From: Greg Kroah-Hartman Date: Fri, 24 Nov 2023 13:43:28 +0000 (+0000) Subject: 5.15-stable patches X-Git-Tag: v4.14.331~53 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7a187089f4fb90408d1ff31a1d6ba829310864b5;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: media-qcom-camss-fix-missing-vfe_lite-clocks-check.patch media-qcom-camss-fix-pm_domain_on-sequence-in-probe.patch media-qcom-camss-fix-vfe-17x-vfe_disable_output.patch media-qcom-camss-fix-vfe_get-error-jump.patch mm-kmem-drop-__gfp_nofail-when-allocating-objcg-vectors.patch mmc-sdhci-pci-gli-gl9750-mask-the-replay-timer-timeout-of-aer.patch r8169-fix-network-lost-after-resume-on-dash-systems.patch --- diff --git a/queue-5.15/media-qcom-camss-fix-missing-vfe_lite-clocks-check.patch b/queue-5.15/media-qcom-camss-fix-missing-vfe_lite-clocks-check.patch new file mode 100644 index 00000000000..c021c32c481 --- /dev/null +++ b/queue-5.15/media-qcom-camss-fix-missing-vfe_lite-clocks-check.patch @@ -0,0 +1,35 @@ +From b6e1bdca463a932c1ac02caa7d3e14bf39288e0c Mon Sep 17 00:00:00 2001 +From: Bryan O'Donoghue +Date: Wed, 30 Aug 2023 16:16:12 +0100 +Subject: media: qcom: camss: Fix missing vfe_lite clocks check + +From: Bryan O'Donoghue + +commit b6e1bdca463a932c1ac02caa7d3e14bf39288e0c upstream. + +check_clock doesn't account for vfe_lite which means that vfe_lite will +never get validated by this routine. Add the clock name to the expected set +to remediate. + +Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/camss/camss-vfe.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/media/platform/qcom/camss/camss-vfe.c ++++ b/drivers/media/platform/qcom/camss/camss-vfe.c +@@ -533,7 +533,8 @@ static int vfe_check_clock_rates(struct + struct camss_clock *clock = &vfe->clock[i]; + + if (!strcmp(clock->name, "vfe0") || +- !strcmp(clock->name, "vfe1")) { ++ !strcmp(clock->name, "vfe1") || ++ !strcmp(clock->name, "vfe_lite")) { + u64 min_rate = 0; + unsigned long rate; + diff --git a/queue-5.15/media-qcom-camss-fix-pm_domain_on-sequence-in-probe.patch b/queue-5.15/media-qcom-camss-fix-pm_domain_on-sequence-in-probe.patch new file mode 100644 index 00000000000..08a2397cb5c --- /dev/null +++ b/queue-5.15/media-qcom-camss-fix-pm_domain_on-sequence-in-probe.patch @@ -0,0 +1,59 @@ +From 7405116519ad70b8c7340359bfac8db8279e7ce4 Mon Sep 17 00:00:00 2001 +From: Bryan O'Donoghue +Date: Wed, 30 Aug 2023 16:16:06 +0100 +Subject: media: qcom: camss: Fix pm_domain_on sequence in probe + +From: Bryan O'Donoghue + +commit 7405116519ad70b8c7340359bfac8db8279e7ce4 upstream. + +We need to make sure camss_configure_pd() happens before +camss_register_entities() as the vfe_get() path relies on the pointer +provided by camss_configure_pd(). + +Fix the ordering sequence in probe to ensure the pointers vfe_get() demands +are present by the time camss_register_entities() runs. + +In order to facilitate backporting to stable kernels I've moved the +configure_pd() call pretty early on the probe() function so that +irrespective of the existence of the old error handling jump labels this +patch should still apply to -next circa Aug 2023 to v5.13 inclusive. + +Fixes: 2f6f8af67203 ("media: camss: Refactor VFE power domain toggling") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/camss/camss.