@ static int inno_hdmi_phy_rk3328_clk_set_rate(struct clk_hw *hw, + RK3328_PRE_PLL_POWER_DOWN); + + /* Configure pre-pll */ +- inno_update_bits(inno, 0xa0, RK3228_PCLK_VCO_DIV_5_MASK, +- RK3228_PCLK_VCO_DIV_5(cfg->vco_div_5_en)); ++ inno_update_bits(inno, 0xa0, RK3328_PCLK_VCO_DIV_5_MASK, ++ RK3328_PCLK_VCO_DIV_5(cfg->vco_div_5_en)); + inno_write(inno, 0xa1, RK3328_PRE_PLL_PRE_DIV(cfg->prediv)); + + val = RK3328_SPREAD_SPECTRUM_MOD_DISABLE; +-- +2.40.1 + diff --git a/queue-6.1/pinctrl-mcp23s08-check-return-value-of-devm_kasprint.patch b/queue-6.1/pinctrl-mcp23s08-check-return-value-of-devm_kasprint.patch new file mode 100644 index 00000000000..9453216a139 --- /dev/null +++ b/queue-6.1/pinctrl-mcp23s08-check-return-value-of-devm_kasprint.patch @@ -0,0 +1,62 @@ +From ae1beae582bdb0a8c840872ee1dbefb5ac292667 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 13:04:09 +0300 +Subject: pinctrl: mcp23s08: check return value of devm_kasprintf() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Claudiu Beznea + +[ Upstream commit f941714a7c7698eadb59bc27d34d6d6f38982705 ] + +devm_kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 0f04a81784fe ("pinctrl: mcp23s08: Split to three parts: core, I²C, SPI") +Signed-off-by: Claudiu Beznea +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230621100409.1608395-1-claudiu.beznea@microchip.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-mcp23s08_spi.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-mcp23s08_spi.c b/drivers/pinctrl/pinctrl-mcp23s08_spi.c +index 9ae10318f6f35..ea059b9c5542e 100644 +--- a/drivers/pinctrl/pinctrl-mcp23s08_spi.c ++++ b/drivers/pinctrl/pinctrl-mcp23s08_spi.c +@@ -91,18 +91,28 @@ static int mcp23s08_spi_regmap_init(struct mcp23s08 *mcp, struct device *dev, + mcp->reg_shift = 0; + mcp->chip.ngpio = 8; + mcp->chip.label = devm_kasprintf(dev, GFP_KERNEL, "mcp23s08.%d", addr); ++ if (!mcp->chip.label) ++ return -ENOMEM; + + config = &mcp23x08_regmap; + name = devm_kasprintf(dev, GFP_KERNEL, "%d", addr); ++ if (!name) ++ return -ENOMEM; ++ + break; + + case MCP_TYPE_S17: + mcp->reg_shift = 1; + mcp->chip.ngpio = 16; + mcp->chip.label = devm_kasprintf(dev, GFP_KERNEL, "mcp23s17.%d", addr); ++ if (!mcp->chip.label) ++ return -ENOMEM; + + config = &mcp23x17_regmap; + name = devm_kasprintf(dev, GFP_KERNEL, "%d", addr); ++ if (!name) ++ return -ENOMEM; ++ + break; + + case MCP_TYPE_S18: +-- +2.40.1 + diff --git a/queue-6.1/platform-x86-amd-pmf-fix-a-missing-cleanup-path.patch b/queue-6.1/platform-x86-amd-pmf-fix-a-missing-cleanup-path.patch new file mode 100644 index 00000000000..5afb5a26b73 --- /dev/null +++ b/queue-6.1/platform-x86-amd-pmf-fix-a-missing-cleanup-path.patch @@ -0,0 +1,44 @@ +From 27201f571b3531ea8cdfe559f204c9dc9e48c007 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Aug 2023 13:54:21 -0500 +Subject: platform/x86/amd/pmf: Fix a missing cleanup path + +From: Mario Limonciello + +[ Upstream commit 4dbd6e61adc7e52dd1c9165f0ccaa90806611e40 ] + +On systems that support slider notifications but don't otherwise support +granular slider the SPS cleanup path doesn't run. + +This means that loading/unloading/loading leads to failures because +the sysfs files don't get setup properly when reloaded. + +Add the missing cleanup path. + +Fixes: 33c9ab5b493a ("platform/x86/amd/pmf: Notify OS power slider update") +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20230823185421.23959-1-mario.limonciello@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c +index 8a38cd94a605d..d10c097380c56 100644 +--- a/drivers/platform/x86/amd/pmf/core.c ++++ b/drivers/platform/x86/amd/pmf/core.c +@@ -322,7 +322,8 @@ static void amd_pmf_init_features(struct amd_pmf_dev *dev) + + static void amd_pmf_deinit_features(struct amd_pmf_dev *dev) + { +- if (is_apmf_func_supported(dev, APMF_FUNC_STATIC_SLIDER_GRANULAR)) { ++ if (is_apmf_func_supported(dev, APMF_FUNC_STATIC_SLIDER_GRANULAR) || ++ is_apmf_func_supported(dev, APMF_FUNC_OS_POWER_SLIDER_UPDATE)) { + power_supply_unreg_notifier(&dev->pwr_src_notifier); + amd_pmf_deinit_sps(dev); + } +-- +2.40.1 + diff --git a/queue-6.1/platform-x86-dell-sysman-fix-reference-leak.patch b/queue-6.1/platform-x86-dell-sysman-fix-reference-leak.patch new file mode 100644 index 00000000000..513cbdcffe9 --- /dev/null +++ b/queue-6.1/platform-x86-dell-sysman-fix-reference-leak.patch @@ -0,0 +1,56 @@ +From fc74cb0f20ae850f50c44f8510c8bd7e731a6894 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Aug 2023 07:36:10 +0200 +Subject: platform/x86: dell-sysman: Fix reference leak + +From: Armin Wolf + +[ Upstream commit 7295a996fdab7bf83dc3d4078fa8b139b8e0a1bf ] + +If a duplicate attribute is found using kset_find_obj(), +a reference to that attribute is returned. This means +that we need to dispose it accordingly. Use kobject_put() +to dispose the duplicate attribute in such a case. + +Compile-tested only. + +Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems") +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20230805053610.7106-1-W_Armin@gmx.de +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/dell/dell-wmi-sysman/sysman.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c b/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c +index 0a6411a8a104c..b2406a595be9a 100644 +--- a/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c ++++ b/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c +@@ -396,6 +396,7 @@ static int init_bios_attributes(int attr_type, const char *guid) + struct kobject *attr_name_kobj; //individual attribute names + union acpi_object *obj = NULL; + union acpi_object *elements; ++ struct kobject *duplicate; + struct kset *tmp_set; + int min_elements; + +@@ -454,9 +455,11 @@ static int init_bios_attributes(int attr_type, const char *guid) + else + tmp_set = wmi_priv.main_dir_kset; + +- if (kset_find_obj(tmp_set, elements[ATTR_NAME].string.pointer)) { +- pr_debug("duplicate attribute name found - %s\n", +- elements[ATTR_NAME].string.pointer); ++ duplicate = kset_find_obj(tmp_set, elements[ATTR_NAME].string.pointer); ++ if (duplicate) { ++ pr_debug("Duplicate attribute name found - %s\n", ++ elements[ATTR_NAME].string.pointer); ++ kobject_put(duplicate); + goto nextobj; + } + +-- +2.40.1 + diff --git a/queue-6.1/pnfs-fix-assignment-of-xprtdata.cred.patch b/queue-6.1/pnfs-fix-assignment-of-xprtdata.cred.patch new file mode 100644 index 00000000000..c7ab3e5c7d3 --- /dev/null +++ b/queue-6.1/pnfs-fix-assignment-of-xprtdata.cred.patch @@ -0,0 +1,39 @@ +From 31d61d407286e92726b3c926abbda873e2f5725c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Aug 2023 14:31:31 -0400 +Subject: pNFS: Fix assignment of xprtdata.cred + +From: Anna Schumaker + +[ Upstream commit c4a123d2e8c4dc91d581ee7d05c0cd51a0273fab ] + +The comma at the end of the line was leftover from an earlier refactor +of the _nfs4_pnfs_v3_ds_connect() function. This is technically valid C, +so the compilers didn't catch it, but if I'm understanding how it works +correctly it assigns the return value of rpc_clnt_add_xprtr() to +xprtdata.cred. + +Reported-by: Olga Kornievskaia +Fixes: a12f996d3413 ("NFSv4/pNFS: Use connections to a DS that are all of the same protocol family") +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/pnfs_nfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c +index 5d035dd2d7bf0..47a8da3f5c9ff 100644 +--- a/fs/nfs/pnfs_nfs.c ++++ b/fs/nfs/pnfs_nfs.c +@@ -943,7 +943,7 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, + * Test this address for session trunking and + * add as an alias + */ +- xprtdata.cred = nfs4_get_clid_cred(clp), ++ xprtdata.cred = nfs4_get_clid_cred(clp); + rpc_clnt_add_xprt(clp->cl_rpcclient, &xprt_args, + rpc_clnt_setup_test_and_add_xprt, + &rpcdata); +-- +2.40.1 + diff --git a/queue-6.1/powerpc-don-t-include-lppaca.h-in-paca.h.patch b/queue-6.1/powerpc-don-t-include-lppaca.h-in-paca.h.patch new file mode 100644 index 00000000000..66e3c5230cd --- /dev/null +++ b/queue-6.1/powerpc-don-t-include-lppaca.h-in-paca.h.patch @@ -0,0 +1,134 @@ +From 4d27cd6f038df21bbb7d9735bec57d90f72ec781 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Aug 2023 15:53:16 +1000 +Subject: powerpc: Don't include lppaca.h in paca.h + +From: Michael Ellerman + +[ Upstream commit 1aa000667669fa855853decbb1c69e974d8ff716 ] + +By adding a forward declaration for struct lppaca we can untangle paca.h +and lppaca.h. Also move get_lppaca() into lppaca.h for consistency. + +Add includes of lppaca.h to some files that need it. + +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230823055317.751786-3-mpe@ellerman.id.au +Stable-dep-of: eac030b22ea1 ("powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT") +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/lppaca.h | 4 ++++ + arch/powerpc/include/asm/paca.h | 6 +----- + arch/powerpc/include/asm/paravirt.h | 1 + + arch/powerpc/include/asm/plpar_wrappers.h | 1 + + arch/powerpc/kvm/book3s_hv_ras.c | 1 + + arch/powerpc/mm/book3s64/slb.c | 1 + + arch/powerpc/xmon/xmon.c | 1 + + 7 files changed, 10 insertions(+), 5 deletions(-) + +diff --git a/arch/powerpc/include/asm/lppaca.h b/arch/powerpc/include/asm/lppaca.h +index 34d44cb17c874..fe278172e9d42 100644 +--- a/arch/powerpc/include/asm/lppaca.h ++++ b/arch/powerpc/include/asm/lppaca.h +@@ -134,6 +134,10 @@ static inline bool lppaca_shared_proc(struct lppaca *l) + return !!(l->__old_status & LPPACA_OLD_SHARED_PROC); + } + ++#ifdef CONFIG_PPC_PSERIES ++#define get_lppaca() (get_paca()->lppaca_ptr) ++#endif ++ + /* + * SLB shadow buffer structure as defined in the PAPR. The save_area + * contains adjacent ESID and VSID pairs for each shadowed SLB. The +diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h +index 0ab3511a47d77..183b5a251804c 100644 +--- a/arch/powerpc/include/asm/paca.h ++++ b/arch/powerpc/include/asm/paca.h +@@ -15,7 +15,6 @@ + #include + #include + #include +-#include + #include + #include + #ifdef CONFIG_PPC_BOOK3E_64 +@@ -47,14 +46,11 @@ extern unsigned int debug_smp_processor_id(void); /* from linux/smp.h */ + #define get_paca() local_paca + #endif + +-#ifdef CONFIG_PPC_PSERIES +-#define get_lppaca() (get_paca()->lppaca_ptr) +-#endif +- + #define get_slb_shadow() (get_paca()->slb_shadow_ptr) + + struct task_struct; + struct rtas_args; ++struct lppaca; + + /* + * Defines the layout of the paca. +diff --git a/arch/powerpc/include/asm/paravirt.h b/arch/powerpc/include/asm/paravirt.h +index f5ba1a3c41f8e..e08513d731193 100644 +--- a/arch/powerpc/include/asm/paravirt.h ++++ b/arch/powerpc/include/asm/paravirt.h +@@ -6,6 +6,7 @@ + #include + #ifdef CONFIG_PPC64 + #include ++#include + #include + #endif + +diff --git a/arch/powerpc/include/asm/plpar_wrappers.h b/arch/powerpc/include/asm/plpar_wrappers.h +index 8239c0af5eb2b..fe3d0ea0058ac 100644 +--- a/arch/powerpc/include/asm/plpar_wrappers.h ++++ b/arch/powerpc/include/asm/plpar_wrappers.h +@@ -9,6 +9,7 @@ + + #include + #include ++#include + #include + + static inline long poll_pending(void) +diff --git a/arch/powerpc/kvm/book3s_hv_ras.c b/arch/powerpc/kvm/book3s_hv_ras.c +index ccfd969656306..82be6d87514b7 100644 +--- a/arch/powerpc/kvm/book3s_hv_ras.c ++++ b/arch/powerpc/kvm/book3s_hv_ras.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + #include + #include +diff --git a/arch/powerpc/mm/book3s64/slb.c b/arch/powerpc/mm/book3s64/slb.c +index 6956f637a38c1..f2708c8629a52 100644 +--- a/arch/powerpc/mm/book3s64/slb.c ++++ b/arch/powerpc/mm/book3s64/slb.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + #include + #include +diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c +index bd8e80936f44d..cd692f399cd18 100644 +--- a/arch/powerpc/xmon/xmon.c ++++ b/arch/powerpc/xmon/xmon.c +@@ -58,6 +58,7 @@ + #ifdef CONFIG_PPC64 + #include + #include ++#include + #endif + + #include "nonstdio.h" +-- +2.40.1 + diff --git a/queue-6.1/powerpc-fadump-reset-dump-area-size-if-fadump-memory.patch b/queue-6.1/powerpc-fadump-reset-dump-area-size-if-fadump-memory.patch new file mode 100644 index 00000000000..52c78959677 --- /dev/null +++ b/queue-6.1/powerpc-fadump-reset-dump-area-size-if-fadump-memory.patch @@ -0,0 +1,42 @@ +From 58e1740c1293b6e3c9e7b5572e2e5a99c1530928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 10:37:15 +0530 +Subject: powerpc/fadump: reset dump area size if fadump memory reserve fails + +From: Sourabh Jain + +[ Upstream commit d1eb75e0dfed80d2d85b664e28a39f65b290ab55 ] + +In case fadump_reserve_mem() fails to reserve memory, the +reserve_dump_area_size variable will retain the reserve area size. This +will lead to /sys/kernel/fadump/mem_reserved node displaying an incorrect +memory reserved by fadump. + +To fix this problem, reserve dump area size variable is set to 0 if fadump +failed to reserve memory. + +Fixes: 8255da95e545 ("powerpc/fadump: release all the memory above boot memory size") +Signed-off-by: Sourabh Jain +Acked-by: Mahesh Salgaonkar +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230704050715.203581-1-sourabhjain@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/fadump.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c +index ea0a073abd969..3ff2da7b120b5 100644 +--- a/arch/powerpc/kernel/fadump.c ++++ b/arch/powerpc/kernel/fadump.c +@@ -654,6 +654,7 @@ int __init fadump_reserve_mem(void) + return ret; + error_out: + fw_dump.fadump_enabled = 0; ++ fw_dump.reserve_dump_area_size = 0; + return 0; + } + +-- +2.40.1 + diff --git a/queue-6.1/powerpc-iommu-fix-notifiers-being-shared-by-pci-and-.patch b/queue-6.1/powerpc-iommu-fix-notifiers-being-shared-by-pci-and-.patch new file mode 100644 index 00000000000..723194805b9 --- /dev/null +++ b/queue-6.1/powerpc-iommu-fix-notifiers-being-shared-by-pci-and-.patch @@ -0,0 +1,96 @@ +From fd420e02d0e9be03749e353bb41d9d9b80b45783 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 14:53:22 +1100 +Subject: powerpc/iommu: Fix notifiers being shared by PCI and VIO buses + +From: Russell Currey + +[ Upstream commit c37b6908f7b2bd24dcaaf14a180e28c9132b9c58 ] + +fail_iommu_setup() registers the fail_iommu_bus_notifier struct to both +PCI and VIO buses. struct notifier_block is a linked list node, so this +causes any notifiers later registered to either bus type to also be +registered to the other since they share the same node. + +This causes issues in (at least) the vgaarb code, which registers a +notifier for PCI buses. pci_notify() ends up being called on a vio +device, converted with to_pci_dev() even though it's not a PCI device, +and finally makes a bad access in vga_arbiter_add_pci_device() as +discovered with KASAN: + + BUG: KASAN: slab-out-of-bounds in vga_arbiter_add_pci_device+0x60/0xe00 + Read of size 4 at addr c000000264c26fdc by task swapper/0/1 + + Call Trace: + dump_stack_lvl+0x1bc/0x2b8 (unreliable) + print_report+0x3f4/0xc60 + kasan_report+0x244/0x698 + __asan_load4+0xe8/0x250 + vga_arbiter_add_pci_device+0x60/0xe00 + pci_notify+0x88/0x444 + notifier_call_chain+0x104/0x320 + blocking_notifier_call_chain+0xa0/0x140 + device_add+0xac8/0x1d30 + device_register+0x58/0x80 + vio_register_device_node+0x9ac/0xce0 + vio_bus_scan_register_devices+0xc4/0x13c + __machine_initcall_pseries_vio_device_init+0x94/0xf0 + do_one_initcall+0x12c/0xaa8 + kernel_init_freeable+0xa48/0xba8 + kernel_init+0x64/0x400 + ret_from_kernel_thread+0x5c/0x64 + +Fix this by creating separate notifier_block structs for each bus type. + +Fixes: d6b9a81b2a45 ("powerpc: IOMMU fault injection") +Reported-by: Nageswara R Sastry +Signed-off-by: Russell Currey +Tested-by: Nageswara R Sastry +Reviewed-by: Andrew Donnellan +[mpe: Add #ifdef to fix CONFIG_IBMVIO=n build] +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230322035322.328709-1-ruscur@russell.cc +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/iommu.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c +index b8b7a189cd3ce..a612abe4bfd57 100644 +--- a/arch/powerpc/kernel/iommu.c ++++ b/arch/powerpc/kernel/iommu.c +@@ -171,17 +171,28 @@ static int fail_iommu_bus_notify(struct notifier_block *nb, + return 0; + } + +-static struct notifier_block fail_iommu_bus_notifier = { ++/* ++ * PCI and VIO buses need separate notifier_block structs, since they're linked ++ * list nodes. Sharing a notifier_block would mean that any notifiers later ++ * registered for PCI buses would also get called by VIO buses and vice versa. ++ */ ++static struct notifier_block fail_iommu_pci_bus_notifier = { + .notifier_call = fail_iommu_bus_notify + }; + ++#ifdef CONFIG_IBMVIO ++static struct notifier_block fail_iommu_vio_bus_notifier = { ++ .notifier_call = fail_iommu_bus_notify ++}; ++#endif ++ + static int __init fail_iommu_setup(void) + { + #ifdef CONFIG_PCI +- bus_register_notifier(&pci_bus_type, &fail_iommu_bus_notifier); ++ bus_register_notifier(&pci_bus_type, &fail_iommu_pci_bus_notifier); + #endif + #ifdef CONFIG_IBMVIO +- bus_register_notifier(&vio_bus_type, &fail_iommu_bus_notifier); ++ bus_register_notifier(&vio_bus_type, &fail_iommu_vio_bus_notifier); + #endif + + return 0; +-- +2.40.1 + diff --git a/queue-6.1/powerpc-mpc5xxx-add-missing-fwnode_handle_put.patch b/queue-6.1/powerpc-mpc5xxx-add-missing-fwnode_handle_put.patch new file mode 100644 index 00000000000..1ba5a095fa1 --- /dev/null +++ b/queue-6.1/powerpc-mpc5xxx-add-missing-fwnode_handle_put.patch @@ -0,0 +1,42 @@ +From dea163d590b692913e949e29a2710e34b144ae18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 11:04:23 +0800 +Subject: powerpc/mpc5xxx: Add missing fwnode_handle_put() + +From: Liang He + +[ Upstream commit b9bbbf4979073d5536b7650decd37fcb901e6556 ] + +In mpc5xxx_fwnode_get_bus_frequency(), we should add +fwnode_handle_put() when break out of the iteration +fwnode_for_each_parent_node() as it will automatically +increase and decrease the refcounter. + +Fixes: de06fba62af6 ("powerpc/mpc5xxx: Switch mpc5xxx_get_bus_frequency() to use fwnode") +Signed-off-by: Liang He +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230322030423.1855440-1-windhl@126.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/mpc5xxx_clocks.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/sysdev/mpc5xxx_clocks.c b/arch/powerpc/sysdev/mpc5xxx_clocks.c +index c5bf7e1b37804..58cee28e23992 100644 +--- a/arch/powerpc/sysdev/mpc5xxx_clocks.c ++++ b/arch/powerpc/sysdev/mpc5xxx_clocks.c +@@ -25,8 +25,10 @@ unsigned long mpc5xxx_fwnode_get_bus_frequency(struct fwnode_handle *fwnode) + + fwnode_for_each_parent_node(fwnode, parent) { + ret = fwnode_property_read_u32(parent, "bus-frequency", &bus_freq); +- if (!ret) ++ if (!ret) { ++ fwnode_handle_put(parent); + return bus_freq; ++ } + } + + return 0; +-- +2.40.1 + diff --git a/queue-6.1/powerpc-perf-convert-fsl_emb-notifier-to-state-machi.patch b/queue-6.1/powerpc-perf-convert-fsl_emb-notifier-to-state-machi.patch new file mode 100644 index 00000000000..d76e4bf02e7 --- /dev/null +++ b/queue-6.1/powerpc-perf-convert-fsl_emb-notifier-to-state-machi.patch @@ -0,0 +1,84 @@ +From 21163917a155169be62c2535183b0f079acd590e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 10:59:44 +0200 +Subject: powerpc/perf: Convert fsl_emb notifier to state machine callbacks + +From: Christophe Leroy + +[ Upstream commit 34daf445f82bd3a4df852bb5f1dffd792ac830a0 ] + + CC arch/powerpc/perf/core-fsl-emb.o +arch/powerpc/perf/core-fsl-emb.c:675:6: error: no previous prototype for 'hw_perf_event_setup' [-Werror=missing-prototypes] + 675 | void hw_perf_event_setup(int cpu) + | ^~~~~~~~~~~~~~~~~~~ + +Looks like fsl_emb was completely missed by commit 3f6da3905398 ("perf: +Rework and fix the arch CPU-hotplug hooks") + +So, apply same changes as commit 3f6da3905398 ("perf: Rework and fix +the arch CPU-hotplug hooks") then commit 57ecde42cc74 ("powerpc/perf: +Convert book3s notifier to state machine callbacks") + +While at it, also fix following error: + +arch/powerpc/perf/core-fsl-emb.c: In function 'perf_event_interrupt': +arch/powerpc/perf/core-fsl-emb.c:648:13: error: variable 'found' set but not used [-Werror=unused-but-set-variable] + 648 | int found = 0; + | ^~~~~ + +Fixes: 3f6da3905398 ("perf: Rework and fix the arch CPU-hotplug hooks") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/603e1facb32608f88f40b7d7b9094adc50e7b2dc.1692349125.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/core-fsl-emb.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/perf/core-fsl-emb.c b/arch/powerpc/perf/core-fsl-emb.c +index ee721f420a7ba..1a53ab08447cb 100644 +--- a/arch/powerpc/perf/core-fsl-emb.c ++++ b/arch/powerpc/perf/core-fsl-emb.c +@@ -645,7 +645,6 @@ static void perf_event_interrupt(struct pt_regs *regs) + struct cpu_hw_events *cpuhw = this_cpu_ptr(&cpu_hw_events); + struct perf_event *event; + unsigned long val; +- int found = 0; + + for (i = 0; i < ppmu->n_counter; ++i) { + event = cpuhw->event[i]; +@@ -654,7 +653,6 @@ static void perf_event_interrupt(struct pt_regs *regs) + if ((int)val < 0) { + if (event) { + /* event has overflowed */ +- found = 1; + record_and_restart(event, val, regs); + } else { + /* +@@ -672,11 +670,13 @@ static void perf_event_interrupt(struct pt_regs *regs) + isync(); + } + +-void hw_perf_event_setup(int cpu) ++static int fsl_emb_pmu_prepare_cpu(unsigned int cpu) + { + struct cpu_hw_events *cpuhw = &per_cpu(cpu_hw_events, cpu); + + memset(cpuhw, 0, sizeof(*cpuhw)); ++ ++ return 0; + } + + int register_fsl_emb_pmu(struct fsl_emb_pmu *pmu) +@@ -689,6 +689,8 @@ int register_fsl_emb_pmu(struct fsl_emb_pmu *pmu) + pmu->name); + + perf_pmu_register(&fsl_emb_pmu, "cpu", PERF_TYPE_RAW); ++ cpuhp_setup_state(CPUHP_PERF_POWER, "perf/powerpc:prepare", ++ fsl_emb_pmu_prepare_cpu, NULL); + + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/powerpc-pseries-fix-hcall-tracepoints-with-jump_labe.patch b/queue-6.1/powerpc-pseries-fix-hcall-tracepoints-with-jump_labe.patch new file mode 100644 index 00000000000..2ecbed6a82f --- /dev/null +++ b/queue-6.1/powerpc-pseries-fix-hcall-tracepoints-with-jump_labe.patch @@ -0,0 +1,37 @@ +From 750578125b35a9631b5abc831a8774ef5181b89e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 May 2023 19:15:59 +1000 +Subject: powerpc/pseries: Fix hcall tracepoints with JUMP_LABEL=n + +From: Nicholas Piggin + +[ Upstream commit 750bd41aeaeb1f0e0128aa4f8fcd6dd759713641 ] + +With JUMP_LABEL=n, hcall_tracepoint_refcount's address is being tested +instead of its value. This results in the tracing slowpath always being +taken unnecessarily. + +Fixes: 9a10ccb29c0a2 ("powerpc/pseries: move hcall_tracepoint_refcount out of .toc") +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230509091600.70994-1-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/hvCall.S | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/platforms/pseries/hvCall.S b/arch/powerpc/platforms/pseries/hvCall.S +index 762eb15d3bd42..fc50b9c27c1ba 100644 +--- a/arch/powerpc/platforms/pseries/hvCall.S ++++ b/arch/powerpc/platforms/pseries/hvCall.S +@@ -89,6 +89,7 @@ BEGIN_FTR_SECTION; \ + b 1f; \ + END_FTR_SECTION(0, 1); \ + LOAD_REG_ADDR(r12, hcall_tracepoint_refcount) ; \ ++ ld r12,0(r12); \ + std r12,32(r1); \ + cmpdi r12,0; \ + bne- LABEL; \ +-- +2.40.1 + diff --git a/queue-6.1/powerpc-pseries-rework-lppaca_shared_proc-to-avoid-d.patch b/queue-6.1/powerpc-pseries-rework-lppaca_shared_proc-to-avoid-d.patch new file mode 100644 index 00000000000..f4115d50cde --- /dev/null +++ b/queue-6.1/powerpc-pseries-rework-lppaca_shared_proc-to-avoid-d.patch @@ -0,0 +1,160 @@ +From b39debf6529b2253dd607542b4199d07afe04e93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Aug 2023 15:53:17 +1000 +Subject: powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT + +From: Russell Currey + +[ Upstream commit eac030b22ea12cdfcbb2e941c21c03964403c63f ] + +lppaca_shared_proc() takes a pointer to the lppaca which is typically +accessed through get_lppaca(). With DEBUG_PREEMPT enabled, this leads +to checking if preemption is enabled, for example: + + BUG: using smp_processor_id() in preemptible [00000000] code: grep/10693 + caller is lparcfg_data+0x408/0x19a0 + CPU: 4 PID: 10693 Comm: grep Not tainted 6.5.0-rc3 #2 + Call Trace: + dump_stack_lvl+0x154/0x200 (unreliable) + check_preemption_disabled+0x214/0x220 + lparcfg_data+0x408/0x19a0 + ... + +This isn't actually a problem however, as it does not matter which +lppaca is accessed, the shared proc state will be the same. +vcpudispatch_stats_procfs_init() already works around this by disabling +preemption, but the lparcfg code does not, erroring any time +/proc/powerpc/lparcfg is accessed with DEBUG_PREEMPT enabled. + +Instead of disabling preemption on the caller side, rework +lppaca_shared_proc() to not take a pointer and instead directly access +the lppaca, bypassing any potential preemption checks. + +Fixes: f13c13a00512 ("powerpc: Stop using non-architected shared_proc field in lppaca") +Signed-off-by: Russell Currey +[mpe: Rework to avoid needing a definition in paca.h and lppaca.h] +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230823055317.751786-4-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/lppaca.h | 11 +++++++++-- + arch/powerpc/platforms/pseries/lpar.c | 10 +--------- + arch/powerpc/platforms/pseries/lparcfg.c | 4 ++-- + arch/powerpc/platforms/pseries/setup.c | 2 +- + drivers/cpuidle/cpuidle-pseries.c | 8 +------- + 5 files changed, 14 insertions(+), 21 deletions(-) + +diff --git a/arch/powerpc/include/asm/lppaca.h b/arch/powerpc/include/asm/lppaca.h +index fe278172e9d42..ee1488d38fdc1 100644 +--- a/arch/powerpc/include/asm/lppaca.h ++++ b/arch/powerpc/include/asm/lppaca.h +@@ -45,6 +45,7 @@ + #include + #include + #include ++#include + + /* + * The lppaca is the "virtual processor area" registered with the hypervisor, +@@ -127,14 +128,20 @@ struct lppaca { + */ + #define LPPACA_OLD_SHARED_PROC 2 + +-static inline bool lppaca_shared_proc(struct lppaca *l) ++#ifdef CONFIG_PPC_PSERIES ++/* ++ * All CPUs should have the same shared proc value, so directly access the PACA ++ * to avoid false positives from DEBUG_PREEMPT. ++ */ ++static inline bool lppaca_shared_proc(void) + { ++ struct lppaca *l = local_paca->lppaca_ptr; ++ + if (!firmware_has_feature(FW_FEATURE_SPLPAR)) + return false; + return !!(l->__old_status & LPPACA_OLD_SHARED_PROC); + } + +-#ifdef CONFIG_PPC_PSERIES + #define get_lppaca() (get_paca()->lppaca_ptr) + #endif + +diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c +index 97ef6499e5019..2c2812a87d470 100644 +--- a/arch/powerpc/platforms/pseries/lpar.c ++++ b/arch/powerpc/platforms/pseries/lpar.c +@@ -638,16 +638,8 @@ static const struct proc_ops vcpudispatch_stats_freq_proc_ops = { + + static int __init vcpudispatch_stats_procfs_init(void) + { +- /* +- * Avoid smp_processor_id while preemptible. All CPUs should have +- * the same value for lppaca_shared_proc. +- */ +- preempt_disable(); +- if (!lppaca_shared_proc(get_lppaca())) { +- preempt_enable(); ++ if (!lppaca_shared_proc()) + return 0; +- } +- preempt_enable(); + + if (!proc_create("powerpc/vcpudispatch_stats", 0600, NULL, + &vcpudispatch_stats_proc_ops)) +diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c +index 63fd925ccbb83..ca10a3682c46e 100644 +--- a/arch/powerpc/platforms/pseries/lparcfg.c ++++ b/arch/powerpc/platforms/pseries/lparcfg.c +@@ -205,7 +205,7 @@ static void parse_ppp_data(struct seq_file *m) + ppp_data.active_system_procs); + + /* pool related entries are appropriate for shared configs */ +- if (lppaca_shared_proc(get_lppaca())) { ++ if (lppaca_shared_proc()) { + unsigned long pool_idle_time, pool_procs; + + seq_printf(m, "pool=%d\n", ppp_data.pool_num); +@@ -616,7 +616,7 @@ static int pseries_lparcfg_data(struct seq_file *m, void *v) + partition_potential_processors); + + seq_printf(m, "shared_processor_mode=%d\n", +- lppaca_shared_proc(get_lppaca())); ++ lppaca_shared_proc()); + + #ifdef CONFIG_PPC_64S_HASH_MMU + if (!radix_enabled()) +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c +index 8ef3270515a9b..a0701dbdb1348 100644 +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -846,7 +846,7 @@ static void __init pSeries_setup_arch(void) + if (firmware_has_feature(FW_FEATURE_LPAR)) { + vpa_init(boot_cpuid); + +- if (lppaca_shared_proc(get_lppaca())) { ++ if (lppaca_shared_proc()) { + static_branch_enable(&shared_processor); + pv_spinlocks_init(); + #ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING +diff --git a/drivers/cpuidle/cpuidle-pseries.c b/drivers/cpuidle/cpuidle-pseries.c +index 7e7ab5597d7ac..0590001db6532 100644 +--- a/drivers/cpuidle/cpuidle-pseries.c ++++ b/drivers/cpuidle/cpuidle-pseries.c +@@ -410,13 +410,7 @@ static int __init pseries_idle_probe(void) + return -ENODEV; + + if (firmware_has_feature(FW_FEATURE_SPLPAR)) { +- /* +- * Use local_paca instead of get_lppaca() since +- * preemption is not disabled, and it is not required in +- * fact, since lppaca_ptr does not need to be the value +- * associated to the current CPU, it can be from any CPU. +- */ +- if (lppaca_shared_proc(local_paca->lppaca_ptr)) { ++ if (lppaca_shared_proc()) { + cpuidle_state_table = shared_states; + max_idle_state = ARRAY_SIZE(shared_states); + } else { +-- +2.40.1 + diff --git a/queue-6.1/powerpc-radix-move-some-functions-into-ifdef-config_.patch b/queue-6.1/powerpc-radix-move-some-functions-into-ifdef-config_.patch new file mode 100644 index 00000000000..a46d53a33b8 --- /dev/null +++ b/queue-6.1/powerpc-radix-move-some-functions-into-ifdef-config_.patch @@ -0,0 +1,346 @@ +From 80821cf35e6eabdc3f3894700ff770ea98e81a35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 10:01:43 +0200 +Subject: powerpc/radix: Move some functions into #ifdef + CONFIG_KVM_BOOK3S_HV_POSSIBLE + +From: Christophe Leroy + +[ Upstream commit 4a9dd8f292efd614f0a18452e6474fe19ae17b47 ] + +With skiboot_defconfig, Clang reports: + + CC arch/powerpc/mm/book3s64/radix_tlb.o +arch/powerpc/mm/book3s64/radix_tlb.c:419:20: error: unused function '_tlbie_pid_lpid' [-Werror,-Wunused-function] +static inline void _tlbie_pid_lpid(unsigned long pid, unsigned long lpid, + ^ +arch/powerpc/mm/book3s64/radix_tlb.c:663:20: error: unused function '_tlbie_va_range_lpid' [-Werror,-Wunused-function] +static inline void _tlbie_va_range_lpid(unsigned long start, unsigned long end, + ^ + +This is because those functions are only called from functions +enclosed in a #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE + +Move below functions inside that #ifdef +* __tlbie_pid_lpid(unsigned long pid, +* __tlbie_va_lpid(unsigned long va, unsigned long pid, +* fixup_tlbie_pid_lpid(unsigned long pid, unsigned long lpid) +* _tlbie_pid_lpid(unsigned long pid, unsigned long lpid, +* fixup_tlbie_va_range_lpid(unsigned long va, +* __tlbie_va_range_lpid(unsigned long start, unsigned long end, +* _tlbie_va_range_lpid(unsigned long start, unsigned long end, + +Fixes: f0c6fbbb9050 ("KVM: PPC: Book3S HV: Add support for H_RPT_INVALIDATE") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202307260802.Mjr99P5O-lkp@intel.com/ +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/3d72efd39f986ee939d068af69fdce28bd600766.1691568093.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/book3s64/radix_tlb.c | 240 ++++++++++++++------------- + 1 file changed, 121 insertions(+), 119 deletions(-) + +diff --git a/arch/powerpc/mm/book3s64/radix_tlb.c b/arch/powerpc/mm/book3s64/radix_tlb.c +index 6d7a1ef723e69..a8ba04dcb20fa 100644 +--- a/arch/powerpc/mm/book3s64/radix_tlb.c ++++ b/arch/powerpc/mm/book3s64/radix_tlb.c +@@ -127,21 +127,6 @@ static __always_inline void __tlbie_pid(unsigned long pid, unsigned long ric) + trace_tlbie(0, 0, rb, rs, ric, prs, r); + } + +-static __always_inline void __tlbie_pid_lpid(unsigned long pid, +- unsigned long lpid, +- unsigned long ric) +-{ +- unsigned long rb, rs, prs, r; +- +- rb = PPC_BIT(53); /* IS = 1 */ +- rs = (pid << PPC_BITLSHIFT(31)) | (lpid & ~(PPC_BITMASK(0, 31))); +- prs = 1; /* process scoped */ +- r = 1; /* radix format */ +- +- asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1) +- : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory"); +- trace_tlbie(0, 0, rb, rs, ric, prs, r); +-} + static __always_inline void __tlbie_lpid(unsigned long lpid, unsigned long ric) + { + unsigned long rb,rs,prs,r; +@@ -202,23 +187,6 @@ static __always_inline void __tlbie_va(unsigned long va, unsigned long pid, + trace_tlbie(0, 0, rb, rs, ric, prs, r); + } + +-static __always_inline void __tlbie_va_lpid(unsigned long va, unsigned long pid, +- unsigned long lpid, +- unsigned long ap, unsigned long ric) +-{ +- unsigned long rb, rs, prs, r; +- +- rb = va & ~(PPC_BITMASK(52, 63)); +- rb |= ap << PPC_BITLSHIFT(58); +- rs = (pid << PPC_BITLSHIFT(31)) | (lpid & ~(PPC_BITMASK(0, 31))); +- prs = 1; /* process scoped */ +- r = 1; /* radix format */ +- +- asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1) +- : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory"); +- trace_tlbie(0, 0, rb, rs, ric, prs, r); +-} +- + static __always_inline void __tlbie_lpid_va(unsigned long va, unsigned long lpid, + unsigned long ap, unsigned long ric) + { +@@ -264,22 +232,6 @@ static inline void fixup_tlbie_va_range(unsigned long va, unsigned long pid, + } + } + +-static inline void fixup_tlbie_va_range_lpid(unsigned long va, +- unsigned long pid, +- unsigned long lpid, +- unsigned long ap) +-{ +- if (cpu_has_feature(CPU_FTR_P9_TLBIE_ERAT_BUG)) { +- asm volatile("ptesync" : : : "memory"); +- __tlbie_pid_lpid(0, lpid, RIC_FLUSH_TLB); +- } +- +- if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) { +- asm volatile("ptesync" : : : "memory"); +- __tlbie_va_lpid(va, pid, lpid, ap, RIC_FLUSH_TLB); +- } +-} +- + static inline void fixup_tlbie_pid(unsigned long pid) + { + /* +@@ -299,26 +251,6 @@ static inline void fixup_tlbie_pid(unsigned long pid) + } + } + +-static inline void fixup_tlbie_pid_lpid(unsigned long pid, unsigned long lpid) +-{ +- /* +- * We can use any address for the invalidation, pick one which is +- * probably unused as an optimisation. +- */ +- unsigned long va = ((1UL << 52) - 1); +- +- if (cpu_has_feature(CPU_FTR_P9_TLBIE_ERAT_BUG)) { +- asm volatile("ptesync" : : : "memory"); +- __tlbie_pid_lpid(0, lpid, RIC_FLUSH_TLB); +- } +- +- if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) { +- asm volatile("ptesync" : : : "memory"); +- __tlbie_va_lpid(va, pid, lpid, mmu_get_ap(MMU_PAGE_64K), +- RIC_FLUSH_TLB); +- } +-} +- + static inline void fixup_tlbie_lpid_va(unsigned long va, unsigned long lpid, + unsigned long ap) + { +@@ -416,31 +348,6 @@ static inline void _tlbie_pid(unsigned long pid, unsigned long ric) + asm volatile("eieio; tlbsync; ptesync": : :"memory"); + } + +-static inline void _tlbie_pid_lpid(unsigned long pid, unsigned long lpid, +- unsigned long ric) +-{ +- asm volatile("ptesync" : : : "memory"); +- +- /* +- * Workaround the fact that the "ric" argument to __tlbie_pid +- * must be a compile-time contraint to match the "i" constraint +- * in the asm statement. +- */ +- switch (ric) { +- case RIC_FLUSH_TLB: +- __tlbie_pid_lpid(pid, lpid, RIC_FLUSH_TLB); +- fixup_tlbie_pid_lpid(pid, lpid); +- break; +- case RIC_FLUSH_PWC: +- __tlbie_pid_lpid(pid, lpid, RIC_FLUSH_PWC); +- break; +- case RIC_FLUSH_ALL: +- default: +- __tlbie_pid_lpid(pid, lpid, RIC_FLUSH_ALL); +- fixup_tlbie_pid_lpid(pid, lpid); +- } +- asm volatile("eieio; tlbsync; ptesync" : : : "memory"); +-} + struct tlbiel_pid { + unsigned long pid; + unsigned long ric; +@@ -566,20 +473,6 @@ static inline void __tlbie_va_range(unsigned long start, unsigned long end, + fixup_tlbie_va_range(addr - page_size, pid, ap); + } + +-static inline void __tlbie_va_range_lpid(unsigned long start, unsigned long end, +- unsigned long pid, unsigned long lpid, +- unsigned long page_size, +- unsigned long psize) +-{ +- unsigned long addr; +- unsigned long ap = mmu_get_ap(psize); +- +- for (addr = start; addr < end; addr += page_size) +- __tlbie_va_lpid(addr, pid, lpid, ap, RIC_FLUSH_TLB); +- +- fixup_tlbie_va_range_lpid(addr - page_size, pid, lpid, ap); +-} +- + static __always_inline void _tlbie_va(unsigned long va, unsigned long pid, + unsigned long psize, unsigned long ric) + { +@@ -660,18 +553,6 @@ static inline void _tlbie_va_range(unsigned long start, unsigned long end, + asm volatile("eieio; tlbsync; ptesync": : :"memory"); + } + +-static inline void _tlbie_va_range_lpid(unsigned long start, unsigned long end, +- unsigned long pid, unsigned long lpid, +- unsigned long page_size, +- unsigned long psize, bool also_pwc) +-{ +- asm volatile("ptesync" : : : "memory"); +- if (also_pwc) +- __tlbie_pid_lpid(pid, lpid, RIC_FLUSH_PWC); +- __tlbie_va_range_lpid(start, end, pid, lpid, page_size, psize); +- asm volatile("eieio; tlbsync; ptesync" : : : "memory"); +-} +- + static inline void _tlbiel_va_range_multicast(struct mm_struct *mm, + unsigned long start, unsigned long end, + unsigned long pid, unsigned long page_size, +@@ -1476,6 +1357,127 @@ void radix__flush_tlb_all(void) + } + + #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE ++static __always_inline void __tlbie_pid_lpid(unsigned long pid, ++ unsigned long lpid, ++ unsigned long ric) ++{ ++ unsigned long rb, rs, prs, r; ++ ++ rb = PPC_BIT(53); /* IS = 1 */ ++ rs = (pid << PPC_BITLSHIFT(31)) | (lpid & ~(PPC_BITMASK(0, 31))); ++ prs = 1; /* process scoped */ ++ r = 1; /* radix format */ ++ ++ asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1) ++ : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory"); ++ trace_tlbie(0, 0, rb, rs, ric, prs, r); ++} ++ ++static __always_inline void __tlbie_va_lpid(unsigned long va, unsigned long pid, ++ unsigned long lpid, ++ unsigned long ap, unsigned long ric) ++{ ++ unsigned long rb, rs, prs, r; ++ ++ rb = va & ~(PPC_BITMASK(52, 63)); ++ rb |= ap << PPC_BITLSHIFT(58); ++ rs = (pid << PPC_BITLSHIFT(31)) | (lpid & ~(PPC_BITMASK(0, 31))); ++ prs = 1; /* process scoped */ ++ r = 1; /* radix format */ ++ ++ asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1) ++ : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory"); ++ trace_tlbie(0, 0, rb, rs, ric, prs, r); ++} ++ ++static inline void fixup_tlbie_pid_lpid(unsigned long pid, unsigned long lpid) ++{ ++ /* ++ * We can use any address for the invalidation, pick one which is ++ * probably unused as an optimisation. ++ */ ++ unsigned long va = ((1UL << 52) - 1); ++ ++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_ERAT_BUG)) { ++ asm volatile("ptesync" : : : "memory"); ++ __tlbie_pid_lpid(0, lpid, RIC_FLUSH_TLB); ++ } ++ ++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) { ++ asm volatile("ptesync" : : : "memory"); ++ __tlbie_va_lpid(va, pid, lpid, mmu_get_ap(MMU_PAGE_64K), ++ RIC_FLUSH_TLB); ++ } ++} ++ ++static inline void _tlbie_pid_lpid(unsigned long pid, unsigned long lpid, ++ unsigned long ric) ++{ ++ asm volatile("ptesync" : : : "memory"); ++ ++ /* ++ * Workaround the fact that the "ric" argument to __tlbie_pid ++ * must be a compile-time contraint to match the "i" constraint ++ * in the asm statement. ++ */ ++ switch (ric) { ++ case RIC_FLUSH_TLB: ++ __tlbie_pid_lpid(pid, lpid, RIC_FLUSH_TLB); ++ fixup_tlbie_pid_lpid(pid, lpid); ++ break; ++ case RIC_FLUSH_PWC: ++ __tlbie_pid_lpid(pid, lpid, RIC_FLUSH_PWC); ++ break; ++ case RIC_FLUSH_ALL: ++ default: ++ __tlbie_pid_lpid(pid, lpid, RIC_FLUSH_ALL); ++ fixup_tlbie_pid_lpid(pid, lpid); ++ } ++ asm volatile("eieio; tlbsync; ptesync" : : : "memory"); ++} ++ ++static inline void fixup_tlbie_va_range_lpid(unsigned long va, ++ unsigned long pid, ++ unsigned long lpid, ++ unsigned long ap) ++{ ++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_ERAT_BUG)) { ++ asm volatile("ptesync" : : : "memory"); ++ __tlbie_pid_lpid(0, lpid, RIC_FLUSH_TLB); ++ } ++ ++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) { ++ asm volatile("ptesync" : : : "memory"); ++ __tlbie_va_lpid(va, pid, lpid, ap, RIC_FLUSH_TLB); ++ } ++} ++ ++static inline void __tlbie_va_range_lpid(unsigned long start, unsigned long end, ++ unsigned long pid, unsigned long lpid, ++ unsigned long page_size, ++ unsigned long psize) ++{ ++ unsigned long addr; ++ unsigned long ap = mmu_get_ap(psize); ++ ++ for (addr = start; addr < end; addr += page_size) ++ __tlbie_va_lpid(addr, pid, lpid, ap, RIC_FLUSH_TLB); ++ ++ fixup_tlbie_va_range_lpid(addr - page_size, pid, lpid, ap); ++} ++ ++static inline void _tlbie_va_range_lpid(unsigned long start, unsigned long end, ++ unsigned long pid, unsigned long lpid, ++ unsigned long page_size, ++ unsigned long psize, bool also_pwc) ++{ ++ asm volatile("ptesync" : : : "memory"); ++ if (also_pwc) ++ __tlbie_pid_lpid(pid, lpid, RIC_FLUSH_PWC); ++ __tlbie_va_range_lpid(start, end, pid, lpid, page_size, psize); ++ asm volatile("eieio; tlbsync; ptesync" : : : "memory"); ++} ++ + /* + * Performs process-scoped invalidations for a given LPID + * as part of H_RPT_INVALIDATE hcall. +-- +2.40.1 + diff --git a/queue-6.1/quota-add-new-helper-dquot_active.patch b/queue-6.1/quota-add-new-helper-dquot_active.patch new file mode 100644 index 00000000000..66fda91e42f --- /dev/null +++ b/queue-6.1/quota-add-new-helper-dquot_active.patch @@ -0,0 +1,119 @@ +From 8538f1227d9abefbecadc31ebfb28667810bfa56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 19:08:20 +0800 +Subject: quota: add new helper dquot_active() + +From: Baokun Li + +[ Upstream commit 33bcfafc48cb186bc4bbcea247feaa396594229e ] + +Add new helper function dquot_active() to make the code more concise. + +Signed-off-by: Baokun Li +Signed-off-by: Jan Kara +Message-Id: <20230630110822.3881712-4-libaokun1@huawei.com> +Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index f9f0610b504df..e4a19a893d85c 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -336,6 +336,11 @@ static void wait_on_dquot(struct dquot *dquot) + mutex_unlock(&dquot->dq_lock); + } + ++static inline int dquot_active(struct dquot *dquot) ++{ ++ return test_bit(DQ_ACTIVE_B, &dquot->dq_flags); ++} ++ + static inline int dquot_dirty(struct dquot *dquot) + { + return test_bit(DQ_MOD_B, &dquot->dq_flags); +@@ -351,14 +356,14 @@ int dquot_mark_dquot_dirty(struct dquot *dquot) + { + int ret = 1; + +- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) ++ if (!dquot_active(dquot)) + return 0; + + if (sb_dqopt(dquot->dq_sb)->flags & DQUOT_NOLIST_DIRTY) + return test_and_set_bit(DQ_MOD_B, &dquot->dq_flags); + + /* If quota is dirty already, we don't have to acquire dq_list_lock */ +- if (test_bit(DQ_MOD_B, &dquot->dq_flags)) ++ if (dquot_dirty(dquot)) + return 1; + + spin_lock(&dq_list_lock); +@@ -440,7 +445,7 @@ int dquot_acquire(struct dquot *dquot) + smp_mb__before_atomic(); + set_bit(DQ_READ_B, &dquot->dq_flags); + /* Instantiate dquot if needed */ +- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags) && !dquot->dq_off) { ++ if (!dquot_active(dquot) && !dquot->dq_off) { + ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk(dquot); + /* Write the info if needed */ + if (info_dirty(&dqopt->info[dquot->dq_id.type])) { +@@ -482,7 +487,7 @@ int dquot_commit(struct dquot *dquot) + goto out_lock; + /* Inactive dquot can be only if there was error during read/init + * => we have better not writing it */ +- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) ++ if (dquot_active(dquot)) + ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk(dquot); + else + ret = -EIO; +@@ -597,7 +602,7 @@ int dquot_scan_active(struct super_block *sb, + + spin_lock(&dq_list_lock); + list_for_each_entry(dquot, &inuse_list, dq_inuse) { +- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) ++ if (!dquot_active(dquot)) + continue; + if (dquot->dq_sb != sb) + continue; +@@ -612,7 +617,7 @@ int dquot_scan_active(struct super_block *sb, + * outstanding call and recheck the DQ_ACTIVE_B after that. + */ + wait_on_dquot(dquot); +- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { ++ if (dquot_active(dquot)) { + ret = fn(dquot, priv); + if (ret < 0) + goto out; +@@ -663,7 +668,7 @@ int dquot_writeback_dquots(struct super_block *sb, int type) + dquot = list_first_entry(&dirty, struct dquot, + dq_dirty); + +- WARN_ON(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)); ++ WARN_ON(!dquot_active(dquot)); + + /* Now we have active dquot from which someone is + * holding reference so we can safely just increase +@@ -800,7 +805,7 @@ void dqput(struct dquot *dquot) + dquot_write_dquot(dquot); + goto we_slept; + } +- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { ++ if (dquot_active(dquot)) { + spin_unlock(&dq_list_lock); + dquot->dq_sb->dq_op->release_dquot(dquot); + goto we_slept; +@@ -901,7 +906,7 @@ struct dquot *dqget(struct super_block *sb, struct kqid qid) + * already finished or it will be canceled due to dq_count > 1 test */ + wait_on_dquot(dquot); + /* Read the