From: Sasha Levin Date: Fri, 8 Sep 2023 21:36:57 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v6.1.53~109 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=803b39e009db1247341d60f3786ad3d794178955;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/alsa-ac97-fix-possible-error-value-of-rac97.patch b/queue-5.4/alsa-ac97-fix-possible-error-value-of-rac97.patch new file mode 100644 index 00000000000..be2c42a2063 --- /dev/null +++ b/queue-5.4/alsa-ac97-fix-possible-error-value-of-rac97.patch @@ -0,0 +1,52 @@ +From 4c501ea0a111ced44e337743ec03ffb26d9f4d7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Aug 2023 10:52:13 +0800 +Subject: ALSA: ac97: Fix possible error value of *rac97 + +From: Su Hui + +[ Upstream commit 67de40c9df94037769967ba28c7d951afb45b7fb ] + +Before committing 79597c8bf64c, *rac97 always be NULL if there is +an error. When error happens, make sure *rac97 is NULL is safer. + +For examble, in snd_vortex_mixer(): + err = snd_ac97_mixer(pbus, &ac97, &vortex->codec); + vortex->isquad = ((vortex->codec == NULL) ? + 0 : (vortex->codec->ext_id&0x80)); +If error happened but vortex->codec isn't NULL, this may cause some +problems. + +Move the judgement order to be clearer and better. + +Fixes: 79597c8bf64c ("ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer") +Suggested-by: Christophe JAILLET +Acked-by: Christophe JAILLET +Signed-off-by: Su Hui +Link: https://lore.kernel.org/r/20230823025212.1000961-1-suhui@nfschina.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/ac97/ac97_codec.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c +index b920c739d6863..418a7a666cf4e 100644 +--- a/sound/pci/ac97/ac97_codec.c ++++ b/sound/pci/ac97/ac97_codec.c +@@ -2006,10 +2006,9 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template, + .dev_disconnect = snd_ac97_dev_disconnect, + }; + +- if (!rac97) +- return -EINVAL; +- if (snd_BUG_ON(!bus || !template)) ++ if (snd_BUG_ON(!bus || !template || !rac97)) + return -EINVAL; ++ *rac97 = NULL; + if (snd_BUG_ON(template->num >= 4)) + return -EINVAL; + if (bus->codec[template->num]) +-- +2.40.1 + diff --git a/queue-5.4/amba-bus-fix-refcount-leak.patch b/queue-5.4/amba-bus-fix-refcount-leak.patch new file mode 100644 index 00000000000..762d84aa1a8 --- /dev/null +++ b/queue-5.4/amba-bus-fix-refcount-leak.patch @@ -0,0 +1,39 @@ +From e4e0553df7eb5707f4b66896a610c5170dbcc0cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Aug 2023 10:39:27 +0800 +Subject: amba: bus: fix refcount leak + +From: Peng Fan + +[ Upstream commit e312cbdc11305568554a9e18a2ea5c2492c183f3 ] + +commit 5de1540b7bc4 ("drivers/amba: create devices from device tree") +increases the refcount of of_node, but not releases it in +amba_device_release, so there is refcount leak. By using of_node_put +to avoid refcount leak. + +Fixes: 5de1540b7bc4 ("drivers/amba: create devices from device tree") +Signed-off-by: Peng Fan +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230821023928.3324283-1-peng.fan@oss.nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/amba/bus.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c +index 702284bcd467c..252b0b43d50ee 100644 +--- a/drivers/amba/bus.c ++++ b/drivers/amba/bus.c +@@ -364,6 +364,7 @@ static void amba_device_release(struct device *dev) + { + struct amba_device *d = to_amba_device(dev); + ++ of_node_put(d->dev.of_node); + if (d->res.parent) + release_resource(&d->res); + kfree(d); +-- +2.40.1 + diff --git a/queue-5.4/arm-dts-bcm53573-add-cells-sizes-to-pcie-node.patch b/queue-5.4/arm-dts-bcm53573-add-cells-sizes-to-pcie-node.patch new file mode 100644 index 00000000000..6725bf0f7c7 --- /dev/null +++ b/queue-5.4/arm-dts-bcm53573-add-cells-sizes-to-pcie-node.patch @@ -0,0 +1,47 @@ +From 1a5c28afa234e446f98b3cb77d1c7b52df79cde2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 13:40:03 +0200 +Subject: ARM: dts: BCM53573: Add cells sizes to PCIe node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 3392ef368d9b04622fe758b1079b512664b6110a ] + +This fixes: +arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: pcie@2000: '#address-cells' is a required property + From schema: /lib/python3.10/site-packages/dtschema/schemas/pci/pci-bus.yaml +arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: pcie@2000: '#size-cells' is a required property + From schema: /lib/python3.10/site-packages/dtschema/schemas/pci/pci-bus.yaml + +Two properties that need to be added later are "device_type" and +"ranges". Adding "device_type" on its own causes a new warning and the +value of "ranges" needs to be determined yet. + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20230707114004.2740-3-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm53573.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi +index 4af8e3293cff4..34bd72b5c9cda 100644 +--- a/arch/arm/boot/dts/bcm53573.dtsi ++++ b/arch/arm/boot/dts/bcm53573.dtsi +@@ -127,6 +127,9 @@ uart0: serial@300 { + + pcie0: pcie@2000 { + reg = <0x00002000 0x1000>; ++ ++ #address-cells = <3>; ++ #size-cells = <2>; + }; + + usb2: usb2@4000 { +-- +2.40.1 + diff --git a/queue-5.4/arm-dts-bcm53573-drop-nonexistent-default-off-led-tr.patch b/queue-5.4/arm-dts-bcm53573-drop-nonexistent-default-off-led-tr.patch new file mode 100644 index 00000000000..399890ef142 --- /dev/null +++ b/queue-5.4/arm-dts-bcm53573-drop-nonexistent-default-off-led-tr.patch @@ -0,0 +1,68 @@ +From 9a2acd872b9c850154833a920b85954f932f0d0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 13:40:01 +0200 +Subject: ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit be7e1e5b0f67c58ec4be0a54db23b6a4fa6e2116 ] + +There is no such trigger documented or implemented in Linux. It was a +copy & paste mistake. + +This fixes: +arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: leds: led-wlan:linux,default-trigger: 'oneOf' conditional failed, one must be fixed: + 'default-off' is not one of ['backlight', 'default-on', 'heartbeat', 'disk-activity', 'disk-read', 'disk-write', 'timer', 'pattern', 'audio-micmute', 'audio-mute', 'bluetooth-power', 'flash', 'kbd-capslock', 'mtd', 'nand-disk', 'none', 'torch', 'usb-gadget', 'usb-host', 'usbport'] + 'default-off' does not match '^cpu[0-9]*$' + 'default-off' does not match '^hci[0-9]+-power$' + 'default-off' does not match '^mmc[0-9]+$' + 'default-off' does not match '^phy[0-9]+tx$' + From schema: Documentation/devicetree/bindings/leds/leds-gpio.yaml + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20230707114004.2740-1-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts | 1 - + arch/arm/boot/dts/bcm47189-luxul-xap-810.dts | 2 -- + 2 files changed, 3 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts +index 57ca1cfaecd8e..02957850c88a8 100644 +--- a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts ++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts +@@ -26,7 +26,6 @@ leds { + wlan { + label = "bcm53xx:blue:wlan"; + gpios = <&chipcommon 10 GPIO_ACTIVE_LOW>; +- linux,default-trigger = "default-off"; + }; + + system { +diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts +index 2e1a7e382cb7a..d68e9dbebf26b 100644 +--- a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts ++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts +@@ -26,7 +26,6 @@ leds { + 5ghz { + label = "bcm53xx:blue:5ghz"; + gpios = <&chipcommon 11 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "default-off"; + }; + + system { +@@ -42,7 +41,6 @@ pcie0_leds { + 2ghz { + label = "bcm53xx:blue:2ghz"; + gpios = <&pcie0_chipcommon 3 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "default-off"; + }; + }; + +-- +2.40.1 + diff --git a/queue-5.4/arm-dts-bcm53573-fix-ethernet-info-for-luxul-devices.patch b/queue-5.4/arm-dts-bcm53573-fix-ethernet-info-for-luxul-devices.patch new file mode 100644 index 00000000000..abff230b9d7 --- /dev/null +++ b/queue-5.4/arm-dts-bcm53573-fix-ethernet-info-for-luxul-devices.patch @@ -0,0 +1,87 @@ +From 1724a8c0644482e5fd7be90259004ac87ca9a503 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 13:11:45 +0200 +Subject: ARM: dts: BCM53573: Fix Ethernet info for Luxul devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 44ad8207806973f4e4f7d870fff36cc01f494250 ] + +Both Luxul's XAP devices (XAP-810 and XAP-1440) are access points that +use a non-default design. They don't include switch but have a single +Ethernet port and BCM54210E PHY connected to the Ethernet controller's +MDIO bus. + +Support for those devices regressed due to two changes: + +1. Describing MDIO bus with switch +After commit 9fb90ae6cae7 ("ARM: dts: BCM53573: Describe on-SoC BCM53125 +rev 4 switch") Linux stopped probing for MDIO devices. + +2. Dropping hardcoded BCM54210E delays +In commit fea7fda7f50a ("net: phy: broadcom: Fix RGMII delays +configuration for BCM54210E") support for other PHY modes was added but +that requires a proper "phy-mode" value in DT. + +Both above changes are correct (they don't need to be reverted or +anything) but they need this fix for DT data to be correct and for Linux +to work properly. + +Fixes: 9fb90ae6cae7 ("ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch") +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20230713111145.14864-1-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts | 13 +++++++++++++ + arch/arm/boot/dts/bcm47189-luxul-xap-810.dts | 13 +++++++++++++ + 2 files changed, 26 insertions(+) + +diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts +index 02957850c88a8..5901160919dcd 100644 +--- a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts ++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts +@@ -45,3 +45,16 @@ restart { + }; + }; + }; ++ ++&gmac0 { ++ phy-mode = "rgmii"; ++ phy-handle = <&bcm54210e>; ++ ++ mdio { ++ /delete-node/ switch@1e; ++ ++ bcm54210e: ethernet-phy@0 { ++ reg = <0>; ++ }; ++ }; ++}; +diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts +index d68e9dbebf26b..8e7483272d47d 100644 +--- a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts ++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts +@@ -81,3 +81,16 @@ pcie0_chipcommon: chipcommon@0 { + }; + }; + }; ++ ++&gmac0 { ++ phy-mode = "rgmii"; ++ phy-handle = <&bcm54210e>; ++ ++ mdio { ++ /delete-node/ switch@1e; ++ ++ bcm54210e: ethernet-phy@0 { ++ reg = <0>; ++ }; ++ }; ++}; +-- +2.40.1 + diff --git a/queue-5.4/arm-dts-bcm53573-use-updated-spi-gpio-binding-proper.patch b/queue-5.4/arm-dts-bcm53573-use-updated-spi-gpio-binding-proper.patch new file mode 100644 index 00000000000..a8143dce4a7 --- /dev/null +++ b/queue-5.4/arm-dts-bcm53573-use-updated-spi-gpio-binding-proper.patch @@ -0,0 +1,54 @@ +From 7c097ab38ddaa04ce7d4306a783baaadf9e03470 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 13:40:04 +0200 +Subject: ARM: dts: BCM53573: Use updated "spi-gpio" binding properties +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 2c0fd6b3d0778ceab40205315ccef74568490f17 ] + +Switch away from deprecated properties. + +This fixes: +arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-sck: False schema does not allow [[3, 21, 0]] + From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml +arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-miso: False schema does not allow [[3, 22, 0]] + From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml +arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-mosi: False schema does not allow [[3, 23, 0]] + From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml +arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: 'sck-gpios' is a required property + From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml +arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: Unevaluated properties are not allowed ('gpio-miso', 'gpio-mosi', 'gpio-sck' were unexpected) + From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20230707114004.2740-4-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm947189acdbmr.dts | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm947189acdbmr.dts b/arch/arm/boot/dts/bcm947189acdbmr.dts +index b0b8c774a37f9..1f0be30e54435 100644 +--- a/arch/arm/boot/dts/bcm947189acdbmr.dts ++++ b/arch/arm/boot/dts/bcm947189acdbmr.dts +@@ -60,9 +60,9 @@ wps { + spi { + compatible = "spi-gpio"; + num-chipselects = <1>; +- gpio-sck = <&chipcommon 21 0>; +- gpio-miso = <&chipcommon 22 0>; +- gpio-mosi = <&chipcommon 23 0>; ++ sck-gpios = <&chipcommon 21 0>; ++ miso-gpios = <&chipcommon 22 0>; ++ mosi-gpios = <&chipcommon 23 0>; + cs-gpios = <&chipcommon 24 0>; + #address-cells = <1>; + #size-cells = <0>; +-- +2.40.1 + diff --git a/queue-5.4/arm-dts-s3c6410-align-node-srom-bus-node-name-with-d.patch b/queue-5.4/arm-dts-s3c6410-align-node-srom-bus-node-name-with-d.patch new file mode 100644 index 00000000000..03f21db9b76 --- /dev/null +++ b/queue-5.4/arm-dts-s3c6410-align-node-srom-bus-node-name-with-d.patch @@ -0,0 +1,40 @@ +From aa69502fcb05006722a1507ef75d275fe26e00f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 20:33:06 +0200 +Subject: ARM: dts: s3c6410: align node SROM bus node name with dtschema in + Mini6410 + +From: Krzysztof Kozlowski + +[ Upstream commit 5911622eff5134c4bf1e16e4e1e2fd18c4f24889 ] + +The SROM controller is modeled with a bus so align the device node name +with dtschema to fix warning: + + srom-cs1@18000000: $nodename:0: 'srom-cs1@18000000' + does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$' + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20200907183313.29234-5-krzk@kernel.org +Stable-dep-of: cf0cb2af6a18 ("ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s3c6410-mini6410.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts +index 75067dbcf7e83..285555b9ed943 100644 +--- a/arch/arm/boot/dts/s3c6410-mini6410.dts ++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts +@@ -42,7 +42,7 @@ xusbxti: oscillator-1 { + #clock-cells = <0>; + }; + +- srom-cs1@18000000 { ++ srom-cs1-bus@18000000 { + compatible = "simple-bus"; + #address-cells = <1>; + #size-cells = <1>; +-- +2.40.1 + diff --git a/queue-5.4/arm-dts-s3c6410-move-fixed-clocks-under-root-node-in.patch b/queue-5.4/arm-dts-s3c6410-move-fixed-clocks-under-root-node-in.patch new file mode 100644 index 00000000000..0e650a03e27 --- /dev/null +++ b/queue-5.4/arm-dts-s3c6410-move-fixed-clocks-under-root-node-in.patch @@ -0,0 +1,72 @@ +From 70e1f99077c42f4f2fed2cd56730d2464ee4fadb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 20:33:04 +0200 +Subject: ARM: dts: s3c6410: move fixed clocks under root node in Mini6410 + +From: Krzysztof Kozlowski + +[ Upstream commit 8b81a8decea77bf2ca3c718732184d4aaf949096 ] + +The fixed clocks are kept under dedicated 'clocks' node but this causes +multiple dtschema warnings: + + clocks: $nodename:0: 'clocks' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$' + clocks: #size-cells:0:0: 0 is not one of [1, 2] + clocks: oscillator@0:reg:0: [0] is too short + clocks: oscillator@1:reg:0: [1] is too short + clocks: 'ranges' is a required property + oscillator@0: 'reg' does not match any of the regexes: 'pinctrl-[0-9]+' + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20200907183313.29234-3-krzk@kernel.org +Stable-dep-of: cf0cb2af6a18 ("ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s3c6410-mini6410.dts | 30 ++++++++++---------------- + 1 file changed, 11 insertions(+), 19 deletions(-) + +diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts +index 1aeac33b0d341..75067dbcf7e83 100644 +--- a/arch/arm/boot/dts/s3c6410-mini6410.dts ++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts +@@ -28,26 +28,18 @@ chosen { + bootargs = "console=ttySAC0,115200n8 earlyprintk rootwait root=/dev/mmcblk0p1"; + }; + +- clocks { +- compatible = "simple-bus"; +- #address-cells = <1>; +- #size-cells = <0>; +- +- fin_pll: oscillator@0 { +- compatible = "fixed-clock"; +- reg = <0>; +- clock-frequency = <12000000>; +- clock-output-names = "fin_pll"; +- #clock-cells = <0>; +- }; ++ fin_pll: oscillator-0 { ++ compatible = "fixed-clock"; ++ clock-frequency = <12000000>; ++ clock-output-names = "fin_pll"; ++ #clock-cells = <0>; ++ }; + +- xusbxti: oscillator@1 { +- compatible = "fixed-clock"; +- reg = <1>; +- clock-output-names = "xusbxti"; +- clock-frequency = <48000000>; +- #clock-cells = <0>; +- }; ++ xusbxti: oscillator-1 { ++ compatible = "fixed-clock"; ++ clock-output-names = "xusbxti"; ++ clock-frequency = <48000000>; ++ #clock-cells = <0>; + }; + + srom-cs1@18000000 { +-- +2.40.1 + diff --git a/queue-5.4/arm-dts-s3c64xx-align-pinctrl-with-dtschema.patch b/queue-5.4/arm-dts-s3c64xx-align-pinctrl-with-dtschema.patch new file mode 100644 index 00000000000..08207fda85c --- /dev/null +++ b/queue-5.4/arm-dts-s3c64xx-align-pinctrl-with-dtschema.patch @@ -0,0 +1,808 @@ +From 4442759427f41db3d120cd4979cdc4f9b197c988 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jan 2022 21:17:16 +0100 +Subject: ARM: dts: s3c64xx: align pinctrl with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit 9e47ccc01284aba7fe5fbf6ee2a7abc29bf2a740 ] + +Align the pin controller related nodes with dtschema. No functional +change expected. + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220111201722.327219-16-krzysztof.kozlowski@canonical.com +Stable-dep-of: cf0cb2af6a18 ("ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s3c6410-mini6410.dts | 4 +- + arch/arm/boot/dts/s3c64xx-pinctrl.dtsi | 210 ++++++++++++------------- + 2 files changed, 107 insertions(+), 107 deletions(-) + +diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts +index 285555b9ed943..17097da36f5ed 100644 +--- a/arch/arm/boot/dts/s3c6410-mini6410.dts ++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts +@@ -193,12 +193,12 @@ &uart3 { + }; + + &pinctrl0 { +- gpio_leds: gpio-leds { ++ gpio_leds: gpio-leds-pins { + samsung,pins = "gpk-4", "gpk-5", "gpk-6", "gpk-7"; + samsung,pin-pud = ; + }; + +- gpio_keys: gpio-keys { ++ gpio_keys: gpio-keys-pins { + samsung,pins = "gpn-0", "gpn-1", "gpn-2", "gpn-3", + "gpn-4", "gpn-5", "gpl-11", "gpl-12"; + samsung,pin-pud = ; +diff --git a/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi b/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi +index 8e9594d64b579..0a3186d57cb56 100644 +--- a/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi ++++ b/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi +@@ -16,111 +16,111 @@ &pinctrl0 { + * Pin banks + */ + +- gpa: gpa { ++ gpa: gpa-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpb: gpb { ++ gpb: gpb-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpc: gpc { ++ gpc: gpc-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpd: gpd { ++ gpd: gpd-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpe: gpe { ++ gpe: gpe-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + }; + +- gpf: gpf { ++ gpf: gpf-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpg: gpg { ++ gpg: gpg-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gph: gph { ++ gph: gph-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpi: gpi { ++ gpi: gpi-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + }; + +- gpj: gpj { ++ gpj: gpj-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + }; + +- gpk: gpk { ++ gpk: gpk-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + }; + +- gpl: gpl { ++ gpl: gpl-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpm: gpm { ++ gpm: gpm-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpn: gpn { ++ gpn: gpn-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpo: gpo { ++ gpo: gpo-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpp: gpp { ++ gpp: gpp-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; + }; + +- gpq: gpq { ++ gpq: gpq-gpio-bank { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; +@@ -131,225 +131,225 @@ gpq: gpq { + * Pin groups + */ + +- uart0_data: uart0-data { ++ uart0_data: uart0-data-pins { + samsung,pins = "gpa-0", "gpa-1"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- uart0_fctl: uart0-fctl { ++ uart0_fctl: uart0-fctl-pins { + samsung,pins = "gpa-2", "gpa-3"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- uart1_data: uart1-data { ++ uart1_data: uart1-data-pins { + samsung,pins = "gpa-4", "gpa-5"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- uart1_fctl: uart1-fctl { ++ uart1_fctl: uart1-fctl-pins { + samsung,pins = "gpa-6", "gpa-7"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- uart2_data: uart2-data { ++ uart2_data: uart2-data-pins { + samsung,pins = "gpb-0", "gpb-1"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- uart3_data: uart3-data { ++ uart3_data: uart3-data-pins { + samsung,pins = "gpb-2", "gpb-3"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- ext_dma_0: ext-dma-0 { ++ ext_dma_0: ext-dma-0-pins { + samsung,pins = "gpb-0", "gpb-1"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- ext_dma_1: ext-dma-1 { ++ ext_dma_1: ext-dma-1-pins { + samsung,pins = "gpb-2", "gpb-3"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- irda_data_0: irda-data-0 { ++ irda_data_0: irda-data-0-pins { + samsung,pins = "gpb-0", "gpb-1"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- irda_data_1: irda-data-1 { ++ irda_data_1: irda-data-1-pins { + samsung,pins = "gpb-2", "gpb-3"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- irda_sdbw: irda-sdbw { ++ irda_sdbw: irda-sdbw-pins { + samsung,pins = "gpb-4"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- i2c0_bus: i2c0-bus { ++ i2c0_bus: i2c0-bus-pins { + samsung,pins = "gpb-5", "gpb-6"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- i2c1_bus: i2c1-bus { ++ i2c1_bus: i2c1-bus-pins { + /* S3C6410-only */ + samsung,pins = "gpb-2", "gpb-3"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- spi0_bus: spi0-bus { ++ spi0_bus: spi0-bus-pins { + samsung,pins = "gpc-0", "gpc-1", "gpc-2"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- spi0_cs: spi0-cs { ++ spi0_cs: spi0-cs-pins { + samsung,pins = "gpc-3"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- spi1_bus: spi1-bus { ++ spi1_bus: spi1-bus-pins { + samsung,pins = "gpc-4", "gpc-5", "gpc-6"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- spi1_cs: spi1-cs { ++ spi1_cs: spi1-cs-pins { + samsung,pins = "gpc-7"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd0_cmd: sd0-cmd { ++ sd0_cmd: sd0-cmd-pins { + samsung,pins = "gpg-1"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd0_clk: sd0-clk { ++ sd0_clk: sd0-clk-pins { + samsung,pins = "gpg-0"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd0_bus1: sd0-bus1 { ++ sd0_bus1: sd0-bus1-pins { + samsung,pins = "gpg-2"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd0_bus4: sd0-bus4 { ++ sd0_bus4: sd0-bus4-pins { + samsung,pins = "gpg-2", "gpg-3", "gpg-4", "gpg-5"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd0_cd: sd0-cd { ++ sd0_cd: sd0-cd-pins { + samsung,pins = "gpg-6"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd1_cmd: sd1-cmd { ++ sd1_cmd: sd1-cmd-pins { + samsung,pins = "gph-1"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd1_clk: sd1-clk { ++ sd1_clk: sd1-clk-pins { + samsung,pins = "gph-0"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd1_bus1: sd1-bus1 { ++ sd1_bus1: sd1-bus1-pins { + samsung,pins = "gph-2"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd1_bus4: sd1-bus4 { ++ sd1_bus4: sd1-bus4-pins { + samsung,pins = "gph-2", "gph-3", "gph-4", "gph-5"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd1_bus8: sd1-bus8 { ++ sd1_bus8: sd1-bus8-pins { + samsung,pins = "gph-2", "gph-3", "gph-4", "gph-5", + "gph-6", "gph-7", "gph-8", "gph-9"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd1_cd: sd1-cd { ++ sd1_cd: sd1-cd-pins { + samsung,pins = "gpg-6"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd2_cmd: sd2-cmd { ++ sd2_cmd: sd2-cmd-pins { + samsung,pins = "gpc-4"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd2_clk: sd2-clk { ++ sd2_clk: sd2-clk-pins { + samsung,pins = "gpc-5"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd2_bus1: sd2-bus1 { ++ sd2_bus1: sd2-bus1-pins { + samsung,pins = "gph-6"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- sd2_bus4: sd2-bus4 { ++ sd2_bus4: sd2-bus4-pins { + samsung,pins = "gph-6", "gph-7", "gph-8", "gph-9"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- i2s0_bus: i2s0-bus { ++ i2s0_bus: i2s0-bus-pins { + samsung,pins = "gpd-0", "gpd-2", "gpd-3", "gpd-4"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- i2s0_cdclk: i2s0-cdclk { ++ i2s0_cdclk: i2s0-cdclk-pins { + samsung,pins = "gpd-1"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- i2s1_bus: i2s1-bus { ++ i2s1_bus: i2s1-bus-pins { + samsung,pins = "gpe-0", "gpe-2", "gpe-3", "gpe-4"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- i2s1_cdclk: i2s1-cdclk { ++ i2s1_cdclk: i2s1-cdclk-pins { + samsung,pins = "gpe-1"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- i2s2_bus: i2s2-bus { ++ i2s2_bus: i2s2-bus-pins { + /* S3C6410-only */ + samsung,pins = "gpc-4", "gpc-5", "gpc-6", "gph-6", + "gph-8", "gph-9"; +@@ -357,50 +357,50 @@ i2s2_bus: i2s2-bus { + samsung,pin-pud = ; + }; + +- i2s2_cdclk: i2s2-cdclk { ++ i2s2_cdclk: i2s2-cdclk-pins { + /* S3C6410-only */ + samsung,pins = "gph-7"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- pcm0_bus: pcm0-bus { ++ pcm0_bus: pcm0-bus-pins { + samsung,pins = "gpd-0", "gpd-2", "gpd-3", "gpd-4"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- pcm0_extclk: pcm0-extclk { ++ pcm0_extclk: pcm0-extclk-pins { + samsung,pins = "gpd-1"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- pcm1_bus: pcm1-bus { ++ pcm1_bus: pcm1-bus-pins { + samsung,pins = "gpe-0", "gpe-2", "gpe-3", "gpe-4"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- pcm1_extclk: pcm1-extclk { ++ pcm1_extclk: pcm1-extclk-pins { + samsung,pins = "gpe-1"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- ac97_bus_0: ac97-bus-0 { ++ ac97_bus_0: ac97-bus-0-pins { + samsung,pins = "gpd-0", "gpd-1", "gpd-2", "gpd-3", "gpd-4"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- ac97_bus_1: ac97-bus-1 { ++ ac97_bus_1: ac97-bus-1-pins { + samsung,pins = "gpe-0", "gpe-1", "gpe-2", "gpe-3", "gpe-4"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- cam_port: cam-port { ++ cam_port: cam-port-pins { + samsung,pins = "gpf-0", "gpf-1", "gpf-2", "gpf-4", + "gpf-5", "gpf-6", "gpf-7", "gpf-8", + "gpf-9", "gpf-10", "gpf-11", "gpf-12"; +@@ -408,242 +408,242 @@ cam_port: cam-port { + samsung,pin-pud = ; + }; + +- cam_rst: cam-rst { ++ cam_rst: cam-rst-pins { + samsung,pins = "gpf-3"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- cam_field: cam-field { ++ cam_field: cam-field-pins { + /* S3C6410-only */ + samsung,pins = "gpb-4"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- pwm_extclk: pwm-extclk { ++ pwm_extclk: pwm-extclk-pins { + samsung,pins = "gpf-13"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- pwm0_out: pwm0-out { ++ pwm0_out: pwm0-out-pins { + samsung,pins = "gpf-14"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- pwm1_out: pwm1-out { ++ pwm1_out: pwm1-out-pins { + samsung,pins = "gpf-15"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- clkout0: clkout-0 { ++ clkout0: clkout-0-pins { + samsung,pins = "gpf-14"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col0_0: keypad-col0-0 { ++ keypad_col0_0: keypad-col0-0-pins { + samsung,pins = "gph-0"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col1_0: keypad-col1-0 { ++ keypad_col1_0: keypad-col1-0-pins { + samsung,pins = "gph-1"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col2_0: keypad-col2-0 { ++ keypad_col2_0: keypad-col2-0-pins { + samsung,pins = "gph-2"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col3_0: keypad-col3-0 { ++ keypad_col3_0: keypad-col3-0-pins { + samsung,pins = "gph-3"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col4_0: keypad-col4-0 { ++ keypad_col4_0: keypad-col4-0-pins { + samsung,pins = "gph-4"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col5_0: keypad-col5-0 { ++ keypad_col5_0: keypad-col5-0-pins { + samsung,pins = "gph-5"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col6_0: keypad-col6-0 { ++ keypad_col6_0: keypad-col6-0-pins { + samsung,pins = "gph-6"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col7_0: keypad-col7-0 { ++ keypad_col7_0: keypad-col7-0-pins { + samsung,pins = "gph-7"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col0_1: keypad-col0-1 { ++ keypad_col0_1: keypad-col0-1-pins { + samsung,pins = "gpl-0"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col1_1: keypad-col1-1 { ++ keypad_col1_1: keypad-col1-1-pins { + samsung,pins = "gpl-1"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col2_1: keypad-col2-1 { ++ keypad_col2_1: keypad-col2-1-pins { + samsung,pins = "gpl-2"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col3_1: keypad-col3-1 { ++ keypad_col3_1: keypad-col3-1-pins { + samsung,pins = "gpl-3"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col4_1: keypad-col4-1 { ++ keypad_col4_1: keypad-col4-1-pins { + samsung,pins = "gpl-4"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col5_1: keypad-col5-1 { ++ keypad_col5_1: keypad-col5-1-pins { + samsung,pins = "gpl-5"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col6_1: keypad-col6-1 { ++ keypad_col6_1: keypad-col6-1-pins { + samsung,pins = "gpl-6"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_col7_1: keypad-col7-1 { ++ keypad_col7_1: keypad-col7-1-pins { + samsung,pins = "gpl-7"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row0_0: keypad-row0-0 { ++ keypad_row0_0: keypad-row0-0-pins { + samsung,pins = "gpk-8"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row1_0: keypad-row1-0 { ++ keypad_row1_0: keypad-row1-0-pins { + samsung,pins = "gpk-9"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row2_0: keypad-row2-0 { ++ keypad_row2_0: keypad-row2-0-pins { + samsung,pins = "gpk-10"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row3_0: keypad-row3-0 { ++ keypad_row3_0: keypad-row3-0-pins { + samsung,pins = "gpk-11"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row4_0: keypad-row4-0 { ++ keypad_row4_0: keypad-row4-0-pins { + samsung,pins = "gpk-12"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row5_0: keypad-row5-0 { ++ keypad_row5_0: keypad-row5-0-pins { + samsung,pins = "gpk-13"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row6_0: keypad-row6-0 { ++ keypad_row6_0: keypad-row6-0-pins { + samsung,pins = "gpk-14"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row7_0: keypad-row7-0 { ++ keypad_row7_0: keypad-row7-0-pins { + samsung,pins = "gpk-15"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row0_1: keypad-row0-1 { ++ keypad_row0_1: keypad-row0-1-pins { + samsung,pins = "gpn-0"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row1_1: keypad-row1-1 { ++ keypad_row1_1: keypad-row1-1-pins { + samsung,pins = "gpn-1"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row2_1: keypad-row2-1 { ++ keypad_row2_1: keypad-row2-1-pins { + samsung,pins = "gpn-2"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row3_1: keypad-row3-1 { ++ keypad_row3_1: keypad-row3-1-pins { + samsung,pins = "gpn-3"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row4_1: keypad-row4-1 { ++ keypad_row4_1: keypad-row4-1-pins { + samsung,pins = "gpn-4"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row5_1: keypad-row5-1 { ++ keypad_row5_1: keypad-row5-1-pins { + samsung,pins = "gpn-5"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row6_1: keypad-row6-1 { ++ keypad_row6_1: keypad-row6-1-pins { + samsung,pins = "gpn-6"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- keypad_row7_1: keypad-row7-1 { ++ keypad_row7_1: keypad-row7-1-pins { + samsung,pins = "gpn-7"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- lcd_ctrl: lcd-ctrl { ++ lcd_ctrl: lcd-ctrl-pins { + samsung,pins = "gpj-8", "gpj-9", "gpj-10", "gpj-11"; + samsung,pin-function = ; + samsung,pin-pud = ; + }; + +- lcd_data16: lcd-data-width16 { ++ lcd_data16: lcd-data-width16-pins { + samsung,pins = "gpi-3", "gpi-4", "gpi-5", "gpi-6", + "gpi-7", "gpi-10", "gpi-11", "gpi-12", + "gpi-13", "gpi-14", "gpi-15", "gpj-3", +@@ -652,7 +652,7 @@ lcd_data16: lcd-data-width16 { + samsung,pin-pud = ; + }; + +- lcd_data18: lcd-data-width18 { ++ lcd_data18: lcd-data-width18-pins { + samsung,pins = "gpi-2", "gpi-3", "gpi-4", "gpi-5", + "gpi-6", "gpi-7", "gpi-10", "gpi-11", + "gpi-12", "gpi-13", "gpi-14", "gpi-15", +@@ -662,7 +662,7 @@ lcd_data18: lcd-data-width18 { + samsung,pin-pud = ; + }; + +- lcd_data24: lcd-data-width24 { ++ lcd_data24: lcd-data-width24-pins { + samsung,pins = "gpi-0", "gpi-1", "gpi-2", "gpi-3", + "gpi-4", "gpi-5", "gpi-6", "gpi-7", + "gpi-8", "gpi-9", "gpi-10", "gpi-11", +@@ -673,7 +673,7 @@ lcd_data24: lcd-data-width24 { + samsung,pin-pud = ; + }; + +- hsi_bus: hsi-bus { ++ hsi_bus: hsi-bus-pins { + samsung,pins = "gpk-0", "gpk-1", "gpk-2", "gpk-3", + "gpk-4", "gpk-5", "gpk-6", "gpk-7"; + samsung,pin-function = ; +-- +2.40.1 + diff --git a/queue-5.4/arm-dts-s5pv210-add-dummy-5v-regulator-for-backlight.patch b/queue-5.4/arm-dts-s5pv210-add-dummy-5v-regulator-for-backlight.patch new file mode 100644 index 00000000000..00c671f09e6 --- /dev/null +++ b/queue-5.4/arm-dts-s5pv210-add-dummy-5v-regulator-for-backlight.patch @@ -0,0 +1,44 @@ +From 8b254e1418b6429d6a56f5b708ac4e302f2fe490 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 11:57:21 +0200 +Subject: ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210 + +From: Krzysztof Kozlowski + +[ Upstream commit b77904ba177a9c67b6dbc3637fdf1faa22df6e5c ] + +Backlight is supplied by DC5V regulator. The DTS has no PMIC node, so +just add a regulator-fixed to solve it and fix dtbs_check warning: + + s5pv210-smdkv210.dtb: backlight: 'power-supply' is a required property + +Link: https://lore.kernel.org/r/20230421095721.31857-4-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s5pv210-smdkv210.dts | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts +index 7459e41e8ef13..ec5e18c59d3cf 100644 +--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts ++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts +@@ -55,6 +55,14 @@ backlight { + default-brightness-level = <6>; + pinctrl-names = "default"; + pinctrl-0 = <&pwm3_out>; ++ power-supply = <&dc5v_reg>; ++ }; ++ ++ dc5v_reg: regulator-0 { ++ compatible = "regulator-fixed"; ++ regulator-name = "DC5V"; ++ regulator-min-microvolt = <5000000>; ++ regulator-max-microvolt = <5000000>; + }; + }; + +-- +2.40.1 + diff --git a/queue-5.4/arm-dts-s5pv210-add-rtc-32-khz-clock-in-smdkv210.patch b/queue-5.4/arm-dts-s5pv210-add-rtc-32-khz-clock-in-smdkv210.patch new file mode 100644 index 00000000000..fb4b2e2fbd5 --- /dev/null +++ b/queue-5.4/arm-dts-s5pv210-add-rtc-32-khz-clock-in-smdkv210.patch @@ -0,0 +1,56 @@ +From 4df411c846207ba2cb8af233ed24bcd38aa23fb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 18:11:30 +0200 +Subject: ARM: dts: s5pv210: add RTC 32 KHz clock in SMDKV210 + +From: Krzysztof Kozlowski + +[ Upstream commit 7260b363457a22b8723d5cbc43fee67397896d07 ] + +The S3C RTC requires 32768 Hz clock as input which is provided by PMIC. +However the PMIC is not described in DTS at all so at least add +a workaround to model its clock with a fixed-clock. + +This fixes dtbs_check warnings: + + rtc@e2800000: clocks: [[2, 145]] is too short + rtc@e2800000: clock-names: ['rtc'] is too short + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20200907161141.31034-15-krzk@kernel.org +Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s5pv210-smdkv210.dts | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts +index 84b38f1851991..1f20622da7194 100644 +--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts ++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts +@@ -31,6 +31,13 @@ memory@20000000 { + reg = <0x20000000 0x40000000>; + }; + ++ pmic_ap_clk: clock-0 { ++ /* Workaround for missing PMIC and its clock */ ++ compatible = "fixed-clock"; ++ #clock-cells = <0>; ++ clock-frequency = <32768>; ++ }; ++ + ethernet@18000000 { + compatible = "davicom,dm9000"; + reg = <0xA8000000 0x2 0xA8000002 0x2>; +@@ -147,6 +154,8 @@ &uart3 { + + &rtc { + status = "okay"; ++ clocks = <&clocks CLK_RTC>, <&pmic_ap_clk>; ++ clock-names = "rtc", "rtc_src"; + }; + + &sdhci0 { +-- +2.40.1 + diff --git a/queue-5.4/arm-dts-s5pv210-correct-ethernet-unit-address-in-smd.patch b/queue-5.4/arm-dts-s5pv210-correct-ethernet-unit-address-in-smd.patch new file mode 100644 index 00000000000..611586a5ae0 --- /dev/null +++ b/queue-5.4/arm-dts-s5pv210-correct-ethernet-unit-address-in-smd.patch @@ -0,0 +1,36 @@ +From 5e90226499d17f40a08a5f1926520533e72411b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 20:33:03 +0200 +Subject: ARM: dts: s5pv210: correct ethernet unit address in SMDKV210 + +From: Krzysztof Kozlowski + +[ Upstream commit 28ab4caccd17d7b84fd8aa36b13af5e735870bad ] + +The SROM bank 5 is at address 0xa8000000, just like the one put in "reg" +property of ethernet node. Fix the unit address of ethernet node. + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20200907183313.29234-2-krzk@kernel.org +Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s5pv210-smdkv210.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts +index 1e1570d66d890..7459e41e8ef13 100644 +--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts ++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts +@@ -39,7 +39,7 @@ pmic_ap_clk: clock-0 { + clock-frequency = <32768>; + }; + +- ethernet@18000000 { ++ ethernet@a8000000 { + compatible = "davicom,dm9000"; + reg = <0xA8000000 0x2 0xA8000002 0x2>; + interrupt-parent = <&gph1>; +-- +2.40.1 + diff --git a/queue-5.4/arm-dts-s5pv210-use-defines-for-irq-flags-in-smdkv21.patch b/queue-5.4/arm-dts-s5pv210-use-defines-for-irq-flags-in-smdkv21.patch new file mode 100644 index 00000000000..75bac0e7854 --- /dev/null +++ b/queue-5.4/arm-dts-s5pv210-use-defines-for-irq-flags-in-smdkv21.patch @@ -0,0 +1,44 @@ +From 211e0ad14294b8ba47a82ffaeb6f0fa9067ea70a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 18:11:34 +0200 +Subject: ARM: dts: s5pv210: use defines for IRQ flags in SMDKV210 + +From: Krzysztof Kozlowski + +[ Upstream commit c272f1cc9492d61dac362d2064ec41ca97fcb1e2 ] + +Replace hard-coded flags with defines for readability. No functional +change. + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20200907161141.31034-19-krzk@kernel.org +Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s5pv210-smdkv210.dts | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts +index 1f20622da7194..1e1570d66d890 100644 +--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts ++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts +@@ -15,6 +15,7 @@ + */ + + /dts-v1/; ++#include + #include + #include "s5pv210.dtsi" + +@@ -42,7 +43,7 @@ ethernet@18000000 { + compatible = "davicom,dm9000"; + reg = <0xA8000000 0x2 0xA8000002 0x2>; + interrupt-parent = <&gph1>; +- interrupts = <1 4>; ++ interrupts = <1 IRQ_TYPE_LEVEL_HIGH>; + local-mac-address = [00 00 de ad be ef]; + davicom,no-eeprom; + }; +-- +2.40.1 + diff --git a/queue-5.4/arm-dts-samsung-s3c6410-mini6410-correct-ethernet-re.patch b/queue-5.4/arm-dts-samsung-s3c6410-mini6410-correct-ethernet-re.patch new file mode 100644 index 00000000000..4eb5761aca6 --- /dev/null +++ b/queue-5.4/arm-dts-samsung-s3c6410-mini6410-correct-ethernet-re.patch @@ -0,0 +1,37 @@ +From 28a21c35d6ad1c6b349c9a168a1edde20b0d756a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 17:29:25 +0200 +Subject: ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses + (split) + +From: Krzysztof Kozlowski + +[ Upstream commit cf0cb2af6a18f28b84f9f1416bff50ca60d6e98a ] + +The davicom,dm9000 Ethernet Controller accepts two reg addresses. + +Fixes: a43736deb47d ("ARM: dts: Add dts file for S3C6410-based Mini6410 board") +Reviewed-by: Alim Akhtar +Link: https://lore.kernel.org/r/20230713152926.82884-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s3c6410-mini6410.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts +index 17097da36f5ed..0b07b3c319604 100644 +--- a/arch/arm/boot/dts/s3c6410-mini6410.dts ++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts +@@ -51,7 +51,7 @@ srom-cs1-bus@18000000 { + + ethernet@18000000 { + compatible = "davicom,dm9000"; +- reg = <0x18000000 0x2 0x18000004 0x2>; ++ reg = <0x18000000 0x2>, <0x18000004 0x2>; + interrupt-parent = <&gpn>; + interrupts = <7 IRQ_TYPE_LEVEL_HIGH>; + davicom,no-eeprom; +-- +2.40.1 + diff --git a/queue-5.4/arm-dts-samsung-s5pv210-smdkv210-correct-ethernet-re.patch b/queue-5.4/arm-dts-samsung-s5pv210-smdkv210-correct-ethernet-re.patch new file mode 100644 index 00000000000..ed8dd07a7f8 --- /dev/null +++ b/queue-5.4/arm-dts-samsung-s5pv210-smdkv210-correct-ethernet-re.patch @@ -0,0 +1,37 @@ +From 109ca633dadcc6c4d6217bdb5752a4ba91b46e11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 17:29:26 +0200 +Subject: ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses + (split) + +From: Krzysztof Kozlowski + +[ Upstream commit 982655cb0e7f18934d7532c32366e574ad61dbd7 ] + +The davicom,dm9000 Ethernet Controller accepts two reg addresses. + +Fixes: b672b27d232e ("ARM: dts: Add Device tree for s5pc110/s5pv210 boards") +Reviewed-by: Alim Akhtar +Link: https://lore.kernel.org/r/20230713152926.82884-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s5pv210-smdkv210.