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/media/platform/qcom/camss/camss.c ++++ b/drivers/media/platform/qcom/camss/camss.c +@@ -1369,6 +1369,12 @@ static int camss_probe(struct platform_d + goto err_cleanup; + } + ++ ret = camss_configure_pd(camss); ++ if (ret < 0) { ++ dev_err(dev, "Failed to configure power domains: %d\n", ret); ++ goto err_cleanup; ++ } ++ + ret = camss_init_subdevices(camss); + if (ret < 0) + goto err_cleanup; +@@ -1421,12 +1427,6 @@ static int camss_probe(struct platform_d + } + } + +- ret = camss_configure_pd(camss); +- if (ret < 0) { +- dev_err(dev, "Failed to configure power domains: %d\n", ret); +- return ret; +- } +- + pm_runtime_enable(dev); + + return 0; diff --git a/queue-5.15/media-qcom-camss-fix-vfe-17x-vfe_disable_output.patch b/queue-5.15/media-qcom-camss-fix-vfe-17x-vfe_disable_output.patch new file mode 100644 index 00000000000..8758fcbcf36 --- /dev/null +++ b/queue-5.15/media-qcom-camss-fix-vfe-17x-vfe_disable_output.patch @@ -0,0 +1,91 @@ +From 3143ad282fc08bf995ee73e32a9e40c527bf265d Mon Sep 17 00:00:00 2001 +From: Bryan O'Donoghue +Date: Wed, 30 Aug 2023 16:16:10 +0100 +Subject: media: qcom: camss: Fix VFE-17x vfe_disable_output() + +From: Bryan O'Donoghue + +commit 3143ad282fc08bf995ee73e32a9e40c527bf265d upstream. + +There are two problems with the current vfe_disable_output() routine. + +Firstly we rightly use a spinlock to protect output->gen2.active_num +everywhere except for in the IDLE timeout path of vfe_disable_output(). +Even if that is not racy "in practice" somehow it is by happenstance not +by design. + +Secondly we do not get consistent behaviour from this routine. On +sc8280xp 50% of the time I get "VFE idle timeout - resetting". In this +case the subsequent capture will succeed. The other 50% of the time, we +don't hit the idle timeout, never do the VFE reset and subsequent +captures stall indefinitely. + +Rewrite the vfe_disable_output() routine to + +- Quiesce write masters with vfe_wm_stop() +- Set active_num = 0 + +remembering to hold the spinlock when we do so followed by + +- Reset the VFE + +Testing on sc8280xp and sdm845 shows this to be a valid fix. + +Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/camss/camss-vfe-170.c | 22 +++------------------- + 1 file changed, 3 insertions(+), 19 deletions(-) + +--- a/drivers/media/platform/qcom/camss/camss-vfe-170.c ++++ b/drivers/media/platform/qcom/camss/camss-vfe-170.c +@@ -7,7 +7,6 @@ + * Copyright (C) 2020-2021 Linaro Ltd. + */ + +-#include + #include + #include + #include +@@ -498,35 +497,20 @@ static int vfe_enable_output(struct vfe_ + return 0; + } + +-static int vfe_disable_output(struct vfe_line *line) ++static void vfe_disable_output(struct vfe_line *line) + { + struct vfe_device *vfe = to_vfe(line); + struct vfe_output *output = &line->output; + unsigned long flags; + unsigned int i; +- bool done; +- int timeout = 0; +- +- do { +- spin_lock_irqsave(&vfe->output_lock, flags); +- done = !output->gen2.active_num; +- spin_unlock_irqrestore(&vfe->output_lock, flags); +- usleep_range(10000, 20000); +- +- if (timeout++ == 100) { +- dev_err(vfe->camss->dev, "VFE idle timeout - resetting\n"); +- vfe_reset(vfe); +- output->gen2.active_num = 0; +- return 0; +- } +- } while (!done); + + spin_lock_irqsave(&vfe->output_lock, flags); + for (i = 0; i < output->wm_num; i++) + vfe_wm_stop(vfe, output->wm_idx[i]); ++ output->gen2.active_num = 0; + spin_unlock_irqrestore(&vfe->output_lock, flags); + +- return 0; ++ vfe_reset(vfe); + } + + /* diff --git a/queue-5.15/media-qcom-camss-fix-vfe_get-error-jump.patch b/queue-5.15/media-qcom-camss-fix-vfe_get-error-jump.patch new file mode 100644 index 00000000000..445c08932ed --- /dev/null +++ b/queue-5.15/media-qcom-camss-fix-vfe_get-error-jump.patch @@ -0,0 +1,99 @@ +From 