dquot / allocate space in quota file */ +- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { ++ if (!dquot_active(dquot)) { + int err; + + err = sb->dq_op->acquire_dquot(dquot); +-- +2.40.1 + diff --git a/queue-6.1/quota-factor-out-dquot_write_dquot.patch b/queue-6.1/quota-factor-out-dquot_write_dquot.patch new file mode 100644 index 00000000000..16769f44dc1 --- /dev/null +++ b/queue-6.1/quota-factor-out-dquot_write_dquot.patch @@ -0,0 +1,94 @@ +From b5a5e0f7f80673bdd0cf8c581807813dfceaf4ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 19:08:18 +0800 +Subject: quota: factor out dquot_write_dquot() + +From: Baokun Li + +[ Upstream commit 024128477809f8073d870307c8157b8826ebfd08 ] + +Refactor out dquot_write_dquot() to reduce duplicate code. + +Signed-off-by: Baokun Li +Signed-off-by: Jan Kara +Message-Id: <20230630110822.3881712-2-libaokun1@huawei.com> +Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 39 ++++++++++++++++----------------------- + 1 file changed, 16 insertions(+), 23 deletions(-) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 46dca88d89c36..5541960ad0252 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -628,6 +628,18 @@ int dquot_scan_active(struct super_block *sb, + } + EXPORT_SYMBOL(dquot_scan_active); + ++static inline int dquot_write_dquot(struct dquot *dquot) ++{ ++ int ret = dquot->dq_sb->dq_op->write_dquot(dquot); ++ if (ret < 0) { ++ quota_error(dquot->dq_sb, "Can't write quota structure " ++ "(error %d). Quota may get out of sync!", ret); ++ /* Clear dirty bit anyway to avoid infinite loop. */ ++ clear_dquot_dirty(dquot); ++ } ++ return ret; ++} ++ + /* Write all dquot structures to quota files */ + int dquot_writeback_dquots(struct super_block *sb, int type) + { +@@ -658,16 +670,9 @@ int dquot_writeback_dquots(struct super_block *sb, int type) + * use count */ + dqgrab(dquot); + spin_unlock(&dq_list_lock); +- err = sb->dq_op->write_dquot(dquot); +- if (err) { +- /* +- * Clear dirty bit anyway to avoid infinite +- * loop here. +- */ +- clear_dquot_dirty(dquot); +- if (!ret) +- ret = err; +- } ++ err = dquot_write_dquot(dquot); ++ if (err && !ret) ++ ret = err; + dqput(dquot); + spin_lock(&dq_list_lock); + } +@@ -765,8 +770,6 @@ static struct shrinker dqcache_shrinker = { + */ + void dqput(struct dquot *dquot) + { +- int ret; +- + if (!dquot) + return; + #ifdef CONFIG_QUOTA_DEBUG +@@ -794,17 +797,7 @@ void dqput(struct dquot *dquot) + if (dquot_dirty(dquot)) { + spin_unlock(&dq_list_lock); + /* Commit dquot before releasing */ +- ret = dquot->dq_sb->dq_op->write_dquot(dquot); +- if (ret < 0) { +- quota_error(dquot->dq_sb, "Can't write quota structure" +- " (error %d). Quota may get out of sync!", +- ret); +- /* +- * We clear dirty bit anyway, so that we avoid +- * infinite loop here +- */ +- clear_dquot_dirty(dquot); +- } ++ dquot_write_dquot(dquot); + goto we_slept; + } + if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { +-- +2.40.1 + diff --git a/queue-6.1/quota-fix-dqput-to-follow-the-guarantees-dquot_srcu-.patch b/queue-6.1/quota-fix-dqput-to-follow-the-guarantees-dquot_srcu-.patch new file mode 100644 index 00000000000..4463b58b5f6 --- /dev/null +++ b/queue-6.1/quota-fix-dqput-to-follow-the-guarantees-dquot_srcu-.patch @@ -0,0 +1,249 @@ +From b13e3fcd4420800b41581050ee240620aa370014 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 19:08:21 +0800 +Subject: quota: fix dqput() to follow the guarantees dquot_srcu should provide + +From: Baokun Li + +[ Upstream commit dabc8b20756601b9e1cc85a81d47d3f98ed4d13a ] + +The dquot_mark_dquot_dirty() using dquot references from the inode +should be protected by dquot_srcu. quota_off code takes care to call +synchronize_srcu(&dquot_srcu) to not drop dquot references while they +are used by other users. But dquot_transfer() breaks this assumption. +We call dquot_transfer() to drop the last reference of dquot and add +it to free_dquots, but there may still be other users using the dquot +at this time, as shown in the function graph below: + + cpu1 cpu2 +_________________|_________________ +wb_do_writeback CHOWN(1) + ... + ext4_da_update_reserve_space + dquot_claim_block + ... + dquot_mark_dquot_dirty // try to dirty old quota + test_bit(DQ_ACTIVE_B, &dquot->dq_flags) // still ACTIVE + if (test_bit(DQ_MOD_B, &dquot->dq_flags)) + // test no dirty, wait dq_list_lock + ... + dquot_transfer + __dquot_transfer + dqput_all(transfer_from) // rls old dquot + dqput // last dqput + dquot_release + clear_bit(DQ_ACTIVE_B, &dquot->dq_flags) + atomic_dec(&dquot->dq_count) + put_dquot_last(dquot) + list_add_tail(&dquot->dq_free, &free_dquots) + // add the dquot to free_dquots + if (!test_and_set_bit(DQ_MOD_B, &dquot->dq_flags)) + add dqi_dirty_list // add released dquot to dirty_list + +This can cause various issues, such as dquot being destroyed by +dqcache_shrink_scan() after being added to free_dquots, which can trigger +a UAF in dquot_mark_dquot_dirty(); or after dquot is added to free_dquots +and then to dirty_list, it is added to free_dquots again after +dquot_writeback_dquots() is executed, which causes the free_dquots list to +be corrupted and triggers a UAF when dqcache_shrink_scan() is called for +freeing dquot twice. + +As Honza said, we need to fix dquot_transfer() to follow the guarantees +dquot_srcu should provide. But calling synchronize_srcu() directly from +dquot_transfer() is too expensive (and mostly unnecessary). So we add +dquot whose last reference should be dropped to the new global dquot +list releasing_dquots, and then queue work item which would call +synchronize_srcu() and after that perform the final cleanup of all the +dquots on releasing_dquots. + +Fixes: 4580b30ea887 ("quota: Do not dirty bad dquots") +Suggested-by: Jan Kara +Signed-off-by: Baokun Li +Signed-off-by: Jan Kara +Message-Id: <20230630110822.3881712-5-libaokun1@huawei.com> +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 96 +++++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 78 insertions(+), 18 deletions(-) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index e4a19a893d85c..53b65c5300fde 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -225,13 +225,22 @@ static void put_quota_format(struct quota_format_type *fmt) + + /* + * Dquot List Management: +- * The quota code uses four lists for dquot management: the inuse_list, +- * free_dquots, dqi_dirty_list, and dquot_hash[] array. A single dquot +- * structure may be on some of those lists, depending on its current state. ++ * The quota code uses five lists for dquot management: the inuse_list, ++ * releasing_dquots, free_dquots, dqi_dirty_list, and dquot_hash[] array. ++ * A single dquot structure may be on some of those lists, depending on ++ * its current state. + * + * All dquots are placed to the end of inuse_list when first created, and this + * list is used for invalidate operation, which must look at every dquot. + * ++ * When the last reference of a dquot will be dropped, the dquot will be ++ * added to releasing_dquots. We'd then queue work item which would call ++ * synchronize_srcu() and after that perform the final cleanup of all the ++ * dquots on the list. Both releasing_dquots and free_dquots use the ++ * dq_free list_head in the dquot struct. When a dquot is removed from ++ * releasing_dquots, a reference count is always subtracted, and if ++ * dq_count == 0 at that point, the dquot will be added to the free_dquots. ++ * + * Unused dquots (dq_count == 0) are added to the free_dquots list when freed, + * and this list is searched whenever we need an available dquot. Dquots are + * removed from the list as soon as they are used again, and +@@ -250,6 +259,7 @@ static void put_quota_format(struct quota_format_type *fmt) + + static LIST_HEAD(inuse_list); + static LIST_HEAD(free_dquots); ++static LIST_HEAD(releasing_dquots); + static unsigned int dq_hash_bits, dq_hash_mask; + static struct hlist_head *dquot_hash; + +@@ -260,6 +270,9 @@ static qsize_t inode_get_rsv_space(struct inode *inode); + static qsize_t __inode_get_rsv_space(struct inode *inode); + static int __dquot_initialize(struct inode *inode, int type); + ++static void quota_release_workfn(struct work_struct *work); ++static DECLARE_DELAYED_WORK(quota_release_work, quota_release_workfn); ++ + static inline unsigned int + hashfn(const struct super_block *sb, struct kqid qid) + { +@@ -305,12 +318,18 @@ static inline void put_dquot_last(struct dquot *dquot) + dqstats_inc(DQST_FREE_DQUOTS); + } + ++static inline void put_releasing_dquots(struct dquot *dquot) ++{ ++ list_add_tail(&dquot->dq_free, &releasing_dquots); ++} ++ + static inline void remove_free_dquot(struct dquot *dquot) + { + if (list_empty(&dquot->dq_free)) + return; + list_del_init(&dquot->dq_free); +- dqstats_dec(DQST_FREE_DQUOTS); ++ if (!atomic_read(&dquot->dq_count)) ++ dqstats_dec(DQST_FREE_DQUOTS); + } + + static inline void put_inuse(struct dquot *dquot) +@@ -552,6 +571,8 @@ static void invalidate_dquots(struct super_block *sb, int type) + struct dquot *dquot, *tmp; + + restart: ++ flush_delayed_work("a_release_work); ++ + spin_lock(&dq_list_lock); + list_for_each_entry_safe(dquot, tmp, &inuse_list, dq_inuse) { + if (dquot->dq_sb != sb) +@@ -560,6 +581,12 @@ static void invalidate_dquots(struct super_block *sb, int type) + continue; + /* Wait for dquot users */ + if (atomic_read(&dquot->dq_count)) { ++ /* dquot in releasing_dquots, flush and retry */ ++ if (!list_empty(&dquot->dq_free)) { ++ spin_unlock(&dq_list_lock); ++ goto restart; ++ } ++ + atomic_inc(&dquot->dq_count); + spin_unlock(&dq_list_lock); + /* +@@ -770,6 +797,49 @@ static struct shrinker dqcache_shrinker = { + .seeks = DEFAULT_SEEKS, + }; + ++/* ++ * Safely release dquot and put reference to dquot. ++ */ ++static void quota_release_workfn(struct work_struct *work) ++{ ++ struct dquot *dquot; ++ struct list_head rls_head; ++ ++ spin_lock(&dq_list_lock); ++ /* Exchange the list head to avoid livelock. */ ++ list_replace_init(&releasing_dquots, &rls_head); ++ spin_unlock(&dq_list_lock); ++ ++restart: ++ synchronize_srcu(&dquot_srcu); ++ spin_lock(&dq_list_lock); ++ while (!list_empty(&rls_head)) { ++ dquot = list_first_entry(&rls_head, struct dquot, dq_free); ++ /* Dquot got used again? */ ++ if (atomic_read(&dquot->dq_count) > 1) { ++ remove_free_dquot(dquot); ++ atomic_dec(&dquot->dq_count); ++ continue; ++ } ++ if (dquot_dirty(dquot)) { ++ spin_unlock(&dq_list_lock); ++ /* Commit dquot before releasing */ ++ dquot_write_dquot(dquot); ++ goto restart; ++ } ++ if (dquot_active(dquot)) { ++ spin_unlock(&dq_list_lock); ++ dquot->dq_sb->dq_op->release_dquot(dquot); ++ goto restart; ++ } ++ /* Dquot is inactive and clean, now move it to free list */ ++ remove_free_dquot(dquot); ++ atomic_dec(&dquot->dq_count); ++ put_dquot_last(dquot); ++ } ++ spin_unlock(&dq_list_lock); ++} ++ + /* + * Put reference to dquot + */ +@@ -786,7 +856,7 @@ void dqput(struct dquot *dquot) + } + #endif + dqstats_inc(DQST_DROPS); +-we_slept: ++ + spin_lock(&dq_list_lock); + if (atomic_read(&dquot->dq_count) > 1) { + /* We have more than one user... nothing to do */ +@@ -798,25 +868,15 @@ void dqput(struct dquot *dquot) + spin_unlock(&dq_list_lock); + return; + } ++ + /* Need to release dquot? */ +- if (dquot_dirty(dquot)) { +- spin_unlock(&dq_list_lock); +- /* Commit dquot before releasing */ +- dquot_write_dquot(dquot); +- goto we_slept; +- } +- if (dquot_active(dquot)) { +- spin_unlock(&dq_list_lock); +- dquot->dq_sb->dq_op->release_dquot(dquot); +- goto we_slept; +- } +- atomic_dec(&dquot->dq_count); + #ifdef CONFIG_QUOTA_DEBUG + /* sanity check */ + BUG_ON(!list_empty(&dquot->dq_free)); + #endif +- put_dquot_last(dquot); ++ put_releasing_dquots(dquot); + spin_unlock(&dq_list_lock); ++ queue_delayed_work(system_unbound_wq, "a_release_work, 1); + } + EXPORT_SYMBOL(dqput); + +-- +2.40.1 + diff --git a/queue-6.1/quota-rename-dquot_active-to-inode_quota_active.patch b/queue-6.1/quota-rename-dquot_active-to-inode_quota_active.patch new file mode 100644 index 00000000000..aef6b541ff9 --- /dev/null +++ b/queue-6.1/quota-rename-dquot_active-to-inode_quota_active.patch @@ -0,0 +1,121 @@ +From 240d4f74ca1d5804af1ebee99aa033e5176ca4da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 19:08:19 +0800 +Subject: quota: rename dquot_active() to inode_quota_active() + +From: Baokun Li + +[ Upstream commit 4b9bdfa16535de8f49bf954aeed0f525ee2fc322 ] + +Now we have a helper function dquot_dirty() to determine if dquot has +DQ_MOD_B bit. dquot_active() can easily be misunderstood as a helper +function to determine if dquot has DQ_ACTIVE_B bit. So we avoid this by +renaming it to inode_quota_active() and later on we will add the helper +function dquot_active() to determine if dquot has DQ_ACTIVE_B bit. + +Signed-off-by: Baokun Li +Signed-off-by: Jan Kara +Message-Id: <20230630110822.3881712-3-libaokun1@huawei.com> +Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 5541960ad0252..f9f0610b504df 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -1418,7 +1418,7 @@ static int info_bdq_free(struct dquot *dquot, qsize_t space) + return QUOTA_NL_NOWARN; + } + +-static int dquot_active(const struct inode *inode) ++static int inode_quota_active(const struct inode *inode) + { + struct super_block *sb = inode->i_sb; + +@@ -1441,7 +1441,7 @@ static int __dquot_initialize(struct inode *inode, int type) + qsize_t rsv; + int ret = 0; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return 0; + + dquots = i_dquot(inode); +@@ -1549,7 +1549,7 @@ bool dquot_initialize_needed(struct inode *inode) + struct dquot **dquots; + int i; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return false; + + dquots = i_dquot(inode); +@@ -1660,7 +1660,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) + int reserve = flags & DQUOT_SPACE_RESERVE; + struct dquot **dquots; + +- if (!dquot_active(inode)) { ++ if (!inode_quota_active(inode)) { + if (reserve) { + spin_lock(&inode->i_lock); + *inode_reserved_space(inode) += number; +@@ -1730,7 +1730,7 @@ int dquot_alloc_inode(struct inode *inode) + struct dquot_warn warn[MAXQUOTAS]; + struct dquot * const *dquots; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return 0; + for (cnt = 0; cnt < MAXQUOTAS; cnt++) + warn[cnt].w_type = QUOTA_NL_NOWARN; +@@ -1773,7 +1773,7 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) + struct dquot **dquots; + int cnt, index; + +- if (!dquot_active(inode)) { ++ if (!inode_quota_active(inode)) { + spin_lock(&inode->i_lock); + *inode_reserved_space(inode) -= number; + __inode_add_bytes(inode, number); +@@ -1815,7 +1815,7 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) + struct dquot **dquots; + int cnt, index; + +- if (!dquot_active(inode)) { ++ if (!inode_quota_active(inode)) { + spin_lock(&inode->i_lock); + *inode_reserved_space(inode) += number; + __inode_sub_bytes(inode, number); +@@ -1859,7 +1859,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) + struct dquot **dquots; + int reserve = flags & DQUOT_SPACE_RESERVE, index; + +- if (!dquot_active(inode)) { ++ if (!inode_quota_active(inode)) { + if (reserve) { + spin_lock(&inode->i_lock); + *inode_reserved_space(inode) -= number; +@@ -1914,7 +1914,7 @@ void dquot_free_inode(struct inode *inode) + struct dquot * const *dquots; + int index; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return; + + dquots = i_dquot(inode); +@@ -2086,7 +2086,7 @@ int dquot_transfer(struct user_namespace *mnt_userns, struct inode *inode, + struct super_block *sb = inode->i_sb; + int ret; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return 0; + + if (i_uid_needs_update(mnt_userns, iattr, inode)) { +-- +2.40.1 + diff --git a/queue-6.1/rdma-efa-fix-wrong-resources-deallocation-order.patch b/queue-6.1/rdma-efa-fix-wrong-resources-deallocation-order.patch new file mode 100644 index 00000000000..b726eb0818f --- /dev/null +++ b/queue-6.1/rdma-efa-fix-wrong-resources-deallocation-order.patch @@ -0,0 +1,62 @@ +From d5845a473f0b1770778e3f8cb57cae4ef1247a42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Aug 2023 08:27:25 +0000 +Subject: RDMA/efa: Fix wrong resources deallocation order + +From: Yonatan Nachum + +[ Upstream commit dc202c57e9a1423aed528e4b8dc949509cd32191 ] + +When trying to destroy QP or CQ, we first decrease the refcount and +potentially free memory regions allocated for the object and then +request the device to destroy the object. If the device fails, the +object isn't fully destroyed so the user/IB core can try to destroy the +object again which will lead to underflow when trying to decrease an +already zeroed refcount. + +Deallocate resources in reverse order of allocating them to safely free +them. + +Fixes: ff6629f88c52 ("RDMA/efa: Do not delay freeing of DMA pages") +Reviewed-by: Michael Margolin +Reviewed-by: Yossi Leybovich +Signed-off-by: Yonatan Nachum +Link: https://lore.kernel.org/r/20230822082725.31719-1-ynachum@amazon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/efa/efa_verbs.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c +index f9526a4c75b26..90d5f1a96f3e5 100644 +--- a/drivers/infiniband/hw/efa/efa_verbs.c ++++ b/drivers/infiniband/hw/efa/efa_verbs.c +@@ -443,12 +443,12 @@ int efa_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) + + ibdev_dbg(&dev->ibdev, "Destroy qp[%u]\n", ibqp->qp_num); + +- efa_qp_user_mmap_entries_remove(qp); +- + err = efa_destroy_qp_handle(dev, qp->qp_handle); + if (err) + return err; + ++ efa_qp_user_mmap_entries_remove(qp); ++ + if (qp->rq_cpu_addr) { + ibdev_dbg(&dev->ibdev, + "qp->cpu_addr[0x%p] freed: size[%lu], dma[%pad]\n", +@@ -1007,8 +1007,8 @@ int efa_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + "Destroy cq[%d] virt[0x%p] freed: size[%lu], dma[%pad]\n", + cq->cq_idx, cq->cpu_addr, cq->size, &cq->dma_addr); + +- efa_cq_user_mmap_entries_remove(cq); + efa_destroy_cq_idx(dev, cq->cq_idx); ++ efa_cq_user_mmap_entries_remove(cq); + if (cq->eq) { + xa_erase(&dev->cqs_xa, cq->cq_idx); + synchronize_irq(cq->eq->irq.irqn); +-- +2.40.1 + diff --git a/queue-6.1/rdma-hns-fix-cq-and-qp-cache-affinity.patch b/queue-6.1/rdma-hns-fix-cq-and-qp-cache-affinity.patch new file mode 100644 index 00000000000..2599a67ac10 --- /dev/null +++ b/queue-6.1/rdma-hns-fix-cq-and-qp-cache-affinity.patch @@ -0,0 +1,106 @@ +From 53681258bb622aab60578df151c840fb395d5ca4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 09:27:11 +0800 +Subject: RDMA/hns: Fix CQ and QP cache affinity + +From: Chengchang Tang + +[ Upstream commit 9e03dbea2b0634b21a45946b4f8097e0dc86ebe1 ] + +Currently, the affinity between QP cache and CQ cache is not +considered when assigning QPN, it will affect the message rate of HW. + +Allocate QPN from QP cache with better CQ affinity to get better +performance. + +Fixes: 71586dd20010 ("RDMA/hns: Create QP with selected QPN for bank load balance") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20230804012711.808069-5-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_device.h | 1 + + drivers/infiniband/hw/hns/hns_roce_qp.c | 28 ++++++++++++++++----- + 2 files changed, 23 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h +index f701cc86896b3..1112afa0af552 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_device.h ++++ b/drivers/infiniband/hw/hns/hns_roce_device.h +@@ -97,6 +97,7 @@ + #define HNS_ROCE_CQ_BANK_NUM 4 + + #define CQ_BANKID_SHIFT 2 ++#define CQ_BANKID_MASK GENMASK(1, 0) + + enum { + SERV_TYPE_RC, +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index 0ae335fb205ca..7a95f8677a02c 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -170,14 +170,29 @@ static void hns_roce_ib_qp_event(struct hns_roce_qp *hr_qp, + } + } + +-static u8 get_least_load_bankid_for_qp(struct hns_roce_bank *bank) ++static u8 get_affinity_cq_bank(u8 qp_bank) + { +- u32 least_load = bank[0].inuse; ++ return (qp_bank >> 1) & CQ_BANKID_MASK; ++} ++ ++static u8 get_least_load_bankid_for_qp(struct ib_qp_init_attr *init_attr, ++ struct hns_roce_bank *bank) ++{ ++#define INVALID_LOAD_QPNUM 0xFFFFFFFF ++ struct ib_cq *scq = init_attr->send_cq; ++ u32 least_load = INVALID_LOAD_QPNUM; ++ unsigned long cqn = 0; + u8 bankid = 0; + u32 bankcnt; + u8 i; + +- for (i = 1; i < HNS_ROCE_QP_BANK_NUM; i++) { ++ if (scq) ++ cqn = to_hr_cq(scq)->cqn; ++ ++ for (i = 0; i < HNS_ROCE_QP_BANK_NUM; i++) { ++ if (scq && (get_affinity_cq_bank(i) != (cqn & CQ_BANKID_MASK))) ++ continue; ++ + bankcnt = bank[i].inuse; + if (bankcnt < least_load) { + least_load = bankcnt; +@@ -209,7 +224,8 @@ static int alloc_qpn_with_bankid(struct hns_roce_bank *bank, u8 bankid, + + return 0; + } +-static int alloc_qpn(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp) ++static int alloc_qpn(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp, ++ struct ib_qp_init_attr *init_attr) + { + struct hns_roce_qp_table *qp_table = &hr_dev->qp_table; + unsigned long num = 0; +@@ -220,7 +236,7 @@ static int alloc_qpn(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp) + num = 1; + } else { + mutex_lock(&qp_table->bank_mutex); +- bankid = get_least_load_bankid_for_qp(qp_table->bank); ++ bankid = get_least_load_bankid_for_qp(init_attr, qp_table->bank); + + ret = alloc_qpn_with_bankid(&qp_table->bank[bankid], bankid, + &num); +@@ -1146,7 +1162,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev, + goto err_buf; + } + +- ret = alloc_qpn(hr_dev, hr_qp); ++ ret = alloc_qpn(hr_dev, hr_qp, init_attr); + if (ret) { + ibdev_err(ibdev, "failed to alloc QPN, ret = %d.\n", ret); + goto err_qpn; +-- +2.40.1 + diff --git a/queue-6.1/rdma-hns-fix-inaccurate-error-label-name-in-init-ins.patch b/queue-6.1/rdma-hns-fix-inaccurate-error-label-name-in-init-ins.patch new file mode 100644 index 00000000000..1368932c541 --- /dev/null +++ b/queue-6.1/rdma-hns-fix-inaccurate-error-label-name-in-init-ins.patch @@ -0,0 +1,57 @@ +From 789f2aea1cbdea971483126e788386b1452ffe67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 09:27:10 +0800 +Subject: RDMA/hns: Fix inaccurate error label name in init instance + +From: Junxian Huang + +[ Upstream commit c9c0bd3c177d93d80968f720304087ba83fe8f74 ] + +This patch fixes inaccurate error label name in init instance. + +Fixes: 70f92521584f ("RDMA/hns: Use the reserved loopback QPs to free MR before destroying MPT") +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20230804012711.808069-4-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index e9a1985f7f17c..33980485ef5ba 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -6865,14 +6865,14 @@ static int __hns_roce_hw_v2_init_instance(struct hnae3_handle *handle) + ret = hns_roce_init(hr_dev); + if (ret) { + dev_err(hr_dev->dev, "RoCE Engine init failed!\n"); +- goto error_failed_cfg; ++ goto error_failed_roce_init; + } + + if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08) { + ret = free_mr_init(hr_dev); + if (ret) { + dev_err(hr_dev->dev, "failed to init free mr!\n"); +- goto error_failed_roce_init; ++ goto error_failed_free_mr_init; + } + } + +@@ -6880,10 +6880,10 @@ static int __hns_roce_hw_v2_init_instance(struct hnae3_handle *handle) + + return 0; + +-error_failed_roce_init: ++error_failed_free_mr_init: + hns_roce_exit(hr_dev); + +-error_failed_cfg: ++error_failed_roce_init: + kfree(hr_dev->priv); + + error_failed_kzalloc: +-- +2.40.1 + diff --git a/queue-6.1/rdma-hns-fix-incorrect-post-send-with-direct-wqe-of-.patch b/queue-6.1/rdma-hns-fix-incorrect-post-send-with-direct-wqe-of-.patch new file mode 100644 index 00000000000..050dd5295dd --- /dev/null +++ b/queue-6.1/rdma-hns-fix-incorrect-post-send-with-direct-wqe-of-.patch @@ -0,0 +1,49 @@ +From a52810875a2420b508c1125fd3ed99b4e6189868 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 09:27:09 +0800 +Subject: RDMA/hns: Fix incorrect post-send with direct wqe of wr-list + +From: Junxian Huang + +[ Upstream commit 706efac4477cdb8be857f6322457de524acc02ff ] + +Currently, direct wqe is not supported for wr-list. RoCE driver excludes +direct wqe for wr-list by judging whether the number of wr is 1. + +For a wr-list where the second wr is a length-error atomic wr, the +post-send driver handles the first wr and adds 1 to the wr number counter +firstly. While handling the second wr, the driver finds out a length error +and terminates the wr handle process, remaining the counter at 1. This +causes the driver mistakenly judges there is only 1 wr and thus enters +the direct wqe process, carrying the current length-error atomic wqe. + +This patch fixes the error by adding a judgement whether the current wr +is a bad wr. If so, use the normal doorbell process but not direct wqe +despite the wr number is 1. + +Fixes: 01584a5edcc4 ("RDMA/hns: Add support of direct wqe") +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20230804012711.808069-3-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 34a270b6891a9..e9a1985f7f17c 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -757,7 +757,8 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, + qp->sq.head += nreq; + qp->next_sge = sge_idx; + +- if (nreq == 1 && (qp->en_flags & HNS_ROCE_QP_CAP_DIRECT_WQE)) ++ if (nreq == 1 && !ret && ++ (qp->en_flags & HNS_ROCE_QP_CAP_DIRECT_WQE)) + write_dwqe(hr_dev, qp, wqe); + else + update_sq_db(hr_dev, qp); +-- +2.40.1 + diff --git a/queue-6.1/rdma-hns-fix-port-active-speed.patch b/queue-6.1/rdma-hns-fix-port-active-speed.patch new file mode 100644 index 00000000000..1968f1655d3 --- /dev/null +++ b/queue-6.1/rdma-hns-fix-port-active-speed.patch @@ -0,0 +1,52 @@ +From f06cf20e10b6a1b013e8cfdd51c4cec6d813321d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 09:27:08 +0800 +Subject: RDMA/hns: Fix port active speed + +From: Chengchang Tang + +[ Upstream commit df1bcf90a66a10967a3a43510b42cb3566208011 ] + +HW supports a variety of different speed, but the current speed +is fixed. + +The real speed should be querried from ethernet. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20230804012711.808069-2-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_main.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c +index 946ba1109e878..da1b33d818d82 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_main.c ++++ b/drivers/infiniband/hw/hns/hns_roce_main.c +@@ -219,6 +219,7 @@ static int hns_roce_query_port(struct ib_device *ib_dev, u32 port_num, + unsigned long flags; + enum ib_mtu mtu; + u32 port; ++ int ret; + + port = port_num - 1; + +@@ -231,8 +232,10 @@ static int hns_roce_query_port(struct ib_device *ib_dev, u32 port_num, + IB_PORT_BOOT_MGMT_SUP; + props->max_msg_sz = HNS_ROCE_MAX_MSG_LEN; + props->pkey_tbl_len = 1; +- props->active_width = IB_WIDTH_4X; +- props->active_speed = 1; ++ ret = ib_get_eth_speed(ib_dev, port_num, &props->active_speed, ++ &props->active_width); ++ if (ret) ++ ibdev_warn(ib_dev, "failed to get speed, ret = %d.\n", ret); + + spin_lock_irqsave(&hr_dev->iboe.lock, flags); + +-- +2.40.1 + diff --git a/queue-6.1/rdma-irdma-prevent-zero-length-stag-registration.patch b/queue-6.1/rdma-irdma-prevent-zero-length-stag-registration.patch new file mode 100644 index 00000000000..432413781a4 --- /dev/null +++ b/queue-6.1/rdma-irdma-prevent-zero-length-stag-registration.patch @@ -0,0 +1,126 @@ +From 709359a0464e776b12f19e2128f333a29ebcd616 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 09:48:38 -0500 +Subject: RDMA/irdma: Prevent zero-length STAG registration + +From: Christopher Bednarz + +[ Upstream commit bb6d73d9add68ad270888db327514384dfa44958 ] + +Currently irdma allows zero-length STAGs to be programmed in HW during +the kernel mode fast register flow. Zero-length MR or STAG registration +disable HW memory length checks. + +Improve gaps in bounds checking in irdma by preventing zero-length STAG or +MR registrations except if the IB_PD_UNSAFE_GLOBAL_RKEY is set. + +This addresses the disclosure CVE-2023-25775. + +Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") +Signed-off-by: Christopher Bednarz +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20230818144838.1758-1-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/ctrl.c | 6 ++++++ + drivers/infiniband/hw/irdma/type.h | 2 ++ + drivers/infiniband/hw/irdma/verbs.c | 10 ++++++++-- + 3 files changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/ctrl.c b/drivers/infiniband/hw/irdma/ctrl.c +index 6544c9c60b7db..d98bfb83c3b4b 100644 +--- a/drivers/infiniband/hw/irdma/ctrl.c ++++ b/drivers/infiniband/hw/irdma/ctrl.c +@@ -1061,6 +1061,9 @@ static int irdma_sc_alloc_stag(struct irdma_sc_dev *dev, + u64 hdr; + enum irdma_page_size page_size; + ++ if (!info->total_len && !info->all_memory) ++ return -EINVAL; ++ + if (info->page_size == 0x40000000) + page_size = IRDMA_PAGE_SIZE_1G; + else if (info->page_size == 0x200000) +@@ -1126,6 +1129,9 @@ static int irdma_sc_mr_reg_non_shared(struct irdma_sc_dev *dev, + u8 addr_type; + enum irdma_page_size page_size; + ++ if (!info->total_len && !info->all_memory) ++ return -EINVAL; ++ + if (info->page_size == 0x40000000) + page_size = IRDMA_PAGE_SIZE_1G; + else if (info->page_size == 0x200000) +diff --git a/drivers/infiniband/hw/irdma/type.h b/drivers/infiniband/hw/irdma/type.h +index d6cb94dc744c5..1c7cbf7c67bed 100644 +--- a/drivers/infiniband/hw/irdma/type.h ++++ b/drivers/infiniband/hw/irdma/type.h +@@ -1015,6 +1015,7 @@ struct irdma_allocate_stag_info { + bool remote_access:1; + bool use_hmc_fcn_index:1; + bool use_pf_rid:1; ++ bool all_memory:1; + u8 hmc_fcn_index; + }; + +@@ -1042,6 +1043,7 @@ struct irdma_reg_ns_stag_info { + bool use_hmc_fcn_index:1; + u8 hmc_fcn_index; + bool use_pf_rid:1; ++ bool all_memory:1; + }; + + struct irdma_fast_reg_stag_info { +diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c +index 5962261f1b156..3b8b2341981ea 100644 +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -2557,7 +2557,8 @@ static int irdma_hw_alloc_stag(struct irdma_device *iwdev, + struct irdma_mr *iwmr) + { + struct irdma_allocate_stag_info *info; +- struct irdma_pd *iwpd = to_iwpd(iwmr->ibmr.pd); ++ struct ib_pd *pd = iwmr->ibmr.pd; ++ struct irdma_pd *iwpd = to_iwpd(pd); + int status; + struct irdma_cqp_request *cqp_request; + struct cqp_cmds_info *cqp_info; +@@ -2573,6 +2574,7 @@ static int irdma_hw_alloc_stag(struct irdma_device *iwdev, + info->stag_idx = iwmr->stag >> IRDMA_CQPSQ_STAG_IDX_S; + info->pd_id = iwpd->sc_pd.pd_id; + info->total_len = iwmr->len; ++ info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY; + info->remote_access = true; + cqp_info->cqp_cmd = IRDMA_OP_ALLOC_STAG; + cqp_info->post_sq = 1; +@@ -2620,6 +2622,8 @@ static struct ib_mr *irdma_alloc_mr(struct ib_pd *pd, enum ib_mr_type mr_type, + iwmr->type = IRDMA_MEMREG_TYPE_MEM; + palloc = &iwpbl->pble_alloc; + iwmr->page_cnt = max_num_sg; ++ /* Use system PAGE_SIZE as the sg page sizes are unknown at this point */ ++ iwmr->len = max_num_sg * PAGE_SIZE; + err_code = irdma_get_pble(iwdev->rf->pble_rsrc, palloc, iwmr->page_cnt, + false); + if (err_code) +@@ -2699,7 +2703,8 @@ static int irdma_hwreg_mr(struct irdma_device *iwdev, struct irdma_mr *iwmr, + { + struct irdma_pbl *iwpbl = &iwmr->iwpbl; + struct irdma_reg_ns_stag_info *stag_info; +- struct irdma_pd *iwpd = to_iwpd(iwmr->ibmr.pd); ++ struct ib_pd *pd = iwmr->ibmr.pd; ++ struct irdma_pd *iwpd = to_iwpd(pd); + struct irdma_pble_alloc *palloc = &iwpbl->pble_alloc; + struct irdma_cqp_request *cqp_request; + struct cqp_cmds_info *cqp_info; +@@ -2718,6 +2723,7 @@ static int irdma_hwreg_mr(struct irdma_device *iwdev, struct irdma_mr *iwmr, + stag_info->total_len = iwmr->len; + stag_info->access_rights = irdma_get_mr_access(access); + stag_info->pd_id = iwpd->sc_pd.pd_id; ++ stag_info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY; + if (stag_info->access_rights & IRDMA_ACCESS_FLAGS_ZERO_BASED) + stag_info->addr_type = IRDMA_ADDR_TYPE_ZERO_BASED; + else +-- +2.40.1 + diff --git a/queue-6.1/rdma-irdma-replace-one-element-array-with-flexible-a.patch b/queue-6.1/rdma-irdma-replace-one-element-array-with-flexible-a.patch new file mode 100644 index 00000000000..c8b7e59238c --- /dev/null +++ b/queue-6.1/rdma-irdma-replace-one-element-array-with-flexible-a.patch @@ -0,0 +1,74 @@ +From ebd9998db8ba80522960fd56f00bbc91e8aa2274 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Aug 2023 08:46:26 -0600 +Subject: RDMA/irdma: Replace one-element array with flexible-array member + +From: Gustavo A. R. Silva + +[ Upstream commit 38313c6d2a02c28162e06753b01bd885caf9386d ] + +One-element and zero-length arrays are deprecated. So, replace +one-element array in struct irdma_qvlist_info with flexible-array +member. + +A patch for this was sent a while ago[1]. However, it seems that, at +the time, the changes were partially folded[2][3], and the actual +flexible-array transformation was omitted. This patch fixes that. + +The only binary difference seen before/after changes is shown below: + +| drivers/infiniband/hw/irdma/hw.o +| @@ -868,7 +868,7 @@ +| drivers/infiniband/hw/irdma/hw.c:484 (discriminator 2) +| size += struct_size(iw_qvlist, qv_info, rf->msix_count); +| 55b: imul $0x45c,%rdi,%rdi +|- 562: add $0x10,%rdi +|+ 562: add $0x4,%rdi + +which is, of course, expected as it reflects the mistake made +while folding the patch I've mentioned above. + +Worth mentioning is the fact that with this change we save 12 bytes +of memory, as can be inferred from the diff snapshot above. Notice +that: + +$ pahole -C rdma_qv_info idrivers/infiniband/hw/irdma/hw.o +struct irdma_qv_info { + u32 v_idx; /* 0 4 */ + u16 ceq_idx; /* 4 2 */ + u16 aeq_idx; /* 6 2 */ + u8 itr_idx; /* 8 1 */ + + /* size: 12, cachelines: 1, members: 4 */ + /* padding: 3 */ + /* last cacheline: 12 bytes */ +}; + +Link: https://lore.kernel.org/linux-hardening/20210525230038.GA175516@embeddedor/ [1] +Link: https://lore.kernel.org/linux-hardening/bf46b428deef4e9e89b0ea1704b1f0e5@intel.com/ [2] +Link: https://lore.kernel.org/linux-rdma/20210520143809.819-1-shiraz.saleem@intel.com/T/#u [3] +Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") +Signed-off-by: Gustavo A. R. Silva +Link: https://lore.kernel.org/r/ZMpsQrZadBaJGkt4@work +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/main.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/irdma/main.h b/drivers/infiniband/hw/irdma/main.h +index e64205839d039..9cbe64311f985 100644 +--- a/drivers/infiniband/hw/irdma/main.h ++++ b/drivers/infiniband/hw/irdma/main.h +@@ -236,7 +236,7 @@ struct irdma_qv_info { + + struct irdma_qvlist_info { + u32 num_vectors; +- struct irdma_qv_info qv_info[1]; ++ struct irdma_qv_info qv_info[]; + }; + + struct irdma_gen_ops { +-- +2.40.1 + diff --git a/queue-6.1/rdma-qedr-remove-a-duplicate-assignment-in-irdma_que.patch b/queue-6.1/rdma-qedr-remove-a-duplicate-assignment-in-irdma_que.patch new file mode 100644 index 00000000000..7cf9a5498e4 --- /dev/null +++ b/queue-6.1/rdma-qedr-remove-a-duplicate-assignment-in-irdma_que.patch @@ -0,0 +1,36 @@ +From 5edc03fb7be5d51e301331db71270f19687e0cad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 10:27:03 +0800 +Subject: RDMA/qedr: Remove a duplicate assignment in irdma_query_ah() + +From: Minjie Du + +[ Upstream commit 65e02e840847158c7ee48ca8e6e91062b0f78662 ] + +Delete a duplicate statement from this function implementation. + +Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") +Signed-off-by: Minjie Du +Acked-by: Alok Prasad +Link: https://lore.kernel.org/r/20230706022704.1260-1-duminjie@vivo.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/verbs.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c +index 6a8bb6ed4bf43..5962261f1b156 100644 +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -4354,7 +4354,6 @@ static int irdma_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr) + ah_attr->grh.traffic_class = ah->sc_ah.ah_info.tc_tos; + ah_attr->grh.hop_limit = ah->sc_ah.ah_info.hop_ttl; + ah_attr->grh.sgid_index = ah->sgid_index; +- ah_attr->grh.sgid_index = ah->sgid_index; + memcpy(&ah_attr->grh.dgid, &ah->dgid, + sizeof(ah_attr->grh.dgid)); + } +-- +2.40.1 + diff --git a/queue-6.1/rdma-rxe-fix-incomplete-state-save-in-rxe_requester.patch b/queue-6.1/rdma-rxe-fix-incomplete-state-save-in-rxe_requester.patch new file mode 100644 index 00000000000..8dfba61906a --- /dev/null +++ b/queue-6.1/rdma-rxe-fix-incomplete-state-save-in-rxe_requester.patch @@ -0,0 +1,124 @@ +From 90ee52fd5df4640b23a957b90a76dc28f090a4ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 15:07:49 -0500 +Subject: RDMA/rxe: Fix incomplete state save in rxe_requester + +From: Bob Pearson + +[ Upstream commit 5d122db2ff80cd2aed4dcd630befb56b51ddf947 ] + +If a send packet is dropped by the IP layer in rxe_requester() +the call to rxe_xmit_packet() can fail with err == -EAGAIN. +To recover, the state of the wqe is restored to the state before +the packet was sent so it can be resent. However, the routines +that save and restore the state miss a significnt part of the +variable state in the wqe, the dma struct which is used to process +through the sge table. And, the state is not saved before the packet +is built which modifies the dma struct. + +Under heavy stress testing with many QPs on a fast node sending +large messages to a slow node dropped packets are observed and +the resent packets are corrupted because the dma struct was not +restored. This patch fixes this behavior and allows the test cases +to succeed. + +Fixes: 3050b9985024 ("IB/rxe: Fix race condition between requester and completer") +Link: https://lore.kernel.org/r/20230721200748.4604-1-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_req.c | 45 ++++++++++++++++------------- + 1 file changed, 25 insertions(+), 20 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index 41f1d84f0acbf..2ace1007a4195 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -529,10 +529,11 @@ static void save_state(struct rxe_send_wqe *wqe, + struct rxe_send_wqe *rollback_wqe, + u32 *rollback_psn) + { +- rollback_wqe->state = wqe->state; ++ rollback_wqe->state = wqe->state; + rollback_wqe->first_psn = wqe->first_psn; +- rollback_wqe->last_psn = wqe->last_psn; +- *rollback_psn = qp->req.psn; ++ rollback_wqe->last_psn = wqe->last_psn; ++ rollback_wqe->dma = wqe->dma; ++ *rollback_psn = qp->req.psn; + } + + static void rollback_state(struct rxe_send_wqe *wqe, +@@ -540,10 +541,11 @@ static void rollback_state(struct rxe_send_wqe *wqe, + struct rxe_send_wqe *rollback_wqe, + u32 rollback_psn) + { +- wqe->state = rollback_wqe->state; ++ wqe->state = rollback_wqe->state; + wqe->first_psn = rollback_wqe->first_psn; +- wqe->last_psn = rollback_wqe->last_psn; +- qp->req.psn = rollback_psn; ++ wqe->last_psn = rollback_wqe->last_psn; ++ wqe->dma = rollback_wqe->dma; ++ qp->req.psn = rollback_psn; + } + + static void update_state(struct rxe_qp *qp, struct rxe_pkt_info *pkt) +@@ -746,6 +748,9 @@ int rxe_requester(void *arg) + pkt.mask = rxe_opcode[opcode].mask; + pkt.wqe = wqe; + ++ /* save wqe state before we build and send packet */ ++ save_state(wqe, qp, &rollback_wqe, &rollback_psn); ++ + av = rxe_get_av(&pkt, &ah); + if (unlikely(!av)) { + pr_err("qp#%d Failed no address vector\n", qp_num(qp)); +@@ -778,29 +783,29 @@ int rxe_requester(void *arg) + if (ah) + rxe_put(ah); + +- /* +- * To prevent a race on wqe access between requester and completer, +- * wqe members state and psn need to be set before calling +- * rxe_xmit_packet(). +- * Otherwise, completer might initiate an unjustified retry flow. +- */ +- save_state(wqe, qp, &rollback_wqe, &rollback_psn); ++ /* update wqe state as though we had sent it */ + update_wqe_state(qp, wqe, &pkt); + update_wqe_psn(qp, wqe, &pkt, payload); + + err = rxe_xmit_packet(qp, &pkt, skb); + if (err) { +- qp->need_req_skb = 1; ++ if (err != -EAGAIN) { ++ wqe->status = IB_WC_LOC_QP_OP_ERR; ++ goto err; ++ } + ++ /* the packet was dropped so reset wqe to the state ++ * before we sent it so we can try to resend ++ */ + rollback_state(wqe, qp, &rollback_wqe, rollback_psn); + +- if (err == -EAGAIN) { +- rxe_sched_task(&qp->req.task); +- goto exit; +- } ++ /* force a delay until the dropped packet is freed and ++ * the send queue is drained below the low water mark ++ */ ++ qp->need_req_skb = 1; + +- wqe->status = IB_WC_LOC_QP_OP_ERR; +- goto err; ++ rxe_sched_task(&qp->req.task); ++ goto exit; + } + + update_state(qp, &pkt); +-- +2.40.1 + diff --git a/queue-6.1/rdma-rxe-split-rxe_run_task-into-two-subroutines.patch b/queue-6.1/rdma-rxe-split-rxe_run_task-into-two-subroutines.patch new file mode 100644 index 00000000000..37567fdf1a8 --- /dev/null +++ b/queue-6.1/rdma-rxe-split-rxe_run_task-into-two-subroutines.patch @@ -0,0 +1,314 @@ +From c0dcb8c9d72ad7aa7dffe7440501fd4abc29db74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 15:01:05 -0500 +Subject: RDMA/rxe: Split rxe_run_task() into two subroutines + +From: Bob Pearson + +[ Upstream commit dccb23f6c312e4480fe32ccbc2afac1a5cac7e5e ] + +Split rxe_run_task(task, sched) into rxe_run_task(task) and +rxe_sched_task(task). + +Link: https://lore.kernel.org/r/20221021200118.2163-5-rpearsonhpe@gmail.com +Signed-off-by: Ian Ziemba +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 5d122db2ff80 ("RDMA/rxe: Fix incomplete state save in rxe_requester") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_comp.c | 19 +++++++++++-------- + drivers/infiniband/sw/rxe/rxe_net.c | 4 ++-- + drivers/infiniband/sw/rxe/rxe_qp.c | 10 +++++----- + drivers/infiniband/sw/rxe/rxe_req.c | 10 +++++----- + drivers/infiniband/sw/rxe/rxe_resp.c | 5 ++++- + drivers/infiniband/sw/rxe/rxe_task.c | 15 ++++++++++----- + drivers/infiniband/sw/rxe/rxe_task.h | 7 +++---- + drivers/infiniband/sw/rxe/rxe_verbs.c | 8 ++++---- + 8 files changed, 44 insertions(+), 34 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c +index fb0c008af78cc..d2a2501236174 100644 +--- a/drivers/infiniband/sw/rxe/rxe_comp.c ++++ b/drivers/infiniband/sw/rxe/rxe_comp.c +@@ -118,7 +118,7 @@ void retransmit_timer(struct timer_list *t) + + if (qp->valid) { + qp->comp.timeout = 1; +- rxe_run_task(&qp->comp.task, 1); ++ rxe_sched_task(&qp->comp.task); + } + } + +@@ -132,7 +132,10 @@ void rxe_comp_queue_pkt(struct rxe_qp *qp, struct sk_buff *skb) + if (must_sched != 0) + rxe_counter_inc(SKB_TO_PKT(skb)->rxe, RXE_CNT_COMPLETER_SCHED); + +- rxe_run_task(&qp->comp.task, must_sched); ++ if (must_sched) ++ rxe_sched_task(&qp->comp.task); ++ else ++ rxe_run_task(&qp->comp.task); + } + + static inline enum comp_state get_wqe(struct rxe_qp *qp, +@@ -305,7 +308,7 @@ static inline enum comp_state check_ack(struct rxe_qp *qp, + qp->comp.psn = pkt->psn; + if (qp->req.wait_psn) { + qp->req.wait_psn = 0; +- rxe_run_task(&qp->req.task, 0); ++ rxe_run_task(&qp->req.task); + } + } + return COMPST_ERROR_RETRY; +@@ -452,7 +455,7 @@ static void do_complete(struct rxe_qp *qp, struct rxe_send_wqe *wqe) + */ + if (qp->req.wait_fence) { + qp->req.wait_fence = 0; +- rxe_run_task(&qp->req.task, 0); ++ rxe_run_task(&qp->req.task); + } + } + +@@ -466,7 +469,7 @@ static inline enum comp_state complete_ack(struct rxe_qp *qp, + if (qp->req.need_rd_atomic) { + qp->comp.timeout_retry = 0; + qp->req.need_rd_atomic = 0; +- rxe_run_task(&qp->req.task, 0); ++ rxe_run_task(&qp->req.task); + } + } + +@@ -512,7 +515,7 @@ static inline enum comp_state complete_wqe(struct rxe_qp *qp, + + if (qp->req.wait_psn) { + qp->req.wait_psn = 0; +- rxe_run_task(&qp->req.task, 1); ++ rxe_sched_task(&qp->req.task); + } + } + +@@ -646,7 +649,7 @@ int rxe_completer(void *arg) + + if (qp->req.wait_psn) { + qp->req.wait_psn = 0; +- rxe_run_task(&qp->req.task, 1); ++ rxe_sched_task(&qp->req.task); + } + + state = COMPST_DONE; +@@ -714,7 +717,7 @@ int rxe_completer(void *arg) + RXE_CNT_COMP_RETRY); + qp->req.need_retry = 1; + qp->comp.started_retry = 1; +- rxe_run_task(&qp->req.task, 0); ++ rxe_run_task(&qp->req.task); + } + goto done; + +diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c +index 65d16024b3bf6..719432808a063 100644 +--- a/drivers/infiniband/sw/rxe/rxe_net.c ++++ b/drivers/infiniband/sw/rxe/rxe_net.c +@@ -348,7 +348,7 @@ static void rxe_skb_tx_dtor(struct sk_buff *skb) + + if (unlikely(qp->need_req_skb && + skb_out < RXE_INFLIGHT_SKBS_PER_QP_LOW)) +- rxe_run_task(&qp->req.task, 1); ++ rxe_sched_task(&qp->req.task); + + rxe_put(qp); + } +@@ -435,7 +435,7 @@ int rxe_xmit_packet(struct rxe_qp *qp, struct rxe_pkt_info *pkt, + if ((qp_type(qp) != IB_QPT_RC) && + (pkt->mask & RXE_END_MASK)) { + pkt->wqe->state = wqe_state_done; +- rxe_run_task(&qp->comp.task, 1); ++ rxe_sched_task(&qp->comp.task); + } + + rxe_counter_inc(rxe, RXE_CNT_SENT_PKTS); +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 59b2024b34ef4..709c63e9773c5 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -539,10 +539,10 @@ static void rxe_qp_drain(struct