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts +index ec5e18c59d3cf..53a841ecf7a44 100644 +--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts ++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts +@@ -41,7 +41,7 @@ pmic_ap_clk: clock-0 { + + ethernet@a8000000 { + compatible = "davicom,dm9000"; +- reg = <0xA8000000 0x2 0xA8000002 0x2>; ++ reg = <0xa8000000 0x2>, <0xa8000002 0x2>; + interrupt-parent = <&gph1>; + interrupts = <1 IRQ_TYPE_LEVEL_HIGH>; + local-mac-address = [00 00 de ad be ef]; +-- +2.40.1 + diff --git a/queue-5.4/arm64-dts-qcom-sdm845-add-missing-rpmh-power-domain-.patch b/queue-5.4/arm64-dts-qcom-sdm845-add-missing-rpmh-power-domain-.patch new file mode 100644 index 00000000000..8824cdcf12a --- /dev/null +++ b/queue-5.4/arm64-dts-qcom-sdm845-add-missing-rpmh-power-domain-.patch @@ -0,0 +1,39 @@ +From dedf9941ed692472e163b411b81823ab20ced531 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 11:10:48 +0530 +Subject: arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC + +From: Manivannan Sadhasivam + +[ Upstream commit 4b6ea15c0a1122422b44bf6c47a3c22fc8d46777 ] + +GCC and it's GDSCs are under the RPMh CX power domain. So let's add the +missing RPMh power domain to the GCC node. + +Fixes: 6d4cf750d03a ("arm64: dts: sdm845: Add minimal dts/dtsi files for sdm845 SoC and MTP") +Reviewed-by: Konrad Dybcio +Co-developed-by: Krzysztof Kozlowski +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20230720054100.9940-4-manivannan.sadhasivam@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 2287354fef863..ca77fc8aa75bb 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -715,6 +715,7 @@ gcc: clock-controller@100000 { + #clock-cells = <1>; + #reset-cells = <1>; + #power-domain-cells = <1>; ++ power-domains = <&rpmhpd SDM845_CX>; + }; + + qfprom@784000 { +-- +2.40.1 + diff --git a/queue-5.4/audit-fix-possible-soft-lockup-in-__audit_inode_chil.patch b/queue-5.4/audit-fix-possible-soft-lockup-in-__audit_inode_chil.patch new file mode 100644 index 00000000000..ef477ea99e6 --- /dev/null +++ b/queue-5.4/audit-fix-possible-soft-lockup-in-__audit_inode_chil.patch @@ -0,0 +1,80 @@ +From f6b3b7d7e35076b615f4398fdfaf285d4e61eb34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Aug 2023 20:14:35 +0800 +Subject: audit: fix possible soft lockup in __audit_inode_child() + +From: Gaosheng Cui + +[ Upstream commit b59bc6e37237e37eadf50cd5de369e913f524463 ] + +Tracefs or debugfs maybe cause hundreds to thousands of PATH records, +too many PATH records maybe cause soft lockup. + +For example: + 1. CONFIG_KASAN=y && CONFIG_PREEMPTION=n + 2. auditctl -a exit,always -S open -k key + 3. sysctl -w kernel.watchdog_thresh=5 + 4. mkdir /sys/kernel/debug/tracing/instances/test + +There may be a soft lockup as follows: + watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498] + Kernel panic - not syncing: softlockup: hung tasks + Call trace: + dump_backtrace+0x0/0x30c + show_stack+0x20/0x30 + dump_stack+0x11c/0x174 + panic+0x27c/0x494 + watchdog_timer_fn+0x2bc/0x390 + __run_hrtimer+0x148/0x4fc + __hrtimer_run_queues+0x154/0x210 + hrtimer_interrupt+0x2c4/0x760 + arch_timer_handler_phys+0x48/0x60 + handle_percpu_devid_irq+0xe0/0x340 + __handle_domain_irq+0xbc/0x130 + gic_handle_irq+0x78/0x460 + el1_irq+0xb8/0x140 + __audit_inode_child+0x240/0x7bc + tracefs_create_file+0x1b8/0x2a0 + trace_create_file+0x18/0x50 + event_create_dir+0x204/0x30c + __trace_add_new_event+0xac/0x100 + event_trace_add_tracer+0xa0/0x130 + trace_array_create_dir+0x60/0x140 + trace_array_create+0x1e0/0x370 + instance_mkdir+0x90/0xd0 + tracefs_syscall_mkdir+0x68/0xa0 + vfs_mkdir+0x21c/0x34c + do_mkdirat+0x1b4/0x1d4 + __arm64_sys_mkdirat+0x4c/0x60 + el0_svc_common.constprop.0+0xa8/0x240 + do_el0_svc+0x8c/0xc0 + el0_svc+0x20/0x30 + el0_sync_handler+0xb0/0xb4 + el0_sync+0x160/0x180 + +Therefore, we add cond_resched() to __audit_inode_child() to fix it. + +Fixes: 5195d8e217a7 ("audit: dynamically allocate audit_names when not enough space is in the names array") +Signed-off-by: Gaosheng Cui +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + kernel/auditsc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index e8e90c0c49367..fc4223f30e847 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -2161,6 +2161,8 @@ void __audit_inode_child(struct inode *parent, + } + } + ++ cond_resched(); ++ + /* is there a matching child entry? */ + list_for_each_entry(n, &context->names_list, list) { + /* can only match entries that have a name */ +-- +2.40.1 + diff --git a/queue-5.4/bluetooth-nokia-fix-value-check-in-nokia_bluetooth_s.patch b/queue-5.4/bluetooth-nokia-fix-value-check-in-nokia_bluetooth_s.patch new file mode 100644 index 00000000000..eafb4463bcc --- /dev/null +++ b/queue-5.4/bluetooth-nokia-fix-value-check-in-nokia_bluetooth_s.patch @@ -0,0 +1,41 @@ +From cd3d4cfef6ca430f7b4b189bb35aefa32b4222c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 21:30:00 +0800 +Subject: Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() + +From: Yuanjun Gong + +[ Upstream commit e8b5aed31355072faac8092ead4938ddec3111fd ] + +in nokia_bluetooth_serdev_probe(), check the return value of +clk_prepare_enable() and return the error code if +clk_prepare_enable() returns an unexpected value. + +Fixes: 7bb318680e86 ("Bluetooth: add nokia driver") +Signed-off-by: Yuanjun Gong +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_nokia.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/hci_nokia.c b/drivers/bluetooth/hci_nokia.c +index 6463350b79779..82db15585196a 100644 +--- a/drivers/bluetooth/hci_nokia.c ++++ b/drivers/bluetooth/hci_nokia.c +@@ -734,7 +734,11 @@ static int nokia_bluetooth_serdev_probe(struct serdev_device *serdev) + return err; + } + +- clk_prepare_enable(sysclk); ++ err = clk_prepare_enable(sysclk); ++ if (err) { ++ dev_err(dev, "could not enable sysclk: %d", err); ++ return err; ++ } + btdev->sysclk_speed = clk_get_rate(sysclk); + clk_disable_unprepare(sysclk); + +-- +2.40.1 + diff --git a/queue-5.4/bpf-clear-the-probe_addr-for-uprobe.patch b/queue-5.4/bpf-clear-the-probe_addr-for-uprobe.patch new file mode 100644 index 00000000000..0c071953cce --- /dev/null +++ b/queue-5.4/bpf-clear-the-probe_addr-for-uprobe.patch @@ -0,0 +1,77 @@ +From 48c2c32700ca327545a424d560acb7857357bf79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jul 2023 02:56:25 +0000 +Subject: bpf: Clear the probe_addr for uprobe + +From: Yafang Shao + +[ Upstream commit 5125e757e62f6c1d5478db4c2b61a744060ddf3f ] + +To avoid returning uninitialized or random values when querying the file +descriptor (fd) and accessing probe_addr, it is necessary to clear the +variable prior to its use. + +Fixes: 41bdc4b40ed6 ("bpf: introduce bpf subcommand BPF_TASK_FD_QUERY") +Signed-off-by: Yafang Shao +Acked-by: Yonghong Song +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/r/20230709025630.3735-6-laoar.shao@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/trace_events.h | 3 ++- + kernel/trace/bpf_trace.c | 2 +- + kernel/trace/trace_uprobe.c | 3 ++- + 3 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h +index 30a8cdcfd4a4f..a8e9d1a04f82c 100644 +--- a/include/linux/trace_events.h ++++ b/include/linux/trace_events.h +@@ -594,7 +594,8 @@ extern int perf_uprobe_init(struct perf_event *event, + extern void perf_uprobe_destroy(struct perf_event *event); + extern int bpf_get_uprobe_info(const struct perf_event *event, + u32 *fd_type, const char **filename, +- u64 *probe_offset, bool perf_type_tracepoint); ++ u64 *probe_offset, u64 *probe_addr, ++ bool perf_type_tracepoint); + #endif + extern int ftrace_profile_set_filter(struct perf_event *event, int event_id, + char *filter_str); +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 1e1345cd21b4f..4a31763a8c5d7 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -1453,7 +1453,7 @@ int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id, + #ifdef CONFIG_UPROBE_EVENTS + if (flags & TRACE_EVENT_FL_UPROBE) + err = bpf_get_uprobe_info(event, fd_type, buf, +- probe_offset, ++ probe_offset, probe_addr, + event->attr.type == PERF_TYPE_TRACEPOINT); + #endif + } +diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c +index 1a566bc675485..e924c04af627e 100644 +--- a/kernel/trace/trace_uprobe.c ++++ b/kernel/trace/trace_uprobe.c +@@ -1402,7 +1402,7 @@ static void uretprobe_perf_func(struct trace_uprobe *tu, unsigned long func, + + int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type, + const char **filename, u64 *probe_offset, +- bool perf_type_tracepoint) ++ u64 *probe_addr, bool perf_type_tracepoint) + { + const char *pevent = trace_event_name(event->tp_event); + const char *group = event->tp_event->class->system; +@@ -1419,6 +1419,7 @@ int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type, + : BPF_FD_TYPE_UPROBE; + *filename = tu->filename; + *probe_offset = tu->offset; ++ *probe_addr = 0; + return 0; + } + #endif /* CONFIG_PERF_EVENTS */ +-- +2.40.1 + diff --git a/queue-5.4/can-gs_usb-gs_usb_receive_bulk_callback-count-rx-ove.patch b/queue-5.4/can-gs_usb-gs_usb_receive_bulk_callback-count-rx-ove.patch new file mode 100644 index 00000000000..9fe45c12ed3 --- /dev/null +++ b/queue-5.4/can-gs_usb-gs_usb_receive_bulk_callback-count-rx-ove.patch @@ -0,0 +1,50 @@ +From b6b04afc910c0400888f71704aa9f4517a879243 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 11:23:37 +0200 +Subject: can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors + also in case of OOM + +From: Marc Kleine-Budde + +[ Upstream commit 6c8bc15f02b85bc8f47074110d8fd8caf7a1e42d ] + +In case of an RX overflow error from the CAN controller and an OOM +where no skb can be allocated, the error counters are not incremented. + +Fix this by first incrementing the error counters and then allocate +the skb. + +Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") +Link: https://lore.kernel.org/all/20230718-gs_usb-cleanups-v1-7-c3b9154ec605@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/gs_usb.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index de5e5385fc110..1a24c1d9dd8f7 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -381,6 +381,9 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) + } + + if (hf->flags & GS_CAN_FLAG_OVERFLOW) { ++ stats->rx_over_errors++; ++ stats->rx_errors++; ++ + skb = alloc_can_err_skb(netdev, &cf); + if (!skb) + goto resubmit_urb; +@@ -388,8 +391,6 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) + cf->can_id |= CAN_ERR_CRTL; + cf->can_dlc = CAN_ERR_DLC; + cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW; +- stats->rx_over_errors++; +- stats->rx_errors++; + netif_rx(skb); + } + +-- +2.40.1 + diff --git a/queue-5.4/clk-imx-composite-8m-fix-clock-pauses-when-set_rate-.patch b/queue-5.4/clk-imx-composite-8m-fix-clock-pauses-when-set_rate-.patch new file mode 100644 index 00000000000..c036cf3ecc9 --- /dev/null +++ b/queue-5.4/clk-imx-composite-8m-fix-clock-pauses-when-set_rate-.patch @@ -0,0 +1,78 @@ +From 536d6f38172f02dfad97f8dd0b0c613488c8085c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Aug 2023 10:22:00 +0200 +Subject: clk: imx: composite-8m: fix clock pauses when set_rate would be a + no-op + +From: Ahmad Fatoum + +[ Upstream commit 4dd432d985ef258e3bc436e568fba4b987b59171 ] + +Reconfiguring the clock divider to the exact same value is observed +on an i.MX8MN to often cause a longer than usual clock pause, probably +because the divider restarts counting whenever the register is rewritten. + +This issue doesn't show up normally, because the clock framework will +take care to not call set_rate when the clock rate is the same. +However, when we reconfigure an upstream clock, the common code will +call set_rate with the newly calculated rate on all children, e.g.: + + - sai5 is running normally and divides Audio PLL out by 16. + - Audio PLL rate is increased by 32Hz (glitch-free kdiv change) + - rates for children are recalculated and rates are set recursively + - imx8m_clk_composite_divider_set_rate(sai5) is called with + 32/16 = 2Hz more + - imx8m_clk_composite_divider_set_rate computes same divider as before + - divider register is written, so it restarts counting from zero and + MCLK is briefly paused, so instead of e.g. 40ns, MCLK is low for 120ns. + +Some external clock consumers can be upset by such unexpected clock pauses, +so let's make sure we only rewrite the divider value when the value to be +written is actually different. + +Fixes: d3ff9728134e ("clk: imx: Add imx composite clock") +Signed-off-by: Ahmad Fatoum +Reviewed-by: Peng Fan +Link: https://lore.kernel.org/r/20230807082201.2332746-1-a.fatoum@pengutronix.de +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-composite-8m.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/imx/clk-composite-8m.c b/drivers/clk/imx/clk-composite-8m.c +index d3486ee79ab54..78122188ac39e 100644 +--- a/drivers/clk/imx/clk-composite-8m.c ++++ b/drivers/clk/imx/clk-composite-8m.c +@@ -95,7 +95,7 @@ static int imx8m_clk_composite_divider_set_rate(struct clk_hw *hw, + int prediv_value; + int div_value; + int ret; +- u32 val; ++ u32 orig, val; + + ret = imx8m_clk_composite_compute_dividers(rate, parent_rate, + &prediv_value, &div_value); +@@ -104,13 +104,15 @@ static int imx8m_clk_composite_divider_set_rate(struct clk_hw *hw, + + spin_lock_irqsave(divider->lock, flags); + +- val = readl(divider->reg); +- val &= ~((clk_div_mask(divider->width) << divider->shift) | +- (clk_div_mask(PCG_DIV_WIDTH) << PCG_DIV_SHIFT)); ++ orig = readl(divider->reg); ++ val = orig & ~((clk_div_mask(divider->width) << divider->shift) | ++ (clk_div_mask(PCG_DIV_WIDTH) << PCG_DIV_SHIFT)); + + val |= (u32)(prediv_value - 1) << divider->shift; + val |= (u32)(div_value - 1) << PCG_DIV_SHIFT; +- writel(val, divider->reg); ++ ++ if (val != orig) ++ writel(val, divider->reg); + + spin_unlock_irqrestore(divider->lock, flags); + +-- +2.40.1 + diff --git a/queue-5.4/clk-sunxi-ng-modify-mismatched-function-name.patch b/queue-5.4/clk-sunxi-ng-modify-mismatched-function-name.patch new file mode 100644 index 00000000000..e9002a1e22e --- /dev/null +++ b/queue-5.4/clk-sunxi-ng-modify-mismatched-function-name.patch @@ -0,0 +1,39 @@ +From 747afa29f24e6f6c738c3f9c2dab2440ecda7eba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jul 2023 15:31:07 +0000 +Subject: clk: sunxi-ng: Modify mismatched function name + +From: Zhang Jianhua + +[ Upstream commit 075d9ca5b4e17f84fd1c744a405e69ec743be7f0 ] + +No functional modification involved. + +drivers/clk/sunxi-ng/ccu_mmc_timing.c:54: warning: expecting prototype for sunxi_ccu_set_mmc_timing_mode(). Prototype was for sunxi_ccu_get_mmc_timing_mode() instead + +Fixes: f6f64ed868d3 ("clk: sunxi-ng: Add interface to query or configure MMC timing modes.") +Signed-off-by: Zhang Jianhua +Reviewed-by: Randy Dunlap +Link: https://lore.kernel.org/r/20230722153107.2078179-1-chris.zjh@huawei.com +Signed-off-by: Jernej Skrabec +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu_mmc_timing.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/sunxi-ng/ccu_mmc_timing.c b/drivers/clk/sunxi-ng/ccu_mmc_timing.c +index de33414fc5c28..c6a6ce98ca03a 100644 +--- a/drivers/clk/sunxi-ng/ccu_mmc_timing.c ++++ b/drivers/clk/sunxi-ng/ccu_mmc_timing.c +@@ -43,7 +43,7 @@ int sunxi_ccu_set_mmc_timing_mode(struct clk *clk, bool new_mode) + EXPORT_SYMBOL_GPL(sunxi_ccu_set_mmc_timing_mode); + + /** +- * sunxi_ccu_set_mmc_timing_mode: Get the current MMC clock timing mode ++ * sunxi_ccu_get_mmc_timing_mode: Get the current MMC clock timing mode + * @clk: clock to query + * + * Returns 0 if the clock is in old timing mode, > 0 if it is in +-- +2.40.1 + diff --git a/queue-5.4/coresight-tmc-explicit-type-conversions-to-prevent-i.patch b/queue-5.4/coresight-tmc-explicit-type-conversions-to-prevent-i.patch new file mode 100644 index 00000000000..aa4bd8dad0d --- /dev/null +++ b/queue-5.4/coresight-tmc-explicit-type-conversions-to-prevent-i.patch @@ -0,0 +1,89 @@ +From d4551acdaf404f81af38d2fd48b810279550eeb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 16:15:14 +0800 +Subject: coresight: tmc: Explicit type conversions to prevent integer overflow + +From: Ruidong Tian + +[ Upstream commit fd380097cdb305582b7a1f9476391330299d2c59 ] + +Perf cs_etm session executed unexpectedly when AUX buffer > 1G. + + perf record -C 0 -m ,2G -e cs_etm// -- + [ perf record: Captured and wrote 2.615 MB perf.data ] + +Perf only collect about 2M perf data rather than 2G. This is becasuse +the operation, "nr_pages << PAGE_SHIFT", in coresight tmc driver, will +overflow when nr_pages >= 0x80000(correspond to 1G AUX buffer). The +overflow cause buffer allocation to fail, and TMC driver will alloc +minimal buffer size(1M). You can just get about 2M perf data(1M AUX +buffer + perf data header) at least. + +Explicit convert nr_pages to 64 bit to avoid overflow. + +Fixes: 22f429f19c41 ("coresight: etm-perf: Add support for ETR backend") +Fixes: 99443ea19e8b ("coresight: Add generic TMC sg table framework") +Fixes: 2e499bbc1a92 ("coresight: tmc: implementing TMC-ETF AUX space API") +Signed-off-by: Ruidong Tian +Reviewed-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230804081514.120171-2-tianruidong@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-tmc-etf.c | 2 +- + drivers/hwtracing/coresight/coresight-tmc-etr.c | 5 +++-- + drivers/hwtracing/coresight/coresight-tmc.h | 2 +- + 3 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c +index 75dfa1e2f3f2c..e15726611c649 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c +@@ -426,7 +426,7 @@ static int tmc_set_etf_buffer(struct coresight_device *csdev, + return -EINVAL; + + /* wrap head around to the amount of space we have */ +- head = handle->head & ((buf->nr_pages << PAGE_SHIFT) - 1); ++ head = handle->head & (((unsigned long)buf->nr_pages << PAGE_SHIFT) - 1); + + /* find the page to write to */ + buf->cur = head / PAGE_SIZE; +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c +index 763463776a0e1..2a0a12c194c05 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c +@@ -47,7 +47,8 @@ struct etr_perf_buffer { + }; + + /* Convert the perf index to an offset within the ETR buffer */ +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* Lower limit for ETR hardware buffer */ + #define TMC_ETR_PERF_MIN_BUF_SIZE SZ_1M +@@ -1215,7 +1216,7 @@ alloc_etr_buf(struct tmc_drvdata *drvdata, struct perf_event *event, + * than the size requested via sysfs. + */ + if ((nr_pages << PAGE_SHIFT) > drvdata->size) { +- etr_buf = tmc_alloc_etr_buf(drvdata, (nr_pages << PAGE_SHIFT), ++ etr_buf = tmc_alloc_etr_buf(drvdata, ((ssize_t)nr_pages << PAGE_SHIFT), + 0, node, NULL); + if (!IS_ERR(etr_buf)) + goto done; +diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h +index 71de978575f36..1fcf6e29e8d3a 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc.h ++++ b/drivers/hwtracing/coresight/coresight-tmc.h +@@ -320,7 +320,7 @@ ssize_t tmc_sg_table_get_data(struct tmc_sg_table *sg_table, + static inline unsigned long + tmc_sg_table_buf_size(struct tmc_sg_table *sg_table) + { +- return sg_table->data_pages.nr_pages << PAGE_SHIFT; ++ return (unsigned long)sg_table->data_pages.nr_pages << PAGE_SHIFT; + } + + struct coresight_device *tmc_etr_get_catu_device(struct tmc_drvdata *drvdata); +-- +2.40.1 + diff --git a/queue-5.4/cpufreq-fix-the-race-condition-while-updating-the-tr.patch b/queue-5.4/cpufreq-fix-the-race-condition-while-updating-the-tr.patch new file mode 100644 index 00000000000..8b0ab708ac8 --- /dev/null +++ b/queue-5.4/cpufreq-fix-the-race-condition-while-updating-the-tr.patch @@ -0,0 +1,81 @@ +From a8c01df4ff4ea4f8726bc3ea6c83805ec00db63c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Aug 2023 07:03:18 +0000 +Subject: cpufreq: Fix the race condition while updating the transition_task of + policy + +From: Liao Chang + +[ Upstream commit 61bfbf7951ba561dcbdd5357702d3cbc2d447812 ] + +The field 'transition_task' of policy structure is used to track the +task which is performing the frequency transition. Using this field to +print a warning once detect a case where the same task is calling +_begin() again before completing the preivous frequency transition via +the _end(). + +However, there is a potential race condition in _end() and _begin() APIs +while updating the field 'transition_task' of policy, the scenario is +depicted below: + + Task A Task B + + /* 1st freq transition */ + Invoke _begin() { + ... + ... + } + /* 2nd freq transition */ + Invoke _begin() { + ... //waiting for A to + ... //clear + ... //transition_ongoing + ... //in _end() for + ... //the 1st transition + | + Change the frequency | + | + Invoke _end() { | + ... | + ... | + transition_ongoing = false; V + transition_ongoing = true; + transition_task = current; + transition_task = NULL; + ... //A overwrites the task + ... //performing the transition + ... //result in error warning. + } + +To fix this race condition, the transition_lock of policy structure is +now acquired before updating policy structure in _end() API. Which ensure +that only one task can update the 'transition_task' field at a time. + +Link: https://lore.kernel.org/all/b3c61d8a-d52d-3136-fbf0-d1de9f1ba411@huawei.com/ +Fixes: ca654dc3a93d ("cpufreq: Catch double invocations of cpufreq_freq_transition_begin/end") +Signed-off-by: Liao Chang +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 01f0a8bdd534b..11b9edc713baa 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -441,8 +441,10 @@ void cpufreq_freq_transition_end(struct cpufreq_policy *policy, + + cpufreq_notify_post_transition(policy, freqs, transition_failed); + ++ spin_lock(&policy->transition_lock); + policy->transition_ongoing = false; + policy->transition_task = NULL; ++ spin_unlock(&policy->transition_lock); + + wake_up(&policy->transition_wait); + } +-- +2.40.1 + diff --git a/queue-5.4/cpufreq-powernow-k8-use-related_cpus-instead-of-cpus.patch b/queue-5.4/cpufreq-powernow-k8-use-related_cpus-instead-of-cpus.patch new file mode 100644 index 00000000000..99c5519bfc9 --- /dev/null +++ b/queue-5.4/cpufreq-powernow-k8-use-related_cpus-instead-of-cpus.patch @@ -0,0 +1,39 @@ +From 7d2539efe66ea798f6ffa79eac7ee4341372656f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Aug 2023 09:51:13 +0000 +Subject: cpufreq: powernow-k8: Use related_cpus instead of cpus in + driver.exit() + +From: Liao Chang + +[ Upstream commit 03997da042dac73c69e60d91942c727c76828b65 ] + +Since the 'cpus' field of policy structure will become empty in the +cpufreq core API, it is better to use 'related_cpus' in the exit() +callback of driver. + +Fixes: c3274763bfc3 ("cpufreq: powernow-k8: Initialize per-cpu data-structures properly") +Signed-off-by: Liao Chang +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/powernow-k8.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c +index 1b2ec3be59eb7..c658e8e49f902 100644 +--- a/drivers/cpufreq/powernow-k8.c ++++ b/drivers/cpufreq/powernow-k8.c +@@ -1101,7 +1101,8 @@ static int powernowk8_cpu_exit(struct cpufreq_policy *pol) + + kfree(data->powernow_table); + kfree(data); +- for_each_cpu(cpu, pol->cpus) ++ /* pol->cpus will be empty here, use related_cpus instead. */ ++ for_each_cpu(cpu, pol->related_cpus) + per_cpu(powernow_data, cpu) = NULL; + + return 0; +-- +2.40.1 + diff --git a/queue-5.4/crypto-caam-fix-unchecked-return-value-error.patch b/queue-5.4/crypto-caam-fix-unchecked-return-value-error.patch new file mode 100644 index 00000000000..2edb557d556 --- /dev/null +++ b/queue-5.4/crypto-caam-fix-unchecked-return-value-error.patch @@ -0,0 +1,44 @@ +From a55a2fe430d6b92ccff5e4bfd1863b8ec9130266 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Aug 2023 12:55:25 +0200 +Subject: crypto: caam - fix unchecked return value error + +From: Gaurav Jain + +[ Upstream commit e30685204711a6be40dec2622606950ccd37dafe ] + +error: +Unchecked return value (CHECKED_RETURN) +check_return: Calling sg_miter_next without checking return value + +fix: +added check if(!sg_miter_next) + +Fixes: 8a2a0dd35f2e ("crypto: caam - strip input zeros from RSA input buffer") +Signed-off-by: Gaurav Jain +Signed-off-by: Meenakshi Aggarwal +Reviewed-by: Gaurav Jain +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/caam/caampkc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c +index 30e3f41ed8721..e0bba20c13cb5 100644 +--- a/drivers/crypto/caam/caampkc.c ++++ b/drivers/crypto/caam/caampkc.c +@@ -225,7 +225,9 @@ static int caam_rsa_count_leading_zeros(struct scatterlist *sgl, + if (len && *buff) + break; + +- sg_miter_next(&miter); ++ if (!sg_miter_next(&miter)) ++ break; ++ + buff = miter.addr; + len = miter.length; + +-- +2.40.1 + diff --git a/queue-5.4/crypto-stm32-properly-handle-pm_runtime_get-failing.patch b/queue-5.4/crypto-stm32-properly-handle-pm_runtime_get-failing.patch new file mode 100644 index 00000000000..6a7fc0d8cb0 --- /dev/null +++ b/queue-5.4/crypto-stm32-properly-handle-pm_runtime_get-failing.patch @@ -0,0 +1,61 @@ +From e30c728c84b6ad2c04a57ce0cb4e91cb9640baff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jul 2023 18:54:54 +0200 +Subject: crypto: stm32 - Properly handle pm_runtime_get failing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit aec48805163338f8413118796c1dd035661b9140 ] + +If pm_runtime_get() (disguised as pm_runtime_resume_and_get()) fails, this +means the clk wasn't prepared and enabled. Returning early in this case +however is wrong as then the following resource frees are skipped and this +is never catched up. So do all the cleanups but clk_disable_unprepare(). + +Also don't emit a warning, as stm32_hash_runtime_resume() already emitted +one. + +Note that the return value of stm32_hash_remove() is mostly ignored by +the device core. The only effect of returning zero instead of an error +value is to suppress another warning in platform_remove(). So return 0 +even if pm_runtime_resume_and_get() failed. + +Fixes: 8b4d566de6a5 ("crypto: stm32/hash - Add power management support") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/stm32/stm32-hash.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c +index dcce15b558091..7beb07def3d3a 100644 +--- a/drivers/crypto/stm32/stm32-hash.c ++++ b/drivers/crypto/stm32/stm32-hash.c +@@ -1553,9 +1553,7 @@ static int stm32_hash_remove(struct platform_device *pdev) + if (!hdev) + return -ENODEV; + +- ret = pm_runtime_resume_and_get(hdev->dev); +- if (ret < 0) +- return ret; ++ ret = pm_runtime_get_sync(hdev->dev); + + stm32_hash_unregister_algs(hdev); + +@@ -1571,7 +1569,8 @@ static int stm32_hash_remove(struct platform_device *pdev) + pm_runtime_disable(hdev->dev); + pm_runtime_put_noidle(hdev->dev); + +- clk_disable_unprepare(hdev->clk); ++ if (ret >= 0) ++ clk_disable_unprepare(hdev->clk); + + return 0; + } +-- +2.40.1 + diff --git a/queue-5.4/dma-buf-sync_file-fix-docs-syntax.patch b/queue-5.4/dma-buf-sync_file-fix-docs-syntax.patch new file mode 100644 index 00000000000..1cdd7194679 --- /dev/null +++ b/queue-5.4/dma-buf-sync_file-fix-docs-syntax.patch @@ -0,0 +1,39 @@ +From 1afb5126b026972073e997ea9cc3b927ff42b01a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 07:49:41 -0700 +Subject: dma-buf/sync_file: Fix docs syntax + +From: Rob Clark + +[ Upstream commit 05d56d8079d510a2994039470f65bea85f0075ee ] + +Fixes the warning: + + include/uapi/linux/sync_file.h:77: warning: Function parameter or member 'num_fences' not described in 'sync_file_info' + +Fixes: 2d75c88fefb2 ("staging/android: refactor SYNC IOCTLs") +Signed-off-by: Rob Clark +Reviewed-by: Randy Dunlap +Link: https://lore.kernel.org/r/20230724145000.125880-1-robdclark@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/uapi/linux/sync_file.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/sync_file.h b/include/uapi/linux/sync_file.h +index ee2dcfb3d6602..d7f7c04a6e0c1 100644 +--- a/include/uapi/linux/sync_file.h ++++ b/include/uapi/linux/sync_file.h +@@ -52,7 +52,7 @@ struct sync_fence_info { + * @name: name of fence + * @status: status of fence. 1: signaled 0:active <0:error + * @flags: sync_file_info flags +- * @num_fences number of fences in the sync_file ++ * @num_fences: number of fences in the sync_file + * @pad: padding for 64-bit alignment, should always be zero + * @sync_fence_info: pointer to array of structs sync_fence_info with all + * fences in the sync_file +-- +2.40.1 + diff --git a/queue-5.4/dmaengine-ste_dma40-add-missing-irq-check-in-d40_pro.patch b/queue-5.4/dmaengine-ste_dma40-add-missing-irq-check-in-d40_pro.patch new file mode 100644 index 00000000000..ba9c5deb763 --- /dev/null +++ b/queue-5.4/dmaengine-ste_dma40-add-missing-irq-check-in-d40_pro.patch @@ -0,0 +1,40 @@ +From d05c59c6b24c2bce20838205f6fe8e4db5e75bc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 14:41:08 +0000 +Subject: dmaengine: ste_dma40: Add missing IRQ check in d40_probe + +From: ruanjinjie + +[ Upstream commit c05ce6907b3d6e148b70f0bb5eafd61dcef1ddc1 ] + +Check for the return value of platform_get_irq(): if no interrupt +is specified, it wouldn't make sense to call request_irq(). + +Fixes: 8d318a50b3d7 ("DMAENGINE: Support for ST-Ericssons DMA40 block v3") +Signed-off-by: Ruan Jinjie +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20230724144108.2582917-1-ruanjinjie@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ste_dma40.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c +index 6671bfe084895..96a808b487cbe 100644 +--- a/drivers/dma/ste_dma40.c ++++ b/drivers/dma/ste_dma40.c +@@ -3599,6 +3599,10 @@ static int __init d40_probe(struct platform_device *pdev) + spin_lock_init(&base->lcla_pool.lock); + + base->irq = platform_get_irq(pdev, 0); ++ if (base->irq < 0) { ++ ret = base->irq; ++ goto destroy_cache; ++ } + + ret = request_irq(base->irq, d40_handle_interrupt, 0, D40_NAME, base); + if (ret) { +-- +2.40.1 + diff --git a/queue-5.4/driver-core-test_async-fix-an-error-code.patch b/queue-5.4/driver-core-test_async-fix-an-error-code.patch new file mode 100644 index 00000000000..411030e5c0d --- /dev/null +++ b/queue-5.4/driver-core-test_async-fix-an-error-code.patch @@ -0,0 +1,37 @@ +From e9318c140433b7ffa64a5e472ec7921b4498d7aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 10:03:49 +0300 +Subject: driver core: test_async: fix an error code + +From: Dan Carpenter + +[ Upstream commit 22d2381bbd70a5853c2ee77522f4965139672db9 ] + +The test_platform_device_register_node() function should return error +pointers instead of NULL. That is what the callers are expecting. + +Fixes: 57ea974fb871 ("driver core: Rewrite test_async_driver_probe to cover serialization and NUMA affinity") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/1e11ed19-e1f6-43d8-b352-474134b7c008@moroto.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/test/test_async_driver_probe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/test/test_async_driver_probe.c b/drivers/base/test/test_async_driver_probe.c +index c157a912d6739..88336f093decd 100644 +--- a/drivers/base/test/test_async_driver_probe.c ++++ b/drivers/base/test/test_async_driver_probe.c +@@ -84,7 +84,7 @@ test_platform_device_register_node(char *name, int id, int nid) + + pdev = platform_device_alloc(name, id); + if (!pdev) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + if (nid != NUMA_NO_NODE) + set_dev_node(&pdev->dev, nid); +-- +2.40.1 + diff --git a/queue-5.4/drivers-clk-keystone-fix-parameter-judgment-in-_of_p.patch b/queue-5.4/drivers-clk-keystone-fix-parameter-judgment-in-_of_p.patch new file mode 100644 index 00000000000..3837672e244 --- /dev/null +++ b/queue-5.4/drivers-clk-keystone-fix-parameter-judgment-in-_of_p.patch @@ -0,0 +1,38 @@ +From 65808d6a2dc1de3f5cfeb365559e3a5dc5c090c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jul 2023 18:22:46 +0800 +Subject: drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() + +From: Minjie Du + +[ Upstream commit a995c50db887ef97f3160775aef7d772635a6f6e ] + +The function clk_register_pll() may return NULL or an ERR_PTR. Don't +treat an ERR_PTR as valid. + +Signed-off-by: Minjie Du +Link: https://lore.kernel.org/r/20230712102246.10348-1-duminjie@vivo.com +Fixes: b9e0d40c0d83 ("clk: keystone: add Keystone PLL clock driver") +[sboyd@kernel.org: Reword commit text] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/keystone/pll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/keystone/pll.c b/drivers/clk/keystone/pll.c +index d59a7621bb204..ee5c72369334f 100644 +--- a/drivers/clk/keystone/pll.c ++++ b/drivers/clk/keystone/pll.c +@@ -209,7 +209,7 @@ static void __init _of_pll_clk_init(struct device_node *node, bool pllctrl) + } + + clk = clk_register_pll(NULL, node->name, parent_name, pll_data); +- if (clk) { ++ if (!IS_ERR_OR_NULL(clk)) { + of_clk_add_provider(node, of_clk_src_simple_get, clk); + return; + } +-- +2.40.1 + diff --git a/queue-5.4/drivers-usb-smsusb-fix-error-handling-code-in-smsusb.patch b/queue-5.4/drivers-usb-smsusb-fix-error-handling-code-in-smsusb.patch new file mode 100644 index 00000000000..ad2b0913c4c --- /dev/null +++ b/queue-5.4/drivers-usb-smsusb-fix-error-handling-code-in-smsusb.patch @@ -0,0 +1,80 @@ +From 4fa6175f6ef7b35e02a20e3ca67f1e8934e8dd7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 18:24:08 +0800 +Subject: drivers: usb: smsusb: fix error handling code in smsusb_init_device + +From: Dongliang Mu + +[ Upstream commit b9c7141f384097fa4fa67d2f72e5731d628aef7c ] + +The previous commit 4b208f8b561f ("[media] siano: register media controller +earlier")moves siano_media_device_register before smscore_register_device, +and adds corresponding error handling code if smscore_register_device +fails. However, it misses the following error handling code of +smsusb_init_device. + +Fix this by moving error handling code at the end of smsusb_init_device +and adding a goto statement in the following error handling parts. + +Fixes: 4b208f8b561f ("[media] siano: register media controller earlier") +Signed-off-by: Dongliang Mu +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/siano/smsusb.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c +index 0358cd1043877..598ad05f5beac 100644 +--- a/drivers/media/usb/siano/smsusb.c ++++ b/drivers/media/usb/siano/smsusb.c +@@ -455,12 +455,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) + rc = smscore_register_device(¶ms, &dev->coredev, 0, mdev); + if (rc < 0) { + pr_err("smscore_register_device(...) failed, rc %d\n", rc); +- smsusb_term_device(intf); +-#ifdef CONFIG_MEDIA_CONTROLLER_DVB +- media_device_unregister(mdev); +-#endif +- kfree(mdev); +- return rc; ++ goto err_unregister_device; + } + + smscore_set_board_id(dev->coredev, board_id); +@@ -477,8 +472,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) + rc = smsusb_start_streaming(dev); + if (rc < 0) { + pr_err("smsusb_start_streaming(...) failed\n"); +- smsusb_term_device(intf); +- return rc; ++ goto err_unregister_device; + } + + dev->state = SMSUSB_ACTIVE; +@@ -486,13 +480,20 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) + rc = smscore_start_device(dev->coredev); + if (rc < 0) { + pr_err("smscore_start_device(...) failed\n"); +- smsusb_term_device(intf); +- return rc; ++ goto err_unregister_device; + } + + pr_debug("device 0x%p created\n", dev); + + return rc; ++ ++err_unregister_device: ++ smsusb_term_device(intf); ++#ifdef CONFIG_MEDIA_CONTROLLER_DVB ++ media_device_unregister(mdev); ++#endif ++ kfree(mdev); ++ return rc; + } + + static int smsusb_probe(struct usb_interface *intf, +-- +2.40.1 + diff --git a/queue-5.4/drm-adv7511-fix-low-refresh-rate-register-for-adv753.patch b/queue-5.4/drm-adv7511-fix-low-refresh-rate-register-for-adv753.patch new file mode 100644 index 00000000000..55764e4f46c --- /dev/null +++ b/queue-5.4/drm-adv7511-fix-low-refresh-rate-register-for-adv753.patch @@ -0,0 +1,49 @@ +From 88052ac91f7f0e76a25140be0f02551debe3d911 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 09:01:43 +0300 +Subject: drm: adv7511: Fix low refresh rate register for ADV7533/5 + +From: Bogdan Togorean + +[ Upstream commit d281eeaa4de2636ff0c8e6ae387bb07b50e5fcbb ] + +For ADV7533 and ADV7535 low refresh rate is selected using +bits [3:2] of 0x4a main register. +So depending on ADV model write 0xfb or 0x4a register. + +Fixes: 2437e7cd88e8 ("drm/bridge: adv7533: Initial support for ADV7533") +Reviewed-by: Robert Foss +Reviewed-by: Nuno Sa +Signed-off-by: Bogdan Togorean +Signed-off-by: Alexandru Ardelean +Reviewed-by: Frieder Schrempf +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230719060143.63649-1-alex@shruggie.ro +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index 62ef603627b77..2cdfbdcbf02d6 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -756,8 +756,13 @@ static void adv7511_mode_set(struct adv7511 *adv7511, + else + low_refresh_rate = ADV7511_LOW_REFRESH_RATE_NONE; + +- regmap_update_bits(adv7511->regmap, 0xfb, +- 0x6, low_refresh_rate << 1); ++ if (adv7511->type == ADV7511) ++ regmap_update_bits(adv7511->regmap, 0xfb, ++ 0x6, low_refresh_rate << 1); ++ else ++ regmap_update_bits(adv7511->regmap, 0x4a, ++ 0xc, low_refresh_rate << 2); ++ + regmap_update_bits(adv7511->regmap, 0x17, + 0x60, (vsync_polarity << 6) | (hsync_polarity << 5)); + +-- +2.40.1 + diff --git a/queue-5.4/drm-amdgpu-avoid-integer-overflow-warning-in-amdgpu_.patch b/queue-5.4/drm-amdgpu-avoid-integer-overflow-warning-in-amdgpu_.patch new file mode 100644 index 00000000000..c96436961f8 --- /dev/null +++ b/queue-5.4/drm-amdgpu-avoid-integer-overflow-warning-in-amdgpu_.patch @@ -0,0 +1,52 @@ +From b3398aef9db225de6c2415d30fa9923da8dec07f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 13:11:51 +0200 +Subject: drm/amdgpu: avoid integer overflow warning in + amdgpu_device_resize_fb_bar() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +[ Upstream commit 822130b5e8834ab30ad410cf19a582e5014b9a85 ] + +On 32-bit architectures comparing a resource against a value larger than +U32_MAX can cause a warning: + +drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:1344:18: error: result of comparison of constant 4294967296 with expression of type 'resource_size_t' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare] + res->start > 0x100000000ull) + ~~~~~~~~~~ ^ ~~~~~~~~~~~~~~ + +As gcc does not warn about this in dead code, add an IS_ENABLED() check at +the start of the function. This will always return success but not actually resize +the BAR on 32-bit architectures without high memory, which is exactly what +we want here, as the driver can fall back to bank switching the VRAM +access. + +Fixes: 31b8adab3247 ("drm/amdgpu: require a root bus window above 4GB for BAR resize") +Reviewed-by: Christian König +Signed-off-by: Arnd Bergmann +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index d0e1fd011de54..e5032eb9ae291 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -759,6 +759,9 @@ int amdgpu_device_resize_fb_bar(struct amdgpu_device *adev) + u16 cmd; + int r; + ++ if (!IS_ENABLED(CONFIG_PHYS_ADDR_T_64BIT)) ++ return 0; ++ + /* Bypass for VF */ + if (amdgpu_sriov_vf(adev)) + return 0; +-- +2.40.1 + diff --git a/queue-5.4/drm-amdgpu-correct-transmit-margin-masks.patch b/queue-5.4/drm-amdgpu-correct-transmit-margin-masks.patch new file mode 100644 index 00000000000..316d45d2447 --- /dev/null +++ b/queue-5.4/drm-amdgpu-correct-transmit-margin-masks.patch @@ -0,0 +1,73 @@ +From 573ba79a5501f2d5c6fbf9daadab01c3d6bec23f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Nov 2019 17:52:48 -0600 +Subject: drm/amdgpu: Correct Transmit Margin masks + +From: Bjorn Helgaas + +[ Upstream commit 19d7a95a8ba66b198f759cf610cc935ce9840d5b ] + +Previously we masked PCIe Link Control 2 register values with "7 << 9", +which was apparently intended to be the Transmit Margin field, but instead +was the high order bit of Transmit Margin, the Enter Modified Compliance +bit, and the Compliance SOS bit. + +Correct the mask to "7 << 7", which is the Transmit Margin field. + +Link: https://lore.kernel.org/r/20191112173503.176611-3-helgaas@kernel.org +Signed-off-by: Bjorn Helgaas +Reviewed-by: Alex Deucher +Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/cik.c | 8 ++++---- + drivers/gpu/drm/amd/amdgpu/si.c | 8 ++++---- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c +index b81bb414fcb30..13a5696d2a6a2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/cik.c ++++ b/drivers/gpu/drm/amd/amdgpu/cik.c +@@ -1498,13 +1498,13 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + + /* linkctl2 */ + pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9))); ++ tmp16 &= ~((1 << 4) | (7 << 7)); ++ tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7))); + pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); + + pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9))); ++ tmp16 &= ~((1 << 4) | (7 << 7)); ++ tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7))); + pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); + + tmp = RREG32_PCIE(ixPCIE_LC_CNTL4); +diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c +index 493af42152f26..1e350172dc7bb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si.c ++++ b/drivers/gpu/drm/amd/amdgpu/si.c +@@ -1737,13 +1737,13 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); + + pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9))); ++ tmp16 &= ~((1 << 4) | (7 << 7)); ++ tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7))); + pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); + + pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9))); ++ tmp16 &= ~((1 << 4) | (7 << 7)); ++ tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7))); + pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); +-- +2.40.1 + diff --git a/queue-5.4/drm-amdgpu-prefer-pcie_capability_read_word.patch b/queue-5.4/drm-amdgpu-prefer-pcie_capability_read_word.patch new file mode 100644 index 00000000000..17469242a96 --- /dev/null +++ b/queue-5.4/drm-amdgpu-prefer-pcie_capability_read_word.patch @@ -0,0 +1,331 @@ +From ff36d0c41fe60e58b10cd39b79dd0c185c97c848 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Nov 2019 18:35:13 -0600 +Subject: drm/amdgpu: Prefer pcie_capability_read_word() + +From: Frederick Lawler + +[ Upstream commit 88027c89ea146e32485251f1c2dddcde43c8d04e ] + +Commit 8c0d3a02c130 ("PCI: Add accessors for PCI Express Capability") +added accessors for the PCI Express Capability so that drivers didn't +need to be aware of differences between v1 and v2 of the PCI +Express Capability. + +Replace pci_read_config_word() and pci_write_config_word() calls with +pcie_capability_read_word() and pcie_capability_write_word(). + +[bhelgaas: fix a couple remaining instances in cik.c] +Link: https://lore.kernel.org/r/20191118003513.10852-1-fred@fredlawl.com +Signed-off-by: Frederick Lawler +Signed-off-by: Bjorn Helgaas +Reviewed-by: Alex Deucher +Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/cik.c | 71 ++++++++++++++++++++------------ + drivers/gpu/drm/amd/amdgpu/si.c | 71 ++++++++++++++++++++------------ + 2 files changed, 90 insertions(+), 52 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c +index 3067bb874032f..38b06ae6357a7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/cik.c ++++ b/drivers/gpu/drm/amd/amdgpu/cik.c +@@ -1384,7 +1384,6 @@ static int cik_set_vce_clocks(struct amdgpu_device *adev, u32 evclk, u32 ecclk) + static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + { + struct pci_dev *root = adev->pdev->bus->self; +- int bridge_pos, gpu_pos; + u32 speed_cntl, current_data_rate; + int i; + u16 tmp16; +@@ -1419,12 +1418,7 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + DRM_INFO("enabling PCIE gen 2 link speeds, disable with amdgpu.pcie_gen2=0\n"); + } + +- bridge_pos = pci_pcie_cap(root); +- if (!bridge_pos) +- return; +- +- gpu_pos = pci_pcie_cap(adev->pdev); +- if (!gpu_pos) ++ if (!pci_is_pcie(root) || !pci_is_pcie(adev->pdev)) + return; + + if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) { +@@ -1434,14 +1428,17 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &bridge_cfg); ++ pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL, ++ &gpu_cfg); + + tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16); + + tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL, ++ tmp16); + + tmp = RREG32_PCIE(ixPCIE_LC_STATUS1); + max_lw = (tmp & PCIE_LC_STATUS1__LC_DETECTED_LINK_WIDTH_MASK) >> +@@ -1465,15 +1462,23 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + + for (i = 0; i < 10; i++) { + /* check status */ +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_DEVSTA, ++ &tmp16); + if (tmp16 & PCI_EXP_DEVSTA_TRPND) + break; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &bridge_cfg); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL, ++ &gpu_cfg); + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2); +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &bridge_cfg2); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL2, ++ &gpu_cfg2); + + tmp = RREG32_PCIE(ixPCIE_LC_CNTL4); + tmp |= PCIE_LC_CNTL4__LC_SET_QUIESCE_MASK; +@@ -1486,32 +1491,45 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + msleep(100); + + /* linkctl */ +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &tmp16); + tmp16 &= ~PCI_EXP_LNKCTL_HAWD; + tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(root, PCI_EXP_LNKCTL, ++ tmp16); + +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL, ++ &tmp16); + tmp16 &= ~PCI_EXP_LNKCTL_HAWD; + tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(adev->pdev, ++ PCI_EXP_LNKCTL, ++ tmp16); + + /* linkctl2 */ +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &tmp16); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN); + tmp16 |= (bridge_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN)); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_write_word(root, ++ PCI_EXP_LNKCTL2, ++ tmp16); + +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL2, ++ &tmp16); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN); + tmp16 |= (gpu_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN)); +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_write_word(adev->pdev, ++ PCI_EXP_LNKCTL2, ++ tmp16); + + tmp = RREG32_PCIE(ixPCIE_LC_CNTL4); + tmp &= ~PCIE_LC_CNTL4__LC_SET_QUIESCE_MASK; +@@ -1526,15 +1544,16 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + speed_cntl &= ~PCIE_LC_SPEED_CNTL__LC_FORCE_DIS_SW_SPEED_CHANGE_MASK; + WREG32_PCIE(ixPCIE_LC_SPEED_CNTL, speed_cntl); + +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); ++ pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL2, &tmp16); + tmp16 &= ~PCI_EXP_LNKCTL2_TLS; ++ + if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) + tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */ + else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) + tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */ + else + tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */ +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL2, tmp16); + + speed_cntl = RREG32_PCIE(ixPCIE_LC_SPEED_CNTL); + speed_cntl |= PCIE_LC_SPEED_CNTL__LC_INITIATE_LINK_SPEED_CHANGE_MASK; +diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c +index a7dcb0d0f039c..9f82be879224a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si.c ++++ b/drivers/gpu/drm/amd/amdgpu/si.c +@@ -1633,7 +1633,6 @@ static void si_init_golden_registers(struct amdgpu_device *adev) + static void si_pcie_gen3_enable(struct amdgpu_device *adev) + { + struct pci_dev *root = adev->pdev->bus->self; +- int bridge_pos, gpu_pos; + u32 speed_cntl, current_data_rate; + int i; + u16 tmp16; +@@ -1668,12 +1667,7 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + DRM_INFO("enabling PCIE gen 2 link speeds, disable with amdgpu.pcie_gen2=0\n"); + } + +- bridge_pos = pci_pcie_cap(root); +- if (!bridge_pos) +- return; +- +- gpu_pos = pci_pcie_cap(adev->pdev); +- if (!gpu_pos) ++ if (!pci_is_pcie(root) || !pci_is_pcie(adev->pdev)) + return; + + if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) { +@@ -1682,14 +1676,17 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &bridge_cfg); ++ pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL, ++ &gpu_cfg); + + tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16); + + tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL, ++ tmp16); + + tmp = RREG32_PCIE(PCIE_LC_STATUS1); + max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT; +@@ -1706,15 +1703,23 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + } + + for (i = 0; i < 10; i++) { +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_DEVSTA, ++ &tmp16); + if (tmp16 & PCI_EXP_DEVSTA_TRPND) + break; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &bridge_cfg); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL, ++ &gpu_cfg); + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2); +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &bridge_cfg2); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL2, ++ &gpu_cfg2); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); + tmp |= LC_SET_QUIESCE; +@@ -1726,31 +1731,44 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + + mdelay(100); + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &tmp16); + tmp16 &= ~PCI_EXP_LNKCTL_HAWD; + tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(root, PCI_EXP_LNKCTL, ++ tmp16); + +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL, ++ &tmp16); + tmp16 &= ~PCI_EXP_LNKCTL_HAWD; + tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(adev->pdev, ++ PCI_EXP_LNKCTL, ++ tmp16); + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &tmp16); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN); + tmp16 |= (bridge_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN)); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_write_word(root, ++ PCI_EXP_LNKCTL2, ++ tmp16); + +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); ++ pcie_capability_read_word(adev->pdev, ++ PCI_EXP_LNKCTL2, ++ &tmp16); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN); + tmp16 |= (gpu_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN)); +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_write_word(adev->pdev, ++ PCI_EXP_LNKCTL2, ++ tmp16); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); + tmp &= ~LC_SET_QUIESCE; +@@ -1763,15 +1781,16 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + speed_cntl &= ~LC_FORCE_DIS_SW_SPEED_CHANGE; + WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl); + +- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); ++ pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL2, &tmp16); + tmp16 &= ~PCI_EXP_LNKCTL2_TLS; ++ + if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) + tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */ + else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) + tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */ + else + tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */ +- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL2, tmp16); + + speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL); + speed_cntl |= LC_INITIATE_LINK_SPEED_CHANGE; +-- +2.40.1 + diff --git a/queue-5.4/drm-amdgpu-replace-numbers-with-pci_exp_lnkctl2-defi.patch b/queue-5.4/drm-amdgpu-replace-numbers-with-pci_exp_lnkctl2-defi.patch new file mode 100644 index 00000000000..251f2f001b6 --- /dev/null +++ b/queue-5.4/drm-amdgpu-replace-numbers-with-pci_exp_lnkctl2-defi.patch @@ -0,0 +1,117 @@ +From 9f2a871f1aead492a7ab6601fc7d52e3ec620900 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Nov 2019 07:23:41 -0600 +Subject: drm/amdgpu: Replace numbers with PCI_EXP_LNKCTL2 definitions + +From: Bjorn Helgaas + +[ Upstream commit 35e768e296729ac96a8c33b7810b6cb1673ae961 ] + +Replace hard-coded magic numbers with the descriptive PCI_EXP_LNKCTL2 +definitions. No functional change intended. + +Link: https://lore.kernel.org/r/20191112173503.176611-4-helgaas@kernel.org +Signed-off-by: Bjorn Helgaas +Reviewed-by: Alex Deucher +Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/cik.c | 22 ++++++++++++++-------- + drivers/gpu/drm/amd/amdgpu/si.c | 22 ++++++++++++++-------- + 2 files changed, 28 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c +index 13a5696d2a6a2..3067bb874032f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/cik.c ++++ b/drivers/gpu/drm/amd/amdgpu/cik.c +@@ -1498,13 +1498,19 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + + /* linkctl2 */ + pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 7)); +- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7))); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (bridge_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); + pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); + + pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 7)); +- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7))); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (gpu_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); + pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); + + tmp = RREG32_PCIE(ixPCIE_LC_CNTL4); +@@ -1521,13 +1527,13 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + WREG32_PCIE(ixPCIE_LC_SPEED_CNTL, speed_cntl); + + pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~0xf; ++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS; + if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) +- tmp16 |= 3; /* gen3 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */ + else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) +- tmp16 |= 2; /* gen2 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */ + else +- tmp16 |= 1; /* gen1 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */ + pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); + + speed_cntl = RREG32_PCIE(ixPCIE_LC_SPEED_CNTL); +diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c +index 1e350172dc7bb..a7dcb0d0f039c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si.c ++++ b/drivers/gpu/drm/amd/amdgpu/si.c +@@ -1737,13 +1737,19 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); + + pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 7)); +- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7))); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (bridge_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); + pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); + + pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 7)); +- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7))); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (gpu_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); + pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); +@@ -1758,13 +1764,13 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl); + + pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~0xf; ++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS; + if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) +- tmp16 |= 3; ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */ + else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) +- tmp16 |= 2; ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */ + else +- tmp16 |= 1; ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */ + pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); + + speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL); +-- +2.40.1 + diff --git a/queue-5.4/drm-amdgpu-update-min-to-min_t-in-amdgpu_info_ioctl.patch b/queue-5.4/drm-amdgpu-update-min-to-min_t-in-amdgpu_info_ioctl.patch new file mode 100644 index 00000000000..e40dae83c4b --- /dev/null +++ b/queue-5.4/drm-amdgpu-update-min-to-min_t-in-amdgpu_info_ioctl.patch @@ -0,0 +1,88 @@ +From 03e4b8d47e71374a647df83083dd1c9fb5f16a01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 12:29:14 +0530 +Subject: drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivasan Shanmugam + +[ Upstream commit a0cc8e1512ad72c9f97cdcb76d42715730adaf62 ] + +Fixes the following: + +WARNING: min() should probably be min_t(size_t, size, sizeof(ip)) ++ ret = copy_to_user(out, &ip, min((size_t)size, sizeof(ip))); + +And other style fixes: + +WARNING: Prefer 'unsigned int' to bare use of 'unsigned' +WARNING: Missing a blank line after declarations + +Cc: Christian König +Cc: Alex Deucher +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index 59fd9ebf3a58b..26a1173df9586 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -471,6 +471,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + crtc = (struct drm_crtc *)minfo->crtcs[i]; + if (crtc && crtc->base.id == info->mode_crtc.id) { + struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc); ++ + ui32 = amdgpu_crtc->crtc_id; + found = 1; + break; +@@ -489,7 +490,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + if (ret) + return ret; + +- ret = copy_to_user(out, &ip, min((size_t)size, sizeof(ip))); ++ ret = copy_to_user(out, &ip, min_t(size_t, size, sizeof(ip))); + return ret ? -EFAULT : 0; + } + case AMDGPU_INFO_HW_IP_COUNT: { +@@ -625,17 +626,18 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + ? -EFAULT : 0; + } + case AMDGPU_INFO_READ_MMR_REG: { +- unsigned n, alloc_size; ++ unsigned int n, alloc_size; + uint32_t *regs; +- unsigned se_num = (info->read_mmr_reg.instance >> ++ unsigned int se_num = (info->read_mmr_reg.instance >> + AMDGPU_INFO_MMR_SE_INDEX_SHIFT) & + AMDGPU_INFO_MMR_SE_INDEX_MASK; +- unsigned sh_num = (info->read_mmr_reg.instance >> ++ unsigned int sh_num = (info->read_mmr_reg.instance >> + AMDGPU_INFO_MMR_SH_INDEX_SHIFT) & + AMDGPU_INFO_MMR_SH_INDEX_MASK; + + /* set full masks if the userspace set all bits +- * in the bitfields */ ++ * in the bitfields ++ */ + if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK) + se_num = 0xffffffff; + else if (se_num >= AMDGPU_GFX_MAX_SE) +@@ -766,7 +768,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + min((size_t)size, sizeof(dev_info))) ? -EFAULT : 0; + } + case AMDGPU_INFO_VCE_CLOCK_TABLE: { +- unsigned i; ++ unsigned int i; + struct drm_amdgpu_info_vce_clock_table vce_clk_table = {}; + struct amd_vce_state *vce_state; + +-- +2.40.1 + diff --git a/queue-5.4/drm-amdgpu-use-rmw-accessors-for-changing-lnkctl.patch b/queue-5.4/drm-amdgpu-use-rmw-accessors-for-changing-lnkctl.patch new file mode 100644 index 00000000000..5c8689b17a6 --- /dev/null +++ b/queue-5.4/drm-amdgpu-use-rmw-accessors-for-changing-lnkctl.patch @@ -0,0 +1,144 @@ +From 1a6dcd4ba668662a1268e2e2def583ad82d64282 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:04:57 +0300 +Subject: drm/amdgpu: Use RMW accessors for changing LNKCTL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit ce7d88110b9ed5f33fe79ea6d4ed049fb0e57bce ] + +Don't assume that only the driver would be accessing LNKCTL. ASPM policy +changes can trigger write to LNKCTL outside of driver's control. And in +the case of upstream bridge, the driver does not even own the device it's +changing the registers for. + +Use RMW capability accessors which do proper locking to avoid losing +concurrent updates to the register value. + +Suggested-by: Lukas Wunner +Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts") +Fixes: 62a37553414a ("drm/amdgpu: add si implementation v10") +Link: https://lore.kernel.org/r/20230717120503.15276-6-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Acked-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/cik.c | 36 +++++++++----------------------- + drivers/gpu/drm/amd/amdgpu/si.c | 36 +++++++++----------------------- + 2 files changed, 20 insertions(+), 52 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c +index 38b06ae6357a7..ee7e218c7daef 100644 +--- a/drivers/gpu/drm/amd/amdgpu/cik.c ++++ b/drivers/gpu/drm/amd/amdgpu/cik.c +@@ -1428,17 +1428,8 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &bridge_cfg); +- pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL, +- &gpu_cfg); +- +- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16); +- +- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_set_word(adev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); + + tmp = RREG32_PCIE(ixPCIE_LC_STATUS1); + max_lw = (tmp & PCIE_LC_STATUS1__LC_DETECTED_LINK_WIDTH_MASK) >> +@@ -1491,21 +1482,14 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + msleep(100); + + /* linkctl */ +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, +- tmp16); +- +- pcie_capability_read_word(adev->pdev, +- PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(adev->pdev, +- PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ bridge_cfg & ++ PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_clear_and_set_word(adev->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ gpu_cfg & ++ PCI_EXP_LNKCTL_HAWD); + + /* linkctl2 */ + pcie_capability_read_word(root, PCI_EXP_LNKCTL2, +diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c +index 9f82be879224a..53f7719d688eb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si.c ++++ b/drivers/gpu/drm/amd/amdgpu/si.c +@@ -1676,17 +1676,8 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &bridge_cfg); +- pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL, +- &gpu_cfg); +- +- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16); +- +- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_set_word(adev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); + + tmp = RREG32_PCIE(PCIE_LC_STATUS1); + max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT; +@@ -1731,21 +1722,14 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + + mdelay(100); + +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, +- tmp16); +- +- pcie_capability_read_word(adev->pdev, +- PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(adev->pdev, +- PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ bridge_cfg & ++ PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_clear_and_set_word(adev->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ gpu_cfg & ++ PCI_EXP_LNKCTL_HAWD); + + pcie_capability_read_word(root, PCI_EXP_LNKCTL2, + &tmp16); +-- +2.40.1 + diff --git a/queue-5.4/drm-armada-fix-off-by-one-error-in-armada_overlay_ge.patch b/queue-5.4/drm-armada-fix-off-by-one-error-in-armada_overlay_ge.patch new file mode 100644 index 00000000000..f07545fc321 --- /dev/null +++ b/queue-5.4/drm-armada-fix-off-by-one-error-in-armada_overlay_ge.patch @@ -0,0 +1,52 @@ +From 9051bed1a1487cf112e820b888ea71637bb6a24a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:25:40 +0200 +Subject: drm/armada: Fix off-by-one error in armada_overlay_get_property() + +From: Geert Uytterhoeven + +[ Upstream commit 5f0d984053f74983a287100a9519b2fabb785fb5 ] + +As ffs() returns one more than the index of the first bit set (zero +means no bits set), the color key mode value is shifted one position too +much. + +Fix this by using FIELD_GET() instead. + +Fixes: c96103b6c49ff9a8 ("drm/armada: move colorkey properties into overlay plane state") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Russell King (Oracle) +Signed-off-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/a4d779d954a7515ddbbf31cb0f0d8184c0e7c879.1689600265.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/armada/armada_overlay.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/armada/armada_overlay.c b/drivers/gpu/drm/armada/armada_overlay.c +index 07f0da4d9ba19..8e7c5ce71608f 100644 +--- a/drivers/gpu/drm/armada/armada_overlay.c ++++ b/drivers/gpu/drm/armada/armada_overlay.c +@@ -4,6 +4,8 @@ + * Rewritten from the dovefb driver, and Armada510 manuals. + */ + ++#include ++ + #include + #include + #include +@@ -446,8 +448,8 @@ static int armada_overlay_get_property(struct drm_plane *plane, + drm_to_overlay_state(state)->colorkey_ug, + drm_to_overlay_state(state)->colorkey_vb, 0); + } else if (property == priv->colorkey_mode_prop) { +- *val = (drm_to_overlay_state(state)->colorkey_mode & +- CFG_CKMODE_MASK) >> ffs(CFG_CKMODE_MASK); ++ *val = FIELD_GET(CFG_CKMODE_MASK, ++ drm_to_overlay_state(state)->colorkey_mode); + } else if (property == priv->brightness_prop) { + *val = drm_to_overlay_state(state)->brightness + 256; + } else if (property == priv->contrast_prop) { +-- +2.40.1 + diff --git a/queue-5.4/drm-bridge-tc358764-fix-debug-print-parameter-order.patch b/queue-5.4/drm-bridge-tc358764-fix-debug-print-parameter-order.patch new file mode 100644 index 00000000000..f7926f74358 --- /dev/null +++ b/queue-5.4/drm-bridge-tc358764-fix-debug-print-parameter-order.patch @@ -0,0 +1,40 @@ +From d3cfdbaea2f36f5143a0bb26598a1895ffecc324 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 17:28:17 +0200 +Subject: drm/bridge: tc358764: Fix debug print parameter order + +From: Marek Vasut + +[ Upstream commit 7f947be02aab5b154427cb5b0fffe858fc387b02 ] + +The debug print parameters were swapped in the output and they were +printed as decimal values, both the hardware address and the value. +Update the debug print to print the parameters in correct order, and +use hexadecimal print for both address and value. + +Fixes: f38b7cca6d0e ("drm/bridge: tc358764: Add DSI to LVDS bridge driver") +Signed-off-by: Marek Vasut +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230615152817.359420-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358764.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/tc358764.c b/drivers/gpu/drm/bridge/tc358764.c +index 170f162ffa558..121250473761e 100644 +--- a/drivers/gpu/drm/bridge/tc358764.c ++++ b/drivers/gpu/drm/bridge/tc358764.c +@@ -180,7 +180,7 @@ static void tc358764_read(struct tc358764 *ctx, u16 addr, u32 *val) + if (ret >= 0) + le32_to_cpus(val); + +- dev_dbg(ctx->dev, "read: %d, addr: %d\n", addr, *val); ++ dev_dbg(ctx->dev, "read: addr=0x%04x data=0x%08x\n", addr, *val); + } + + static void tc358764_write(struct tc358764 *ctx, u16 addr, u32 val) +-- +2.40.1 + diff --git a/queue-5.4/drm-etnaviv-fix-dumping-of-active-mmu-context.patch b/queue-5.4/drm-etnaviv-fix-dumping-of-active-mmu-context.patch new file mode 100644 index 00000000000..3d35289b149 --- /dev/null +++ b/queue-5.4/drm-etnaviv-fix-dumping-of-active-mmu-context.patch @@ -0,0 +1,72 @@ +From 7929bb33a015063aef7622c2a1d0f9680eccd9f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 16:38:10 +0200 +Subject: drm/etnaviv: fix dumping of active MMU context + +From: Lucas Stach + +[ Upstream commit 20faf2005ec85fa1a6acc9a74ff27de667f90576 ] + +gpu->mmu_context is the MMU context of the last job in the HW queue, which +isn't necessarily the same as the context from the bad job. Dump the MMU +context from the scheduler determined bad submit to make it work as intended. + +Fixes: 17e4660ae3d7 ("drm/etnaviv: implement per-process address spaces on MMUv2") +Signed-off-by: Lucas Stach +Reviewed-by: Christian Gmeiner +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_dump.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c +index 648cf02073092..67901f4586a3f 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c +@@ -125,9 +125,9 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit) + return; + etnaviv_dump_core = false; + +- mutex_lock(&gpu->mmu_context->lock); ++ mutex_lock(&submit->mmu_context->lock); + +- mmu_size = etnaviv_iommu_dump_size(gpu->mmu_context); ++ mmu_size = etnaviv_iommu_dump_size(submit->mmu_context); + + /* We always dump registers, mmu, ring, hanging cmdbuf and end marker */ + n_obj = 5; +@@ -157,7 +157,7 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit) + iter.start = __vmalloc(file_size, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY, + PAGE_KERNEL); + if (!iter.start) { +- mutex_unlock(&gpu->mmu_context->lock); ++ mutex_unlock(&submit->mmu_context->lock); + dev_warn(gpu->dev, "failed to allocate devcoredump file\n"); + return; + } +@@ -169,18 +169,18 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit) + memset(iter.hdr, 0, iter.data - iter.start); + + etnaviv_core_dump_registers(&iter, gpu); +- etnaviv_core_dump_mmu(&iter, gpu->mmu_context, mmu_size); ++ etnaviv_core_dump_mmu(&iter, submit->mmu_context, mmu_size); + etnaviv_core_dump_mem(&iter, ETDUMP_BUF_RING, gpu->buffer.vaddr, + gpu->buffer.size, + etnaviv_cmdbuf_get_va(&gpu->buffer, +- &gpu->mmu_context->cmdbuf_mapping)); ++ &submit->mmu_context->cmdbuf_mapping)); + + etnaviv_core_dump_mem(&iter, ETDUMP_BUF_CMD, + submit->cmdbuf.vaddr, submit->cmdbuf.size, + etnaviv_cmdbuf_get_va(&submit->cmdbuf, +- &gpu->mmu_context->cmdbuf_mapping)); ++ &submit->mmu_context->cmdbuf_mapping)); + +- mutex_unlock(&gpu->mmu_context->lock); ++ mutex_unlock(&submit->mmu_context->lock); + + /* Reserve space for the bomap */ + if (n_bomap_pages) { +-- +2.40.1 + diff --git a/queue-5.4/drm-mediatek-fix-potential-memory-leak-if-vmap-fail.patch b/queue-5.4/drm-mediatek-fix-potential-memory-leak-if-vmap-fail.patch new file mode 100644 index 00000000000..2baf4d51986 --- /dev/null +++ b/queue-5.4/drm-mediatek-fix-potential-memory-leak-if-vmap-fail.patch @@ -0,0 +1,45 @@ +From bd63d6a24ba604d01c47fba479c6a78c5993743e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 21:40:00 +0800 +Subject: drm/mediatek: Fix potential memory leak if vmap() fail + +From: Sui Jingfeng + +[ Upstream commit 379091e0f6d179d1a084c65de90fa44583b14a70 ] + +Also return -ENOMEM if such a failure happens, the implement should take +responsibility for the error handling. + +Fixes: 3df64d7b0a4f ("drm/mediatek: Implement gem prime vmap/vunmap function") +Reviewed-by: Matthias Brugger +Reviewed-by: Alexandre Mergnat +Signed-off-by: Sui Jingfeng +Reviewed-by: CK Hu +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/dri-devel/patch/20230706134000.130098-1-suijingfeng@loongson.cn/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +index 2fa432287d690..e51394982efb6 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +@@ -267,7 +267,11 @@ void *mtk_drm_gem_prime_vmap(struct drm_gem_object *obj) + } + mtk_gem->kvaddr = vmap(mtk_gem->pages, npages, VM_MAP, + pgprot_writecombine(PAGE_KERNEL)); +- ++ if (!mtk_gem->kvaddr) { ++ kfree(sgt); ++ kfree(mtk_gem->pages); ++ return -ENOMEM; ++ } + out: + kfree(sgt); + +-- +2.40.1 + diff --git a/queue-5.4/drm-msm-mdp5-don-t-leak-some-plane-state.patch b/queue-5.4/drm-msm-mdp5-don-t-leak-some-plane-state.patch new file mode 100644 index 00000000000..8609ae7995f --- /dev/null +++ b/queue-5.4/drm-msm-mdp5-don-t-leak-some-plane-state.patch @@ -0,0 +1,55 @@ +From 2d635f63d65cd5cf784b5605ccde9ab56640b141 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 22:45:21 +0200 +Subject: drm/msm/mdp5: Don't leak some plane state + +From: Daniel Vetter + +[ Upstream commit fd0ad3b2365c1c58aa5a761c18efc4817193beb6 ] + +Apparently no one noticed that mdp5 plane states leak like a sieve +ever since we introduced plane_state->commit refcount a few years ago +in 21a01abbe32a ("drm/atomic: Fix freeing connector/plane state too +early by tracking commits, v3.") + +Fix it by using the right helpers. + +Fixes: 21a01abbe32a ("drm/atomic: Fix freeing connector/plane state too early by tracking commits, v3.") +Cc: Maarten Lankhorst +Cc: Daniel Vetter +Cc: Rob Clark +Cc: Abhinav Kumar +Cc: Dmitry Baryshkov +Cc: linux-arm-msm@vger.kernel.org +Cc: freedreno@lists.freedesktop.org +Reported-and-tested-by: dorum@noisolation.com +Cc: dorum@noisolation.com +Signed-off-by: Daniel Vetter +Reviewed-by: Rob Clark +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/551236/ +Link: https://lore.kernel.org/r/20230803204521.928582-1-daniel.vetter@ffwll.ch +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +index 0dc23c86747e8..e1c1b4ad5ed04 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +@@ -221,8 +221,7 @@ static void mdp5_plane_destroy_state(struct drm_plane *plane, + { + struct mdp5_plane_state *pstate = to_mdp5_plane_state(state); + +- if (state->fb) +- drm_framebuffer_put(state->fb); ++ __drm_atomic_helper_plane_destroy_state(state); + + kfree(pstate); + } +-- +2.40.1 + diff --git a/queue-5.4/drm-panel-simple-add-missing-connector-type-and-pixe.patch b/queue-5.4/drm-panel-simple-add-missing-connector-type-and-pixe.patch new file mode 100644 index 00000000000..8bb8609263b --- /dev/null +++ b/queue-5.4/drm-panel-simple-add-missing-connector-type-and-pixe.patch @@ -0,0 +1,41 @@ +From 2d13b3203d383e78dfa1b6762221fd9d552265ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jul 2023 15:49:14 +0200 +Subject: drm/panel: simple: Add missing connector type and pixel format for + AUO T215HVN01 + +From: Marek Vasut + +[ Upstream commit 7a675a8fa598edb29a664a91adb80f0340649f6f ] + +The connector type and pixel format are missing for this panel, +add them to prevent various drivers from failing to determine +either of those parameters. + +Fixes: 7ee933a1d5c4 ("drm/panel: simple: Add support for AUO T215HVN01") +Signed-off-by: Marek Vasut +Reviewed-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20230709134914.449328-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index a87b79c8d76f7..63d17607ef89c 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -919,7 +919,9 @@ static const struct panel_desc auo_t215hvn01 = { + .delay = { + .disable = 5, + .unprepare = 1000, +- } ++ }, ++ .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, ++ .connector_type = DRM_MODE_CONNECTOR_LVDS, + }; + + static const struct drm_display_mode avic_tm070ddh03_mode = { +-- +2.40.1 + diff --git a/queue-5.4/drm-radeon-correct-transmit-margin-masks.patch b/queue-5.4/drm-radeon-correct-transmit-margin-masks.patch new file mode 100644 index 00000000000..73b4bd3f3c8 --- /dev/null +++ b/queue-5.4/drm-radeon-correct-transmit-margin-masks.patch @@ -0,0 +1,73 @@ +From dbc75eb4ec358989a511dea1fd2c0dee4a69296b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Nov 2019 17:54:13 -0600 +Subject: drm/radeon: Correct Transmit Margin masks + +From: Bjorn Helgaas + +[ Upstream commit 40bd4be5a652ce56068a8273b68caa38cb0d8f4b ] + +Previously we masked PCIe Link Control 2 register values with "7 << 9", +which was apparently intended to be the Transmit Margin field, but instead +was the high order bit of Transmit Margin, the Enter Modified Compliance +bit, and the Compliance SOS bit. + +Correct the mask to "7 << 7", which is the Transmit Margin field. + +Link: https://lore.kernel.org/r/20191112173503.176611-3-helgaas@kernel.org +Signed-off-by: Bjorn Helgaas +Reviewed-by: Alex Deucher +Stable-dep-of: 7189576e8a82 ("drm/radeon: Use RMW accessors for changing LNKCTL") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/cik.c | 8 ++++---- + drivers/gpu/drm/radeon/si.c | 8 ++++---- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index 897442754fd03..3ab8dae8aa3c3 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -9619,13 +9619,13 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + + /* linkctl2 */ + pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9))); ++ tmp16 &= ~((1 << 4) | (7 << 7)); ++ tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7))); + pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); + + pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9))); ++ tmp16 &= ~((1 << 4) | (7 << 7)); ++ tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7))); + pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index 1d8efb0eefdb4..e28e1486e070c 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -7202,13 +7202,13 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + + /* linkctl2 */ + pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9))); ++ tmp16 &= ~((1 << 4) | (7 << 7)); ++ tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7))); + pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); + + pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 9)); +- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9))); ++ tmp16 &= ~((1 << 4) | (7 << 7)); ++ tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7))); + pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); +-- +2.40.1 + diff --git a/queue-5.4/drm-radeon-prefer-pcie_capability_read_word.patch b/queue-5.4/drm-radeon-prefer-pcie_capability_read_word.patch new file mode 100644 index 00000000000..979a054e280 --- /dev/null +++ b/queue-5.4/drm-radeon-prefer-pcie_capability_read_word.patch @@ -0,0 +1,339 @@ +From 846275e25e22f48a53fde4e07bc7a7b30073c893 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Nov 2019 18:35:13 -0600 +Subject: drm/radeon: Prefer pcie_capability_read_word() + +From: Frederick Lawler + +[ Upstream commit 3d581b11e34a92350983e5d3ecf469b5c677e295 ] + +Commit 8c0d3a02c130 ("PCI: Add accessors for PCI Express Capability") +added accessors for the PCI Express Capability so that drivers didn't +need to be aware of differences between v1 and v2 of the PCI +Express Capability. + +Replace pci_read_config_word() and pci_write_config_word() calls with +pcie_capability_read_word() and pcie_capability_write_word(). + +Link: https://lore.kernel.org/r/20191118003513.10852-1-fred@fredlawl.com +Signed-off-by: Frederick Lawler +Signed-off-by: Bjorn Helgaas +Reviewed-by: Alex Deucher +Stable-dep-of: 7189576e8a82 ("drm/radeon: Use RMW accessors for changing LNKCTL") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/cik.c | 70 +++++++++++++++++++++------------- + drivers/gpu/drm/radeon/si.c | 73 +++++++++++++++++++++++------------- + 2 files changed, 90 insertions(+), 53 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index 816976f44fffb..6476f901b63e6 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -9504,7 +9504,6 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + { + struct pci_dev *root = rdev->pdev->bus->self; + enum pci_bus_speed speed_cap; +- int bridge_pos, gpu_pos; + u32 speed_cntl, current_data_rate; + int i; + u16 tmp16; +@@ -9546,12 +9545,7 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + DRM_INFO("enabling PCIE gen 2 link speeds, disable with radeon.pcie_gen2=0\n"); + } + +- bridge_pos = pci_pcie_cap(root); +- if (!bridge_pos) +- return; +- +- gpu_pos = pci_pcie_cap(rdev->pdev); +- if (!gpu_pos) ++ if (!pci_is_pcie(root) || !pci_is_pcie(rdev->pdev)) + return; + + if (speed_cap == PCIE_SPEED_8_0GT) { +@@ -9561,14 +9555,17 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &bridge_cfg); ++ pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL, ++ &gpu_cfg); + + tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16); + + tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL, ++ tmp16); + + tmp = RREG32_PCIE_PORT(PCIE_LC_STATUS1); + max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT; +@@ -9586,15 +9583,23 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + + for (i = 0; i < 10; i++) { + /* check status */ +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_DEVSTA, ++ &tmp16); + if (tmp16 & PCI_EXP_DEVSTA_TRPND) + break; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &bridge_cfg); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL, ++ &gpu_cfg); + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2); +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &bridge_cfg2); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL2, ++ &gpu_cfg2); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); + tmp |= LC_SET_QUIESCE; +@@ -9607,32 +9612,45 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + msleep(100); + + /* linkctl */ +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &tmp16); + tmp16 &= ~PCI_EXP_LNKCTL_HAWD; + tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(root, PCI_EXP_LNKCTL, ++ tmp16); + +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL, ++ &tmp16); + tmp16 &= ~PCI_EXP_LNKCTL_HAWD; + tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(rdev->pdev, ++ PCI_EXP_LNKCTL, ++ tmp16); + + /* linkctl2 */ +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &tmp16); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN); + tmp16 |= (bridge_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN)); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_write_word(root, ++ PCI_EXP_LNKCTL2, ++ tmp16); + +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL2, ++ &tmp16); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN); + tmp16 |= (gpu_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN)); +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_write_word(rdev->pdev, ++ PCI_EXP_LNKCTL2, ++ tmp16); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); + tmp &= ~LC_SET_QUIESCE; +@@ -9646,7 +9664,7 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + speed_cntl &= ~LC_FORCE_DIS_SW_SPEED_CHANGE; + WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl); + +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); ++ pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL2, &tmp16); + tmp16 &= ~PCI_EXP_LNKCTL2_TLS; + if (speed_cap == PCIE_SPEED_8_0GT) + tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */ +@@ -9654,7 +9672,7 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */ + else + tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */ +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL2, tmp16); + + speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL); + speed_cntl |= LC_INITIATE_LINK_SPEED_CHANGE; +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index 21ac174e21f50..d7eea75b2c277 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -3257,7 +3257,7 @@ static void si_gpu_init(struct radeon_device *rdev) + /* XXX what about 12? */ + rdev->config.si.tile_config |= (3 << 0); + break; +- } ++ } + switch ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) { + case 0: /* four banks */ + rdev->config.si.tile_config |= 0 << 4; +@@ -7087,7 +7087,6 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + { + struct pci_dev *root = rdev->pdev->bus->self; + enum pci_bus_speed speed_cap; +- int bridge_pos, gpu_pos; + u32 speed_cntl, current_data_rate; + int i; + u16 tmp16; +@@ -7129,12 +7128,7 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + DRM_INFO("enabling PCIE gen 2 link speeds, disable with radeon.pcie_gen2=0\n"); + } + +- bridge_pos = pci_pcie_cap(root); +- if (!bridge_pos) +- return; +- +- gpu_pos = pci_pcie_cap(rdev->pdev); +- if (!gpu_pos) ++ if (!pci_is_pcie(root) || !pci_is_pcie(rdev->pdev)) + return; + + if (speed_cap == PCIE_SPEED_8_0GT) { +@@ -7144,14 +7138,17 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &bridge_cfg); ++ pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL, ++ &gpu_cfg); + + tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16); + + tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL, ++ tmp16); + + tmp = RREG32_PCIE(PCIE_LC_STATUS1); + max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT; +@@ -7169,15 +7166,23 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + + for (i = 0; i < 10; i++) { + /* check status */ +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_DEVSTA, ++ &tmp16); + if (tmp16 & PCI_EXP_DEVSTA_TRPND) + break; + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg); +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &bridge_cfg); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL, ++ &gpu_cfg); + +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2); +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &bridge_cfg2); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL2, ++ &gpu_cfg2); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); + tmp |= LC_SET_QUIESCE; +@@ -7190,32 +7195,46 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + msleep(100); + + /* linkctl */ +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL, ++ &tmp16); + tmp16 &= ~PCI_EXP_LNKCTL_HAWD; + tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(root, ++ PCI_EXP_LNKCTL, ++ tmp16); + +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL, ++ &tmp16); + tmp16 &= ~PCI_EXP_LNKCTL_HAWD; + tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16); ++ pcie_capability_write_word(rdev->pdev, ++ PCI_EXP_LNKCTL, ++ tmp16); + + /* linkctl2 */ +- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); ++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2, ++ &tmp16); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN); + tmp16 |= (bridge_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN)); +- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_write_word(root, ++ PCI_EXP_LNKCTL2, ++ tmp16); + +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); ++ pcie_capability_read_word(rdev->pdev, ++ PCI_EXP_LNKCTL2, ++ &tmp16); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN); + tmp16 |= (gpu_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | + PCI_EXP_LNKCTL2_TX_MARGIN)); +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_write_word(rdev->pdev, ++ PCI_EXP_LNKCTL2, ++ tmp16); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); + tmp &= ~LC_SET_QUIESCE; +@@ -7229,7 +7248,7 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + speed_cntl &= ~LC_FORCE_DIS_SW_SPEED_CHANGE; + WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl); + +- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); ++ pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL2, &tmp16); + tmp16 &= ~PCI_EXP_LNKCTL2_TLS; + if (speed_cap == PCIE_SPEED_8_0GT) + tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */ +@@ -7237,7 +7256,7 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */ + else + tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */ +- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); ++ pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL2, tmp16); + + speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL); + speed_cntl |= LC_INITIATE_LINK_SPEED_CHANGE; +-- +2.40.1 + diff --git a/queue-5.4/drm-radeon-replace-numbers-with-pci_exp_lnkctl2-defi.patch b/queue-5.4/drm-radeon-replace-numbers-with-pci_exp_lnkctl2-defi.patch new file mode 100644 index 00000000000..84c8fb14c9c --- /dev/null +++ b/queue-5.4/drm-radeon-replace-numbers-with-pci_exp_lnkctl2-defi.patch @@ -0,0 +1,117 @@ +From 18f2587fe43078ab18e494d0c057a76224162cca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Nov 2019 07:24:24 -0600 +Subject: drm/radeon: Replace numbers with PCI_EXP_LNKCTL2 definitions + +From: Bjorn Helgaas + +[ Upstream commit ca56f99c18cafdeae6961ce9d87fc978506152ca ] + +Replace hard-coded magic numbers with the descriptive PCI_EXP_LNKCTL2 +definitions. No functional change intended. + +Link: https://lore.kernel.org/r/20191112173503.176611-4-helgaas@kernel.org +Signed-off-by: Bjorn Helgaas +Reviewed-by: Alex Deucher +Stable-dep-of: 7189576e8a82 ("drm/radeon: Use RMW accessors for changing LNKCTL") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/cik.c | 22 ++++++++++++++-------- + drivers/gpu/drm/radeon/si.c | 22 ++++++++++++++-------- + 2 files changed, 28 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index 3ab8dae8aa3c3..816976f44fffb 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -9619,13 +9619,19 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + + /* linkctl2 */ + pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 7)); +- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7))); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (bridge_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); + pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); + + pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 7)); +- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7))); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (gpu_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); + pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); +@@ -9641,13 +9647,13 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl); + + pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~0xf; ++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS; + if (speed_cap == PCIE_SPEED_8_0GT) +- tmp16 |= 3; /* gen3 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */ + else if (speed_cap == PCIE_SPEED_5_0GT) +- tmp16 |= 2; /* gen2 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */ + else +- tmp16 |= 1; /* gen1 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */ + pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); + + speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL); +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index e28e1486e070c..21ac174e21f50 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -7202,13 +7202,19 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + + /* linkctl2 */ + pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 7)); +- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 7))); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (bridge_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); + pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16); + + pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~((1 << 4) | (7 << 7)); +- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 7))); ++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN); ++ tmp16 |= (gpu_cfg2 & ++ (PCI_EXP_LNKCTL2_ENTER_COMP | ++ PCI_EXP_LNKCTL2_TX_MARGIN)); + pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); + + tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4); +@@ -7224,13 +7230,13 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl); + + pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); +- tmp16 &= ~0xf; ++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS; + if (speed_cap == PCIE_SPEED_8_0GT) +- tmp16 |= 3; /* gen3 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */ + else if (speed_cap == PCIE_SPEED_5_0GT) +- tmp16 |= 2; /* gen2 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */ + else +- tmp16 |= 1; /* gen1 */ ++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */ + pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16); + + speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL); +-- +2.40.1 + diff --git a/queue-5.4/drm-radeon-use-rmw-accessors-for-changing-lnkctl.patch b/queue-5.4/drm-radeon-use-rmw-accessors-for-changing-lnkctl.patch new file mode 100644 index 00000000000..5260936d4b3 --- /dev/null +++ b/queue-5.4/drm-radeon-use-rmw-accessors-for-changing-lnkctl.patch @@ -0,0 +1,145 @@ +From 37149a592cc61316601cd22450464d79718329a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:04:58 +0300 +Subject: drm/radeon: Use RMW accessors for changing LNKCTL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 7189576e8a829130192b33c5b64e8a475369c776 ] + +Don't assume that only the driver would be accessing LNKCTL. ASPM policy +changes can trigger write to LNKCTL outside of driver's control. And in +the case of upstream bridge, the driver does not even own the device it's +changing the registers for. + +Use RMW capability accessors which do proper locking to avoid losing +concurrent updates to the register value. + +Suggested-by: Lukas Wunner +Fixes: 8a7cd27679d0 ("drm/radeon/cik: add support for pcie gen1/2/3 switching") +Fixes: b9d305dfb66c ("drm/radeon: implement pcie gen2/3 support for SI") +Link: https://lore.kernel.org/r/20230717120503.15276-7-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Acked-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/cik.c | 36 ++++++++++------------------------- + drivers/gpu/drm/radeon/si.c | 37 ++++++++++-------------------------- + 2 files changed, 20 insertions(+), 53 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index 6476f901b63e6..c338bb82a1226 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -9555,17 +9555,8 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &bridge_cfg); +- pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL, +- &gpu_cfg); +- +- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16); +- +- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_set_word(rdev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); + + tmp = RREG32_PCIE_PORT(PCIE_LC_STATUS1); + max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT; +@@ -9612,21 +9603,14 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) + msleep(100); + + /* linkctl */ +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, +- tmp16); +- +- pcie_capability_read_word(rdev->pdev, +- PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(rdev->pdev, +- PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ bridge_cfg & ++ PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_clear_and_set_word(rdev->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ gpu_cfg & ++ PCI_EXP_LNKCTL_HAWD); + + /* linkctl2 */ + pcie_capability_read_word(root, PCI_EXP_LNKCTL2, +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index d7eea75b2c277..74cbed9377f09 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -7138,17 +7138,8 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + u16 bridge_cfg2, gpu_cfg2; + u32 max_lw, current_lw, tmp; + +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &bridge_cfg); +- pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL, +- &gpu_cfg); +- +- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16); +- +- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD; +- pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_set_word(rdev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD); + + tmp = RREG32_PCIE(PCIE_LC_STATUS1); + max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT; +@@ -7195,22 +7186,14 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev) + msleep(100); + + /* linkctl */ +- pcie_capability_read_word(root, PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(root, +- PCI_EXP_LNKCTL, +- tmp16); +- +- pcie_capability_read_word(rdev->pdev, +- PCI_EXP_LNKCTL, +- &tmp16); +- tmp16 &= ~PCI_EXP_LNKCTL_HAWD; +- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD); +- pcie_capability_write_word(rdev->pdev, +- PCI_EXP_LNKCTL, +- tmp16); ++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ bridge_cfg & ++ PCI_EXP_LNKCTL_HAWD); ++ pcie_capability_clear_and_set_word(rdev->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_HAWD, ++ gpu_cfg & ++ PCI_EXP_LNKCTL_HAWD); + + /* linkctl2 */ + pcie_capability_read_word(root, PCI_EXP_LNKCTL2, +-- +2.40.1 + diff --git a/queue-5.4/drm-tegra-dpaux-fix-incorrect-return-value-of-platfo.patch b/queue-5.4/drm-tegra-dpaux-fix-incorrect-return-value-of-platfo.patch new file mode 100644 index 00000000000..96ba34e7be1 --- /dev/null +++ b/queue-5.4/drm-tegra-dpaux-fix-incorrect-return-value-of-platfo.patch @@ -0,0 +1,37 @@ +From 547b76e8d647e5c24a08b12234a8cdeda0c83305 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jul 2023 11:23:49 +0800 +Subject: drm/tegra: dpaux: Fix incorrect return value of platform_get_irq + +From: Yangtao Li + +[ Upstream commit 2a1ca44b654346cadfc538c4fb32eecd8daf3140 ] + +When platform_get_irq fails, we should return dpaux->irq +instead of -ENXIO. + +Fixes: 6b6b604215c6 ("drm/tegra: Add eDP support") +Signed-off-by: Yangtao Li +Signed-off-by: Thierry Reding +Link: https://patchwork.freedesktop.org/patch/msgid/20230710032355.72914-13-frank.li@vivo.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/dpaux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c +index 304434bf10814..a84d19087d094 100644 +--- a/drivers/gpu/drm/tegra/dpaux.c ++++ b/drivers/gpu/drm/tegra/dpaux.c +@@ -448,7 +448,7 @@ static int tegra_dpaux_probe(struct platform_device *pdev) + + dpaux->irq = platform_get_irq(pdev, 0); + if (dpaux->irq < 0) +- return -ENXIO; ++ return dpaux->irq; + + if (!pdev->dev.pm_domain) { + dpaux->rst = devm_reset_control_get(&pdev->dev, "dpaux"); +-- +2.40.1 + diff --git a/queue-5.4/drm-tegra-remove-superfluous-error-messages-around-p.patch b/queue-5.4/drm-tegra-remove-superfluous-error-messages-around-p.patch new file mode 100644 index 00000000000..f1358a9860e --- /dev/null +++ b/queue-5.4/drm-tegra-remove-superfluous-error-messages-around-p.patch @@ -0,0 +1,41 @@ +From e55b2a0d41785a230be90a49c03503fcefc23b4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 14:39:55 +0800 +Subject: drm/tegra: Remove superfluous error messages around + platform_get_irq() + +From: Tan Zhongjun + +[ Upstream commit d12919bb5da571ec50588ef97683d37e36dc2de5 ] + +The platform_get_irq() prints error message telling that interrupt is +missing,hence there is no need to duplicated that message in the +drivers. + +Signed-off-by: Tan Zhongjun +Signed-off-by: Thierry Reding +Stable-dep-of: 2a1ca44b6543 ("drm/tegra: dpaux: Fix incorrect return value of platform_get_irq") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/dpaux.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c +index a0f6f9b0d2585..304434bf10814 100644 +--- a/drivers/gpu/drm/tegra/dpaux.c ++++ b/drivers/gpu/drm/tegra/dpaux.c +@@ -447,10 +447,8 @@ static int tegra_dpaux_probe(struct platform_device *pdev) + return PTR_ERR(dpaux->regs); + + dpaux->irq = platform_get_irq(pdev, 0); +- if (dpaux->irq < 0) { +- dev_err(&pdev->dev, "failed to get IRQ\n"); ++ if (dpaux->irq < 0) + return -ENXIO; +- } + + if (!pdev->dev.pm_domain) { + dpaux->rst = devm_reset_control_get(&pdev->dev, "dpaux"); +-- +2.40.1 + diff --git a/queue-5.4/eventfd-export-eventfd_ctx_do_read.patch b/queue-5.4/eventfd-export-eventfd_ctx_do_read.patch new file mode 100644 index 00000000000..c217569e720 --- /dev/null +++ b/queue-5.4/eventfd-export-eventfd_ctx_do_read.patch @@ -0,0 +1,75 @@ +From 85ababaf725eac4731210e70850f5c4630293644 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 13:55:21 +0000 +Subject: eventfd: Export eventfd_ctx_do_read() + +From: David Woodhouse + +[ Upstream commit 28f1326710555bbe666f64452d08f2d7dd657cae ] + +Where events are consumed in the kernel, for example by KVM's +irqfd_wakeup() and VFIO's virqfd_wakeup(), they currently lack a +mechanism to drain the eventfd's counter. + +Since the wait queue is already locked while the wakeup functions are +invoked, all they really need to do is call eventfd_ctx_do_read(). + +Add a check for the lock, and export it for them. + +Signed-off-by: David Woodhouse +Message-Id: <20201027135523.646811-2-dwmw2@infradead.org> +Signed-off-by: Paolo Bonzini +Stable-dep-of: 758b49204781 ("eventfd: prevent underflow for eventfd semaphores") +Signed-off-by: Sasha Levin +--- + fs/eventfd.c | 5 ++++- + include/linux/eventfd.h | 6 ++++++ + 2 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/fs/eventfd.c b/fs/eventfd.c +index 78e41c7c3d05b..26b3d821e9168 100644 +--- a/fs/eventfd.c ++++ b/fs/eventfd.c +@@ -181,11 +181,14 @@ static __poll_t eventfd_poll(struct file *file, poll_table *wait) + return events; + } + +-static void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt) ++void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt) + { ++ lockdep_assert_held(&ctx->wqh.lock); ++ + *cnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count; + ctx->count -= *cnt; + } ++EXPORT_SYMBOL_GPL(eventfd_ctx_do_read); + + /** + * eventfd_ctx_remove_wait_queue - Read the current counter and removes wait queue. +diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h +index 3482f9365a4db..de0ad39d4281f 100644 +--- a/include/linux/eventfd.h ++++ b/include/linux/eventfd.h +@@ -41,6 +41,7 @@ struct eventfd_ctx *eventfd_ctx_fileget(struct file *file); + __u64 eventfd_signal(struct eventfd_ctx *ctx, __u64 n); + int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_entry_t *wait, + __u64 *cnt); ++void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt); + + DECLARE_PER_CPU(int, eventfd_wake_count); + +@@ -82,6 +83,11 @@ static inline bool eventfd_signal_count(void) + return false; + } + ++static inline void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt) ++{ ++ ++} ++ + #endif + + #endif /* _LINUX_EVENTFD_H */ +-- +2.40.1 + diff --git a/queue-5.4/eventfd-prevent-underflow-for-eventfd-semaphores.patch b/queue-5.4/eventfd-prevent-underflow-for-eventfd-semaphores.patch new file mode 100644 index 00000000000..3cafddb9960 --- /dev/null +++ b/queue-5.4/eventfd-prevent-underflow-for-eventfd-semaphores.patch @@ -0,0 +1,76 @@ +From 402dc33a5a9cc32da46f664f02f6ed58779743aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jul 2023 14:54:51 +0800 +Subject: eventfd: prevent underflow for eventfd semaphores + +From: Wen Yang + +[ Upstream commit 758b492047816a3158d027e9fca660bc5bcf20bf ] + +For eventfd with flag EFD_SEMAPHORE, when its ctx->count is 0, calling +eventfd_ctx_do_read will cause ctx->count to overflow to ULLONG_MAX. + +An underflow can happen with EFD_SEMAPHORE eventfds in at least the +following three subsystems: + +(1) virt/kvm/eventfd.c +(2) drivers/vfio/virqfd.c +(3) drivers/virt/acrn/irqfd.c + +where (2) and (3) are just modeled after (1). An eventfd must be +specified for use with the KVM_IRQFD ioctl(). This can also be an +EFD_SEMAPHORE eventfd. When the eventfd count is zero or has been +decremented to zero an underflow can be triggered when the irqfd is shut +down by raising the KVM_IRQFD_FLAG_DEASSIGN flag in the KVM_IRQFD +ioctl(): + + // ctx->count == 0 + kvm_vm_ioctl() + -> kvm_irqfd() + -> kvm_irqfd_deassign() + -> irqfd_deactivate() + -> irqfd_shutdown() + -> eventfd_ctx_remove_wait_queue(&cnt) + -> eventfd_ctx_do_read(&cnt) + +Userspace polling on the eventfd wouldn't notice the underflow because 1 +is always returned as the value from eventfd_read() while ctx->count +would've underflowed. It's not a huge deal because this should only be +happening when the irqfd is shutdown but we should still fix it and +avoid the spurious wakeup. + +Fixes: cb289d6244a3 ("eventfd - allow atomic read and waitqueue remove") +Signed-off-by: Wen Yang +Cc: Alexander Viro +Cc: Jens Axboe +Cc: Christian Brauner +Cc: Christoph Hellwig +Cc: Dylan Yudaken +Cc: David Woodhouse +Cc: Matthew Wilcox +Cc: linux-fsdevel@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Message-Id: +[brauner: rewrite commit message and add explanation how this underflow can happen] +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/eventfd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/eventfd.c b/fs/eventfd.c +index 26b3d821e9168..e144094c831df 100644 +--- a/fs/eventfd.c ++++ b/fs/eventfd.c +@@ -185,7 +185,7 @@ void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt) + { + lockdep_assert_held(&ctx->wqh.lock); + +- *cnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count; ++ *cnt = ((ctx->flags & EFD_SEMAPHORE) && ctx->count) ? 1 : ctx->count; + ctx->count -= *cnt; + } + EXPORT_SYMBOL_GPL(eventfd_ctx_do_read); +-- +2.40.1 + diff --git a/queue-5.4/fs-fix-error-checking-for-d_hash_and_lookup.patch b/queue-5.4/fs-fix-error-checking-for-d_hash_and_lookup.patch new file mode 100644 index 00000000000..285dcc18ad1 --- /dev/null +++ b/queue-5.4/fs-fix-error-checking-for-d_hash_and_lookup.patch @@ -0,0 +1,38 @@ +From 97e25dbb02abc562b6ffc5a5a57ef2343c38c321 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 20:05:42 +0800 +Subject: fs: Fix error checking for d_hash_and_lookup() + +From: Wang Ming + +[ Upstream commit 0d5a4f8f775ff990142cdc810a84eae078589d27 ] + +The d_hash_and_lookup() function returns error pointers or NULL. +Most incorrect error checks were fixed, but the one in int path_pts() +was forgotten. + +Fixes: eedf265aa003 ("devpts: Make each mount of devpts an independent filesystem.") +Signed-off-by: Wang Ming +Message-Id: <20230713120555.7025-1-machel@vivo.com> +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/namei.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/namei.c b/fs/namei.c +index 21988d22399f9..f6708ab8ec7ed 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -2603,7 +2603,7 @@ int path_pts(struct path *path) + this.name = "pts"; + this.len = 3; + child = d_hash_and_lookup(parent, &this); +- if (!child) ++ if (IS_ERR_OR_NULL(child)) + return -ENOENT; + + path->dentry = child; +-- +2.40.1 + diff --git a/queue-5.4/fs-lockd-avoid-possible-wrong-null-parameter.patch b/queue-5.4/fs-lockd-avoid-possible-wrong-null-parameter.patch new file mode 100644 index 00000000000..c944f33a971 --- /dev/null +++ b/queue-5.4/fs-lockd-avoid-possible-wrong-null-parameter.patch @@ -0,0 +1,43 @@ +From 9ba8fe7c3a7152862b2887e4172782781a952c7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 09:26:57 +0800 +Subject: fs: lockd: avoid possible wrong NULL parameter + +From: Su Hui + +[ Upstream commit de8d38cf44bac43e83bad28357ba84784c412752 ] + +clang's static analysis warning: fs/lockd/mon.c: line 293, column 2: +Null pointer passed as 2nd argument to memory copy function. + +Assuming 'hostname' is NULL and calling 'nsm_create_handle()', this will +pass NULL as 2nd argument to memory copy function 'memcpy()'. So return +NULL if 'hostname' is invalid. + +Fixes: 77a3ef33e2de ("NSM: More clean up of nsm_get_handle()") +Signed-off-by: Su Hui +Reviewed-by: Nick Desaulniers +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/lockd/mon.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c +index 1eabd91870e6f..d770a41f85695 100644 +--- a/fs/lockd/mon.c ++++ b/fs/lockd/mon.c +@@ -276,6 +276,9 @@ static struct nsm_handle *nsm_create_handle(const struct sockaddr *sap, + { + struct nsm_handle *new; + ++ if (!hostname) ++ return NULL; ++ + new = kzalloc(sizeof(*new) + hostname_len + 1, GFP_KERNEL); + if (unlikely(new == NULL)) + return NULL; +-- +2.40.1 + diff --git a/queue-5.4/fs-ocfs2-namei-check-return-value-of-ocfs2_add_entry.patch b/queue-5.4/fs-ocfs2-namei-check-return-value-of-ocfs2_add_entry.patch new file mode 100644 index 00000000000..188cf332b96 --- /dev/null +++ b/queue-5.4/fs-ocfs2-namei-check-return-value-of-ocfs2_add_entry.patch @@ -0,0 +1,50 @@ +From ebe0b4852246fb3714ce304683385ba9c4c62a12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 17:54:17 +0300 +Subject: fs: ocfs2: namei: check return value of ocfs2_add_entry() + +From: Artem Chernyshev + +[ Upstream commit 6b72e5f9e79360fce4f2be7fe81159fbdf4256a5 ] + +Process result of ocfs2_add_entry() in case we have an error +value. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Link: https://lkml.kernel.org/r/20230803145417.177649-1-artem.chernyshev@red-soft.ru +Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem") +Signed-off-by: Artem Chernyshev +Reviewed-by: Joseph Qi +Cc: Artem Chernyshev +Cc: Joel Becker +Cc: Kurt Hackel +Cc: Mark Fasheh +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/namei.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c +index fb284bf3aed15..cd6a214398266 100644 +--- a/fs/ocfs2/namei.c ++++ b/fs/ocfs2/namei.c +@@ -1524,6 +1524,10 @@ static int ocfs2_rename(struct inode *old_dir, + status = ocfs2_add_entry(handle, new_dentry, old_inode, + OCFS2_I(old_inode)->ip_blkno, + new_dir_bh, &target_insert); ++ if (status < 0) { ++ mlog_errno(status); ++ goto bail; ++ } + } + + old_inode->i_ctime = current_time(old_inode); +-- +2.40.1 + diff --git a/queue-5.4/hid-logitech-dj-fix-error-handling-in-logi_dj_recv_s.patch b/queue-5.4/hid-logitech-dj-fix-error-handling-in-logi_dj_recv_s.patch new file mode 100644 index 00000000000..b4b61cb9178 --- /dev/null +++ b/queue-5.4/hid-logitech-dj-fix-error-handling-in-logi_dj_recv_s.patch @@ -0,0 +1,55 @@ +From bab8f627fef34441b9d4fcb9e3a43470f44274bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 03:16:35 -0700 +Subject: HID: logitech-dj: Fix error handling in + logi_dj_recv_switch_to_dj_mode() + +From: Nikita Zhandarovich + +[ Upstream commit 6f20d3261265885f6a6be4cda49d7019728760e0 ] + +Presently, if a call to logi_dj_recv_send_report() fails, we do +not learn about the error until after sending short +HID_OUTPUT_REPORT with hid_hw_raw_request(). +To handle this somewhat unlikely issue, return on error in +logi_dj_recv_send_report() (minding ugly sleep workaround) and +take into account the result of hid_hw_raw_request(). + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 6a9ddc897883 ("HID: logitech-dj: enable notifications on connect/disconnect") +Signed-off-by: Nikita Zhandarovich +Link: https://lore.kernel.org/r/20230613101635.77820-1-n.zhandarovich@fintech.ru +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-dj.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c +index a663cbb7b6832..0c2aa9024b878 100644 +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -1212,6 +1212,9 @@ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev, + * 50 msec should gives enough time to the receiver to be ready. + */ + msleep(50); ++ ++ if (retval) ++ return retval; + } + + /* +@@ -1233,7 +1236,7 @@ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev, + buf[5] = 0x09; + buf[6] = 0x00; + +- hid_hw_raw_request(hdev, REPORT_ID_HIDPP_SHORT, buf, ++ retval = hid_hw_raw_request(hdev, REPORT_ID_HIDPP_SHORT, buf, + HIDPP_REPORT_SHORT_LENGTH, HID_OUTPUT_REPORT, + HID_REQ_SET_REPORT); + +-- +2.40.1 + diff --git a/queue-5.4/hid-multitouch-correct-devm-device-reference-for-hid.patch b/queue-5.4/hid-multitouch-correct-devm-device-reference-for-hid.patch new file mode 100644 index 00000000000..8189b35fd80 --- /dev/null +++ b/queue-5.4/hid-multitouch-correct-devm-device-reference-for-hid.patch @@ -0,0 +1,67 @@ +From 750727c8fba5ccbb94e82d2d79fc68d7abd507e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 06:14:33 +0000 +Subject: HID: multitouch: Correct devm device reference for hidinput input_dev + name + +From: Rahul Rameshbabu + +[ Upstream commit 4794394635293a3e74591351fff469cea7ad15a2 ] + +Reference the HID device rather than the input device for the devm +allocation of the input_dev name. Referencing the input_dev would lead to a +use-after-free when the input_dev was unregistered and subsequently fires a +uevent that depends on the name. At the point of firing the uevent, the +name would be freed by devres management. + +Use devm_kasprintf to simplify the logic for allocating memory and +formatting the input_dev name string. + +Reported-by: Maxime Ripard +Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92520f74b6cf6ffa8653f9c92643d4ae +Fixes: c08d46aa805b ("HID: multitouch: devm conversion") +Suggested-by: Maxime Ripard +Suggested-by: Dmitry Torokhov +Signed-off-by: Rahul Rameshbabu +Reviewed-by: Maxime Ripard +Link: https://lore.kernel.org/r/20230824061308.222021-3-sergeantsagara@protonmail.com +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 9db327654580c..0893b31e6f102 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1548,7 +1548,6 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app) + static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) + { + struct mt_device *td = hid_get_drvdata(hdev); +- char *name; + const char *suffix = NULL; + struct mt_report_data *rdata; + struct mt_application *mt_application = NULL; +@@ -1602,15 +1601,9 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) + break; + } + +- if (suffix) { +- name = devm_kzalloc(&hi->input->dev, +- strlen(hdev->name) + strlen(suffix) + 2, +- GFP_KERNEL); +- if (name) { +- sprintf(name, "%s %s", hdev->name, suffix); +- hi->input->name = name; +- } +- } ++ if (suffix) ++ hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, ++ "%s %s", hdev->name, suffix); + + return 0; + } +-- +2.40.1 + diff --git a/queue-5.4/hwrng-iproc-rng200-implement-suspend-and-resume-call.patch b/queue-5.4/hwrng-iproc-rng200-implement-suspend-and-resume-call.patch new file mode 100644 index 00000000000..edbea4d3453 --- /dev/null +++ b/queue-5.4/hwrng-iproc-rng200-implement-suspend-and-resume-call.patch @@ -0,0 +1,75 @@ +From df554dfcbd3ac64fd48ea916c8828df67086a8a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 12:22:08 -0700 +Subject: hwrng: iproc-rng200 - Implement suspend and resume calls + +From: Florian Fainelli + +[ Upstream commit 8e03dd62e5be811efbf0cbeba47e79e793519105 ] + +Chips such as BCM7278 support system wide suspend/resume which will +cause the HWRNG block to lose its state and reset to its power on reset +register values. We need to cleanup and re-initialize the HWRNG for it +to be functional coming out of a system suspend cycle. + +Fixes: c3577f6100ca ("hwrng: iproc-rng200 - Add support for BCM7278") +Signed-off-by: Florian Fainelli +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/iproc-rng200.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/drivers/char/hw_random/iproc-rng200.c b/drivers/char/hw_random/iproc-rng200.c +index 472f37f41317e..b2d3da17daa8e 100644 +--- a/drivers/char/hw_random/iproc-rng200.c ++++ b/drivers/char/hw_random/iproc-rng200.c +@@ -202,6 +202,8 @@ static int iproc_rng200_probe(struct platform_device *pdev) + return PTR_ERR(priv->base); + } + ++ dev_set_drvdata(dev, priv); ++ + priv->rng.name = "iproc-rng200"; + priv->rng.read = iproc_rng200_read; + priv->rng.init = iproc_rng200_init; +@@ -219,6 +221,28 @@ static int iproc_rng200_probe(struct platform_device *pdev) + return 0; + } + ++static int __maybe_unused iproc_rng200_suspend(struct device *dev) ++{ ++ struct iproc_rng200_dev *priv = dev_get_drvdata(dev); ++ ++ iproc_rng200_cleanup(&priv->rng); ++ ++ return 0; ++} ++ ++static int __maybe_unused iproc_rng200_resume(struct device *dev) ++{ ++ struct iproc_rng200_dev *priv = dev_get_drvdata(dev); ++ ++ iproc_rng200_init(&priv->rng); ++ ++ return 0; ++} ++ ++static const struct dev_pm_ops iproc_rng200_pm_ops = { ++ SET_SYSTEM_SLEEP_PM_OPS(iproc_rng200_suspend, iproc_rng200_resume) ++}; ++ + static const struct of_device_id iproc_rng200_of_match[] = { + { .compatible = "brcm,bcm7211-rng200", }, + { .compatible = "brcm,bcm7278-rng200", }, +@@ -231,6 +255,7 @@ static struct platform_driver iproc_rng200_driver = { + .driver = { + .name = "iproc-rng200", + .of_match_table = iproc_rng200_of_match, ++ .pm = &iproc_rng200_pm_ops, + }, + .probe = iproc_rng200_probe, + }; +-- +2.40.1 + diff --git a/queue-5.4/hwrng-iproc-rng200-use-semicolons-rather-than-commas.patch b/queue-5.4/hwrng-iproc-rng200-use-semicolons-rather-than-commas.patch new file mode 100644 index 00000000000..b2fa7a32f40 --- /dev/null +++ b/queue-5.4/hwrng-iproc-rng200-use-semicolons-rather-than-commas.patch @@ -0,0 +1,53 @@ +From 2bf7954870474208173cb8bc9989d5daabfce97d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Sep 2020 21:12:16 +0200 +Subject: hwrng: iproc-rng200 - use semicolons rather than commas to separate + statements + +From: Julia Lawall + +[ Upstream commit f9dc446cb959d1efdb971fb3cde18c354a4a04c9 ] + +Replace commas with semicolons. What is done is essentially described by +the following Coccinelle semantic patch (http://coccinelle.lip6.fr/): + +// +@@ expression e1,e2; @@ +e1 +-, ++; +e2 +... when any +// + +Signed-off-by: Julia Lawall +Acked-by: Florian Fainelli +Signed-off-by: Herbert Xu +Stable-dep-of: 8e03dd62e5be ("hwrng: iproc-rng200 - Implement suspend and resume calls") +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/iproc-rng200.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/char/hw_random/iproc-rng200.c b/drivers/char/hw_random/iproc-rng200.c +index 92be1c0ab99f3..472f37f41317e 100644 +--- a/drivers/char/hw_random/iproc-rng200.c ++++ b/drivers/char/hw_random/iproc-rng200.c +@@ -202,10 +202,10 @@ static int iproc_rng200_probe(struct platform_device *pdev) + return PTR_ERR(priv->base); + } + +- priv->rng.name = "iproc-rng200", +- priv->rng.read = iproc_rng200_read, +- priv->rng.init = iproc_rng200_init, +- priv->rng.cleanup = iproc_rng200_cleanup, ++ priv->rng.name = "iproc-rng200"; ++ priv->rng.read = iproc_rng200_read; ++ priv->rng.init = iproc_rng200_init; ++ priv->rng.cleanup = iproc_rng200_cleanup; + + /* Register driver */ + ret = devm_hwrng_register(dev, &priv->rng); +-- +2.40.1 + diff --git a/queue-5.4/ib-uverbs-fix-an-potential-error-pointer-dereference.patch b/queue-5.4/ib-uverbs-fix-an-potential-error-pointer-dereference.patch new file mode 100644 index 00000000000..8b8ba746193 --- /dev/null +++ b/queue-5.4/ib-uverbs-fix-an-potential-error-pointer-dereference.patch @@ -0,0 +1,42 @@ +From 2b79e0b483a2f12328f22531a57e40bd59e7f54b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 10:25:25 +0800 +Subject: IB/uverbs: Fix an potential error pointer dereference + +From: Xiang Yang + +[ Upstream commit 26b7d1a27167e7adf75b150755e05d2bc123ce55 ] + +smatch reports the warning below: +drivers/infiniband/core/uverbs_std_types_counters.c:110 +ib_uverbs_handler_UVERBS_METHOD_COUNTERS_READ() error: 'uattr' +dereferencing possible ERR_PTR() + +The return value of uattr maybe ERR_PTR(-ENOENT), fix this by checking +the value of uattr before using it. + +Fixes: ebb6796bd397 ("IB/uverbs: Add read counters support") +Signed-off-by: Xiang Yang +Link: https://lore.kernel.org/r/20230804022525.1916766-1-xiangyang3@huawei.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/uverbs_std_types_counters.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/core/uverbs_std_types_counters.c b/drivers/infiniband/core/uverbs_std_types_counters.c +index 9f013304e6778..35e41c5ca1bb1 100644 +--- a/drivers/infiniband/core/uverbs_std_types_counters.c ++++ b/drivers/infiniband/core/uverbs_std_types_counters.c +@@ -105,6 +105,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_COUNTERS_READ)( + return ret; + + uattr = uverbs_attr_get(attrs, UVERBS_ATTR_READ_COUNTERS_BUFF); ++ if (IS_ERR(uattr)) ++ return PTR_ERR(uattr); + read_attr.ncounters = uattr->ptr_attr.len / sizeof(u64); + read_attr.counters_buff = uverbs_zalloc( + attrs, array_size(read_attr.ncounters, sizeof(u64))); +-- +2.40.1 + diff --git a/queue-5.4/ima-remove-deprecated-ima_trusted_keyring-kconfig.patch b/queue-5.4/ima-remove-deprecated-ima_trusted_keyring-kconfig.patch new file mode 100644 index 00000000000..9aea574e5c3 --- /dev/null +++ b/queue-5.4/ima-remove-deprecated-ima_trusted_keyring-kconfig.patch @@ -0,0 +1,45 @@ +From 8f3da884be26c0261d8259bc9166f40e878f958b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 12:44:47 -0400 +Subject: ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig + +From: Nayna Jain + +[ Upstream commit 5087fd9e80e539d2163accd045b73da64de7de95 ] + +Time to remove "IMA_TRUSTED_KEYRING". + +Fixes: f4dc37785e9b ("integrity: define '.evm' as a builtin 'trusted' keyring") # v4.5+ +Signed-off-by: Nayna Jain +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/Kconfig | 12 ------------ + 1 file changed, 12 deletions(-) + +diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig +index d90ead61f0def..c97ce6265fc6b 100644 +--- a/security/integrity/ima/Kconfig ++++ b/security/integrity/ima/Kconfig +@@ -243,18 +243,6 @@ config IMA_APPRAISE_MODSIG + The modsig keyword can be used in the IMA policy to allow a hook + to accept such signatures. + +-config IMA_TRUSTED_KEYRING +- bool "Require all keys on the .ima keyring be signed (deprecated)" +- depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING +- depends on INTEGRITY_ASYMMETRIC_KEYS +- select INTEGRITY_TRUSTED_KEYRING +- default y +- help +- This option requires that all keys added to the .ima +- keyring be signed by a key on the system trusted keyring. +- +- This option is deprecated in favor of INTEGRITY_TRUSTED_KEYRING +- + config IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY + bool "Permit keys validly signed by a built-in or secondary CA cert (EXPERIMENTAL)" + depends on SYSTEM_TRUSTED_KEYRING +-- +2.40.1 + diff --git a/queue-5.4/iommu-vt-d-fix-to-flush-cache-of-pasid-directory-tab.patch b/queue-5.4/iommu-vt-d-fix-to-flush-cache-of-pasid-directory-tab.patch new file mode 100644 index 00000000000..6dceca358a2 --- /dev/null +++ b/queue-5.4/iommu-vt-d-fix-to-flush-cache-of-pasid-directory-tab.patch @@ -0,0 +1,44 @@ +From a297e483c436356981f6dd6b1e228563e0c4401c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 20:48:04 +0800 +Subject: iommu/vt-d: Fix to flush cache of PASID directory table + +From: Yanfei Xu + +[ Upstream commit 8a3b8e63f8371c1247b7aa24ff9c5312f1a6948b ] + +Even the PCI devices don't support pasid capability, PASID table is +mandatory for a PCI device in scalable mode. However flushing cache +of pasid directory table for these devices are not taken after pasid +table is allocated as the "size" of table is zero. Fix it by +calculating the size by page order. + +Found this when reading the code, no real problem encountered for now. + +Fixes: 194b3348bdbb ("iommu/vt-d: Fix PASID directory pointer coherency") +Suggested-by: Lu Baolu +Signed-off-by: Yanfei Xu +Link: https://lore.kernel.org/r/20230616081045.721873-1-yanfei.xu@intel.com +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-pasid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel-pasid.c b/drivers/iommu/intel-pasid.c +index 58f060006ba31..9641eaa19e08e 100644 +--- a/drivers/iommu/intel-pasid.c ++++ b/drivers/iommu/intel-pasid.c +@@ -167,7 +167,7 @@ int intel_pasid_alloc_table(struct device *dev) + device_attach_pasid_table(info, pasid_table); + + if (!ecap_coherent(info->iommu->ecap)) +- clflush_cache_range(pasid_table->table, size); ++ clflush_cache_range(pasid_table->table, (1 << order) * PAGE_SIZE); + + return 0; + } +-- +2.40.1 + diff --git a/queue-5.4/ipmi-ssif-add-check-for-kstrdup.patch b/queue-5.4/ipmi-ssif-add-check-for-kstrdup.patch new file mode 100644 index 00000000000..dae966858ea --- /dev/null +++ b/queue-5.4/ipmi-ssif-add-check-for-kstrdup.patch @@ -0,0 +1,40 @@ +From c9851f907591dc1e56dcee21a5603f50a61338d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 17:28:02 +0800 +Subject: ipmi:ssif: Add check for kstrdup + +From: Jiasheng Jiang + +[ Upstream commit c5586d0f711e9744d0cade39b0c4a2d116a333ca ] + +Add check for the return value of kstrdup() and return the error +if it fails in order to avoid NULL pointer dereference. + +Fixes: c4436c9149c5 ("ipmi_ssif: avoid registering duplicate ssif interface") +Signed-off-by: Jiasheng Jiang +Message-Id: <20230619092802.35384-1-jiasheng@iscas.ac.cn> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_ssif.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index 2907b0bca1af0..0061f2207f318 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -1609,6 +1609,11 @@ static int ssif_add_infos(struct i2c_client *client) + info->addr_src = SI_ACPI; + info->client = client; + info->adapter_name = kstrdup(client->adapter->name, GFP_KERNEL); ++ if (!info->adapter_name) { ++ kfree(info); ++ return -ENOMEM; ++ } ++ + info->binfo.addr = client->addr; + list_add_tail(&info->link, &ssif_infos); + return 0; +-- +2.40.1 + diff --git a/queue-5.4/ipmi-ssif-fix-a-memory-leak-when-scanning-for-an-ada.patch b/queue-5.4/ipmi-ssif-fix-a-memory-leak-when-scanning-for-an-ada.patch new file mode 100644 index 00000000000..b3e3c234a9f --- /dev/null +++ b/queue-5.4/ipmi-ssif-fix-a-memory-leak-when-scanning-for-an-ada.patch @@ -0,0 +1,37 @@ +From 824fd5970d89253aee53f79228ec0529582d213d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 11:43:33 -0500 +Subject: ipmi:ssif: Fix a memory leak when scanning for an adapter + +From: Corey Minyard + +[ Upstream commit b8d72e32e1453d37ee5c8a219f24e7eeadc471ef ] + +The adapter scan ssif_info_find() sets info->adapter_name if the adapter +info came from SMBIOS, as it's not set in that case. However, this +function can be called more than once, and it will leak the adapter name +if it had already been set. So check for NULL before setting it. + +Fixes: c4436c9149c5 ("ipmi_ssif: avoid registering duplicate ssif interface") +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_ssif.