26bda3da00c3edef727a6acb00ed2eb4b22f8723 Mon Sep 17 00:00:00 2001 +From: Bryan O'Donoghue +Date: Wed, 30 Aug 2023 16:16:09 +0100 +Subject: media: qcom: camss: Fix vfe_get() error jump + +From: Bryan O'Donoghue + +commit 26bda3da00c3edef727a6acb00ed2eb4b22f8723 upstream. + +Right now it is possible to do a vfe_get() with the internal reference +count at 1. If vfe_check_clock_rates() returns non-zero then we will +leave the reference count as-is and + +run: +- pm_runtime_put_sync() +- vfe->ops->pm_domain_off() + +skip: +- camss_disable_clocks() + +Subsequent vfe_put() calls will when the ref-count is non-zero +unconditionally run: + +- pm_runtime_put_sync() +- vfe->ops->pm_domain_off() +- camss_disable_clocks() + +vfe_get() should not attempt to roll-back on error when the ref-count is +non-zero as the upper layers will still do their own vfe_put() operations. + +vfe_put() will drop the reference count and do the necessary power +domain release, the cleanup jumps in vfe_get() should only be run when +the ref-count is zero. + +[ 50.095796] CPU: 7 PID: 3075 Comm: cam Not tainted 6.3.2+ #80 +[ 50.095798] Hardware name: LENOVO 21BXCTO1WW/21BXCTO1WW, BIOS N3HET82W (1.54 ) 05/26/2023 +[ 50.095799] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 50.095802] pc : refcount_warn_saturate+0xf4/0x148 +[ 50.095804] lr : refcount_warn_saturate+0xf4/0x148 +[ 50.095805] sp : ffff80000c7cb8b0 +[ 50.095806] x29: ffff80000c7cb8b0 x28: ffff16ecc0e3fc10 x27: 0000000000000000 +[ 50.095810] x26: 0000000000000000 x25: 0000000000020802 x24: 0000000000000000 +[ 50.095813] x23: ffff16ecc7360640 x22: 00000000ffffffff x21: 0000000000000005 +[ 50.095815] x20: ffff16ed175f4400 x19: ffffb4d9852942a8 x18: ffffffffffffffff +[ 50.095818] x17: ffffb4d9852d4a48 x16: ffffb4d983da5db8 x15: ffff80000c7cb320 +[ 50.095821] x14: 0000000000000001 x13: 2e656572662d7265 x12: 7466612d65737520 +[ 50.095823] x11: 00000000ffffefff x10: ffffb4d9850cebf0 x9 : ffffb4d9835cf954 +[ 50.095826] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000057fa8 +[ 50.095829] x5 : ffff16f813fe3d08 x4 : 0000000000000000 x3 : ffff621e8f4d2000 +[ 50.095832] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff16ed32119040 +[ 50.095835] Call trace: +[ 50.095836] refcount_warn_saturate+0xf4/0x148 +[ 50.095838] device_link_put_kref+0x84/0xc8 +[ 50.095843] device_link_del+0x38/0x58 +[ 50.095846] vfe_pm_domain_off+0x3c/0x50 [qcom_camss] +[ 50.095860] vfe_put+0x114/0x140 [qcom_camss] +[ 50.095869] csid_set_power+0x2c8/0x408 [qcom_camss] +[ 50.095878] pipeline_pm_power_one+0x164/0x170 [videodev] +[ 50.095896] pipeline_pm_power+0xc4/0x110 [videodev] +[ 50.095909] v4l2_pipeline_pm_use+0x5c/0xa0 [videodev] +[ 50.095923] v4l2_pipeline_pm_get+0x1c/0x30 [videodev] +[ 50.095937] video_open+0x7c/0x100 [qcom_camss] +[ 50.095945] v4l2_open+0x84/0x130 [videodev] +[ 50.095960] chrdev_open+0xc8/0x250 +[ 50.095964] do_dentry_open+0x1bc/0x498 +[ 50.095966] vfs_open+0x34/0x40 +[ 50.095968] path_openat+0xb44/0xf20 +[ 50.095971] do_filp_open+0xa4/0x160 +[ 50.095974] do_sys_openat2+0xc8/0x188 +[ 50.095975] __arm64_sys_openat+0x6c/0xb8 +[ 50.095977] invoke_syscall+0x50/0x128 +[ 50.095982] el0_svc_common.constprop.0+0x4c/0x100 +[ 50.095985] do_el0_svc+0x40/0xa8 +[ 50.095988] el0_svc+0x2c/0x88 +[ 50.095991] el0t_64_sync_handler+0xf4/0x120 +[ 50.095994] el0t_64_sync+0x190/0x198 +[ 50.095996] ---[ end trace 0000000000000000 ]--- + +Fixes: 779096916dae ("media: camss: vfe: Fix runtime PM imbalance on error") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/camss/camss-vfe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/qcom/camss/camss-vfe.c ++++ b/drivers/media/platform/qcom/camss/camss-vfe.c +@@ -607,7 +607,7 @@ static int vfe_get(struct vfe_device *vf + } else { + ret = vfe_check_clock_rates(vfe); + if (ret < 0) +- goto error_pm_runtime_get; ++ goto error_pm_domain; + } + vfe->power_count++; + diff --git a/queue-5.15/mm-kmem-drop-__gfp_nofail-when-allocating-objcg-vectors.patch b/queue-5.15/mm-kmem-drop-__gfp_nofail-when-allocating-objcg-vectors.patch new file mode 100644 index 00000000000..186db0ae644 --- /dev/null +++ b/queue-5.15/mm-kmem-drop-__gfp_nofail-when-allocating-objcg-vectors.patch @@ -0,0 +1,52 @@ +From 24948e3b7b12e0031a6edb4f49bbb9fb2ad1e4e9 Mon Sep 17 00:00:00 2001 +From: Roman Gushchin +Date: Tue, 7 Nov 2023 09:18:02 -0800 +Subject: mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors + +From: Roman Gushchin + +commit 24948e3b7b12e0031a6edb4f49bbb9fb2ad1e4e9 upstream. + +Objcg vectors attached to slab pages to store slab object ownership +information are allocated using gfp flags for the original slab +allocation. Depending on slab page order and the size of slab objects, +objcg vector can take several pages. + +If the original allocation was done with the __GFP_NOFAIL flag, it +triggered a warning in the page allocation code. Indeed, order > 1 pages +should not been allocated with the __GFP_NOFAIL flag. + +Fix this by simply dropping the __GFP_NOFAIL flag when allocating the +objcg vector. It effectively allows to skip the accounting of a single +slab object under a heavy memory pressure. + +An alternative would be to implement the mechanism to fallback to order-0 +allocations for accounting metadata, which is also not perfect because it +will increase performance penalty and memory footprint of the kernel +memory accounting under memory pressure. + +Link: https://lkml.kernel.org/r/ZUp8ZFGxwmCx4ZFr@P9FQF9L96D.corp.robot.car +Signed-off-by: Roman Gushchin +Reported-by: Christoph Lameter +Closes: https://lkml.kernel.org/r/6b42243e-f197-600a-5d22-56bd728a5ad8@gentwo.org +Acked-by: Shakeel Butt +Cc: Matthew Wilcox +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/memcontrol.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -2822,7 +2822,8 @@ retry: + * Moreover, it should not come from DMA buffer and is not readily + * reclaimable. So those GFP bits should be masked off. + */ +-#define OBJCGS_CLEAR_MASK (__GFP_DMA | __GFP_RECLAIMABLE | __GFP_ACCOUNT) ++#define OBJCGS_CLEAR_MASK (__GFP_DMA | __GFP_RECLAIMABLE | \ ++ __GFP_ACCOUNT | __GFP_NOFAIL) + + int memcg_alloc_page_obj_cgroups(struct page *page, struct kmem_cache *s, + gfp_t gfp, bool new_page) diff --git a/queue-5.15/mmc-sdhci-pci-gli-gl9750-mask-the-replay-timer-timeout-of-aer.patch b/queue-5.15/mmc-sdhci-pci-gli-gl9750-mask-the-replay-timer-timeout-of-aer.patch new file mode 100644 index 00000000000..ca62793f881 --- /dev/null +++ b/queue-5.15/mmc-sdhci-pci-gli-gl9750-mask-the-replay-timer-timeout-of-aer.patch @@ -0,0 +1,50 @@ +From 015c9cbcf0ad709079117d27c2094a46e0eadcdb Mon Sep 17 00:00:00 2001 +From: Victor Shih +Date: Tue, 7 Nov 2023 17:57:40 +0800 +Subject: mmc: sdhci-pci-gli: GL9750: Mask the replay timer timeout of AER + +From: Victor Shih + +commit 015c9cbcf0ad709079117d27c2094a46e0eadcdb upstream. + +Due to a flaw in the hardware design, the GL9750 replay timer frequently +times out when ASPM is enabled. As a result, the warning messages will +often appear in the system log when the system accesses the GL9750 +PCI config. Therefore, the replay timer timeout must be masked. + +Fixes: d7133797e9e1 ("mmc: sdhci-pci-gli: A workaround to allow GL9750 to enter ASPM L1.2") +Signed-off-by: Victor Shih +Acked-by: Adrian Hunter +Acked-by: Kai-Heng Feng +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20231107095741.8832-2-victorshihgli@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-pci-gli.