rxe_qp *qp) + if (qp->req.state != QP_STATE_DRAINED) { + qp->req.state = QP_STATE_DRAIN; + if (qp_type(qp) == IB_QPT_RC) +- rxe_run_task(&qp->comp.task, 1); ++ rxe_sched_task(&qp->comp.task); + else + __rxe_do_task(&qp->comp.task); +- rxe_run_task(&qp->req.task, 1); ++ rxe_sched_task(&qp->req.task); + } + } + } +@@ -556,13 +556,13 @@ void rxe_qp_error(struct rxe_qp *qp) + qp->attr.qp_state = IB_QPS_ERR; + + /* drain work and packet queues */ +- rxe_run_task(&qp->resp.task, 1); ++ rxe_sched_task(&qp->resp.task); + + if (qp_type(qp) == IB_QPT_RC) +- rxe_run_task(&qp->comp.task, 1); ++ rxe_sched_task(&qp->comp.task); + else + __rxe_do_task(&qp->comp.task); +- rxe_run_task(&qp->req.task, 1); ++ rxe_sched_task(&qp->req.task); + } + + /* called by the modify qp verb */ +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index f637712079705..41f1d84f0acbf 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -105,7 +105,7 @@ void rnr_nak_timer(struct timer_list *t) + /* request a send queue retry */ + qp->req.need_retry = 1; + qp->req.wait_for_rnr_timer = 0; +- rxe_run_task(&qp->req.task, 1); ++ rxe_sched_task(&qp->req.task); + } + + static struct rxe_send_wqe *req_next_wqe(struct rxe_qp *qp) +@@ -608,7 +608,7 @@ static int rxe_do_local_ops(struct rxe_qp *qp, struct rxe_send_wqe *wqe) + * which can lead to a deadlock. So go ahead and complete + * it now. + */ +- rxe_run_task(&qp->comp.task, 1); ++ rxe_sched_task(&qp->comp.task); + + return 0; + } +@@ -733,7 +733,7 @@ int rxe_requester(void *arg) + qp->req.wqe_index); + wqe->state = wqe_state_done; + wqe->status = IB_WC_SUCCESS; +- rxe_run_task(&qp->comp.task, 0); ++ rxe_run_task(&qp->comp.task); + goto done; + } + payload = mtu; +@@ -795,7 +795,7 @@ int rxe_requester(void *arg) + rollback_state(wqe, qp, &rollback_wqe, rollback_psn); + + if (err == -EAGAIN) { +- rxe_run_task(&qp->req.task, 1); ++ rxe_sched_task(&qp->req.task); + goto exit; + } + +@@ -817,7 +817,7 @@ int rxe_requester(void *arg) + qp->req.wqe_index = queue_next_index(qp->sq.queue, qp->req.wqe_index); + wqe->state = wqe_state_error; + qp->req.state = QP_STATE_ERROR; +- rxe_run_task(&qp->comp.task, 0); ++ rxe_run_task(&qp->comp.task); + exit: + ret = -EAGAIN; + out: +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index 9f65c346d8432..a45202cecf2d7 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -91,7 +91,10 @@ void rxe_resp_queue_pkt(struct rxe_qp *qp, struct sk_buff *skb) + must_sched = (pkt->opcode == IB_OPCODE_RC_RDMA_READ_REQUEST) || + (skb_queue_len(&qp->req_pkts) > 1); + +- rxe_run_task(&qp->resp.task, must_sched); ++ if (must_sched) ++ rxe_sched_task(&qp->resp.task); ++ else ++ rxe_run_task(&qp->resp.task); + } + + static inline enum resp_states get_req(struct rxe_qp *qp, +diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c +index 182d0532a8ab9..446ee2c3d3813 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.c ++++ b/drivers/infiniband/sw/rxe/rxe_task.c +@@ -127,15 +127,20 @@ void rxe_cleanup_task(struct rxe_task *task) + tasklet_kill(&task->tasklet); + } + +-void rxe_run_task(struct rxe_task *task, int sched) ++void rxe_run_task(struct rxe_task *task) + { + if (task->destroyed) + return; + +- if (sched) +- tasklet_schedule(&task->tasklet); +- else +- rxe_do_task(&task->tasklet); ++ rxe_do_task(&task->tasklet); ++} ++ ++void rxe_sched_task(struct rxe_task *task) ++{ ++ if (task->destroyed) ++ return; ++ ++ tasklet_schedule(&task->tasklet); + } + + void rxe_disable_task(struct rxe_task *task) +diff --git a/drivers/infiniband/sw/rxe/rxe_task.h b/drivers/infiniband/sw/rxe/rxe_task.h +index b3dfd970d1dc6..590b1c1d7e7ca 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.h ++++ b/drivers/infiniband/sw/rxe/rxe_task.h +@@ -52,10 +52,9 @@ int __rxe_do_task(struct rxe_task *task); + */ + void rxe_do_task(struct tasklet_struct *t); + +-/* run a task, else schedule it to run as a tasklet, The decision +- * to run or schedule tasklet is based on the parameter sched. +- */ +-void rxe_run_task(struct rxe_task *task, int sched); ++void rxe_run_task(struct rxe_task *task); ++ ++void rxe_sched_task(struct rxe_task *task); + + /* keep a task from scheduling */ + void rxe_disable_task(struct rxe_task *task); +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index be13bcb4cc406..065717c11cba5 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -678,9 +678,9 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, + wr = next; + } + +- rxe_run_task(&qp->req.task, 1); ++ rxe_sched_task(&qp->req.task); + if (unlikely(qp->req.state == QP_STATE_ERROR)) +- rxe_run_task(&qp->comp.task, 1); ++ rxe_sched_task(&qp->comp.task); + + return err; + } +@@ -702,7 +702,7 @@ static int rxe_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr, + + if (qp->is_user) { + /* Utilize process context to do protocol processing */ +- rxe_run_task(&qp->req.task, 0); ++ rxe_run_task(&qp->req.task); + return 0; + } else + return rxe_post_send_kernel(qp, wr, bad_wr); +@@ -740,7 +740,7 @@ static int rxe_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *wr, + spin_unlock_irqrestore(&rq->producer_lock, flags); + + if (qp->resp.state == QP_STATE_ERROR) +- rxe_run_task(&qp->resp.task, 1); ++ rxe_sched_task(&qp->resp.task); + + return err; + } +-- +2.40.1 + diff --git a/queue-6.1/rdma-siw-balance-the-reference-of-cep-kref-in-the-er.patch b/queue-6.1/rdma-siw-balance-the-reference-of-cep-kref-in-the-er.patch new file mode 100644 index 00000000000..1638c78ed17 --- /dev/null +++ b/queue-6.1/rdma-siw-balance-the-reference-of-cep-kref-in-the-er.patch @@ -0,0 +1,50 @@ +From 5b855a76173a1bdbed41888008d6f35d28b0edad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Aug 2023 21:32:53 +0800 +Subject: RDMA/siw: Balance the reference of cep->kref in the error path + +From: Guoqing Jiang + +[ Upstream commit b056327bee09e6b86683d3f709a438ccd6031d72 ] + +The siw_connect can go to err in below after cep is allocated successfully: + +1. If siw_cm_alloc_work returns failure. In this case socket is not +assoicated with cep so siw_cep_put can't be called by siw_socket_disassoc. +We need to call siw_cep_put twice since cep->kref is increased once after +it was initialized. + +2. If siw_cm_queue_work can't find a work, which means siw_cep_get is not +called in siw_cm_queue_work, so cep->kref is increased twice by siw_cep_get +and when associate socket with cep after it was initialized. So we need to +call siw_cep_put three times (one in siw_socket_disassoc). + +3. siw_send_mpareqrep returns error, this scenario is similar as 2. + +So we need to remove one siw_cep_put in the error path. + +Fixes: 6c52fdc244b5 ("rdma/siw: connection management") +Signed-off-by: Guoqing Jiang +Link: https://lore.kernel.org/r/20230821133255.31111-2-guoqing.jiang@linux.dev +Acked-by: Bernard Metzler +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_cm.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c +index f88d2971c2c63..552d8271e423b 100644 +--- a/drivers/infiniband/sw/siw/siw_cm.c ++++ b/drivers/infiniband/sw/siw/siw_cm.c +@@ -1496,7 +1496,6 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params) + + cep->cm_id = NULL; + id->rem_ref(id); +- siw_cep_put(cep); + + qp->cep = NULL; + siw_cep_put(cep); +-- +2.40.1 + diff --git a/queue-6.1/rdma-siw-correct-wrong-debug-message.patch b/queue-6.1/rdma-siw-correct-wrong-debug-message.patch new file mode 100644 index 00000000000..2214291cdf9 --- /dev/null +++ b/queue-6.1/rdma-siw-correct-wrong-debug-message.patch @@ -0,0 +1,38 @@ +From 64c31e727e9cae1d896d2290cb146b00112dcaee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Aug 2023 21:32:54 +0800 +Subject: RDMA/siw: Correct wrong debug message + +From: Guoqing Jiang + +[ Upstream commit bee024d20451e4ce04ea30099cad09f7f75d288b ] + +We need to print num_sle first then pbl->max_buf per the condition. +Also replace mem->pbl with pbl while at it. + +Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") +Signed-off-by: Guoqing Jiang +Link: https://lore.kernel.org/r/20230821133255.31111-3-guoqing.jiang@linux.dev +Acked-by: Bernard Metzler +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index 2e4cdcd26fe01..193f7d58d3845 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -1494,7 +1494,7 @@ int siw_map_mr_sg(struct ib_mr *base_mr, struct scatterlist *sl, int num_sle, + + if (pbl->max_buf < num_sle) { + siw_dbg_mem(mem, "too many SGE's: %d > %d\n", +- mem->pbl->max_buf, num_sle); ++ num_sle, pbl->max_buf); + return -ENOMEM; + } + for_each_sg(sl, slp, num_sle, i) { +-- +2.40.1 + diff --git a/queue-6.1/rdma-siw-fabricate-a-gid-on-tun-and-loopback-devices.patch b/queue-6.1/rdma-siw-fabricate-a-gid-on-tun-and-loopback-devices.patch new file mode 100644 index 00000000000..8038eb710af --- /dev/null +++ b/queue-6.1/rdma-siw-fabricate-a-gid-on-tun-and-loopback-devices.patch @@ -0,0 +1,118 @@ +From 7c0d1c22a5540165103d96b053e8f9e54b1f8cb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 11:12:12 -0400 +Subject: RDMA/siw: Fabricate a GID on tun and loopback devices + +From: Chuck Lever + +[ Upstream commit bad5b6e34ffbaacc77ad28a0f482e33b3929e635 ] + +LOOPBACK and NONE (tunnel) devices have all-zero MAC addresses. +Currently, siw_device_create() falls back to copying the IB device's +name in those cases, because an all-zero MAC address breaks the RDMA +core address resolution mechanism. + +However, at the point when siw_device_create() constructs a GID, the +ib_device::name field is uninitialized, leaving the MAC address to +remain in an all-zero state. + +Fabricate a random artificial GID for such devices, and ensure this +artificial GID is returned for all device query operations. + +Link: https://lore.kernel.org/r/168960673260.3007.12378736853793339110.stgit@manet.1015granger.net +Reported-by: Tom Talpey +Fixes: a2d36b02c15d ("RDMA/siw: Enable siw on tunnel devices") +Reviewed-by: Bernard Metzler +Reviewed-by: Tom Talpey +Signed-off-by: Chuck Lever +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw.h | 1 + + drivers/infiniband/sw/siw/siw_main.c | 22 ++++++++-------------- + drivers/infiniband/sw/siw/siw_verbs.c | 4 ++-- + 3 files changed, 11 insertions(+), 16 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw.h b/drivers/infiniband/sw/siw/siw.h +index 2f3a9cda3850f..8b4a710b82bc1 100644 +--- a/drivers/infiniband/sw/siw/siw.h ++++ b/drivers/infiniband/sw/siw/siw.h +@@ -74,6 +74,7 @@ struct siw_device { + + u32 vendor_part_id; + int numa_node; ++ char raw_gid[ETH_ALEN]; + + /* physical port state (only one port per device) */ + enum ib_port_state state; +diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c +index 65b5cda5457ba..f45600d169ae7 100644 +--- a/drivers/infiniband/sw/siw/siw_main.c ++++ b/drivers/infiniband/sw/siw/siw_main.c +@@ -75,8 +75,7 @@ static int siw_device_register(struct siw_device *sdev, const char *name) + return rv; + } + +- siw_dbg(base_dev, "HWaddr=%pM\n", sdev->netdev->dev_addr); +- ++ siw_dbg(base_dev, "HWaddr=%pM\n", sdev->raw_gid); + return 0; + } + +@@ -313,24 +312,19 @@ static struct siw_device *siw_device_create(struct net_device *netdev) + return NULL; + + base_dev = &sdev->base_dev; +- + sdev->netdev = netdev; + +- if (netdev->type != ARPHRD_LOOPBACK && netdev->type != ARPHRD_NONE) { +- addrconf_addr_eui48((unsigned char *)&base_dev->node_guid, +- netdev->dev_addr); ++ if (netdev->addr_len) { ++ memcpy(sdev->raw_gid, netdev->dev_addr, ++ min_t(unsigned int, netdev->addr_len, ETH_ALEN)); + } else { + /* +- * This device does not have a HW address, +- * but connection mangagement lib expects gid != 0 ++ * This device does not have a HW address, but ++ * connection mangagement requires a unique gid. + */ +- size_t len = min_t(size_t, strlen(base_dev->name), 6); +- char addr[6] = { }; +- +- memcpy(addr, base_dev->name, len); +- addrconf_addr_eui48((unsigned char *)&base_dev->node_guid, +- addr); ++ eth_random_addr(sdev->raw_gid); + } ++ addrconf_addr_eui48((u8 *)&base_dev->node_guid, sdev->raw_gid); + + base_dev->uverbs_cmd_mask |= BIT_ULL(IB_USER_VERBS_CMD_POST_SEND); + +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index 906fde1a2a0de..2e4cdcd26fe01 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -157,7 +157,7 @@ int siw_query_device(struct ib_device *base_dev, struct ib_device_attr *attr, + attr->vendor_part_id = sdev->vendor_part_id; + + addrconf_addr_eui48((u8 *)&attr->sys_image_guid, +- sdev->netdev->dev_addr); ++ sdev->raw_gid); + + return 0; + } +@@ -218,7 +218,7 @@ int siw_query_gid(struct ib_device *base_dev, u32 port, int idx, + + /* subnet_prefix == interface_id == 0; */ + memset(gid, 0, sizeof(*gid)); +- memcpy(&gid->raw[0], sdev->netdev->dev_addr, 6); ++ memcpy(gid->raw, sdev->raw_gid, ETH_ALEN); + + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/refscale-fix-uninitalized-use-of-wait_queue_head_t.patch b/queue-6.1/refscale-fix-uninitalized-use-of-wait_queue_head_t.patch new file mode 100644 index 00000000000..0ec9be6e428 --- /dev/null +++ b/queue-6.1/refscale-fix-uninitalized-use-of-wait_queue_head_t.patch @@ -0,0 +1,83 @@ +From e9493cf29b43471960844179b8d85461bbf4c1eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 13:53:55 -0400 +Subject: refscale: Fix uninitalized use of wait_queue_head_t + +From: Waiman Long + +[ Upstream commit f5063e8948dad7f31adb007284a5d5038ae31bb8 ] + +Running the refscale test occasionally crashes the kernel with the +following error: + +[ 8569.952896] BUG: unable to handle page fault for address: ffffffffffffffe8 +[ 8569.952900] #PF: supervisor read access in kernel mode +[ 8569.952902] #PF: error_code(0x0000) - not-present page +[ 8569.952904] PGD c4b048067 P4D c4b049067 PUD c4b04b067 PMD 0 +[ 8569.952910] Oops: 0000 [#1] PREEMPT_RT SMP NOPTI +[ 8569.952916] Hardware name: Dell Inc. PowerEdge R750/0WMWCR, BIOS 1.2.4 05/28/2021 +[ 8569.952917] RIP: 0010:prepare_to_wait_event+0x101/0x190 + : +[ 8569.952940] Call Trace: +[ 8569.952941] +[ 8569.952944] ref_scale_reader+0x380/0x4a0 [refscale] +[ 8569.952959] kthread+0x10e/0x130 +[ 8569.952966] ret_from_fork+0x1f/0x30 +[ 8569.952973] + +The likely cause is that init_waitqueue_head() is called after the call to +the torture_create_kthread() function that creates the ref_scale_reader +kthread. Although this init_waitqueue_head() call will very likely +complete before this kthread is created and starts running, it is +possible that the calling kthread will be delayed between the calls to +torture_create_kthread() and init_waitqueue_head(). In this case, the +new kthread will use the waitqueue head before it is properly initialized, +which is not good for the kernel's health and well-being. + +The above crash happened here: + + static inline void __add_wait_queue(...) + { + : + if (!(wq->flags & WQ_FLAG_PRIORITY)) <=== Crash here + +The offset of flags from list_head entry in wait_queue_entry is +-0x18. If reader_tasks[i].wq.head.next is NULL as allocated reader_task +structure is zero initialized, the instruction will try to access address +0xffffffffffffffe8, which is exactly the fault address listed above. + +This commit therefore invokes init_waitqueue_head() before creating +the kthread. + +Fixes: 653ed64b01dc ("refperf: Add a test to measure performance of read-side synchronization") +Signed-off-by: Waiman Long +Reviewed-by: Qiuxu Zhuo +Reviewed-by: Davidlohr Bueso +Acked-by: Joel Fernandes (Google) +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/refscale.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/kernel/rcu/refscale.c b/kernel/rcu/refscale.c +index d49a9d66e0000..3a93c53f615f0 100644 +--- a/kernel/rcu/refscale.c ++++ b/kernel/rcu/refscale.c +@@ -867,12 +867,11 @@ ref_scale_init(void) + VERBOSE_SCALEOUT("Starting %d reader threads", nreaders); + + for (i = 0; i < nreaders; i++) { ++ init_waitqueue_head(&reader_tasks[i].wq); + firsterr = torture_create_kthread(ref_scale_reader, (void *)i, + reader_tasks[i].task); + if (torture_init_error(firsterr)) + goto unwind; +- +- init_waitqueue_head(&(reader_tasks[i].wq)); + } + + // Main Task +-- +2.40.1 + diff --git a/queue-6.1/regmap-rbtree-use-alloc_flags-for-memory-allocations.patch b/queue-6.1/regmap-rbtree-use-alloc_flags-for-memory-allocations.patch new file mode 100644 index 00000000000..7b4681d7324 --- /dev/null +++ b/queue-6.1/regmap-rbtree-use-alloc_flags-for-memory-allocations.patch @@ -0,0 +1,98 @@ +From da350f4ffcf62f2f0c034136cc7d6dd808b1c59a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 17:55:33 +0300 +Subject: regmap: rbtree: Use alloc_flags for memory allocations + +From: Dan Carpenter + +[ Upstream commit 0c8b0bf42c8cef56f7cd9cd876fbb7ece9217064 ] + +The kunit tests discovered a sleeping in atomic bug. The allocations +in the regcache-rbtree code should use the map->alloc_flags instead of +GFP_KERNEL. + +[ 5.005510] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:306 +[ 5.005960] in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 117, name: kunit_try_catch +[ 5.006219] preempt_count: 1, expected: 0 +[ 5.006414] 1 lock held by kunit_try_catch/117: +[ 5.006590] #0: 833b9010 (regmap_kunit:86:(config)->lock){....}-{2:2}, at: regmap_lock_spinlock+0x14/0x1c +[ 5.007493] irq event stamp: 162 +[ 5.007627] hardirqs last enabled at (161): [<80786738>] crng_make_state+0x1a0/0x294 +[ 5.007871] hardirqs last disabled at (162): [<80c531ec>] _raw_spin_lock_irqsave+0x7c/0x80 +[ 5.008119] softirqs last enabled at (0): [<801110ac>] copy_process+0x810/0x2138 +[ 5.008356] softirqs last disabled at (0): [<00000000>] 0x0 +[ 5.008688] CPU: 0 PID: 117 Comm: kunit_try_catch Tainted: G N 6.4.4-rc3-g0e8d2fdfb188 #1 +[ 5.009011] Hardware name: Generic DT based system +[ 5.009277] unwind_backtrace from show_stack+0x18/0x1c +[ 5.009497] show_stack from dump_stack_lvl+0x38/0x5c +[ 5.009676] dump_stack_lvl from __might_resched+0x188/0x2d0 +[ 5.009860] __might_resched from __kmem_cache_alloc_node+0x1dc/0x25c +[ 5.010061] __kmem_cache_alloc_node from kmalloc_trace+0x30/0xc8 +[ 5.010254] kmalloc_trace from regcache_rbtree_write+0x26c/0x468 +[ 5.010446] regcache_rbtree_write from _regmap_write+0x88/0x140 +[ 5.010634] _regmap_write from regmap_write+0x44/0x68 +[ 5.010803] regmap_write from basic_read_write+0x8c/0x270 +[ 5.010980] basic_read_write from kunit_try_run_case+0x48/0xa0 + +Fixes: 28644c809f44 ("regmap: Add the rbtree cache support") +Reported-by: Guenter Roeck +Closes: https://lore.kernel.org/all/ee59d128-413c-48ad-a3aa-d9d350c80042@roeck-us.net/ +Signed-off-by: Dan Carpenter +Tested-by: Guenter Roeck +Link: https://lore.kernel.org/r/58f12a07-5f4b-4a8f-ab84-0a42d1908cb9@moroto.mountain +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regcache-rbtree.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c +index fabf87058d80b..ae6b8788d5f3f 100644 +--- a/drivers/base/regmap/regcache-rbtree.c ++++ b/drivers/base/regmap/regcache-rbtree.c +@@ -277,7 +277,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, + + blk = krealloc(rbnode->block, + blklen * map->cache_word_size, +- GFP_KERNEL); ++ map->alloc_flags); + if (!blk) + return -ENOMEM; + +@@ -286,7 +286,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, + if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) { + present = krealloc(rbnode->cache_present, + BITS_TO_LONGS(blklen) * sizeof(*present), +- GFP_KERNEL); ++ map->alloc_flags); + if (!present) + return -ENOMEM; + +@@ -320,7 +320,7 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg) + const struct regmap_range *range; + int i; + +- rbnode = kzalloc(sizeof(*rbnode), GFP_KERNEL); ++ rbnode = kzalloc(sizeof(*rbnode), map->alloc_flags); + if (!rbnode) + return NULL; + +@@ -346,13 +346,13 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg) + } + + rbnode->block = kmalloc_array(rbnode->blklen, map->cache_word_size, +- GFP_KERNEL); ++ map->alloc_flags); + if (!rbnode->block) + goto err_free; + + rbnode->cache_present = kcalloc(BITS_TO_LONGS(rbnode->blklen), + sizeof(*rbnode->cache_present), +- GFP_KERNEL); ++ map->alloc_flags); + if (!rbnode->cache_present) + goto err_free_block; + +-- +2.40.1 + diff --git a/queue-6.1/reiserfs-check-the-return-value-from-__getblk.patch b/queue-6.1/reiserfs-check-the-return-value-from-__getblk.patch new file mode 100644 index 00000000000..1d3f59c11d8 --- /dev/null +++ b/queue-6.1/reiserfs-check-the-return-value-from-__getblk.patch @@ -0,0 +1,49 @@ +From 9c774cc19609a6ef1efa761ff2f6233c5812e768 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 12:16:06 +0100 +Subject: reiserfs: Check the return value from __getblk() + +From: Matthew Wilcox + +[ Upstream commit ba38980add7ffc9e674ada5b4ded4e7d14e76581 ] + +__getblk() can return a NULL pointer if we run out of memory or if we +try to access beyond the end of the device; check it and handle it +appropriately. + +Signed-off-by: Matthew Wilcox (Oracle) +Link: https://lore.kernel.org/lkml/CAFcO6XOacq3hscbXevPQP7sXRoYFz34ZdKPYjmd6k5sZuhGFDw@mail.gmail.com/ +Tested-by: butt3rflyh4ck +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") # probably introduced in 2002 +Acked-by: Edward Shishkin +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/reiserfs/journal.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c +index 9f62da7471c9e..eb81b4170cb51 100644 +--- a/fs/reiserfs/journal.c ++++ b/fs/reiserfs/journal.c +@@ -2326,7 +2326,7 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev, + int i, j; + + bh = __getblk(dev, block, bufsize); +- if (buffer_uptodate(bh)) ++ if (!bh || buffer_uptodate(bh)) + return (bh); + + if (block + BUFNR > max_block) { +@@ -2336,6 +2336,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev, + j = 1; + for (i = 1; i < blocks; i++) { + bh = __getblk(dev, block + i, bufsize); ++ if (!bh) ++ break; + if (buffer_uptodate(bh)) { + brelse(bh); + break; +-- +2.40.1 + diff --git a/queue-6.1/revert-f2fs-fix-to-do-sanity-check-on-extent-cache-c.patch b/queue-6.1/revert-f2fs-fix-to-do-sanity-check-on-extent-cache-c.patch new file mode 100644 index 00000000000..6caae1268bc --- /dev/null +++ b/queue-6.1/revert-f2fs-fix-to-do-sanity-check-on-extent-cache-c.patch @@ -0,0 +1,96 @@ +From a98075ffd098b0cb33a117b4db08f10455968c65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 19:29:53 +0800 +Subject: Revert "f2fs: fix to do sanity check on extent cache correctly" + +From: Chao Yu + +[ Upstream commit 958ccbbf1ce716d77c7cfa79ace50a421c1eed73 ] + +syzbot reports a f2fs bug as below: + +UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19 +index 1409 is out of range for type '__le32[923]' (aka 'unsigned int[923]') +Call Trace: + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 + ubsan_epilogue lib/ubsan.c:217 [inline] + __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 + inline_data_addr fs/f2fs/f2fs.h:3275 [inline] + __recover_inline_status fs/f2fs/inode.c:113 [inline] + do_read_inode fs/f2fs/inode.c:480 [inline] + f2fs_iget+0x4730/0x48b0 fs/f2fs/inode.c:604 + f2fs_fill_super+0x640e/0x80c0 fs/f2fs/super.c:4601 + mount_bdev+0x276/0x3b0 fs/super.c:1391 + legacy_get_tree+0xef/0x190 fs/fs_context.c:611 + vfs_get_tree+0x8c/0x270 fs/super.c:1519 + do_new_mount+0x28f/0xae0 fs/namespace.c:3335 + do_mount fs/namespace.c:3675 [inline] + __do_sys_mount fs/namespace.c:3884 [inline] + __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +The issue was bisected to: + +commit d48a7b3a72f121655d95b5157c32c7d555e44c05 +Author: Chao Yu +Date: Mon Jan 9 03:49:20 2023 +0000 + + f2fs: fix to do sanity check on extent cache correctly + +The root cause is we applied both v1 and v2 of the patch, v2 is the right +fix, so it needs to revert v1 in order to fix reported issue. + +v1: +commit d48a7b3a72f1 ("f2fs: fix to do sanity check on extent cache correctly") +https://lore.kernel.org/lkml/20230109034920.492914-1-chao@kernel.org/ + +v2: +commit 269d11948100 ("f2fs: fix to do sanity check on extent cache correctly") +https://lore.kernel.org/lkml/20230207134808.1827869-1-chao@kernel.org/ + +Reported-by: syzbot+601018296973a481f302@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-f2fs-devel/000000000000fcf0690600e4d04d@google.com/ +Fixes: d48a7b3a72f1 ("f2fs: fix to do sanity check on extent cache correctly") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/inode.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index aab3b8b3ab0a7..1fc7760499f10 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -397,6 +397,12 @@ static int do_read_inode(struct inode *inode) + fi->i_inline_xattr_size = 0; + } + ++ if (!sanity_check_inode(inode, node_page)) { ++ f2fs_put_page(node_page, 1); ++ f2fs_handle_error(sbi, ERROR_CORRUPTED_INODE); ++ return -EFSCORRUPTED; ++ } ++ + /* check data exist */ + if (f2fs_has_inline_data(inode) && !f2fs_exist_data(inode)) + __recover_inline_status(inode, node_page); +@@ -459,12 +465,6 @@ static int do_read_inode(struct inode *inode) + /* Need all the flag bits */ + f2fs_init_read_extent_tree(inode, node_page); + +- if (!sanity_check_inode(inode, node_page)) { +- f2fs_put_page(node_page, 1); +- f2fs_handle_error(sbi, ERROR_CORRUPTED_INODE); +- return -EFSCORRUPTED; +- } +- + if (!sanity_check_extent_cache(inode)) { + f2fs_put_page(node_page, 1); + f2fs_handle_error(sbi, ERROR_CORRUPTED_INODE); +-- +2.40.1 + diff --git a/queue-6.1/revert-ib-isert-fix-incorrect-release-of-isert-conne.patch b/queue-6.1/revert-ib-isert-fix-incorrect-release-of-isert-conne.patch new file mode 100644 index 00000000000..0f9d7453b38 --- /dev/null +++ b/queue-6.1/revert-ib-isert-fix-incorrect-release-of-isert-conne.patch @@ -0,0 +1,124 @@ +From 64dca39fc4f30e2a1e529b547664fb8695652652 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Aug 2023 10:57:14 +0300 +Subject: Revert "IB/isert: Fix incorrect release of isert connection" + +From: Leon Romanovsky + +[ Upstream commit dfe261107c080709459c32695847eec96238852b ] + +Commit: 699826f4e30a ("IB/isert: Fix incorrect release of isert connection") is +causing problems on OPA when DEVICE_REMOVAL is happening. + + ------------[ cut here ]------------ + WARNING: CPU: 52 PID: 2117247 at drivers/infiniband/core/cq.c:359 +ib_cq_pool_cleanup+0xac/0xb0 [ib_core] + Modules linked in: nfsd nfs_acl target_core_user uio tcm_fc libfc +scsi_transport_fc tcm_loop target_core_pscsi target_core_iblock target_core_file +rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs +rfkill rpcrdma rdma_ucm ib_srpt sunrpc ib_isert iscsi_target_mod target_core_mod +opa_vnic ib_iser libiscsi ib_umad scsi_transport_iscsi rdma_cm ib_ipoib iw_cm +ib_cm hfi1(-) rdmavt ib_uverbs intel_rapl_msr intel_rapl_common sb_edac ib_core +x86_pkg_temp_thermal intel_powerclamp coretemp i2c_i801 mxm_wmi rapl iTCO_wdt +ipmi_si iTCO_vendor_support mei_me ipmi_devintf mei intel_cstate ioatdma +intel_uncore i2c_smbus joydev pcspkr lpc_ich ipmi_msghandler acpi_power_meter +acpi_pad xfs libcrc32c sr_mod sd_mod cdrom t10_pi sg crct10dif_pclmul +crc32_pclmul crc32c_intel drm_kms_helper drm_shmem_helper ahci libahci +ghash_clmulni_intel igb drm libata dca i2c_algo_bit wmi fuse + CPU: 52 PID: 2117247 Comm: modprobe Not tainted 6.5.0-rc1+ #1 + Hardware name: Intel Corporation S2600CWR/S2600CW, BIOS +SE5C610.86B.01.01.0014.121820151719 12/18/2015 + RIP: 0010:ib_cq_pool_cleanup+0xac/0xb0 [ib_core] + Code: ff 48 8b 43 40 48 8d 7b 40 48 83 e8 40 4c 39 e7 75 b3 49 83 +c4 10 4d 39 fc 75 94 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc <0f> 0b eb a1 +90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f + RSP: 0018:ffffc10bea13fc80 EFLAGS: 00010206 + RAX: 000000000000010c RBX: ffff9bf5c7e66c00 RCX: 000000008020001d + RDX: 000000008020001e RSI: fffff175221f9900 RDI: ffff9bf5c7e67640 + RBP: ffff9bf5c7e67600 R08: ffff9bf5c7e64400 R09: 000000008020001d + R10: 0000000040000000 R11: 0000000000000000 R12: ffff9bee4b1e8a18 + R13: dead000000000122 R14: dead000000000100 R15: ffff9bee4b1e8a38 + FS: 00007ff1e6d38740(0000) GS:ffff9bfd9fb00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00005652044ecc68 CR3: 0000000889b5c005 CR4: 00000000001706e0 + Call Trace: + + ? __warn+0x80/0x130 + ? ib_cq_pool_cleanup+0xac/0xb0 [ib_core] + ? report_bug+0x195/0x1a0 + ? handle_bug+0x3c/0x70 + ? exc_invalid_op+0x14/0x70 + ? asm_exc_invalid_op+0x16/0x20 + ? ib_cq_pool_cleanup+0xac/0xb0 [ib_core] + disable_device+0x9d/0x160 [ib_core] + __ib_unregister_device+0x42/0xb0 [ib_core] + ib_unregister_device+0x22/0x30 [ib_core] + rvt_unregister_device+0x20/0x90 [rdmavt] + hfi1_unregister_ib_device+0x16/0xf0 [hfi1] + remove_one+0x55/0x1a0 [hfi1] + pci_device_remove+0x36/0xa0 + device_release_driver_internal+0x193/0x200 + driver_detach+0x44/0x90 + bus_remove_driver+0x69/0xf0 + pci_unregister_driver+0x2a/0xb0 + hfi1_mod_cleanup+0xc/0x3c [hfi1] + __do_sys_delete_module.constprop.0+0x17a/0x2f0 + ? exit_to_user_mode_prepare+0xc4/0xd0 + ? syscall_trace_enter.constprop.0+0x126/0x1a0 + do_syscall_64+0x5c/0x90 + ? syscall_exit_to_user_mode+0x12/0x30 + ? do_syscall_64+0x69/0x90 + ? syscall_exit_work+0x103/0x130 + ? syscall_exit_to_user_mode+0x12/0x30 + ? do_syscall_64+0x69/0x90 + ? exc_page_fault+0x65/0x150 + entry_SYSCALL_64_after_hwframe+0x6e/0xd8 + RIP: 0033:0x7ff1e643f5ab + Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 +66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 +ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 + RSP: 002b:00007ffec9103cc8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 + RAX: ffffffffffffffda RBX: 00005615267fdc50 RCX: 00007ff1e643f5ab + RDX: 0000000000000000 RSI: 0000000000000800 RDI: 00005615267fdcb8 + RBP: 00005615267fdc50 R08: 0000000000000000 R09: 0000000000000000 + R10: 00007ff1e659eac0 R11: 0000000000000206 R12: 00005615267fdcb8 + R13: 0000000000000000 R14: 00005615267fdcb8 R15: 00007ffec9105ff8 + + ---[ end trace 0000000000000000 ]--- + +And... + + restrack: ------------[ cut here ]------------ + infiniband hfi1_0: BUG: RESTRACK detected leak of resources + restrack: Kernel PD object allocated by ib_isert is not freed + restrack: Kernel CQ object allocated by ib_core is not freed + restrack: Kernel QP object allocated by rdma_cm is not freed + restrack: ------------[ cut here ]------------ + +Fixes: 699826f4e30a ("IB/isert: Fix incorrect release of isert connection") +Reported-by: Dennis Dalessandro +Closes: https://lore.kernel.org/all/921cd1d9-2879-f455-1f50-0053fe6a6655@cornelisnetworks.com +Link: https://lore.kernel.org/r/a27982d3235005c58f6d321f3fad5eb6e1beaf9e.1692604607.git.leonro@nvidia.com +Tested-by: Dennis Dalessandro +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/isert/ib_isert.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index a7fef3ea77fe3..a02a3caeaa4e7 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -2571,6 +2571,8 @@ static void isert_wait_conn(struct iscsit_conn *conn) + isert_put_unsol_pending_cmds(conn); + isert_wait4cmds(conn); + isert_wait4logout(isert_conn); ++ ++ queue_work(isert_release_wq, &isert_conn->release_work); + } + + static void isert_free_conn(struct iscsit_conn *conn) +-- +2.40.1 + diff --git a/queue-6.1/rpmsg-glink-add-check-for-kstrdup.patch b/queue-6.1/rpmsg-glink-add-check-for-kstrdup.patch new file mode 100644 index 00000000000..f4e7815f613 --- /dev/null +++ b/queue-6.1/rpmsg-glink-add-check-for-kstrdup.patch @@ -0,0 +1,39 @@ +From 4dc10271f113653598587732b86486acb78845e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 11:06:31 +0800 +Subject: rpmsg: glink: Add check for kstrdup + +From: Jiasheng Jiang + +[ Upstream commit b5c9ee8296a3760760c7b5d2e305f91412adc795 ] + +Add check for the return value of kstrdup() and return the error +if it fails in order to avoid NULL pointer dereference. + +Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20230619030631.12361-1-jiasheng@iscas.ac.cn +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_glink_native.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index 67e7664efb0dc..cb8f65c1d4e3b 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -224,6 +224,10 @@ static struct glink_channel *qcom_glink_alloc_channel(struct qcom_glink *glink, + + channel->glink = glink; + channel->name = kstrdup(name, GFP_KERNEL); ++ if (!channel->name) { ++ kfree(channel); ++ return ERR_PTR(-ENOMEM); ++ } + + init_completion(&channel->open_req); + init_completion(&channel->open_ack); +-- +2.40.1 + diff --git a/queue-6.1/s390-paes-fix-pkey_type_ep11_aes-handling-for-secure.patch b/queue-6.1/s390-paes-fix-pkey_type_ep11_aes-handling-for-secure.patch new file mode 100644 index 00000000000..726d71eb2d2 --- /dev/null +++ b/queue-6.1/s390-paes-fix-pkey_type_ep11_aes-handling-for-secure.patch @@ -0,0 +1,40 @@ +From 6d5ac111bd6bcc6c4df73a81c0d3a91bae53067b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 14:23:45 +0200 +Subject: s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs + +From: Holger Dengler + +[ Upstream commit cba33db3fc4dbf2e54294b0e499d2335a3a00d78 ] + +Commit 'fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC +private keys")' introduced PKEY_TYPE_EP11_AES securekey blobs as a +supplement to the PKEY_TYPE_EP11 (which won't work in environments +with session-bound keys). This new keyblobs has a different maximum +size, so fix paes crypto module to accept also these larger keyblobs. + +Fixes: fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC private keys") +Signed-off-by: Holger Dengler +Reviewed-by: Ingo Franzki +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/crypto/paes_s390.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c +index a279b7d23a5e2..621322eb0e681 100644 +--- a/arch/s390/crypto/paes_s390.c ++++ b/arch/s390/crypto/paes_s390.c +@@ -35,7 +35,7 @@ + * and padding is also possible, the limits need to be generous. + */ + #define PAES_MIN_KEYSIZE 16 +-#define PAES_MAX_KEYSIZE 320 ++#define PAES_MAX_KEYSIZE MAXEP11AESKEYBLOBSIZE + + static u8 *ctrblk; + static DEFINE_MUTEX(ctrblk_lock); +-- +2.40.1 + diff --git a/queue-6.1/s390-pkey-fix-harmonize-internal-keyblob-headers.patch b/queue-6.1/s390-pkey-fix-harmonize-internal-keyblob-headers.patch new file mode 100644 index 00000000000..ceba2d18b08 --- /dev/null +++ b/queue-6.1/s390-pkey-fix-harmonize-internal-keyblob-headers.patch @@ -0,0 +1,89 @@ +From a5853060bd8f52c87a7cc1805b8e66f859db8de3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 11:33:45 +0200 +Subject: s390/pkey: fix/harmonize internal keyblob headers + +From: Holger Dengler + +[ Upstream commit 37a08f010b7c423b5e4c9ed3b187d21166553007 ] + +Commit 'fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC +private keys")' introduced PKEY_TYPE_EP11_AES as a supplement to +PKEY_TYPE_EP11. All pkeys have an internal header/payload structure, +which is opaque to the userspace. The header structures for +PKEY_TYPE_EP11 and PKEY_TYPE_EP11_AES are nearly identical and there +is no reason, why different structures are used. In preparation to fix +the keyversion handling in the broken PKEY IOCTLs, the same header +structure is used for PKEY_TYPE_EP11 and PKEY_TYPE_EP11_AES. This +reduces the number of different code paths and increases the +readability. + +Fixes: fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC private keys") +Signed-off-by: Holger Dengler +Reviewed-by: Ingo Franzki +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/pkey_api.c | 2 +- + drivers/s390/crypto/zcrypt_ep11misc.c | 4 ++-- + drivers/s390/crypto/zcrypt_ep11misc.h | 9 +-------- + 3 files changed, 4 insertions(+), 11 deletions(-) + +diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c +index a8def50c149bd..e650df3fe7ccb 100644 +--- a/drivers/s390/crypto/pkey_api.c ++++ b/drivers/s390/crypto/pkey_api.c +@@ -747,7 +747,7 @@ static int pkey_verifykey2(const u8 *key, size_t keylen, + if (ktype) + *ktype = PKEY_TYPE_EP11; + if (ksize) +- *ksize = kb->head.keybitlen; ++ *ksize = kb->head.bitlen; + + rc = ep11_findcard2(&_apqns, &_nr_apqns, *cardnr, *domain, + ZCRYPT_CEX7, EP11_API_V, kb->wkvp); +diff --git a/drivers/s390/crypto/zcrypt_ep11misc.c b/drivers/s390/crypto/zcrypt_ep11misc.c +index b1c29017be5bc..497de7faa2fc5 100644 +--- a/drivers/s390/crypto/zcrypt_ep11misc.c ++++ b/drivers/s390/crypto/zcrypt_ep11misc.c +@@ -787,7 +787,7 @@ int ep11_genaeskey(u16 card, u16 domain, u32 keybitsize, u32 keygenflags, + kb->head.type = TOKTYPE_NON_CCA; + kb->head.len = rep_pl->data_len; + kb->head.version = TOKVER_EP11_AES; +- kb->head.keybitlen = keybitsize; ++ kb->head.bitlen = keybitsize; + + out: + kfree(req); +@@ -1055,7 +1055,7 @@ static int ep11_unwrapkey(u16 card, u16 domain, + kb->head.type = TOKTYPE_NON_CCA; + kb->head.len = rep_pl->data_len; + kb->head.version = TOKVER_EP11_AES; +- kb->head.keybitlen = keybitsize; ++ kb->head.bitlen = keybitsize; + + out: + kfree(req); +diff --git a/drivers/s390/crypto/zcrypt_ep11misc.h b/drivers/s390/crypto/zcrypt_ep11misc.h +index 07445041869fe..912b3918c10a1 100644 +--- a/drivers/s390/crypto/zcrypt_ep11misc.h ++++ b/drivers/s390/crypto/zcrypt_ep11misc.h +@@ -29,14 +29,7 @@ struct ep11keyblob { + union { + u8 session[32]; + /* only used for PKEY_TYPE_EP11: */ +- struct { +- u8 type; /* 0x00 (TOKTYPE_NON_CCA) */ +- u8 res0; /* unused */ +- u16 len; /* total length in bytes of this blob */ +- u8 version; /* 0x03 (TOKVER_EP11_AES) */ +- u8 res1; /* unused */ +- u16 keybitlen; /* clear key bit len, 0 for unknown */ +- } head; ++ struct ep11kblob_header head; + }; + u8 wkvp[16]; /* wrapping key verification pattern */ + u64 attr; /* boolean key attributes */ +-- +2.40.1 + diff --git a/queue-6.1/s390-pkey-fix-pkey_type_ep11_aes-handling-for-sysfs-.patch b/queue-6.1/s390-pkey-fix-pkey_type_ep11_aes-handling-for-sysfs-.patch new file mode 100644 index 00000000000..dfc520e1f2b --- /dev/null +++ b/queue-6.1/s390-pkey-fix-pkey_type_ep11_aes-handling-for-sysfs-.patch @@ -0,0 +1,78 @@ +From 8e5f452f2349e0388f62d3a0b1fd9a0ccbfb039a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 16:02:58 +0200 +Subject: s390/pkey: fix PKEY_TYPE_EP11_AES handling for sysfs attributes + +From: Holger Dengler + +[ Upstream commit b9352e4b9b9eff949bcc6907b8569b3a1d992f1e ] + +Commit 'fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC +private keys")' introduced a new PKEY_TYPE_EP11_AES securekey type as +a supplement to the existing PKEY_TYPE_EP11 (which won't work in +environments with session-bound keys). The pkey EP11 securekey +attributes use PKEY_TYPE_EP11_AES (instead of PKEY_TYPE_EP11) +keyblobs, to make the generated keyblobs usable also in environments, +where session-bound keys are required. + +There should be no negative impacts to userspace because the internal +structure of the keyblobs is opaque. The increased size of the +generated keyblobs is reflected by the changed size of the attributes. + +Fixes: fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC private keys") +Signed-off-by: Holger Dengler +Reviewed-by: Ingo Franzki +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/include/uapi/asm/pkey.h | 2 +- + drivers/s390/crypto/pkey_api.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/s390/include/uapi/asm/pkey.h b/arch/s390/include/uapi/asm/pkey.h +index 924b876f992c1..29c6fd369761e 100644 +--- a/arch/s390/include/uapi/asm/pkey.h ++++ b/arch/s390/include/uapi/asm/pkey.h +@@ -26,7 +26,7 @@ + #define MAXCLRKEYSIZE 32 /* a clear key value may be up to 32 bytes */ + #define MAXAESCIPHERKEYSIZE 136 /* our aes cipher keys have always 136 bytes */ + #define MINEP11AESKEYBLOBSIZE 256 /* min EP11 AES key blob size */ +-#define MAXEP11AESKEYBLOBSIZE 320 /* max EP11 AES key blob size */ ++#define MAXEP11AESKEYBLOBSIZE 336 /* max EP11 AES key blob size */ + + /* Minimum size of a key blob */ + #define MINKEYBLOBSIZE SECKEYBLOBSIZE +diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c +index 79568da580c67..2b92ec20ed68e 100644 +--- a/drivers/s390/crypto/pkey_api.c ++++ b/drivers/s390/crypto/pkey_api.c +@@ -1947,7 +1947,7 @@ static struct attribute_group ccacipher_attr_group = { + * (i.e. off != 0 or count < key blob size) -EINVAL is returned. + * This function and the sysfs attributes using it provide EP11 key blobs + * padded to the upper limit of MAXEP11AESKEYBLOBSIZE which is currently +- * 320 bytes. ++ * 336 bytes. + */ + static ssize_t pkey_ep11_aes_attr_read(enum pkey_key_size keybits, + bool is_xts, char *buf, loff_t off, +@@ -1976,7 +1976,7 @@ static ssize_t pkey_ep11_aes_attr_read(enum pkey_key_size keybits, + card = apqns[i] >> 16; + dom = apqns[i] & 0xFFFF; + rc = ep11_genaeskey(card, dom, keybits, 0, buf, &keysize, +- PKEY_TYPE_EP11); ++ PKEY_TYPE_EP11_AES); + if (rc == 0) + break; + } +@@ -1987,7 +1987,7 @@ static ssize_t pkey_ep11_aes_attr_read(enum pkey_key_size keybits, + keysize = MAXEP11AESKEYBLOBSIZE; + buf += MAXEP11AESKEYBLOBSIZE; + rc = ep11_genaeskey(card, dom, keybits, 0, buf, &keysize, +- PKEY_TYPE_EP11); ++ PKEY_TYPE_EP11_AES); + if (rc == 0) + return 2 * MAXEP11AESKEYBLOBSIZE; + } +-- +2.40.1 + diff --git a/queue-6.1/s390-pkey-fix-pkey_type_ep11_aes-handling-in-pkey_ge.patch b/queue-6.1/s390-pkey-fix-pkey_type_ep11_aes-handling-in-pkey_ge.patch new file mode 100644 index 00000000000..0d688befbbc --- /dev/null +++ b/queue-6.1/s390-pkey-fix-pkey_type_ep11_aes-handling-in-pkey_ge.patch @@ -0,0 +1,276 @@ +From dd56f6fb0bb535437e9d5685e39aecb4f2e4aab9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 09:49:55 +0200 +Subject: s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_GENSECK2 IOCTL + +From: Holger Dengler + +[ Upstream commit fb249ce7f7bfd8621a38e4ad401ba74b680786d4 ] + +Commit 'fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC +private keys")' introduced PKEY_TYPE_EP11_AES for the PKEY_GENSECK2 +IOCTL, to enable userspace to generate securekey blobs of this +type. Unfortunately, all PKEY_GENSECK2 IOCTL requests for +PKEY_TYPE_EP11_AES return with an error (-EINVAL). Fix the handling +for PKEY_TYPE_EP11_AES in PKEY_GENSECK2 IOCTL, so that userspace can +generate securekey blobs of this type. + +The start of the header and the keyblob, as well as the length need +special handling, depending on the internal keyversion. Add a helper +function that splits an uninitialized buffer into start and size of +the header as well as start and size of the payload, depending on the +requested keyversion. + +Do the header-related calculations and the raw genkey request handling +in separate functions. Use the raw genkey request function for +internal purposes. + +Fixes: fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC private keys") +Signed-off-by: Holger Dengler +Reviewed-by: Ingo Franzki +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/pkey_api.c | 18 +++-- + drivers/s390/crypto/zcrypt_ep11misc.c | 103 ++++++++++++++++++++++---- + drivers/s390/crypto/zcrypt_ep11misc.h | 2 +- + 3 files changed, 102 insertions(+), 21 deletions(-) + +diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c +index e650df3fe7ccb..79568da580c67 100644 +--- a/drivers/s390/crypto/pkey_api.c ++++ b/drivers/s390/crypto/pkey_api.c +@@ -565,6 +565,11 @@ static int pkey_genseckey2(const struct pkey_apqn *apqns, size_t nr_apqns, + if (*keybufsize < MINEP11AESKEYBLOBSIZE) + return -EINVAL; + break; ++ case PKEY_TYPE_EP11_AES: ++ if (*keybufsize < (sizeof(struct ep11kblob_header) + ++ MINEP11AESKEYBLOBSIZE)) ++ return -EINVAL; ++ break; + default: + return -EINVAL; + } +@@ -581,9 +586,10 @@ static int pkey_genseckey2(const struct pkey_apqn *apqns, size_t nr_apqns, + for (i = 0, rc = -ENODEV; i < nr_apqns; i++) { + card = apqns[i].card; + dom = apqns[i].domain; +- if (ktype == PKEY_TYPE_EP11) { ++ if (ktype == PKEY_TYPE_EP11 || ++ ktype == PKEY_TYPE_EP11_AES) { + rc = ep11_genaeskey(card, dom, ksize, kflags, +- keybuf, keybufsize); ++ keybuf, keybufsize, ktype); + } else if (ktype == PKEY_TYPE_CCA_DATA) { + rc = cca_genseckey(card, dom, ksize, keybuf); + *keybufsize = (rc ? 