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index 0061f2207f318..a1b080dfa9604 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -1410,7 +1410,7 @@ static struct ssif_addr_info *ssif_info_find(unsigned short addr, + restart: + list_for_each_entry(info, &ssif_infos, link) { + if (info->binfo.addr == addr) { +- if (info->addr_src == SI_SMBIOS) ++ if (info->addr_src == SI_SMBIOS && !info->adapter_name) + info->adapter_name = kstrdup(adapter_name, + GFP_KERNEL); + +-- +2.40.1 + diff --git a/queue-5.4/jfs-validate-max-amount-of-blocks-before-allocation.patch b/queue-5.4/jfs-validate-max-amount-of-blocks-before-allocation.patch new file mode 100644 index 00000000000..fac0eced865 --- /dev/null +++ b/queue-5.4/jfs-validate-max-amount-of-blocks-before-allocation.patch @@ -0,0 +1,42 @@ +From cb53beca5fda07d34bb5e49784a3f28461e08eb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Aug 2023 20:32:16 +0300 +Subject: jfs: validate max amount of blocks before allocation. + +From: Alexei Filippov + +[ Upstream commit 0225e10972fa809728b8d4c1bd2772b3ec3fdb57 ] + +The lack of checking bmp->db_max_freebud in extBalloc() can lead to +shift out of bounds, so this patch prevents undefined behavior, because +bmp->db_max_freebud == -1 only if there is no free space. + +Signed-off-by: Aleksei Filippov +Signed-off-by: Dave Kleikamp +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-and-tested-by: syzbot+5f088f29593e6b4c8db8@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?id=01abadbd6ae6a08b1f1987aa61554c6b3ac19ff2 +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_extent.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/jfs/jfs_extent.c b/fs/jfs/jfs_extent.c +index f65bd6b35412b..d4e063dbb9a0b 100644 +--- a/fs/jfs/jfs_extent.c ++++ b/fs/jfs/jfs_extent.c +@@ -508,6 +508,11 @@ extBalloc(struct inode *ip, s64 hint, s64 * nblocks, s64 * blkno) + * blocks in the map. in that case, we'll start off with the + * maximum free. + */ ++ ++ /* give up if no space left */ ++ if (bmp->db_maxfreebud == -1) ++ return -ENOSPC; ++ + max = (s64) 1 << bmp->db_maxfreebud; + if (*nblocks >= max && *nblocks > nbperpage) + nb = nblks = (max > nbperpage) ? max : nbperpage; +-- +2.40.1 + diff --git a/queue-5.4/lwt-check-lwtunnel_xmit_continue-strictly.patch b/queue-5.4/lwt-check-lwtunnel_xmit_continue-strictly.patch new file mode 100644 index 00000000000..65c7a7baff6 --- /dev/null +++ b/queue-5.4/lwt-check-lwtunnel_xmit_continue-strictly.patch @@ -0,0 +1,78 @@ +From 98f188abcf6d01e13fb8688ea8c814ebfac90d53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 19:58:14 -0700 +Subject: lwt: Check LWTUNNEL_XMIT_CONTINUE strictly + +From: Yan Zhai + +[ Upstream commit a171fbec88a2c730b108c7147ac5e7b2f5a02b47 ] + +LWTUNNEL_XMIT_CONTINUE is implicitly assumed in ip(6)_finish_output2, +such that any positive return value from a xmit hook could cause +unexpected continue behavior, despite that related skb may have been +freed. This could be error-prone for future xmit hook ops. One of the +possible errors is to return statuses of dst_output directly. + +To make the code safer, redefine LWTUNNEL_XMIT_CONTINUE value to +distinguish from dst_output statuses and check the continue +condition explicitly. + +Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure") +Suggested-by: Dan Carpenter +Signed-off-by: Yan Zhai +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/96b939b85eda00e8df4f7c080f770970a4c5f698.1692326837.git.yan@cloudflare.com +Signed-off-by: Sasha Levin +--- + include/net/lwtunnel.h | 5 ++++- + net/ipv4/ip_output.c | 2 +- + net/ipv6/ip6_output.c | 2 +- + 3 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h +index 5d6c5b1fc6955..ed1cd431e2b3b 100644 +--- a/include/net/lwtunnel.h ++++ b/include/net/lwtunnel.h +@@ -16,9 +16,12 @@ + #define LWTUNNEL_STATE_INPUT_REDIRECT BIT(1) + #define LWTUNNEL_STATE_XMIT_REDIRECT BIT(2) + ++/* LWTUNNEL_XMIT_CONTINUE should be distinguishable from dst_output return ++ * values (NET_XMIT_xxx and NETDEV_TX_xxx in linux/netdevice.h) for safety. ++ */ + enum { + LWTUNNEL_XMIT_DONE, +- LWTUNNEL_XMIT_CONTINUE, ++ LWTUNNEL_XMIT_CONTINUE = 0x100, + }; + + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index 08ccb501ff0cc..bf7c2333bc236 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -222,7 +222,7 @@ static int ip_finish_output2(struct net *net, struct sock *sk, struct sk_buff *s + if (lwtunnel_xmit_redirect(dst->lwtstate)) { + int res = lwtunnel_xmit(skb); + +- if (res < 0 || res == LWTUNNEL_XMIT_DONE) ++ if (res != LWTUNNEL_XMIT_CONTINUE) + return res; + } + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 8231a7a3dd035..816275b2135fe 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -130,7 +130,7 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * + if (lwtunnel_xmit_redirect(dst->lwtstate)) { + int res = lwtunnel_xmit(skb); + +- if (res < 0 || res == LWTUNNEL_XMIT_DONE) ++ if (res != LWTUNNEL_XMIT_CONTINUE) + return res; + } + +-- +2.40.1 + diff --git a/queue-5.4/lwt-fix-return-values-of-bpf-xmit-ops.patch b/queue-5.4/lwt-fix-return-values-of-bpf-xmit-ops.patch new file mode 100644 index 00000000000..4894ba3425a --- /dev/null +++ b/queue-5.4/lwt-fix-return-values-of-bpf-xmit-ops.patch @@ -0,0 +1,63 @@ +From ba1cd803be4e51c2f2abd9480dbfad3ca2a56688 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 19:58:11 -0700 +Subject: lwt: Fix return values of BPF xmit ops + +From: Yan Zhai + +[ Upstream commit 29b22badb7a84b783e3a4fffca16f7768fb31205 ] + +BPF encap ops can return different types of positive values, such like +NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function +skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return +values would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in +ip(6)_finish_output2. When this happens, skbs that have been freed would +continue to the neighbor subsystem, causing use-after-free bug and +kernel crashes. + +To fix the incorrect behavior, skb_do_redirect return values can be +simply discarded, the same as tc-egress behavior. On the other hand, +bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU +information. Thus convert its return values to avoid the conflict with +LWTUNNEL_XMIT_CONTINUE. + +Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure") +Reported-by: Jordan Griege +Suggested-by: Martin KaFai Lau +Suggested-by: Stanislav Fomichev +Signed-off-by: Yan Zhai +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/0d2b878186cfe215fec6b45769c1cd0591d3628d.1692326837.git.yan@cloudflare.com +Signed-off-by: Sasha Levin +--- + net/core/lwt_bpf.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c +index bf270b6a99b4f..017ed82611a8d 100644 +--- a/net/core/lwt_bpf.c ++++ b/net/core/lwt_bpf.c +@@ -59,9 +59,8 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt, + ret = BPF_OK; + } else { + skb_reset_mac_header(skb); +- ret = skb_do_redirect(skb); +- if (ret == 0) +- ret = BPF_REDIRECT; ++ skb_do_redirect(skb); ++ ret = BPF_REDIRECT; + } + break; + +@@ -254,7 +253,7 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb) + + err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb); + if (unlikely(err)) +- return err; ++ return net_xmit_errno(err); + + /* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */ + return LWTUNNEL_XMIT_DONE; +-- +2.40.1 + diff --git a/queue-5.4/md-bitmap-don-t-set-max_write_behind-if-there-is-no-.patch b/queue-5.4/md-bitmap-don-t-set-max_write_behind-if-there-is-no-.patch new file mode 100644 index 00000000000..28cc21c58d0 --- /dev/null +++ b/queue-5.4/md-bitmap-don-t-set-max_write_behind-if-there-is-no-.patch @@ -0,0 +1,59 @@ +From 4baca5e76a8ebdd07e50aec95d331b65f4089c6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Oct 2021 21:50:17 +0800 +Subject: md/bitmap: don't set max_write_behind if there is no write mostly + device + +From: Guoqing Jiang + +[ Upstream commit 8c13ab115b577bd09097b9d77916732e97e31b7b ] + +We shouldn't set it since write behind IO should only happen to write +mostly device. + +Signed-off-by: Guoqing Jiang +Signed-off-by: Song Liu +Stable-dep-of: 44abfa6a95df ("md/md-bitmap: hold 'reconfig_mutex' in backlog_store()") +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index bea8265ce9b8e..a549662ff4e51 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -2480,11 +2480,30 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len) + { + unsigned long backlog; + unsigned long old_mwb = mddev->bitmap_info.max_write_behind; ++ struct md_rdev *rdev; ++ bool has_write_mostly = false; + int rv = kstrtoul(buf, 10, &backlog); + if (rv) + return rv; + if (backlog > COUNTER_MAX) + return -EINVAL; ++ ++ /* ++ * Without write mostly device, it doesn't make sense to set ++ * backlog for max_write_behind. ++ */ ++ rdev_for_each(rdev, mddev) { ++ if (test_bit(WriteMostly, &rdev->flags)) { ++ has_write_mostly = true; ++ break; ++ } ++ } ++ if (!has_write_mostly) { ++ pr_warn_ratelimited("%s: can't set backlog, no write mostly device available\n", ++ mdname(mddev)); ++ return -EINVAL; ++ } ++ + mddev->bitmap_info.max_write_behind = backlog; + if (!backlog && mddev->wb_info_pool) { + /* wb_info_pool is not needed if backlog is zero */ +-- +2.40.1 + diff --git a/queue-5.4/md-md-bitmap-hold-reconfig_mutex-in-backlog_store.patch b/queue-5.4/md-md-bitmap-hold-reconfig_mutex-in-backlog_store.patch new file mode 100644 index 00000000000..9d9e66deb5d --- /dev/null +++ b/queue-5.4/md-md-bitmap-hold-reconfig_mutex-in-backlog_store.patch @@ -0,0 +1,62 @@ +From 15d6c490b27c148fcc1c689f9b282dcd344067f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 16:37:27 +0800 +Subject: md/md-bitmap: hold 'reconfig_mutex' in backlog_store() + +From: Yu Kuai + +[ Upstream commit 44abfa6a95df425c0660d56043020b67e6d93ab8 ] + +Several reasons why 'reconfig_mutex' should be held: + +1) rdev_for_each() is not safe to be called without the lock, because + rdev can be removed concurrently. +2) mddev_destroy_serial_pool() and mddev_create_serial_pool() should not + be called concurrently. +3) mddev_suspend() from mddev_destroy/create_serial_pool() should be + protected by the lock. + +Fixes: 10c92fca636e ("md-bitmap: create and destroy wb_info_pool with the change of backlog") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20230706083727.608914-3-yukuai1@huaweicloud.com +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index a549662ff4e51..843139447a964 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -2488,6 +2488,10 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len) + if (backlog > COUNTER_MAX) + return -EINVAL; + ++ rv = mddev_lock(mddev); ++ if (rv) ++ return rv; ++ + /* + * Without write mostly device, it doesn't make sense to set + * backlog for max_write_behind. +@@ -2501,6 +2505,7 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len) + if (!has_write_mostly) { + pr_warn_ratelimited("%s: can't set backlog, no write mostly device available\n", + mdname(mddev)); ++ mddev_unlock(mddev); + return -EINVAL; + } + +@@ -2518,6 +2523,8 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len) + } + if (old_mwb != backlog) + md_bitmap_update_sb(mddev->bitmap); ++ ++ mddev_unlock(mddev); + return len; + } + +-- +2.40.1 + diff --git a/queue-5.4/md-raid1-free-the-r1bio-before-waiting-for-blocked-r.patch b/queue-5.4/md-raid1-free-the-r1bio-before-waiting-for-blocked-r.patch new file mode 100644 index 00000000000..7139c604ca7 --- /dev/null +++ b/queue-5.4/md-raid1-free-the-r1bio-before-waiting-for-blocked-r.patch @@ -0,0 +1,55 @@ +From 2a0f2c067e6ab45f70a8286afeb51dad7d68ae15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 21:53:55 +0800 +Subject: md/raid1: free the r1bio before waiting for blocked rdev + +From: Xueshi Hu + +[ Upstream commit 992db13a4aee766c8bfbf046ad15c2db5fa7cab8 ] + +Raid1 reshape will change mempool and r1conf::raid_disks which are +needed to free r1bio. allow_barrier() make a concurrent raid1_reshape() +possible. So, free the in-flight r1bio before waiting blocked rdev. + +Fixes: 6bfe0b499082 ("md: support blocking writes to an array on device failure") +Reviewed-by: Yu Kuai +Signed-off-by: Xueshi Hu +Link: https://lore.kernel.org/r/20230814135356.1113639-3-xueshi.hu@smartx.com +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid1.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 1919de4c8c12d..c507b759491a2 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1361,6 +1361,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, + */ + wait_barrier(conf, bio->bi_iter.bi_sector); + ++ retry_write: + r1_bio = alloc_r1bio(mddev, bio); + r1_bio->sectors = max_write_sectors; + +@@ -1382,7 +1383,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, + */ + + disks = conf->raid_disks * 2; +- retry_write: + blocked_rdev = NULL; + rcu_read_lock(); + max_sectors = r1_bio->sectors; +@@ -1453,7 +1453,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, + for (j = 0; j < i; j++) + if (r1_bio->bios[j]) + rdev_dec_pending(conf->mirrors[j].rdev, mddev); +- r1_bio->state = 0; ++ free_r1bio(r1_bio); + allow_barrier(conf, bio->bi_iter.bi_sector); + raid1_log(mddev, "wait rdev %d blocked", blocked_rdev->raid_disk); + md_wait_for_blocked_rdev(blocked_rdev, mddev); +-- +2.40.1 + diff --git a/queue-5.4/md-raid1-hold-the-barrier-until-handle_read_error-fi.patch b/queue-5.4/md-raid1-hold-the-barrier-until-handle_read_error-fi.patch new file mode 100644 index 00000000000..c0a2964d0ab --- /dev/null +++ b/queue-5.4/md-raid1-hold-the-barrier-until-handle_read_error-fi.patch @@ -0,0 +1,53 @@ +From 355b03caed8649bf582b4b555a97565bcbb424bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 21:53:56 +0800 +Subject: md/raid1: hold the barrier until handle_read_error() finishes + +From: Xueshi Hu + +[ Upstream commit c069da449a13669ffa754fd971747e7e17e7d691 ] + +handle_read_error() will call allow_barrier() to match the former barrier +raising. However, it should put the allow_barrier() at the end to avoid a +concurrent raid reshape. + +Fixes: 689389a06ce7 ("md/raid1: simplify handle_read_error().") +Reviewed-by: Yu Kuai +Signed-off-by: Xueshi Hu +Link: https://lore.kernel.org/r/20230814135356.1113639-4-xueshi.hu@smartx.com +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid1.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index c507b759491a2..253c620515f06 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -2481,6 +2481,7 @@ static void handle_read_error(struct r1conf *conf, struct r1bio *r1_bio) + struct mddev *mddev = conf->mddev; + struct bio *bio; + struct md_rdev *rdev; ++ sector_t sector; + + clear_bit(R1BIO_ReadError, &r1_bio->state); + /* we got a read error. Maybe the drive is bad. Maybe just +@@ -2510,12 +2511,13 @@ static void handle_read_error(struct r1conf *conf, struct r1bio *r1_bio) + } + + rdev_dec_pending(rdev, conf->mddev); +- allow_barrier(conf, r1_bio->sector); ++ sector = r1_bio->sector; + bio = r1_bio->master_bio; + + /* Reuse the old r1_bio so that the IO_BLOCKED settings are preserved */ + r1_bio->state = 0; + raid1_read_request(mddev, bio, r1_bio->sectors, r1_bio); ++ allow_barrier(conf, sector); + } + + static void raid1d(struct md_thread *thread) +-- +2.40.1 + diff --git a/queue-5.4/media-cx24120-add-retval-check-for-cx24120_message_s.patch b/queue-5.4/media-cx24120-add-retval-check-for-cx24120_message_s.patch new file mode 100644 index 00000000000..ef85a925236 --- /dev/null +++ b/queue-5.4/media-cx24120-add-retval-check-for-cx24120_message_s.patch @@ -0,0 +1,40 @@ +From 58ba3a3eb2e78dd38e2ff854d6bdf266c83f54a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 01:55:01 -0700 +Subject: media: cx24120: Add retval check for cx24120_message_send() + +From: Daniil Dulov + +[ Upstream commit 96002c0ac824e1773d3f706b1f92e2a9f2988047 ] + +If cx24120_message_send() returns error, we should keep local struct +unchanged. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 5afc9a25be8d ("[media] Add support for TechniSat Skystar S2") +Signed-off-by: Daniil Dulov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/cx24120.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-frontends/cx24120.c b/drivers/media/dvb-frontends/cx24120.c +index 2464b63fe0cf4..307efef263f27 100644 +--- a/drivers/media/dvb-frontends/cx24120.c ++++ b/drivers/media/dvb-frontends/cx24120.c +@@ -972,7 +972,9 @@ static void cx24120_set_clock_ratios(struct dvb_frontend *fe) + cmd.arg[8] = (clock_ratios_table[idx].rate >> 8) & 0xff; + cmd.arg[9] = (clock_ratios_table[idx].rate >> 0) & 0xff; + +- cx24120_message_send(state, &cmd); ++ ret = cx24120_message_send(state, &cmd); ++ if (ret != 0) ++ return; + + /* Calculate ber window rates for stat work */ + cx24120_calculate_ber_window(state, clock_ratios_table[idx].rate); +-- +2.40.1 + diff --git a/queue-5.4/media-dib7000p-fix-potential-division-by-zero.patch b/queue-5.4/media-dib7000p-fix-potential-division-by-zero.patch new file mode 100644 index 00000000000..1191e248aed --- /dev/null +++ b/queue-5.4/media-dib7000p-fix-potential-division-by-zero.patch @@ -0,0 +1,39 @@ +From bac3de4f369a3d95169c17cc2c21c9f7c2b7742d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 06:38:32 -0700 +Subject: media: dib7000p: Fix potential division by zero + +From: Daniil Dulov + +[ Upstream commit a1db7b2c5533fc67e2681eb5efc921a67bc7d5b8 ] + +Variable loopdiv can be assigned 0, then it is used as a denominator, +without checking it for 0. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 713d54a8bd81 ("[media] DiB7090: add support for the dib7090 based") +Signed-off-by: Daniil Dulov +Signed-off-by: Hans Verkuil +[hverkuil: (bw != NULL) -> bw] +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/dib7000p.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c +index 0d22c700016d4..ac34fd8659b52 100644 +--- a/drivers/media/dvb-frontends/dib7000p.c ++++ b/drivers/media/dvb-frontends/dib7000p.c +@@ -497,7 +497,7 @@ static int dib7000p_update_pll(struct dvb_frontend *fe, struct dibx000_bandwidth + prediv = reg_1856 & 0x3f; + loopdiv = (reg_1856 >> 6) & 0x3f; + +- if ((bw != NULL) && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) { ++ if (loopdiv && bw && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) { + dprintk("Updating pll (prediv: old = %d new = %d ; loopdiv : old = %d new = %d)\n", prediv, bw->pll_prediv, loopdiv, bw->pll_ratio); + reg_1856 &= 0xf000; + reg_1857 = dib7000p_read_word(state, 1857); +-- +2.40.1 + diff --git a/queue-5.4/media-dvb-usb-m920x-fix-a-potential-memory-leak-in-m.patch b/queue-5.4/media-dvb-usb-m920x-fix-a-potential-memory-leak-in-m.patch new file mode 100644 index 00000000000..547267f6640 --- /dev/null +++ b/queue-5.4/media-dvb-usb-m920x-fix-a-potential-memory-leak-in-m.patch @@ -0,0 +1,50 @@ +From eee783a0bd895bfbcb2247929629a70b42a5e911 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 May 2023 07:58:36 +0200 +Subject: media: dvb-usb: m920x: Fix a potential memory leak in + m920x_i2c_xfer() + +From: Christophe JAILLET + +[ Upstream commit ea9ef6c2e001c5dc94bee35ebd1c8a98621cf7b8 ] + +'read' is freed when it is known to be NULL, but not when a read error +occurs. + +Revert the logic to avoid a small leak, should a m920x_read() call fail. + +Fixes: a2ab06d7c4d6 ("media: m920x: don't use stack on USB reads") +Signed-off-by: Christophe JAILLET +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/m920x.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb/m920x.c b/drivers/media/usb/dvb-usb/m920x.c +index 7282f60226558..8b19ae67f1879 100644 +--- a/drivers/media/usb/dvb-usb/m920x.c ++++ b/drivers/media/usb/dvb-usb/m920x.c +@@ -277,7 +277,6 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu + char *read = kmalloc(1, GFP_KERNEL); + if (!read) { + ret = -ENOMEM; +- kfree(read); + goto unlock; + } + +@@ -288,8 +287,10 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu + + if ((ret = m920x_read(d->udev, M9206_I2C, 0x0, + 0x20 | stop, +- read, 1)) != 0) ++ read, 1)) != 0) { ++ kfree(read); + goto unlock; ++ } + msg[i].buf[j] = read[0]; + } + +-- +2.40.1 + diff --git a/queue-5.4/media-go7007-remove-redundant-if-statement.patch b/queue-5.4/media-go7007-remove-redundant-if-statement.patch new file mode 100644 index 00000000000..47e7b710744 --- /dev/null +++ b/queue-5.4/media-go7007-remove-redundant-if-statement.patch @@ -0,0 +1,43 @@ +From be07a0f58d163ab7f19de269fb769b461f83b2b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 19:40:07 +0200 +Subject: media: go7007: Remove redundant if statement + +From: Colin Ian King + +[ Upstream commit f33cb49081da0ec5af0888f8ecbd566bd326eed1 ] + +The if statement that compares msgs[i].len != 3 is always false because +it is in a code block where msg[i].len is equal to 3. The check is +redundant and can be removed. + +As detected by cppcheck static analysis: +drivers/media/usb/go7007/go7007-i2c.c:168:20: warning: Opposite inner +'if' condition leads to a dead code block. [oppositeInnerCondition] + +Link: https://lore.kernel.org/linux-media/20230727174007.635572-1-colin.i.king@gmail.com + +Fixes: 866b8695d67e ("Staging: add the go7007 video driver") +Signed-off-by: Colin Ian King +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/go7007/go7007-i2c.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/media/usb/go7007/go7007-i2c.c b/drivers/media/usb/go7007/go7007-i2c.c +index 38339dd2f83f7..2880370e45c8b 100644 +--- a/drivers/media/usb/go7007/go7007-i2c.c ++++ b/drivers/media/usb/go7007/go7007-i2c.c +@@ -165,8 +165,6 @@ static int go7007_i2c_master_xfer(struct i2c_adapter *adapter, + } else if (msgs[i].len == 3) { + if (msgs[i].flags & I2C_M_RD) + return -EIO; +- if (msgs[i].len != 3) +- return -EIO; + if (go7007_i2c_xfer(go, msgs[i].addr, 0, + (msgs[i].buf[0] << 8) | msgs[i].buf[1], + 0x01, &msgs[i].buf[2]) < 0) +-- +2.40.1 + diff --git a/queue-5.4/media-i2c-ov2680-set-v4l2_ctrl_flag_modify_layout-on.patch b/queue-5.4/media-i2c-ov2680-set-v4l2_ctrl_flag_modify_layout-on.patch new file mode 100644 index 00000000000..574cbc8c1ee --- /dev/null +++ b/queue-5.4/media-i2c-ov2680-set-v4l2_ctrl_flag_modify_layout-on.patch @@ -0,0 +1,41 @@ +From 82e57598d0c467f737037c386a23e185d517af42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 15:21:45 +0000 +Subject: media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips + +From: Dave Stevenson + +[ Upstream commit 66274280b2c745d380508dc27b9a4dfd736e5eda ] + +The driver changes the Bayer order based on the flips, but +does not define the control correctly with the +V4L2_CTRL_FLAG_MODIFY_LAYOUT flag. + +Add the V4L2_CTRL_FLAG_MODIFY_LAYOUT flag. + +Signed-off-by: Dave Stevenson +Acked-by: Rui Miguel Silva +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: 7b5a42e6ae71 ("media: ov2680: Remove auto-gain and auto-exposure controls") +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index 59cdbc33658ce..cd0c083a4768a 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -966,6 +966,8 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor) + + ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE; + ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE; ++ ctrls->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT; ++ ctrls->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT; + + v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true); + v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true); +-- +2.40.1 + diff --git a/queue-5.4/media-i2c-ov5640-configure-hvp-lines-in-s_power-call.patch b/queue-5.4/media-i2c-ov5640-configure-hvp-lines-in-s_power-call.patch new file mode 100644 index 00000000000..70d2d6dd24a --- /dev/null +++ b/queue-5.4/media-i2c-ov5640-configure-hvp-lines-in-s_power-call.patch @@ -0,0 +1,178 @@ +From 3947d3fec76ca7e843e877abcf649169ad206af5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 22:18:33 +0200 +Subject: media: i2c: ov5640: Configure HVP lines in s_power callback + +From: Lad Prabhakar + +[ Upstream commit 311a6408f8d46d47e35d3bf598dced39af4ce087 ] + +Configure HVP lines in s_power callback instead of configuring everytime +in ov5640_set_stream_dvp(). + +Alongside also disable MIPI in DVP mode. + +Signed-off-by: Lad Prabhakar +Reviewed-by: Biju Das +Tested-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: 98cb72d3b9c5 ("media: ov5640: Enable MIPI interface in ov5640_set_power_mipi()") +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov5640.c | 123 +++++++++++++++++-------------------- + 1 file changed, 58 insertions(+), 65 deletions(-) + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index 087fb464ffc12..76a9fa6d6d5c0 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -1206,71 +1206,6 @@ static int ov5640_set_autogain(struct ov5640_dev *sensor, bool on) + + static int ov5640_set_stream_dvp(struct ov5640_dev *sensor, bool on) + { +- int ret; +- unsigned int flags = sensor->ep.bus.parallel.flags; +- u8 pclk_pol = 0; +- u8 hsync_pol = 0; +- u8 vsync_pol = 0; +- +- /* +- * Note about parallel port configuration. +- * +- * When configured in parallel mode, the OV5640 will +- * output 10 bits data on DVP data lines [9:0]. +- * If only 8 bits data are wanted, the 8 bits data lines +- * of the camera interface must be physically connected +- * on the DVP data lines [9:2]. +- * +- * Control lines polarity can be configured through +- * devicetree endpoint control lines properties. +- * If no endpoint control lines properties are set, +- * polarity will be as below: +- * - VSYNC: active high +- * - HREF: active low +- * - PCLK: active low +- */ +- +- if (on) { +- /* +- * configure parallel port control lines polarity +- * +- * POLARITY CTRL0 +- * - [5]: PCLK polarity (0: active low, 1: active high) +- * - [1]: HREF polarity (0: active low, 1: active high) +- * - [0]: VSYNC polarity (mismatch here between +- * datasheet and hardware, 0 is active high +- * and 1 is active low...) +- */ +- if (flags & V4L2_MBUS_PCLK_SAMPLE_RISING) +- pclk_pol = 1; +- if (flags & V4L2_MBUS_HSYNC_ACTIVE_HIGH) +- hsync_pol = 1; +- if (flags & V4L2_MBUS_VSYNC_ACTIVE_LOW) +- vsync_pol = 1; +- +- ret = ov5640_write_reg(sensor, +- OV5640_REG_POLARITY_CTRL00, +- (pclk_pol << 5) | +- (hsync_pol << 1) | +- vsync_pol); +- +- if (ret) +- return ret; +- } +- +- /* +- * powerdown MIPI TX/RX PHY & disable MIPI +- * +- * MIPI CONTROL 00 +- * 4: PWDN PHY TX +- * 3: PWDN PHY RX +- * 2: MIPI enable +- */ +- ret = ov5640_write_reg(sensor, +- OV5640_REG_IO_MIPI_CTRL00, on ? 0x18 : 0); +- if (ret) +- return ret; +- + return ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, on ? + OV5640_REG_SYS_CTRL0_SW_PWUP : + OV5640_REG_SYS_CTRL0_SW_PWDN); +@@ -2029,15 +1964,73 @@ static int ov5640_set_power_mipi(struct ov5640_dev *sensor, bool on) + + static int ov5640_set_power_dvp(struct ov5640_dev *sensor, bool on) + { ++ unsigned int flags = sensor->ep.bus.parallel.flags; ++ u8 pclk_pol = 0; ++ u8 hsync_pol = 0; ++ u8 vsync_pol = 0; + int ret; + + if (!on) { + /* Reset settings to their default values. */ ++ ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x58); ++ ov5640_write_reg(sensor, OV5640_REG_POLARITY_CTRL00, 0x20); + ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE01, 0x00); + ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE02, 0x00); + return 0; + } + ++ /* ++ * Note about parallel port configuration. ++ * ++ * When configured in parallel mode, the OV5640 will ++ * output 10 bits data on DVP data lines [9:0]. ++ * If only 8 bits data are wanted, the 8 bits data lines ++ * of the camera interface must be physically connected ++ * on the DVP data lines [9:2]. ++ * ++ * Control lines polarity can be configured through ++ * devicetree endpoint control lines properties. ++ * If no endpoint control lines properties are set, ++ * polarity will be as below: ++ * - VSYNC: active high ++ * - HREF: active low ++ * - PCLK: active low ++ */ ++ /* ++ * configure parallel port control lines polarity ++ * ++ * POLARITY CTRL0 ++ * - [5]: PCLK polarity (0: active low, 1: active high) ++ * - [1]: HREF polarity (0: active low, 1: active high) ++ * - [0]: VSYNC polarity (mismatch here between ++ * datasheet and hardware, 0 is active high ++ * and 1 is active low...) ++ */ ++ if (flags & V4L2_MBUS_PCLK_SAMPLE_RISING) ++ pclk_pol = 1; ++ if (flags & V4L2_MBUS_HSYNC_ACTIVE_HIGH) ++ hsync_pol = 1; ++ if (flags & V4L2_MBUS_VSYNC_ACTIVE_LOW) ++ vsync_pol = 1; ++ ++ ret = ov5640_write_reg(sensor, OV5640_REG_POLARITY_CTRL00, ++ (pclk_pol << 5) | (hsync_pol << 1) | vsync_pol); ++ ++ if (ret) ++ return ret; ++ ++ /* ++ * powerdown MIPI TX/RX PHY & disable MIPI ++ * ++ * MIPI CONTROL 00 ++ * 4: PWDN PHY TX ++ * 3: PWDN PHY RX ++ * 2: MIPI enable ++ */ ++ ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x18); ++ if (ret) ++ return ret; ++ + /* + * enable VSYNC/HREF/PCLK DVP control lines + * & D[9:6] DVP data lines +-- +2.40.1 + diff --git a/queue-5.4/media-mediatek-vcodec-return-null-if-no-vdec_fb-is-f.patch b/queue-5.4/media-mediatek-vcodec-return-null-if-no-vdec_fb-is-f.patch new file mode 100644 index 00000000000..369980c705f --- /dev/null +++ b/queue-5.4/media-mediatek-vcodec-return-null-if-no-vdec_fb-is-f.patch @@ -0,0 +1,43 @@ +From 3e8359769eaf319b5a1aa5d8c0d21a3c1f269853 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jul 2023 17:14:41 +0800 +Subject: media: mediatek: vcodec: Return NULL if no vdec_fb is found + +From: Irui Wang + +[ Upstream commit dfa2d6e07432270330ae191f50a0e70636a4cd2b ] + +"fb_use_list" is used to store used or referenced frame buffers for +vp9 stateful decoder. "NULL" should be returned when getting target +frame buffer failed from "fb_use_list", not a random unexpected one. + +Fixes: f77e89854b3e ("[media] vcodec: mediatek: Add Mediatek VP9 Video Decoder Driver") +Signed-off-by: Irui Wang +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c +index 5066c283d86d1..2fd7d913fd640 100644 +--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c ++++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c +@@ -222,10 +222,11 @@ static struct vdec_fb *vp9_rm_from_fb_use_list(struct vdec_vp9_inst + if (fb->base_y.va == addr) { + list_move_tail(&node->list, + &inst->available_fb_node_list); +- break; ++ return fb; + } + } +- return fb; ++ ++ return NULL; + } + + static void vp9_add_to_fb_free_list(struct vdec_vp9_inst *inst, +-- +2.40.1 + diff --git a/queue-5.4/media-ov2680-fix-ov2680_bayer_order.patch b/queue-5.4/media-ov2680-fix-ov2680_bayer_order.patch new file mode 100644 index 00000000000..0960497f3f1 --- /dev/null +++ b/queue-5.4/media-ov2680-fix-ov2680_bayer_order.patch @@ -0,0 +1,117 @@ +From 3a74feef85e5bb059284d82b15ef647e057a76e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 11:33:17 +0200 +Subject: media: ov2680: Fix ov2680_bayer_order() + +From: Hans de Goede + +[ Upstream commit 50a7bad4e0a37d7018ab6fe843dd84bc6b2ecf72 ] + +The index into ov2680_hv_flip_bayer_order[] should be 0-3, but +ov2680_bayer_order() was using 0 + BIT(2) + (BIT(2) << 1) as +max index, while the intention was to use: 0 + 1 + 2 as max index. + +Fix the index calculation in ov2680_bayer_order(), while at it +also just use the ctrl values rather then reading them back using +a slow i2c-read transaction. + +This also allows making the function void, since there now are +no more i2c-reads to error check. + +Note the check for the ctrls being NULL is there to allow +adding an ov2680_fill_format() helper later, which will call +ov2680_set_bayer_order() during probe() before the ctrls are created. + +[Sakari Ailus: Change all users of ov2680_set_bayer_order() here] + +Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver") +Reviewed-by: Daniel Scally +Acked-by: Rui Miguel Silva +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 33 ++++++++++++++------------------- + 1 file changed, 14 insertions(+), 19 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index f143e2af0b5fc..a4baf440b9505 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -315,26 +315,17 @@ static void ov2680_power_down(struct ov2680_dev *sensor) + usleep_range(5000, 10000); + } + +-static int ov2680_bayer_order(struct ov2680_dev *sensor) ++static void ov2680_set_bayer_order(struct ov2680_dev *sensor) + { +- u32 format1; +- u32 format2; +- u32 hv_flip; +- int ret; +- +- ret = ov2680_read_reg(sensor, OV2680_REG_FORMAT1, &format1); +- if (ret < 0) +- return ret; ++ int hv_flip = 0; + +- ret = ov2680_read_reg(sensor, OV2680_REG_FORMAT2, &format2); +- if (ret < 0) +- return ret; ++ if (sensor->ctrls.vflip && sensor->ctrls.vflip->val) ++ hv_flip += 1; + +- hv_flip = (format2 & BIT(2) << 1) | (format1 & BIT(2)); ++ if (sensor->ctrls.hflip && sensor->ctrls.hflip->val) ++ hv_flip += 2; + + sensor->fmt.code = ov2680_hv_flip_bayer_order[hv_flip]; +- +- return 0; + } + + static int ov2680_vflip_enable(struct ov2680_dev *sensor) +@@ -345,7 +336,8 @@ static int ov2680_vflip_enable(struct ov2680_dev *sensor) + if (ret < 0) + return ret; + +- return ov2680_bayer_order(sensor); ++ ov2680_set_bayer_order(sensor); ++ return 0; + } + + static int ov2680_vflip_disable(struct ov2680_dev *sensor) +@@ -356,7 +348,8 @@ static int ov2680_vflip_disable(struct ov2680_dev *sensor) + if (ret < 0) + return ret; + +- return ov2680_bayer_order(sensor); ++ ov2680_set_bayer_order(sensor); ++ return 0; + } + + static int ov2680_hflip_enable(struct ov2680_dev *sensor) +@@ -367,7 +360,8 @@ static int ov2680_hflip_enable(struct ov2680_dev *sensor) + if (ret < 0) + return ret; + +- return ov2680_bayer_order(sensor); ++ ov2680_set_bayer_order(sensor); ++ return 0; + } + + static int ov2680_hflip_disable(struct ov2680_dev *sensor) +@@ -378,7 +372,8 @@ static int ov2680_hflip_disable(struct ov2680_dev *sensor) + if (ret < 0) + return ret; + +- return ov2680_bayer_order(sensor); ++ ov2680_set_bayer_order(sensor); ++ return 0; + } + + static int ov2680_test_pattern_set(struct ov2680_dev *sensor, int value) +-- +2.40.1 + diff --git a/queue-5.4/media-ov2680-fix-regulators-being-left-enabled-on-ov.patch b/queue-5.4/media-ov2680-fix-regulators-being-left-enabled-on-ov.patch new file mode 100644 index 00000000000..d11d794447c --- /dev/null +++ b/queue-5.4/media-ov2680-fix-regulators-being-left-enabled-on-ov.patch @@ -0,0 +1,64 @@ +From b64c710b83fa551d5cd1dae61e0be765ffe97aa5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 11:33:23 +0200 +Subject: media: ov2680: Fix regulators being left enabled on ov2680_power_on() + errors + +From: Hans de Goede + +[ Upstream commit 84b4bd7e0d98166aa32fd470e672721190492eae ] + +When the ov2680_power_on() "sensor soft reset failed" path is hit during +probe() the WARN() about putting an enabled regulator at +drivers/regulator/core.c:2398 triggers 3 times (once for each regulator), +filling dmesg with backtraces. + +Fix this by properly disabling the regulators on ov2680_power_on() errors. + +Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver") +Reviewed-by: Daniel Scally +Acked-by: Rui Miguel Silva +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index 5249a9eb7c81a..731a60f6a59af 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -459,7 +459,7 @@ static int ov2680_power_on(struct ov2680_dev *sensor) + ret = ov2680_write_reg(sensor, OV2680_REG_SOFT_RESET, 0x01); + if (ret != 0) { + dev_err(dev, "sensor soft reset failed\n"); +- return ret; ++ goto err_disable_regulators; + } + usleep_range(1000, 2000); + } else { +@@ -469,7 +469,7 @@ static int ov2680_power_on(struct ov2680_dev *sensor) + + ret = clk_prepare_enable(sensor->xvclk); + if (ret < 0) +- return ret; ++ goto err_disable_regulators; + + sensor->is_enabled = true; + +@@ -479,6 +479,10 @@ static int ov2680_power_on(struct ov2680_dev *sensor) + ov2680_stream_disable(sensor); + + return 0; ++ ++err_disable_regulators: ++ regulator_bulk_disable(OV2680_NUM_SUPPLIES, sensor->supplies); ++ return ret; + } + + static int ov2680_s_power(struct v4l2_subdev *sd, int on) +-- +2.40.1 + diff --git a/queue-5.4/media-ov2680-fix-vflip-hflip-set-functions.patch b/queue-5.4/media-ov2680-fix-vflip-hflip-set-functions.patch new file mode 100644 index 00000000000..12f04ce8cb8 --- /dev/null +++ b/queue-5.4/media-ov2680-fix-vflip-hflip-set-functions.patch @@ -0,0 +1,118 @@ +From 69a0e7cff5f69b531d379806535f34654e829b8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 11:33:18 +0200 +Subject: media: ov2680: Fix vflip / hflip set functions + +From: Hans de Goede + +[ Upstream commit d5d08ad330c9ccebc5e066fda815423a290f48b0 ] + +ov2680_vflip_disable() / ov2680_hflip_disable() pass BIT(0) instead of +0 as value to ov2680_mod_reg(). + +While fixing this also: + +1. Stop having separate enable/disable functions for hflip / vflip +2. Move the is_streaming check, which is unique to hflip / vflip + into the ov2680_set_?flip() functions. + +for a nice code cleanup. + +Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver") +Reviewed-by: Daniel Scally +Acked-by: Rui Miguel Silva +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 50 +++++++++----------------------------- + 1 file changed, 12 insertions(+), 38 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index a4baf440b9505..5249a9eb7c81a 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -328,23 +328,15 @@ static void ov2680_set_bayer_order(struct ov2680_dev *sensor) + sensor->fmt.code = ov2680_hv_flip_bayer_order[hv_flip]; + } + +-static int ov2680_vflip_enable(struct ov2680_dev *sensor) ++static int ov2680_set_vflip(struct ov2680_dev *sensor, s32 val) + { + int ret; + +- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, BIT(2), BIT(2)); +- if (ret < 0) +- return ret; +- +- ov2680_set_bayer_order(sensor); +- return 0; +-} +- +-static int ov2680_vflip_disable(struct ov2680_dev *sensor) +-{ +- int ret; ++ if (sensor->is_streaming) ++ return -EBUSY; + +- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, BIT(2), BIT(0)); ++ ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, ++ BIT(2), val ? BIT(2) : 0); + if (ret < 0) + return ret; + +@@ -352,23 +344,15 @@ static int ov2680_vflip_disable(struct ov2680_dev *sensor) + return 0; + } + +-static int ov2680_hflip_enable(struct ov2680_dev *sensor) ++static int ov2680_set_hflip(struct ov2680_dev *sensor, s32 val) + { + int ret; + +- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, BIT(2), BIT(2)); +- if (ret < 0) +- return ret; +- +- ov2680_set_bayer_order(sensor); +- return 0; +-} +- +-static int ov2680_hflip_disable(struct ov2680_dev *sensor) +-{ +- int ret; ++ if (sensor->is_streaming) ++ return -EBUSY; + +- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, BIT(2), BIT(0)); ++ ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, ++ BIT(2), val ? BIT(2) : 0); + if (ret < 0) + return ret; + +@@ -721,19 +705,9 @@ static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl) + case V4L2_CID_EXPOSURE: + return ov2680_exposure_set(sensor, ctrl->val); + case V4L2_CID_VFLIP: +- if (sensor->is_streaming) +- return -EBUSY; +- if (ctrl->val) +- return ov2680_vflip_enable(sensor); +- else +- return ov2680_vflip_disable(sensor); ++ return ov2680_set_vflip(sensor, ctrl->val); + case V4L2_CID_HFLIP: +- if (sensor->is_streaming) +- return -EBUSY; +- if (ctrl->val) +- return ov2680_hflip_enable(sensor); +- else +- return ov2680_hflip_disable(sensor); ++ return ov2680_set_hflip(sensor, ctrl->val); + case V4L2_CID_TEST_PATTERN: + return ov2680_test_pattern_set(sensor, ctrl->val); + default: +-- +2.40.1 + diff --git a/queue-5.4/media-ov2680-remove-auto-gain-and-auto-exposure-cont.patch b/queue-5.4/media-ov2680-remove-auto-gain-and-auto-exposure-cont.patch new file mode 100644 index 00000000000..58af0ee1cac --- /dev/null +++ b/queue-5.4/media-ov2680-remove-auto-gain-and-auto-exposure-cont.patch @@ -0,0 +1,331 @@ +From 2e362866c0e1dc10c83bae093f3edb1264e34e6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 11:33:16 +0200 +Subject: media: ov2680: Remove auto-gain and auto-exposure controls + +From: Hans de Goede + +[ Upstream commit 7b5a42e6ae71927359ea67a2c22570ba97fa4059 ] + +Quoting the OV2680 datasheet: + +"3.2 exposure and gain control + +In the OV2680, the exposure time and gain are set manually from an external +controller. The OV2680 supports manual gain and exposure control only for +normal applications, no auto mode." + +And indeed testing with the atomisp_ov2680 fork of ov2680.c has shown that +auto-exposure and auto-gain do not work. + +Note that the code setting the auto-exposure flag was broken, callers +of ov2680_exposure_set() were directly passing !!ctrls->auto_exp->val as +"bool auto_exp" value, but ctrls->auto_exp is a menu control with: + +enum v4l2_exposure_auto_type { + V4L2_EXPOSURE_AUTO = 0, + V4L2_EXPOSURE_MANUAL = 1, + ... + +So instead of passing !!ctrls->auto_exp->val they should have been passing +ctrls->auto_exp->val == V4L2_EXPOSURE_AUTO, iow the passed value was +inverted of what it should have been. + +Also remove ov2680_g_volatile_ctrl() since without auto support the gain +and exposure controls are not volatile. + +This also fixes the control values not being properly applied in +ov2680_mode_set(). The 800x600 mode register-list also sets gain, +exposure and vflip overriding the last set ctrl values. + +ov2680_mode_set() does call ov2680_gain_set() and ov2680_exposure_set() +but did this before writing the mode register-list, so these values +would still be overridden by the mode register-list. + +Add a v4l2_ctrl_handler_setup() call after writing the mode register-list +to restore all ctrl values. Also remove the ctrls->gain->is_new check from +ov2680_gain_set() so that the gain always gets restored properly. + +Last since ov2680_mode_set() now calls v4l2_ctrl_handler_setup(), remove +the v4l2_ctrl_handler_setup() call after ov2680_mode_restore() since +ov2680_mode_restore() calls ov2680_mode_set(). + +Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver") +Reviewed-by: Daniel Scally +Acked-by: Rui Miguel Silva +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2680.c | 161 ++++--------------------------------- + 1 file changed, 17 insertions(+), 144 deletions(-) + +diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c +index cd0c083a4768a..f143e2af0b5fc 100644 +--- a/drivers/media/i2c/ov2680.c ++++ b/drivers/media/i2c/ov2680.c +@@ -85,15 +85,8 @@ struct ov2680_mode_info { + + struct ov2680_ctrls { + struct v4l2_ctrl_handler handler; +- struct { +- struct v4l2_ctrl *auto_exp; +- struct v4l2_ctrl *exposure; +- }; +- struct { +- struct v4l2_ctrl *auto_gain; +- struct v4l2_ctrl *gain; +- }; +- ++ struct v4l2_ctrl *exposure; ++ struct v4l2_ctrl *gain; + struct v4l2_ctrl *hflip; + struct v4l2_ctrl *vflip; + struct v4l2_ctrl *test_pattern; +@@ -143,6 +136,7 @@ static const struct reg_value ov2680_setting_30fps_QUXGA_800_600[] = { + {0x380e, 0x02}, {0x380f, 0x84}, {0x3811, 0x04}, {0x3813, 0x04}, + {0x3814, 0x31}, {0x3815, 0x31}, {0x3820, 0xc0}, {0x4008, 0x00}, + {0x4009, 0x03}, {0x4837, 0x1e}, {0x3501, 0x4e}, {0x3502, 0xe0}, ++ {0x3503, 0x03}, + }; + + static const struct reg_value ov2680_setting_30fps_720P_1280_720[] = { +@@ -405,69 +399,15 @@ static int ov2680_test_pattern_set(struct ov2680_dev *sensor, int value) + return 0; + } + +-static int ov2680_gain_set(struct ov2680_dev *sensor, bool auto_gain) +-{ +- struct ov2680_ctrls *ctrls = &sensor->ctrls; +- u32 gain; +- int ret; +- +- ret = ov2680_mod_reg(sensor, OV2680_REG_R_MANUAL, BIT(1), +- auto_gain ? 