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/mmc/host/sdhci-pci-gli.c ++++ b/drivers/mmc/host/sdhci-pci-gli.c +@@ -26,6 +26,9 @@ + #define PCI_GLI_9750_PM_CTRL 0xFC + #define PCI_GLI_9750_PM_STATE GENMASK(1, 0) + ++#define PCI_GLI_9750_CORRERR_MASK 0x214 ++#define PCI_GLI_9750_CORRERR_MASK_REPLAY_TIMER_TIMEOUT BIT(12) ++ + #define SDHCI_GLI_9750_CFG2 0x848 + #define SDHCI_GLI_9750_CFG2_L1DLY GENMASK(28, 24) + #define GLI_9750_CFG2_L1DLY_VALUE 0x1F +@@ -446,6 +449,11 @@ static void gl9750_hw_setting(struct sdh + value &= ~PCI_GLI_9750_PM_STATE; + pci_write_config_dword(pdev, PCI_GLI_9750_PM_CTRL, value); + ++ /* mask the replay timer timeout of AER */ ++ pci_read_config_dword(pdev, PCI_GLI_9750_CORRERR_MASK, &value); ++ value |= PCI_GLI_9750_CORRERR_MASK_REPLAY_TIMER_TIMEOUT; ++ pci_write_config_dword(pdev, PCI_GLI_9750_CORRERR_MASK, value); ++ + gl9750_wt_off(host); + } + diff --git a/queue-5.15/r8169-fix-network-lost-after-resume-on-dash-systems.patch b/queue-5.15/r8169-fix-network-lost-after-resume-on-dash-systems.patch new file mode 100644 index 00000000000..42da3d4a200 --- /dev/null +++ b/queue-5.15/r8169-fix-network-lost-after-resume-on-dash-systems.patch @@ -0,0 +1,43 @@ +From 868c3b95afef4883bfb66c9397482da6840b5baf Mon Sep 17 00:00:00 2001 +From: ChunHao Lin +Date: Fri, 10 Nov 2023 01:34:00 +0800 +Subject: r8169: fix network lost after resume on DASH systems + +From: ChunHao Lin + +commit 868c3b95afef4883bfb66c9397482da6840b5baf upstream. + +Device that support DASH may be reseted or powered off during suspend. +So driver needs to handle DASH during system suspend and resume. Or +DASH firmware will influence device behavior and causes network lost. + +Fixes: b646d90053f8 ("r8169: magic.") +Cc: stable@vger.kernel.org +Reviewed-by: Heiner Kallweit +Signed-off-by: ChunHao Lin +Link: https://lore.kernel.org/r/20231109173400.4573-3-hau@realtek.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/realtek/r8169_main.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4714,10 +4714,16 @@ static void rtl8169_down(struct rtl8169_ + rtl8169_cleanup(tp, true); + + rtl_prepare_power_down(tp); ++ ++ if (tp->dash_type != RTL_DASH_NONE) ++ rtl8168_driver_stop(tp); + } + + static void rtl8169_up(struct rtl8169_private *tp) + { ++ if (tp->dash_type != RTL_DASH_NONE) ++ rtl8168_driver_start(tp); ++ + pci_set_master(tp->pci_dev); + phy_init_hw(tp->phydev); + phy_resume(tp->phydev); diff --git a/queue-5.15/series b/queue-5.15/series index 436ca33509d..bf2c4019209 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -279,3 +279,10 @@ media-ccs-correctly-initialise-try-compose-rectangle.patch nfsd-fix-file-memleak-on-client_opens_release.patch riscv-kprobes-allow-writing-to-x0.patch mmc-sdhci-pci-gli-a-workaround-to-allow-gl9750-to-enter-aspm-l1.2.patch +mm-kmem-drop-__gfp_nofail-when-allocating-objcg-vectors.patch +r8169-fix-network-lost-after-resume-on-dash-systems.patch +mmc-sdhci-pci-gli-gl9750-mask-the-replay-timer-timeout-of-aer.patch +media-qcom-camss-fix-pm_domain_on-sequence-in-probe.patch +media-qcom-camss-fix-vfe_get-error-jump.patch +media-qcom-camss-fix-vfe-17x-vfe_disable_output.patch +media-qcom-camss-fix-missing-vfe_lite-clocks-check.patch