0 : SECKEYBLOBSIZE); +@@ -1313,7 +1319,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, + apqns = _copy_apqns_from_user(kgs.apqns, kgs.apqn_entries); + if (IS_ERR(apqns)) + return PTR_ERR(apqns); +- kkey = kmalloc(klen, GFP_KERNEL); ++ kkey = kzalloc(klen, GFP_KERNEL); + if (!kkey) { + kfree(apqns); + return -ENOMEM; +@@ -1969,7 +1975,8 @@ static ssize_t pkey_ep11_aes_attr_read(enum pkey_key_size keybits, + for (i = 0, rc = -ENODEV; i < nr_apqns; i++) { + card = apqns[i] >> 16; + dom = apqns[i] & 0xFFFF; +- rc = ep11_genaeskey(card, dom, keybits, 0, buf, &keysize); ++ rc = ep11_genaeskey(card, dom, keybits, 0, buf, &keysize, ++ PKEY_TYPE_EP11); + if (rc == 0) + break; + } +@@ -1979,7 +1986,8 @@ static ssize_t pkey_ep11_aes_attr_read(enum pkey_key_size keybits, + if (is_xts) { + keysize = MAXEP11AESKEYBLOBSIZE; + buf += MAXEP11AESKEYBLOBSIZE; +- rc = ep11_genaeskey(card, dom, keybits, 0, buf, &keysize); ++ rc = ep11_genaeskey(card, dom, keybits, 0, buf, &keysize, ++ PKEY_TYPE_EP11); + if (rc == 0) + return 2 * MAXEP11AESKEYBLOBSIZE; + } +diff --git a/drivers/s390/crypto/zcrypt_ep11misc.c b/drivers/s390/crypto/zcrypt_ep11misc.c +index 497de7faa2fc5..20bbeec1a1a22 100644 +--- a/drivers/s390/crypto/zcrypt_ep11misc.c ++++ b/drivers/s390/crypto/zcrypt_ep11misc.c +@@ -113,6 +113,50 @@ static void __exit card_cache_free(void) + spin_unlock_bh(&card_list_lock); + } + ++static int ep11_kb_split(const u8 *kb, size_t kblen, u32 kbver, ++ struct ep11kblob_header **kbhdr, size_t *kbhdrsize, ++ u8 **kbpl, size_t *kbplsize) ++{ ++ struct ep11kblob_header *hdr = NULL; ++ size_t hdrsize, plsize = 0; ++ int rc = -EINVAL; ++ u8 *pl = NULL; ++ ++ if (kblen < sizeof(struct ep11kblob_header)) ++ goto out; ++ hdr = (struct ep11kblob_header *)kb; ++ ++ switch (kbver) { ++ case TOKVER_EP11_AES: ++ /* header overlays the payload */ ++ hdrsize = 0; ++ break; ++ case TOKVER_EP11_ECC_WITH_HEADER: ++ case TOKVER_EP11_AES_WITH_HEADER: ++ /* payload starts after the header */ ++ hdrsize = sizeof(struct ep11kblob_header); ++ break; ++ default: ++ goto out; ++ } ++ ++ plsize = kblen - hdrsize; ++ pl = (u8 *)kb + hdrsize; ++ ++ if (kbhdr) ++ *kbhdr = hdr; ++ if (kbhdrsize) ++ *kbhdrsize = hdrsize; ++ if (kbpl) ++ *kbpl = pl; ++ if (kbplsize) ++ *kbplsize = plsize; ++ ++ rc = 0; ++out: ++ return rc; ++} ++ + /* + * Simple check if the key blob is a valid EP11 AES key blob with header. + */ +@@ -664,8 +708,9 @@ EXPORT_SYMBOL(ep11_get_domain_info); + */ + #define KEY_ATTR_DEFAULTS 0x00200c00 + +-int ep11_genaeskey(u16 card, u16 domain, u32 keybitsize, u32 keygenflags, +- u8 *keybuf, size_t *keybufsize) ++static int _ep11_genaeskey(u16 card, u16 domain, ++ u32 keybitsize, u32 keygenflags, ++ u8 *keybuf, size_t *keybufsize) + { + struct keygen_req_pl { + struct pl_head head; +@@ -701,7 +746,6 @@ int ep11_genaeskey(u16 card, u16 domain, u32 keybitsize, u32 keygenflags, + struct ep11_cprb *req = NULL, *rep = NULL; + struct ep11_target_dev target; + struct ep11_urb *urb = NULL; +- struct ep11keyblob *kb; + int api, rc = -ENOMEM; + + switch (keybitsize) { +@@ -780,14 +824,9 @@ int ep11_genaeskey(u16 card, u16 domain, u32 keybitsize, u32 keygenflags, + goto out; + } + +- /* copy key blob and set header values */ ++ /* copy key blob */ + memcpy(keybuf, rep_pl->data, rep_pl->data_len); + *keybufsize = rep_pl->data_len; +- kb = (struct ep11keyblob *)keybuf; +- kb->head.type = TOKTYPE_NON_CCA; +- kb->head.len = rep_pl->data_len; +- kb->head.version = TOKVER_EP11_AES; +- kb->head.bitlen = keybitsize; + + out: + kfree(req); +@@ -795,6 +834,43 @@ int ep11_genaeskey(u16 card, u16 domain, u32 keybitsize, u32 keygenflags, + kfree(urb); + return rc; + } ++ ++int ep11_genaeskey(u16 card, u16 domain, u32 keybitsize, u32 keygenflags, ++ u8 *keybuf, size_t *keybufsize, u32 keybufver) ++{ ++ struct ep11kblob_header *hdr; ++ size_t hdr_size, pl_size; ++ u8 *pl; ++ int rc; ++ ++ switch (keybufver) { ++ case TOKVER_EP11_AES: ++ case TOKVER_EP11_AES_WITH_HEADER: ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ rc = ep11_kb_split(keybuf, *keybufsize, keybufver, ++ &hdr, &hdr_size, &pl, &pl_size); ++ if (rc) ++ return rc; ++ ++ rc = _ep11_genaeskey(card, domain, keybitsize, keygenflags, ++ pl, &pl_size); ++ if (rc) ++ return rc; ++ ++ *keybufsize = hdr_size + pl_size; ++ ++ /* update header information */ ++ hdr->type = TOKTYPE_NON_CCA; ++ hdr->len = *keybufsize; ++ hdr->version = keybufver; ++ hdr->bitlen = keybitsize; ++ ++ return 0; ++} + EXPORT_SYMBOL(ep11_genaeskey); + + static int ep11_cryptsingle(u16 card, u16 domain, +@@ -1201,7 +1277,6 @@ int ep11_clr2keyblob(u16 card, u16 domain, u32 keybitsize, u32 keygenflags, + const u8 *clrkey, u8 *keybuf, size_t *keybufsize) + { + int rc; +- struct ep11keyblob *kb; + u8 encbuf[64], *kek = NULL; + size_t clrkeylen, keklen, encbuflen = sizeof(encbuf); + +@@ -1223,17 +1298,15 @@ int ep11_clr2keyblob(u16 card, u16 domain, u32 keybitsize, u32 keygenflags, + } + + /* Step 1: generate AES 256 bit random kek key */ +- rc = ep11_genaeskey(card, domain, 256, +- 0x00006c00, /* EN/DECRYPT, WRAP/UNWRAP */ +- kek, &keklen); ++ rc = _ep11_genaeskey(card, domain, 256, ++ 0x00006c00, /* EN/DECRYPT, WRAP/UNWRAP */ ++ kek, &keklen); + if (rc) { + DEBUG_ERR( + "%s generate kek key failed, rc=%d\n", + __func__, rc); + goto out; + } +- kb = (struct ep11keyblob *)kek; +- memset(&kb->head, 0, sizeof(kb->head)); + + /* Step 2: encrypt clear key value with the kek key */ + rc = ep11_cryptsingle(card, domain, 0, 0, def_iv, kek, keklen, +diff --git a/drivers/s390/crypto/zcrypt_ep11misc.h b/drivers/s390/crypto/zcrypt_ep11misc.h +index 912b3918c10a1..ed328c354bade 100644 +--- a/drivers/s390/crypto/zcrypt_ep11misc.h ++++ b/drivers/s390/crypto/zcrypt_ep11misc.h +@@ -107,7 +107,7 @@ int ep11_get_domain_info(u16 card, u16 domain, struct ep11_domain_info *info); + * Generate (random) EP11 AES secure key. + */ + int ep11_genaeskey(u16 card, u16 domain, u32 keybitsize, u32 keygenflags, +- u8 *keybuf, size_t *keybufsize); ++ u8 *keybuf, size_t *keybufsize, u32 keybufver); + + /* + * Generate EP11 AES secure key with given clear key value. +-- +2.40.1 + diff --git a/queue-6.1/samples-bpf-fix-bio-latency-check-with-tracepoint.patch b/queue-6.1/samples-bpf-fix-bio-latency-check-with-tracepoint.patch new file mode 100644 index 00000000000..4ffc3523306 --- /dev/null +++ b/queue-6.1/samples-bpf-fix-bio-latency-check-with-tracepoint.patch @@ -0,0 +1,111 @@ +From d693dda1665d54584585cab9549374b616a78f8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 18:01:16 +0900 +Subject: samples/bpf: fix bio latency check with tracepoint + +From: Daniel T. Lee + +[ Upstream commit 92632115fb57ff9e368f256913e96d6fd5abf5ab ] + +Recently, a new tracepoint for the block layer, specifically the +block_io_start/done tracepoints, was introduced in commit 5a80bd075f3b +("block: introduce block_io_start/block_io_done tracepoints"). + +Previously, the kprobe entry used for this purpose was quite unstable +and inherently broke relevant probes [1]. Now that a stable tracepoint +is available, this commit replaces the bio latency check with it. + +One of the changes made during this replacement is the key used for the +hash table. Since 'struct request' cannot be used as a hash key, the +approach taken follows that which was implemented in bcc/biolatency [2]. +(uses dev:sector for the key) + +[1]: https://github.com/iovisor/bcc/issues/4261 +[2]: https://github.com/iovisor/bcc/pull/4691 + +Fixes: 450b7879e345 ("block: move blk_account_io_{start,done} to blk-mq.c") +Signed-off-by: Daniel T. Lee +Link: https://lore.kernel.org/r/20230818090119.477441-7-danieltimlee@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + samples/bpf/tracex3_kern.c | 36 ++++++++++++++++++++++++------------ + 1 file changed, 24 insertions(+), 12 deletions(-) + +diff --git a/samples/bpf/tracex3_kern.c b/samples/bpf/tracex3_kern.c +index bde6591cb20c5..af235bd6615b1 100644 +--- a/samples/bpf/tracex3_kern.c ++++ b/samples/bpf/tracex3_kern.c +@@ -11,6 +11,12 @@ + #include + #include + ++struct start_key { ++ dev_t dev; ++ u32 _pad; ++ sector_t sector; ++}; ++ + struct { + __uint(type, BPF_MAP_TYPE_HASH); + __type(key, long); +@@ -18,16 +24,17 @@ struct { + __uint(max_entries, 4096); + } my_map SEC(".maps"); + +-/* kprobe is NOT a stable ABI. If kernel internals change this bpf+kprobe +- * example will no longer be meaningful +- */ +-SEC("kprobe/blk_mq_start_request") +-int bpf_prog1(struct pt_regs *ctx) ++/* from /sys/kernel/tracing/events/block/block_io_start/format */ ++SEC("tracepoint/block/block_io_start") ++int bpf_prog1(struct trace_event_raw_block_rq *ctx) + { +- long rq = PT_REGS_PARM1(ctx); + u64 val = bpf_ktime_get_ns(); ++ struct start_key key = { ++ .dev = ctx->dev, ++ .sector = ctx->sector ++ }; + +- bpf_map_update_elem(&my_map, &rq, &val, BPF_ANY); ++ bpf_map_update_elem(&my_map, &key, &val, BPF_ANY); + return 0; + } + +@@ -49,21 +56,26 @@ struct { + __uint(max_entries, SLOTS); + } lat_map SEC(".maps"); + +-SEC("kprobe/__blk_account_io_done") +-int bpf_prog2(struct pt_regs *ctx) ++/* from /sys/kernel/tracing/events/block/block_io_done/format */ ++SEC("tracepoint/block/block_io_done") ++int bpf_prog2(struct trace_event_raw_block_rq *ctx) + { +- long rq = PT_REGS_PARM1(ctx); ++ struct start_key key = { ++ .dev = ctx->dev, ++ .sector = ctx->sector ++ }; ++ + u64 *value, l, base; + u32 index; + +- value = bpf_map_lookup_elem(&my_map, &rq); ++ value = bpf_map_lookup_elem(&my_map, &key); + if (!value) + return 0; + + u64 cur_time = bpf_ktime_get_ns(); + u64 delta = cur_time - *value; + +- bpf_map_delete_elem(&my_map, &rq); ++ bpf_map_delete_elem(&my_map, &key); + + /* the lines below are computing index = log10(delta)*10 + * using integer arithmetic +-- +2.40.1 + diff --git a/queue-6.1/samples-bpf-fix-broken-map-lookup-probe.patch b/queue-6.1/samples-bpf-fix-broken-map-lookup-probe.patch new file mode 100644 index 00000000000..bbffae9f66f --- /dev/null +++ b/queue-6.1/samples-bpf-fix-broken-map-lookup-probe.patch @@ -0,0 +1,71 @@ +From 952e6b36be323c65507545fde2e681abe7c24bc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 18:01:17 +0900 +Subject: samples/bpf: fix broken map lookup probe + +From: Daniel T. Lee + +[ Upstream commit d93a7cf6ca2cfcd7de5d06f753ce8d5e863316ac ] + +In the commit 7c4cd051add3 ("bpf: Fix syscall's stackmap lookup +potential deadlock"), a potential deadlock issue was addressed, which +resulted in *_map_lookup_elem not triggering BPF programs. +(prior to lookup, bpf_disable_instrumentation() is used) + +To resolve the broken map lookup probe using "htab_map_lookup_elem", +this commit introduces an alternative approach. Instead, it utilize +"bpf_map_copy_value" and apply a filter specifically for the hash table +with map_type. + +Signed-off-by: Daniel T. Lee +Fixes: 7c4cd051add3 ("bpf: Fix syscall's stackmap lookup potential deadlock") +Link: https://lore.kernel.org/r/20230818090119.477441-8-danieltimlee@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + samples/bpf/tracex6_kern.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/samples/bpf/tracex6_kern.c b/samples/bpf/tracex6_kern.c +index acad5712d8b4f..fd602c2774b8b 100644 +--- a/samples/bpf/tracex6_kern.c ++++ b/samples/bpf/tracex6_kern.c +@@ -2,6 +2,8 @@ + #include + #include + #include ++#include ++#include + + struct { + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); +@@ -45,13 +47,24 @@ int bpf_prog1(struct pt_regs *ctx) + return 0; + } + +-SEC("kprobe/htab_map_lookup_elem") +-int bpf_prog2(struct pt_regs *ctx) ++/* ++ * Since *_map_lookup_elem can't be expected to trigger bpf programs ++ * due to potential deadlocks (bpf_disable_instrumentation), this bpf ++ * program will be attached to bpf_map_copy_value (which is called ++ * from map_lookup_elem) and will only filter the hashtable type. ++ */ ++SEC("kprobe/bpf_map_copy_value") ++int BPF_KPROBE(bpf_prog2, struct bpf_map *map) + { + u32 key = bpf_get_smp_processor_id(); + struct bpf_perf_event_value *val, buf; ++ enum bpf_map_type type; + int error; + ++ type = BPF_CORE_READ(map, map_type); ++ if (type != BPF_MAP_TYPE_HASH) ++ return 0; ++ + error = bpf_perf_event_read_value(&counters, key, &buf, sizeof(buf)); + if (error) + return 0; +-- +2.40.1 + diff --git a/queue-6.1/sched-psi-select-kernfs-as-needed.patch b/queue-6.1/sched-psi-select-kernfs-as-needed.patch new file mode 100644 index 00000000000..213b8d81805 --- /dev/null +++ b/queue-6.1/sched-psi-select-kernfs-as-needed.patch @@ -0,0 +1,43 @@ +From a77809278b932a3d0b0c4384f151ac04003efa39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Jul 2023 20:07:40 -0700 +Subject: sched/psi: Select KERNFS as needed + +From: Randy Dunlap + +[ Upstream commit 98dfdd9ee93995a408192dbbf3dd219ba23e3738 ] + +Users of KERNFS should select it to enforce its being built, so +do this to prevent a build error. + +In file included from ../kernel/sched/build_utility.c:97: +../kernel/sched/psi.c: In function 'psi_trigger_poll': +../kernel/sched/psi.c:1479:17: error: implicit declaration of function 'kernfs_generic_poll' [-Werror=implicit-function-declaration] + 1479 | kernfs_generic_poll(t->of, wait); + +Fixes: aff037078eca ("sched/psi: use kernfs polling functions for PSI trigger polling") +Reported-by: kernel test robot +Signed-off-by: Randy Dunlap +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Suren Baghdasaryan +Link: lore.kernel.org/r/202307310732.r65EQFY0-lkp@intel.com +Signed-off-by: Sasha Levin +--- + init/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/init/Kconfig b/init/Kconfig +index 2028ed4d50f5b..de255842f5d09 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -627,6 +627,7 @@ config TASK_IO_ACCOUNTING + + config PSI + bool "Pressure stall information tracking" ++ select KERNFS + help + Collect metrics that indicate how overcommitted the CPU, memory, + and IO capacity are in the system. +-- +2.40.1 + diff --git a/queue-6.1/sched-rt-fix-sysctl_sched_rr_timeslice-intial-value.patch b/queue-6.1/sched-rt-fix-sysctl_sched_rr_timeslice-intial-value.patch new file mode 100644 index 00000000000..b667fd8a84d --- /dev/null +++ b/queue-6.1/sched-rt-fix-sysctl_sched_rr_timeslice-intial-value.patch @@ -0,0 +1,75 @@ +From 8c804f080c8f8711a58bbd6d9d7f300772ba3fb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Aug 2023 17:19:05 +0200 +Subject: sched/rt: Fix sysctl_sched_rr_timeslice intial value + +From: Cyril Hrubis + +[ Upstream commit c7fcb99877f9f542c918509b2801065adcaf46fa ] + +There is a 10% rounding error in the intial value of the +sysctl_sched_rr_timeslice with CONFIG_HZ_300=y. + +This was found with LTP test sched_rr_get_interval01: + +sched_rr_get_interval01.c:57: TPASS: sched_rr_get_interval() passed +sched_rr_get_interval01.c:64: TPASS: Time quantum 0s 99999990ns +sched_rr_get_interval01.c:72: TFAIL: /proc/sys/kernel/sched_rr_timeslice_ms != 100 got 90 +sched_rr_get_interval01.c:57: TPASS: sched_rr_get_interval() passed +sched_rr_get_interval01.c:64: TPASS: Time quantum 0s 99999990ns +sched_rr_get_interval01.c:72: TFAIL: /proc/sys/kernel/sched_rr_timeslice_ms != 100 got 90 + +What this test does is to compare the return value from the +sched_rr_get_interval() and the sched_rr_timeslice_ms sysctl file and +fails if they do not match. + +The problem it found is the intial sysctl file value which was computed as: + +static int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE; + +which works fine as long as MSEC_PER_SEC is multiple of HZ, however it +introduces 10% rounding error for CONFIG_HZ_300: + +(MSEC_PER_SEC / HZ) * (100 * HZ / 1000) + +(1000 / 300) * (100 * 300 / 1000) + +3 * 30 = 90 + +This can be easily fixed by reversing the order of the multiplication +and division. After this fix we get: + +(MSEC_PER_SEC * (100 * HZ / 1000)) / HZ + +(1000 * (100 * 300 / 1000)) / 300 + +(1000 * 30) / 300 = 100 + +Fixes: 975e155ed873 ("sched/rt: Show the 'sched_rr_timeslice' SCHED_RR timeslice tuning knob in milliseconds") +Signed-off-by: Cyril Hrubis +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Petr Vorel +Acked-by: Mel Gorman +Tested-by: Petr Vorel +Link: https://lore.kernel.org/r/20230802151906.25258-2-chrubis@suse.cz +Signed-off-by: Sasha Levin +--- + kernel/sched/rt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 4f5796dd26a56..576eb2f51f043 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -25,7 +25,7 @@ unsigned int sysctl_sched_rt_period = 1000000; + int sysctl_sched_rt_runtime = 950000; + + #ifdef CONFIG_SYSCTL +-static int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE; ++static int sysctl_sched_rr_timeslice = (MSEC_PER_SEC * RR_TIMESLICE) / HZ; + static int sched_rt_handler(struct ctl_table *table, int write, void *buffer, + size_t *lenp, loff_t *ppos); + static int sched_rr_handler(struct ctl_table *table, int write, void *buffer, +-- +2.40.1 + diff --git a/queue-6.1/scsi-be2iscsi-add-length-check-when-parsing-nlattrs.patch b/queue-6.1/scsi-be2iscsi-add-length-check-when-parsing-nlattrs.patch new file mode 100644 index 00000000000..6633c256919 --- /dev/null +++ b/queue-6.1/scsi-be2iscsi-add-length-check-when-parsing-nlattrs.patch @@ -0,0 +1,46 @@ +From a369abcaf099f937254269860dbf0003b2d0cc99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 15:59:38 +0800 +Subject: scsi: be2iscsi: Add length check when parsing nlattrs + +From: Lin Ma + +[ Upstream commit ee0268f230f66cb472df3424f380ea668da2749a ] + +beiscsi_iface_set_param() parses nlattr with nla_for_each_attr and assumes +every attributes can be viewed as struct iscsi_iface_param_info. + +This is not true because there is no any nla_policy to validate the +attributes passed from the upper function iscsi_set_iface_params(). + +Add the nla_len check before accessing the nlattr data and return EINVAL if +the length check fails. + +Fixes: 0e43895ec1f4 ("[SCSI] be2iscsi: adding functionality to change network settings using iscsiadm") +Signed-off-by: Lin Ma +Link: https://lore.kernel.org/r/20230723075938.3713864-1-linma@zju.edu.cn +Reviewed-by: Chris Leech +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/be2iscsi/be_iscsi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/scsi/be2iscsi/be_iscsi.c b/drivers/scsi/be2iscsi/be_iscsi.c +index 8aeaddc93b167..8d374ae863ba2 100644 +--- a/drivers/scsi/be2iscsi/be_iscsi.c ++++ b/drivers/scsi/be2iscsi/be_iscsi.c +@@ -450,6 +450,10 @@ int beiscsi_iface_set_param(struct Scsi_Host *shost, + } + + nla_for_each_attr(attrib, data, dt_len, rm_len) { ++ /* ignore nla_type as it is never used */ ++ if (nla_len(attrib) < sizeof(*iface_param)) ++ return -EINVAL; ++ + iface_param = nla_data(attrib); + + if (iface_param->param_type != ISCSI_NET_PARAM) +-- +2.40.1 + diff --git a/queue-6.1/scsi-core-use-32-bit-hostnum-in-scsi_host_lookup.patch b/queue-6.1/scsi-core-use-32-bit-hostnum-in-scsi_host_lookup.patch new file mode 100644 index 00000000000..82c935f64db --- /dev/null +++ b/queue-6.1/scsi-core-use-32-bit-hostnum-in-scsi_host_lookup.patch @@ -0,0 +1,61 @@ +From 5d3db240e84352ab6c4d75eaaa94369e43c31a66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 10:03:25 -0400 +Subject: scsi: core: Use 32-bit hostnum in scsi_host_lookup() + +From: Tony Battersby + +[ Upstream commit 62ec2092095b678ff89ce4ba51c2938cd1e8e630 ] + +Change scsi_host_lookup() hostnum argument type from unsigned short to +unsigned int to match the type used everywhere else. + +Fixes: 6d49f63b415c ("[SCSI] Make host_no an unsigned int") +Signed-off-by: Tony Battersby +Link: https://lore.kernel.org/r/a02497e7-c12b-ef15-47fc-3f0a0b00ffce@cybernetics.com +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hosts.c | 4 ++-- + include/scsi/scsi_host.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c +index 45a2fd6584d16..8b825364baade 100644 +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -535,7 +535,7 @@ EXPORT_SYMBOL(scsi_host_alloc); + static int __scsi_host_match(struct device *dev, const void *data) + { + struct Scsi_Host *p; +- const unsigned short *hostnum = data; ++ const unsigned int *hostnum = data; + + p = class_to_shost(dev); + return p->host_no == *hostnum; +@@ -552,7 +552,7 @@ static int __scsi_host_match(struct device *dev, const void *data) + * that scsi_host_get() took. The put_device() below dropped + * the reference from class_find_device(). + **/ +-struct Scsi_Host *scsi_host_lookup(unsigned short hostnum) ++struct Scsi_Host *scsi_host_lookup(unsigned int hostnum) + { + struct device *cdev; + struct Scsi_Host *shost = NULL; +diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h +index fcf25f1642a3a..d27d9fb7174c8 100644 +--- a/include/scsi/scsi_host.h ++++ b/include/scsi/scsi_host.h +@@ -757,7 +757,7 @@ extern void scsi_remove_host(struct Scsi_Host *); + extern struct Scsi_Host *scsi_host_get(struct Scsi_Host *); + extern int scsi_host_busy(struct Scsi_Host *shost); + extern void scsi_host_put(struct Scsi_Host *t); +-extern struct Scsi_Host *scsi_host_lookup(unsigned short); ++extern struct Scsi_Host *scsi_host_lookup(unsigned int hostnum); + extern const char *scsi_host_state_name(enum scsi_host_state); + extern void scsi_host_complete_all_commands(struct Scsi_Host *shost, + enum scsi_host_status status); +-- +2.40.1 + diff --git a/queue-6.1/scsi-fcoe-fix-potential-deadlock-on-fip-ctlr_lock.patch b/queue-6.1/scsi-fcoe-fix-potential-deadlock-on-fip-ctlr_lock.patch new file mode 100644 index 00000000000..0eb4a3dec09 --- /dev/null +++ b/queue-6.1/scsi-fcoe-fix-potential-deadlock-on-fip-ctlr_lock.patch @@ -0,0 +1,156 @@ +From 51c80d29cdccf38661762ecce49e92b31c920484 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 07:47:08 +0000 +Subject: scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock + +From: Chengfeng Ye + +[ Upstream commit 1a1975551943f681772720f639ff42fbaa746212 ] + +There is a long call chain that &fip->ctlr_lock is acquired by isr +fnic_isr_msix_wq_copy() under hard IRQ context. Thus other process context +code acquiring the lock should disable IRQ, otherwise deadlock could happen +if the IRQ preempts the execution while the lock is held in process context +on the same CPU. + +[ISR] +fnic_isr_msix_wq_copy() + -> fnic_wq_copy_cmpl_handler() + -> fnic_fcpio_cmpl_handler() + -> fnic_fcpio_flogi_reg_cmpl_handler() + -> fnic_flush_tx() + -> fnic_send_frame() + -> fcoe_ctlr_els_send() + -> spin_lock_bh(&fip->ctlr_lock) + +[Process Context] +1. fcoe_ctlr_timer_work() + -> fcoe_ctlr_flogi_send() + -> spin_lock_bh(&fip->ctlr_lock) + +2. fcoe_ctlr_recv_work() + -> fcoe_ctlr_recv_handler() + -> fcoe_ctlr_recv_els() + -> fcoe_ctlr_announce() + -> spin_lock_bh(&fip->ctlr_lock) + +3. fcoe_ctlr_recv_work() + -> fcoe_ctlr_recv_handler() + -> fcoe_ctlr_recv_els() + -> fcoe_ctlr_flogi_retry() + -> spin_lock_bh(&fip->ctlr_lock) + +4. -> fcoe_xmit() + -> fcoe_ctlr_els_send() + -> spin_lock_bh(&fip->ctlr_lock) + +spin_lock_bh() is not enough since fnic_isr_msix_wq_copy() is a +hardirq. + +These flaws were found by an experimental static analysis tool I am +developing for irq-related deadlock. + +The patch fix the potential deadlocks by spin_lock_irqsave() to disable +hard irq. + +Fixes: 794d98e77f59 ("[SCSI] libfcoe: retry rejected FLOGI to another FCF if possible") +Signed-off-by: Chengfeng Ye +Link: https://lore.kernel.org/r/20230817074708.7509-1-dg573847474@gmail.com +Reviewed-by: Davidlohr Bueso +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/fcoe/fcoe_ctlr.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c +index ddc048069af25..8a4124e7d2043 100644 +--- a/drivers/scsi/fcoe/fcoe_ctlr.c ++++ b/drivers/scsi/fcoe/fcoe_ctlr.c +@@ -319,16 +319,17 @@ static void fcoe_ctlr_announce(struct fcoe_ctlr *fip) + { + struct fcoe_fcf *sel; + struct fcoe_fcf *fcf; ++ unsigned long flags; + + mutex_lock(&fip->ctlr_mutex); +- spin_lock_bh(&fip->ctlr_lock); ++ spin_lock_irqsave(&fip->ctlr_lock, flags); + + kfree_skb(fip->flogi_req); + fip->flogi_req = NULL; + list_for_each_entry(fcf, &fip->fcfs, list) + fcf->flogi_sent = 0; + +- spin_unlock_bh(&fip->ctlr_lock); ++ spin_unlock_irqrestore(&fip->ctlr_lock, flags); + sel = fip->sel_fcf; + + if (sel && ether_addr_equal(sel->fcf_mac, fip->dest_addr)) +@@ -699,6 +700,7 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport, + { + struct fc_frame *fp; + struct fc_frame_header *fh; ++ unsigned long flags; + u16 old_xid; + u8 op; + u8 mac[ETH_ALEN]; +@@ -732,11 +734,11 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport, + op = FIP_DT_FLOGI; + if (fip->mode == FIP_MODE_VN2VN) + break; +- spin_lock_bh(&fip->ctlr_lock); ++ spin_lock_irqsave(&fip->ctlr_lock, flags); + kfree_skb(fip->flogi_req); + fip->flogi_req = skb; + fip->flogi_req_send = 1; +- spin_unlock_bh(&fip->ctlr_lock); ++ spin_unlock_irqrestore(&fip->ctlr_lock, flags); + schedule_work(&fip->timer_work); + return -EINPROGRESS; + case ELS_FDISC: +@@ -1705,10 +1707,11 @@ static int fcoe_ctlr_flogi_send_locked(struct fcoe_ctlr *fip) + static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip) + { + struct fcoe_fcf *fcf; ++ unsigned long flags; + int error; + + mutex_lock(&fip->ctlr_mutex); +- spin_lock_bh(&fip->ctlr_lock); ++ spin_lock_irqsave(&fip->ctlr_lock, flags); + LIBFCOE_FIP_DBG(fip, "re-sending FLOGI - reselect\n"); + fcf = fcoe_ctlr_select(fip); + if (!fcf || fcf->flogi_sent) { +@@ -1719,7 +1722,7 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip) + fcoe_ctlr_solicit(fip, NULL); + error = fcoe_ctlr_flogi_send_locked(fip); + } +- spin_unlock_bh(&fip->ctlr_lock); ++ spin_unlock_irqrestore(&fip->ctlr_lock, flags); + mutex_unlock(&fip->ctlr_mutex); + return error; + } +@@ -1736,8 +1739,9 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip) + static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip) + { + struct fcoe_fcf *fcf; ++ unsigned long flags; + +- spin_lock_bh(&fip->ctlr_lock); ++ spin_lock_irqsave(&fip->ctlr_lock, flags); + fcf = fip->sel_fcf; + if (!fcf || !fip->flogi_req_send) + goto unlock; +@@ -1764,7 +1768,7 @@ static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip) + } else /* XXX */ + LIBFCOE_FIP_DBG(fip, "No FCF selected - defer send\n"); + unlock: +- spin_unlock_bh(&fip->ctlr_lock); ++ spin_unlock_irqrestore(&fip->ctlr_lock, flags); + } + + /** +-- +2.40.1 + diff --git a/queue-6.1/scsi-hisi_sas-fix-normally-completed-i-o-analysed-as.patch b/queue-6.1/scsi-hisi_sas-fix-normally-completed-i-o-analysed-as.patch new file mode 100644 index 00000000000..0d5e6a43ea0 --- /dev/null +++ b/queue-6.1/scsi-hisi_sas-fix-normally-completed-i-o-analysed-as.patch @@ -0,0 +1,90 @@ +From eba93f36568c16e9ccd750b2ed36dfe888ed6d2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 11:14:58 +0800 +Subject: scsi: hisi_sas: Fix normally completed I/O analysed as failed + +From: Xingui Yang + +[ Upstream commit f5393a5602cacfda2014e0ff8220e5a7564e7cd1 ] + +The PIO read command has no response frame and the struct iu[1024] won't be +filled. I/Os which are normally completed will be treated as failed in +sas_ata_task_done() when iu contains abnormal dirty data. + +Consequently ending_fis should not be filled by iu when the response frame +hasn't been written to memory. + +Fixes: d380f55503ed ("scsi: hisi_sas: Don't bother clearing status buffer IU in task prep") +Signed-off-by: Xingui Yang +Signed-off-by: Xiang Chen +Link: https://lore.kernel.org/r/1689045300-44318-2-git-send-email-chenxiang66@hisilicon.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 11 +++++++++-- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 6 ++++-- + 2 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +index 02575d81afca2..50697672146ad 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +@@ -2026,6 +2026,11 @@ static void slot_err_v2_hw(struct hisi_hba *hisi_hba, + u16 dma_tx_err_type = le16_to_cpu(err_record->dma_tx_err_type); + u16 sipc_rx_err_type = le16_to_cpu(err_record->sipc_rx_err_type); + u32 dma_rx_err_type = le32_to_cpu(err_record->dma_rx_err_type); ++ struct hisi_sas_complete_v2_hdr *complete_queue = ++ hisi_hba->complete_hdr[slot->cmplt_queue]; ++ struct hisi_sas_complete_v2_hdr *complete_hdr = ++ &complete_queue[slot->cmplt_queue_slot]; ++ u32 dw0 = le32_to_cpu(complete_hdr->dw0); + int error = -1; + + if (err_phase == 1) { +@@ -2310,7 +2315,8 @@ static void slot_err_v2_hw(struct hisi_hba *hisi_hba, + break; + } + } +- hisi_sas_sata_done(task, slot); ++ if (dw0 & CMPLT_HDR_RSPNS_XFRD_MSK) ++ hisi_sas_sata_done(task, slot); + } + break; + default: +@@ -2443,7 +2449,8 @@ static void slot_complete_v2_hw(struct hisi_hba *hisi_hba, + case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP: + { + ts->stat = SAS_SAM_STAT_GOOD; +- hisi_sas_sata_done(task, slot); ++ if (dw0 & CMPLT_HDR_RSPNS_XFRD_MSK) ++ hisi_sas_sata_done(task, slot); + break; + } + default: +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 8544c1554f5ff..c0e74d768716d 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -2203,7 +2203,8 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task, + ts->stat = SAS_OPEN_REJECT; + ts->open_rej_reason = SAS_OREJ_RSVD_RETRY; + } +- hisi_sas_sata_done(task, slot); ++ if (dw0 & CMPLT_HDR_RSPNS_XFRD_MSK) ++ hisi_sas_sata_done(task, slot); + break; + case SAS_PROTOCOL_SMP: + ts->stat = SAS_SAM_STAT_CHECK_CONDITION; +@@ -2330,7 +2331,8 @@ static void slot_complete_v3_hw(struct hisi_hba *hisi_hba, + case SAS_PROTOCOL_STP: + case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP: + ts->stat = SAS_SAM_STAT_GOOD; +- hisi_sas_sata_done(task, slot); ++ if (dw0 & CMPLT_HDR_RSPNS_XFRD_MSK) ++ hisi_sas_sata_done(task, slot); + break; + default: + ts->stat = SAS_SAM_STAT_CHECK_CONDITION; +-- +2.40.1 + diff --git a/queue-6.1/scsi-hisi_sas-fix-warnings-detected-by-sparse.patch b/queue-6.1/scsi-hisi_sas-fix-warnings-detected-by-sparse.patch new file mode 100644 index 00000000000..fcaf371f357 --- /dev/null +++ b/queue-6.1/scsi-hisi_sas-fix-warnings-detected-by-sparse.patch @@ -0,0 +1,60 @@ +From 038e84aa78598789a6379dd54d38509abe14b85f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 10:41:21 +0800 +Subject: scsi: hisi_sas: Fix warnings detected by sparse + +From: Xingui Yang + +[ Upstream commit c0328cc595124579328462fc45d7a29a084cf357 ] + +This patch fixes the following warning: + +drivers/scsi/hisi_sas/hisi_sas_v3_hw.c:2168:43: sparse: sparse: restricted __le32 degrades to integer + +Reported-by: kernel test robot +Link: https://lore.kernel.org/oe-kbuild-all/202304161254.NztCVZIO-lkp@intel.com/ +Signed-off-by: Xingui Yang +Signed-off-by: Xiang Chen +Link: https://lore.kernel.org/r/1684118481-95908-4-git-send-email-chenxiang66@hisilicon.com +Signed-off-by: Martin K. Petersen +Stable-dep-of: f5393a5602ca ("scsi: hisi_sas: Fix normally completed I/O analysed as failed") +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index e8a3511040af2..8544c1554f5ff 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -2163,6 +2163,7 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task, + u32 trans_tx_fail_type = le32_to_cpu(record->trans_tx_fail_type); + u16 sipc_rx_err_type = le16_to_cpu(record->sipc_rx_err_type); + u32 dw3 = le32_to_cpu(complete_hdr->dw3); ++ u32 dw0 = le32_to_cpu(complete_hdr->dw0); + + switch (task->task_proto) { + case SAS_PROTOCOL_SSP: +@@ -2172,8 +2173,8 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task, + * but I/O information has been written to the host memory, we examine + * response IU. + */ +- if (!(complete_hdr->dw0 & CMPLT_HDR_RSPNS_GOOD_MSK) && +- (complete_hdr->dw0 & CMPLT_HDR_RSPNS_XFRD_MSK)) ++ if (!(dw0 & CMPLT_HDR_RSPNS_GOOD_MSK) && ++ (dw0 & CMPLT_HDR_RSPNS_XFRD_MSK)) + return false; + + ts->residual = trans_tx_fail_type; +@@ -2189,7 +2190,7 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task, + case SAS_PROTOCOL_SATA: + case SAS_PROTOCOL_STP: + case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP: +- if ((complete_hdr->dw0 & CMPLT_HDR_RSPNS_XFRD_MSK) && ++ if ((dw0 & CMPLT_HDR_RSPNS_XFRD_MSK) && + (sipc_rx_err_type & RX_FIS_STATUS_ERR_MSK)) { + ts->stat = SAS_PROTO_RESPONSE; + } else if (dma_rx_err_type & RX_DATA_LEN_UNDERFLOW_MSK) { +-- +2.40.1 + diff --git a/queue-6.1/scsi-iscsi-add-length-check-for-nlattr-payload.patch b/queue-6.1/scsi-iscsi-add-length-check-for-nlattr-payload.patch new file mode 100644 index 00000000000..b1d5a468dc6 --- /dev/null +++ b/queue-6.1/scsi-iscsi-add-length-check-for-nlattr-payload.patch @@ -0,0 +1,306 @@ +From 0252531278a01dc0c89326931c69a99be52a90d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 10:45:29 +0800 +Subject: scsi: iscsi: Add length check for nlattr payload + +From: Lin Ma + +[ Upstream commit 971dfcb74a800047952f5288512b9c7ddedb050a ] + +The current NETLINK_ISCSI netlink parsing loop checks every nlmsg to make +sure the length is bigger than sizeof(struct iscsi_uevent) and then calls +iscsi_if_recv_msg(). + + nlh = nlmsg_hdr(skb); + if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) || + skb->len < nlh->nlmsg_len) { + break; + } + ... + err = iscsi_if_recv_msg(skb, nlh, &group); + +Hence, in iscsi_if_recv_msg() the nlmsg_data can be safely converted to +iscsi_uevent as the length is already checked. + +However, in other cases the length of nlattr payload is not checked before +the payload is converted to other data structures. One example is +iscsi_set_path() which converts the payload to type iscsi_path without any +checks: + + params = (struct iscsi_path *)((char *)ev + sizeof(*ev)); + +Whereas iscsi_if_transport_conn() correctly checks the pdu_len: + + pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev); + if ((ev->u.send_pdu.hdr_size > pdu_len) .. + err = -EINVAL; + +To sum up, some code paths called in iscsi_if_recv_msg() do not check the +length of the data (see below picture) and directly convert the data to +another data structure. This could result in an out-of-bound reads and heap +dirty data leakage. + + _________ nlmsg_len(nlh) _______________ + / \ ++----------+--------------+---------------------------+ +| nlmsghdr | iscsi_uevent | data | ++----------+--------------+---------------------------+ + \ / + iscsi_uevent->u.set_param.len + +Fix the issue by adding the length check before accessing it. To clean up +the code, an additional parameter named rlen is added. The rlen is +calculated at the beginning of iscsi_if_recv_msg() which avoids duplicated +calculation. + +Fixes: ac20c7bf070d ("[SCSI] iscsi_transport: Added Ping support") +Fixes: 43514774ff40 ("[SCSI] iscsi class: Add new NETLINK_ISCSI messages for cnic/bnx2i driver.") +Fixes: 1d9bf13a9cf9 ("[SCSI] iscsi class: add iscsi host set param event") +Fixes: 01cb225dad8d ("[SCSI] iscsi: add target discvery event to transport class") +Fixes: 264faaaa1254 ("[SCSI] iscsi: add transport end point callbacks") +Fixes: fd7255f51a13 ("[SCSI] iscsi: add sysfs attrs for uspace sync up") +Signed-off-by: Lin Ma +Link: https://lore.kernel.org/r/20230725024529.428311-1-linma@zju.edu.cn +Reviewed-by: Chris Leech +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_iscsi.c | 72 +++++++++++++++++------------ + 1 file changed, 43 insertions(+), 29 deletions(-) + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index b9b97300e3b3c..2680de88f5bbc 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -3013,14 +3013,15 @@ iscsi_if_destroy_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev + } + + static int +-iscsi_if_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev) ++iscsi_if_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev, u32 rlen) + { + char *data = (char*)ev + sizeof(*ev); + struct iscsi_cls_conn *conn; + struct iscsi_cls_session *session; + int err = 0, value = 0, state; + +- if (ev->u.set_param.len > PAGE_SIZE) ++ if (ev->u.set_param.len > rlen || ++ ev->u.set_param.len > PAGE_SIZE) + return -EINVAL; + + session = iscsi_session_lookup(ev->u.set_param.sid); +@@ -3117,7 +3118,7 @@ static int iscsi_if_ep_disconnect(struct iscsi_transport *transport, + + static int + iscsi_if_transport_ep(struct iscsi_transport *transport, +- struct iscsi_uevent *ev, int msg_type) ++ struct iscsi_uevent *ev, int msg_type, u32 rlen) + { + struct iscsi_endpoint *ep; + int rc = 0; +@@ -3125,7 +3126,10 @@ iscsi_if_transport_ep(struct iscsi_transport *transport, + switch (msg_type) { + case ISCSI_UEVENT_TRANSPORT_EP_CONNECT_THROUGH_HOST: + case ISCSI_UEVENT_TRANSPORT_EP_CONNECT: +- rc = iscsi_if_ep_connect(transport, ev, msg_type); ++ if (rlen < sizeof(struct sockaddr)) ++ rc = -EINVAL; ++ else ++ rc = iscsi_if_ep_connect(transport, ev, msg_type); + break; + case ISCSI_UEVENT_TRANSPORT_EP_POLL: + if (!transport->ep_poll) +@@ -3149,12 +3153,15 @@ iscsi_if_transport_ep(struct iscsi_transport *transport, + + static int + iscsi_tgt_dscvr(struct iscsi_transport *transport, +- struct iscsi_uevent *ev) ++ struct iscsi_uevent *ev, u32 rlen) + { + struct Scsi_Host *shost; + struct sockaddr *dst_addr; + int err; + ++ if (rlen < sizeof(*dst_addr)) ++ return -EINVAL; ++ + if (!transport->tgt_dscvr) + return -EINVAL; + +@@ -3175,7 +3182,7 @@ iscsi_tgt_dscvr(struct iscsi_transport *transport, + + static int + iscsi_set_host_param(struct iscsi_transport *transport, +- struct iscsi_uevent *ev) ++ struct iscsi_uevent *ev, u32 rlen) + { + char *data = (char*)ev + sizeof(*ev); + struct Scsi_Host *shost; +@@ -3184,7 +3191,8 @@ iscsi_set_host_param(struct iscsi_transport *transport, + if (!transport->set_host_param) + return -ENOSYS; + +- if (ev->u.set_host_param.len > PAGE_SIZE) ++ if (ev->u.set_host_param.len > rlen || ++ ev->u.set_host_param.len > PAGE_SIZE) + return -EINVAL; + + shost = scsi_host_lookup(ev->u.set_host_param.host_no); +@@ -3201,12 +3209,15 @@ iscsi_set_host_param(struct iscsi_transport *transport, + } + + static int +-iscsi_set_path(struct iscsi_transport *transport, struct iscsi_uevent *ev) ++iscsi_set_path(struct iscsi_transport *transport, struct iscsi_uevent *ev, u32 rlen) + { + struct Scsi_Host *shost; + struct iscsi_path *params; + int err; + ++ if (rlen < sizeof(*params)) ++ return -EINVAL; ++ + if (!transport->set_path) + return -ENOSYS; + +@@ -3266,12 +3277,15 @@ iscsi_set_iface_params(struct iscsi_transport *transport, + } + + static int +-iscsi_send_ping(struct iscsi_transport *transport, struct iscsi_uevent *ev) ++iscsi_send_ping(struct iscsi_transport *transport, struct iscsi_uevent *ev, u32 rlen) + { + struct Scsi_Host *shost; + struct sockaddr *dst_addr; + int err; + ++ if (rlen < sizeof(*dst_addr)) ++ return -EINVAL; ++ + if (!transport->send_ping) + return -ENOSYS; + +@@ -3769,13 +3783,12 @@ iscsi_get_host_stats(struct iscsi_transport *transport, struct nlmsghdr *nlh) + } + + static int iscsi_if_transport_conn(struct iscsi_transport *transport, +- struct nlmsghdr *nlh) ++ struct nlmsghdr *nlh, u32 pdu_len) + { + struct iscsi_uevent *ev = nlmsg_data(nlh); + struct iscsi_cls_session *session; + struct iscsi_cls_conn *conn = NULL; + struct iscsi_endpoint *ep; +- uint32_t pdu_len; + int err = 0; + + switch (nlh->nlmsg_type) { +@@ -3860,8 +3873,6 @@ static int iscsi_if_transport_conn(struct iscsi_transport *transport, + + break; + case ISCSI_UEVENT_SEND_PDU: +- pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev); +- + if ((ev->u.send_pdu.hdr_size > pdu_len) || + (ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) { + err = -EINVAL; +@@ -3891,6 +3902,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + struct iscsi_internal *priv; + struct iscsi_cls_session *session; + struct iscsi_endpoint *ep = NULL; ++ u32 rlen; + + if (!netlink_capable(skb, CAP_SYS_ADMIN)) + return -EPERM; +@@ -3910,6 +3922,13 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + + portid = NETLINK_CB(skb).portid; + ++ /* ++ * Even though the remaining payload may not be regarded as nlattr, ++ * (like address or something else), calculate the remaining length ++ * here to ease following length checks. ++ */ ++ rlen = nlmsg_attrlen(nlh, sizeof(*ev)); ++ + switch (nlh->nlmsg_type) { + case ISCSI_UEVENT_CREATE_SESSION: + err = iscsi_if_create_session(priv, ep, ev, +@@ -3966,7 +3985,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + err = -EINVAL; + break; + case ISCSI_UEVENT_SET_PARAM: +- err = iscsi_if_set_param(transport, ev); ++ err = iscsi_if_set_param(transport, ev, rlen); + break; + case ISCSI_UEVENT_CREATE_CONN: + case ISCSI_UEVENT_DESTROY_CONN: +@@ -3974,7 +3993,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + case ISCSI_UEVENT_START_CONN: + case ISCSI_UEVENT_BIND_CONN: + case ISCSI_UEVENT_SEND_PDU: +- err = iscsi_if_transport_conn(transport, nlh); ++ err = iscsi_if_transport_conn(transport, nlh, rlen); + break; + case ISCSI_UEVENT_GET_STATS: + err = iscsi_if_get_stats(transport, nlh); +@@ -3983,23 +4002,22 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + case ISCSI_UEVENT_TRANSPORT_EP_POLL: + case ISCSI_UEVENT_TRANSPORT_EP_DISCONNECT: + case ISCSI_UEVENT_TRANSPORT_EP_CONNECT_THROUGH_HOST: +- err = iscsi_if_transport_ep(transport, ev, nlh->nlmsg_type); ++ err = iscsi_if_transport_ep(transport, ev, nlh->nlmsg_type, rlen); + break; + case ISCSI_UEVENT_TGT_DSCVR: +- err = iscsi_tgt_dscvr(transport, ev); ++ err = iscsi_tgt_dscvr(transport, ev, rlen); + break; + case ISCSI_UEVENT_SET_HOST_PARAM: +- err = iscsi_set_host_param(transport, ev); ++ err = iscsi_set_host_param(transport, ev, rlen); + break; + case ISCSI_UEVENT_PATH_UPDATE: +- err = iscsi_set_path(transport, ev); ++ err = iscsi_set_path(transport, ev, rlen); + break; + case ISCSI_UEVENT_SET_IFACE_PARAMS: +- err = iscsi_set_iface_params(transport, ev, +- nlmsg_attrlen(nlh, sizeof(*ev))); ++ err = iscsi_set_iface_params(transport, ev, rlen); + break; + case ISCSI_UEVENT_PING: +- err = iscsi_send_ping(transport, ev); ++ err = iscsi_send_ping(transport, ev, rlen); + break; + case ISCSI_UEVENT_GET_CHAP: + err = iscsi_get_chap(transport, nlh); +@@ -4008,13 +4026,10 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + err = iscsi_delete_chap(transport, ev); + break; + case ISCSI_UEVENT_SET_FLASHNODE_PARAMS: +- err = iscsi_set_flashnode_param(transport, ev, +- nlmsg_attrlen(nlh, +- sizeof(*ev))); ++ err = iscsi_set_flashnode_param(transport, ev, rlen); + break; + case ISCSI_UEVENT_NEW_FLASHNODE: +- err = iscsi_new_flashnode(transport, ev, +- nlmsg_attrlen(nlh, sizeof(*ev))); ++ err = iscsi_new_flashnode(transport, ev, rlen); + break; + case ISCSI_UEVENT_DEL_FLASHNODE: + err = iscsi_del_flashnode(transport, ev); +@@ -4029,8 +4044,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + err = iscsi_logout_flashnode_sid(transport, ev); + break; + case ISCSI_UEVENT_SET_CHAP: +- err = iscsi_set_chap(transport, ev, +- nlmsg_attrlen(nlh, sizeof(*ev))); ++ err = iscsi_set_chap(transport, ev, rlen); + break; + case ISCSI_UEVENT_GET_HOST_STATS: + err = iscsi_get_host_stats(transport, nlh); +-- +2.40.1 + diff --git a/queue-6.1/scsi-iscsi-add-strlen-check-in-iscsi_if_set-_host-_p.patch b/queue-6.1/scsi-iscsi-add-strlen-check-in-iscsi_if_set-_host-_p.patch new file mode 100644 index 00000000000..01cfea3c5e3 --- /dev/null +++ b/queue-6.1/scsi-iscsi-add-strlen-check-in-iscsi_if_set-_host-_p.patch @@ -0,0 +1,79 @@ +From 4574370a8ade7b67be547d9ef630936831c10989 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 15:58:20 +0800 +Subject: scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() + +From: Lin Ma + +[ Upstream commit ce51c817008450ef4188471db31639d42d37a5e1 ] + +The functions iscsi_if_set_param() and iscsi_if_set_host_param() convert an +nlattr payload to type char* and then call C string handling functions like +sscanf and kstrdup: + + char *data = (char*)ev + sizeof(*ev); + ... + sscanf(data, "%d", &value); + +However, since the nlattr is provided by the user-space program and the +nlmsg skb is allocated with GFP_KERNEL instead of GFP_ZERO flag (see +netlink_alloc_large_skb() in netlink_sendmsg()), dirty data on the heap can +lead to an OOB access for those string handling functions. + +By investigating how the bug is introduced, we find it is really +interesting as the old version parsing code starting from commit +fd7255f51a13 ("[SCSI] iscsi: add sysfs attrs for uspace sync up") treated +the nlattr as integer bytes instead of string and had length check in +iscsi_copy_param(): + + if (ev->u.set_param.len != sizeof(uint32_t)) + BUG(); + +But, since the commit a54a52caad4b ("[SCSI] iscsi: fixup set/get param +functions"), the code treated the nlattr as C string while forgetting to +add any strlen checks(), opening the possibility of an OOB access. + +Fix the potential OOB by adding the strlen() check before accessing the +buf. If the data passes this check, all low-level set_param handlers can +safely treat this buf as legal C string. + +Fixes: fd7255f51a13 ("[SCSI] iscsi: add sysfs attrs for uspace sync up") +Fixes: 1d9bf13a9cf9 ("[SCSI] iscsi class: add iscsi host set param event") +Signed-off-by: Lin Ma +Link: https://lore.kernel.org/r/20230723075820.3713119-1-linma@zju.edu.cn +Reviewed-by: Chris Leech +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_iscsi.