0 : BIT(1)); +- if (ret < 0) +- return ret; +- +- if (auto_gain || !ctrls->gain->is_new) +- return 0; +- +- gain = ctrls->gain->val; +- +- ret = ov2680_write_reg16(sensor, OV2680_REG_GAIN_PK, gain); +- +- return 0; +-} +- +-static int ov2680_gain_get(struct ov2680_dev *sensor) +-{ +- u32 gain; +- int ret; +- +- ret = ov2680_read_reg16(sensor, OV2680_REG_GAIN_PK, &gain); +- if (ret) +- return ret; +- +- return gain; +-} +- +-static int ov2680_exposure_set(struct ov2680_dev *sensor, bool auto_exp) ++static int ov2680_gain_set(struct ov2680_dev *sensor, u32 gain) + { +- struct ov2680_ctrls *ctrls = &sensor->ctrls; +- u32 exp; +- int ret; +- +- ret = ov2680_mod_reg(sensor, OV2680_REG_R_MANUAL, BIT(0), +- auto_exp ? 0 : BIT(0)); +- if (ret < 0) +- return ret; +- +- if (auto_exp || !ctrls->exposure->is_new) +- return 0; +- +- exp = (u32)ctrls->exposure->val; +- exp <<= 4; +- +- return ov2680_write_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, exp); ++ return ov2680_write_reg16(sensor, OV2680_REG_GAIN_PK, gain); + } + +-static int ov2680_exposure_get(struct ov2680_dev *sensor) ++static int ov2680_exposure_set(struct ov2680_dev *sensor, u32 exp) + { +- int ret; +- u32 exp; +- +- ret = ov2680_read_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, &exp); +- if (ret) +- return ret; +- +- return exp >> 4; ++ return ov2680_write_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, ++ exp << 4); + } + + static int ov2680_stream_enable(struct ov2680_dev *sensor) +@@ -482,33 +422,17 @@ static int ov2680_stream_disable(struct ov2680_dev *sensor) + + static int ov2680_mode_set(struct ov2680_dev *sensor) + { +- struct ov2680_ctrls *ctrls = &sensor->ctrls; + int ret; + +- ret = ov2680_gain_set(sensor, false); +- if (ret < 0) +- return ret; +- +- ret = ov2680_exposure_set(sensor, false); ++ ret = ov2680_load_regs(sensor, sensor->current_mode); + if (ret < 0) + return ret; + +- ret = ov2680_load_regs(sensor, sensor->current_mode); ++ /* Restore value of all ctrls */ ++ ret = __v4l2_ctrl_handler_setup(&sensor->ctrls.handler); + if (ret < 0) + return ret; + +- if (ctrls->auto_gain->val) { +- ret = ov2680_gain_set(sensor, true); +- if (ret < 0) +- return ret; +- } +- +- if (ctrls->auto_exp->val == V4L2_EXPOSURE_AUTO) { +- ret = ov2680_exposure_set(sensor, true); +- if (ret < 0) +- return ret; +- } +- + sensor->mode_pending_changes = false; + + return 0; +@@ -590,15 +514,10 @@ static int ov2680_s_power(struct v4l2_subdev *sd, int on) + else + ret = ov2680_power_off(sensor); + +- mutex_unlock(&sensor->lock); +- +- if (on && ret == 0) { +- ret = v4l2_ctrl_handler_setup(&sensor->ctrls.handler); +- if (ret < 0) +- return ret; +- ++ if (on && ret == 0) + ret = ov2680_mode_restore(sensor); +- } ++ ++ mutex_unlock(&sensor->lock); + + return ret; + } +@@ -793,52 +712,19 @@ static int ov2680_enum_frame_interval(struct v4l2_subdev *sd, + return 0; + } + +-static int ov2680_g_volatile_ctrl(struct v4l2_ctrl *ctrl) +-{ +- struct v4l2_subdev *sd = ctrl_to_sd(ctrl); +- struct ov2680_dev *sensor = to_ov2680_dev(sd); +- struct ov2680_ctrls *ctrls = &sensor->ctrls; +- int val; +- +- if (!sensor->is_enabled) +- return 0; +- +- switch (ctrl->id) { +- case V4L2_CID_GAIN: +- val = ov2680_gain_get(sensor); +- if (val < 0) +- return val; +- ctrls->gain->val = val; +- break; +- case V4L2_CID_EXPOSURE: +- val = ov2680_exposure_get(sensor); +- if (val < 0) +- return val; +- ctrls->exposure->val = val; +- break; +- } +- +- return 0; +-} +- + static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl) + { + struct v4l2_subdev *sd = ctrl_to_sd(ctrl); + struct ov2680_dev *sensor = to_ov2680_dev(sd); +- struct ov2680_ctrls *ctrls = &sensor->ctrls; + + if (!sensor->is_enabled) + return 0; + + switch (ctrl->id) { +- case V4L2_CID_AUTOGAIN: +- return ov2680_gain_set(sensor, !!ctrl->val); + case V4L2_CID_GAIN: +- return ov2680_gain_set(sensor, !!ctrls->auto_gain->val); +- case V4L2_CID_EXPOSURE_AUTO: +- return ov2680_exposure_set(sensor, !!ctrl->val); ++ return ov2680_gain_set(sensor, ctrl->val); + case V4L2_CID_EXPOSURE: +- return ov2680_exposure_set(sensor, !!ctrls->auto_exp->val); ++ return ov2680_exposure_set(sensor, ctrl->val); + case V4L2_CID_VFLIP: + if (sensor->is_streaming) + return -EBUSY; +@@ -863,7 +749,6 @@ static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl) + } + + static const struct v4l2_ctrl_ops ov2680_ctrl_ops = { +- .g_volatile_ctrl = ov2680_g_volatile_ctrl, + .s_ctrl = ov2680_s_ctrl, + }; + +@@ -935,7 +820,7 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor) + if (ret < 0) + return ret; + +- v4l2_ctrl_handler_init(hdl, 7); ++ v4l2_ctrl_handler_init(hdl, 5); + + hdl->lock = &sensor->lock; + +@@ -947,16 +832,9 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor) + ARRAY_SIZE(test_pattern_menu) - 1, + 0, 0, test_pattern_menu); + +- ctrls->auto_exp = v4l2_ctrl_new_std_menu(hdl, ops, +- V4L2_CID_EXPOSURE_AUTO, +- V4L2_EXPOSURE_MANUAL, 0, +- V4L2_EXPOSURE_AUTO); +- + ctrls->exposure = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_EXPOSURE, + 0, 32767, 1, 0); + +- ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_AUTOGAIN, +- 0, 1, 1, 1); + ctrls->gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_GAIN, 0, 2047, 1, 0); + + if (hdl->error) { +@@ -964,14 +842,9 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor) + goto cleanup_entity; + } + +- ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE; +- ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE; + ctrls->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT; + ctrls->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT; + +- v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true); +- v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true); +- + sensor->sd.ctrl_handler = hdl; + + ret = v4l2_async_register_subdev(&sensor->sd); +-- +2.40.1 + diff --git a/queue-5.4/media-ov5640-enable-mipi-interface-in-ov5640_set_pow.patch b/queue-5.4/media-ov5640-enable-mipi-interface-in-ov5640_set_pow.patch new file mode 100644 index 00000000000..b0a29543d13 --- /dev/null +++ b/queue-5.4/media-ov5640-enable-mipi-interface-in-ov5640_set_pow.patch @@ -0,0 +1,51 @@ +From 71d1d8566e36447dc6637d8b0f49c0d276794a68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Aug 2023 16:47:25 +0200 +Subject: media: ov5640: Enable MIPI interface in ov5640_set_power_mipi() + +From: Marek Vasut + +[ Upstream commit 98cb72d3b9c5e03b10fa993752ecfcbd9c572d8c ] + +Set OV5640_REG_IO_MIPI_CTRL00 bit 2 to 1 instead of 0, since 1 means +MIPI CSI2 interface, while 0 means CPI parallel interface. + +In the ov5640_set_power_mipi() the interface should obviously be set +to MIPI CSI2 since this functions is used to power up the sensor when +operated in MIPI CSI2 mode. The sensor should not be in CPI mode in +that case. + +This fixes a corner case where capturing the first frame on i.MX8MN +with CSI/ISI resulted in corrupted frame. + +Fixes: aa4bb8b8838f ("media: ov5640: Re-work MIPI startup sequence") +Reviewed-by: Jacopo Mondi +Tested-by: Jacopo Mondi # [Test on imx6q] +Signed-off-by: Marek Vasut +Tested-by: Jai Luthra # [Test on bplay, sk-am62] +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov5640.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index 76a9fa6d6d5c0..2e5a49e87a74c 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -1927,9 +1927,9 @@ static int ov5640_set_power_mipi(struct ov5640_dev *sensor, bool on) + * "ov5640_set_stream_mipi()") + * [4] = 0 : Power up MIPI HS Tx + * [3] = 0 : Power up MIPI LS Rx +- * [2] = 0 : MIPI interface disabled ++ * [2] = 1 : MIPI interface enabled + */ +- ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x40); ++ ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x44); + if (ret) + return ret; + +-- +2.40.1 + diff --git a/queue-5.4/media-v4l2-core-fix-a-potential-resource-leak-in-v4l.patch b/queue-5.4/media-v4l2-core-fix-a-potential-resource-leak-in-v4l.patch new file mode 100644 index 00000000000..d328880e9cf --- /dev/null +++ b/queue-5.4/media-v4l2-core-fix-a-potential-resource-leak-in-v4l.patch @@ -0,0 +1,70 @@ +From 1302048558884080b53a497a6d804823b57222e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 20:31:05 +0200 +Subject: media: v4l2-core: Fix a potential resource leak in + v4l2_fwnode_parse_link() + +From: Christophe JAILLET + +[ Upstream commit d7b13edd4cb4bfa335b6008ab867ac28582d3e5c ] + +If fwnode_graph_get_remote_endpoint() fails, 'fwnode' is known to be NULL, +so fwnode_handle_put() is a no-op. + +Release the reference taken from a previous fwnode_graph_get_port_parent() +call instead. + +Also handle fwnode_graph_get_port_parent() failures. + +In order to fix these issues, add an error handling path to the function +and the needed gotos. + +Fixes: ca50c197bd96 ("[media] v4l: fwnode: Support generic fwnode for parsing standardised properties") +Signed-off-by: Christophe JAILLET +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-fwnode.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c +index 56aad92b80fc9..00d66495b47d7 100644 +--- a/drivers/media/v4l2-core/v4l2-fwnode.c ++++ b/drivers/media/v4l2-core/v4l2-fwnode.c +@@ -570,18 +570,28 @@ int v4l2_fwnode_parse_link(struct fwnode_handle *fwnode, + fwnode_graph_parse_endpoint(fwnode, &fwep); + link->local_port = fwep.port; + link->local_node = fwnode_graph_get_port_parent(fwnode); ++ if (!link->local_node) ++ return -ENOLINK; + + fwnode = fwnode_graph_get_remote_endpoint(fwnode); +- if (!fwnode) { +- fwnode_handle_put(fwnode); +- return -ENOLINK; +- } ++ if (!fwnode) ++ goto err_put_local_node; + + fwnode_graph_parse_endpoint(fwnode, &fwep); + link->remote_port = fwep.port; + link->remote_node = fwnode_graph_get_port_parent(fwnode); ++ if (!link->remote_node) ++ goto err_put_remote_endpoint; + + return 0; ++ ++err_put_remote_endpoint: ++ fwnode_handle_put(fwnode); ++ ++err_put_local_node: ++ fwnode_handle_put(link->local_node); ++ ++ return -ENOLINK; + } + EXPORT_SYMBOL_GPL(v4l2_fwnode_parse_link); + +-- +2.40.1 + diff --git a/queue-5.4/media-v4l2-fwnode-fix-v4l2_fwnode_parse_link-handlin.patch b/queue-5.4/media-v4l2-fwnode-fix-v4l2_fwnode_parse_link-handlin.patch new file mode 100644 index 00000000000..a02a138fcd8 --- /dev/null +++ b/queue-5.4/media-v4l2-fwnode-fix-v4l2_fwnode_parse_link-handlin.patch @@ -0,0 +1,42 @@ +From 79a32b128e7b8c75ef454298864b539b5573e68f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Mar 2020 11:31:39 +0100 +Subject: media: v4l2-fwnode: fix v4l2_fwnode_parse_link handling + +From: Marco Felsch + +[ Upstream commit 453b0c8304dcbc6eed2836de8fee90bf5bcc7006 ] + +Currently the driver differentiate the port number property handling for +ACPI and DT. This is wrong as because ACPI should use the "reg" val too +[1]. + +[1] https://patchwork.kernel.org/patch/11421985/ + +Fixes: ca50c197bd96 ("[media] v4l: fwnode: Support generic fwnode for parsing standardised properties") +Signed-off-by: Marco Felsch +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: d7b13edd4cb4 ("media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()") +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-fwnode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c +index 48c3b9f72722a..217d67cb31af2 100644 +--- a/drivers/media/v4l2-core/v4l2-fwnode.c ++++ b/drivers/media/v4l2-core/v4l2-fwnode.c +@@ -563,7 +563,7 @@ EXPORT_SYMBOL_GPL(v4l2_fwnode_endpoint_alloc_parse); + int v4l2_fwnode_parse_link(struct fwnode_handle *__fwnode, + struct v4l2_fwnode_link *link) + { +- const char *port_prop = is_of_node(__fwnode) ? "reg" : "port"; ++ const char *port_prop = "reg"; + struct fwnode_handle *fwnode; + + memset(link, 0, sizeof(*link)); +-- +2.40.1 + diff --git a/queue-5.4/media-v4l2-fwnode-simplify-v4l2_fwnode_parse_link.patch b/queue-5.4/media-v4l2-fwnode-simplify-v4l2_fwnode_parse_link.patch new file mode 100644 index 00000000000..9aa386a58f9 --- /dev/null +++ b/queue-5.4/media-v4l2-fwnode-simplify-v4l2_fwnode_parse_link.patch @@ -0,0 +1,71 @@ +From f61c592a8104cd7feb1f1263693b67fdbd01ebed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Mar 2020 11:31:40 +0100 +Subject: media: v4l2-fwnode: simplify v4l2_fwnode_parse_link + +From: Marco Felsch + +[ Upstream commit 507a0ba93aa1cf2837d2abc4ab0cbad3c29409d3 ] + +This helper was introduced before those helpers where awailable. Convert +it to cleanup the code and improbe readability. + +Signed-off-by: Marco Felsch +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: d7b13edd4cb4 ("media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()") +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-fwnode.c | 25 +++++++++---------------- + 1 file changed, 9 insertions(+), 16 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c +index 217d67cb31af2..56aad92b80fc9 100644 +--- a/drivers/media/v4l2-core/v4l2-fwnode.c ++++ b/drivers/media/v4l2-core/v4l2-fwnode.c +@@ -560,33 +560,26 @@ int v4l2_fwnode_endpoint_alloc_parse(struct fwnode_handle *fwnode, + } + EXPORT_SYMBOL_GPL(v4l2_fwnode_endpoint_alloc_parse); + +-int v4l2_fwnode_parse_link(struct fwnode_handle *__fwnode, ++int v4l2_fwnode_parse_link(struct fwnode_handle *fwnode, + struct v4l2_fwnode_link *link) + { +- const char *port_prop = "reg"; +- struct fwnode_handle *fwnode; ++ struct fwnode_endpoint fwep; + + memset(link, 0, sizeof(*link)); + +- fwnode = fwnode_get_parent(__fwnode); +- fwnode_property_read_u32(fwnode, port_prop, &link->local_port); +- fwnode = fwnode_get_next_parent(fwnode); +- if (is_of_node(fwnode) && of_node_name_eq(to_of_node(fwnode), "ports")) +- fwnode = fwnode_get_next_parent(fwnode); +- link->local_node = fwnode; ++ fwnode_graph_parse_endpoint(fwnode, &fwep); ++ link->local_port = fwep.port; ++ link->local_node = fwnode_graph_get_port_parent(fwnode); + +- fwnode = fwnode_graph_get_remote_endpoint(__fwnode); ++ fwnode = fwnode_graph_get_remote_endpoint(fwnode); + if (!fwnode) { + fwnode_handle_put(fwnode); + return -ENOLINK; + } + +- fwnode = fwnode_get_parent(fwnode); +- fwnode_property_read_u32(fwnode, port_prop, &link->remote_port); +- fwnode = fwnode_get_next_parent(fwnode); +- if (is_of_node(fwnode) && of_node_name_eq(to_of_node(fwnode), "ports")) +- fwnode = fwnode_get_next_parent(fwnode); +- link->remote_node = fwnode; ++ fwnode_graph_parse_endpoint(fwnode, &fwep); ++ link->remote_port = fwep.port; ++ link->remote_node = fwnode_graph_get_port_parent(fwnode); + + return 0; + } +-- +2.40.1 + diff --git a/queue-5.4/mlxsw-i2c-fix-chunk-size-setting-in-output-mailbox-b.patch b/queue-5.4/mlxsw-i2c-fix-chunk-size-setting-in-output-mailbox-b.patch new file mode 100644 index 00000000000..b5c8ab25e37 --- /dev/null +++ b/queue-5.4/mlxsw-i2c-fix-chunk-size-setting-in-output-mailbox-b.patch @@ -0,0 +1,43 @@ +From 70c6afb633f7ec1b5c58c4aef1516f987b13be24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 15:43:08 +0200 +Subject: mlxsw: i2c: Fix chunk size setting in output mailbox buffer + +From: Vadim Pasternak + +[ Upstream commit 146c7c330507c0384bf29d567186632bfe975927 ] + +The driver reads commands output from the output mailbox. If the size +of the output mailbox is not a multiple of the transaction / +block size, then the driver will not issue enough read transactions +to read the entire output, which can result in driver initialization +errors. + +Fix by determining the number of transactions using DIV_ROUND_UP(). + +Fixes: 3029a693beda ("mlxsw: i2c: Allow flexible setting of I2C transactions size") +Signed-off-by: Vadim Pasternak +Reviewed-by: Ido Schimmel +Signed-off-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/i2c.c b/drivers/net/ethernet/mellanox/mlxsw/i2c.c +index 7cc4c30af1a71..65976a3ab591e 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/i2c.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/i2c.c +@@ -427,7 +427,7 @@ mlxsw_i2c_cmd(struct device *dev, u16 opcode, u32 in_mod, size_t in_mbox_size, + } else { + /* No input mailbox is case of initialization query command. */ + reg_size = MLXSW_I2C_MAX_DATA_SIZE; +- num = reg_size / mlxsw_i2c->block_size; ++ num = DIV_ROUND_UP(reg_size, mlxsw_i2c->block_size); + + if (mutex_lock_interruptible(&mlxsw_i2c->cmd.lock) < 0) { + dev_err(&client->dev, "Could not acquire lock"); +-- +2.40.1 + diff --git a/queue-5.4/mlxsw-i2c-limit-single-transaction-buffer-size.patch b/queue-5.4/mlxsw-i2c-limit-single-transaction-buffer-size.patch new file mode 100644 index 00000000000..fd9627027b0 --- /dev/null +++ b/queue-5.4/mlxsw-i2c-limit-single-transaction-buffer-size.patch @@ -0,0 +1,56 @@ +From 394fb67f79b258ea55292865aee5e8e07fec106e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 15:43:09 +0200 +Subject: mlxsw: i2c: Limit single transaction buffer size + +From: Vadim Pasternak + +[ Upstream commit d7248f1cc835bd80e936dc5b2d94b149bdd0077d ] + +Maximum size of buffer is obtained from underlying I2C adapter and in +case adapter allows I2C transaction buffer size greater than 100 bytes, +transaction will fail due to firmware limitation. + +As a result driver will fail initialization. + +Limit the maximum size of transaction buffer by 100 bytes to fit to +firmware. + +Remove unnecessary calculation: +max_t(u16, MLXSW_I2C_BLK_DEF, quirk_size). +This condition can not happened. + +Fixes: 3029a693beda ("mlxsw: i2c: Allow flexible setting of I2C transactions size") +Signed-off-by: Vadim Pasternak +Reviewed-by: Petr Machata +Signed-off-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/i2c.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/i2c.c b/drivers/net/ethernet/mellanox/mlxsw/i2c.c +index 65976a3ab591e..b0d44b1361161 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/i2c.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/i2c.c +@@ -47,6 +47,7 @@ + #define MLXSW_I2C_MBOX_SIZE_BITS 12 + #define MLXSW_I2C_ADDR_BUF_SIZE 4 + #define MLXSW_I2C_BLK_DEF 32 ++#define MLXSW_I2C_BLK_MAX 100 + #define MLXSW_I2C_RETRY 5 + #define MLXSW_I2C_TIMEOUT_MSECS 5000 + #define MLXSW_I2C_MAX_DATA_SIZE 256 +@@ -575,7 +576,7 @@ static int mlxsw_i2c_probe(struct i2c_client *client, + return -EOPNOTSUPP; + } + +- mlxsw_i2c->block_size = max_t(u16, MLXSW_I2C_BLK_DEF, ++ mlxsw_i2c->block_size = min_t(u16, MLXSW_I2C_BLK_MAX, + min_t(u16, quirks->max_read_len, + quirks->max_write_len)); + } else { +-- +2.40.1 + diff --git a/queue-5.4/mtd-rawnand-fsmc-handle-clk-prepare-error-in-fsmc_na.patch b/queue-5.4/mtd-rawnand-fsmc-handle-clk-prepare-error-in-fsmc_na.patch new file mode 100644 index 00000000000..ff3facbb171 --- /dev/null +++ b/queue-5.4/mtd-rawnand-fsmc-handle-clk-prepare-error-in-fsmc_na.patch @@ -0,0 +1,44 @@ +From 5c2009ffb373eb2c5685b47f37a2addda2657e30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 19:58:39 +0800 +Subject: mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume() + +From: Yi Yang + +[ Upstream commit a5a88125d00612586e941ae13e7fcf36ba8f18a7 ] + +In fsmc_nand_resume(), the return value of clk_prepare_enable() should be +checked since it might fail. + +Fixes: e25da1c07dfb ("mtd: fsmc_nand: Add clk_{un}prepare() support") +Signed-off-by: Yi Yang +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230817115839.10192-1-yiyang13@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/fsmc_nand.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c +index cc8369a595de3..bccadf8f27fa4 100644 +--- a/drivers/mtd/nand/raw/fsmc_nand.c ++++ b/drivers/mtd/nand/raw/fsmc_nand.c +@@ -1181,9 +1181,14 @@ static int fsmc_nand_suspend(struct device *dev) + static int fsmc_nand_resume(struct device *dev) + { + struct fsmc_nand_data *host = dev_get_drvdata(dev); ++ int ret; + + if (host) { +- clk_prepare_enable(host->clk); ++ ret = clk_prepare_enable(host->clk); ++ if (ret) { ++ dev_err(dev, "failed to enable clk\n"); ++ return ret; ++ } + if (host->dev_timings) + fsmc_nand_setup(host, host->dev_timings); + nand_reset(&host->nand, 0); +-- +2.40.1 + diff --git a/queue-5.4/mwifiex-switch-from-pci_-to-dma_-api.patch b/queue-5.4/mwifiex-switch-from-pci_-to-dma_-api.patch new file mode 100644 index 00000000000..6c99ff3e2a6 --- /dev/null +++ b/queue-5.4/mwifiex-switch-from-pci_-to-dma_-api.patch @@ -0,0 +1,633 @@ +From c15106ad955fc5af05fc5b556a806e468c6218fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 09:01:52 +0200 +Subject: mwifiex: switch from 'pci_' to 'dma_' API + +From: Christophe JAILLET + +[ Upstream commit 4cf975f640fefdfdf6168a79e882558478ce057a ] + +The wrappers in include/linux/pci-dma-compat.h should go away. + +The patch has been generated with the coccinelle script below and has been +hand modified to replace GFP_ with a correct flag. +It has been compile tested. + +When memory is allocated in 'mwifiex_pcie_alloc_buffers()' (see details in +the call chain below) GFP_KERNEL can be used because both +'mwifiex_register()' and 'mwifiex_reinit_sw()' already use GFP_KERNEL. +(for 'mwifiex_reinit_sw()', it is hidden in a call to 'alloc_workqueue()') + +The call chain is: + mwifiex_register + --> mwifiex_init_pcie (.init_if function, see mwifiex_if_ops) + [ or ] + mwifiex_reinit_sw + -->mwifiex_pcie_up_dev (.up_dev function, see mwifiex_if_ops) + + [ then in both case ] + -->mwifiex_pcie_alloc_buffers + --> mwifiex_pcie_create_txbd_ring + --> mwifiex_pcie_create_rxbd_ring + --> mwifiex_pcie_create_evtbd_ring + --> mwifiex_pcie_alloc_sleep_cookie_buf + +@@ +@@ +- PCI_DMA_BIDIRECTIONAL ++ DMA_BIDIRECTIONAL + +@@ +@@ +- PCI_DMA_TODEVICE ++ DMA_TO_DEVICE + +@@ +@@ +- PCI_DMA_FROMDEVICE ++ DMA_FROM_DEVICE + +@@ +@@ +- PCI_DMA_NONE ++ DMA_NONE + +@@ +expression e1, e2, e3; +@@ +- pci_alloc_consistent(e1, e2, e3) ++ dma_alloc_coherent(&e1->dev, e2, e3, GFP_) + +@@ +expression e1, e2, e3; +@@ +- pci_zalloc_consistent(e1, e2, e3) ++ dma_alloc_coherent(&e1->dev, e2, e3, GFP_) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_free_consistent(e1, e2, e3, e4) ++ dma_free_coherent(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_map_single(e1, e2, e3, e4) ++ dma_map_single(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_unmap_single(e1, e2, e3, e4) ++ dma_unmap_single(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4, e5; +@@ +- pci_map_page(e1, e2, e3, e4, e5) ++ dma_map_page(&e1->dev, e2, e3, e4, e5) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_unmap_page(e1, e2, e3, e4) ++ dma_unmap_page(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_map_sg(e1, e2, e3, e4) ++ dma_map_sg(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_unmap_sg(e1, e2, e3, e4) ++ dma_unmap_sg(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_dma_sync_single_for_cpu(e1, e2, e3, e4) ++ dma_sync_single_for_cpu(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_dma_sync_single_for_device(e1, e2, e3, e4) ++ dma_sync_single_for_device(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_dma_sync_sg_for_cpu(e1, e2, e3, e4) ++ dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2, e3, e4; +@@ +- pci_dma_sync_sg_for_device(e1, e2, e3, e4) ++ dma_sync_sg_for_device(&e1->dev, e2, e3, e4) + +@@ +expression e1, e2; +@@ +- pci_dma_mapping_error(e1, e2) ++ dma_mapping_error(&e1->dev, e2) + +@@ +expression e1, e2; +@@ +- pci_set_dma_mask(e1, e2) ++ dma_set_mask(&e1->dev, e2) + +@@ +expression e1, e2; +@@ +- pci_set_consistent_dma_mask(e1, e2) ++ dma_set_coherent_mask(&e1->dev, e2) + +Signed-off-by: Christophe JAILLET +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200819070152.111522-1-christophe.jaillet@wanadoo.fr +Stable-dep-of: 288c63d5cb46 ("wifi: mwifiex: fix error recovery in PCIE buffer descriptor management") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/pcie.c | 153 ++++++++++---------- + 1 file changed, 78 insertions(+), 75 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index b316e34917958..80dde94b65c87 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -58,8 +58,8 @@ mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb, + struct pcie_service_card *card = adapter->card; + struct mwifiex_dma_mapping mapping; + +- mapping.addr = pci_map_single(card->dev, skb->data, size, flags); +- if (pci_dma_mapping_error(card->dev, mapping.addr)) { ++ mapping.addr = dma_map_single(&card->dev->dev, skb->data, size, flags); ++ if (dma_mapping_error(&card->dev->dev, mapping.addr)) { + mwifiex_dbg(adapter, ERROR, "failed to map pci memory!\n"); + return -1; + } +@@ -75,7 +75,7 @@ static void mwifiex_unmap_pci_memory(struct mwifiex_adapter *adapter, + struct mwifiex_dma_mapping mapping; + + mwifiex_get_mapping(skb, &mapping); +- pci_unmap_single(card->dev, mapping.addr, mapping.len, flags); ++ dma_unmap_single(&card->dev->dev, mapping.addr, mapping.len, flags); + } + + /* +@@ -465,10 +465,9 @@ static void mwifiex_delay_for_sleep_cookie(struct mwifiex_adapter *adapter, + struct sk_buff *cmdrsp = card->cmdrsp_buf; + + for (count = 0; count < max_delay_loop_cnt; count++) { +- pci_dma_sync_single_for_cpu(card->dev, +- MWIFIEX_SKB_DMA_ADDR(cmdrsp), +- sizeof(sleep_cookie), +- PCI_DMA_FROMDEVICE); ++ dma_sync_single_for_cpu(&card->dev->dev, ++ MWIFIEX_SKB_DMA_ADDR(cmdrsp), ++ sizeof(sleep_cookie), DMA_FROM_DEVICE); + buffer = cmdrsp->data; + sleep_cookie = get_unaligned_le32(buffer); + +@@ -477,10 +476,10 @@ static void mwifiex_delay_for_sleep_cookie(struct mwifiex_adapter *adapter, + "sleep cookie found at count %d\n", count); + break; + } +- pci_dma_sync_single_for_device(card->dev, +- MWIFIEX_SKB_DMA_ADDR(cmdrsp), +- sizeof(sleep_cookie), +- PCI_DMA_FROMDEVICE); ++ dma_sync_single_for_device(&card->dev->dev, ++ MWIFIEX_SKB_DMA_ADDR(cmdrsp), ++ sizeof(sleep_cookie), ++ DMA_FROM_DEVICE); + usleep_range(20, 30); + } + +@@ -634,7 +633,7 @@ static int mwifiex_init_rxq_ring(struct mwifiex_adapter *adapter) + + if (mwifiex_map_pci_memory(adapter, skb, + MWIFIEX_RX_DATA_BUF_SIZE, +- PCI_DMA_FROMDEVICE)) ++ DMA_FROM_DEVICE)) + return -1; + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); +@@ -691,7 +690,7 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) + skb_put(skb, MAX_EVENT_SIZE); + + if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE, +- PCI_DMA_FROMDEVICE)) { ++ DMA_FROM_DEVICE)) { + kfree_skb(skb); + kfree(card->evtbd_ring_vbase); + return -1; +@@ -734,7 +733,7 @@ static void mwifiex_cleanup_txq_ring(struct mwifiex_adapter *adapter) + if (card->tx_buf_list[i]) { + skb = card->tx_buf_list[i]; + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + dev_kfree_skb_any(skb); + } + memset(desc2, 0, sizeof(*desc2)); +@@ -743,7 +742,7 @@ static void mwifiex_cleanup_txq_ring(struct mwifiex_adapter *adapter) + if (card->tx_buf_list[i]) { + skb = card->tx_buf_list[i]; + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + dev_kfree_skb_any(skb); + } + memset(desc, 0, sizeof(*desc)); +@@ -773,7 +772,7 @@ static void mwifiex_cleanup_rxq_ring(struct mwifiex_adapter *adapter) + if (card->rx_buf_list[i]) { + skb = card->rx_buf_list[i]; + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_FROMDEVICE); ++ DMA_FROM_DEVICE); + dev_kfree_skb_any(skb); + } + memset(desc2, 0, sizeof(*desc2)); +@@ -782,7 +781,7 @@ static void mwifiex_cleanup_rxq_ring(struct mwifiex_adapter *adapter) + if (card->rx_buf_list[i]) { + skb = card->rx_buf_list[i]; + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_FROMDEVICE); ++ DMA_FROM_DEVICE); + dev_kfree_skb_any(skb); + } + memset(desc, 0, sizeof(*desc)); +@@ -808,7 +807,7 @@ static void mwifiex_cleanup_evt_ring(struct mwifiex_adapter *adapter) + if (card->evt_buf_list[i]) { + skb = card->evt_buf_list[i]; + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_FROMDEVICE); ++ DMA_FROM_DEVICE); + dev_kfree_skb_any(skb); + } + card->evt_buf_list[i] = NULL; +@@ -849,9 +848,10 @@ static int mwifiex_pcie_create_txbd_ring(struct mwifiex_adapter *adapter) + mwifiex_dbg(adapter, INFO, + "info: txbd_ring: Allocating %d bytes\n", + card->txbd_ring_size); +- card->txbd_ring_vbase = pci_alloc_consistent(card->dev, +- card->txbd_ring_size, +- &card->txbd_ring_pbase); ++ card->txbd_ring_vbase = dma_alloc_coherent(&card->dev->dev, ++ card->txbd_ring_size, ++ &card->txbd_ring_pbase, ++ GFP_KERNEL); + if (!card->txbd_ring_vbase) { + mwifiex_dbg(adapter, ERROR, + "allocate consistent memory (%d bytes) failed!\n", +@@ -875,9 +875,9 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter) + mwifiex_cleanup_txq_ring(adapter); + + if (card->txbd_ring_vbase) +- pci_free_consistent(card->dev, card->txbd_ring_size, +- card->txbd_ring_vbase, +- card->txbd_ring_pbase); ++ dma_free_coherent(&card->dev->dev, card->txbd_ring_size, ++ card->txbd_ring_vbase, ++ card->txbd_ring_pbase); + card->txbd_ring_size = 0; + card->txbd_wrptr = 0; + card->txbd_rdptr = 0 | reg->tx_rollover_ind; +@@ -913,9 +913,10 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter) + mwifiex_dbg(adapter, INFO, + "info: rxbd_ring: Allocating %d bytes\n", + card->rxbd_ring_size); +- card->rxbd_ring_vbase = pci_alloc_consistent(card->dev, +- card->rxbd_ring_size, +- &card->rxbd_ring_pbase); ++ card->rxbd_ring_vbase = dma_alloc_coherent(&card->dev->dev, ++ card->rxbd_ring_size, ++ &card->rxbd_ring_pbase, ++ GFP_KERNEL); + if (!card->rxbd_ring_vbase) { + mwifiex_dbg(adapter, ERROR, + "allocate consistent memory (%d bytes) failed!\n", +@@ -943,9 +944,9 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter) + mwifiex_cleanup_rxq_ring(adapter); + + if (card->rxbd_ring_vbase) +- pci_free_consistent(card->dev, card->rxbd_ring_size, +- card->rxbd_ring_vbase, +- card->rxbd_ring_pbase); ++ dma_free_coherent(&card->dev->dev, card->rxbd_ring_size, ++ card->rxbd_ring_vbase, ++ card->rxbd_ring_pbase); + card->rxbd_ring_size = 0; + card->rxbd_wrptr = 0; + card->rxbd_rdptr = 0 | reg->rx_rollover_ind; +@@ -977,9 +978,10 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter) + mwifiex_dbg(adapter, INFO, + "info: evtbd_ring: Allocating %d bytes\n", + card->evtbd_ring_size); +- card->evtbd_ring_vbase = pci_alloc_consistent(card->dev, +- card->evtbd_ring_size, +- &card->evtbd_ring_pbase); ++ card->evtbd_ring_vbase = dma_alloc_coherent(&card->dev->dev, ++ card->evtbd_ring_size, ++ &card->evtbd_ring_pbase, ++ GFP_KERNEL); + if (!card->evtbd_ring_vbase) { + mwifiex_dbg(adapter, ERROR, + "allocate consistent memory (%d bytes) failed!\n", +@@ -1007,9 +1009,9 @@ static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter) + mwifiex_cleanup_evt_ring(adapter); + + if (card->evtbd_ring_vbase) +- pci_free_consistent(card->dev, card->evtbd_ring_size, +- card->evtbd_ring_vbase, +- card->evtbd_ring_pbase); ++ dma_free_coherent(&card->dev->dev, card->evtbd_ring_size, ++ card->evtbd_ring_vbase, ++ card->evtbd_ring_pbase); + card->evtbd_wrptr = 0; + card->evtbd_rdptr = 0 | reg->evt_rollover_ind; + card->evtbd_ring_size = 0; +@@ -1036,7 +1038,7 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter) + } + skb_put(skb, MWIFIEX_UPLD_SIZE); + if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, +- PCI_DMA_FROMDEVICE)) { ++ DMA_FROM_DEVICE)) { + kfree_skb(skb); + return -1; + } +@@ -1060,14 +1062,14 @@ static int mwifiex_pcie_delete_cmdrsp_buf(struct mwifiex_adapter *adapter) + + if (card && card->cmdrsp_buf) { + mwifiex_unmap_pci_memory(adapter, card->cmdrsp_buf, +- PCI_DMA_FROMDEVICE); ++ DMA_FROM_DEVICE); + dev_kfree_skb_any(card->cmdrsp_buf); + card->cmdrsp_buf = NULL; + } + + if (card && card->cmd_buf) { + mwifiex_unmap_pci_memory(adapter, card->cmd_buf, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + dev_kfree_skb_any(card->cmd_buf); + card->cmd_buf = NULL; + } +@@ -1082,8 +1084,10 @@ static int mwifiex_pcie_alloc_sleep_cookie_buf(struct mwifiex_adapter *adapter) + struct pcie_service_card *card = adapter->card; + u32 *cookie; + +- card->sleep_cookie_vbase = pci_alloc_consistent(card->dev, sizeof(u32), +- &card->sleep_cookie_pbase); ++ card->sleep_cookie_vbase = dma_alloc_coherent(&card->dev->dev, ++ sizeof(u32), ++ &card->sleep_cookie_pbase, ++ GFP_KERNEL); + if (!card->sleep_cookie_vbase) { + mwifiex_dbg(adapter, ERROR, + "pci_alloc_consistent failed!\n"); +@@ -1111,9 +1115,9 @@ static int mwifiex_pcie_delete_sleep_cookie_buf(struct mwifiex_adapter *adapter) + card = adapter->card; + + if (card && card->sleep_cookie_vbase) { +- pci_free_consistent(card->dev, sizeof(u32), +- card->sleep_cookie_vbase, +- card->sleep_cookie_pbase); ++ dma_free_coherent(&card->dev->dev, sizeof(u32), ++ card->sleep_cookie_vbase, ++ card->sleep_cookie_pbase); + card->sleep_cookie_vbase = NULL; + } + +@@ -1185,7 +1189,7 @@ static int mwifiex_pcie_send_data_complete(struct mwifiex_adapter *adapter) + "SEND COMP: Detach skb %p at txbd_rdidx=%d\n", + skb, wrdoneidx); + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + + unmap_count++; + +@@ -1278,7 +1282,7 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb, + put_unaligned_le16(MWIFIEX_TYPE_DATA, payload + 2); + + if (mwifiex_map_pci_memory(adapter, skb, skb->len, +- PCI_DMA_TODEVICE)) ++ DMA_TO_DEVICE)) + return -1; + + wrindx = (card->txbd_wrptr & reg->tx_mask) >> reg->tx_start_ptr; +@@ -1368,7 +1372,7 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb, + + return -EINPROGRESS; + done_unmap: +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE); + card->tx_buf_list[wrindx] = NULL; + atomic_dec(&adapter->tx_hw_pending); + if (reg->pfu_enabled) +@@ -1422,7 +1426,7 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter) + if (!skb_data) + return -ENOMEM; + +- mwifiex_unmap_pci_memory(adapter, skb_data, PCI_DMA_FROMDEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb_data, DMA_FROM_DEVICE); + card->rx_buf_list[rd_index] = NULL; + + /* Get data length from interface header - +@@ -1460,7 +1464,7 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter) + + if (mwifiex_map_pci_memory(adapter, skb_tmp, + MWIFIEX_RX_DATA_BUF_SIZE, +- PCI_DMA_FROMDEVICE)) ++ DMA_FROM_DEVICE)) + return -1; + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb_tmp); +@@ -1537,7 +1541,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) + return -1; + } + +- if (mwifiex_map_pci_memory(adapter, skb, skb->len, PCI_DMA_TODEVICE)) ++ if (mwifiex_map_pci_memory(adapter, skb, skb->len, DMA_TO_DEVICE)) + return -1; + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); +@@ -1549,7 +1553,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) + mwifiex_dbg(adapter, ERROR, + "%s: failed to write download command to boot code.\n", + __func__); +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE); + return -1; + } + +@@ -1561,7 +1565,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) + mwifiex_dbg(adapter, ERROR, + "%s: failed to write download command to boot code.\n", + __func__); +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE); + return -1; + } + +@@ -1570,7 +1574,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) + mwifiex_dbg(adapter, ERROR, + "%s: failed to write command len to cmd_size scratch reg\n", + __func__); +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE); + return -1; + } + +@@ -1579,7 +1583,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) + CPU_INTR_DOOR_BELL)) { + mwifiex_dbg(adapter, ERROR, + "%s: failed to assert door-bell intr\n", __func__); +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE); + return -1; + } + +@@ -1638,7 +1642,7 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) + put_unaligned_le16((u16)skb->len, &payload[0]); + put_unaligned_le16(MWIFIEX_TYPE_CMD, &payload[2]); + +- if (mwifiex_map_pci_memory(adapter, skb, skb->len, PCI_DMA_TODEVICE)) ++ if (mwifiex_map_pci_memory(adapter, skb, skb->len, DMA_TO_DEVICE)) + return -1; + + card->cmd_buf = skb; +@@ -1738,17 +1742,16 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter) + "info: Rx CMD Response\n"); + + if (adapter->curr_cmd) +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_FROMDEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_FROM_DEVICE); + else +- pci_dma_sync_single_for_cpu(card->dev, +- MWIFIEX_SKB_DMA_ADDR(skb), +- MWIFIEX_UPLD_SIZE, +- PCI_DMA_FROMDEVICE); ++ dma_sync_single_for_cpu(&card->dev->dev, ++ MWIFIEX_SKB_DMA_ADDR(skb), ++ MWIFIEX_UPLD_SIZE, DMA_FROM_DEVICE); + + /* Unmap the command as a response has been received. */ + if (card->cmd_buf) { + mwifiex_unmap_pci_memory(adapter, card->cmd_buf, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + dev_kfree_skb_any(card->cmd_buf); + card->cmd_buf = NULL; + } +@@ -1759,10 +1762,10 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter) + + if (!adapter->curr_cmd) { + if (adapter->ps_state == PS_STATE_SLEEP_CFM) { +- pci_dma_sync_single_for_device(card->dev, +- MWIFIEX_SKB_DMA_ADDR(skb), +- MWIFIEX_SLEEP_COOKIE_SIZE, +- PCI_DMA_FROMDEVICE); ++ dma_sync_single_for_device(&card->dev->dev, ++ MWIFIEX_SKB_DMA_ADDR(skb), ++ MWIFIEX_SLEEP_COOKIE_SIZE, ++ DMA_FROM_DEVICE); + if (mwifiex_write_reg(adapter, + PCIE_CPU_INT_EVENT, + CPU_INTR_SLEEP_CFM_DONE)) { +@@ -1773,7 +1776,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter) + mwifiex_delay_for_sleep_cookie(adapter, + MWIFIEX_MAX_DELAY_COUNT); + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_FROMDEVICE); ++ DMA_FROM_DEVICE); + skb_pull(skb, adapter->intf_hdr_len); + while (reg->sleep_cookie && (count++ < 10) && + mwifiex_pcie_ok_to_access_hw(adapter)) +@@ -1789,7 +1792,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter) + min_t(u32, MWIFIEX_SIZE_OF_CMD_BUFFER, skb->len)); + skb_push(skb, adapter->intf_hdr_len); + if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, +- PCI_DMA_FROMDEVICE)) ++ DMA_FROM_DEVICE)) + return -1; + } else if (mwifiex_pcie_ok_to_access_hw(adapter)) { + skb_pull(skb, adapter->intf_hdr_len); +@@ -1831,7 +1834,7 @@ static int mwifiex_pcie_cmdrsp_complete(struct mwifiex_adapter *adapter, + card->cmdrsp_buf = skb; + skb_push(card->cmdrsp_buf, adapter->intf_hdr_len); + if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, +- PCI_DMA_FROMDEVICE)) ++ DMA_FROM_DEVICE)) + return -1; + } + +@@ -1886,7 +1889,7 @@ static int mwifiex_pcie_process_event_ready(struct mwifiex_adapter *adapter) + mwifiex_dbg(adapter, INFO, + "info: Read Index: %d\n", rdptr); + skb_cmd = card->evt_buf_list[rdptr]; +- mwifiex_unmap_pci_memory(adapter, skb_cmd, PCI_DMA_FROMDEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb_cmd, DMA_FROM_DEVICE); + + /* Take the pointer and set it to event pointer in adapter + and will return back after event handling callback */ +@@ -1966,7 +1969,7 @@ static int mwifiex_pcie_event_complete(struct mwifiex_adapter *adapter, + skb_put(skb, MAX_EVENT_SIZE - skb->len); + if (mwifiex_map_pci_memory(adapter, skb, + MAX_EVENT_SIZE, +- PCI_DMA_FROMDEVICE)) ++ DMA_FROM_DEVICE)) + return -1; + card->evt_buf_list[rdptr] = skb; + desc = card->evtbd_ring[rdptr]; +@@ -2248,7 +2251,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter, + "interrupt status during fw dnld.