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 2680de88f5bbc..49dbcd67579aa 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -3029,6 +3029,10 @@ iscsi_if_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev, u + if (!conn || !session) + return -EINVAL; + ++ /* data will be regarded as NULL-ended string, do length check */ ++ if (strlen(data) > ev->u.set_param.len) ++ return -EINVAL; ++ + switch (ev->u.set_param.param) { + case ISCSI_PARAM_SESS_RECOVERY_TMO: + sscanf(data, "%d", &value); +@@ -3202,6 +3206,10 @@ iscsi_set_host_param(struct iscsi_transport *transport, + return -ENODEV; + } + ++ /* see similar check in iscsi_if_set_param() */ ++ if (strlen(data) > ev->u.set_host_param.len) ++ return -EINVAL; ++ + err = transport->set_host_param(shost, ev->u.set_host_param.param, + data, ev->u.set_host_param.len); + scsi_host_put(shost); +-- +2.40.1 + diff --git a/queue-6.1/scsi-iscsi-rename-iscsi_set_param-to-iscsi_if_set_pa.patch b/queue-6.1/scsi-iscsi-rename-iscsi_set_param-to-iscsi_if_set_pa.patch new file mode 100644 index 00000000000..90167c948b8 --- /dev/null +++ b/queue-6.1/scsi-iscsi-rename-iscsi_set_param-to-iscsi_if_set_pa.patch @@ -0,0 +1,50 @@ +From 309ba60bc03b73b9f916d1c3e7ea64b5022bd4e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 18:11:05 +0000 +Subject: scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param() + +From: Wenchao Hao + +[ Upstream commit 0c26a2d7c98039e913e63f9250fde738a3f88a60 ] + +There are two iscsi_set_param() functions defined in libiscsi.c and +scsi_transport_iscsi.c respectively which is confusing. + +Rename the one in scsi_transport_iscsi.c to iscsi_if_set_param(). + +Signed-off-by: Wenchao Hao +Link: https://lore.kernel.org/r/20221122181105.4123935-1-haowenchao@huawei.com +Reviewed-by: Mike Christie +Reviewed-by: Lee Duncan +Signed-off-by: Martin K. Petersen +Stable-dep-of: 971dfcb74a80 ("scsi: iscsi: Add length check for nlattr payload") +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_iscsi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index bf834e72595a3..b9b97300e3b3c 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -3013,7 +3013,7 @@ iscsi_if_destroy_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev + } + + static int +-iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev) ++iscsi_if_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev) + { + char *data = (char*)ev + sizeof(*ev); + struct iscsi_cls_conn *conn; +@@ -3966,7 +3966,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + err = -EINVAL; + break; + case ISCSI_UEVENT_SET_PARAM: +- err = iscsi_set_param(transport, ev); ++ err = iscsi_if_set_param(transport, ev); + break; + case ISCSI_UEVENT_CREATE_CONN: + case ISCSI_UEVENT_DESTROY_CONN: +-- +2.40.1 + diff --git a/queue-6.1/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_de.patch b/queue-6.1/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_de.patch new file mode 100644 index 00000000000..5b7907d82df --- /dev/null +++ b/queue-6.1/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_de.patch @@ -0,0 +1,67 @@ +From 3564d504aa928baa6b1bac7a011ecd23ebb9c251 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jul 2023 10:40:33 +0200 +Subject: scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() + directly + +From: Oleksandr Natalenko + +[ Upstream commit 31b5991a9a91ba97237ac9da509d78eec453ff72 ] + +The qedf_dbg_debug_cmd_read() function invokes sprintf() directly on a +__user pointer, which may crash the kernel. + +Avoid doing that by using a small on-stack buffer for scnprintf() and then +calling simple_read_from_buffer() which does a proper copy_to_user() call. + +Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") +Link: https://lore.kernel.org/lkml/20230724120241.40495-1-oleksandr@redhat.com/ +Link: https://lore.kernel.org/linux-scsi/20230726101236.11922-1-skashyap@marvell.com/ +Cc: Saurav Kashyap +Cc: Rob Evers +Cc: Johannes Thumshirn +Cc: David Laight +Cc: Jozef Bacik +Cc: Laurence Oberman +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: GR-QLogic-Storage-Upstream@marvell.com +Cc: linux-scsi@vger.kernel.org +Reviewed-by: Laurence Oberman +Reviewed-by: Johannes Thumshirn +Tested-by: Laurence Oberman +Acked-by: Saurav Kashyap +Signed-off-by: Oleksandr Natalenko +Link: https://lore.kernel.org/r/20230731084034.37021-3-oleksandr@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_debugfs.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c +index 3eb4334ac6a32..1c5716540e465 100644 +--- a/drivers/scsi/qedf/qedf_debugfs.c ++++ b/drivers/scsi/qedf/qedf_debugfs.c +@@ -138,15 +138,14 @@ qedf_dbg_debug_cmd_read(struct file *filp, char __user *buffer, size_t count, + loff_t *ppos) + { + int cnt; ++ char cbuf[32]; + struct qedf_dbg_ctx *qedf_dbg = + (struct qedf_dbg_ctx *)filp->private_data; + + QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "debug mask=0x%x\n", qedf_debug); +- cnt = sprintf(buffer, "debug mask = 0x%x\n", qedf_debug); ++ cnt = scnprintf(cbuf, sizeof(cbuf), "debug mask = 0x%x\n", qedf_debug); + +- cnt = min_t(int, count, cnt - *ppos); +- *ppos += cnt; +- return cnt; ++ return simple_read_from_buffer(buffer, count, ppos, cbuf, cnt); + } + + static ssize_t +-- +2.40.1 + diff --git a/queue-6.1/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_fp.patch b/queue-6.1/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_fp.patch new file mode 100644 index 00000000000..d1599a9785e --- /dev/null +++ b/queue-6.1/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_fp.patch @@ -0,0 +1,112 @@ +From c32bdd124318176d1469f53751ac7131311f7f44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jul 2023 10:40:34 +0200 +Subject: scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() + directly + +From: Oleksandr Natalenko + +[ Upstream commit 25dbc20deab5165f847b4eb42f376f725a986ee8 ] + +The qedf_dbg_fp_int_cmd_read() function invokes sprintf() directly on a +__user pointer, which may crash the kernel. + +Avoid doing that by vmalloc()'ating a buffer for scnprintf() and then +calling simple_read_from_buffer() which does a proper copy_to_user() call. + +Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") +Link: https://lore.kernel.org/lkml/20230724120241.40495-1-oleksandr@redhat.com/ +Link: https://lore.kernel.org/linux-scsi/20230726101236.11922-1-skashyap@marvell.com/ +Cc: Saurav Kashyap +Cc: Rob Evers +Cc: Johannes Thumshirn +Cc: David Laight +Cc: Jozef Bacik +Cc: Laurence Oberman +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: GR-QLogic-Storage-Upstream@marvell.com +Cc: linux-scsi@vger.kernel.org +Reviewed-by: Laurence Oberman +Reviewed-by: Johannes Thumshirn +Tested-by: Laurence Oberman +Acked-by: Saurav Kashyap +Signed-off-by: Oleksandr Natalenko +Link: https://lore.kernel.org/r/20230731084034.37021-4-oleksandr@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_dbg.h | 2 ++ + drivers/scsi/qedf/qedf_debugfs.c | 21 +++++++++++++++------ + 2 files changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/qedf/qedf_dbg.h b/drivers/scsi/qedf/qedf_dbg.h +index f4d81127239eb..5ec2b817c694a 100644 +--- a/drivers/scsi/qedf/qedf_dbg.h ++++ b/drivers/scsi/qedf/qedf_dbg.h +@@ -59,6 +59,8 @@ extern uint qedf_debug; + #define QEDF_LOG_NOTICE 0x40000000 /* Notice logs */ + #define QEDF_LOG_WARN 0x80000000 /* Warning logs */ + ++#define QEDF_DEBUGFS_LOG_LEN (2 * PAGE_SIZE) ++ + /* Debug context structure */ + struct qedf_dbg_ctx { + unsigned int host_no; +diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c +index 1c5716540e465..451fd236bfd05 100644 +--- a/drivers/scsi/qedf/qedf_debugfs.c ++++ b/drivers/scsi/qedf/qedf_debugfs.c +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + + #include "qedf.h" + #include "qedf_dbg.h" +@@ -98,7 +99,9 @@ static ssize_t + qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count, + loff_t *ppos) + { ++ ssize_t ret; + size_t cnt = 0; ++ char *cbuf; + int id; + struct qedf_fastpath *fp = NULL; + struct qedf_dbg_ctx *qedf_dbg = +@@ -108,19 +111,25 @@ qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count, + + QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n"); + +- cnt = sprintf(buffer, "\nFastpath I/O completions\n\n"); ++ cbuf = vmalloc(QEDF_DEBUGFS_LOG_LEN); ++ if (!cbuf) ++ return 0; ++ ++ cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt, "\nFastpath I/O completions\n\n"); + + for (id = 0; id < qedf->num_queues; id++) { + fp = &(qedf->fp_array[id]); + if (fp->sb_id == QEDF_SB_ID_NULL) + continue; +- cnt += sprintf((buffer + cnt), "#%d: %lu\n", id, +- fp->completions); ++ cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt, ++ "#%d: %lu\n", id, fp->completions); + } + +- cnt = min_t(int, count, cnt - *ppos); +- *ppos += cnt; +- return cnt; ++ ret = simple_read_from_buffer(buffer, count, ppos, cbuf, cnt); ++ ++ vfree(cbuf); ++ ++ return ret; + } + + static ssize_t +-- +2.40.1 + diff --git a/queue-6.1/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_st.patch b/queue-6.1/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_st.patch new file mode 100644 index 00000000000..8841b1a162b --- /dev/null +++ b/queue-6.1/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_st.patch @@ -0,0 +1,70 @@ +From a953b01c5a03fa00340c5777156036c32578ef88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jul 2023 10:40:32 +0200 +Subject: scsi: qedf: Do not touch __user pointer in + qedf_dbg_stop_io_on_error_cmd_read() directly + +From: Oleksandr Natalenko + +[ Upstream commit 7d3d20dee4f648ec44e9717d5f647d594d184433 ] + +The qedf_dbg_stop_io_on_error_cmd_read() function invokes sprintf() +directly on a __user pointer, which may crash the kernel. + +Avoid doing that by using a small on-stack buffer for scnprintf() and then +calling simple_read_from_buffer() which does a proper copy_to_user() call. + +Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") +Link: https://lore.kernel.org/lkml/20230724120241.40495-1-oleksandr@redhat.com/ +Link: https://lore.kernel.org/linux-scsi/20230726101236.11922-1-skashyap@marvell.com/ +Cc: Saurav Kashyap +Cc: Rob Evers +Cc: Johannes Thumshirn +Cc: David Laight +Cc: Jozef Bacik +Cc: Laurence Oberman +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: GR-QLogic-Storage-Upstream@marvell.com +Cc: linux-scsi@vger.kernel.org +Reviewed-by: Laurence Oberman +Reviewed-by: Johannes Thumshirn +Tested-by: Laurence Oberman +Acked-by: Saurav Kashyap +Signed-off-by: Oleksandr Natalenko +Link: https://lore.kernel.org/r/20230731084034.37021-2-oleksandr@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_debugfs.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c +index a3ed681c8ce3f..3eb4334ac6a32 100644 +--- a/drivers/scsi/qedf/qedf_debugfs.c ++++ b/drivers/scsi/qedf/qedf_debugfs.c +@@ -185,18 +185,17 @@ qedf_dbg_stop_io_on_error_cmd_read(struct file *filp, char __user *buffer, + size_t count, loff_t *ppos) + { + int cnt; ++ char cbuf[7]; + struct qedf_dbg_ctx *qedf_dbg = + (struct qedf_dbg_ctx *)filp->private_data; + struct qedf_ctx *qedf = container_of(qedf_dbg, + struct qedf_ctx, dbg_ctx); + + QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n"); +- cnt = sprintf(buffer, "%s\n", ++ cnt = scnprintf(cbuf, sizeof(cbuf), "%s\n", + qedf->stop_io_on_error ? "true" : "false"); + +- cnt = min_t(int, count, cnt - *ppos); +- *ppos += cnt; +- return cnt; ++ return simple_read_from_buffer(buffer, count, ppos, cbuf, cnt); + } + + static ssize_t +-- +2.40.1 + diff --git a/queue-6.1/scsi-qla4xxx-add-length-check-when-parsing-nlattrs.patch b/queue-6.1/scsi-qla4xxx-add-length-check-when-parsing-nlattrs.patch new file mode 100644 index 00000000000..03a90e4a2b0 --- /dev/null +++ b/queue-6.1/scsi-qla4xxx-add-length-check-when-parsing-nlattrs.patch @@ -0,0 +1,80 @@ +From b7a36917beaefb278f893f10ed23539821ed9fbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 16:00:53 +0800 +Subject: scsi: qla4xxx: Add length check when parsing nlattrs + +From: Lin Ma + +[ Upstream commit 47cd3770e31df942e2bb925a9a855c79ed0662eb ] + +There are three places that qla4xxx parses nlattrs: + + - qla4xxx_set_chap_entry() + + - qla4xxx_iface_set_param() + + - qla4xxx_sysfs_ddb_set_param() + +and each of them directly converts the nlattr to specific pointer of +structure without length checking. This could be dangerous as those +attributes are not validated and a malformed nlattr (e.g., length 0) could +result in an OOB read that leaks heap dirty data. + +Add the nla_len check before accessing the nlattr data and return EINVAL if +the length check fails. + +Fixes: 26ffd7b45fe9 ("[SCSI] qla4xxx: Add support to set CHAP entries") +Fixes: 1e9e2be3ee03 ("[SCSI] qla4xxx: Add flash node mgmt support") +Fixes: 00c31889f751 ("[SCSI] qla4xxx: fix data alignment and use nl helpers") +Signed-off-by: Lin Ma +Link: https://lore.kernel.org/r/20230723080053.3714534-1-linma@zju.edu.cn +Reviewed-by: Chris Leech +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla4xxx/ql4_os.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index 9e849f6b0d0f7..3f2f9734ee42e 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -968,6 +968,11 @@ static int qla4xxx_set_chap_entry(struct Scsi_Host *shost, void *data, int len) + memset(&chap_rec, 0, sizeof(chap_rec)); + + nla_for_each_attr(attr, data, len, rem) { ++ if (nla_len(attr) < sizeof(*param_info)) { ++ rc = -EINVAL; ++ goto exit_set_chap; ++ } ++ + param_info = nla_data(attr); + + switch (param_info->param) { +@@ -2750,6 +2755,11 @@ qla4xxx_iface_set_param(struct Scsi_Host *shost, void *data, uint32_t len) + } + + nla_for_each_attr(attr, data, len, rem) { ++ if (nla_len(attr) < sizeof(*iface_param)) { ++ rval = -EINVAL; ++ goto exit_init_fw_cb; ++ } ++ + iface_param = nla_data(attr); + + if (iface_param->param_type == ISCSI_NET_PARAM) { +@@ -8104,6 +8114,11 @@ qla4xxx_sysfs_ddb_set_param(struct iscsi_bus_flash_session *fnode_sess, + + memset((void *)&chap_tbl, 0, sizeof(chap_tbl)); + nla_for_each_attr(attr, data, len, rem) { ++ if (nla_len(attr) < sizeof(*fnode_param)) { ++ rc = -EINVAL; ++ goto exit_set_param; ++ } ++ + fnode_param = nla_data(attr); + + switch (fnode_param->param) { +-- +2.40.1 + diff --git a/queue-6.1/scsi-rdma-srp-fix-residual-handling.patch b/queue-6.1/scsi-rdma-srp-fix-residual-handling.patch new file mode 100644 index 00000000000..6140a1849e1 --- /dev/null +++ b/queue-6.1/scsi-rdma-srp-fix-residual-handling.patch @@ -0,0 +1,49 @@ +From 95cebeb2b98acafecaed8b9782c17092579b43cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 13:08:30 -0700 +Subject: scsi: RDMA/srp: Fix residual handling + +From: Bart Van Assche + +[ Upstream commit 89e637c19b2441aabc8dbf22a8745b932fd6996e ] + +Although the code for residual handling in the SRP initiator follows the +SCSI documentation, that documentation has never been correct. Because +scsi_finish_command() starts from the data buffer length and subtracts the +residual, scsi_set_resid() must not be called if a residual overflow +occurs. Hence remove the scsi_set_resid() calls from the SRP initiator if a +residual overflow occurrs. + +Cc: Leon Romanovsky +Cc: Jason Gunthorpe +Fixes: 9237f04e12cc ("scsi: core: Fix scsi_get/set_resid() interface") +Fixes: e714531a349f ("IB/srp: Fix residual handling") +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20230724200843.3376570-3-bvanassche@acm.org +Acked-by: Leon Romanovsky +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srp/ib_srp.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index b4d6a4a5ae81e..a7580c4855fec 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -1984,12 +1984,8 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp) + + if (unlikely(rsp->flags & SRP_RSP_FLAG_DIUNDER)) + scsi_set_resid(scmnd, be32_to_cpu(rsp->data_in_res_cnt)); +- else if (unlikely(rsp->flags & SRP_RSP_FLAG_DIOVER)) +- scsi_set_resid(scmnd, -be32_to_cpu(rsp->data_in_res_cnt)); + else if (unlikely(rsp->flags & SRP_RSP_FLAG_DOUNDER)) + scsi_set_resid(scmnd, be32_to_cpu(rsp->data_out_res_cnt)); +- else if (unlikely(rsp->flags & SRP_RSP_FLAG_DOOVER)) +- scsi_set_resid(scmnd, -be32_to_cpu(rsp->data_out_res_cnt)); + + srp_free_req(ch, req, scmnd, + be32_to_cpu(rsp->req_lim_delta)); +-- +2.40.1 + diff --git a/queue-6.1/selftests-bpf-clean-up-fmod_ret-in-bench_rename-test.patch b/queue-6.1/selftests-bpf-clean-up-fmod_ret-in-bench_rename-test.patch new file mode 100644 index 00000000000..48c6e902aed --- /dev/null +++ b/queue-6.1/selftests-bpf-clean-up-fmod_ret-in-bench_rename-test.patch @@ -0,0 +1,52 @@ +From 052a1f6ccb1407f32876187737789afa7caa58d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 11:07:27 +0800 +Subject: selftests/bpf: Clean up fmod_ret in bench_rename test script +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yipeng Zou + +[ Upstream commit 83a89c4b6ae93481d3f618aba6a29d89208d26ed ] + +Running the bench_rename test script, the following error occurs: + + # ./benchs/run_bench_rename.sh + base : 0.819 ± 0.012M/s + kprobe : 0.538 ± 0.009M/s + kretprobe : 0.503 ± 0.004M/s + rawtp : 0.779 ± 0.020M/s + fentry : 0.726 ± 0.007M/s + fexit : 0.691 ± 0.007M/s + benchmark 'rename-fmodret' not found + +The bench_rename_fmodret has been removed in commit b000def2e052 +("selftests: Remove fmod_ret from test_overhead"), thus remove it +from the runners in the test script. + +Fixes: b000def2e052 ("selftests: Remove fmod_ret from test_overhead") +Signed-off-by: Yipeng Zou +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20230814030727.3010390-1-zouyipeng@huawei.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/benchs/run_bench_rename.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/benchs/run_bench_rename.sh b/tools/testing/selftests/bpf/benchs/run_bench_rename.sh +index 16f774b1cdbed..7b281dbe41656 100755 +--- a/tools/testing/selftests/bpf/benchs/run_bench_rename.sh ++++ b/tools/testing/selftests/bpf/benchs/run_bench_rename.sh +@@ -2,7 +2,7 @@ + + set -eufo pipefail + +-for i in base kprobe kretprobe rawtp fentry fexit fmodret ++for i in base kprobe kretprobe rawtp fentry fexit + do + summary=$(sudo ./bench -w2 -d5 -a rename-$i | tail -n1 | cut -d'(' -f1 | cut -d' ' -f3-) + printf "%-10s: %s\n" $i "$summary" +-- +2.40.1 + diff --git a/queue-6.1/selftests-bpf-fix-bpf_nf-failure-upon-test-rerun.patch b/queue-6.1/selftests-bpf-fix-bpf_nf-failure-upon-test-rerun.patch new file mode 100644 index 00000000000..18350e24cfd --- /dev/null +++ b/queue-6.1/selftests-bpf-fix-bpf_nf-failure-upon-test-rerun.patch @@ -0,0 +1,72 @@ +From 7aece2e310edf7e10cd820b9986bc76f1a88fd01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 15:19:42 +0200 +Subject: selftests/bpf: Fix bpf_nf failure upon test rerun + +From: Daniel Borkmann + +[ Upstream commit 17e8e5d6e09adb4b4f4fb5c89b3ec3fcae2c64a6 ] + +Alexei reported: + + After fast forwarding bpf-next today bpf_nf test started to fail when + run twice: + + $ ./test_progs -t bpf_nf + #17 bpf_nf:OK + Summary: 1/10 PASSED, 0 SKIPPED, 0 FAILED + + $ ./test_progs -t bpf_nf + All error logs: + test_bpf_nf_ct:PASS:test_bpf_nf__open_and_load 0 nsec + test_bpf_nf_ct:PASS:iptables-legacy -t raw -A PREROUTING -j CONNMARK + --set-mark 42/0 0 nsec + (network_helpers.c:102: errno: Address already in use) Failed to bind socket + test_bpf_nf_ct:FAIL:start_server unexpected start_server: actual -1 < expected 0 + #17/1 bpf_nf/xdp-ct:FAIL + test_bpf_nf_ct:PASS:test_bpf_nf__open_and_load 0 nsec + test_bpf_nf_ct:PASS:iptables-legacy -t raw -A PREROUTING -j CONNMARK + --set-mark 42/0 0 nsec + (network_helpers.c:102: errno: Address already in use) Failed to bind socket + test_bpf_nf_ct:FAIL:start_server unexpected start_server: actual -1 < expected 0 + #17/2 bpf_nf/tc-bpf-ct:FAIL + #17 bpf_nf:FAIL + Summary: 0/8 PASSED, 0 SKIPPED, 1 FAILED + +I was able to locally reproduce as well. Rearrange the connection teardown +so that the client closes its connection first so that we don't need to +linger in TCP time-wait. + +Fixes: e81fbd4c1ba7 ("selftests/bpf: Add existing connection bpf_*_ct_lookup() test") +Reported-by: Alexei Starovoitov +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/CAADnVQ+0dnDq_v_vH1EfkacbfGnHANaon7zsw10pMb-D9FS0Pw@mail.gmail.com +Link: https://lore.kernel.org/bpf/20230626131942.5100-1-daniel@iogearbox.net +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/bpf_nf.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c +index 8a838ea8bdf3b..b2998896f9f7b 100644 +--- a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c ++++ b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c +@@ -123,12 +123,13 @@ static void test_bpf_nf_ct(int mode) + ASSERT_EQ(skel->data->test_snat_addr, 0, "Test for source natting"); + ASSERT_EQ(skel->data->test_dnat_addr, 0, "Test for destination natting"); + end: +- if (srv_client_fd != -1) +- close(srv_client_fd); + if (client_fd != -1) + close(client_fd); ++ if (srv_client_fd != -1) ++ close(srv_client_fd); + if (srv_fd != -1) + close(srv_fd); ++ + snprintf(cmd, sizeof(cmd), iptables, "-D"); + system(cmd); + test_bpf_nf__destroy(skel); +-- +2.40.1 + diff --git a/queue-6.1/selftests-bpf-fix-repeat-option-when-kfunc_call-veri.patch b/queue-6.1/selftests-bpf-fix-repeat-option-when-kfunc_call-veri.patch new file mode 100644 index 00000000000..e63411dd1ec --- /dev/null +++ b/queue-6.1/selftests-bpf-fix-repeat-option-when-kfunc_call-veri.patch @@ -0,0 +1,39 @@ +From 6dd8338192ee92647573734ccadd47a01ef2f28e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 11:14:34 +0800 +Subject: selftests/bpf: Fix repeat option when kfunc_call verification fails + +From: Yipeng Zou + +[ Upstream commit 811915db674f8daf19bb4fcb67da9017235ce26d ] + +There is no way where topts.repeat can be set to 1 when tc_test fails. +Fix the typo where the break statement slipped by one line. + +Fixes: fb66223a244f ("selftests/bpf: add test for accessing ctx from syscall program type") +Signed-off-by: Yipeng Zou +Signed-off-by: Daniel Borkmann +Reviewed-by: Li Zetao +Link: https://lore.kernel.org/bpf/20230814031434.3077944-1-zouyipeng@huawei.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/kfunc_call.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/kfunc_call.c b/tools/testing/selftests/bpf/prog_tests/kfunc_call.c +index 5af1ee8f0e6ee..36071f3f15ba1 100644 +--- a/tools/testing/selftests/bpf/prog_tests/kfunc_call.c ++++ b/tools/testing/selftests/bpf/prog_tests/kfunc_call.c +@@ -171,8 +171,8 @@ static void verify_fail(struct kfunc_test_params *param) + case tc_test: + topts.data_in = &pkt_v4; + topts.data_size_in = sizeof(pkt_v4); +- break; + topts.repeat = 1; ++ break; + } + + skel = kfunc_call_fail__open_opts(&opts); +-- +2.40.1 + diff --git a/queue-6.1/selftests-bpf-fix-static-assert-compilation-issue-fo.patch b/queue-6.1/selftests-bpf-fix-static-assert-compilation-issue-fo.patch new file mode 100644 index 00000000000..588622d910a --- /dev/null +++ b/queue-6.1/selftests-bpf-fix-static-assert-compilation-issue-fo.patch @@ -0,0 +1,82 @@ +From c64427646205091b7c714dbc11be131d6e36a525 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Aug 2023 08:39:06 +0100 +Subject: selftests/bpf: fix static assert compilation issue for test_cls_*.c + +From: Alan Maguire + +[ Upstream commit 416c6d01244ecbf0abfdb898fd091b50ef951b48 ] + +commit bdeeed3498c7 ("libbpf: fix offsetof() and container_of() to work with CO-RE") + +...was backported to stable trees such as 5.15. The problem is that with older +LLVM/clang (14/15) - which is often used for older kernels - we see compilation +failures in BPF selftests now: + +In file included from progs/test_cls_redirect_subprogs.c:2: +progs/test_cls_redirect.c:90:2: error: static assertion expression is not an integral constant expression + sizeof(flow_ports_t) != + ^~~~~~~~~~~~~~~~~~~~~~~ +progs/test_cls_redirect.c:91:3: note: cast that performs the conversions of a reinterpret_cast is not allowed in a constant expression + offsetofend(struct bpf_sock_tuple, ipv4.dport) - + ^ +progs/test_cls_redirect.c:32:3: note: expanded from macro 'offsetofend' + (offsetof(TYPE, MEMBER) + sizeof((((TYPE *)0)->MEMBER))) + ^ +tools/testing/selftests/bpf/tools/include/bpf/bpf_helpers.h:86:33: note: expanded from macro 'offsetof' + ^ +In file included from progs/test_cls_redirect_subprogs.c:2: +progs/test_cls_redirect.c:95:2: error: static assertion expression is not an integral constant expression + sizeof(flow_ports_t) != + ^~~~~~~~~~~~~~~~~~~~~~~ +progs/test_cls_redirect.c:96:3: note: cast that performs the conversions of a reinterpret_cast is not allowed in a constant expression + offsetofend(struct bpf_sock_tuple, ipv6.dport) - + ^ +progs/test_cls_redirect.c:32:3: note: expanded from macro 'offsetofend' + (offsetof(TYPE, MEMBER) + sizeof((((TYPE *)0)->MEMBER))) + ^ +tools/testing/selftests/bpf/tools/include/bpf/bpf_helpers.h:86:33: note: expanded from macro 'offsetof' + ^ +2 errors generated. +make: *** [Makefile:594: tools/testing/selftests/bpf/test_cls_redirect_subprogs.bpf.o] Error 1 + +The problem is the new offsetof() does not play nice with static asserts. +Given that the context is a static assert (and CO-RE relocation is not +needed at compile time), offsetof() usage can be replaced by restoring +the original offsetof() definition as __builtin_offsetof(). + +Fixes: bdeeed3498c7 ("libbpf: fix offsetof() and container_of() to work with CO-RE") +Reported-by: Colm Harrington +Signed-off-by: Alan Maguire +Tested-by: Yipeng Zou +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20230802073906.3197480-1-alan.maguire@oracle.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/progs/test_cls_redirect.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/tools/testing/selftests/bpf/progs/test_cls_redirect.h b/tools/testing/selftests/bpf/progs/test_cls_redirect.h +index 76eab0aacba0c..233b089d1fbac 100644 +--- a/tools/testing/selftests/bpf/progs/test_cls_redirect.h ++++ b/tools/testing/selftests/bpf/progs/test_cls_redirect.h +@@ -12,6 +12,15 @@ + #include + #include + ++/* offsetof() is used in static asserts, and the libbpf-redefined CO-RE ++ * friendly version breaks compilation for older clang versions <= 15 ++ * when invoked in a static assert. Restore original here. ++ */ ++#ifdef offsetof ++#undef offsetof ++#define offsetof(type, member) __builtin_offsetof(type, member) ++#endif ++ + struct gre_base_hdr { + uint16_t flags; + uint16_t protocol; +-- +2.40.1 + diff --git a/queue-6.1/selftests-futex-order-calls-to-futex_lock_pi.patch b/queue-6.1/selftests-futex-order-calls-to-futex_lock_pi.patch new file mode 100644 index 00000000000..22028b48c59 --- /dev/null +++ b/queue-6.1/selftests-futex-order-calls-to-futex_lock_pi.patch @@ -0,0 +1,76 @@ +From b221891d2ec5da9d2db097e3e3f0197e3313f554 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 13:39:27 +0530 +Subject: selftests/futex: Order calls to futex_lock_pi + +From: Nysal Jan K.A + +[ Upstream commit fbf4dec702774286db409815ffb077711a96b824 ] + +Observed occassional failures in the futex_wait_timeout test: + +ok 1 futex_wait relative succeeds +ok 2 futex_wait_bitset realtime succeeds +ok 3 futex_wait_bitset monotonic succeeds +ok 4 futex_wait_requeue_pi realtime succeeds +ok 5 futex_wait_requeue_pi monotonic succeeds +not ok 6 futex_lock_pi realtime returned 0 +...... + +The test expects the child thread to complete some steps before +the parent thread gets to run. There is an implicit expectation +of the order of invocation of futex_lock_pi between the child thread +and the parent thread. Make this order explicit. If the order is +not met, the futex_lock_pi call in the parent thread succeeds and +will not timeout. + +Fixes: f4addd54b161 ("selftests: futex: Expand timeout test") +Signed-off-by: Nysal Jan K.A +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + .../selftests/futex/functional/futex_wait_timeout.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/tools/testing/selftests/futex/functional/futex_wait_timeout.c b/tools/testing/selftests/futex/functional/futex_wait_timeout.c +index 3651ce17beeb9..d183f878360bc 100644 +--- a/tools/testing/selftests/futex/functional/futex_wait_timeout.c ++++ b/tools/testing/selftests/futex/functional/futex_wait_timeout.c +@@ -24,6 +24,7 @@ + + static long timeout_ns = 100000; /* 100us default timeout */ + static futex_t futex_pi; ++static pthread_barrier_t barrier; + + void usage(char *prog) + { +@@ -48,6 +49,8 @@ void *get_pi_lock(void *arg) + if (ret != 0) + error("futex_lock_pi failed\n", ret); + ++ pthread_barrier_wait(&barrier); ++ + /* Blocks forever */ + ret = futex_wait(&lock, 0, NULL, 0); + error("futex_wait failed\n", ret); +@@ -130,6 +133,7 @@ int main(int argc, char *argv[]) + basename(argv[0])); + ksft_print_msg("\tArguments: timeout=%ldns\n", timeout_ns); + ++ pthread_barrier_init(&barrier, NULL, 2); + pthread_create(&thread, NULL, get_pi_lock, NULL); + + /* initialize relative timeout */ +@@ -163,6 +167,9 @@ int main(int argc, char *argv[]) + res = futex_wait_requeue_pi(&f1, f1, &futex_pi, &to, 0); + test_timeout(res, &ret, "futex_wait_requeue_pi monotonic", ETIMEDOUT); + ++ /* Wait until the other thread calls futex_lock_pi() */ ++ pthread_barrier_wait(&barrier); ++ pthread_barrier_destroy(&barrier); + /* + * FUTEX_LOCK_PI with CLOCK_REALTIME + * Due to historical reasons, FUTEX_LOCK_PI supports only realtime +-- +2.40.1 + diff --git a/queue-6.1/selftests-harness-actually-report-skip-for-signal-te.patch b/queue-6.1/selftests-harness-actually-report-skip-for-signal-te.patch new file mode 100644 index 00000000000..f6f58663e02 --- /dev/null +++ b/queue-6.1/selftests-harness-actually-report-skip-for-signal-te.patch @@ -0,0 +1,56 @@ +From 4c1ecac6eb2fea0b143f6410f4a88c5e9ce4e2f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Aug 2023 10:43:58 -0700 +Subject: selftests/harness: Actually report SKIP for signal tests + +From: Kees Cook + +[ Upstream commit b3d46e11fec0c5a8972e5061bb1462119ae5736d ] + +Tests that were expecting a signal were not correctly checking for a +SKIP condition. Move the check before the signal checking when +processing test result. + +Cc: Shuah Khan +Cc: Andy Lutomirski +Cc: Will Drewry +Cc: linux-kselftest@vger.kernel.org +Fixes: 9847d24af95c ("selftests/harness: Refactor XFAIL into SKIP") +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kselftest_harness.h | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/tools/testing/selftests/kselftest_harness.h b/tools/testing/selftests/kselftest_harness.h +index 25f4d54067c0e..584687c3286dd 100644 +--- a/tools/testing/selftests/kselftest_harness.h ++++ b/tools/testing/selftests/kselftest_harness.h +@@ -937,7 +937,11 @@ void __wait_for_test(struct __test_metadata *t) + fprintf(TH_LOG_STREAM, + "# %s: Test terminated by timeout\n", t->name); + } else if (WIFEXITED(status)) { +- if (t->termsig != -1) { ++ if (WEXITSTATUS(status) == 255) { ++ /* SKIP */ ++ t->passed = 1; ++ t->skip = 1; ++ } else if (t->termsig != -1) { + t->passed = 0; + fprintf(TH_LOG_STREAM, + "# %s: Test exited normally instead of by signal (code: %d)\n", +@@ -949,11 +953,6 @@ void __wait_for_test(struct __test_metadata *t) + case 0: + t->passed = 1; + break; +- /* SKIP */ +- case 255: +- t->passed = 1; +- t->skip = 1; +- break; + /* Other failure, assume step report. */ + default: + t->passed = 0; +-- +2.40.1 + diff --git a/queue-6.1/selftests-resctrl-add-resctrl.h-into-build-deps.patch b/queue-6.1/selftests-resctrl-add-resctrl.h-into-build-deps.patch new file mode 100644 index 00000000000..d75e3f323e6 --- /dev/null +++ b/queue-6.1/selftests-resctrl-add-resctrl.h-into-build-deps.patch @@ -0,0 +1,41 @@ +From 3648727275ef8323c4c4665ed6fd5d1f897c107e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 16:14:49 +0300 +Subject: selftests/resctrl: Add resctrl.h into build deps +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 8e289f4542890168705219e54f0231dccfabddbe ] + +Makefile only lists *.c as build dependencies for the resctrl_tests +executable which excludes resctrl.h. + +Add *.h to wildcard() to include resctrl.h. + +Fixes: 591a6e8588fc ("selftests/resctrl: Add basic resctrl file system operations and data") +Signed-off-by: Ilpo Järvinen +Reviewed-by: Reinette Chatre +Tested-by: Babu Moger +Tested-by: Shaopeng Tan (Fujitsu) +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/resctrl/Makefile b/tools/testing/selftests/resctrl/Makefile +index 73d53257df42f..5073dbc961258 100644 +--- a/tools/testing/selftests/resctrl/Makefile ++++ b/tools/testing/selftests/resctrl/Makefile +@@ -7,4 +7,4 @@ TEST_GEN_PROGS := resctrl_tests + + include ../lib.mk + +-$(OUTPUT)/resctrl_tests: $(wildcard *.c) ++$(OUTPUT)/resctrl_tests: $(wildcard *.[ch]) +-- +2.40.1 + diff --git a/queue-6.1/selftests-resctrl-close-perf-value-read-fd-on-errors.patch b/queue-6.1/selftests-resctrl-close-perf-value-read-fd-on-errors.patch new file mode 100644 index 00000000000..67980d74a13 --- /dev/null +++ b/queue-6.1/selftests-resctrl-close-perf-value-read-fd-on-errors.patch @@ -0,0 +1,87 @@ +From b6f53758c799df31245b47057faf311b028b6e88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 16:14:52 +0300 +Subject: selftests/resctrl: Close perf value read fd on errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 51a0c3b7f028169e40db930575dd01fe81c3e765 ] + +Perf event fd (fd_lm) is not closed when run_fill_buf() returns error. + +Close fd_lm only in cat_val() to make it easier to track it is always +closed. + +Fixes: 790bf585b0ee ("selftests/resctrl: Add Cache Allocation Technology (CAT) selftest") +Signed-off-by: Ilpo Järvinen +Tested-by: Babu Moger +Tested-by: Shaopeng Tan (Fujitsu) +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/cache.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/cache.c b/tools/testing/selftests/resctrl/cache.c +index 0485863a169f2..338f714453935 100644 +--- a/tools/testing/selftests/resctrl/cache.c ++++ b/tools/testing/selftests/resctrl/cache.c +@@ -89,21 +89,19 @@ static int reset_enable_llc_perf(pid_t pid, int cpu_no) + static int get_llc_perf(unsigned long *llc_perf_miss) + { + __u64 total_misses; ++ int ret; + + /* Stop counters after one span to get miss rate */ + + ioctl(fd_lm, PERF_EVENT_IOC_DISABLE, 0); + +- if (read(fd_lm, &rf_cqm, sizeof(struct read_format)) == -1) { ++ ret = read(fd_lm, &rf_cqm, sizeof(struct read_format)); ++ if (ret == -1) { + perror("Could not get llc misses through perf"); +- + return -1; + } + + total_misses = rf_cqm.values[0].value; +- +- close(fd_lm); +- + *llc_perf_miss = total_misses; + + return 0; +@@ -258,19 +256,25 @@ int cat_val(struct resctrl_val_param *param) + memflush, operation, resctrl_val)) { + fprintf(stderr, "Error-running fill buffer\n"); + ret = -1; +- break; ++ goto pe_close; + } + + sleep(1); + ret = measure_cache_vals(param, bm_pid); + if (ret) +- break; ++ goto pe_close; ++ ++ close(fd_lm); + } else { + break; + } + } + + return ret; ++ ++pe_close: ++ close(fd_lm); ++ return ret; + } + + /* +-- +2.40.1 + diff --git a/queue-6.1/selftests-resctrl-don-t-leak-buffer-in-fill_cache.patch b/queue-6.1/selftests-resctrl-don-t-leak-buffer-in-fill_cache.patch new file mode 100644 index 00000000000..66ac91880ba --- /dev/null +++ b/queue-6.1/selftests-resctrl-don-t-leak-buffer-in-fill_cache.patch @@ -0,0 +1,55 @@ +From 416900e125042f618b93fa6d2c3bdcd93f6487f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 16:14:50 +0300 +Subject: selftests/resctrl: Don't leak buffer in fill_cache() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 2d320b1029ee7329ee0638181be967789775b962 ] + +The error path in fill_cache() does return before the allocated buffer +is freed leaking the buffer. + +The leak was introduced when fill_cache_read() started to return errors +in commit c7b607fa9325 ("selftests/resctrl: Fix null pointer +dereference on open failed"), before that both fill functions always +returned 0. + +Move free() earlier to prevent the mem leak. + +Fixes: c7b607fa9325 ("selftests/resctrl: Fix null pointer dereference on open failed") +Signed-off-by: Ilpo Järvinen +Reviewed-by: Reinette Chatre +Tested-by: Babu Moger +Tested-by: Shaopeng Tan (Fujitsu) +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/fill_buf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/resctrl/fill_buf.c b/tools/testing/selftests/resctrl/fill_buf.c +index c20d0a7ecbe63..ab1d91328d67b 100644 +--- a/tools/testing/selftests/resctrl/fill_buf.c ++++ b/tools/testing/selftests/resctrl/fill_buf.c +@@ -184,12 +184,13 @@ fill_cache(unsigned long long buf_size, int malloc_and_init, int memflush, + else + ret = fill_cache_write(start_ptr, end_ptr, resctrl_val); + ++ free(startptr); ++ + if (ret) { + printf("\n Error in fill cache read/write...\n"); + return -1; + } + +- free(startptr); + + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/selftests-resctrl-unmount-resctrl-fs-if-child-fails-.patch b/queue-6.1/selftests-resctrl-unmount-resctrl-fs-if-child-fails-.patch new file mode 100644 index 00000000000..da423e98166 --- /dev/null +++ b/queue-6.1/selftests-resctrl-unmount-resctrl-fs-if-child-fails-.patch @@ -0,0 +1,44 @@ +From 32bc2363d252b34a59b71baf9c8b0fc5ebc3fa34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 16:14:51 +0300 +Subject: selftests/resctrl: Unmount resctrl FS if child fails to run benchmark +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit f99e413eb54652e2436cc56d081176bc9a34cd8d ] + +A child calls PARENT_EXIT() when it fails to run a benchmark to kill +the parent process. PARENT_EXIT() lacks unmount for the resctrl FS and +the parent won't be there to unmount it either after it gets killed. + +Add the resctrl FS unmount also to PARENT_EXIT(). + +Fixes: 591a6e8588fc ("selftests/resctrl: Add basic resctrl file system operations and data") +Signed-off-by: Ilpo Järvinen +Reviewed-by: Reinette Chatre +Tested-by: Babu Moger +Tested-by: Shaopeng Tan (Fujitsu) +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/resctrl.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/resctrl/resctrl.h b/tools/testing/selftests/resctrl/resctrl.h +index f44fa2de4d986..dbe5cfb545585 100644 +--- a/tools/testing/selftests/resctrl/resctrl.h ++++ b/tools/testing/selftests/resctrl/resctrl.h +@@ -43,6 +43,7 @@ + do { \ + perror(err_msg); \ + kill(ppid, SIGKILL); \ ++ umount_resctrlfs(); \ + exit(EXIT_FAILURE); \ + } while (0) + +-- +2.40.1 + diff --git a/queue-6.1/serial-sprd-assign-sprd_port-after-initialized-to-av.patch b/queue-6.1/serial-sprd-assign-sprd_port-after-initialized-to-av.patch new file mode 100644 index 00000000000..855f4aa8f11 --- /dev/null +++ b/queue-6.1/serial-sprd-assign-sprd_port-after-initialized-to-av.patch @@ -0,0 +1,118 @@ +From a9f1c45e45b78355effee9dcb155447baf64d8ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 14:40:52 +0800 +Subject: serial: sprd: Assign sprd_port after initialized to avoid wrong + access + +From: Chunyan Zhang + +[ Upstream commit f9608f1887568b728839d006024585ab02ef29e5 ] + +The global pointer 'sprd_port' may not zero when sprd_probe returns +failure, that is a risk for sprd_port to be accessed afterward, and +may lead to unexpected errors. + +For example: + +There are two UART ports, UART1 is used for console and configured in +kernel command line, i.e. "console="; + +The UART1 probe failed and the memory allocated to sprd_port[1] was +released, but sprd_port[1] was not set to NULL; + +In UART2 probe, the same virtual address was allocated to sprd_port[2], +and UART2 probe process finally will go into sprd_console_setup() to +register UART1 as console since it is configured as preferred console +(filled to console_cmdline[]), but the console parameters (sprd_port[1]) +belong to UART2. + +So move the sprd_port[] assignment to where the port already initialized +can avoid the above issue. + +Fixes: b7396a38fb28 ("tty/serial: Add Spreadtrum sc9836-uart driver support") +Signed-off-by: Chunyan Zhang +Link: https://lore.kernel.org/r/20230725064053.235448-1-chunyan.zhang@unisoc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sprd_serial.c | 25 +++++++++++++++++-------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index 342a879676315..58825443529f3 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -1132,7 +1132,7 @@ static bool sprd_uart_is_console(struct uart_port *uport) + static int sprd_clk_init(struct uart_port *uport) + { + struct clk *clk_uart, *clk_parent; +- struct sprd_uart_port *u = sprd_port[uport->line]; ++ struct sprd_uart_port *u = container_of(uport, struct sprd_uart_port, port); + + clk_uart = devm_clk_get(uport->dev, "uart"); + if (IS_ERR(clk_uart)) { +@@ -1175,22 +1175,22 @@ static int sprd_probe(struct platform_device *pdev) + { + struct resource *res; + struct uart_port *up; ++ struct sprd_uart_port *sport; + int irq; + int index; + int ret; + + index = of_alias_get_id(pdev->dev.of_node, "serial"); +- if (index < 0 || index >= ARRAY_SIZE(sprd_port)) { ++ if (index < 0 || index >= UART_NR_MAX) { + dev_err(&pdev->dev, "got a wrong serial alias id %d\n", index); + return -EINVAL; + } + +- sprd_port[index] = devm_kzalloc(&pdev->dev, sizeof(*sprd_port[index]), +- GFP_KERNEL); +- if (!sprd_port[index]) ++ sport = devm_kzalloc(&pdev->dev, sizeof(*sport), GFP_KERNEL); ++ if (!sport) + return -ENOMEM; + +- up = &sprd_port[index]->port; ++ up = &sport->port; + up->dev = &pdev->dev; + up->line = index; + up->type = PORT_SPRD; +@@ -1221,7 +1221,7 @@ static int sprd_probe(struct platform_device *pdev) + * Allocate one dma buffer to prepare for receive transfer, in case + * memory allocation failure at runtime. + */ +- ret = sprd_rx_alloc_buf(sprd_port[index]); ++ ret = sprd_rx_alloc_buf(sport); + if (ret) + return ret; + +@@ -1232,14 +1232,23 @@ static int sprd_probe(struct platform_device *pdev) + return ret; + } + } ++ + sprd_ports_num++; ++ sprd_port[index] = sport; + + ret = uart_add_one_port(&sprd_uart_driver, up); + if (ret) +- sprd_remove(pdev); ++ goto clean_port; + + platform_set_drvdata(pdev, up); + ++ return 0; ++ ++clean_port: ++ sprd_port[index] = NULL; ++ if (--sprd_ports_num == 0) ++ uart_unregister_driver(&sprd_uart_driver); ++ sprd_rx_free_buf(sport); + return ret; + } + +-- +2.40.1 + diff --git a/queue-6.1/serial-sprd-fix-dma-buffer-leak-issue.patch b/queue-6.1/serial-sprd-fix-dma-buffer-leak-issue.patch new file mode 100644 index 00000000000..bf64e0eb0d8 --- /dev/null +++ b/queue-6.1/serial-sprd-fix-dma-buffer-leak-issue.patch @@ -0,0 +1,54 @@ +From 58c4245cdf776499b2bae3c34a031fef9b8bd530 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 14:40:53 +0800 +Subject: serial: sprd: Fix DMA buffer leak issue + +From: Chunyan Zhang + +[ Upstream commit cd119fdc3ee1450fbf7f78862b5de44c42b6e47f ] + +Release DMA buffer when _probe() returns failure to avoid memory leak. + +Fixes: f4487db58eb7 ("serial: sprd: Add DMA mode support") +Signed-off-by: Chunyan Zhang +Reviewed-by: Baolin Wang +Link: https://lore.kernel.org/r/20230725064053.235448-2-chunyan.zhang@unisoc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sprd_serial.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index 58825443529f3..9c7f71993e945 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -367,7 +367,7 @@ static void sprd_rx_free_buf(struct sprd_uart_port *sp) + if (sp->rx_dma.virt) + dma_free_coherent(sp->port.dev, SPRD_UART_RX_SIZE, + sp->rx_dma.virt, sp->rx_dma.phys_addr); +- ++ sp->rx_dma.virt = NULL; + } + + static int sprd_rx_dma_config(struct uart_port *port, u32 burst) +@@ -1229,7 +1229,7 @@ static int sprd_probe(struct platform_device *pdev) + ret = uart_register_driver(&sprd_uart_driver); + if (ret < 0) { + pr_err("Failed to register SPRD-UART driver\n"); +- return ret; ++ goto free_rx_buf; + } + } + +@@ -1248,6 +1248,7 @@ static int sprd_probe(struct platform_device *pdev) + sprd_port[index] = NULL; + if (--sprd_ports_num == 0) + uart_unregister_driver(&sprd_uart_driver); ++free_rx_buf: + sprd_rx_free_buf(sport); + return ret; + } +-- +2.40.1 + diff --git a/queue-6.1/serial-tegra-handle-clk-prepare-error-in-tegra_uart_.patch b/queue-6.1/serial-tegra-handle-clk-prepare-error-in-tegra_uart_.patch new file mode 100644 index 00000000000..f97d6479b82 --- /dev/null +++ b/queue-6.1/serial-tegra-handle-clk-prepare-error-in-tegra_uart_.patch @@ -0,0 +1,41 @@ +From 703d4132bfce180ac35fddb3f5f2517e8121337f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 18:54:06 +0800 +Subject: serial: tegra: handle clk prepare error in tegra_uart_hw_init() + +From: Yi Yang + +[ Upstream commit 5abd01145d0cc6cd1b7c2fe6ee0b9ea0fa13671e ] + +In tegra_uart_hw_init(), the return value of clk_prepare_enable() should +be checked since it might fail. + +Fixes: e9ea096dd225 ("serial: tegra: add serial driver") +Signed-off-by: Yi Yang +Link: https://lore.kernel.org/r/20230817105406.228674-1-yiyang13@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial-tegra.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index c08360212aa20..7aa2b5b67001d 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -999,7 +999,11 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + tup->ier_shadow = 0; + tup->current_baud = 0; + +- clk_prepare_enable(tup->uart_clk); ++ ret = clk_prepare_enable(tup->uart_clk); ++ if (ret) { ++ dev_err(tup->uport.dev, "could not enable clk\n"); ++ return ret; ++ } + + /* Reset the UART controller to clear all previous status.