\n", + __func__); + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + ret = -1; + goto done; + } +@@ -2260,12 +2263,12 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter, + mwifiex_dbg(adapter, ERROR, "%s: Card failed to ACK download\n", + __func__); + mwifiex_unmap_pci_memory(adapter, skb, +- PCI_DMA_TODEVICE); ++ DMA_TO_DEVICE); + ret = -1; + goto done; + } + +- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE); ++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE); + + offset += txlen; + } while (true); +@@ -2935,13 +2938,13 @@ static int mwifiex_init_pcie(struct mwifiex_adapter *adapter) + + pci_set_master(pdev); + +- ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)); ++ ret = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32)); + if (ret) { + pr_err("set_dma_mask(32) failed: %d\n", ret); + goto err_set_dma_mask; + } + +- ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)); ++ ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); + if (ret) { + pr_err("set_consistent_dma_mask(64) failed\n"); + goto err_set_dma_mask; +-- +2.40.1 + diff --git a/queue-5.4/net-arcnet-do-not-call-kfree_skb-under-local_irq_dis.patch b/queue-5.4/net-arcnet-do-not-call-kfree_skb-under-local_irq_dis.patch new file mode 100644 index 00000000000..e832d67c770 --- /dev/null +++ b/queue-5.4/net-arcnet-do-not-call-kfree_skb-under-local_irq_dis.patch @@ -0,0 +1,38 @@ +From f971925e2d2db7b7aafa4d1ab003d13c5610726b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 14:43:36 +0800 +Subject: net: arcnet: Do not call kfree_skb() under local_irq_disable() + +From: Jinjie Ruan + +[ Upstream commit 786c96e92fb9e854cb8b0cb7399bb2fb28e15c4b ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with hardware interrupts being disabled. +So replace kfree_skb() with dev_kfree_skb_irq() under +local_irq_disable(). Compile tested only. + +Fixes: 05fcd31cc472 ("arcnet: add err_skb package for package status feedback") +Signed-off-by: Jinjie Ruan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/arcnet/arcnet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c +index 553776cc1d29d..2b112d3d85409 100644 +--- a/drivers/net/arcnet/arcnet.c ++++ b/drivers/net/arcnet/arcnet.c +@@ -434,7 +434,7 @@ static void arcnet_reply_tasklet(unsigned long data) + + ret = sock_queue_err_skb(sk, ackskb); + if (ret) +- kfree_skb(ackskb); ++ dev_kfree_skb_irq(ackskb); + + local_irq_enable(); + }; +-- +2.40.1 + diff --git a/queue-5.4/net-sched-sch_hfsc-ensure-inner-classes-have-fsc-cur.patch b/queue-5.4/net-sched-sch_hfsc-ensure-inner-classes-have-fsc-cur.patch new file mode 100644 index 00000000000..2838d42cc6d --- /dev/null +++ b/queue-5.4/net-sched-sch_hfsc-ensure-inner-classes-have-fsc-cur.patch @@ -0,0 +1,44 @@ +From 7b51da790bc727dcd0a695996e2c786ff8f2ffc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 01:49:05 -0700 +Subject: net/sched: sch_hfsc: Ensure inner classes have fsc curve + +From: Budimir Markovic + +[ Upstream commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f ] + +HFSC assumes that inner classes have an fsc curve, but it is currently +possible for classes without an fsc curve to become parents. This leads +to bugs including a use-after-free. + +Don't allow non-root classes without HFSC_FSC to become parents. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Budimir Markovic +Signed-off-by: Budimir Markovic +Acked-by: Jamal Hadi Salim +Link: https://lore.kernel.org/r/20230824084905.422-1-markovicbudimir@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_hfsc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c +index 92ad4115e473c..2af4adb7e84e4 100644 +--- a/net/sched/sch_hfsc.c ++++ b/net/sched/sch_hfsc.c +@@ -1012,6 +1012,10 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid, + if (parent == NULL) + return -ENOENT; + } ++ if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) { ++ NL_SET_ERR_MSG(extack, "Invalid parent - parent class must have FSC"); ++ return -EINVAL; ++ } + + if (classid == 0 || TC_H_MAJ(classid ^ sch->handle) != 0) + return -EINVAL; +-- +2.40.1 + diff --git a/queue-5.4/netrom-deny-concurrent-connect.patch b/queue-5.4/netrom-deny-concurrent-connect.patch new file mode 100644 index 00000000000..8bc07a61531 --- /dev/null +++ b/queue-5.4/netrom-deny-concurrent-connect.patch @@ -0,0 +1,139 @@ +From c34ae6595142db1b66011c0f5f0ef9278977196a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Aug 2023 09:50:59 -0700 +Subject: netrom: Deny concurrent connect(). + +From: Kuniyuki Iwashima + +[ Upstream commit c2f8fd7949603efb03908e05abbf7726748c8de3 ] + +syzkaller reported null-ptr-deref [0] related to AF_NETROM. +This is another self-accept issue from the strace log. [1] + +syz-executor creates an AF_NETROM socket and calls connect(), which +is blocked at that time. Then, sk->sk_state is TCP_SYN_SENT and +sock->state is SS_CONNECTING. + + [pid 5059] socket(AF_NETROM, SOCK_SEQPACKET, 0) = 4 + [pid 5059] connect(4, {sa_family=AF_NETROM, sa_data="..." + +Another thread calls connect() concurrently, which finally fails +with -EINVAL. However, the problem here is the socket state is +reset even while the first connect() is blocked. + + [pid 5060] connect(4, NULL, 0 + [pid 5060] <... connect resumed>) = -1 EINVAL (Invalid argument) + +As sk->state is TCP_CLOSE and sock->state is SS_UNCONNECTED, the +following listen() succeeds. Then, the first connect() looks up +itself as a listener and puts skb into the queue with skb->sk itself. +As a result, the next accept() gets another FD of itself as 3, and +the first connect() finishes. + + [pid 5060] listen(4, 0 + [pid 5060] <... listen resumed>) = 0 + [pid 5060] accept(4, NULL, NULL + [pid 5060] <... accept resumed>) = 3 + [pid 5059] <... connect resumed>) = 0 + +Then, accept4() is called but blocked, which causes the general protection +fault later. + + [pid 5059] accept4(4, NULL, 0x20000400, SOCK_NONBLOCK + +After that, another self-accept occurs by accept() and writev(). + + [pid 5060] accept(4, NULL, NULL + [pid 5061] writev(3, [{iov_base=...}] + [pid 5061] <... writev resumed>) = 99 + [pid 5060] <... accept resumed>) = 6 + +Finally, the leader thread close()s all FDs. Since the three FDs +reference the same socket, nr_release() does the cleanup for it +three times, and the remaining accept4() causes the following fault. + + [pid 5058] close(3) = 0 + [pid 5058] close(4) = 0 + [pid 5058] close(5) = -1 EBADF (Bad file descriptor) + [pid 5058] close(6) = 0 + [pid 5058] <... exit_group resumed>) = ? + [ 83.456055][ T5059] general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN + +To avoid the issue, we need to return an error for connect() if +another connect() is in progress, as done in __inet_stream_connect(). + +[0]: +general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] +CPU: 0 PID: 5059 Comm: syz-executor.0 Not tainted 6.5.0-rc5-syzkaller-00194-gace0ab3a4b54 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 +RIP: 0010:__lock_acquire+0x109/0x5de0 kernel/locking/lockdep.c:5012 +Code: 45 85 c9 0f 84 cc 0e 00 00 44 8b 05 11 6e 23 0b 45 85 c0 0f 84 be 0d 00 00 48 ba 00 00 00 00 00 fc ff df 4c 89 d1 48 c1 e9 03 <80> 3c 11 00 0f 85 e8 40 00 00 49 81 3a a0 69 48 90 0f 84 96 0d 00 +RSP: 0018:ffffc90003d6f9e0 EFLAGS: 00010006 +RAX: ffff8880244c8000 RBX: 1ffff920007adf6c RCX: 0000000000000003 +RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000018 +RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000001 +R10: 0000000000000018 R11: 0000000000000000 R12: 0000000000000000 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 +FS: 00007f51d519a6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f51d5158d58 CR3: 000000002943f000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + lock_acquire kernel/locking/lockdep.c:5761 [inline] + lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5726 + __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] + _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162 + prepare_to_wait+0x47/0x380 kernel/sched/wait.c:269 + nr_accept+0x20d/0x650 net/netrom/af_netrom.c:798 + do_accept+0x3a6/0x570 net/socket.c:1872 + __sys_accept4_file net/socket.c:1913 [inline] + __sys_accept4+0x99/0x120 net/socket.c:1943 + __do_sys_accept4 net/socket.c:1954 [inline] + __se_sys_accept4 net/socket.c:1951 [inline] + __x64_sys_accept4+0x96/0x100 net/socket.c:1951 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f51d447cae9 +Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f51d519a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 +RAX: ffffffffffffffda RBX: 00007f51d459bf80 RCX: 00007f51d447cae9 +RDX: 0000000020000400 RSI: 0000000000000000 RDI: 0000000000000004 +RBP: 00007f51d44c847a R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000000 +R13: 000000000000000b R14: 00007f51d459bf80 R15: 00007ffc25c34e48 + + +Link: https://syzkaller.appspot.com/text?tag=CrashLog&x=152cdb63a80000 [1] +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: syzbot+666c97e4686410e79649@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=666c97e4686410e79649 +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/netrom/af_netrom.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index 7da77ddba5f4d..e18a73264c103 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -638,6 +638,11 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr, + goto out_release; + } + ++ if (sock->state == SS_CONNECTING) { ++ err = -EALREADY; ++ goto out_release; ++ } ++ + sk->sk_state = TCP_CLOSE; + sock->state = SS_UNCONNECTED; + +-- +2.40.1 + diff --git a/queue-5.4/new-helper-lookup_positive_unlocked.patch b/queue-5.4/new-helper-lookup_positive_unlocked.patch new file mode 100644 index 00000000000..1d4f301bfba --- /dev/null +++ b/queue-5.4/new-helper-lookup_positive_unlocked.patch @@ -0,0 +1,284 @@ +From 82defc87cb346eae9e0daa88e1885097be8430d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2019 01:21:58 -0400 +Subject: new helper: lookup_positive_unlocked() + +From: Al Viro + +[ Upstream commit 6c2d4798a8d16cf4f3a28c3cd4af4f1dcbbb4d04 ] + +Most of the callers of lookup_one_len_unlocked() treat negatives are +ERR_PTR(-ENOENT). Provide a helper that would do just that. Note +that a pinned positive dentry remains positive - it's ->d_inode is +stable, etc.; a pinned _negative_ dentry can become positive at any +point as long as you are not holding its parent at least shared. +So using lookup_one_len_unlocked() needs to be careful; +lookup_positive_unlocked() is safer and that's what the callers +end up open-coding anyway. + +Signed-off-by: Al Viro +Stable-dep-of: 0d5a4f8f775f ("fs: Fix error checking for d_hash_and_lookup()") +Signed-off-by: Sasha Levin +--- + fs/cifs/cifsfs.c | 7 +------ + fs/debugfs/inode.c | 6 +----- + fs/kernfs/mount.c | 2 +- + fs/namei.c | 20 ++++++++++++++++++++ + fs/nfsd/nfs3xdr.c | 4 +--- + fs/nfsd/nfs4xdr.c | 11 +---------- + fs/overlayfs/namei.c | 24 ++++++++---------------- + fs/quota/dquot.c | 7 +------ + include/linux/namei.h | 1 + + 9 files changed, 35 insertions(+), 47 deletions(-) + +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 871a7b044c1b8..b6149952ab846 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -738,11 +738,6 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb) + struct inode *dir = d_inode(dentry); + struct dentry *child; + +- if (!dir) { +- dput(dentry); +- dentry = ERR_PTR(-ENOENT); +- break; +- } + if (!S_ISDIR(dir->i_mode)) { + dput(dentry); + dentry = ERR_PTR(-ENOTDIR); +@@ -759,7 +754,7 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb) + while (*s && *s != sep) + s++; + +- child = lookup_one_len_unlocked(p, dentry, s - p); ++ child = lookup_positive_unlocked(p, dentry, s - p); + dput(dentry); + dentry = child; + } while (!IS_ERR(dentry)); +diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c +index e0f07382ebebc..258230f4e4855 100644 +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -299,13 +299,9 @@ struct dentry *debugfs_lookup(const char *name, struct dentry *parent) + if (!parent) + parent = debugfs_mount->mnt_root; + +- dentry = lookup_one_len_unlocked(name, parent, strlen(name)); ++ dentry = lookup_positive_unlocked(name, parent, strlen(name)); + if (IS_ERR(dentry)) + return NULL; +- if (!d_really_is_positive(dentry)) { +- dput(dentry); +- return NULL; +- } + return dentry; + } + EXPORT_SYMBOL_GPL(debugfs_lookup); +diff --git a/fs/kernfs/mount.c b/fs/kernfs/mount.c +index 6c12fac2c2878..d62cec6d838d6 100644 +--- a/fs/kernfs/mount.c ++++ b/fs/kernfs/mount.c +@@ -200,7 +200,7 @@ struct dentry *kernfs_node_dentry(struct kernfs_node *kn, + dput(dentry); + return ERR_PTR(-EINVAL); + } +- dtmp = lookup_one_len_unlocked(kntmp->name, dentry, ++ dtmp = lookup_positive_unlocked(kntmp->name, dentry, + strlen(kntmp->name)); + dput(dentry); + if (IS_ERR(dtmp)) +diff --git a/fs/namei.c b/fs/namei.c +index 14e600711f504..21988d22399f9 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -2565,6 +2565,26 @@ struct dentry *lookup_one_len_unlocked(const char *name, + } + EXPORT_SYMBOL(lookup_one_len_unlocked); + ++/* ++ * Like lookup_one_len_unlocked(), except that it yields ERR_PTR(-ENOENT) ++ * on negatives. Returns known positive or ERR_PTR(); that's what ++ * most of the users want. Note that pinned negative with unlocked parent ++ * _can_ become positive at any time, so callers of lookup_one_len_unlocked() ++ * need to be very careful; pinned positives have ->d_inode stable, so ++ * this one avoids such problems. ++ */ ++struct dentry *lookup_positive_unlocked(const char *name, ++ struct dentry *base, int len) ++{ ++ struct dentry *ret = lookup_one_len_unlocked(name, base, len); ++ if (!IS_ERR(ret) && d_is_negative(ret)) { ++ dput(ret); ++ ret = ERR_PTR(-ENOENT); ++ } ++ return ret; ++} ++EXPORT_SYMBOL(lookup_positive_unlocked); ++ + #ifdef CONFIG_UNIX98_PTYS + int path_pts(struct path *path) + { +diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c +index 8f077e66e613f..03e8c45a52f3c 100644 +--- a/fs/nfsd/nfs3xdr.c ++++ b/fs/nfsd/nfs3xdr.c +@@ -868,13 +868,11 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp, + } else + dchild = dget(dparent); + } else +- dchild = lookup_one_len_unlocked(name, dparent, namlen); ++ dchild = lookup_positive_unlocked(name, dparent, namlen); + if (IS_ERR(dchild)) + return rv; + if (d_mountpoint(dchild)) + goto out; +- if (d_really_is_negative(dchild)) +- goto out; + if (dchild->d_inode->i_ino != ino) + goto out; + rv = fh_compose(fhp, exp, dchild, &cd->fh); +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index ff95a08574721..3d7b0ad4157df 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -2991,18 +2991,9 @@ nfsd4_encode_dirent_fattr(struct xdr_stream *xdr, struct nfsd4_readdir *cd, + __be32 nfserr; + int ignore_crossmnt = 0; + +- dentry = lookup_one_len_unlocked(name, cd->rd_fhp->fh_dentry, namlen); ++ dentry = lookup_positive_unlocked(name, cd->rd_fhp->fh_dentry, namlen); + if (IS_ERR(dentry)) + return nfserrno(PTR_ERR(dentry)); +- if (d_really_is_negative(dentry)) { +- /* +- * we're not holding the i_mutex here, so there's +- * a window where this directory entry could have gone +- * away. +- */ +- dput(dentry); +- return nfserr_noent; +- } + + exp_get(exp); + /* +diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c +index f47c591402d76..625da4bc8d0fc 100644 +--- a/fs/overlayfs/namei.c ++++ b/fs/overlayfs/namei.c +@@ -200,7 +200,7 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d, + int err; + bool last_element = !post[0]; + +- this = lookup_one_len_unlocked(name, base, namelen); ++ this = lookup_positive_unlocked(name, base, namelen); + if (IS_ERR(this)) { + err = PTR_ERR(this); + this = NULL; +@@ -208,8 +208,6 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d, + goto out; + goto out_err; + } +- if (!this->d_inode) +- goto put_and_out; + + if (ovl_dentry_weird(this)) { + /* Don't support traversing automounts and other weirdness */ +@@ -659,7 +657,7 @@ struct dentry *ovl_get_index_fh(struct ovl_fs *ofs, struct ovl_fh *fh) + if (err) + return ERR_PTR(err); + +- index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len); ++ index = lookup_positive_unlocked(name.name, ofs->indexdir, name.len); + kfree(name.name); + if (IS_ERR(index)) { + if (PTR_ERR(index) == -ENOENT) +@@ -667,9 +665,7 @@ struct dentry *ovl_get_index_fh(struct ovl_fs *ofs, struct ovl_fh *fh) + return index; + } + +- if (d_is_negative(index)) +- err = 0; +- else if (ovl_is_whiteout(index)) ++ if (ovl_is_whiteout(index)) + err = -ESTALE; + else if (ovl_dentry_weird(index)) + err = -EIO; +@@ -693,7 +689,7 @@ struct dentry *ovl_lookup_index(struct ovl_fs *ofs, struct dentry *upper, + if (err) + return ERR_PTR(err); + +- index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len); ++ index = lookup_positive_unlocked(name.name, ofs->indexdir, name.len); + if (IS_ERR(index)) { + err = PTR_ERR(index); + if (err == -ENOENT) { +@@ -708,9 +704,7 @@ struct dentry *ovl_lookup_index(struct ovl_fs *ofs, struct dentry *upper, + } + + inode = d_inode(index); +- if (d_is_negative(index)) { +- goto out_dput; +- } else if (ovl_is_whiteout(index) && !verify) { ++ if (ovl_is_whiteout(index) && !verify) { + /* + * When index lookup is called with !verify for decoding an + * overlay file handle, a whiteout index implies that decode +@@ -1139,7 +1133,7 @@ bool ovl_lower_positive(struct dentry *dentry) + struct dentry *this; + struct dentry *lowerdir = poe->lowerstack[i].dentry; + +- this = lookup_one_len_unlocked(name->name, lowerdir, ++ this = lookup_positive_unlocked(name->name, lowerdir, + name->len); + if (IS_ERR(this)) { + switch (PTR_ERR(this)) { +@@ -1156,10 +1150,8 @@ bool ovl_lower_positive(struct dentry *dentry) + break; + } + } else { +- if (this->d_inode) { +- positive = !ovl_is_whiteout(this); +- done = true; +- } ++ positive = !ovl_is_whiteout(this); ++ done = true; + dput(this); + } + } +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 3d1a71d2909bb..5361e6bc397d0 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -2543,15 +2543,10 @@ int dquot_quota_on_mount(struct super_block *sb, char *qf_name, + struct dentry *dentry; + int error; + +- dentry = lookup_one_len_unlocked(qf_name, sb->s_root, strlen(qf_name)); ++ dentry = lookup_positive_unlocked(qf_name, sb->s_root, strlen(qf_name)); + if (IS_ERR(dentry)) + return PTR_ERR(dentry); + +- if (d_really_is_negative(dentry)) { +- error = -ENOENT; +- goto out; +- } +- + error = security_quota_on(dentry); + if (!error) + error = vfs_load_quota_inode(d_inode(dentry), type, format_id, +diff --git a/include/linux/namei.h b/include/linux/namei.h +index 397a08ade6a21..7fe7b87a3ded9 100644 +--- a/include/linux/namei.h ++++ b/include/linux/namei.h +@@ -60,6 +60,7 @@ extern int kern_path_mountpoint(int, const char *, struct path *, unsigned int); + extern struct dentry *try_lookup_one_len(const char *, struct dentry *, int); + extern struct dentry *lookup_one_len(const char *, struct dentry *, int); + extern struct dentry *lookup_one_len_unlocked(const char *, struct dentry *, int); ++extern struct dentry *lookup_positive_unlocked(const char *, struct dentry *, int); + + extern int follow_down_one(struct path *); + extern int follow_down(struct path *); +-- +2.40.1 + diff --git a/queue-5.4/nfs-blocklayout-use-the-passed-in-gfp-flags.patch b/queue-5.4/nfs-blocklayout-use-the-passed-in-gfp-flags.patch new file mode 100644 index 00000000000..cd264826c6d --- /dev/null +++ b/queue-5.4/nfs-blocklayout-use-the-passed-in-gfp-flags.patch @@ -0,0 +1,47 @@ +From 9a4d282d9b5eee72ae0c052569967e79d02b02b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 11:08:46 +0300 +Subject: nfs/blocklayout: Use the passed in gfp flags + +From: Dan Carpenter + +[ Upstream commit 08b45fcb2d4675f6182fe0edc0d8b1fe604051fa ] + +This allocation should use the passed in GFP_ flags instead of +GFP_KERNEL. One places where this matters is in filelayout_pg_init_write() +which uses GFP_NOFS as the allocation flags. + +Fixes: 5c83746a0cf2 ("pnfs/blocklayout: in-kernel GETDEVICEINFO XDR parsing") +Signed-off-by: Dan Carpenter +Reviewed-by: Christoph Hellwig +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/blocklayout/dev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c +index dec5880ac6de2..6e3a14fdff9c8 100644 +--- a/fs/nfs/blocklayout/dev.c ++++ b/fs/nfs/blocklayout/dev.c +@@ -422,7 +422,7 @@ bl_parse_concat(struct nfs_server *server, struct pnfs_block_dev *d, + int ret, i; + + d->children = kcalloc(v->concat.volumes_count, +- sizeof(struct pnfs_block_dev), GFP_KERNEL); ++ sizeof(struct pnfs_block_dev), gfp_mask); + if (!d->children) + return -ENOMEM; + +@@ -451,7 +451,7 @@ bl_parse_stripe(struct nfs_server *server, struct pnfs_block_dev *d, + int ret, i; + + d->children = kcalloc(v->stripe.volumes_count, +- sizeof(struct pnfs_block_dev), GFP_KERNEL); ++ sizeof(struct pnfs_block_dev), gfp_mask); + if (!d->children) + return -ENOMEM; + +-- +2.40.1 + diff --git a/queue-5.4/nfs-guard-against-readdir-loop-when-entry-names-exce.patch b/queue-5.4/nfs-guard-against-readdir-loop-when-entry-names-exce.patch new file mode 100644 index 00000000000..52c682dbaeb --- /dev/null +++ b/queue-5.4/nfs-guard-against-readdir-loop-when-entry-names-exce.patch @@ -0,0 +1,57 @@ +From 22831374e4e032750d083ed1821659ccc0cbb77b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Aug 2023 14:22:38 -0400 +Subject: NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN + +From: Benjamin Coddington + +[ Upstream commit f67b55b6588bcf9316a1e6e8d529100a5aa3ebe6 ] + +Commit 64cfca85bacd asserts the only valid return values for +nfs2/3_decode_dirent should not include -ENAMETOOLONG, but for a server +that sends a filename3 which exceeds MAXNAMELEN in a READDIR response the +client's behavior will be to endlessly retry the operation. + +We could map -ENAMETOOLONG into -EBADCOOKIE, but that would produce +truncated listings without any error. The client should return an error +for this case to clearly assert that the server implementation must be +corrected. + +Fixes: 64cfca85bacd ("NFS: Return valid errors from nfs2/3_decode_dirent()") +Signed-off-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs2xdr.c | 2 +- + fs/nfs/nfs3xdr.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c +index af557dc2cfe1d..6b783e2d28554 100644 +--- a/fs/nfs/nfs2xdr.c ++++ b/fs/nfs/nfs2xdr.c +@@ -953,7 +953,7 @@ int nfs2_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + + error = decode_filename_inline(xdr, &entry->name, &entry->len); + if (unlikely(error)) +- return -EAGAIN; ++ return error == -ENAMETOOLONG ? -ENAMETOOLONG : -EAGAIN; + + /* + * The type (size and byte order) of nfscookie isn't defined in +diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c +index 84369d51353a5..6d8768ce370d2 100644 +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -1991,7 +1991,7 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + + error = decode_inline_filename3(xdr, &entry->name, &entry->len); + if (unlikely(error)) +- return -EAGAIN; ++ return error == -ENAMETOOLONG ? -ENAMETOOLONG : -EAGAIN; + + error = decode_cookie3(xdr, &new_cookie); + if (unlikely(error)) +-- +2.40.1 + diff --git a/queue-5.4/nfsd-da_addr_body-field-missing-in-some-getdeviceinf.patch b/queue-5.4/nfsd-da_addr_body-field-missing-in-some-getdeviceinf.patch new file mode 100644 index 00000000000..2d7dd0498e3 --- /dev/null +++ b/queue-5.4/nfsd-da_addr_body-field-missing-in-some-getdeviceinf.patch @@ -0,0 +1,139 @@ +From fd227c599828289044079c14dc53a7ad286e0975 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Aug 2023 10:20:52 -0400 +Subject: NFSD: da_addr_body field missing in some GETDEVICEINFO replies + +From: Chuck Lever + +[ Upstream commit 6372e2ee629894433fe6107d7048536a3280a284 ] + +The XDR specification in RFC 8881 looks like this: + +struct device_addr4 { + layouttype4 da_layout_type; + opaque da_addr_body<>; +}; + +struct GETDEVICEINFO4resok { + device_addr4 gdir_device_addr; + bitmap4 gdir_notification; +}; + +union GETDEVICEINFO4res switch (nfsstat4 gdir_status) { +case NFS4_OK: + GETDEVICEINFO4resok gdir_resok4; +case NFS4ERR_TOOSMALL: + count4 gdir_mincount; +default: + void; +}; + +Looking at nfsd4_encode_getdeviceinfo() .... + +When the client provides a zero gd_maxcount, then the Linux NFS +server implementation encodes the da_layout_type field and then +skips the da_addr_body field completely, proceeding directly to +encode gdir_notification field. + +There does not appear to be an option in the specification to skip +encoding da_addr_body. Moreover, Section 18.40.3 says: + +> If the client wants to just update or turn off notifications, it +> MAY send a GETDEVICEINFO operation with gdia_maxcount set to zero. +> In that event, if the device ID is valid, the reply's da_addr_body +> field of the gdir_device_addr field will be of zero length. + +Since the layout drivers are responsible for encoding the +da_addr_body field, put this fix inside the ->encode_getdeviceinfo +methods. + +Fixes: 9cf514ccfacb ("nfsd: implement pNFS operations") +Reviewed-by: Christoph Hellwig +Cc: Tom Haynes +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/blocklayoutxdr.c | 9 +++++++++ + fs/nfsd/flexfilelayoutxdr.c | 9 +++++++++ + fs/nfsd/nfs4xdr.c | 25 +++++++++++-------------- + 3 files changed, 29 insertions(+), 14 deletions(-) + +diff --git a/fs/nfsd/blocklayoutxdr.c b/fs/nfsd/blocklayoutxdr.c +index 442543304930b..2455dc8be18a8 100644 +--- a/fs/nfsd/blocklayoutxdr.c ++++ b/fs/nfsd/blocklayoutxdr.c +@@ -82,6 +82,15 @@ nfsd4_block_encode_getdeviceinfo(struct xdr_stream *xdr, + int len = sizeof(__be32), ret, i; + __be32 *p; + ++ /* ++ * See paragraph 5 of RFC 8881 S18.40.3. ++ */ ++ if (!gdp->gd_maxcount) { ++ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT) ++ return nfserr_resource; ++ return nfs_ok; ++ } ++ + p = xdr_reserve_space(xdr, len + sizeof(__be32)); + if (!p) + return nfserr_resource; +diff --git a/fs/nfsd/flexfilelayoutxdr.c b/fs/nfsd/flexfilelayoutxdr.c +index e81d2a5cf381e..bb205328e043d 100644 +--- a/fs/nfsd/flexfilelayoutxdr.c ++++ b/fs/nfsd/flexfilelayoutxdr.c +@@ -85,6 +85,15 @@ nfsd4_ff_encode_getdeviceinfo(struct xdr_stream *xdr, + int addr_len; + __be32 *p; + ++ /* ++ * See paragraph 5 of RFC 8881 S18.40.3. ++ */ ++ if (!gdp->gd_maxcount) { ++ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT) ++ return nfserr_resource; ++ return nfs_ok; ++ } ++ + /* len + padding for two strings */ + addr_len = 16 + da->netaddr.netid_len + da->netaddr.addr_len; + ver_len = 20; +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 3d7b0ad4157df..1d24fff2709c5 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -4126,20 +4126,17 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr, + + *p++ = cpu_to_be32(gdev->gd_layout_type); + +- /* If maxcount is 0 then just update notifications */ +- if (gdev->gd_maxcount != 0) { +- ops = nfsd4_layout_ops[gdev->gd_layout_type]; +- nfserr = ops->encode_getdeviceinfo(xdr, gdev); +- if (nfserr) { +- /* +- * We don't bother to burden the layout drivers with +- * enforcing gd_maxcount, just tell the client to +- * come back with a bigger buffer if it's not enough. +- */ +- if (xdr->buf->len + 4 > gdev->gd_maxcount) +- goto toosmall; +- return nfserr; +- } ++ ops = nfsd4_layout_ops[gdev->gd_layout_type]; ++ nfserr = ops->encode_getdeviceinfo(xdr, gdev); ++ if (nfserr) { ++ /* ++ * We don't bother to burden the layout drivers with ++ * enforcing gd_maxcount, just tell the client to ++ * come back with a bigger buffer if it's not enough. ++ */ ++ if (xdr->buf->len + 4 > gdev->gd_maxcount) ++ goto toosmall; ++ return nfserr; + } + + if (gdev->gd_notify_types) { +-- +2.40.1 + diff --git a/queue-5.4/of-unittest-fix-null-pointer-dereferencing-in-of_uni.patch b/queue-5.4/of-unittest-fix-null-pointer-dereferencing-in-of_uni.patch new file mode 100644 index 00000000000..b58192ffb5c --- /dev/null +++ b/queue-5.4/of-unittest-fix-null-pointer-dereferencing-in-of_uni.patch @@ -0,0 +1,74 @@ +From c58152a8802dd8f1d8732048ef2353f745903762 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 16:02:46 +0800 +Subject: of: unittest: fix null pointer dereferencing in + of_unittest_find_node_by_name() + +From: Ruan Jinjie + +[ Upstream commit d6ce4f0ea19c32f10867ed93d8386924326ab474 ] + +when kmalloc() fail to allocate memory in kasprintf(), name +or full_name will be NULL, strcmp() will cause +null pointer dereference. + +Fixes: 0d638a07d3a1 ("of: Convert to using %pOF instead of full_name") +Signed-off-by: Ruan Jinjie +Link: https://lore.kernel.org/r/20230727080246.519539-1-ruanjinjie@huawei.com +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/unittest.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 5707c309a7545..ef3c2112046fc 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -52,7 +52,7 @@ static void __init of_unittest_find_node_by_name(void) + + np = of_find_node_by_path("/testcase-data"); + name = kasprintf(GFP_KERNEL, "%pOF", np); +- unittest(np && !strcmp("/testcase-data", name), ++ unittest(np && name && !strcmp("/testcase-data", name), + "find /testcase-data failed\n"); + of_node_put(np); + kfree(name); +@@ -63,14 +63,14 @@ static void __init of_unittest_find_node_by_name(void) + + np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-a"); + name = kasprintf(GFP_KERNEL, "%pOF", np); +- unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name), ++ unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name), + "find /testcase-data/phandle-tests/consumer-a failed\n"); + of_node_put(np); + kfree(name); + + np = of_find_node_by_path("testcase-alias"); + name = kasprintf(GFP_KERNEL, "%pOF", np); +- unittest(np && !strcmp("/testcase-data", name), ++ unittest(np && name && !strcmp("/testcase-data", name), + "find testcase-alias failed\n"); + of_node_put(np); + kfree(name); +@@ -81,7 +81,7 @@ static void __init of_unittest_find_node_by_name(void) + + np = of_find_node_by_path("testcase-alias/phandle-tests/consumer-a"); + name = kasprintf(GFP_KERNEL, "%pOF", np); +- unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name), ++ unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name), + "find testcase-alias/phandle-tests/consumer-a failed\n"); + of_node_put(np); + kfree(name); +@@ -1151,6 +1151,8 @@ static void attach_node_and_children(struct device_node *np) + const char *full_name; + + full_name = kasprintf(GFP_KERNEL, "%pOF", np); ++ if (!full_name) ++ return; + + if (!strcmp(full_name, "/__local_fixups__") || + !strcmp(full_name, "/__fixups__")) { +-- +2.40.1 + diff --git a/queue-5.4/of-unittest-fix-overlay-type-in-apply-revert-check.patch b/queue-5.4/of-unittest-fix-overlay-type-in-apply-revert-check.patch new file mode 100644 index 00000000000..4bccc6f7cd1 --- /dev/null +++ b/queue-5.4/of-unittest-fix-overlay-type-in-apply-revert-check.patch @@ -0,0 +1,42 @@ +From 72477d8672ac78e7b0c636177f9e3a3dca8610ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jul 2023 10:50:29 +0200 +Subject: of: unittest: Fix overlay type in apply/revert check + +From: Geert Uytterhoeven + +[ Upstream commit 6becf8f845ae1f0b1cfed395bbeccbd23654162d ] + +The removal check in of_unittest_apply_revert_overlay_check() +always uses the platform device overlay type, while it should use the +actual overlay type, as passed as a parameter to the function. + +This has no impact on any current test, as all tests calling +of_unittest_apply_revert_overlay_check() use the platform device overlay +type. + +Fixes: d5e75500ca401d31 ("of: unitest: Add I2C overlay unit tests.") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/ba0234c41ba808f10112094f88792beeb6dbaedf.1690533838.git.geert+renesas@glider.be +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/unittest.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index ef3c2112046fc..42acbb3668b2c 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -1582,7 +1582,7 @@ static int __init of_unittest_apply_revert_overlay_check(int overlay_nr, + } + + /* unittest device must be again in before state */ +- if (of_unittest_device_exists(unittest_nr, PDEV_OVERLAY) != before) { ++ if (of_unittest_device_exists(unittest_nr, ovtype) != before) { + unittest(0, "%s with device @\"%s\" %s\n", + overlay_name_from_nr(overlay_nr), + unittest_path(unittest_nr, ovtype), +-- +2.40.1 + diff --git a/queue-5.4/opp-fix-passing-0-to-ptr_err-in-_opp_attach_genpd.patch b/queue-5.4/opp-fix-passing-0-to-ptr_err-in-_opp_attach_genpd.patch new file mode 100644 index 00000000000..6c1813df928 --- /dev/null +++ b/queue-5.4/opp-fix-passing-0-to-ptr_err-in-_opp_attach_genpd.patch @@ -0,0 +1,41 @@ +From e946730388b19e9825a2582b02c5eba5ec880c03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 18:16:34 +0530 +Subject: OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd() + +From: Manivannan Sadhasivam + +[ Upstream commit d920920f85a82c1c806a4143871a0e8f534732f2 ] + +If dev_pm_domain_attach_by_name() returns NULL, then 0 will be passed to +PTR_ERR() as reported by the smatch warning below: + +drivers/opp/core.c:2456 _opp_attach_genpd() warn: passing zero to 'PTR_ERR' + +Fix it by checking for the non-NULL virt_dev pointer before passing it to +PTR_ERR. Otherwise return -ENODEV. + +Fixes: 4ea9496cbc95 ("opp: Fix error check in dev_pm_opp_attach_genpd()") +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index 08f5d1c3d6651..e1810c4011b23 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -1882,7 +1882,7 @@ struct opp_table *dev_pm_opp_attach_genpd(struct device *dev, + + virt_dev = dev_pm_domain_attach_by_name(dev, *name); + if (IS_ERR_OR_NULL(virt_dev)) { +- ret = PTR_ERR(virt_dev) ? : -ENODEV; ++ ret = virt_dev ? PTR_ERR(virt_dev) : -ENODEV; + dev_err(dev, "Couldn't attach to pm_domain: %d\n", ret); + goto err; + } +-- +2.40.1 + diff --git a/queue-5.4/pci-add-defines-for-enter-compliance-transmit-margin.patch b/queue-5.4/pci-add-defines-for-enter-compliance-transmit-margin.patch new file mode 100644 index 00000000000..ee4c0437e2a --- /dev/null +++ b/queue-5.4/pci-add-defines-for-enter-compliance-transmit-margin.patch @@ -0,0 +1,37 @@ +From d4fc74689083af3014e33fe886507bc9bafd2d6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2019 11:07:36 -0600 +Subject: PCI: Add #defines for Enter Compliance, Transmit Margin + +From: Bjorn Helgaas + +[ Upstream commit bbdb2f5ecdf1e66b2f09710134db3c2e5c43a958 ] + +Add definitions for the Enter Compliance and Transmit Margin fields of the +PCIe Link Control 2 register. + +Link: https://lore.kernel.org/r/20191112173503.176611-2-helgaas@kernel.org +Signed-off-by: Bjorn Helgaas +Reviewed-by: Alex Deucher +Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL") +Signed-off-by: Sasha Levin +--- + include/uapi/linux/pci_regs.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h +index b485d8b0d5a79..5d830a95daf20 100644 +--- a/include/uapi/linux/pci_regs.h ++++ b/include/uapi/linux/pci_regs.h +@@ -679,6 +679,8 @@ + #define PCI_EXP_LNKCTL2_TLS_8_0GT 0x0003 /* Supported Speed 8GT/s */ + #define PCI_EXP_LNKCTL2_TLS_16_0GT 0x0004 /* Supported Speed 16GT/s */ + #define PCI_EXP_LNKCTL2_TLS_32_0GT 0x0005 /* Supported Speed 32GT/s */ ++#define PCI_EXP_LNKCTL2_ENTER_COMP 0x0010 /* Enter Compliance */ ++#define PCI_EXP_LNKCTL2_TX_MARGIN 0x0380 /* Transmit Margin */ + #define PCI_EXP_LNKSTA2 50 /* Link Status 2 */ + #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 52 /* v2 endpoints with link end here */ + #define PCI_EXP_SLTCAP2 52 /* Slot Capabilities 2 */ +-- +2.40.1 + diff --git a/queue-5.4/pci-aspm-use-rmw-accessors-for-changing-lnkctl.patch b/queue-5.4/pci-aspm-use-rmw-accessors-for-changing-lnkctl.patch new file mode 100644 index 00000000000..f8be4116cbb --- /dev/null +++ b/queue-5.4/pci-aspm-use-rmw-accessors-for-changing-lnkctl.patch @@ -0,0 +1,105 @@ +From 061917e953ee52d862461311fd1ef460d2a1e140 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:04:56 +0300 +Subject: PCI/ASPM: Use RMW accessors for changing LNKCTL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit e09060b3b6b4661278ff8e1b7b81a37d5ea86eae ] + +Don't assume that the device is fully under the control of ASPM and use RMW +capability accessors which do proper locking to avoid losing concurrent +updates to the register values. + +If configuration fails in pcie_aspm_configure_common_clock(), the +function attempts to restore the old PCI_EXP_LNKCTL_CCC settings. Store +only the old PCI_EXP_LNKCTL_CCC bit for the relevant devices rather +than the content of the whole LNKCTL registers. It aligns better with +how pcie_lnkctl_clear_and_set() expects its parameter and makes the +code more obvious to understand. + +Suggested-by: Lukas Wunner +Fixes: 2a42d9dba784 ("PCIe: ASPM: Break out of endless loop waiting for PCI config bits to switch") +Fixes: 7d715a6c1ae5 ("PCI: add PCI Express ASPM support") +Link: https://lore.kernel.org/r/20230717120503.15276-5-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Acked-by: "Rafael J. Wysocki" +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/aspm.c | 30 +++++++++++++----------------- + 1 file changed, 13 insertions(+), 17 deletions(-) + +diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c +index 55270180ae081..ee51e433fdedb 100644 +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -257,7 +257,7 @@ static int pcie_retrain_link(struct pcie_link_state *link) + static void pcie_aspm_configure_common_clock(struct pcie_link_state *link) + { + int same_clock = 1; +- u16 reg16, parent_reg, child_reg[8]; ++ u16 reg16, ccc, parent_old_ccc, child_old_ccc[8]; + struct pci_dev *child, *parent = link->pdev; + struct pci_bus *linkbus = parent->subordinate; + /* +@@ -279,6 +279,7 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link) + + /* Port might be already in common clock mode */ + pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16); ++ parent_old_ccc = reg16 & PCI_EXP_LNKCTL_CCC; + if (same_clock && (reg16 & PCI_EXP_LNKCTL_CCC)) { + bool consistent = true; + +@@ -295,34 +296,29 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link) + pci_warn(parent, "ASPM: current common clock configuration is broken, reconfiguring\n"); + } + ++ ccc = same_clock ? PCI_EXP_LNKCTL_CCC : 0; + /* Configure downstream component, all functions */ + list_for_each_entry(child, &linkbus->devices, bus_list) { + pcie_capability_read_word(child, PCI_EXP_LNKCTL, ®16); +- child_reg[PCI_FUNC(child->devfn)] = reg16; +- if (same_clock) +- reg16 |= PCI_EXP_LNKCTL_CCC; +- else +- reg16 &= ~PCI_EXP_LNKCTL_CCC; +- pcie_capability_write_word(child, PCI_EXP_LNKCTL, reg16); ++ child_old_ccc[PCI_FUNC(child->devfn)] = reg16 & PCI_EXP_LNKCTL_CCC; ++ pcie_capability_clear_and_set_word(child, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_CCC, ccc); + } + + /* Configure upstream component */ +- pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16); +- parent_reg = reg16; +- if (same_clock) +- reg16 |= PCI_EXP_LNKCTL_CCC; +- else +- reg16 &= ~PCI_EXP_LNKCTL_CCC; +- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16); ++ pcie_capability_clear_and_set_word(parent, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_CCC, ccc); + + if (pcie_retrain_link(link)) { + + /* Training failed. Restore common clock configurations */ + pci_err(parent, "ASPM: Could not configure common clock\n"); + list_for_each_entry(child, &linkbus->devices, bus_list) +- pcie_capability_write_word(child, PCI_EXP_LNKCTL, +- child_reg[PCI_FUNC(child->devfn)]); +- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, parent_reg); ++ pcie_capability_clear_and_set_word(child, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_CCC, ++ child_old_ccc[PCI_FUNC(child->devfn)]); ++ pcie_capability_clear_and_set_word(parent, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_CCC, parent_old_ccc); + } + } + +-- +2.40.1 + diff --git a/queue-5.4/pci-mark-nvidia-t4-gpus-to-avoid-bus-reset.patch b/queue-5.4/pci-mark-nvidia-t4-gpus-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..b6e13242404 --- /dev/null +++ b/queue-5.4/pci-mark-nvidia-t4-gpus-to-avoid-bus-reset.patch @@ -0,0 +1,38 @@ +From 7bdbb86fa6dba74ed58190d7e7985635a047f8f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 20:34:11 +0800 +Subject: PCI: Mark NVIDIA T4 GPUs to avoid bus reset + +From: Wu Zongyong + +[ Upstream commit d5af729dc2071273f14cbb94abbc60608142fd83 ] + +NVIDIA T4 GPUs do not work with SBR. This problem is found when the T4 card +is direct attached to a Root Port only. Avoid bus reset by marking T4 GPUs +PCI_DEV_FLAGS_NO_BUS_RESET. + +Fixes: 4c207e7121fa ("PCI: Mark some NVIDIA GPUs to avoid bus reset") +Link: https://lore.kernel.org/r/2dcebea53a6eb9bd212ec6d8974af2e5e0333ef6.1681129861.git.wuzongyong@linux.alibaba.com +Signed-off-by: Wu Zongyong +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 73260bd217278..6d258f146aa90 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3566,7 +3566,7 @@ static void quirk_no_bus_reset(struct pci_dev *dev) + */ + static void quirk_nvidia_no_bus_reset(struct pci_dev *dev) + { +- if ((dev->device & 0xffc0) == 0x2340) ++ if ((dev->device & 0xffc0) == 0x2340 || dev->device == 0x1eb8) + quirk_no_bus_reset(dev); + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, +-- +2.40.1 + diff --git a/queue-5.4/pci-pciehp-use-rmw-accessors-for-changing-lnkctl.patch b/queue-5.4/pci-pciehp-use-rmw-accessors-for-changing-lnkctl.patch new file mode 100644 index 00000000000..3ca65fbeabe --- /dev/null +++ b/queue-5.4/pci-pciehp-use-rmw-accessors-for-changing-lnkctl.patch @@ -0,0 +1,54 @@ +From f8e3888b2bacc066bc79f2b784243df2c8a1c313 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:04:55 +0300 +Subject: PCI: pciehp: Use RMW accessors for changing LNKCTL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 5f75f96c61039151c193775d776fde42477eace1 ] + +As hotplug is not the only driver touching LNKCTL, use the RMW capability +accessor which handles concurrent changes correctly. + +Suggested-by: Lukas Wunner +Fixes: 7f822999e12a ("PCI: pciehp: Add Disable/enable link functions") +Link: https://lore.kernel.org/r/20230717120503.15276-4-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Acked-by: "Rafael J. Wysocki" +Signed-off-by: Sasha Levin +--- + drivers/pci/hotplug/pciehp_hpc.