*/ + reset_control_assert(tup->rst); +-- +2.40.1 + diff --git a/queue-6.1/series b/queue-6.1/series index a9380ef3bf4..ee70492b981 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -98,3 +98,419 @@ tools-resolve_btfids-compile-resolve_btfids-as-host-program.patch tools-resolve_btfids-tidy-host_overrides.patch tools-resolve_btfids-pass-hostcflags-as-extra_cflags-to-prepare-targets.patch tools-resolve_btfids-fix-setting-hostcflags.patch +reiserfs-check-the-return-value-from-__getblk.patch +eventfd-prevent-underflow-for-eventfd-semaphores.patch +fs-fix-error-checking-for-d_hash_and_lookup.patch +iomap-remove-large-folio-handling-in-iomap_invalidat.patch +tmpfs-verify-g-u-id-mount-options-correctly.patch +selftests-harness-actually-report-skip-for-signal-te.patch +vfs-security-fix-automount-superblock-lsm-init-probl.patch +arm-ptrace-restore-syscall-restart-tracing.patch +arm-ptrace-restore-syscall-skipping-for-tracers.patch +refscale-fix-uninitalized-use-of-wait_queue_head_t.patch +opp-fix-passing-0-to-ptr_err-in-_opp_attach_genpd.patch +selftests-resctrl-add-resctrl.h-into-build-deps.patch +selftests-resctrl-don-t-leak-buffer-in-fill_cache.patch +selftests-resctrl-unmount-resctrl-fs-if-child-fails-.patch +selftests-resctrl-close-perf-value-read-fd-on-errors.patch +arm64-ptrace-clean-up-error-handling-path-in-sve_set.patch +sched-psi-select-kernfs-as-needed.patch +x86-decompressor-don-t-rely-on-upper-32-bits-of-gprs.patch +arm64-sme-don-t-use-streaming-mode-to-probe-the-maxi.patch +arm64-fpsimd-only-provide-the-length-to-cpufeature-f.patch +sched-rt-fix-sysctl_sched_rr_timeslice-intial-value.patch +perf-imx_ddr-don-t-enable-counter0-if-none-of-4-coun.patch +selftests-futex-order-calls-to-futex_lock_pi.patch +s390-pkey-fix-harmonize-internal-keyblob-headers.patch +s390-pkey-fix-pkey_type_ep11_aes-handling-in-pkey_ge.patch +s390-pkey-fix-pkey_type_ep11_aes-handling-for-sysfs-.patch +s390-paes-fix-pkey_type_ep11_aes-handling-for-secure.patch +irqchip-loongson-eiointc-fix-return-value-checking-o.patch +acpi-x86-s2idle-post-increment-variables-when-gettin.patch +acpi-x86-s2idle-fix-a-logic-error-parsing-amd-constr.patch +thermal-of-fix-potential-uninitialized-value-access.patch +cpufreq-amd-pstate-ut-remove-module-parameter-access.patch +cpufreq-amd-pstate-ut-fix-kernel-panic-when-loading-.patch +x86-efistub-fix-pci-rom-preservation-in-mixed-mode.patch +cpufreq-powernow-k8-use-related_cpus-instead-of-cpus.patch +selftests-bpf-fix-bpf_nf-failure-upon-test-rerun.patch +bpftool-use-a-local-copy-of-perf_event-to-fix-access.patch +bpftool-define-a-local-bpf_perf_link-to-fix-accessin.patch +bpftool-use-a-local-copy-of-bpf_link_type_perf_event.patch +bpftool-use-a-local-bpf_perf_event_value-to-fix-acce.patch +libbpf-fix-realloc-api-handling-in-zero-sized-edge-c.patch +bpf-clear-the-probe_addr-for-uprobe.patch +bpf-fix-an-error-in-verifying-a-field-in-a-union.patch +crypto-qat-change-value-of-default-idle-filter.patch +tcp-tcp_enter_quickack_mode-should-be-static.patch +hwrng-nomadik-keep-clock-enabled-while-hwrng-is-regi.patch +hwrng-pic32-use-devm_clk_get_enabled.patch +regmap-rbtree-use-alloc_flags-for-memory-allocations.patch +wifi-rtw89-debug-fix-error-handling-in-rtw89_debug_p.patch +wifi-mt76-mt7921-fix-non-psc-channel-scan-fail.patch +udp-re-score-reuseport-groups-when-connected-sockets.patch +bpf-reject-unhashed-sockets-in-bpf_sk_assign.patch +net-export-inet_lookup_reuseport-and-inet6_lookup_re.patch +net-remove-duplicate-reuseport_lookup-functions.patch +bpf-net-support-so_reuseport-sockets-with-bpf_sk_ass.patch +wifi-mt76-testmode-add-nla_policy-for-mt76_tm_attr_t.patch +spi-tegra20-sflash-fix-to-check-return-value-of-plat.patch +can-gs_usb-gs_usb_receive_bulk_callback-count-rx-ove.patch +wifi-mt76-mt7915-fix-power-limits-while-chan_switch.patch +wifi-mwifiex-fix-oob-and-integer-underflow-when-rx-p.patch +wifi-mwifiex-fix-error-recovery-in-pcie-buffer-descr.patch +selftests-bpf-fix-static-assert-compilation-issue-fo.patch +kbuild-rust_is_available-remove-v-option.patch +kbuild-rust_is_available-fix-version-check-when-cc-h.patch +kbuild-rust_is_available-add-check-for-bindgen-invoc.patch +kbuild-rust_is_available-fix-confusion-when-a-versio.patch +crypto-stm32-properly-handle-pm_runtime_get-failing.patch +crypto-api-use-work-queue-in-crypto_destroy_instance.patch +bluetooth-nokia-fix-value-check-in-nokia_bluetooth_s.patch +bluetooth-fix-potential-use-after-free-when-clear-ke.patch +bluetooth-hci_sync-don-t-double-print-name-in-add-re.patch +bluetooth-hci_sync-avoid-use-after-free-in-dbg-for-h.patch +net-tcp-fix-unexcepted-socket-die-when-snd_wnd-is-0.patch +selftests-bpf-fix-repeat-option-when-kfunc_call-veri.patch +selftests-bpf-clean-up-fmod_ret-in-bench_rename-test.patch +spi-tegra114-remove-unnecessary-null-pointer-checks.patch +net-fix-slab-out-of-bounds-in-inet-6-_steal_sock.patch +net-memcg-fix-scope-of-sockmem-pressure-indicators.patch +ice-ice_aq_check_events-fix-off-by-one-check-when-fi.patch +crypto-caam-fix-unchecked-return-value-error.patch +hwrng-iproc-rng200-implement-suspend-and-resume-call.patch +lwt-fix-return-values-of-bpf-xmit-ops.patch +lwt-check-lwtunnel_xmit_continue-strictly.patch +fs-ocfs2-namei-check-return-value-of-ocfs2_add_entry.patch +net-annotate-data-races-around-sk-sk_lingertime.patch +wifi-mwifiex-fix-memory-leak-in-mwifiex_histogram_re.patch +wifi-mwifiex-fix-missed-return-in-oob-checks-failed-.patch +arm-dts-add-.dts-files-missing-from-the-build.patch +samples-bpf-fix-bio-latency-check-with-tracepoint.patch +samples-bpf-fix-broken-map-lookup-probe.patch +wifi-ath9k-fix-races-between-ath9k_wmi_cmd-and-ath9k.patch +wifi-ath9k-protect-wmi-command-response-buffer-repla.patch +wifi-nl80211-cfg80211-add-forgotten-nla_policy-for-b.patch +mac80211-make-ieee80211_tx_info-padding-explicit.patch +wifi-mwifiex-avoid-possible-null-skb-pointer-derefer.patch +bluetooth-btusb-do-not-call-kfree_skb-under-spin_loc.patch +arm64-mm-use-ptep_clear-instead-of-pte_clear-in-clea.patch +wifi-ath9k-use-is_err-with-debugfs_create_dir.patch +ice-avoid-executing-commands-on-other-ports-when-dri.patch +net-arcnet-do-not-call-kfree_skb-under-local_irq_dis.patch +mlxsw-i2c-fix-chunk-size-setting-in-output-mailbox-b.patch +mlxsw-i2c-limit-single-transaction-buffer-size.patch +mlxsw-core_hwmon-adjust-module-label-names-based-on-.patch +hwmon-tmp513-fix-the-channel-number-in-tmp51x_is_vis.patch +octeontx2-pf-refactor-schedular-queue-alloc-free-cal.patch +octeontx2-pf-fix-pfc-tx-scheduler-free.patch +cteonxt2-pf-fix-backpressure-config-for-multiple-pfc.patch +sfc-check-firmware-supports-ethernet-ptp-filter.patch +net-sched-sch_hfsc-ensure-inner-classes-have-fsc-cur.patch +netrom-deny-concurrent-connect.patch +drm-bridge-tc358764-fix-debug-print-parameter-order.patch +asoc-cs43130-fix-numerator-denominator-mixup.patch +drm-bridge-dw-mipi-dsi-fix-enable-disable-of-dsi-con.patch +quota-factor-out-dquot_write_dquot.patch +quota-rename-dquot_active-to-inode_quota_active.patch +quota-add-new-helper-dquot_active.patch +quota-fix-dqput-to-follow-the-guarantees-dquot_srcu-.patch +drm-amd-display-do-not-set-drr-on-pipe-commit.patch +drm-hyperv-fix-a-compilation-issue-because-of-not-in.patch +asoc-stac9766-fix-build-errors-with-regmap_ac97.patch +soc-qcom-ocmem-add-ocmem-hardware-version-print.patch +soc-qcom-ocmem-fix-num_ports-num_macros-macros.patch +arm64-dts-qcom-sm6350-fix-zap-region.patch +arm64-dts-qcom-sm8250-correct-dynamic-power-coeffici.patch +arm64-dts-qcom-msm8916-l8150-correct-light-sensor-vd.patch +arm64-dts-qcom-sm8250-edo-add-gpio-line-names-for-tl.patch +arm64-dts-qcom-sm8250-edo-add-gpio-line-names-for-pm.patch +arm64-dts-qcom-sm8250-edo-rectify-gpio-keys.patch +arm64-dts-qcom-sc8280xp-crd-correct-vreg_misc_3p3-gp.patch +arm64-dts-qcom-sc8280xp-add-missing-scm-interconnect.patch +arm64-dts-qcom-msm8996-add-missing-interrupt-to-the-.patch +arm64-dts-qcom-sdm845-tama-set-serial-indices-and-st.patch +arm64-dts-qcom-sm8350-fix-cpu-idle-state-residency-t.patch +arm64-dts-qcom-sm8350-add-missing-lmh-interrupts-to-.patch +arm64-dts-qcom-sm8350-use-proper-cpu-compatibles.patch +arm64-dts-qcom-pm8350-fix-thermal-zone-name.patch +arm64-dts-qcom-pm8350b-fix-thermal-zone-name.patch +arm64-dts-qcom-pmr735b-fix-thermal-zone-name.patch +arm64-dts-qcom-pmk8350-fix-adc-tm-compatible-string.patch +arm64-dts-qcom-sm8250-mark-pcie-hosts-as-dma-coheren.patch +arm-dts-stm32-rename-mdio0-to-mdio.patch +arm-dts-stm32-yaml-validation-fails-for-argon-boards.patch +arm-dts-stm32-adopt-generic-iio-bindings-for-adc-cha.patch +arm-dts-stm32-add-missing-detach-mailbox-for-emtrion.patch +arm-dts-stm32-yaml-validation-fails-for-odyssey-boar.patch +arm-dts-stm32-add-missing-detach-mailbox-for-odyssey.patch +arm-dts-stm32-update-to-generic-adc-channel-binding-.patch +arm-dts-stm32-add-missing-detach-mailbox-for-dhcom-s.patch +firmware-ti_sci-use-system_state-to-determine-pollin.patch +drm-amdgpu-avoid-integer-overflow-warning-in-amdgpu_.patch +arm-dts-bcm53573-drop-nonexistent-usb-cells.patch +arm-dts-bcm53573-add-cells-sizes-to-pcie-node.patch +arm-dts-bcm53573-use-updated-spi-gpio-binding-proper.patch +arm64-tegra-fix-hsuart-for-jetson-agx-orin.patch +arm64-dts-qcom-sm8250-sony-xperia-correct-gpio-keys-.patch +arm64-dts-qcom-pm6150l-add-missing-short-interrupt.patch +arm64-dts-qcom-pm660l-add-missing-short-interrupt.patch +arm64-dts-qcom-pmi8994-add-missing-ovp-interrupt.patch +arm64-tegra-fix-hsuart-for-smaug.patch +drm-etnaviv-fix-dumping-of-active-mmu-context.patch +block-cleanup-queue_wc_store.patch +block-don-t-allow-enabling-a-cache-on-devices-that-d.patch +x86-mm-fix-pat-bit-missing-from-page-protection-modi.patch +drm-bridge-anx7625-use-common-macros-for-dp-power-se.patch +drm-bridge-anx7625-use-common-macros-for-hdcp-capabi.patch +arm-dts-samsung-s3c6410-mini6410-correct-ethernet-re.patch +arm-dts-s5pv210-add-dummy-5v-regulator-for-backlight.patch +arm-dts-samsung-s5pv210-smdkv210-correct-ethernet-re.patch +drm-adv7511-fix-low-refresh-rate-register-for-adv753.patch +arm-dts-bcm53573-fix-ethernet-info-for-luxul-devices.patch +arm64-dts-qcom-sdm845-add-missing-rpmh-power-domain-.patch +arm64-dts-qcom-sdm845-fix-the-min-frequency-of-ice_c.patch +arm64-dts-qcom-msm8996-gemini-fix-touchscreen-vio-su.patch +drm-amdgpu-update-min-to-min_t-in-amdgpu_info_ioctl.patch +md-factor-out-is_md_suspended-helper.patch +md-change-active_io-to-percpu.patch +md-restore-noio_flag-for-the-last-mddev_resume.patch +md-raid10-factor-out-dereference_rdev_and_rrdev.patch +md-raid10-use-dereference_rdev_and_rrdev-to-get-devi.patch +md-md-bitmap-remove-unnecessary-local-variable-in-ba.patch +md-md-bitmap-hold-reconfig_mutex-in-backlog_store.patch +drm-msm-update-dev-core-dump-to-not-print-backwards.patch +drm-tegra-dpaux-fix-incorrect-return-value-of-platfo.patch +of-unittest-fix-null-pointer-dereferencing-in-of_uni.patch +arm64-dts-qcom-sm8150-fix-the-i2c7-interrupt.patch +arm-dts-bcm53573-fix-tenda-ac9-switch-cpu-port.patch +drm-armada-fix-off-by-one-error-in-armada_overlay_ge.patch +drm-repaper-reduce-temporary-buffer-size-in-repaper_.patch +drm-panel-simple-add-missing-connector-type-and-pixe.patch +ima-remove-deprecated-ima_trusted_keyring-kconfig.patch +drm-xlnx-zynqmp_dpsub-add-missing-check-for-dma_set_.patch +soc-qcom-smem-fix-incompatible-types-in-comparison.patch +drm-msm-mdp5-don-t-leak-some-plane-state.patch +firmware-meson_sm-fix-to-avoid-potential-null-pointe.patch +drm-msm-dpu-fix-the-irq-index-in-dpu_encoder_phys_wb.patch +smackfs-prevent-underflow-in-smk_set_cipso.patch +drm-amd-pm-fix-variable-dereferenced-issue-in-amdgpu.patch +drm-msm-a2xx-call-adreno_gpu_init-earlier.patch +audit-fix-possible-soft-lockup-in-__audit_inode_chil.patch +block-mq-deadline-use-correct-way-to-throttling-writ.patch +io_uring-fix-drain-stalls-by-invalid-sqe.patch +drm-mediatek-dp-add-missing-error-checks-in-mtk_dp_p.patch +bus-ti-sysc-fix-build-warning-for-64-bit-build.patch +drm-mediatek-remove-freeing-not-dynamic-allocated-me.patch +arm-dts-qcom-ipq4019-correct-sdhci-xo-clock.patch +drm-mediatek-fix-potential-memory-leak-if-vmap-fail.patch +arm64-dts-qcom-apq8016-sbc-fix-ov5640-regulator-supp.patch +arm64-dts-qcom-msm8998-drop-bus-clock-reference-from.patch +arm64-dts-qcom-msm8998-add-missing-power-domain-to-m.patch +arm64-dts-qcom-msm8996-fix-dsi1-interrupts.patch +arm64-dts-qcom-sc8280xp-x13s-unreserve-nc-pins.patch +bus-ti-sysc-fix-cast-to-enum-warning.patch +md-raid5-cache-fix-a-deadlock-in-r5l_exit_log.patch +md-raid5-cache-fix-null-ptr-deref-for-r5l_flush_stri.patch +firmware-cs_dsp-fix-new-control-name-check.patch +md-raid1-free-the-r1bio-before-waiting-for-blocked-r.patch +md-raid1-hold-the-barrier-until-handle_read_error-fi.patch +md-add-error_handlers-for-raid0-and-linear.patch +md-raid0-factor-out-helper-for-mapping-and-submittin.patch +md-raid0-fix-performance-regression-for-large-sequen.patch +md-raid0-account-for-split-bio-in-iostat-accounting.patch +asoc-sof-amd-clear-dsp-to-host-interrupt-status.patch +of-overlay-call-of_changeset_init-early.patch +of-unittest-fix-overlay-type-in-apply-revert-check.patch +alsa-ac97-fix-possible-error-value-of-rac97.patch +ipmi-ssif-add-check-for-kstrdup.patch +ipmi-ssif-fix-a-memory-leak-when-scanning-for-an-ada.patch +clk-qcom-gpucc-sm6350-introduce-index-based-clk-look.patch +clk-qcom-gpucc-sm6350-fix-clock-source-names.patch +clk-qcom-gcc-sc8280xp-add-emac-gdscs.patch +clk-qcom-gcc-sc8280xp-add-missing-gdsc-flags.patch +dt-bindings-clock-qcom-gcc-sc8280xp-add-missing-gdsc.patch +clk-qcom-gcc-sc8280xp-add-missing-gdscs.patch +clk-rockchip-rk3568-fix-pll-rate-setting-for-78.75mh.patch +pci-apple-initialize-pcie-nvecs-before-use.patch +pci-qcom-ep-switch-mhi-bus-master-clock-off-during-l.patch +drivers-clk-keystone-fix-parameter-judgment-in-_of_p.patch +pci-doe-fix-destroy_work_on_stack-race.patch +clk-sunxi-ng-modify-mismatched-function-name.patch +clk-qcom-gcc-sc7180-fix-up-gcc_sdcc2_apps_clk_src.patch +edac-igen6-fix-the-issue-of-no-error-events.patch +ext4-correct-grp-validation-in-ext4_mb_good_group.patch +ext4-avoid-potential-data-overflow-in-next_linear_gr.patch +clk-qcom-gcc-sm8250-fix-gcc_sdcc2_apps_clk_src.patch +kvm-vfio-prepare-for-accepting-vfio-device-fd.patch +kvm-vfio-ensure-kvg-instance-stays-around-in-kvm_vfi.patch +clk-qcom-reset-use-the-correct-type-of-sleep-delay-b.patch +clk-qcom-gcc-sm6350-fix-gcc_sdcc2_apps_clk_src.patch +pci-microchip-correct-the-ded-and-sec-interrupt-bit-.patch +pci-mark-nvidia-t4-gpus-to-avoid-bus-reset.patch +pinctrl-mcp23s08-check-return-value-of-devm_kasprint.patch +pci-allow-drivers-to-request-exclusive-config-region.patch +pci-add-locking-to-rmw-pci-express-capability-regist.patch +pci-pciehp-use-rmw-accessors-for-changing-lnkctl.patch +pci-aspm-use-rmw-accessors-for-changing-lnkctl.patch +clk-qcom-gcc-sm8450-use-floor-ops-for-sdcc-rcgs.patch +clk-imx-pllv4-fix-spll2-mult-range.patch +clk-imx-imx8ulp-update-spll2-type.patch +clk-imx8mp-fix-sai4-clock.patch +clk-imx-composite-8m-fix-clock-pauses-when-set_rate-.patch +powerpc-radix-move-some-functions-into-ifdef-config_.patch +vfio-type1-fix-cap_migration-information-leak.patch +nvdimm-fix-memleak-of-pmu-attr_groups-in-unregister_.patch +nvdimm-fix-dereference-after-free-in-register_nvdimm.patch +powerpc-fadump-reset-dump-area-size-if-fadump-memory.patch +powerpc-perf-convert-fsl_emb-notifier-to-state-machi.patch +drm-amdgpu-use-rmw-accessors-for-changing-lnkctl.patch +drm-radeon-use-rmw-accessors-for-changing-lnkctl.patch +net-mlx5-use-rmw-accessors-for-changing-lnkctl.patch +wifi-ath11k-use-rmw-accessors-for-changing-lnkctl.patch +wifi-ath10k-use-rmw-accessors-for-changing-lnkctl.patch +nfsv4.2-rework-scratch-handling-for-read_plus.patch +nfsv4.2-fix-read_plus-smatch-warnings.patch +nfsv4.2-fix-up-read_plus-alignment.patch +nfsv4.2-fix-read_plus-size-calculations.patch +powerpc-don-t-include-lppaca.h-in-paca.h.patch +powerpc-pseries-rework-lppaca_shared_proc-to-avoid-d.patch +nfs-blocklayout-use-the-passed-in-gfp-flags.patch +powerpc-pseries-fix-hcall-tracepoints-with-jump_labe.patch +powerpc-mpc5xxx-add-missing-fwnode_handle_put.patch +powerpc-iommu-fix-notifiers-being-shared-by-pci-and-.patch +ext4-fix-unttached-inode-after-power-cut-with-orphan.patch +jfs-validate-max-amount-of-blocks-before-allocation.patch +fs-lockd-avoid-possible-wrong-null-parameter.patch +nfsd-da_addr_body-field-missing-in-some-getdeviceinf.patch +nfs-guard-against-readdir-loop-when-entry-names-exce.patch +nfsv4.2-fix-handling-of-copy-err_offload_no_req.patch +pnfs-fix-assignment-of-xprtdata.cred.patch +cgroup-cpuset-inherit-parent-s-load-balance-state-in.patch +rdma-qedr-remove-a-duplicate-assignment-in-irdma_que.patch +media-ov5640-fix-low-resolution-image-abnormal-issue.patch +media-ad5820-drop-unsupported-ad5823-from-i2c_-and-o.patch +media-i2c-tvp5150-check-return-value-of-devm_kasprin.patch +media-v4l2-core-fix-a-potential-resource-leak-in-v4l.patch +iommu-amd-iommu_v2-fix-pasid_state-refcount-dec-hit-.patch +iommu-rockchip-fix-directory-table-address-encoding.patch +drivers-usb-smsusb-fix-error-handling-code-in-smsusb.patch +media-dib7000p-fix-potential-division-by-zero.patch +media-dvb-usb-m920x-fix-a-potential-memory-leak-in-m.patch +media-cx24120-add-retval-check-for-cx24120_message_s.patch +rdma-siw-fabricate-a-gid-on-tun-and-loopback-devices.patch +scsi-hisi_sas-fix-warnings-detected-by-sparse.patch +scsi-hisi_sas-fix-normally-completed-i-o-analysed-as.patch +dt-bindings-extcon-maxim-max77843-restrict-connector.patch +media-amphion-reinit-vpu-if-reqbufs-output-0.patch +media-amphion-add-helper-function-to-get-id-name.patch +media-mtk-jpeg-fix-use-after-free-bug-due-to-uncance.patch +media-rkvdec-increase-max-supported-height-for-h.264.patch +media-amphion-fix-checked_return-issues-reported-by-.patch +media-amphion-fix-reverse_inull-issues-reported-by-c.patch +media-amphion-fix-uninit-issues-reported-by-coverity.patch +media-amphion-fix-unused_value-issue-reported-by-cov.patch +media-amphion-ensure-the-bitops-don-t-cross-boundari.patch +media-mediatek-vcodec-return-null-if-no-vdec_fb-is-f.patch +media-mediatek-vcodec-fix-potential-double-free.patch +media-mediatek-vcodec-fix-resource-leaks-in-vdec_msg.patch +usb-phy-mxs-fix-getting-wrong-state-with-mxs_phy_is_.patch +scsi-rdma-srp-fix-residual-handling.patch +scsi-iscsi-rename-iscsi_set_param-to-iscsi_if_set_pa.patch +scsi-iscsi-add-length-check-for-nlattr-payload.patch +scsi-iscsi-add-strlen-check-in-iscsi_if_set-_host-_p.patch +scsi-be2iscsi-add-length-check-when-parsing-nlattrs.patch +scsi-qla4xxx-add-length-check-when-parsing-nlattrs.patch +iio-accel-adxl313-fix-adxl313_i2c_id-table.patch +serial-sprd-assign-sprd_port-after-initialized-to-av.patch +serial-sprd-fix-dma-buffer-leak-issue.patch +x86-apm-drop-the-duplicate-apm_minor_dev-macro.patch +rdma-rxe-split-rxe_run_task-into-two-subroutines.patch +rdma-rxe-fix-incomplete-state-save-in-rxe_requester.patch +scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_st.patch +scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_de.patch +scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_fp.patch +rdma-irdma-replace-one-element-array-with-flexible-a.patch +coresight-tmc-explicit-type-conversions-to-prevent-i.patch +interconnect-qcom-qcm2290-enable-sync-state.patch +dma-buf-sync_file-fix-docs-syntax.patch +driver-core-test_async-fix-an-error-code.patch +driver-core-call-dma_cleanup-on-the-test_remove-path.patch +kernfs-add-stub-helper-for-kernfs_generic_poll.patch +extcon-cht_wc-add-power_supply-dependency.patch +iommu-mediatek-remove-unused-mapping-member-from-mtk.patch +iommu-mediatek-fix-two-iommu-share-pagetable-issue.patch +iommu-sprd-add-missing-force_aperture.patch +rdma-hns-fix-port-active-speed.patch +rdma-hns-fix-incorrect-post-send-with-direct-wqe-of-.patch +rdma-hns-fix-inaccurate-error-label-name-in-init-ins.patch +rdma-hns-fix-cq-and-qp-cache-affinity.patch +ib-uverbs-fix-an-potential-error-pointer-dereference.patch +fsi-aspeed-reset-master-errors-after-cfam-reset.patch +iommu-qcom-disable-and-reset-context-bank-before-pro.patch +iommu-vt-d-fix-to-flush-cache-of-pasid-directory-tab.patch +platform-x86-dell-sysman-fix-reference-leak.patch +media-cec-core-add-adap_nb_transmit_canceled-callbac.patch +media-cec-core-add-adap_unconfigured-callback.patch +media-go7007-remove-redundant-if-statement.patch +media-venus-hfi_venus-only-consider-sys_idle_indicat.patch +docs-abi-fix-spelling-grammar-in-sbefifo-timeout-int.patch +usb-gadget-core-add-missing-kerneldoc-for-vbus_work.patch +usb-gadget-f_mass_storage-fix-unused-variable-warnin.patch +drivers-base-free-devm-resources-when-unregistering-.patch +hid-input-support-devices-sending-eraser-without-inv.patch +media-ov5640-enable-mipi-interface-in-ov5640_set_pow.patch +media-ov5640-fix-initial-resetb-state-and-annotate-t.patch +media-i2c-ov2680-set-v4l2_ctrl_flag_modify_layout-on.patch +media-ov2680-remove-auto-gain-and-auto-exposure-cont.patch +media-ov2680-fix-ov2680_bayer_order.patch +media-ov2680-fix-vflip-hflip-set-functions.patch +media-ov2680-remove-video_v4l2_subdev_api-ifdef-s.patch +media-ov2680-don-t-take-the-lock-for-try_fmt-calls.patch +media-ov2680-add-ov2680_fill_format-helper-function.patch +media-ov2680-fix-ov2680_set_fmt-which-v4l2_subdev_fo.patch +media-ov2680-fix-regulators-being-left-enabled-on-ov.patch +media-i2c-rdacm21-fix-uninitialized-value.patch +f2fs-fix-to-avoid-mmap-vs-set_compress_option-case.patch +f2fs-judge-whether-discard_unit-is-section-only-when.patch +f2fs-only-lfs-mode-is-allowed-with-zoned-block-devic.patch +revert-f2fs-fix-to-do-sanity-check-on-extent-cache-c.patch +cgroup-namespace-remove-unused-cgroup_namespaces_ini.patch +coresight-trbe-fix-trbe-potential-sleep-in-atomic-co.patch +rdma-irdma-prevent-zero-length-stag-registration.patch +scsi-core-use-32-bit-hostnum-in-scsi_host_lookup.patch +scsi-fcoe-fix-potential-deadlock-on-fip-ctlr_lock.patch +interconnect-qcom-sm8450-enable-sync_state.patch +interconnect-qcom-bcm-voter-improve-enable_mask-hand.patch +interconnect-qcom-bcm-voter-use-enable_maks-for-keep.patch +serial-tegra-handle-clk-prepare-error-in-tegra_uart_.patch +amba-bus-fix-refcount-leak.patch +revert-ib-isert-fix-incorrect-release-of-isert-conne.patch +rdma-siw-balance-the-reference-of-cep-kref-in-the-er.patch +rdma-siw-correct-wrong-debug-message.patch +rdma-efa-fix-wrong-resources-deallocation-order.patch +hid-logitech-dj-fix-error-handling-in-logi_dj_recv_s.patch +hid-uclogic-correct-devm-device-reference-for-hidinp.patch +hid-multitouch-correct-devm-device-reference-for-hid.patch +platform-x86-amd-pmf-fix-a-missing-cleanup-path.patch +tick-rcu-fix-false-positive-softirq-work-is-pending-.patch +x86-speculation-mark-all-skylake-cpus-as-vulnerable-.patch +tracing-remove-extra-space-at-the-end-of-hwlat_detec.patch +tracing-fix-race-issue-between-cpu-buffer-write-and-.patch +mtd-rawnand-brcmnand-fix-mtd-oobsize.patch +dmaengine-idxd-modify-the-dependence-of-attribute-pa.patch +phy-rockchip-inno-hdmi-use-correct-vco_div_5-macro-o.patch +phy-rockchip-inno-hdmi-round-fractal-pixclock-in-rk3.patch +phy-rockchip-inno-hdmi-do-not-power-on-rk3328-post-p.patch +rpmsg-glink-add-check-for-kstrdup.patch +leds-pwm-fix-error-code-in-led_pwm_create_fwnode.patch +leds-multicolor-use-rounded-division-when-calculatin.patch +leds-fix-bug_on-check-for-led_color_id_multi-that-is.patch +leds-trigger-tty-do-not-use-led_on-off-constants-use.patch +mtd-spi-nor-check-bus-width-while-setting-qe-bit.patch +mtd-rawnand-fsmc-handle-clk-prepare-error-in-fsmc_na.patch +um-fix-hostaudio-build-errors.patch +dmaengine-ste_dma40-add-missing-irq-check-in-d40_pro.patch +drivers-hv-vmbus-don-t-dereference-acpi-root-object-.patch +cpufreq-fix-the-race-condition-while-updating-the-tr.patch +virtio_ring-fix-avail_wrap_counter-in-virtqueue_add_.patch diff --git a/queue-6.1/sfc-check-firmware-supports-ethernet-ptp-filter.patch b/queue-6.1/sfc-check-firmware-supports-ethernet-ptp-filter.patch new file mode 100644 index 00000000000..e39a3a879d5 --- /dev/null +++ b/queue-6.1/sfc-check-firmware-supports-ethernet-ptp-filter.patch @@ -0,0 +1,40 @@ +From c1499a8a221374c464621c821f2ec357502c6deb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 17:46:57 +0100 +Subject: sfc: Check firmware supports Ethernet PTP filter + +From: Alex Austin + +[ Upstream commit c4413a20fa6d7c4888009fb7dd391685f196cd36 ] + +Not all firmware variants support RSS filters. Do not fail all PTP +functionality when raw ethernet PTP filters fail to insert. + +Fixes: e4616f64726b ("sfc: support PTP over Ethernet") +Signed-off-by: Alex Austin +Acked-by: Edward Cree +Reviewed-by: Pieter Jansen van Vuuren +Link: https://lore.kernel.org/r/20230824164657.42379-1-alex.austin@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ptp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c +index eaef4a15008a3..692c7f132e9f9 100644 +--- a/drivers/net/ethernet/sfc/ptp.c ++++ b/drivers/net/ethernet/sfc/ptp.c +@@ -1387,7 +1387,8 @@ static int efx_ptp_insert_multicast_filters(struct efx_nic *efx) + goto fail; + + rc = efx_ptp_insert_eth_filter(efx); +- if (rc < 0) ++ /* Not all firmware variants support this filter */ ++ if (rc < 0 && rc != -EPROTONOSUPPORT) + goto fail; + } + +-- +2.40.1 + diff --git a/queue-6.1/smackfs-prevent-underflow-in-smk_set_cipso.patch b/queue-6.1/smackfs-prevent-underflow-in-smk_set_cipso.patch new file mode 100644 index 00000000000..e3efee1b60b --- /dev/null +++ b/queue-6.1/smackfs-prevent-underflow-in-smk_set_cipso.patch @@ -0,0 +1,37 @@ +From b604bfab7e785d89598d3ef89728115405624307 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 08:52:39 +0300 +Subject: smackfs: Prevent underflow in smk_set_cipso() + +From: Dan Carpenter + +[ Upstream commit 3ad49d37cf5759c3b8b68d02e3563f633d9c1aee ] + +There is a upper bound to "catlen" but no lower bound to prevent +negatives. I don't see that this necessarily causes a problem but we +may as well be safe. + +Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel") +Signed-off-by: Dan Carpenter +Signed-off-by: Casey Schaufler +Signed-off-by: Sasha Levin +--- + security/smack/smackfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c +index 4b58526450d49..da7db9e22ce7c 100644 +--- a/security/smack/smackfs.c ++++ b/security/smack/smackfs.c +@@ -896,7 +896,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + } + + ret = sscanf(rule, "%d", &catlen); +- if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM) ++ if (ret != 1 || catlen < 0 || catlen > SMACK_CIPSO_MAXCATNUM) + goto out; + + if (format == SMK_FIXED24_FMT && +-- +2.40.1 + diff --git a/queue-6.1/soc-qcom-ocmem-add-ocmem-hardware-version-print.patch b/queue-6.1/soc-qcom-ocmem-add-ocmem-hardware-version-print.patch new file mode 100644 index 00000000000..75adaee3345 --- /dev/null +++ b/queue-6.1/soc-qcom-ocmem-add-ocmem-hardware-version-print.patch @@ -0,0 +1,53 @@ +From dc64cc73fdf0826ca71cc409322fa0491aac8d60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 May 2023 10:41:15 +0200 +Subject: soc: qcom: ocmem: Add OCMEM hardware version print + +From: Luca Weiss + +[ Upstream commit e81a16e77259294cd4ff0a9c1fbe5aa0e311a47d ] + +It might be useful to know what hardware version of the OCMEM block the +SoC contains. Add a debug print for that. + +Signed-off-by: Luca Weiss +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230509-ocmem-hwver-v3-1-e51f3488e0f4@z3ntu.xyz +Stable-dep-of: a7b484b1c933 ("soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros") +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/ocmem.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/soc/qcom/ocmem.c b/drivers/soc/qcom/ocmem.c +index c92d26b73e6fc..7197d9fe0946a 100644 +--- a/drivers/soc/qcom/ocmem.c ++++ b/drivers/soc/qcom/ocmem.c +@@ -76,6 +76,10 @@ struct ocmem { + #define OCMEM_REG_GFX_MPU_START 0x00001004 + #define OCMEM_REG_GFX_MPU_END 0x00001008 + ++#define OCMEM_HW_VERSION_MAJOR(val) FIELD_GET(GENMASK(31, 28), val) ++#define OCMEM_HW_VERSION_MINOR(val) FIELD_GET(GENMASK(27, 16), val) ++#define OCMEM_HW_VERSION_STEP(val) FIELD_GET(GENMASK(15, 0), val) ++ + #define OCMEM_HW_PROFILE_NUM_PORTS(val) FIELD_PREP(0x0000000f, (val)) + #define OCMEM_HW_PROFILE_NUM_MACROS(val) FIELD_PREP(0x00003f00, (val)) + +@@ -355,6 +359,12 @@ static int ocmem_dev_probe(struct platform_device *pdev) + } + } + ++ reg = ocmem_read(ocmem, OCMEM_REG_HW_VERSION); ++ dev_dbg(dev, "OCMEM hardware version: %lu.%lu.%lu\n", ++ OCMEM_HW_VERSION_MAJOR(reg), ++ OCMEM_HW_VERSION_MINOR(reg), ++ OCMEM_HW_VERSION_STEP(reg)); ++ + reg = ocmem_read(ocmem, OCMEM_REG_HW_PROFILE); + ocmem->num_ports = OCMEM_HW_PROFILE_NUM_PORTS(reg); + ocmem->num_macros = OCMEM_HW_PROFILE_NUM_MACROS(reg); +-- +2.40.1 + diff --git a/queue-6.1/soc-qcom-ocmem-fix-num_ports-num_macros-macros.patch b/queue-6.1/soc-qcom-ocmem-fix-num_ports-num_macros-macros.patch new file mode 100644 index 00000000000..458c4707cea --- /dev/null +++ b/queue-6.1/soc-qcom-ocmem-fix-num_ports-num_macros-macros.patch @@ -0,0 +1,50 @@ +From def9213ec3ac2ab654c7eb64e0c3e383964e5eec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 18:35:47 +0200 +Subject: soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros + +From: Luca Weiss + +[ Upstream commit a7b484b1c9332a1ee12e8799d62a11ee3f8e0801 ] + +Since we're using these two macros to read a value from a register, we +need to use the FIELD_GET instead of the FIELD_PREP macro, otherwise +we're getting wrong values. + +So instead of: + + [ 3.111779] ocmem fdd00000.sram: 2 ports, 1 regions, 512 macros, not interleaved + +we now get the correct value of: + + [ 3.129672] ocmem fdd00000.sram: 2 ports, 1 regions, 2 macros, not interleaved + +Fixes: 88c1e9404f1d ("soc: qcom: add OCMEM driver") +Reviewed-by: Caleb Connolly +Reviewed-by: Konrad Dybcio +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20230506-msm8226-ocmem-v3-1-79da95a2581f@z3ntu.xyz +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/ocmem.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/qcom/ocmem.c b/drivers/soc/qcom/ocmem.c +index 7197d9fe0946a..27c668eac9647 100644 +--- a/drivers/soc/qcom/ocmem.c ++++ b/drivers/soc/qcom/ocmem.c +@@ -80,8 +80,8 @@ struct ocmem { + #define OCMEM_HW_VERSION_MINOR(val) FIELD_GET(GENMASK(27, 16), val) + #define OCMEM_HW_VERSION_STEP(val) FIELD_GET(GENMASK(15, 0), val) + +-#define OCMEM_HW_PROFILE_NUM_PORTS(val) FIELD_PREP(0x0000000f, (val)) +-#define OCMEM_HW_PROFILE_NUM_MACROS(val) FIELD_PREP(0x00003f00, (val)) ++#define OCMEM_HW_PROFILE_NUM_PORTS(val) FIELD_GET(0x0000000f, (val)) ++#define OCMEM_HW_PROFILE_NUM_MACROS(val) FIELD_GET(0x00003f00, (val)) + + #define OCMEM_HW_PROFILE_LAST_REGN_HALFSIZE 0x00010000 + #define OCMEM_HW_PROFILE_INTERLEAVING 0x00020000 +-- +2.40.1 + diff --git a/queue-6.1/soc-qcom-smem-fix-incompatible-types-in-comparison.patch b/queue-6.1/soc-qcom-smem-fix-incompatible-types-in-comparison.patch new file mode 100644 index 00000000000..09d81002acd --- /dev/null +++ b/queue-6.1/soc-qcom-smem-fix-incompatible-types-in-comparison.patch @@ -0,0 +1,43 @@ +From ab4c95249454d5c40dcc8dae3d228ab06b0f9fbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Aug 2023 17:48:07 +0800 +Subject: soc: qcom: smem: Fix incompatible types in comparison + +From: Chen Jiahao + +[ Upstream commit 5f908786cf44fcb397cfe0f322ef2f41b0909e2a ] + +This patch fixes the following sparse error: + +drivers/soc/qcom/smem.c:738:30: error: incompatible types in comparison expression (different add ress spaces): +drivers/soc/qcom/smem.c:738:30: void * +drivers/soc/qcom/smem.c:738:30: void [noderef] __iomem * + +In addr_in_range(), "base" is of type void __iomem *, converting +void *addr to the same type to fix above sparse error. + +Fixes: 20bb6c9de1b7 ("soc: qcom: smem: map only partitions used by local HOST") +Signed-off-by: Chen Jiahao +Link: https://lore.kernel.org/r/20230801094807.4146779-1-chenjiahao16@huawei.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/smem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c +index 4f163d62942c1..af8d90efd91fa 100644 +--- a/drivers/soc/qcom/smem.c ++++ b/drivers/soc/qcom/smem.c +@@ -723,7 +723,7 @@ EXPORT_SYMBOL(qcom_smem_get_free_space); + + static bool addr_in_range(void __iomem *base, size_t size, void *addr) + { +- return base && (addr >= base && addr < base + size); ++ return base && ((void __iomem *)addr >= base && (void __iomem *)addr < base + size); + } + + /** +-- +2.40.1 + diff --git a/queue-6.1/spi-tegra114-remove-unnecessary-null-pointer-checks.patch b/queue-6.1/spi-tegra114-remove-unnecessary-null-pointer-checks.patch new file mode 100644 index 00000000000..1715ac646ca --- /dev/null +++ b/queue-6.1/spi-tegra114-remove-unnecessary-null-pointer-checks.patch @@ -0,0 +1,73 @@ +From 92a88e70cfd0d6d1148947aee97349176ef318fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Aug 2023 12:20:58 +0300 +Subject: spi: tegra114: Remove unnecessary NULL-pointer checks + +From: Alexander Danilenko + +[ Upstream commit 373c36bf7914e3198ac2654dede499f340c52950 ] + +cs_setup, cs_hold and cs_inactive points to fields of spi_device struct, +so there is no sense in checking them for NULL. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 04e6bb0d6bb1 ("spi: modify set_cs_timing parameter") +Signed-off-by: Alexander Danilenko +Link: https://lore.kernel.org/r/20230815092058.4083-1-al.b.danilenko@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra114.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c +index d9be80e3e1bcb..6b56108308fc5 100644 +--- a/drivers/spi/spi-tegra114.c ++++ b/drivers/spi/spi-tegra114.c +@@ -723,27 +723,23 @@ static int tegra_spi_set_hw_cs_timing(struct spi_device *spi) + struct spi_delay *setup = &spi->cs_setup; + struct spi_delay *hold = &spi->cs_hold; + struct spi_delay *inactive = &spi->cs_inactive; +- u8 setup_dly, hold_dly, inactive_dly; ++ u8 setup_dly, hold_dly; + u32 setup_hold; + u32 spi_cs_timing; + u32 inactive_cycles; + u8 cs_state; + +- if ((setup && setup->unit != SPI_DELAY_UNIT_SCK) || +- (hold && hold->unit != SPI_DELAY_UNIT_SCK) || +- (inactive && inactive->unit != SPI_DELAY_UNIT_SCK)) { ++ if (setup->unit != SPI_DELAY_UNIT_SCK || ++ hold->unit != SPI_DELAY_UNIT_SCK || ++ inactive->unit != SPI_DELAY_UNIT_SCK) { + dev_err(&spi->dev, + "Invalid delay unit %d, should be SPI_DELAY_UNIT_SCK\n", + SPI_DELAY_UNIT_SCK); + return -EINVAL; + } + +- setup_dly = setup ? setup->value : 0; +- hold_dly = hold ? hold->value : 0; +- inactive_dly = inactive ? inactive->value : 0; +- +- setup_dly = min_t(u8, setup_dly, MAX_SETUP_HOLD_CYCLES); +- hold_dly = min_t(u8, hold_dly, MAX_SETUP_HOLD_CYCLES); ++ setup_dly = min_t(u8, setup->value, MAX_SETUP_HOLD_CYCLES); ++ hold_dly = min_t(u8, hold->value, MAX_SETUP_HOLD_CYCLES); + if (setup_dly && hold_dly) { + setup_hold = SPI_SETUP_HOLD(setup_dly - 1, hold_dly - 1); + spi_cs_timing = SPI_CS_SETUP_HOLD(tspi->spi_cs_timing1, +@@ -755,7 +751,7 @@ static int tegra_spi_set_hw_cs_timing(struct spi_device *spi) + } + } + +- inactive_cycles = min_t(u8, inactive_dly, MAX_INACTIVE_CYCLES); ++ inactive_cycles = min_t(u8, inactive->value, MAX_INACTIVE_CYCLES); + if (inactive_cycles) + inactive_cycles--; + cs_state = inactive_cycles ? 0 : 1; +-- +2.40.1 + diff --git a/queue-6.1/spi-tegra20-sflash-fix-to-check-return-value-of-plat.patch b/queue-6.1/spi-tegra20-sflash-fix-to-check-return-value-of-plat.patch new file mode 100644 index 00000000000..e398156b4d5 --- /dev/null +++ b/queue-6.1/spi-tegra20-sflash-fix-to-check-return-value-of-plat.patch @@ -0,0 +1,44 @@ +From f63e0ffe568041b405026bb42fe7668aaeb53b7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jul 2023 23:49:09 +0800 +Subject: spi: tegra20-sflash: fix to check return value of platform_get_irq() + in tegra_sflash_probe() + +From: Zhang Shurong + +[ Upstream commit 29a449e765ff70a5bd533be94babb6d36985d096 ] + +The platform_get_irq might be failed and return a negative result. So +there should have an error handling code. + +Fixed this by adding an error handling code. + +Fixes: 8528547bcc33 ("spi: tegra: add spi driver for sflash controller") +Signed-off-by: Zhang Shurong +Link: https://lore.kernel.org/r/tencent_71FC162D589E4788C2152AAC84CD8D5C6D06@qq.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra20-sflash.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c +index 220ee08c4a06c..d4bebb4314172 100644 +--- a/drivers/spi/spi-tegra20-sflash.c ++++ b/drivers/spi/spi-tegra20-sflash.c +@@ -455,7 +455,11 @@ static int tegra_sflash_probe(struct platform_device *pdev) + goto exit_free_master; + } + +- tsd->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ goto exit_free_master; ++ tsd->irq = ret; ++ + ret = request_irq(tsd->irq, tegra_sflash_isr, 0, + dev_name(&pdev->dev), tsd); + if (ret < 0) { +-- +2.40.1 + diff --git a/queue-6.1/tcp-tcp_enter_quickack_mode-should-be-static.patch b/queue-6.1/tcp-tcp_enter_quickack_mode-should-be-static.patch new file mode 100644 index 00000000000..cdad8367b68 --- /dev/null +++ b/queue-6.1/tcp-tcp_enter_quickack_mode-should-be-static.patch @@ -0,0 +1,60 @@ +From e10b1a008e0f3cfe44d9e6992e715d4945c1403a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 16:20:49 +0000 +Subject: tcp: tcp_enter_quickack_mode() should be static + +From: Eric Dumazet + +[ Upstream commit 03b123debcbc8db987bda17ed8412cc011064c22 ] + +After commit d2ccd7bc8acd ("tcp: avoid resetting ACK timer in DCTCP"), +tcp_enter_quickack_mode() is only used from net/ipv4/tcp_input.c. + +Fixes: d2ccd7bc8acd ("tcp: avoid resetting ACK timer in DCTCP") +Signed-off-by: Eric Dumazet +Cc: Yuchung Cheng +Cc: Neal Cardwell +Link: https://lore.kernel.org/r/20230718162049.1444938-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 1 - + net/ipv4/tcp_input.c | 3 +-- + 2 files changed, 1 insertion(+), 3 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index e9c8f88f47696..5fd69f2342a44 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -355,7 +355,6 @@ ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos, + struct sk_buff *tcp_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp, + bool force_schedule); + +-void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks); + static inline void tcp_dec_quickack_mode(struct sock *sk, + const unsigned int pkts) + { +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index e2d3ea2e34561..c697836f2b5b4 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -287,7 +287,7 @@ static void tcp_incr_quickack(struct sock *sk, unsigned int max_quickacks) + icsk->icsk_ack.quick = quickacks; + } + +-void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks) ++static void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks) + { + struct inet_connection_sock *icsk = inet_csk(sk); + +@@ -295,7 +295,6 @@ void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks) + inet_csk_exit_pingpong_mode(sk); + icsk->icsk_ack.ato = TCP_ATO_MIN; + } +-EXPORT_SYMBOL(tcp_enter_quickack_mode); + + /* Send ACKs quickly, if "quick" count is not exhausted + * and the session is not interactive. +-- +2.40.1 + diff --git a/queue-6.1/thermal-of-fix-potential-uninitialized-value-access.patch b/queue-6.1/thermal-of-fix-potential-uninitialized-value-access.patch new file mode 100644 index 00000000000..447262a5bd7 --- /dev/null +++ b/queue-6.1/thermal-of-fix-potential-uninitialized-value-access.patch @@ -0,0 +1,62 @@ +From 1f78611461ee1a07e796a4eaf4f161c71a2fbc7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 09:16:36 +0800 +Subject: thermal/of: Fix potential uninitialized value access + +From: Peng Fan + +[ Upstream commit f96801f0cfcefc0a16b146596577c53c75ee9773 ] + +If of_parse_phandle_with_args() called from __thermal_of_bind() or +__thermal_of_unbind() fails, cooling_spec.np will not be initialized, +so move the of_node_put() calls below the respective return value checks +to avoid dereferencing an uninitialized pointer. + +Fixes: 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization") +Signed-off-by: Peng Fan +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/thermal/thermal_of.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c +index aacba30bc10c1..762d1990180bf 100644 +--- a/drivers/thermal/thermal_of.c ++++ b/drivers/thermal/thermal_of.c +@@ -409,13 +409,13 @@ static int __thermal_of_unbind(struct device_node *map_np, int index, int trip_i + ret = of_parse_phandle_with_args(map_np, "cooling-device", "#cooling-cells", + index, &cooling_spec); + +- of_node_put(cooling_spec.np); +- + if (ret < 0) { + pr_err("Invalid cooling-device entry\n"); + return ret; + } + ++ of_node_put(cooling_spec.np); ++ + if (cooling_spec.args_count < 2) { + pr_err("wrong reference to cooling device, missing limits\n"); + return -EINVAL; +@@ -442,13 +442,13 @@ static int __thermal_of_bind(struct device_node *map_np, int index, int trip_id, + ret = of_parse_phandle_with_args(map_np, "cooling-device", "#cooling-cells", + index, &cooling_spec); + +- of_node_put(cooling_spec.np); +- + if (ret < 0) { + pr_err("Invalid cooling-device entry\n"); + return ret; + } + ++ of_node_put(cooling_spec.np); ++ + if (cooling_spec.args_count < 2) { + pr_err("wrong reference to cooling device, missing limits\n"); + return -EINVAL; +-- +2.40.1 + diff --git a/queue-6.1/tick-rcu-fix-false-positive-softirq-work-is-pending-.patch b/queue-6.1/tick-rcu-fix-false-positive-softirq-work-is-pending-.patch new file mode 100644 index 00000000000..29dd9c523a8 --- /dev/null +++ b/queue-6.1/tick-rcu-fix-false-positive-softirq-work-is-pending-.patch @@ -0,0 +1,79 @@ +From 5ab7a7ed270087d768c1d2aa808979402af1a225 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 16:07:57 -0400 +Subject: tick/rcu: Fix false positive "softirq work is pending" messages + +From: Paul Gortmaker + +[ Upstream commit 96c1fa04f089a7e977a44e4e8fdc92e81be20bef ] + +In commit 0345691b24c0 ("tick/rcu: Stop allowing RCU_SOFTIRQ in idle") the +new function report_idle_softirq() was created by breaking code out of the +existing can_stop_idle_tick() for kernels v5.18 and newer. + +In doing so, the code essentially went from a one conditional: + + if (a && b && c) + warn(); + +to a three conditional: + + if (!a) + return; + if (!b) + return; + if (!c) + return; + warn(); + +But that conversion got the condition for the RT specific +local_bh_blocked() wrong. The original condition was: + + !local_bh_blocked() + +but the conversion failed to negate it so it ended up as: + + if (!local_bh_blocked()) + return false; + +This issue lay dormant until another fixup for the same commit was added +in commit a7e282c77785 ("tick/rcu: Fix bogus ratelimit condition"). +This commit realized the ratelimit was essentially set to zero instead +of ten, and hence *no* softirq pending messages would ever be issued. + +Once this commit was backported via linux-stable, both the v6.1 and v6.4 +preempt-rt kernels started printing out 10 instances of this at boot: + + NOHZ tick-stop error: local softirq work is pending, handler #80!!! + +Remove the negation and return when local_bh_blocked() evaluates to true to +bring the correct behaviour back. + +Fixes: 0345691b24c0 ("tick/rcu: Stop allowing RCU_SOFTIRQ in idle") +Signed-off-by: Paul Gortmaker +Signed-off-by: Thomas Gleixner +Tested-by: Ahmad Fatoum +Reviewed-by: Wen Yang +Acked-by: Frederic Weisbecker +Link: https://lore.kernel.org/r/20230818200757.1808398-1-paul.gortmaker@windriver.com +Signed-off-by: Sasha Levin +--- + kernel/time/tick-sched.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 1ad89eec2a55f..798e1841d2863 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -1050,7 +1050,7 @@ static bool report_idle_softirq(void) + return false; + + /* On RT, softirqs handling may be waiting on some lock */ +- if (!local_bh_blocked()) ++ if (local_bh_blocked()) + return false; + + pr_warn("NOHZ tick-stop error: local softirq work is pending, handler #%02x!!!\n", +-- +2.40.1 + diff --git a/queue-6.1/tmpfs-verify-g-u-id-mount-options-correctly.patch b/queue-6.1/tmpfs-verify-g-u-id-mount-options-correctly.patch new file mode 100644 index 00000000000..277c8370a46 --- /dev/null +++ b/queue-6.1/tmpfs-verify-g-u-id-mount-options-correctly.patch @@ -0,0 +1,98 @@ +From bae25da5551067fadc6cebab9d1a3ebdaaf661ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Aug 2023 18:17:04 +0200 +Subject: tmpfs: verify {g,u}id mount options correctly + +From: Christian Brauner + +[ Upstream commit 0200679fc7953177941e41c2a4241d0b6c2c5de8 ] + +A while ago we received the following report: + +"The other outstanding issue I noticed comes from the fact that +fsconfig syscalls may occur in a different userns than that which +called fsopen. That means that resolving the uid/gid via +current_user_ns() can save a kuid that isn't mapped in the associated +namespace when the filesystem is finally mounted. This means that it +is possible for an unprivileged user to create files owned by any +group in a tmpfs mount (since we can set the SUID bit on the tmpfs +directory), or a tmpfs that is owned by any user, including the root +group/user." + +The contract for {g,u}id mount options and {g,u}id values in general set +from userspace has always been that they are translated according to the +caller's idmapping. In so far, tmpfs has been doing the correct thing. +But since tmpfs is mountable in unprivileged contexts it is also +necessary to verify that the resulting {k,g}uid is representable in the +namespace of the superblock to avoid such bugs as above. + +The new mount api's cross-namespace delegation abilities are already +widely used. After having talked to a bunch of userspace this is the +most faithful solution with minimal regression risks. I know of one +users - systemd - that makes use of the new mount api in this way and +they don't set unresolable {g,u}ids. So the regression risk is minimal. + +Link: https://lore.kernel.org/lkml/CALxfFW4BXhEwxR0Q5LSkg-8Vb4r2MONKCcUCVioehXQKr35eHg@mail.gmail.com +Fixes: f32356261d44 ("vfs: Convert ramfs, shmem, tmpfs, devtmpfs, rootfs to use the new mount API") +Reviewed-by: "Seth Forshee (DigitalOcean)" +Reported-by: Seth Jenkins +Message-Id: <20230801-vfs-fs_context-uidgid-v1-1-daf46a050bbf@kernel.org> +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + mm/shmem.c | 28 ++++++++++++++++++++++++---- + 1 file changed, 24 insertions(+), 4 deletions(-) + +diff --git a/mm/shmem.c b/mm/shmem.c +index 10365ced5b1fc..806741bbe4a68 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -3485,6 +3485,8 @@ static int shmem_parse_one(struct fs_context *fc, struct fs_parameter *param) + unsigned long long size; + char *rest; + int opt; ++ kuid_t kuid; ++ kgid_t kgid; + + opt = fs_parse(fc, shmem_fs_parameters, param, &result); + if (opt < 0) +@@ -3520,14 +3522,32 @@ static int shmem_parse_one(struct fs_context *fc, struct fs_parameter *param) + ctx->mode = result.uint_32 & 07777; + break; + case Opt_uid: +- ctx->uid = make_kuid(current_user_ns(), result.uint_32); +- if (!uid_valid(ctx->uid)) ++ kuid = make_kuid(current_user_ns(), result.uint_32); ++ if (!uid_valid(kuid)) + goto bad_value; ++ ++ /* ++ * The requested uid must be representable in the ++ * filesystem's idmapping. ++ */ ++ if (!kuid_has_mapping(fc->user_ns, kuid)) ++ goto bad_value; ++ ++ ctx->uid = kuid; + break; + case Opt_gid: +- ctx->gid = make_kgid(current_user_ns(), result.uint_32); +- if (!gid_valid(ctx->gid)) ++ kgid = make_kgid(current_user_ns(), result.uint_32); ++ if (!gid_valid(kgid)) + goto bad_value; ++ ++ /* ++ * The requested gid must be representable in the ++ * filesystem's idmapping. ++ */ ++ if (!kgid_has_mapping(fc->user_ns, kgid)) ++ goto bad_value; ++ ++ ctx->gid = kgid; + break; + case Opt_huge: + ctx->huge = result.uint_32; +-- +2.40.1 + diff --git a/queue-6.1/tracing-fix-race-issue-between-cpu-buffer-write-and-.patch b/queue-6.1/tracing-fix-race-issue-between-cpu-buffer-write-and-.patch new file mode 100644 index 00000000000..b03e61c936a --- /dev/null +++ b/queue-6.1/tracing-fix-race-issue-between-cpu-buffer-write-and-.patch @@ -0,0 +1,141 @@ +From 6431b01069cea5584fd99e3e9b489448b4be8ce6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Aug 2023 21:27:39 +0800 +Subject: tracing: Fix race issue between cpu buffer write and swap + +From: Zheng Yejian + +[ Upstream commit 3163f635b20e9e1fb4659e74f47918c9dddfe64e ] + +Warning happened in rb_end_commit() at code: + if (RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))) + + WARNING: CPU: 0 PID: 139 at kernel/trace/ring_buffer.c:3142 + rb_commit+0x402/0x4a0 + Call Trace: + ring_buffer_unlock_commit+0x42/0x250 + trace_buffer_unlock_commit_regs+0x3b/0x250 + trace_event_buffer_commit+0xe5/0x440 + trace_event_buffer_reserve+0x11c/0x150 + trace_event_raw_event_sched_switch+0x23c/0x2c0 + __traceiter_sched_switch+0x59/0x80 + __schedule+0x72b/0x1580 + schedule+0x92/0x120 + worker_thread+0xa0/0x6f0 + +It is because the race between writing event into cpu buffer and swapping +cpu buffer through file per_cpu/cpu0/snapshot: + + Write on CPU 0 Swap buffer by per_cpu/cpu0/snapshot on CPU 1 + -------- -------- + tracing_snapshot_write() + [...] + + ring_buffer_lock_reserve() + cpu_buffer = buffer->buffers[cpu]; // 1. Suppose find 'cpu_buffer_a'; + [...] + rb_reserve_next_event() + [...] + + ring_buffer_swap_cpu() + if (local_read(&cpu_buffer_a->committing)) + goto out_dec; + if (local_read(&cpu_buffer_b->committing)) + goto out_dec; + buffer_a->buffers[cpu] = cpu_buffer_b; + buffer_b->buffers[cpu] = cpu_buffer_a; + // 2. cpu_buffer has swapped here. + + rb_start_commit(cpu_buffer); + if (unlikely(READ_ONCE(cpu_buffer->buffer) + != buffer)) { // 3. This check passed due to 'cpu_buffer->buffer' + [...] // has not changed here. + return NULL; + } + cpu_buffer_b->buffer = buffer_a; + cpu_buffer_a->buffer = buffer_b; + [...] + + // 4. Reserve event from 'cpu_buffer_a'. + + ring_buffer_unlock_commit() + [...] + cpu_buffer = buffer->buffers[cpu]; // 5. Now find 'cpu_buffer_b' !!! + rb_commit(cpu_buffer) + rb_end_commit() // 6. WARN for the wrong 'committing' state !!! + +Based on above analysis, we can easily reproduce by following testcase: + ``` bash + #!/bin/bash + + dmesg -n 7 + sysctl -w kernel.panic_on_warn=1 + TR=/sys/kernel/tracing + echo 7 > ${TR}/buffer_size_kb + echo "sched:sched_switch" > ${TR}/set_event + while [ true ]; do + echo 1 > ${TR}/per_cpu/cpu0/snapshot + done & + while [ true ]; do + echo 1 > ${TR}/per_cpu/cpu0/snapshot + done & + while [ true ]; do + echo 1 > ${TR}/per_cpu/cpu0/snapshot + done & + ``` + +To fix it, IIUC, we can use smp_call_function_single() to do the swap on +the target cpu where the buffer is located, so that above race would be +avoided. + +Link: https://lore.kernel.org/linux-trace-kernel/20230831132739.4070878-1-zhengyejian1@huawei.com + +Cc: +Fixes: f1affcaaa861 ("tracing: Add snapshot in the per_cpu trace directories") +Signed-off-by: Zheng Yejian +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index e581253ecc535..5d0465ae7be8c 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -7516,6 +7516,11 @@ static int tracing_snapshot_open(struct inode *inode, struct file *file) + return ret; + } + ++static void tracing_swap_cpu_buffer(void *tr) ++{ ++ update_max_tr_single((struct trace_array *)tr, current, smp_processor_id()); ++} ++ + static ssize_t + tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt, + loff_t *ppos) +@@ -7574,13 +7579,15 @@ tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt, + ret = tracing_alloc_snapshot_instance(tr); + if (ret < 0) + break; +- local_irq_disable(); + /* Now, we're going to swap */ +- if (iter->cpu_file == RING_BUFFER_ALL_CPUS) ++ if (iter->cpu_file == RING_BUFFER_ALL_CPUS) { ++ local_irq_disable(); + update_max_tr(tr, current, smp_processor_id(), NULL); +- else +- update_max_tr_single(tr, current, iter->cpu_file); +- local_irq_enable(); ++ local_irq_enable(); ++ } else { ++ smp_call_function_single(iter->cpu_file, tracing_swap_cpu_buffer, ++ (void *)tr, 1); ++ } + break; + default: + if (tr->allocated_snapshot) { +-- +2.40.1 + diff --git a/queue-6.1/tracing-remove-extra-space-at-the-end-of-hwlat_detec.patch b/queue-6.1/tracing-remove-extra-space-at-the-end-of-hwlat_detec.patch new file mode 100644 index 00000000000..48d4e2e3609 --- /dev/null +++ b/queue-6.1/tracing-remove-extra-space-at-the-end-of-hwlat_detec.patch @@ -0,0 +1,44 @@ +From 7260245222d1e63b5d4a0b2c7f91078048ac2698 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Aug 2023 13:34:30 +0300 +Subject: tracing: Remove extra space at the end of hwlat_detector/mode + +From: Mikhail Kobuk + +[ Upstream commit 2cf0dee989a8b2501929eaab29473b6b1fa11057 ] + +Space is printed after each mode value including the last one: +$ echo \"$(sudo cat /sys/kernel/tracing/hwlat_detector/mode)\" +"none [round-robin] per-cpu " + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Link: https://lore.kernel.org/linux-trace-kernel/20230825103432.7750-1-m.kobuk@ispras.ru + +Cc: Masami Hiramatsu +Fixes: 8fa826b7344d ("trace/hwlat: Implement the mode config option") +Signed-off-by: Mikhail Kobuk +Reviewed-by: Alexey Khoroshilov +Acked-by: Daniel Bristot de Oliveira +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_hwlat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c +index 2f37a6e68aa9f..b791524a6536a 100644 +--- a/kernel/trace/trace_hwlat.c ++++ b/kernel/trace/trace_hwlat.c +@@ -635,7 +635,7 @@ static int s_mode_show(struct seq_file *s, void *v) + else + seq_printf(s, "%s", thread_mode_str[mode]); + +- if (mode != MODE_MAX) ++ if (mode < MODE_MAX - 1) /* if mode is any but last */ + seq_puts(s, " "); + + return 0; +-- +2.40.1 + diff --git a/queue-6.1/udp-re-score-reuseport-groups-when-connected-sockets.patch b/queue-6.1/udp-re-score-reuseport-groups-when-connected-sockets.patch new file mode 100644 index 00000000000..f2ef9d1e280 --- /dev/null +++ b/queue-6.1/udp-re-score-reuseport-groups-when-connected-sockets.patch @@ -0,0 +1,114 @@ +From 26a3db262fa998aeea53953b97f2a21df26d958e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 17:30:05 +0200 +Subject: udp: re-score reuseport groups when connected sockets are present + +From: Lorenz Bauer + +[ Upstream commit f0ea27e7bfe1c34e1f451a63eb68faa1d4c3a86d ] + +Contrary to TCP, UDP reuseport groups can contain TCP_ESTABLISHED +sockets. To support these properly we remember whether a group has +a connected socket and skip the fast reuseport early-return. In +effect we continue scoring all reuseport sockets and then choose the +one with the highest score. + +The current code fails to re-calculate the score for the result of +lookup_reuseport. According to Kuniyuki Iwashima: + + 1) SO_INCOMING_CPU is set + -> selected sk might have +1 score + + 2) BPF prog returns ESTABLISHED and/or SO_INCOMING_CPU sk + -> selected sk will have more than 8 + + Using the old score could trigger more lookups depending on the + order that sockets are created. + + sk -> sk (SO_INCOMING_CPU) -> sk (ESTABLISHED) + | | + `-> select the next SO_INCOMING_CPU sk + | + `-> select itself (We should save this lookup) + +Fixes: efc6b6f6c311 ("udp: Improve load balancing for SO_REUSEPORT.") +Reviewed-by: Kuniyuki Iwashima +Signed-off-by: Lorenz Bauer +Link: https://lore.kernel.org/r/20230720-so-reuseport-v6-1-7021b683cdae@isovalent.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + net/ipv4/udp.c | 20 +++++++++++++++----- + net/ipv6/udp.c | 19 ++++++++++++++----- + 2 files changed, 29 insertions(+), 10 deletions(-) + +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 956d6797c76f3..42c1f7d9a980a 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -445,14 +445,24 @@ static struct sock *udp4_lib_lookup2(struct net *net, + score = compute_score(sk, net, saddr, sport, + daddr, hnum, dif, sdif); + if (score > badness) { +- result = lookup_reuseport(net, sk, skb, +- saddr, sport, daddr, hnum); ++ badness = score; ++ result = lookup_reuseport(net, sk, skb, saddr, sport, daddr, hnum); ++ if (!result) { ++ result = sk; ++ continue; ++ } ++ + /* Fall back to scoring if group has connections */ +- if (result && !reuseport_has_conns(sk)) ++ if (!reuseport_has_conns(sk)) + return result; + +- result = result ? : sk; +- badness = score; ++ /* Reuseport logic returned an error, keep original score. */ ++ if (IS_ERR(result)) ++ continue; ++ ++ badness = compute_score(result, net, saddr, sport, ++ daddr, hnum, dif, sdif); ++ + } + } + return result; +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 27348172b25b9..64b36c2ba774a 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -193,14 +193,23 @@ static struct sock *udp6_lib_lookup2(struct net *net, + score = compute_score(sk, net, saddr, sport, + daddr, hnum, dif, sdif); + if (score > badness) { +- result = lookup_reuseport(net, sk, skb, +- saddr, sport, daddr, hnum); ++ badness = score; ++ result = lookup_reuseport(net, sk, skb, saddr, sport, daddr, hnum); ++ if (!result) { ++ result = sk; ++ continue; ++ } ++ + /* Fall back to scoring if group has connections */ +- if (result && !reuseport_has_conns(sk)) ++ if (!reuseport_has_conns(sk)) + return result; + +- result = result ? : sk; +- badness = score; ++ /* Reuseport logic returned an error, keep original score. */ ++ if (IS_ERR(result)) ++ continue; ++ ++ badness = compute_score(sk, net, saddr, sport, ++ daddr, hnum, dif, sdif); + } + } + return result; +-- +2.40.1 + diff --git a/queue-6.1/um-fix-hostaudio-build-errors.patch b/queue-6.1/um-fix-hostaudio-build-errors.patch new file mode 100644 index 00000000000..3c1dceefbcd --- /dev/null +++ b/queue-6.1/um-fix-hostaudio-build-errors.patch @@ -0,0 +1,148 @@ +From 76782b2134c2c6d355ce9fef5faa0a4356496132 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Aug 2023 22:15:00 -0700 +Subject: um: Fix hostaudio build errors + +From: Randy Dunlap + +[ Upstream commit db4bfcba7bb8d10f00bba2a3da6b9a9c2a1d7b71 ] + +Use "select" to ensure that the required kconfig symbols are set +as expected. +Drop HOSTAUDIO since it is now equivalent to UML_SOUND. + +Set CONFIG_SOUND=m in ARCH=um defconfig files to maintain the +status quo of the default configs. + +Allow SOUND with UML regardless of HAS_IOMEM. Otherwise there is a +kconfig warning for unmet dependencies. (This was not an issue when +SOUND was defined in arch/um/drivers/Kconfig. I have done 50 randconfig +builds and didn't find any issues.) + +This fixes build errors when CONFIG_SOUND is not set: + +ld: arch/um/drivers/hostaudio_kern.o: in function `hostaudio_cleanup_module': +hostaudio_kern.c:(.exit.text+0xa): undefined reference to `unregister_sound_mixer' +ld: hostaudio_kern.c:(.exit.text+0x15): undefined reference to `unregister_sound_dsp' +ld: arch/um/drivers/hostaudio_kern.o: in function `hostaudio_init_module': +hostaudio_kern.c:(.init.text+0x19): undefined reference to `register_sound_dsp' +ld: hostaudio_kern.c:(.init.text+0x31): undefined reference to `register_sound_mixer' +ld: hostaudio_kern.c:(.init.text+0x49): undefined reference to `unregister_sound_dsp' + +and this kconfig warning: +WARNING: unmet direct dependencies detected for SOUND + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Fixes: d886e87cb82b ("sound: make OSS sound core optional") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Closes: lore.kernel.org/r/202307141416.vxuRVpFv-lkp@intel.com +Cc: Richard Weinberger +Cc: Anton Ivanov +Cc: Johannes Berg +Cc: linux-um@lists.infradead.org +Cc: Tejun Heo +Cc: Takashi Iwai +Cc: Jaroslav Kysela +Cc: Masahiro Yamada +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Nicolas Schier +Cc: linux-kbuild@vger.kernel.org +Cc: alsa-devel@alsa-project.org +Reviewed-by: Masahiro Yamada +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/configs/i386_defconfig | 1 + + arch/um/configs/x86_64_defconfig | 1 + + arch/um/drivers/Kconfig | 16 +++------------- + arch/um/drivers/Makefile | 2 +- + sound/Kconfig | 2 +- + 5 files changed, 7 insertions(+), 15 deletions(-) + +diff --git a/arch/um/configs/i386_defconfig b/arch/um/configs/i386_defconfig +index c0162286d68b7..c33a6880a437a 100644 +--- a/arch/um/configs/i386_defconfig ++++ b/arch/um/configs/i386_defconfig +@@ -35,6 +35,7 @@ CONFIG_TTY_CHAN=y + CONFIG_XTERM_CHAN=y + CONFIG_CON_CHAN="pts" + CONFIG_SSL_CHAN="pts" ++CONFIG_SOUND=m + CONFIG_UML_SOUND=m + CONFIG_DEVTMPFS=y + CONFIG_DEVTMPFS_MOUNT=y +diff --git a/arch/um/configs/x86_64_defconfig b/arch/um/configs/x86_64_defconfig +index bec6e5d956873..df29f282b6ac2 100644 +--- a/arch/um/configs/x86_64_defconfig ++++ b/arch/um/configs/x86_64_defconfig +@@ -33,6 +33,7 @@ CONFIG_TTY_CHAN=y + CONFIG_XTERM_CHAN=y + CONFIG_CON_CHAN="pts" + CONFIG_SSL_CHAN="pts" ++CONFIG_SOUND=m + CONFIG_UML_SOUND=m + CONFIG_DEVTMPFS=y + CONFIG_DEVTMPFS_MOUNT=y +diff --git a/arch/um/drivers/Kconfig b/arch/um/drivers/Kconfig +index 5903e2b598aae..fe0210eaf9bb6 100644 +--- a/arch/um/drivers/Kconfig ++++ b/arch/um/drivers/Kconfig +@@ -111,24 +111,14 @@ config SSL_CHAN + + config UML_SOUND + tristate "Sound support" ++ depends on SOUND ++ select SOUND_OSS_CORE + help + This option enables UML sound support. If enabled, it will pull in +- soundcore and the UML hostaudio relay, which acts as a intermediary ++ the UML hostaudio relay, which acts as a intermediary + between the host's dsp and mixer devices and the UML sound system. + It is safe to say 'Y' here. + +-config SOUND +- tristate +- default UML_SOUND +- +-config SOUND_OSS_CORE +- bool +- default UML_SOUND +- +-config HOSTAUDIO +- tristate +- default UML_SOUND +- + endmenu + + menu "UML Network Devices" +diff --git a/arch/um/drivers/Makefile b/arch/um/drivers/Makefile +index 65b449c992d2c..079556ec044b8 100644 +--- a/arch/um/drivers/Makefile ++++ b/arch/um/drivers/Makefile +@@ -54,7 +54,7 @@ obj-$(CONFIG_UML_NET) += net.o + obj-$(CONFIG_MCONSOLE) += mconsole.o + obj-$(CONFIG_MMAPPER) += mmapper_kern.o + obj-$(CONFIG_BLK_DEV_UBD) += ubd.o +-obj-$(CONFIG_HOSTAUDIO) += hostaudio.o ++obj-$(CONFIG_UML_SOUND) += hostaudio.o + obj-$(CONFIG_NULL_CHAN) += null.o + obj-$(CONFIG_PORT_CHAN) += port.o + obj-$(CONFIG_PTY_CHAN) += pty.o +diff --git a/sound/Kconfig b/sound/Kconfig +index e56d96d2b11ca..1903c35d799e1 100644 +--- a/sound/Kconfig ++++ b/sound/Kconfig +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0-only + menuconfig SOUND + tristate "Sound card support" +- depends on HAS_IOMEM ++ depends on HAS_IOMEM || UML + help + If you have a sound card in your computer, i.e. if it can say more + than an occasional beep, say Y. +-- +2.40.1 + diff --git a/queue-6.1/usb-gadget-core-add-missing-kerneldoc-for-vbus_work.patch b/queue-6.1/usb-gadget-core-add-missing-kerneldoc-for-vbus_work.patch new file mode 100644 index 00000000000..36395d42a06 --- /dev/null +++ b/queue-6.1/usb-gadget-core-add-missing-kerneldoc-for-vbus_work.patch @@ -0,0 +1,35 @@ +From 86a6ff6b162cc85b0fa07db807a8913067160e8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 13:44:38 -0400 +Subject: USB: gadget: core: Add missing kerneldoc for vbus_work + +From: Alan Stern + +[ Upstream commit 159a98afc88e88f588077afe818081d67f50a5e0 ] + +Add a missing kerneldoc description of the vbus_work field in struct usb_udc. + +Signed-off-by: Alan Stern +Fixes: 50966da807c8 ("usb: gadget: udc: core: Offload usb_udc_vbus_handler processing") +Link: https://lore.kernel.org/r/1e5e7cda-b2c8-4917-9952-4354f365ede0@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c +index 316e9cc3987be..1c0c61e8ba696 100644 +--- a/drivers/usb/gadget/udc/core.c ++++ b/drivers/usb/gadget/udc/core.c +@@ -40,6 +40,7 @@ static struct bus_type gadget_bus_type; + * @allow_connect: Indicates whether UDC is allowed to be pulled up. + * Set/cleared by gadget_(un)bind_driver() after gadget driver is bound or + * unbound. ++ * @vbus_work: work routine to handle VBUS status change notifications. + * @connect_lock: protects udc->started, gadget->connect, + * gadget->allow_connect and gadget->deactivate. The routines + * usb_gadget_connect_locked(), usb_gadget_disconnect_locked(), +-- +2.40.1 + diff --git a/queue-6.1/usb-gadget-f_mass_storage-fix-unused-variable-warnin.patch b/queue-6.1/usb-gadget-f_mass_storage-fix-unused-variable-warnin.patch new file mode 100644 index 00000000000..ab3bc182021 --- /dev/null +++ b/queue-6.1/usb-gadget-f_mass_storage-fix-unused-variable-warnin.patch @@ -0,0 +1,37 @@ +From db7bcbe3b6b447c3abddb8e1f7def5e9aae8536c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 13:47:04 -0400 +Subject: USB: gadget: f_mass_storage: Fix unused variable warning + +From: Alan Stern + +[ Upstream commit 55c3e571d2a0aabef4f1354604443f1c415d2e85 ] + +Fix a "variable set but not used" warning in f_mass_storage.c. rc is +used if verbose debugging is enabled but not otherwise. + +Signed-off-by: Alan Stern +Fixes: d5e2b67aae79 ("USB: g_mass_storage: template f_mass_storage.c file created") +Link: https://lore.kernel.org/r/cfed16c7-aa46-494b-ba84-b0e0dc99be3a@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_mass_storage.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c +index 3abf7f586e2af..7b9a4cf9b100c 100644 +--- a/drivers/usb/gadget/function/f_mass_storage.c ++++ b/drivers/usb/gadget/function/f_mass_storage.c +@@ -926,7 +926,7 @@ static void invalidate_sub(struct fsg_lun *curlun) + { + struct file *filp = curlun->filp; + struct inode *inode = file_inode(filp); +- unsigned long rc; ++ unsigned long __maybe_unused rc; + + rc = invalidate_mapping_pages(inode->i_mapping, 0, -1); + VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc); +-- +2.40.1 + diff --git a/queue-6.1/usb-phy-mxs-fix-getting-wrong-state-with-mxs_phy_is_.patch b/queue-6.1/usb-phy-mxs-fix-getting-wrong-state-with-mxs_phy_is_.patch new file mode 100644 index 00000000000..0bc8367ccb6 --- /dev/null +++ b/queue-6.1/usb-phy-mxs-fix-getting-wrong-state-with-mxs_phy_is_.patch @@ -0,0 +1,50 @@ +From 97c6312a43400df31c94eeb42fd38431074d4cb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 19:03:52 +0800 +Subject: usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() + +From: Xu Yang + +[ Upstream commit 5eda42aebb7668b4dcff025cd3ccb0d3d7c53da6 ] + +The function mxs_phy_is_otg_host() will return true if OTG_ID_VALUE is +0 at USBPHY_CTRL register. However, OTG_ID_VALUE will not reflect the real +state if the ID pin is float, such as Host-only or Type-C cases. The value +of OTG_ID_VALUE is always 1 which means device mode. +This patch will fix the issue by judging the current mode based on +last_event. The controller will update last_event in time. + +Fixes: 7b09e67639d6 ("usb: phy: mxs: refine mxs_phy_disconnect_line") +Signed-off-by: Xu Yang +Acked-by: Peter Chen +Link: https://lore.kernel.org/r/20230627110353.1879477-2-xu.yang_2@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-mxs-usb.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c +index d2836ef5d15c7..9299df53eb9df 100644 +--- a/drivers/usb/phy/phy-mxs-usb.c ++++ b/drivers/usb/phy/phy-mxs-usb.c +@@ -388,14 +388,8 @@ static void __mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool disconnect) + + static bool mxs_phy_is_otg_host(struct mxs_phy *mxs_phy) + { +- void __iomem *base = mxs_phy->phy.io_priv; +- u32 phyctrl = readl(base + HW_USBPHY_CTRL); +- +- if (IS_ENABLED(CONFIG_USB_OTG) && +- !(phyctrl & BM_USBPHY_CTRL_OTG_ID_VALUE)) +- return true; +- +- return false; ++ return IS_ENABLED(CONFIG_USB_OTG) && ++ mxs_phy->phy.last_event == USB_EVENT_ID; + } + + static void mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool on) +-- +2.40.1 + diff --git a/queue-6.1/vfio-type1-fix-cap_migration-information-leak.patch b/queue-6.1/vfio-type1-fix-cap_migration-information-leak.patch new file mode 100644 index 00000000000..55c6871358f --- /dev/null +++ b/queue-6.1/vfio-type1-fix-cap_migration-information-leak.patch @@ -0,0 +1,93 @@ +From 61b95499930a89612afea7b6c92facfdfaa157bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Aug 2023 11:53:52 -0400 +Subject: vfio/type1: fix cap_migration information leak + +From: Stefan Hajnoczi + +[ Upstream commit cd24e2a60af633f157d7e59c0a6dba64f131c0b1 ] + +Fix an information leak where an uninitialized hole in struct +vfio_iommu_type1_info_cap_migration on the stack is exposed to userspace. + +The definition of struct vfio_iommu_type1_info_cap_migration contains a hole as +shown in this pahole(1) output: + + struct vfio_iommu_type1_info_cap_migration { + struct vfio_info_cap_header header; /* 0 8 */ + __u32 flags; /* 8 4 */ + + /* XXX 4 bytes hole, try to pack */ + + __u64 pgsize_bitmap; /* 16 8 */ + __u64 max_dirty_bitmap_size; /* 24 8 */ + + /* size: 32, cachelines: 1, members: 4 */ + /* sum members: 28, holes: 1, sum holes: 4 */ + /* last cacheline: 32 bytes */ + }; + +The cap_mig variable is filled in without initializing the hole: + + static int vfio_iommu_migration_build_caps(struct vfio_iommu *iommu, + struct vfio_info_cap *caps) + { + struct vfio_iommu_type1_info_cap_migration cap_mig; + + cap_mig.header.id = VFIO_IOMMU_TYPE1_INFO_CAP_MIGRATION; + cap_mig.header.version = 1; + + cap_mig.flags = 0; + /* support minimum pgsize */ + cap_mig.pgsize_bitmap = (size_t)1 << __ffs(iommu->pgsize_bitmap); + cap_mig.max_dirty_bitmap_size = DIRTY_BITMAP_SIZE_MAX; + + return vfio_info_add_capability(caps, &cap_mig.header, sizeof(cap_mig)); + } + +The structure is then copied to a temporary location on the heap. At this point +it's already too late and ioctl(VFIO_IOMMU_GET_INFO) copies it to userspace +later: + + int vfio_info_add_capability(struct vfio_info_cap *caps, + struct vfio_info_cap_header *cap, size_t size) + { + struct vfio_info_cap_header *header; + + header = vfio_info_cap_add(caps, size, cap->id, cap->version); + if (IS_ERR(header)) + return PTR_ERR(header); + + memcpy(header + 1, cap + 1, size - sizeof(*header)); + + return 0; + } + +This issue was found by code inspection. + +Signed-off-by: Stefan Hajnoczi +Reviewed-by: Kevin Tian +Fixes: ad721705d09c ("vfio iommu: Add migration capability to report supported features") +Link: https://lore.kernel.org/r/20230801155352.1391945-1-stefanha@redhat.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/vfio_iommu_type1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index 009ba186652ac..18a2dbbc77799 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -2822,7 +2822,7 @@ static int vfio_iommu_iova_build_caps(struct vfio_iommu *iommu, + static int vfio_iommu_migration_build_caps(struct vfio_iommu *iommu, + struct vfio_info_cap *caps) + { +- struct vfio_iommu_type1_info_cap_migration cap_mig; ++ struct vfio_iommu_type1_info_cap_migration cap_mig = {}; + + cap_mig.header.id = VFIO_IOMMU_TYPE1_INFO_CAP_MIGRATION; + cap_mig.header.version = 1; +-- +2.40.1 + diff --git a/queue-6.1/vfs-security-fix-automount-superblock-lsm-init-probl.patch b/queue-6.1/vfs-security-fix-automount-superblock-lsm-init-probl.patch new file mode 100644 index 00000000000..9f4f9611aed --- /dev/null +++ b/queue-6.1/vfs-security-fix-automount-superblock-lsm-init-probl.patch @@ -0,0 +1,258 @@ +From 137f205b2df31bbb1945f859a38f8c3bb3aba22b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Aug 2023 07:34:20 -0400 +Subject: vfs, security: Fix automount superblock LSM init problem, preventing + NFS sb sharing + +From: David Howells + +[ Upstream commit d80a8f1b58c2bc8d7c6bfb65401ea4f7ec8cddc2 ] + +When NFS superblocks are created by automounting, their LSM parameters +aren't set in the fs_context struct prior to sget_fc() being called, +leading to failure to match existing superblocks. + +This bug leads to messages like the following appearing in dmesg when +fscache is enabled: + + NFS: Cache volume key already in use (nfs,4.2,2,108,106a8c0,1,,,,100000,100000,2ee,3a98,1d4c,3a98,1) + +Fix this by adding a new LSM hook to load fc->security for submount +creation. + +Signed-off-by: David Howells +Signed-off-by: Jeff Layton +Link: https://lore.kernel.org/r/165962680944.3334508.6610023900349142034.stgit@warthog.procyon.org.uk/ # v1 +Link: https://lore.kernel.org/r/165962729225.3357250.14350728846471527137.stgit@warthog.procyon.org.uk/ # v2 +Link: https://lore.kernel.org/r/165970659095.2812394.6868894171102318796.stgit@warthog.procyon.org.uk/ # v3 +Link: https://lore.kernel.org/r/166133579016.3678898.6283195019480567275.stgit@warthog.procyon.org.uk/ # v4 +Link: https://lore.kernel.org/r/217595.1662033775@warthog.procyon.org.uk/ # v5 +Fixes: 9bc61ab18b1d ("vfs: Introduce fs_context, switch vfs_kern_mount() to it.") +Fixes: 779df6a5480f ("NFS: Ensure security label is set for root inode") +Tested-by: Jeff Layton +Acked-by: Casey Schaufler +Acked-by: "Christian Brauner (Microsoft)" +Acked-by: Paul Moore +Reviewed-by: Jeff Layton +Message-Id: <20230808-master-v9-1-e0ecde888221@kernel.org> +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/fs_context.c | 23 +++++++++++++++- + include/linux/lsm_hook_defs.h | 1 + + include/linux/security.h | 6 +++++ + security/security.c | 14 ++++++++++ + security/selinux/hooks.c | 22 +++++++++++++++ + security/smack/smack_lsm.c | 51 +++++++++++++++++++++++++++++++++++ + 6 files changed, 116 insertions(+), 1 deletion(-) + +diff --git a/fs/fs_context.c b/fs/fs_context.c +index 851214d1d013d..375023e40161d 100644 +--- a/fs/fs_context.c ++++ b/fs/fs_context.c +@@ -315,10 +315,31 @@ struct fs_context *fs_context_for_reconfigure(struct dentry *dentry, + } + EXPORT_SYMBOL(fs_context_for_reconfigure); + ++/** ++ * fs_context_for_submount: allocate a new fs_context for a submount ++ * @type: file_system_type of the new context ++ * @reference: reference dentry from which to copy relevant info ++ * ++ * Allocate a new fs_context suitable for a submount. This also ensures that ++ * the fc->security object is inherited from @reference (if needed). ++ */ + struct fs_context *fs_context_for_submount(struct file_system_type *type, + struct dentry *reference) + { +- return alloc_fs_context(type, reference, 0, 0, FS_CONTEXT_FOR_SUBMOUNT); ++ struct fs_context *fc; ++ int ret; ++ ++ fc = alloc_fs_context(type, reference, 0, 0, FS_CONTEXT_FOR_SUBMOUNT); ++ if (IS_ERR(fc)) ++ return fc; ++ ++ ret = security_fs_context_submount(fc, reference->d_sb); ++ if (ret) { ++ put_fs_context(fc); ++ return ERR_PTR(ret); ++ } ++ ++ return fc; + } + EXPORT_SYMBOL(fs_context_for_submount); + +diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h +index ec119da1d89b4..4a97a6db9bcec 100644 +--- a/include/linux/lsm_hook_defs.h ++++ b/include/linux/lsm_hook_defs.h +@@ -54,6 +54,7 @@ LSM_HOOK(int, 0, bprm_creds_from_file, struct linux_binprm *bprm, struct file *f + LSM_HOOK(int, 0, bprm_check_security, struct linux_binprm *bprm) + LSM_HOOK(void, LSM_RET_VOID, bprm_committing_creds, struct linux_binprm *bprm) + LSM_HOOK(void, LSM_RET_VOID, bprm_committed_creds, struct linux_binprm *bprm) ++LSM_HOOK(int, 0, fs_context_submount, struct fs_context *fc, struct super_block *reference) + LSM_HOOK(int, 0, fs_context_dup, struct fs_context *fc, + struct fs_context *src_sc) + LSM_HOOK(int, -ENOPARAM, fs_context_parse_param, struct fs_context *fc, +diff --git a/include/linux/security.h b/include/linux/security.h +index ca1b7109c0dbb..a6c97cc57caa0 100644 +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -293,6 +293,7 @@ int security_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file); + int security_bprm_check(struct linux_binprm *bprm); + void security_bprm_committing_creds(struct linux_binprm *bprm); + void security_bprm_committed_creds(struct linux_binprm *bprm); ++int security_fs_context_submount(struct fs_context *fc, struct super_block *reference); + int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc); + int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param); + int security_sb_alloc(struct super_block *sb); +@@ -625,6 +626,11 @@ static inline void security_bprm_committed_creds(struct linux_binprm *bprm) + { + } + ++static inline int security_fs_context_submount(struct fs_context *fc, ++ struct super_block *reference) ++{ ++ return 0; ++} + static inline int security_fs_context_dup(struct fs_context *fc, + struct fs_context *src_fc) + { +diff --git a/security/security.c b/security/security.c +index 75dc0947ee0cf..5fa286ae9908d 100644 +--- a/security/security.c ++++ b/security/security.c +@@ -882,6 +882,20 @@ void security_bprm_committed_creds(struct linux_binprm *bprm) + call_void_hook(bprm_committed_creds, bprm); + } + ++/** ++ * security_fs_context_submount() - Initialise fc->security ++ * @fc: new filesystem context ++ * @reference: dentry reference for submount/remount ++ * ++ * Fill out the ->security field for a new fs_context. ++ * ++ * Return: Returns 0 on success or negative error code on failure. ++ */ ++int security_fs_context_submount(struct fs_context *fc, struct super_block *reference) ++{ ++ return call_int_hook(fs_context_submount, 0, fc, reference); ++} ++ + int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc) + { + return call_int_hook(fs_context_dup, 0, fc, src_fc); +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index f553c370397ee..26c9e4da4efcf 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -2766,6 +2766,27 @@ static int selinux_umount(struct vfsmount *mnt, int flags) + FILESYSTEM__UNMOUNT, NULL); + } + ++static int selinux_fs_context_submount(struct fs_context *fc, ++ struct super_block *reference) ++{ ++ const struct superblock_security_struct *sbsec; ++ struct selinux_mnt_opts *opts; ++ ++ opts = kzalloc(sizeof(*opts), GFP_KERNEL); ++ if (!opts) ++ return -ENOMEM; ++ ++ sbsec = selinux_superblock(reference); ++ if (sbsec->flags & FSCONTEXT_MNT) ++ opts->fscontext_sid = sbsec->sid; ++ if (sbsec->flags & CONTEXT_MNT) ++ opts->context_sid = sbsec->mntpoint_sid; ++ if (sbsec->flags & DEFCONTEXT_MNT) ++ opts->defcontext_sid = sbsec->def_sid; ++ fc->security = opts; ++ return 0; ++} ++ + static int selinux_fs_context_dup(struct fs_context *fc, + struct fs_context *src_fc) + { +@@ -7263,6 +7284,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { + /* + * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE + */ ++ LSM_HOOK_INIT(fs_context_submount, selinux_fs_context_submount), + LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup), + LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param), + LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts), +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index b6306d71c9088..67dcd31cd3f3d 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -611,6 +611,56 @@ static int smack_add_opt(int token, const char *s, void **mnt_opts) + return -EINVAL; + } + ++/** ++ * smack_fs_context_submount - Initialise security data for a filesystem context ++ * @fc: The filesystem context. ++ * @reference: reference superblock ++ * ++ * Returns 0 on success or -ENOMEM on error. ++ */ ++static int smack_fs_context_submount(struct fs_context *fc, ++ struct super_block *reference) ++{ ++ struct superblock_smack *sbsp; ++ struct smack_mnt_opts *ctx; ++ struct inode_smack *isp; ++ ++ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); ++ if (!ctx) ++ return -ENOMEM; ++ fc->security = ctx; ++ ++ sbsp = smack_superblock(reference); ++ isp = smack_inode(reference->s_root->d_inode); ++ ++ if (sbsp->smk_default) { ++ ctx->fsdefault = kstrdup(sbsp->smk_default->smk_known, GFP_KERNEL); ++ if (!ctx->fsdefault) ++ return -ENOMEM; ++ } ++ ++ if (sbsp->smk_floor) { ++ ctx->fsfloor = kstrdup(sbsp->smk_floor->smk_known, GFP_KERNEL); ++ if (!ctx->fsfloor) ++ return -ENOMEM; ++ } ++ ++ if (sbsp->smk_hat) { ++ ctx->fshat = kstrdup(sbsp->smk_hat->smk_known, GFP_KERNEL); ++ if (!ctx->fshat) ++ return -ENOMEM; ++ } ++ ++ if (isp->smk_flags & SMK_INODE_TRANSMUTE) { ++ if (sbsp->smk_root) { ++ ctx->fstransmute = kstrdup(sbsp->smk_root->smk_known, GFP_KERNEL); ++ if (!ctx->fstransmute) ++ return -ENOMEM; ++ } ++ } ++ return 0; ++} ++ + /** + * smack_fs_context_dup - Duplicate the security data on fs_context duplication + * @fc: The new filesystem context. +@@ -4792,6 +4842,7 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { + LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme), + LSM_HOOK_INIT(syslog, smack_syslog), + ++ LSM_HOOK_INIT(fs_context_submount, smack_fs_context_submount), + LSM_HOOK_INIT(fs_context_dup, smack_fs_context_dup), + LSM_HOOK_INIT(fs_context_parse_param, smack_fs_context_parse_param), + +-- +2.40.1 + diff --git a/queue-6.1/virtio_ring-fix-avail_wrap_counter-in-virtqueue_add_.patch b/queue-6.1/virtio_ring-fix-avail_wrap_counter-in-virtqueue_add_.patch new file mode 100644 index 00000000000..e52cc504d7a --- /dev/null +++ b/queue-6.1/virtio_ring-fix-avail_wrap_counter-in-virtqueue_add_.patch @@ -0,0 +1,80 @@ +From 1bb9aba4dfb8e1efb3c15d001a006be5cf6a4ecb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Aug 2023 05:10:59 +0000 +Subject: virtio_ring: fix avail_wrap_counter in virtqueue_add_packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yuan Yao + +[ Upstream commit 1acfe2c1225899eab5ab724c91b7e1eb2881b9ab ] + +In current packed virtqueue implementation, the avail_wrap_counter won't +flip, in the case when the driver supplies a descriptor chain with a +length equals to the queue size; total_sg == vq->packed.vring.num. + +Let’s assume the following situation: +vq->packed.vring.num=4 +vq->packed.next_avail_idx: 1 +vq->packed.avail_wrap_counter: 0 + +Then the driver adds a descriptor chain containing 4 descriptors. + +We expect the following result with avail_wrap_counter flipped: +vq->packed.next_avail_idx: 1 +vq->packed.avail_wrap_counter: 1 + +But, the current implementation gives the following result: +vq->packed.next_avail_idx: 1 +vq->packed.avail_wrap_counter: 0 + +To reproduce the bug, you can set a packed queue size as small as +possible, so that the driver is more likely to provide a descriptor +chain with a length equal to the packed queue size. For example, in +qemu run following commands: +sudo qemu-system-x86_64 \ +-enable-kvm \ +-nographic \ +-kernel "path/to/kernel_image" \ +-m 1G \ +-drive file="path/to/rootfs",if=none,id=disk \ +-device virtio-blk,drive=disk \ +-drive file="path/to/disk_image",if=none,id=rwdisk \ +-device virtio-blk,drive=rwdisk,packed=on,queue-size=4,\ +indirect_desc=off \ +-append "console=ttyS0 root=/dev/vda rw init=/bin/bash" + +Inside the VM, create a directory and mount the rwdisk device on it. The +rwdisk will hang and mount operation will not complete. + +This commit fixes the wrap counter error by flipping the +packed.avail_wrap_counter, when start of descriptor chain equals to the +end of descriptor chain (head == i). + +Fixes: 1ce9e6055fa0 ("virtio_ring: introduce packed ring support") +Signed-off-by: Yuan Yao +Message-Id: <20230808051110.3492693-1-yuanyaogoog@chromium.org> +Acked-by: Jason Wang +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_ring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index 90d514c141794..7d320f799ca1e 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -1449,7 +1449,7 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq, + } + } + +- if (i < head) ++ if (i <= head) + vq->packed.avail_wrap_counter ^= 1; + + /* We're using some buffers from the free list. */ +-- +2.40.1 + diff --git a/queue-6.1/wifi-ath10k-use-rmw-accessors-for-changing-lnkctl.patch b/queue-6.1/wifi-ath10k-use-rmw-accessors-for-changing-lnkctl.patch new file mode 100644 index 00000000000..f5e40738819 --- /dev/null +++ b/queue-6.1/wifi-ath10k-use-rmw-accessors-for-changing-lnkctl.patch @@ -0,0 +1,61 @@ +From 657c356344b67418ec3153ca4133d1f0f06d5fba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:05:02 +0300 +Subject: wifi: ath10k: Use RMW accessors for changing LNKCTL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit f139492a09f15254fa261245cdbd65555cdf39e3 ] + +Don't assume that only the driver would be accessing LNKCTL. ASPM policy +changes can trigger write to LNKCTL outside of driver's control. + +Use RMW capability accessors which does proper locking to avoid losing +concurrent updates to the register value. On restore, clear the ASPMC field +properly. + +Suggested-by: Lukas Wunner +Fixes: 76d870ed09ab ("ath10k: enable ASPM") +Link: https://lore.kernel.org/r/20230717120503.15276-11-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Reviewed-by: Simon Horman +Acked-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/pci.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c +index 728d607289c36..522691ba4c5d2 100644 +--- a/drivers/net/wireless/ath/ath10k/pci.c ++++ b/drivers/net/wireless/ath/ath10k/pci.c +@@ -1963,8 +1963,9 @@ static int ath10k_pci_hif_start(struct ath10k *ar) + ath10k_pci_irq_enable(ar); + ath10k_pci_rx_post(ar); + +- pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL, +- ar_pci->link_ctl); ++ pcie_capability_clear_and_set_word(ar_pci->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_ASPMC, ++ ar_pci->link_ctl & PCI_EXP_LNKCTL_ASPMC); + + return 0; + } +@@ -2821,8 +2822,8 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar, + + pcie_capability_read_word(ar_pci->pdev, PCI_EXP_LNKCTL, + &ar_pci->link_ctl); +- pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL, +- ar_pci->link_ctl & ~PCI_EXP_LNKCTL_ASPMC); ++ pcie_capability_clear_word(ar_pci->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_ASPMC); + + /* + * Bring the target up cleanly. +-- +2.40.1 + diff --git a/queue-6.1/wifi-ath11k-use-rmw-accessors-for-changing-lnkctl.patch b/queue-6.1/wifi-ath11k-use-rmw-accessors-for-changing-lnkctl.patch new file mode 100644 index 00000000000..2fb4771c65a --- /dev/null +++ b/queue-6.1/wifi-ath11k-use-rmw-accessors-for-changing-lnkctl.patch @@ -0,0 +1,62 @@ +From 7d61d310ec30148a0a322593e8a263d375713a5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:05:00 +0300 +Subject: wifi: ath11k: Use RMW accessors for changing LNKCTL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 6c1b6bdb34aaf8f94f65a9cae1d63490320c11bc ] + +Don't assume that only the driver would be accessing LNKCTL. ASPM policy +changes can trigger write to LNKCTL outside of driver's control. + +Use RMW capability accessors which do proper locking to avoid losing +concurrent updates to the register value. On restore, clear the ASPMC field +properly. + +Suggested-by: Lukas Wunner +Fixes: e9603f4bdcc0 ("ath11k: pci: disable ASPM L0sLs before downloading firmware") +Link: https://lore.kernel.org/r/20230717120503.15276-9-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Reviewed-by: Simon Horman +Acked-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/pci.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/pci.c b/drivers/net/wireless/ath/ath11k/pci.c +index 3c6005ab9a717..3953ebd551bf8 100644 +--- a/drivers/net/wireless/ath/ath11k/pci.c ++++ b/drivers/net/wireless/ath/ath11k/pci.c +@@ -582,8 +582,8 @@ static void ath11k_pci_aspm_disable(struct ath11k_pci *ab_pci) + u16_get_bits(ab_pci->link_ctl, PCI_EXP_LNKCTL_ASPM_L1)); + + /* disable L0s and L1 */ +- pcie_capability_write_word(ab_pci->pdev, PCI_EXP_LNKCTL, +- ab_pci->link_ctl & ~PCI_EXP_LNKCTL_ASPMC); ++ pcie_capability_clear_word(ab_pci->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_ASPMC); + + set_bit(ATH11K_PCI_ASPM_RESTORE, &ab_pci->flags); + } +@@ -591,8 +591,10 @@ static void ath11k_pci_aspm_disable(struct ath11k_pci *ab_pci) + static void ath11k_pci_aspm_restore(struct ath11k_pci *ab_pci) + { + if (test_and_clear_bit(ATH11K_PCI_ASPM_RESTORE, &ab_pci->flags)) +- pcie_capability_write_word(ab_pci->pdev, PCI_EXP_LNKCTL, +- ab_pci->link_ctl); ++ pcie_capability_clear_and_set_word(ab_pci->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_ASPMC, ++ ab_pci->link_ctl & ++ PCI_EXP_LNKCTL_ASPMC); + } + + static int ath11k_pci_power_up(struct ath11k_base *ab) +-- +2.40.1 + diff --git a/queue-6.1/wifi-ath9k-fix-races-between-ath9k_wmi_cmd-and-ath9k.patch b/queue-6.1/wifi-ath9k-fix-races-between-ath9k_wmi_cmd-and-ath9k.patch new file mode 100644 index 00000000000..f0e3356a075 --- /dev/null +++ b/queue-6.1/wifi-ath9k-fix-races-between-ath9k_wmi_cmd-and-ath9k.patch @@ -0,0 +1,129 @@ +From 2c721e099e14152f56a105f9a5e582cf044d7b0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 22:26:06 +0300 +Subject: wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit b674fb513e2e7a514fcde287c0f73915d393fdb6 ] + +Currently, the synchronization between ath9k_wmi_cmd() and +ath9k_wmi_ctrl_rx() is exposed to a race condition which, although being +rather unlikely, can lead to invalid behaviour of ath9k_wmi_cmd(). + +Consider the following scenario: + +CPU0 CPU1 + +ath9k_wmi_cmd(...) + mutex_lock(&wmi->op_mutex) + ath9k_wmi_cmd_issue(...) + wait_for_completion_timeout(...) + --- + timeout + --- + /* the callback is being processed + * before last_seq_id became zero + */ + ath9k_wmi_ctrl_rx(...) + spin_lock_irqsave(...) + /* wmi->last_seq_id check here + * doesn't detect timeout yet + */ + spin_unlock_irqrestore(...) + /* last_seq_id is zeroed to + * indicate there was a timeout + */ + wmi->last_seq_id = 0 + mutex_unlock(&wmi->op_mutex) + return -ETIMEDOUT + +ath9k_wmi_cmd(...) + mutex_lock(&wmi->op_mutex) + /* the buffer is replaced with + * another one + */ + wmi->cmd_rsp_buf = rsp_buf + wmi->cmd_rsp_len = rsp_len + ath9k_wmi_cmd_issue(...) + spin_lock_irqsave(...) + spin_unlock_irqrestore(...) + wait_for_completion_timeout(...) + /* the continuation of the + * callback left after the first + * ath9k_wmi_cmd call + */ + ath9k_wmi_rsp_callback(...) + /* copying data designated + * to already timeouted + * WMI command into an + * inappropriate wmi_cmd_buf + */ + memcpy(...) + complete(&wmi->cmd_wait) + /* awakened by the bogus callback + * => invalid return result + */ + mutex_unlock(&wmi->op_mutex) + return 0 + +To fix this, update last_seq_id on timeout path inside ath9k_wmi_cmd() +under the wmi_lock. Move ath9k_wmi_rsp_callback() under wmi_lock inside +ath9k_wmi_ctrl_rx() so that the wmi->cmd_wait can be completed only for +initially designated wmi_cmd call, otherwise the path would be rejected +with last_seq_id check. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Signed-off-by: Fedor Pchelkin +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230425192607.18015-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/wmi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c +index d652c647d56b5..04f363cb90fe5 100644 +--- a/drivers/net/wireless/ath/ath9k/wmi.c ++++ b/drivers/net/wireless/ath/ath9k/wmi.c +@@ -242,10 +242,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb, + spin_unlock_irqrestore(&wmi->wmi_lock, flags); + goto free_skb; + } +- spin_unlock_irqrestore(&wmi->wmi_lock, flags); + + /* WMI command response */ + ath9k_wmi_rsp_callback(wmi, skb); ++ spin_unlock_irqrestore(&wmi->wmi_lock, flags); + + free_skb: + kfree_skb(skb); +@@ -308,8 +308,8 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + struct ath_common *common = ath9k_hw_common(ah); + u16 headroom = sizeof(struct htc_frame_hdr) + + sizeof(struct wmi_cmd_hdr); ++ unsigned long time_left, flags; + struct sk_buff *skb; +- unsigned long time_left; + int ret = 0; + + if (ah->ah_flags & AH_UNPLUGGED) +@@ -345,7 +345,9 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + if (!time_left) { + ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n", + wmi_cmd_to_name(cmd_id)); ++ spin_lock_irqsave(&wmi->wmi_lock, flags); + wmi->last_seq_id = 0; ++ spin_unlock_irqrestore(&wmi->wmi_lock, flags); + mutex_unlock(&wmi->op_mutex); + return -ETIMEDOUT; + } +-- +2.40.1 + diff --git a/queue-6.1/wifi-ath9k-protect-wmi-command-response-buffer-repla.patch b/queue-6.1/wifi-ath9k-protect-wmi-command-response-buffer-repla.patch new file mode 100644 index 00000000000..cc0cf62faa7 --- /dev/null +++ b/queue-6.1/wifi-ath9k-protect-wmi-command-response-buffer-repla.patch @@ -0,0 +1,78 @@ +From d55991cfa4f210e2ab6449f2dfc594dec83b5f64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 22:26:07 +0300 +Subject: wifi: ath9k: protect WMI command response buffer replacement with a + lock +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit 454994cfa9e4c18b6df9f78b60db8eadc20a6c25 ] + +If ath9k_wmi_cmd() has exited with a timeout, it is possible that during +next ath9k_wmi_cmd() call the wmi_rsp callback for previous wmi command +writes to new wmi->cmd_rsp_buf and makes a completion. This results in an +invalid ath9k_wmi_cmd() return value. + +Move the replacement of WMI command response buffer and length under +wmi_lock. Note that last_seq_id value is updated there, too. + +Thus, the buffer cannot be written to by a belated wmi_rsp callback +because that path is properly rejected by the last_seq_id check. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Signed-off-by: Fedor Pchelkin +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230425192607.18015-2-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/wmi.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c +index 04f363cb90fe5..1476b42b52a91 100644 +--- a/drivers/net/wireless/ath/ath9k/wmi.c ++++ b/drivers/net/wireless/ath/ath9k/wmi.c +@@ -283,7 +283,8 @@ int ath9k_wmi_connect(struct htc_target *htc, struct wmi *wmi, + + static int ath9k_wmi_cmd_issue(struct wmi *wmi, + struct sk_buff *skb, +- enum wmi_cmd_id cmd, u16 len) ++ enum wmi_cmd_id cmd, u16 len, ++ u8 *rsp_buf, u32 rsp_len) + { + struct wmi_cmd_hdr *hdr; + unsigned long flags; +@@ -293,6 +294,11 @@ static int ath9k_wmi_cmd_issue(struct wmi *wmi, + hdr->seq_no = cpu_to_be16(++wmi->tx_seq_id); + + spin_lock_irqsave(&wmi->wmi_lock, flags); ++ ++ /* record the rsp buffer and length */ ++ wmi->cmd_rsp_buf = rsp_buf; ++ wmi->cmd_rsp_len = rsp_len; ++ + wmi->last_seq_id = wmi->tx_seq_id; + spin_unlock_irqrestore(&wmi->wmi_lock, flags); + +@@ -333,11 +339,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + goto out; + } + +- /* record the rsp buffer and length */ +- wmi->cmd_rsp_buf = rsp_buf; +- wmi->cmd_rsp_len = rsp_len; +- +- ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len); ++ ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len, rsp_buf, rsp_len); + if (ret) + goto out; + +-- +2.40.1 + diff --git a/queue-6.1/wifi-ath9k-use-is_err-with-debugfs_create_dir.patch b/queue-6.1/wifi-ath9k-use-is_err-with-debugfs_create_dir.patch new file mode 100644 index 00000000000..ae1858902e7 --- /dev/null +++ b/queue-6.1/wifi-ath9k-use-is_err-with-debugfs_create_dir.patch @@ -0,0 +1,44 @@ +From 33b4275b8e2c0dacd6957b8db2ae526933f70ddd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 11:03:44 +0800 +Subject: wifi: ath9k: use IS_ERR() with debugfs_create_dir() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wang Ming + +[ Upstream commit 1e4134610d93271535ecf900a676e1f094e9944c ] + +The debugfs_create_dir() function returns error pointers, +it never returns NULL. Most incorrect error checks were fixed, +but the one in ath9k_htc_init_debug() was forgotten. + +Fix the remaining error check. + +Fixes: e5facc75fa91 ("ath9k_htc: Cleanup HTC debugfs") +Signed-off-by: Wang Ming +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230713030358.12379-1-machel@vivo.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c +index b3ed65e5c4da8..c55aab01fff5d 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c +@@ -491,7 +491,7 @@ int ath9k_htc_init_debug(struct ath_hw *ah) + + priv->debug.debugfs_phy = debugfs_create_dir(KBUILD_MODNAME, + priv->hw->wiphy->debugfsdir); +- if (!priv->debug.debugfs_phy) ++ if (IS_ERR(priv->debug.debugfs_phy)) + return -ENOMEM; + + ath9k_cmn_spectral_init_debug(&priv->spec_priv, priv->debug.debugfs_phy); +-- +2.40.1 + diff --git a/queue-6.1/wifi-mt76-mt7915-fix-power-limits-while-chan_switch.patch b/queue-6.1/wifi-mt76-mt7915-fix-power-limits-while-chan_switch.patch new file mode 100644 index 00000000000..bdb7517baff --- /dev/null +++ b/queue-6.1/wifi-mt76-mt7915-fix-power-limits-while-chan_switch.patch @@ -0,0 +1,45 @@ +From c633c3f1ada0579baaf0acaa077fa2c50a4ff5c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 02:35:06 +0800 +Subject: wifi: mt76: mt7915: fix power-limits while chan_switch + +From: Ryder Lee + +[ Upstream commit 6c0570bc21ec2073890aa252c8420ca7bec402e4 ] + +If user changes the channel without completely disabling the interface the +txpower_sku values reported track the old channel the device was operating on. +If user bounces the interface the correct power tables are applied. + +mt7915_sku_group_len array gets updated before the channel switch happens so it +uses data from the old channel. + +Fixes: ecb187a74e18 ("mt76: mt7915: rework the flow of txpower setting") +Fixes: f1d962369d56 ("mt76: mt7915: implement HE per-rate tx power support") +Reported-By: Chad Monroe +Tested-by: Chad Monroe +Signed-off-by: Allen Ye +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +index bda26bd62412e..3280843ea8566 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +@@ -455,7 +455,8 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed) + ieee80211_wake_queues(hw); + } + +- if (changed & IEEE80211_CONF_CHANGE_POWER) { ++ if (changed & (IEEE80211_CONF_CHANGE_POWER | ++ IEEE80211_CONF_CHANGE_CHANNEL)) { + ret = mt7915_mcu_set_txpower_sku(phy); + if (ret) + return ret; +-- +2.40.1 + diff --git a/queue-6.1/wifi-mt76-mt7921-fix-non-psc-channel-scan-fail.patch b/queue-6.1/wifi-mt76-mt7921-fix-non-psc-channel-scan-fail.patch new file mode 100644 index 00000000000..385942c4440 --- /dev/null +++ b/queue-6.1/wifi-mt76-mt7921-fix-non-psc-channel-scan-fail.patch @@ -0,0 +1,40 @@ +From 3fc78f2f2d97ca956faa15ca37f478cd0a810d19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 22:08:14 +0800 +Subject: wifi: mt76: mt7921: fix non-PSC channel scan fail + +From: Ming Yen Hsieh + +[ Upstream commit 0e5911bb7cc92c00dda9b4d635c1266b7ca915c6 ] + +Due to the scan command may only request legacy bands and PSC channel +in 6GHz band, we are unable to scan the APs on non-PSC channel in this +case. Enable WIPHY_FLAG_SPLIT_SCAN_6GHZ to support non-PSC channel +(obtained during scan on legacy bands) in 6GHz scan request. + +Fixes: 50ac15a511e3 ("mt76: mt7921: add 6GHz support") +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Deren Wu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/init.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c +index 4ad66b3443838..c997b8d3ea590 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c +@@ -80,7 +80,8 @@ mt7921_init_wiphy(struct ieee80211_hw *hw) + wiphy->max_sched_scan_ssids = MT76_CONNAC_MAX_SCHED_SCAN_SSID; + wiphy->max_match_sets = MT76_CONNAC_MAX_SCAN_MATCH; + wiphy->max_sched_scan_reqs = 1; +- wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH; ++ wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH | ++ WIPHY_FLAG_SPLIT_SCAN_6GHZ; + wiphy->reg_notifier = mt7921_regd_notifier; + + wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR | +-- +2.40.1 + diff --git a/queue-6.1/wifi-mt76-testmode-add-nla_policy-for-mt76_tm_attr_t.patch b/queue-6.1/wifi-mt76-testmode-add-nla_policy-for-mt76_tm_attr_t.patch new file mode 100644 index 00000000000..85a10000e23 --- /dev/null +++ b/queue-6.1/wifi-mt76-testmode-add-nla_policy-for-mt76_tm_attr_t.patch @@ -0,0 +1,41 @@ +From dc6d62718308e0c0543481995406b713edd8966d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 16:03:50 +0800 +Subject: wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH + +From: Lin Ma + +[ Upstream commit 74f12d511625e603fac8c0c2b6872e687e56dd61 ] + +It seems that the nla_policy in mt76_tm_policy is missed for attribute +MT76_TM_ATTR_TX_LENGTH. This patch adds the correct description to make +sure the + + u32 val = nla_get_u32(tb[MT76_TM_ATTR_TX_LENGTH]); + +in function mt76_testmode_cmd() is safe and will not result in +out-of-attribute read. + +Fixes: f0efa8621550 ("mt76: add API for testmode support") +Signed-off-by: Lin Ma +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/testmode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/testmode.c b/drivers/net/wireless/mediatek/mt76/testmode.c +index 0accc71a91c9a..4644dace9bb34 100644 +--- a/drivers/net/wireless/mediatek/mt76/testmode.c ++++ b/drivers/net/wireless/mediatek/mt76/testmode.c +@@ -8,6 +8,7 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = { + [MT76_TM_ATTR_RESET] = { .type = NLA_FLAG }, + [MT76_TM_ATTR_STATE] = { .type = NLA_U8 }, + [MT76_TM_ATTR_TX_COUNT] = { .type = NLA_U32 }, ++ [MT76_TM_ATTR_TX_LENGTH] = { .type = NLA_U32 }, + [MT76_TM_ATTR_TX_RATE_MODE] = { .type = NLA_U8 }, + [MT76_TM_ATTR_TX_RATE_NSS] = { .type = NLA_U8 }, + [MT76_TM_ATTR_TX_RATE_IDX] = { .type = NLA_U8 }, +-- +2.40.1 + diff --git a/queue-6.1/wifi-mwifiex-avoid-possible-null-skb-pointer-derefer.patch b/queue-6.1/wifi-mwifiex-avoid-possible-null-skb-pointer-derefer.patch new file mode 100644 index 00000000000..dde29531bde --- /dev/null +++ b/queue-6.1/wifi-mwifiex-avoid-possible-null-skb-pointer-derefer.patch @@ -0,0 +1,50 @@ +From a39bdbc5ca54d65405480420910b58d6fb7daaa5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 12:49:57 +0300 +Subject: wifi: mwifiex: avoid possible NULL skb pointer dereference + +From: Dmitry Antipov + +[ Upstream commit 35a7a1ce7c7d61664ee54f5239a1f120ab95a87e ] + +In 'mwifiex_handle_uap_rx_forward()', always check the value +returned by 'skb_copy()' to avoid potential NULL pointer +dereference in 'mwifiex_uap_queue_bridged_pkt()', and drop +original skb in case of copying failure. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 838e4f449297 ("mwifiex: improve uAP RX handling") +Acked-by: Brian Norris +Signed-off-by: Dmitry Antipov +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230814095041.16416-1-dmantipov@yandex.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +index c1b8d41dd7536..b8b9a0fcb19cd 100644 +--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c ++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +@@ -253,7 +253,15 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv, + + if (is_multicast_ether_addr(ra)) { + skb_uap = skb_copy(skb, GFP_ATOMIC); +- mwifiex_uap_queue_bridged_pkt(priv, skb_uap); ++ if (likely(skb_uap)) { ++ mwifiex_uap_queue_bridged_pkt(priv, skb_uap); ++ } else { ++ mwifiex_dbg(adapter, ERROR, ++ "failed to copy skb for uAP\n"); ++ priv->stats.rx_dropped++; ++ dev_kfree_skb_any(skb); ++ return -1; ++ } + } else { + if (mwifiex_get_sta_entry(priv, ra)) { + /* Requeue Intra-BSS packet */ +-- +2.40.1 + diff --git a/queue-6.1/wifi-mwifiex-fix-error-recovery-in-pcie-buffer-descr.patch b/queue-6.1/wifi-mwifiex-fix-error-recovery-in-pcie-buffer-descr.patch new file mode 100644 index 00000000000..16b6938bb2e --- /dev/null +++ b/queue-6.1/wifi-mwifiex-fix-error-recovery-in-pcie-buffer-descr.patch @@ -0,0 +1,121 @@ +From 9b9ed082fc8e5e9821b6015a0854a5a731d9bb03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jul 2023 10:43:07 +0300 +Subject: wifi: mwifiex: fix error recovery in PCIE buffer descriptor + management + +From: Dmitry Antipov + +[ Upstream commit 288c63d5cb4667a51a04668b3e2bb0ea499bc5f4 ] + +Add missing 'kfree_skb()' in 'mwifiex_init_rxq_ring()' and never do +'kfree(card->rxbd_ring_vbase)' because this area is DMAed and should +be released with 'dma_free_coherent()'. The latter is performed in +'mwifiex_pcie_delete_rxbd_ring()', which is now called to recover +from possible errors in 'mwifiex_pcie_create_rxbd_ring()'. Likewise +for 'mwifiex_pcie_init_evt_ring()', 'kfree(card->evtbd_ring_vbase)' +'mwifiex_pcie_delete_evtbd_ring()' and 'mwifiex_pcie_create_rxbd_ring()'. + +Fixes: d930faee141b ("mwifiex: add support for Marvell pcie8766 chipset") +Signed-off-by: Dmitry Antipov +Acked-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230731074334.56463-1-dmantipov@yandex.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/pcie.c | 25 ++++++++++++++------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index 9a698a16a8f38..6697132ecc977 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -189,6 +189,8 @@ static int mwifiex_pcie_probe_of(struct device *dev) + } + + static void mwifiex_pcie_work(struct work_struct *work); ++static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter); ++static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter); + + static int + mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb, +@@ -792,14 +794,15 @@ static int mwifiex_init_rxq_ring(struct mwifiex_adapter *adapter) + if (!skb) { + mwifiex_dbg(adapter, ERROR, + "Unable to allocate skb for RX ring.\n"); +- kfree(card->rxbd_ring_vbase); + return -ENOMEM; + } + + if (mwifiex_map_pci_memory(adapter, skb, + MWIFIEX_RX_DATA_BUF_SIZE, +- DMA_FROM_DEVICE)) +- return -1; ++ DMA_FROM_DEVICE)) { ++ kfree_skb(skb); ++ return -ENOMEM; ++ } + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); + +@@ -849,7 +852,6 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) + if (!skb) { + mwifiex_dbg(adapter, ERROR, + "Unable to allocate skb for EVENT buf.\n"); +- kfree(card->evtbd_ring_vbase); + return -ENOMEM; + } + skb_put(skb, MAX_EVENT_SIZE); +@@ -857,8 +859,7 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) + if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE, + DMA_FROM_DEVICE)) { + kfree_skb(skb); +- kfree(card->evtbd_ring_vbase); +- return -1; ++ return -ENOMEM; + } + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); +@@ -1058,6 +1059,7 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter) + */ + static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter) + { ++ int ret; + struct pcie_service_card *card = adapter->card; + const struct mwifiex_pcie_card_reg *reg = card->pcie.reg; + +@@ -1096,7 +1098,10 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter) + (u32)((u64)card->rxbd_ring_pbase >> 32), + card->rxbd_ring_size); + +- return mwifiex_init_rxq_ring(adapter); ++ ret = mwifiex_init_rxq_ring(adapter); ++ if (ret) ++ mwifiex_pcie_delete_rxbd_ring(adapter); ++ return ret; + } + + /* +@@ -1127,6 +1132,7 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter) + */ + static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter) + { ++ int ret; + struct pcie_service_card *card = adapter->card; + const struct mwifiex_pcie_card_reg *reg = card->pcie.reg; + +@@ -1161,7 +1167,10 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter) + (u32)((u64)card->evtbd_ring_pbase >> 32), + card->evtbd_ring_size); + +- return mwifiex_pcie_init_evt_ring(adapter); ++ ret = mwifiex_pcie_init_evt_ring(adapter); ++ if (ret) ++ mwifiex_pcie_delete_evtbd_ring(adapter); ++ return ret; + } + + /* +-- +2.40.1 + diff --git a/queue-6.1/wifi-mwifiex-fix-memory-leak-in-mwifiex_histogram_re.patch b/queue-6.1/wifi-mwifiex-fix-memory-leak-in-mwifiex_histogram_re.patch new file mode 100644 index 00000000000..6c4bb3dce4c --- /dev/null +++ b/queue-6.1/wifi-mwifiex-fix-memory-leak-in-mwifiex_histogram_re.patch @@ -0,0 +1,52 @@ +From 3f361191b31816a8fe252a24db793202ede56813 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Aug 2023 19:07:15 +0300 +Subject: wifi: mwifiex: fix memory leak in mwifiex_histogram_read() + +From: Dmitry Antipov + +[ Upstream commit 9c8fd72a5c2a031cbc680a2990107ecd958ffcdb ] + +Always free the zeroed page on return from 'mwifiex_histogram_read()'. + +Fixes: cbf6e05527a7 ("mwifiex: add rx histogram statistics support") + +Acked-by: Brian Norris +Signed-off-by: Dmitry Antipov +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230802160726.85545-1-dmantipov@yandex.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/debugfs.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c +index bda53cb91f376..63f232c723374 100644 +--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c ++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c +@@ -253,8 +253,11 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf, + if (!p) + return -ENOMEM; + +- if (!priv || !priv->hist_data) +- return -EFAULT; ++ if (!priv || !priv->hist_data) { ++ ret = -EFAULT; ++ goto free_and_exit; ++ } ++ + phist_data = priv->hist_data; + + p += sprintf(p, "\n" +@@ -309,6 +312,8 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf, + ret = simple_read_from_buffer(ubuf, count, ppos, (char *)page, + (unsigned long)p - page); + ++free_and_exit: ++ free_page(page); + return ret; + } + +-- +2.40.1 + diff --git a/queue-6.1/wifi-mwifiex-fix-missed-return-in-oob-checks-failed-.patch b/queue-6.1/wifi-mwifiex-fix-missed-return-in-oob-checks-failed-.patch new file mode 100644 index 00000000000..d065f86537b --- /dev/null +++ b/queue-6.1/wifi-mwifiex-fix-missed-return-in-oob-checks-failed-.patch @@ -0,0 +1,51 @@ +From a5b5fc47e9f87da1884878b7a90ed887d6c65364 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 08:39:11 +0000 +Subject: wifi: mwifiex: Fix missed return in oob checks failed path + +From: Polaris Pi + +[ Upstream commit 2785851c627f2db05f9271f7f63661b5dbd95c4c ] + +Add missed return in mwifiex_uap_queue_bridged_pkt() and +mwifiex_process_rx_packet(). + +Fixes: 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") +Signed-off-by: Polaris Pi +Reported-by: Dmitry Antipov +Acked-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230810083911.3725248-1-pinkperfect2021@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/sta_rx.c | 1 + + drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c +index f2899d53a43f9..65420ad674167 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c +@@ -92,6 +92,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, + skb->len, rx_pkt_off); + priv->stats.rx_dropped++; + dev_kfree_skb_any(skb); ++ return -1; + } + + if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, +diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +index 04ff051f5d186..c1b8d41dd7536 100644 +--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c ++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +@@ -110,6 +110,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv, + skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset)); + priv->stats.rx_dropped++; + dev_kfree_skb_any(skb); ++ return; + } + + if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, +-- +2.40.1 + diff --git a/queue-6.1/wifi-mwifiex-fix-oob-and-integer-underflow-when-rx-p.patch b/queue-6.1/wifi-mwifiex-fix-oob-and-integer-underflow-when-rx-p.patch new file mode 100644 index 00000000000..4004bc53e8e --- /dev/null +++ b/queue-6.1/wifi-mwifiex-fix-oob-and-integer-underflow-when-rx-p.patch @@ -0,0 +1,127 @@ +From ad214fb3c38fa99065504026ee6059e171f78fbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 07:07:41 +0000 +Subject: wifi: mwifiex: Fix OOB and integer underflow when rx packets + +From: Polaris Pi + +[ Upstream commit 11958528161731c58e105b501ed60b83a91ea941 ] + +Make sure mwifiex_process_mgmt_packet, +mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, +mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet +not out-of-bounds access the skb->data buffer. + +Fixes: 2dbaf751b1de ("mwifiex: report received management frames to cfg80211") +Signed-off-by: Polaris Pi +Reviewed-by: Matthew Wang +Reviewed-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230723070741.1544662-1-pinkperfect2021@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/sta_rx.c | 11 ++++++++++- + .../net/wireless/marvell/mwifiex/uap_txrx.c | 19 +++++++++++++++++++ + drivers/net/wireless/marvell/mwifiex/util.c | 10 +++++++--- + 3 files changed, 36 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c +index 13659b02ba882..f2899d53a43f9 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c +@@ -86,6 +86,14 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, + rx_pkt_len = le16_to_cpu(local_rx_pd->rx_pkt_length); + rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off; + ++ if (sizeof(*rx_pkt_hdr) + rx_pkt_off > skb->len) { ++ mwifiex_dbg(priv->adapter, ERROR, ++ "wrong rx packet offset: len=%d, rx_pkt_off=%d\n", ++ skb->len, rx_pkt_off); ++ priv->stats.rx_dropped++; ++ dev_kfree_skb_any(skb); ++ } ++ + if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, + sizeof(bridge_tunnel_header))) || + (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header, +@@ -194,7 +202,8 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv, + + rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_offset; + +- if ((rx_pkt_offset + rx_pkt_length) > (u16) skb->len) { ++ if ((rx_pkt_offset + rx_pkt_length) > skb->len || ++ sizeof(rx_pkt_hdr->eth803_hdr) + rx_pkt_offset > skb->len) { + mwifiex_dbg(adapter, ERROR, + "wrong rx packet: len=%d, rx_pkt_offset=%d, rx_pkt_length=%d\n", + skb->len, rx_pkt_offset, rx_pkt_length); +diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +index e495f7eaea033..04ff051f5d186 100644 +--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c ++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +@@ -103,6 +103,15 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv, + return; + } + ++ if (sizeof(*rx_pkt_hdr) + ++ le16_to_cpu(uap_rx_pd->rx_pkt_offset) > skb->len) { ++ mwifiex_dbg(adapter, ERROR, ++ "wrong rx packet offset: len=%d,rx_pkt_offset=%d\n", ++ skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset)); ++ priv->stats.rx_dropped++; ++ dev_kfree_skb_any(skb); ++ } ++ + if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, + sizeof(bridge_tunnel_header))) || + (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header, +@@ -367,6 +376,16 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv, + rx_pkt_type = le16_to_cpu(uap_rx_pd->rx_pkt_type); + rx_pkt_hdr = (void *)uap_rx_pd + le16_to_cpu(uap_rx_pd->rx_pkt_offset); + ++ if (le16_to_cpu(uap_rx_pd->rx_pkt_offset) + ++ sizeof(rx_pkt_hdr->eth803_hdr) > skb->len) { ++ mwifiex_dbg(adapter, ERROR, ++ "wrong rx packet for struct ethhdr: len=%d, offset=%d\n", ++ skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset)); ++ priv->stats.rx_dropped++; ++ dev_kfree_skb_any(skb); ++ return 0; ++ } ++ + ether_addr_copy(ta, rx_pkt_hdr->eth803_hdr.h_source); + + if ((le16_to_cpu(uap_rx_pd->rx_pkt_offset) + +diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c +index 94c2d219835da..745b1d925b217 100644 +--- a/drivers/net/wireless/marvell/mwifiex/util.c ++++ b/drivers/net/wireless/marvell/mwifiex/util.c +@@ -393,11 +393,15 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv, + } + + rx_pd = (struct rxpd *)skb->data; ++ pkt_len = le16_to_cpu(rx_pd->rx_pkt_length); ++ if (pkt_len < sizeof(struct ieee80211_hdr) + sizeof(pkt_len)) { ++ mwifiex_dbg(priv->adapter, ERROR, "invalid rx_pkt_length"); ++ return -1; ++ } + + skb_pull(skb, le16_to_cpu(rx_pd->rx_pkt_offset)); + skb_pull(skb, sizeof(pkt_len)); +- +- pkt_len = le16_to_cpu(rx_pd->rx_pkt_length); ++ pkt_len -= sizeof(pkt_len); + + ieee_hdr = (void *)skb->data; + if (ieee80211_is_mgmt(ieee_hdr->frame_control)) { +@@ -410,7 +414,7 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv, + skb->data + sizeof(struct ieee80211_hdr), + pkt_len - sizeof(struct ieee80211_hdr)); + +- pkt_len -= ETH_ALEN + sizeof(pkt_len); ++ pkt_len -= ETH_ALEN; + rx_pd->rx_pkt_length = cpu_to_le16(pkt_len); + + cfg80211_rx_mgmt(&priv->wdev, priv->roc_cfg.chan.center_freq, +-- +2.40.1 + diff --git a/queue-6.1/wifi-nl80211-cfg80211-add-forgotten-nla_policy-for-b.patch b/queue-6.1/wifi-nl80211-cfg80211-add-forgotten-nla_policy-for-b.patch new file mode 100644 index 00000000000..28ebc4734d6 --- /dev/null +++ b/queue-6.1/wifi-nl80211-cfg80211-add-forgotten-nla_policy-for-b.patch @@ -0,0 +1,44 @@ +From ba29936bbbd55c7775ba574becedd079639970ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 11:31:51 +0800 +Subject: wifi: nl80211/cfg80211: add forgotten nla_policy for BSS color + attribute + +From: Lin Ma + +[ Upstream commit 218d690c49b7e9c94ad0d317adbdd4af846ea0dc ] + +The previous commit dd3e4fc75b4a ("nl80211/cfg80211: add BSS color to +NDP ranging parameters") adds a parameter for NDP ranging by introducing +a new attribute type named NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR. + +However, the author forgot to also describe the nla_policy at +nl80211_pmsr_ftm_req_attr_policy (net/wireless/nl80211.c). Just +complement it to avoid malformed attribute that causes out-of-attribute +access. + +Fixes: dd3e4fc75b4a ("nl80211/cfg80211: add BSS color to NDP ranging parameters") +Signed-off-by: Lin Ma +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230809033151.768910-1-linma@zju.edu.cn +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index c2363d44a1ffc..12c7c89d5be1d 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -323,6 +323,7 @@ nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = { + [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG }, + [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG }, + [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG }, ++ [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 }, + }; + + static const struct nla_policy +-- +2.40.1 + diff --git a/queue-6.1/wifi-rtw89-debug-fix-error-handling-in-rtw89_debug_p.patch b/queue-6.1/wifi-rtw89-debug-fix-error-handling-in-rtw89_debug_p.patch new file mode 100644 index 00000000000..b11079f1b09 --- /dev/null +++ b/queue-6.1/wifi-rtw89-debug-fix-error-handling-in-rtw89_debug_p.patch @@ -0,0 +1,53 @@ +From 7bc2faf1167fa60083b85151e1cd7ab255f2d3f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jul 2023 21:42:57 +0800 +Subject: wifi: rtw89: debug: Fix error handling in + rtw89_debug_priv_btc_manual_set() + +From: Zhang Shurong + +[ Upstream commit 59b4cc439f184c5eaa34161ec67af1e16ffabed4 ] + +If there is a failure during kstrtobool_from_user() +rtw89_debug_priv_btc_manual_set should return a negative error code +instead of returning the count directly. + +Fix this bug by returning an error code instead of a count after +a failed call of the function "kstrtobool_from_user". Moreover +I omitted the label "out" with this source code correction. + +Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver") +Signed-off-by: Zhang Shurong +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/tencent_1C09B99BD7DA9CAD18B00C8F0F050F540607@qq.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/debug.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c +index ec0af903961f0..3a8fe60d0bb7b 100644 +--- a/drivers/net/wireless/realtek/rtw89/debug.c ++++ b/drivers/net/wireless/realtek/rtw89/debug.c +@@ -2302,12 +2302,14 @@ static ssize_t rtw89_debug_priv_btc_manual_set(struct file *filp, + struct rtw89_dev *rtwdev = debugfs_priv->rtwdev; + struct rtw89_btc *btc = &rtwdev->btc; + bool btc_manual; ++ int ret; + +- if (kstrtobool_from_user(user_buf, count, &btc_manual)) +- goto out; ++ ret = kstrtobool_from_user(user_buf, count, &btc_manual); ++ if (ret) ++ return ret; + + btc->ctrl.manual = btc_manual; +-out: ++ + return count; + } + +-- +2.40.1 + diff --git a/queue-6.1/x86-apm-drop-the-duplicate-apm_minor_dev-macro.patch b/queue-6.1/x86-apm-drop-the-duplicate-apm_minor_dev-macro.patch new file mode 100644 index 00000000000..da6347d6b03 --- /dev/null +++ b/queue-6.1/x86-apm-drop-the-duplicate-apm_minor_dev-macro.patch @@ -0,0 +1,46 @@ +From 8c77ab87e256703abeec072a226960b7b9fb8ea8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 18:11:20 -0700 +Subject: x86/APM: drop the duplicate APM_MINOR_DEV macro + +From: Randy Dunlap + +[ Upstream commit 4ba2909638a29630a346d6c4907a3105409bee7d ] + +This source file already includes , which contains +the same macro. It doesn't need to be defined here again. + +Fixes: 874bcd00f520 ("apm-emulation: move APM_MINOR_DEV to include/linux/miscdevice.h") +Signed-off-by: Randy Dunlap +Cc: Jiri Kosina +Cc: x86@kernel.org +Cc: Sohil Mehta +Cc: Corentin Labbe +Reviewed-by: Sohil Mehta +Link: https://lore.kernel.org/r/20230728011120.759-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apm_32.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c +index 60e330cdbd175..6e38188633a4d 100644 +--- a/arch/x86/kernel/apm_32.c ++++ b/arch/x86/kernel/apm_32.c +@@ -238,12 +238,6 @@ + extern int (*console_blank_hook)(int); + #endif + +-/* +- * The apm_bios device is one of the misc char devices. +- * This is its minor number. +- */ +-#define APM_MINOR_DEV 134 +- + /* + * Various options can be changed at boot time as follows: + * (We allow underscores for compatibility with the modules code) +-- +2.40.1 + diff --git a/queue-6.1/x86-decompressor-don-t-rely-on-upper-32-bits-of-gprs.patch b/queue-6.1/x86-decompressor-don-t-rely-on-upper-32-bits-of-gprs.patch new file mode 100644 index 00000000000..3b9da0f4bde --- /dev/null +++ b/queue-6.1/x86-decompressor-don-t-rely-on-upper-32-bits-of-gprs.patch @@ -0,0 +1,113 @@ +From 64ed338b5bf6a127608d5e795aaf7141a7d698a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Aug 2023 18:26:58 +0200 +Subject: x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ard Biesheuvel + +[ Upstream commit 264b82fdb4989cf6a44a2bcd0c6ea05e8026b2ac ] + +The 4-to-5 level mode switch trampoline disables long mode and paging in +order to be able to flick the LA57 bit. According to section 3.4.1.1 of +the x86 architecture manual [0], 64-bit GPRs might not retain the upper +32 bits of their contents across such a mode switch. + +Given that RBP, RBX and RSI are live at this point, preserve them on the +stack, along with the return address that might be above 4G as well. + +[0] Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture + + "Because the upper 32 bits of 64-bit general-purpose registers are + undefined in 32-bit modes, the upper 32 bits of any general-purpose + register are not preserved when switching from 64-bit mode to a 32-bit + mode (to protected mode or compatibility mode). Software must not + depend on these bits to maintain a value after a 64-bit to 32-bit + mode switch." + +Fixes: 194a9749c73d650c ("x86/boot/compressed/64: Handle 5-level paging boot if kernel is above 4G") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230807162720.545787-2-ardb@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/boot/compressed/head_64.S | 30 +++++++++++++++++++++++------- + 1 file changed, 23 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S +index d33f060900d23..b4bd6df29116f 100644 +--- a/arch/x86/boot/compressed/head_64.S ++++ b/arch/x86/boot/compressed/head_64.S +@@ -485,11 +485,25 @@ SYM_CODE_START(startup_64) + /* Save the trampoline address in RCX */ + movq %rax, %rcx + ++ /* Set up 32-bit addressable stack */ ++ leaq TRAMPOLINE_32BIT_STACK_END(%rcx), %rsp ++ ++ /* ++ * Preserve live 64-bit registers on the stack: this is necessary ++ * because the architecture does not guarantee that GPRs will retain ++ * their full 64-bit values across a 32-bit mode switch. ++ */ ++ pushq %rbp ++ pushq %rbx ++ pushq %rsi ++ + /* +- * Load the address of trampoline_return() into RDI. +- * It will be used by the trampoline to return to the main code. ++ * Push the 64-bit address of trampoline_return() onto the new stack. ++ * It will be used by the trampoline to return to the main code. Due to ++ * the 32-bit mode switch, it cannot be kept it in a register either. + */ + leaq trampoline_return(%rip), %rdi ++ pushq %rdi + + /* Switch to compatibility mode (CS.L = 0 CS.D = 1) via far return */ + pushq $__KERNEL32_CS +@@ -497,6 +511,11 @@ SYM_CODE_START(startup_64) + pushq %rax + lretq + trampoline_return: ++ /* Restore live 64-bit registers */ ++ popq %rsi ++ popq %rbx ++ popq %rbp ++ + /* Restore the stack, the 32-bit trampoline uses its own stack */ + leaq rva(boot_stack_end)(%rbx), %rsp + +@@ -606,7 +625,7 @@ SYM_FUNC_END(.Lrelocated) + /* + * This is the 32-bit trampoline that will be copied over to low memory. + * +- * RDI contains the return address (might be above 4G). ++ * Return address is at the top of the stack (might be above 4G). + * ECX contains the base address of the trampoline memory. + * Non zero RDX means trampoline needs to enable 5-level paging. + */ +@@ -616,9 +635,6 @@ SYM_CODE_START(trampoline_32bit_src) + movl %eax, %ds + movl %eax, %ss + +- /* Set up new stack */ +- leal TRAMPOLINE_32BIT_STACK_END(%ecx), %esp +- + /* Disable paging */ + movl %cr0, %eax + btrl $X86_CR0_PG_BIT, %eax +@@ -695,7 +711,7 @@ SYM_CODE_END(trampoline_32bit_src) + .code64 + SYM_FUNC_START_LOCAL_NOALIGN(.Lpaging_enabled) + /* Return from the trampoline */ +- jmp *%rdi ++ retq + SYM_FUNC_END(.Lpaging_enabled) + + /* +-- +2.40.1 + diff --git a/queue-6.1/x86-efistub-fix-pci-rom-preservation-in-mixed-mode.patch b/queue-6.1/x86-efistub-fix-pci-rom-preservation-in-mixed-mode.patch new file mode 100644 index 00000000000..a4b142bd908 --- /dev/null +++ b/queue-6.1/x86-efistub-fix-pci-rom-preservation-in-mixed-mode.patch @@ -0,0 +1,38 @@ +From 32edf71b8908d1c751aff50f39ed27de6a07e847 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Aug 2023 17:51:58 -0400 +Subject: x86/efistub: Fix PCI ROM preservation in mixed mode + +From: Mikel Rychliski + +[ Upstream commit 8b94da92559f7e403dc7ab81937cc50f949ee2fd ] + +preserve_pci_rom_image() was accessing the romsize field in +efi_pci_io_protocol_t directly instead of using the efi_table_attr() +helper. This prevents the ROM image from being saved correctly during a +mixed mode boot. + +Fixes: 2c3625cb9fa2 ("efi/x86: Fold __setup_efi_pci32() and __setup_efi_pci64() into one function") +Signed-off-by: Mikel Rychliski +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/libstub/x86-stub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c +index 33a7811e12c65..4f0152b11a890 100644 +--- a/drivers/firmware/efi/libstub/x86-stub.c ++++ b/drivers/firmware/efi/libstub/x86-stub.c +@@ -61,7 +61,7 @@ preserve_pci_rom_image(efi_pci_io_protocol_t *pci, struct pci_setup_rom **__rom) + rom->data.type = SETUP_PCI; + rom->data.len = size - sizeof(struct setup_data); + rom->data.next = 0; +- rom->pcilen = pci->romsize; ++ rom->pcilen = romsize; + *__rom = rom; + + status = efi_call_proto(pci, pci.read, EfiPciIoWidthUint16, +-- +2.40.1 + diff --git a/queue-6.1/x86-mm-fix-pat-bit-missing-from-page-protection-modi.patch b/queue-6.1/x86-mm-fix-pat-bit-missing-from-page-protection-modi.patch new file mode 100644 index 00000000000..f5b65975113 --- /dev/null +++ b/queue-6.1/x86-mm-fix-pat-bit-missing-from-page-protection-modi.patch @@ -0,0 +1,107 @@ +From fa71810dc80e9cd450701d0f6e8d3b4f315270da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jul 2023 09:36:14 +0200 +Subject: x86/mm: Fix PAT bit missing from page protection modify mask +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Janusz Krzysztofik + +[ Upstream commit 548cb932051fb6232ac983ed6673dae7bdf3cf4c ] + +Visible glitches have been observed when running graphics applications on +Linux under Xen hypervisor. Those observations have been confirmed with +failures from kms_pwrite_crc Intel GPU test that verifies data coherency +of DRM frame buffer objects using hardware CRC checksums calculated by +display controllers, exposed to userspace via debugfs. Affected +processing paths have then been identified with new IGT test variants that +mmap the objects using different methods and caching modes [1]. + +When running as a Xen PV guest, Linux uses Xen provided PAT configuration +which is different from its native one. In particular, Xen specific PTE +encoding of write-combining caching, likely used by graphics applications, +differs from the Linux default one found among statically defined minimal +set of supported modes. Since Xen defines PTE encoding of the WC mode as +_PAGE_PAT, it no longer belongs to the minimal set, depends on correct +handling of _PAGE_PAT bit, and can be mismatched with write-back caching. + +When a user calls mmap() for a DRM buffer object, DRM device specific +.mmap file operation, called from mmap_region(), takes care of setting PTE +encoding bits in a vm_page_prot field of an associated virtual memory area +structure. Unfortunately, _PAGE_PAT bit is not preserved when the vma's +.vm_flags are then applied to .vm_page_prot via vm_set_page_prot(). Bits +to be preserved are determined with _PAGE_CHG_MASK symbol that doesn't +cover _PAGE_PAT. As a consequence, WB caching is requested instead of WC +when running under Xen (also, WP is silently changed to WT, and UC +downgraded to UC_MINUS). When running on bare metal, WC is not affected, +but WP and WT extra modes are unintentionally replaced with WC and UC, +respectively. + +WP and WT modes, encoded with _PAGE_PAT bit set, were introduced by commit +281d4078bec3 ("x86: Make page cache mode a real type"). Care was taken +to extend _PAGE_CACHE_MASK symbol with that additional bit, but that +symbol has never been used for identification of bits preserved when +applying page protection flags. Support for all cache modes under Xen, +including the problematic WC mode, was then introduced by commit +47591df50512 ("xen: Support Xen pv-domains using PAT"). + +The issue needs to be fixed by including _PAGE_PAT bit into a bitmask used +by pgprot_modify() for selecting bits to be preserved. We can do that +either internally to pgprot_modify() (as initially proposed), or by making +_PAGE_PAT a part of _PAGE_CHG_MASK. If we go for the latter then, since +_PAGE_PAT is the same as _PAGE_PSE, we need to note that _HPAGE_CHG_MASK +-- a huge pmds' counterpart of _PAGE_CHG_MASK, introduced by commit +c489f1257b8c ("thp: add pmd_modify"), defined as (_PAGE_CHG_MASK | +_PAGE_PSE) -- will no longer differ from _PAGE_CHG_MASK. If such +modification of _PAGE_CHG_MASK was irrelevant to its users then one might +wonder why that new _HPAGE_CHG_MASK symbol was introduced instead of +reusing the existing one with that otherwise irrelevant bit (_PAGE_PSE in +that case) added. + +Add _PAGE_PAT to _PAGE_CHG_MASK and _PAGE_PAT_LARGE to _HPAGE_CHG_MASK for +symmetry. Split out common bits from both symbols to a common symbol for +clarity. + +[ dhansen: tweak the solution changelog description ] + +[1] https://gitlab.freedesktop.org/drm/igt-gpu-tools/-/commit/0f0754413f14 + +Fixes: 281d4078bec3 ("x86: Make page cache mode a real type") +Signed-off-by: Janusz Krzysztofik +Signed-off-by: Dave Hansen +Reviewed-by: Andi Shyti +Reviewed-by: Juergen Gross +Tested-by: Marek Marczykowski-Górecki +Link: https://gitlab.freedesktop.org/drm/intel/-/issues/7648 +Link: https://lore.kernel.org/all/20230710073613.8006-2-janusz.krzysztofik%40linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/pgtable_types.h | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h +index aa174fed3a71c..f6116b66f2892 100644 +--- a/arch/x86/include/asm/pgtable_types.h ++++ b/arch/x86/include/asm/pgtable_types.h +@@ -125,11 +125,12 @@ + * instance, and is *not* included in this mask since + * pte_modify() does modify it. + */ +-#define _PAGE_CHG_MASK (PTE_PFN_MASK | _PAGE_PCD | _PAGE_PWT | \ +- _PAGE_SPECIAL | _PAGE_ACCESSED | _PAGE_DIRTY | \ +- _PAGE_SOFT_DIRTY | _PAGE_DEVMAP | _PAGE_ENC | \ +- _PAGE_UFFD_WP) +-#define _HPAGE_CHG_MASK (_PAGE_CHG_MASK | _PAGE_PSE) ++#define _COMMON_PAGE_CHG_MASK (PTE_PFN_MASK | _PAGE_PCD | _PAGE_PWT | \ ++ _PAGE_SPECIAL | _PAGE_ACCESSED | _PAGE_DIRTY |\ ++ _PAGE_SOFT_DIRTY | _PAGE_DEVMAP | _PAGE_ENC | \ ++ _PAGE_UFFD_WP) ++#define _PAGE_CHG_MASK (_COMMON_PAGE_CHG_MASK | _PAGE_PAT) ++#define _HPAGE_CHG_MASK (_COMMON_PAGE_CHG_MASK | _PAGE_PSE | _PAGE_PAT_LARGE) + + /* + * The cache modes defined here are used to translate between pure SW usage +-- +2.40.1 + diff --git a/queue-6.1/x86-speculation-mark-all-skylake-cpus-as-vulnerable-.patch b/queue-6.1/x86-speculation-mark-all-skylake-cpus-as-vulnerable-.patch new file mode 100644 index 00000000000..ebae96ab397 --- /dev/null +++ b/queue-6.1/x86-speculation-mark-all-skylake-cpus-as-vulnerable-.patch @@ -0,0 +1,76 @@ +From 379d33a3ba649941d4ddc7e55870fbd91d7d6feb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Aug 2023 08:07:25 -0700 +Subject: x86/speculation: Mark all Skylake CPUs as vulnerable to GDS + +From: Dave Hansen + +[ Upstream commit c9f4c45c8ec3f07f4f083f9750032a1ec3eab6b2 ] + +The Gather Data Sampling (GDS) vulnerability is common to all Skylake +processors. However, the "client" Skylakes* are now in this list: + + https://www.intel.com/content/www/us/en/support/articles/000022396/processors.html + +which means they are no longer included for new vulnerabilities here: + + https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html + +or in other GDS documentation. Thus, they were not included in the +original GDS mitigation patches. + +Mark SKYLAKE and SKYLAKE_L as vulnerable to GDS to match all the +other Skylake CPUs (which include Kaby Lake). Also group the CPUs +so that the ones that share the exact same vulnerabilities are next +to each other. + +Last, move SRBDS to the end of each line. This makes it clear at a +glance that SKYLAKE_X is unique. Of the five Skylakes, it is the +only "server" CPU and has a different implementation from the +clients of the "special register" hardware, making it immune to SRBDS. + +This makes the diff much harder to read, but the resulting table is +worth it. + +I very much appreciate the report from Michael Zhivich about this +issue. Despite what level of support a hardware vendor is providing, +the kernel very much needs an accurate and up-to-date list of +vulnerable CPUs. More reports like this are very welcome. + +* Client Skylakes are CPUID 406E3/506E3 which is family 6, models + 0x4E and 0x5E, aka INTEL_FAM6_SKYLAKE and INTEL_FAM6_SKYLAKE_L. + +Reported-by: Michael Zhivich +Fixes: 8974eb588283 ("x86/speculation: Add Gather Data Sampling mitigation") +Signed-off-by: Dave Hansen +Signed-off-by: Ingo Molnar +Reviewed-by: Daniel Sneddon +Cc: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/common.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index d38ae25e7c01f..b723368dbc644 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1259,11 +1259,11 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { + VULNBL_INTEL_STEPPINGS(BROADWELL_G, X86_STEPPING_ANY, SRBDS), + VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO), + VULNBL_INTEL_STEPPINGS(BROADWELL, X86_STEPPING_ANY, SRBDS), +- VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED), + VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED | GDS), +- VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED), +- VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS), +- VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS), ++ VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), ++ VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), ++ VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), ++ VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), + VULNBL_INTEL_STEPPINGS(CANNONLAKE_L, X86_STEPPING_ANY, RETBLEED), + VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS), + VULNBL_INTEL_STEPPINGS(ICELAKE_D, X86_STEPPING_ANY, MMIO | GDS), +-- +2.40.1 +