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c +index 651664fe4058d..bdbe01d4d9e90 100644 +--- a/drivers/pci/hotplug/pciehp_hpc.c ++++ b/drivers/pci/hotplug/pciehp_hpc.c +@@ -293,17 +293,11 @@ int pciehp_check_link_status(struct controller *ctrl) + static int __pciehp_link_set(struct controller *ctrl, bool enable) + { + struct pci_dev *pdev = ctrl_dev(ctrl); +- u16 lnk_ctrl; + +- pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &lnk_ctrl); ++ pcie_capability_clear_and_set_word(pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_LD, ++ enable ? 0 : PCI_EXP_LNKCTL_LD); + +- if (enable) +- lnk_ctrl &= ~PCI_EXP_LNKCTL_LD; +- else +- lnk_ctrl |= PCI_EXP_LNKCTL_LD; +- +- pcie_capability_write_word(pdev, PCI_EXP_LNKCTL, lnk_ctrl); +- ctrl_dbg(ctrl, "%s: lnk_ctrl = %x\n", __func__, lnk_ctrl); + return 0; + } + +-- +2.40.1 + diff --git a/queue-5.4/perf-imx_ddr-don-t-enable-counter0-if-none-of-4-coun.patch b/queue-5.4/perf-imx_ddr-don-t-enable-counter0-if-none-of-4-coun.patch new file mode 100644 index 00000000000..48760ccd014 --- /dev/null +++ b/queue-5.4/perf-imx_ddr-don-t-enable-counter0-if-none-of-4-coun.patch @@ -0,0 +1,90 @@ +From 62455d679628e0c02de737071971c10fd2c5ef0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 09:54:38 +0800 +Subject: perf/imx_ddr: don't enable counter0 if none of 4 counters are used + +From: Xu Yang + +[ Upstream commit f4e2bd91ddf5e8543cbe7ad80b3fba3d2dc63fa3 ] + +In current driver, counter0 will be enabled after ddr_perf_pmu_enable() +is called even though none of the 4 counters are used. This will cause +counter0 continue to count until ddr_perf_pmu_disabled() is called. If +pmu is not disabled all the time, the pmu interrupt will be asserted +from time to time due to counter0 will overflow and irq handler will +clear it. It's not an expected behavior. This patch will not enable +counter0 if none of 4 counters are used. + +Fixes: 9a66d36cc7ac ("drivers/perf: imx_ddr: Add DDR performance counter support to perf") +Signed-off-by: Xu Yang +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20230811015438.1999307-2-xu.yang_2@nxp.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/fsl_imx8_ddr_perf.c | 24 +++++++++--------------- + 1 file changed, 9 insertions(+), 15 deletions(-) + +diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c +index 912a220a9db92..a0e45c726bbf0 100644 +--- a/drivers/perf/fsl_imx8_ddr_perf.c ++++ b/drivers/perf/fsl_imx8_ddr_perf.c +@@ -77,6 +77,7 @@ struct ddr_pmu { + const struct fsl_ddr_devtype_data *devtype_data; + int irq; + int id; ++ int active_counter; + }; + + static ssize_t ddr_perf_cpumask_show(struct device *dev, +@@ -353,6 +354,10 @@ static void ddr_perf_event_start(struct perf_event *event, int flags) + + ddr_perf_counter_enable(pmu, event->attr.config, counter, true); + ++ if (!pmu->active_counter++) ++ ddr_perf_counter_enable(pmu, EVENT_CYCLES_ID, ++ EVENT_CYCLES_COUNTER, true); ++ + hwc->state = 0; + } + +@@ -407,6 +412,10 @@ static void ddr_perf_event_stop(struct perf_event *event, int flags) + ddr_perf_counter_enable(pmu, event->attr.config, counter, false); + ddr_perf_event_update(event); + ++ if (!--pmu->active_counter) ++ ddr_perf_counter_enable(pmu, EVENT_CYCLES_ID, ++ EVENT_CYCLES_COUNTER, false); ++ + hwc->state |= PERF_HES_STOPPED; + } + +@@ -425,25 +434,10 @@ static void ddr_perf_event_del(struct perf_event *event, int flags) + + static void ddr_perf_pmu_enable(struct pmu *pmu) + { +- struct ddr_pmu *ddr_pmu = to_ddr_pmu(pmu); +- +- /* enable cycle counter if cycle is not active event list */ +- if (ddr_pmu->events[EVENT_CYCLES_COUNTER] == NULL) +- ddr_perf_counter_enable(ddr_pmu, +- EVENT_CYCLES_ID, +- EVENT_CYCLES_COUNTER, +- true); + } + + static void ddr_perf_pmu_disable(struct pmu *pmu) + { +- struct ddr_pmu *ddr_pmu = to_ddr_pmu(pmu); +- +- if (ddr_pmu->events[EVENT_CYCLES_COUNTER] == NULL) +- ddr_perf_counter_enable(ddr_pmu, +- EVENT_CYCLES_ID, +- EVENT_CYCLES_COUNTER, +- false); + } + + static int ddr_perf_init(struct ddr_pmu *pmu, void __iomem *base, +-- +2.40.1 + diff --git a/queue-5.4/phy-rockchip-inno-hdmi-do-not-power-on-rk3328-post-p.patch b/queue-5.4/phy-rockchip-inno-hdmi-do-not-power-on-rk3328-post-p.patch new file mode 100644 index 00000000000..ec4d090350f --- /dev/null +++ b/queue-5.4/phy-rockchip-inno-hdmi-do-not-power-on-rk3328-post-p.patch @@ -0,0 +1,55 @@ +From 31d5c7aca77f6c9c354c4cc9704ed1510873e642 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 17:10:21 +0000 +Subject: phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write + +From: Jonas Karlman + +[ Upstream commit 19a1d46bd699940a496d3b0d4e142ef99834988c ] + +inno_write is used to configure 0xaa reg, that also hold the +POST_PLL_POWER_DOWN bit. +When POST_PLL_REFCLK_SEL_TMDS is configured the power down bit is not +taken into consideration. + +Fix this by keeping the power down bit until configuration is complete. +Also reorder the reg write order for consistency. + +Fixes: 53706a116863 ("phy: add Rockchip Innosilicon hdmi phy") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20230615171005.2251032-5-jonas@kwiboo.se +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-inno-hdmi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +index 093d2334e8cdc..2b0f5f2b4f339 100644 +--- a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c ++++ b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +@@ -1023,9 +1023,10 @@ inno_hdmi_phy_rk3328_power_on(struct inno_hdmi_phy *inno, + + inno_write(inno, 0xac, RK3328_POST_PLL_FB_DIV_7_0(cfg->fbdiv)); + if (cfg->postdiv == 1) { +- inno_write(inno, 0xaa, RK3328_POST_PLL_REFCLK_SEL_TMDS); + inno_write(inno, 0xab, RK3328_POST_PLL_FB_DIV_8(cfg->fbdiv) | + RK3328_POST_PLL_PRE_DIV(cfg->prediv)); ++ inno_write(inno, 0xaa, RK3328_POST_PLL_REFCLK_SEL_TMDS | ++ RK3328_POST_PLL_POWER_DOWN); + } else { + v = (cfg->postdiv / 2) - 1; + v &= RK3328_POST_PLL_POST_DIV_MASK; +@@ -1033,7 +1034,8 @@ inno_hdmi_phy_rk3328_power_on(struct inno_hdmi_phy *inno, + inno_write(inno, 0xab, RK3328_POST_PLL_FB_DIV_8(cfg->fbdiv) | + RK3328_POST_PLL_PRE_DIV(cfg->prediv)); + inno_write(inno, 0xaa, RK3328_POST_PLL_POST_DIV_ENABLE | +- RK3328_POST_PLL_REFCLK_SEL_TMDS); ++ RK3328_POST_PLL_REFCLK_SEL_TMDS | ++ RK3328_POST_PLL_POWER_DOWN); + } + + for (v = 0; v < 14; v++) +-- +2.40.1 + diff --git a/queue-5.4/phy-rockchip-inno-hdmi-round-fractal-pixclock-in-rk3.patch b/queue-5.4/phy-rockchip-inno-hdmi-round-fractal-pixclock-in-rk3.patch new file mode 100644 index 00000000000..fe5e01c4097 --- /dev/null +++ b/queue-5.4/phy-rockchip-inno-hdmi-round-fractal-pixclock-in-rk3.patch @@ -0,0 +1,50 @@ +From edf1613645691c26e500b31d6c2eaf6dfd40bf5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 17:10:19 +0000 +Subject: phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate + +From: Zheng Yang + +[ Upstream commit d5ef343c1d62bc4c4c2c393af654a41cb34b449f ] + +inno_hdmi_phy_rk3328_clk_recalc_rate() is returning a rate not found +in the pre pll config table when the fractal divider is used. +This can prevent proper power_on because a tmdsclock for the new rate +is not found in the pre pll config table. + +Fix this by saving and returning a rounded pixel rate that exist +in the pre pll config table. + +Fixes: 53706a116863 ("phy: add Rockchip Innosilicon hdmi phy") +Signed-off-by: Zheng Yang +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20230615171005.2251032-3-jonas@kwiboo.se +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-inno-hdmi.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +index b0ac1d3ee3905..093d2334e8cdc 100644 +--- a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c ++++ b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +@@ -745,10 +745,12 @@ unsigned long inno_hdmi_phy_rk3328_clk_recalc_rate(struct clk_hw *hw, + do_div(vco, (nd * (no_a == 1 ? no_b : no_a) * no_d * 2)); + } + +- inno->pixclock = vco; +- dev_dbg(inno->dev, "%s rate %lu\n", __func__, inno->pixclock); ++ inno->pixclock = DIV_ROUND_CLOSEST((unsigned long)vco, 1000) * 1000; + +- return vco; ++ dev_dbg(inno->dev, "%s rate %lu vco %llu\n", ++ __func__, inno->pixclock, vco); ++ ++ return inno->pixclock; + } + + static long inno_hdmi_phy_rk3328_clk_round_rate(struct clk_hw *hw, +-- +2.40.1 + diff --git a/queue-5.4/phy-rockchip-inno-hdmi-use-correct-vco_div_5-macro-o.patch b/queue-5.4/phy-rockchip-inno-hdmi-use-correct-vco_div_5-macro-o.patch new file mode 100644 index 00000000000..04bdf825aec --- /dev/null +++ b/queue-5.4/phy-rockchip-inno-hdmi-use-correct-vco_div_5-macro-o.patch @@ -0,0 +1,41 @@ +From 8c18e2731379c464b440b0b747ecd2047155899b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 17:10:17 +0000 +Subject: phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328 + +From: Jonas Karlman + +[ Upstream commit 644c06dfbd0da713f772abf0a8f8581ac78e6264 ] + +inno_hdmi_phy_rk3328_clk_set_rate() is using the RK3228 macro +when configuring vco_div_5 on RK3328. + +Fix this by using correct vco_div_5 macro for RK3328. + +Fixes: 53706a116863 ("phy: add Rockchip Innosilicon hdmi phy") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20230615171005.2251032-2-jonas@kwiboo.se +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-inno-hdmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +index 9ca20c947283d..b0ac1d3ee3905 100644 +--- a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c ++++ b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c +@@ -790,8 +790,8 @@ static int inno_hdmi_phy_rk3328_clk_set_rate(struct clk_hw *hw, + RK3328_PRE_PLL_POWER_DOWN); + + /* Configure pre-pll */ +- inno_update_bits(inno, 0xa0, RK3228_PCLK_VCO_DIV_5_MASK, +- RK3228_PCLK_VCO_DIV_5(cfg->vco_div_5_en)); ++ inno_update_bits(inno, 0xa0, RK3328_PCLK_VCO_DIV_5_MASK, ++ RK3328_PCLK_VCO_DIV_5(cfg->vco_div_5_en)); + inno_write(inno, 0xa1, RK3328_PRE_PLL_PRE_DIV(cfg->prediv)); + + val = RK3328_SPREAD_SPECTRUM_MOD_DISABLE; +-- +2.40.1 + diff --git a/queue-5.4/powerpc-fadump-reset-dump-area-size-if-fadump-memory.patch b/queue-5.4/powerpc-fadump-reset-dump-area-size-if-fadump-memory.patch new file mode 100644 index 00000000000..0da0f95e71a --- /dev/null +++ b/queue-5.4/powerpc-fadump-reset-dump-area-size-if-fadump-memory.patch @@ -0,0 +1,42 @@ +From aa1eb075ab1ba51398cc88650f2bddba4cf91684 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 10:37:15 +0530 +Subject: powerpc/fadump: reset dump area size if fadump memory reserve fails + +From: Sourabh Jain + +[ Upstream commit d1eb75e0dfed80d2d85b664e28a39f65b290ab55 ] + +In case fadump_reserve_mem() fails to reserve memory, the +reserve_dump_area_size variable will retain the reserve area size. This +will lead to /sys/kernel/fadump/mem_reserved node displaying an incorrect +memory reserved by fadump. + +To fix this problem, reserve dump area size variable is set to 0 if fadump +failed to reserve memory. + +Fixes: 8255da95e545 ("powerpc/fadump: release all the memory above boot memory size") +Signed-off-by: Sourabh Jain +Acked-by: Mahesh Salgaonkar +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230704050715.203581-1-sourabhjain@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/fadump.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c +index 69d64f406204f..15405db43141c 100644 +--- a/arch/powerpc/kernel/fadump.c ++++ b/arch/powerpc/kernel/fadump.c +@@ -629,6 +629,7 @@ int __init fadump_reserve_mem(void) + return ret; + error_out: + fw_dump.fadump_enabled = 0; ++ fw_dump.reserve_dump_area_size = 0; + return 0; + } + +-- +2.40.1 + diff --git a/queue-5.4/powerpc-iommu-fix-notifiers-being-shared-by-pci-and-.patch b/queue-5.4/powerpc-iommu-fix-notifiers-being-shared-by-pci-and-.patch new file mode 100644 index 00000000000..23425165a07 --- /dev/null +++ b/queue-5.4/powerpc-iommu-fix-notifiers-being-shared-by-pci-and-.patch @@ -0,0 +1,96 @@ +From 254c43b4b5c658abe1f93565bf825331069f1448 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 14:53:22 +1100 +Subject: powerpc/iommu: Fix notifiers being shared by PCI and VIO buses + +From: Russell Currey + +[ Upstream commit c37b6908f7b2bd24dcaaf14a180e28c9132b9c58 ] + +fail_iommu_setup() registers the fail_iommu_bus_notifier struct to both +PCI and VIO buses. struct notifier_block is a linked list node, so this +causes any notifiers later registered to either bus type to also be +registered to the other since they share the same node. + +This causes issues in (at least) the vgaarb code, which registers a +notifier for PCI buses. pci_notify() ends up being called on a vio +device, converted with to_pci_dev() even though it's not a PCI device, +and finally makes a bad access in vga_arbiter_add_pci_device() as +discovered with KASAN: + + BUG: KASAN: slab-out-of-bounds in vga_arbiter_add_pci_device+0x60/0xe00 + Read of size 4 at addr c000000264c26fdc by task swapper/0/1 + + Call Trace: + dump_stack_lvl+0x1bc/0x2b8 (unreliable) + print_report+0x3f4/0xc60 + kasan_report+0x244/0x698 + __asan_load4+0xe8/0x250 + vga_arbiter_add_pci_device+0x60/0xe00 + pci_notify+0x88/0x444 + notifier_call_chain+0x104/0x320 + blocking_notifier_call_chain+0xa0/0x140 + device_add+0xac8/0x1d30 + device_register+0x58/0x80 + vio_register_device_node+0x9ac/0xce0 + vio_bus_scan_register_devices+0xc4/0x13c + __machine_initcall_pseries_vio_device_init+0x94/0xf0 + do_one_initcall+0x12c/0xaa8 + kernel_init_freeable+0xa48/0xba8 + kernel_init+0x64/0x400 + ret_from_kernel_thread+0x5c/0x64 + +Fix this by creating separate notifier_block structs for each bus type. + +Fixes: d6b9a81b2a45 ("powerpc: IOMMU fault injection") +Reported-by: Nageswara R Sastry +Signed-off-by: Russell Currey +Tested-by: Nageswara R Sastry +Reviewed-by: Andrew Donnellan +[mpe: Add #ifdef to fix CONFIG_IBMVIO=n build] +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230322035322.328709-1-ruscur@russell.cc +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/iommu.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c +index d7d42bd448c4a..dd062eef533b1 100644 +--- a/arch/powerpc/kernel/iommu.c ++++ b/arch/powerpc/kernel/iommu.c +@@ -133,17 +133,28 @@ static int fail_iommu_bus_notify(struct notifier_block *nb, + return 0; + } + +-static struct notifier_block fail_iommu_bus_notifier = { ++/* ++ * PCI and VIO buses need separate notifier_block structs, since they're linked ++ * list nodes. Sharing a notifier_block would mean that any notifiers later ++ * registered for PCI buses would also get called by VIO buses and vice versa. ++ */ ++static struct notifier_block fail_iommu_pci_bus_notifier = { + .notifier_call = fail_iommu_bus_notify + }; + ++#ifdef CONFIG_IBMVIO ++static struct notifier_block fail_iommu_vio_bus_notifier = { ++ .notifier_call = fail_iommu_bus_notify ++}; ++#endif ++ + static int __init fail_iommu_setup(void) + { + #ifdef CONFIG_PCI +- bus_register_notifier(&pci_bus_type, &fail_iommu_bus_notifier); ++ bus_register_notifier(&pci_bus_type, &fail_iommu_pci_bus_notifier); + #endif + #ifdef CONFIG_IBMVIO +- bus_register_notifier(&vio_bus_type, &fail_iommu_bus_notifier); ++ bus_register_notifier(&vio_bus_type, &fail_iommu_vio_bus_notifier); + #endif + + return 0; +-- +2.40.1 + diff --git a/queue-5.4/quota-add-new-helper-dquot_active.patch b/queue-5.4/quota-add-new-helper-dquot_active.patch new file mode 100644 index 00000000000..db7c2cef050 --- /dev/null +++ b/queue-5.4/quota-add-new-helper-dquot_active.patch @@ -0,0 +1,119 @@ +From 255eb5cd3babb4233813d5325883d8d548c7a24d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 19:08:20 +0800 +Subject: quota: add new helper dquot_active() + +From: Baokun Li + +[ Upstream commit 33bcfafc48cb186bc4bbcea247feaa396594229e ] + +Add new helper function dquot_active() to make the code more concise. + +Signed-off-by: Baokun Li +Signed-off-by: Jan Kara +Message-Id: <20230630110822.3881712-4-libaokun1@huawei.com> +Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 7abf1ae05f939..5495c82e55ad4 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -336,6 +336,11 @@ static void wait_on_dquot(struct dquot *dquot) + mutex_unlock(&dquot->dq_lock); + } + ++static inline int dquot_active(struct dquot *dquot) ++{ ++ return test_bit(DQ_ACTIVE_B, &dquot->dq_flags); ++} ++ + static inline int dquot_dirty(struct dquot *dquot) + { + return test_bit(DQ_MOD_B, &dquot->dq_flags); +@@ -351,14 +356,14 @@ int dquot_mark_dquot_dirty(struct dquot *dquot) + { + int ret = 1; + +- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) ++ if (!dquot_active(dquot)) + return 0; + + if (sb_dqopt(dquot->dq_sb)->flags & DQUOT_NOLIST_DIRTY) + return test_and_set_bit(DQ_MOD_B, &dquot->dq_flags); + + /* If quota is dirty already, we don't have to acquire dq_list_lock */ +- if (test_bit(DQ_MOD_B, &dquot->dq_flags)) ++ if (dquot_dirty(dquot)) + return 1; + + spin_lock(&dq_list_lock); +@@ -438,7 +443,7 @@ int dquot_acquire(struct dquot *dquot) + smp_mb__before_atomic(); + set_bit(DQ_READ_B, &dquot->dq_flags); + /* Instantiate dquot if needed */ +- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags) && !dquot->dq_off) { ++ if (!dquot_active(dquot) && !dquot->dq_off) { + ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk(dquot); + /* Write the info if needed */ + if (info_dirty(&dqopt->info[dquot->dq_id.type])) { +@@ -477,7 +482,7 @@ int dquot_commit(struct dquot *dquot) + goto out_lock; + /* Inactive dquot can be only if there was error during read/init + * => we have better not writing it */ +- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) ++ if (dquot_active(dquot)) + ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk(dquot); + else + ret = -EIO; +@@ -588,7 +593,7 @@ int dquot_scan_active(struct super_block *sb, + + spin_lock(&dq_list_lock); + list_for_each_entry(dquot, &inuse_list, dq_inuse) { +- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) ++ if (!dquot_active(dquot)) + continue; + if (dquot->dq_sb != sb) + continue; +@@ -603,7 +608,7 @@ int dquot_scan_active(struct super_block *sb, + * outstanding call and recheck the DQ_ACTIVE_B after that. + */ + wait_on_dquot(dquot); +- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { ++ if (dquot_active(dquot)) { + ret = fn(dquot, priv); + if (ret < 0) + goto out; +@@ -654,7 +659,7 @@ int dquot_writeback_dquots(struct super_block *sb, int type) + dquot = list_first_entry(&dirty, struct dquot, + dq_dirty); + +- WARN_ON(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)); ++ WARN_ON(!dquot_active(dquot)); + + /* Now we have active dquot from which someone is + * holding reference so we can safely just increase +@@ -791,7 +796,7 @@ void dqput(struct dquot *dquot) + dquot_write_dquot(dquot); + goto we_slept; + } +- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { ++ if (dquot_active(dquot)) { + spin_unlock(&dq_list_lock); + dquot->dq_sb->dq_op->release_dquot(dquot); + goto we_slept; +@@ -892,7 +897,7 @@ struct dquot *dqget(struct super_block *sb, struct kqid qid) + * already finished or it will be canceled due to dq_count > 1 test */ + wait_on_dquot(dquot); + /* Read the dquot / allocate space in quota file */ +- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { ++ if (!dquot_active(dquot)) { + int err; + + err = sb->dq_op->acquire_dquot(dquot); +-- +2.40.1 + diff --git a/queue-5.4/quota-avoid-increasing-dqst_lookups-when-iterating-o.patch b/queue-5.4/quota-avoid-increasing-dqst_lookups-when-iterating-o.patch new file mode 100644 index 00000000000..b8f9c6ecdb6 --- /dev/null +++ b/queue-5.4/quota-avoid-increasing-dqst_lookups-when-iterating-o.patch @@ -0,0 +1,45 @@ +From 94bebbf670629497101d8c5f8d8f962821c8c7ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2019 16:34:08 +0800 +Subject: quota: avoid increasing DQST_LOOKUPS when iterating over dirty/inuse + list + +From: Chengguang Xu + +[ Upstream commit 05848db2083d4f232e84e385845dcd98d5c511b2 ] + +It is meaningless to increase DQST_LOOKUPS number while iterating +over dirty/inuse list, so just avoid it. + +Link: https://lore.kernel.org/r/20190926083408.4269-1-cgxu519@zoho.com.cn +Signed-off-by: Chengguang Xu +Signed-off-by: Jan Kara +Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 5361e6bc397d0..5b887fb1aa71a 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -595,7 +595,6 @@ int dquot_scan_active(struct super_block *sb, + /* Now we have active dquot so we can just increase use count */ + atomic_inc(&dquot->dq_count); + spin_unlock(&dq_list_lock); +- dqstats_inc(DQST_LOOKUPS); + dqput(old_dquot); + old_dquot = dquot; + /* +@@ -650,7 +649,6 @@ int dquot_writeback_dquots(struct super_block *sb, int type) + * use count */ + dqgrab(dquot); + spin_unlock(&dq_list_lock); +- dqstats_inc(DQST_LOOKUPS); + err = sb->dq_op->write_dquot(dquot); + if (err) { + /* +-- +2.40.1 + diff --git a/queue-5.4/quota-factor-out-dquot_write_dquot.patch b/queue-5.4/quota-factor-out-dquot_write_dquot.patch new file mode 100644 index 00000000000..944213a5f77 --- /dev/null +++ b/queue-5.4/quota-factor-out-dquot_write_dquot.patch @@ -0,0 +1,94 @@ +From 13c208c4761c6bb20c4e01e0706014dc84563784 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 19:08:18 +0800 +Subject: quota: factor out dquot_write_dquot() + +From: Baokun Li + +[ Upstream commit 024128477809f8073d870307c8157b8826ebfd08 ] + +Refactor out dquot_write_dquot() to reduce duplicate code. + +Signed-off-by: Baokun Li +Signed-off-by: Jan Kara +Message-Id: <20230630110822.3881712-2-libaokun1@huawei.com> +Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 39 ++++++++++++++++----------------------- + 1 file changed, 16 insertions(+), 23 deletions(-) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 5b887fb1aa71a..806a404e7156e 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -619,6 +619,18 @@ int dquot_scan_active(struct super_block *sb, + } + EXPORT_SYMBOL(dquot_scan_active); + ++static inline int dquot_write_dquot(struct dquot *dquot) ++{ ++ int ret = dquot->dq_sb->dq_op->write_dquot(dquot); ++ if (ret < 0) { ++ quota_error(dquot->dq_sb, "Can't write quota structure " ++ "(error %d). Quota may get out of sync!", ret); ++ /* Clear dirty bit anyway to avoid infinite loop. */ ++ clear_dquot_dirty(dquot); ++ } ++ return ret; ++} ++ + /* Write all dquot structures to quota files */ + int dquot_writeback_dquots(struct super_block *sb, int type) + { +@@ -649,16 +661,9 @@ int dquot_writeback_dquots(struct super_block *sb, int type) + * use count */ + dqgrab(dquot); + spin_unlock(&dq_list_lock); +- err = sb->dq_op->write_dquot(dquot); +- if (err) { +- /* +- * Clear dirty bit anyway to avoid infinite +- * loop here. +- */ +- clear_dquot_dirty(dquot); +- if (!ret) +- ret = err; +- } ++ err = dquot_write_dquot(dquot); ++ if (err && !ret) ++ ret = err; + dqput(dquot); + spin_lock(&dq_list_lock); + } +@@ -756,8 +761,6 @@ static struct shrinker dqcache_shrinker = { + */ + void dqput(struct dquot *dquot) + { +- int ret; +- + if (!dquot) + return; + #ifdef CONFIG_QUOTA_DEBUG +@@ -785,17 +788,7 @@ void dqput(struct dquot *dquot) + if (dquot_dirty(dquot)) { + spin_unlock(&dq_list_lock); + /* Commit dquot before releasing */ +- ret = dquot->dq_sb->dq_op->write_dquot(dquot); +- if (ret < 0) { +- quota_error(dquot->dq_sb, "Can't write quota structure" +- " (error %d). Quota may get out of sync!", +- ret); +- /* +- * We clear dirty bit anyway, so that we avoid +- * infinite loop here +- */ +- clear_dquot_dirty(dquot); +- } ++ dquot_write_dquot(dquot); + goto we_slept; + } + if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { +-- +2.40.1 + diff --git a/queue-5.4/quota-fix-dqput-to-follow-the-guarantees-dquot_srcu-.patch b/queue-5.4/quota-fix-dqput-to-follow-the-guarantees-dquot_srcu-.patch new file mode 100644 index 00000000000..6464209940d --- /dev/null +++ b/queue-5.4/quota-fix-dqput-to-follow-the-guarantees-dquot_srcu-.patch @@ -0,0 +1,249 @@ +From 770788ee445bd8ae5fc63d7e945209a6b8ea0a78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 19:08:21 +0800 +Subject: quota: fix dqput() to follow the guarantees dquot_srcu should provide + +From: Baokun Li + +[ Upstream commit dabc8b20756601b9e1cc85a81d47d3f98ed4d13a ] + +The dquot_mark_dquot_dirty() using dquot references from the inode +should be protected by dquot_srcu. quota_off code takes care to call +synchronize_srcu(&dquot_srcu) to not drop dquot references while they +are used by other users. But dquot_transfer() breaks this assumption. +We call dquot_transfer() to drop the last reference of dquot and add +it to free_dquots, but there may still be other users using the dquot +at this time, as shown in the function graph below: + + cpu1 cpu2 +_________________|_________________ +wb_do_writeback CHOWN(1) + ... + ext4_da_update_reserve_space + dquot_claim_block + ... + dquot_mark_dquot_dirty // try to dirty old quota + test_bit(DQ_ACTIVE_B, &dquot->dq_flags) // still ACTIVE + if (test_bit(DQ_MOD_B, &dquot->dq_flags)) + // test no dirty, wait dq_list_lock + ... + dquot_transfer + __dquot_transfer + dqput_all(transfer_from) // rls old dquot + dqput // last dqput + dquot_release + clear_bit(DQ_ACTIVE_B, &dquot->dq_flags) + atomic_dec(&dquot->dq_count) + put_dquot_last(dquot) + list_add_tail(&dquot->dq_free, &free_dquots) + // add the dquot to free_dquots + if (!test_and_set_bit(DQ_MOD_B, &dquot->dq_flags)) + add dqi_dirty_list // add released dquot to dirty_list + +This can cause various issues, such as dquot being destroyed by +dqcache_shrink_scan() after being added to free_dquots, which can trigger +a UAF in dquot_mark_dquot_dirty(); or after dquot is added to free_dquots +and then to dirty_list, it is added to free_dquots again after +dquot_writeback_dquots() is executed, which causes the free_dquots list to +be corrupted and triggers a UAF when dqcache_shrink_scan() is called for +freeing dquot twice. + +As Honza said, we need to fix dquot_transfer() to follow the guarantees +dquot_srcu should provide. But calling synchronize_srcu() directly from +dquot_transfer() is too expensive (and mostly unnecessary). So we add +dquot whose last reference should be dropped to the new global dquot +list releasing_dquots, and then queue work item which would call +synchronize_srcu() and after that perform the final cleanup of all the +dquots on releasing_dquots. + +Fixes: 4580b30ea887 ("quota: Do not dirty bad dquots") +Suggested-by: Jan Kara +Signed-off-by: Baokun Li +Signed-off-by: Jan Kara +Message-Id: <20230630110822.3881712-5-libaokun1@huawei.com> +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 96 +++++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 78 insertions(+), 18 deletions(-) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 5495c82e55ad4..30475cbe82cc8 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -223,13 +223,22 @@ static void put_quota_format(struct quota_format_type *fmt) + + /* + * Dquot List Management: +- * The quota code uses four lists for dquot management: the inuse_list, +- * free_dquots, dqi_dirty_list, and dquot_hash[] array. A single dquot +- * structure may be on some of those lists, depending on its current state. ++ * The quota code uses five lists for dquot management: the inuse_list, ++ * releasing_dquots, free_dquots, dqi_dirty_list, and dquot_hash[] array. ++ * A single dquot structure may be on some of those lists, depending on ++ * its current state. + * + * All dquots are placed to the end of inuse_list when first created, and this + * list is used for invalidate operation, which must look at every dquot. + * ++ * When the last reference of a dquot will be dropped, the dquot will be ++ * added to releasing_dquots. We'd then queue work item which would call ++ * synchronize_srcu() and after that perform the final cleanup of all the ++ * dquots on the list. Both releasing_dquots and free_dquots use the ++ * dq_free list_head in the dquot struct. When a dquot is removed from ++ * releasing_dquots, a reference count is always subtracted, and if ++ * dq_count == 0 at that point, the dquot will be added to the free_dquots. ++ * + * Unused dquots (dq_count == 0) are added to the free_dquots list when freed, + * and this list is searched whenever we need an available dquot. Dquots are + * removed from the list as soon as they are used again, and +@@ -248,6 +257,7 @@ static void put_quota_format(struct quota_format_type *fmt) + + static LIST_HEAD(inuse_list); + static LIST_HEAD(free_dquots); ++static LIST_HEAD(releasing_dquots); + static unsigned int dq_hash_bits, dq_hash_mask; + static struct hlist_head *dquot_hash; + +@@ -258,6 +268,9 @@ static qsize_t inode_get_rsv_space(struct inode *inode); + static qsize_t __inode_get_rsv_space(struct inode *inode); + static int __dquot_initialize(struct inode *inode, int type); + ++static void quota_release_workfn(struct work_struct *work); ++static DECLARE_DELAYED_WORK(quota_release_work, quota_release_workfn); ++ + static inline unsigned int + hashfn(const struct super_block *sb, struct kqid qid) + { +@@ -305,12 +318,18 @@ static inline void put_dquot_last(struct dquot *dquot) + dqstats_inc(DQST_FREE_DQUOTS); + } + ++static inline void put_releasing_dquots(struct dquot *dquot) ++{ ++ list_add_tail(&dquot->dq_free, &releasing_dquots); ++} ++ + static inline void remove_free_dquot(struct dquot *dquot) + { + if (list_empty(&dquot->dq_free)) + return; + list_del_init(&dquot->dq_free); +- dqstats_dec(DQST_FREE_DQUOTS); ++ if (!atomic_read(&dquot->dq_count)) ++ dqstats_dec(DQST_FREE_DQUOTS); + } + + static inline void put_inuse(struct dquot *dquot) +@@ -543,6 +562,8 @@ static void invalidate_dquots(struct super_block *sb, int type) + struct dquot *dquot, *tmp; + + restart: ++ flush_delayed_work("a_release_work); ++ + spin_lock(&dq_list_lock); + list_for_each_entry_safe(dquot, tmp, &inuse_list, dq_inuse) { + if (dquot->dq_sb != sb) +@@ -551,6 +572,12 @@ static void invalidate_dquots(struct super_block *sb, int type) + continue; + /* Wait for dquot users */ + if (atomic_read(&dquot->dq_count)) { ++ /* dquot in releasing_dquots, flush and retry */ ++ if (!list_empty(&dquot->dq_free)) { ++ spin_unlock(&dq_list_lock); ++ goto restart; ++ } ++ + atomic_inc(&dquot->dq_count); + spin_unlock(&dq_list_lock); + /* +@@ -761,6 +788,49 @@ static struct shrinker dqcache_shrinker = { + .seeks = DEFAULT_SEEKS, + }; + ++/* ++ * Safely release dquot and put reference to dquot. ++ */ ++static void quota_release_workfn(struct work_struct *work) ++{ ++ struct dquot *dquot; ++ struct list_head rls_head; ++ ++ spin_lock(&dq_list_lock); ++ /* Exchange the list head to avoid livelock. */ ++ list_replace_init(&releasing_dquots, &rls_head); ++ spin_unlock(&dq_list_lock); ++ ++restart: ++ synchronize_srcu(&dquot_srcu); ++ spin_lock(&dq_list_lock); ++ while (!list_empty(&rls_head)) { ++ dquot = list_first_entry(&rls_head, struct dquot, dq_free); ++ /* Dquot got used again? */ ++ if (atomic_read(&dquot->dq_count) > 1) { ++ remove_free_dquot(dquot); ++ atomic_dec(&dquot->dq_count); ++ continue; ++ } ++ if (dquot_dirty(dquot)) { ++ spin_unlock(&dq_list_lock); ++ /* Commit dquot before releasing */ ++ dquot_write_dquot(dquot); ++ goto restart; ++ } ++ if (dquot_active(dquot)) { ++ spin_unlock(&dq_list_lock); ++ dquot->dq_sb->dq_op->release_dquot(dquot); ++ goto restart; ++ } ++ /* Dquot is inactive and clean, now move it to free list */ ++ remove_free_dquot(dquot); ++ atomic_dec(&dquot->dq_count); ++ put_dquot_last(dquot); ++ } ++ spin_unlock(&dq_list_lock); ++} ++ + /* + * Put reference to dquot + */ +@@ -777,7 +847,7 @@ void dqput(struct dquot *dquot) + } + #endif + dqstats_inc(DQST_DROPS); +-we_slept: ++ + spin_lock(&dq_list_lock); + if (atomic_read(&dquot->dq_count) > 1) { + /* We have more than one user... nothing to do */ +@@ -789,25 +859,15 @@ void dqput(struct dquot *dquot) + spin_unlock(&dq_list_lock); + return; + } ++ + /* Need to release dquot? */ +- if (dquot_dirty(dquot)) { +- spin_unlock(&dq_list_lock); +- /* Commit dquot before releasing */ +- dquot_write_dquot(dquot); +- goto we_slept; +- } +- if (dquot_active(dquot)) { +- spin_unlock(&dq_list_lock); +- dquot->dq_sb->dq_op->release_dquot(dquot); +- goto we_slept; +- } +- atomic_dec(&dquot->dq_count); + #ifdef CONFIG_QUOTA_DEBUG + /* sanity check */ + BUG_ON(!list_empty(&dquot->dq_free)); + #endif +- put_dquot_last(dquot); ++ put_releasing_dquots(dquot); + spin_unlock(&dq_list_lock); ++ queue_delayed_work(system_unbound_wq, "a_release_work, 1); + } + EXPORT_SYMBOL(dqput); + +-- +2.40.1 + diff --git a/queue-5.4/quota-rename-dquot_active-to-inode_quota_active.patch b/queue-5.4/quota-rename-dquot_active-to-inode_quota_active.patch new file mode 100644 index 00000000000..8575a680e72 --- /dev/null +++ b/queue-5.4/quota-rename-dquot_active-to-inode_quota_active.patch @@ -0,0 +1,121 @@ +From 31f188d1b161cdac0e2d042c63bd0bafd2f91fa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 19:08:19 +0800 +Subject: quota: rename dquot_active() to inode_quota_active() + +From: Baokun Li + +[ Upstream commit 4b9bdfa16535de8f49bf954aeed0f525ee2fc322 ] + +Now we have a helper function dquot_dirty() to determine if dquot has +DQ_MOD_B bit. dquot_active() can easily be misunderstood as a helper +function to determine if dquot has DQ_ACTIVE_B bit. So we avoid this by +renaming it to inode_quota_active() and later on we will add the helper +function dquot_active() to determine if dquot has DQ_ACTIVE_B bit. + +Signed-off-by: Baokun Li +Signed-off-by: Jan Kara +Message-Id: <20230630110822.3881712-3-libaokun1@huawei.com> +Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 806a404e7156e..7abf1ae05f939 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -1409,7 +1409,7 @@ static int info_bdq_free(struct dquot *dquot, qsize_t space) + return QUOTA_NL_NOWARN; + } + +-static int dquot_active(const struct inode *inode) ++static int inode_quota_active(const struct inode *inode) + { + struct super_block *sb = inode->i_sb; + +@@ -1432,7 +1432,7 @@ static int __dquot_initialize(struct inode *inode, int type) + qsize_t rsv; + int ret = 0; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return 0; + + dquots = i_dquot(inode); +@@ -1540,7 +1540,7 @@ bool dquot_initialize_needed(struct inode *inode) + struct dquot **dquots; + int i; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return false; + + dquots = i_dquot(inode); +@@ -1651,7 +1651,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) + int reserve = flags & DQUOT_SPACE_RESERVE; + struct dquot **dquots; + +- if (!dquot_active(inode)) { ++ if (!inode_quota_active(inode)) { + if (reserve) { + spin_lock(&inode->i_lock); + *inode_reserved_space(inode) += number; +@@ -1721,7 +1721,7 @@ int dquot_alloc_inode(struct inode *inode) + struct dquot_warn warn[MAXQUOTAS]; + struct dquot * const *dquots; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return 0; + for (cnt = 0; cnt < MAXQUOTAS; cnt++) + warn[cnt].w_type = QUOTA_NL_NOWARN; +@@ -1764,7 +1764,7 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) + struct dquot **dquots; + int cnt, index; + +- if (!dquot_active(inode)) { ++ if (!inode_quota_active(inode)) { + spin_lock(&inode->i_lock); + *inode_reserved_space(inode) -= number; + __inode_add_bytes(inode, number); +@@ -1806,7 +1806,7 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) + struct dquot **dquots; + int cnt, index; + +- if (!dquot_active(inode)) { ++ if (!inode_quota_active(inode)) { + spin_lock(&inode->i_lock); + *inode_reserved_space(inode) += number; + __inode_sub_bytes(inode, number); +@@ -1850,7 +1850,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) + struct dquot **dquots; + int reserve = flags & DQUOT_SPACE_RESERVE, index; + +- if (!dquot_active(inode)) { ++ if (!inode_quota_active(inode)) { + if (reserve) { + spin_lock(&inode->i_lock); + *inode_reserved_space(inode) -= number; +@@ -1905,7 +1905,7 @@ void dquot_free_inode(struct inode *inode) + struct dquot * const *dquots; + int index; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return; + + dquots = i_dquot(inode); +@@ -2076,7 +2076,7 @@ int dquot_transfer(struct inode *inode, struct iattr *iattr) + struct super_block *sb = inode->i_sb; + int ret; + +- if (!dquot_active(inode)) ++ if (!inode_quota_active(inode)) + return 0; + + if (iattr->ia_valid & ATTR_UID && !uid_eq(iattr->ia_uid, inode->i_uid)){ +-- +2.40.1 + diff --git a/queue-5.4/rdma-siw-balance-the-reference-of-cep-kref-in-the-er.patch b/queue-5.4/rdma-siw-balance-the-reference-of-cep-kref-in-the-er.patch new file mode 100644 index 00000000000..4b090a98799 --- /dev/null +++ b/queue-5.4/rdma-siw-balance-the-reference-of-cep-kref-in-the-er.patch @@ -0,0 +1,50 @@ +From 068dd3a0b98977c5b97eb695627f01c5196bd66b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Aug 2023 21:32:53 +0800 +Subject: RDMA/siw: Balance the reference of cep->kref in the error path + +From: Guoqing Jiang + +[ Upstream commit b056327bee09e6b86683d3f709a438ccd6031d72 ] + +The siw_connect can go to err in below after cep is allocated successfully: + +1. If siw_cm_alloc_work returns failure. In this case socket is not +assoicated with cep so siw_cep_put can't be called by siw_socket_disassoc. +We need to call siw_cep_put twice since cep->kref is increased once after +it was initialized. + +2. If siw_cm_queue_work can't find a work, which means siw_cep_get is not +called in siw_cm_queue_work, so cep->kref is increased twice by siw_cep_get +and when associate socket with cep after it was initialized. So we need to +call siw_cep_put three times (one in siw_socket_disassoc). + +3. siw_send_mpareqrep returns error, this scenario is similar as 2. + +So we need to remove one siw_cep_put in the error path. + +Fixes: 6c52fdc244b5 ("rdma/siw: connection management") +Signed-off-by: Guoqing Jiang +Link: https://lore.kernel.org/r/20230821133255.31111-2-guoqing.jiang@linux.dev +Acked-by: Bernard Metzler +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_cm.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c +index 69fcf21eaf528..3d96b649889ca 100644 +--- a/drivers/infiniband/sw/siw/siw_cm.c ++++ b/drivers/infiniband/sw/siw/siw_cm.c +@@ -1525,7 +1525,6 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params) + + cep->cm_id = NULL; + id->rem_ref(id); +- siw_cep_put(cep); + + qp->cep = NULL; + siw_cep_put(cep); +-- +2.40.1 + diff --git a/queue-5.4/rdma-siw-correct-wrong-debug-message.patch b/queue-5.4/rdma-siw-correct-wrong-debug-message.patch new file mode 100644 index 00000000000..b6c863e5e49 --- /dev/null +++ b/queue-5.4/rdma-siw-correct-wrong-debug-message.patch @@ -0,0 +1,38 @@ +From 8664be783f07cbbba8bb0f8776060626974286f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Aug 2023 21:32:54 +0800 +Subject: RDMA/siw: Correct wrong debug message + +From: Guoqing Jiang + +[ Upstream commit bee024d20451e4ce04ea30099cad09f7f75d288b ] + +We need to print num_sle first then pbl->max_buf per the condition. +Also replace mem->pbl with pbl while at it. + +Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") +Signed-off-by: Guoqing Jiang +Link: https://lore.kernel.org/r/20230821133255.31111-3-guoqing.jiang@linux.dev +Acked-by: Bernard Metzler +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index c8c2014b79d22..236f9efaa75ce 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -1509,7 +1509,7 @@ int siw_map_mr_sg(struct ib_mr *base_mr, struct scatterlist *sl, int num_sle, + + if (pbl->max_buf < num_sle) { + siw_dbg_mem(mem, "too many SGE's: %d > %d\n", +- mem->pbl->max_buf, num_sle); ++ num_sle, pbl->max_buf); + return -ENOMEM; + } + for_each_sg(sl, slp, num_sle, i) { +-- +2.40.1 + diff --git a/queue-5.4/regmap-rbtree-use-alloc_flags-for-memory-allocations.patch b/queue-5.4/regmap-rbtree-use-alloc_flags-for-memory-allocations.patch new file mode 100644 index 00000000000..6349c7251f0 --- /dev/null +++ b/queue-5.4/regmap-rbtree-use-alloc_flags-for-memory-allocations.patch @@ -0,0 +1,98 @@ +From 1b16f8d3286898d7762d7b13511e6a5094f30c3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 17:55:33 +0300 +Subject: regmap: rbtree: Use alloc_flags for memory allocations + +From: Dan Carpenter + +[ Upstream commit 0c8b0bf42c8cef56f7cd9cd876fbb7ece9217064 ] + +The kunit tests discovered a sleeping in atomic bug. The allocations +in the regcache-rbtree code should use the map->alloc_flags instead of +GFP_KERNEL. + +[ 5.005510] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:306 +[ 5.005960] in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 117, name: kunit_try_catch +[ 5.006219] preempt_count: 1, expected: 0 +[ 5.006414] 1 lock held by kunit_try_catch/117: +[ 5.006590] #0: 833b9010 (regmap_kunit:86:(config)->lock){....}-{2:2}, at: regmap_lock_spinlock+0x14/0x1c +[ 5.007493] irq event stamp: 162 +[ 5.007627] hardirqs last enabled at (161): [<80786738>] crng_make_state+0x1a0/0x294 +[ 5.007871] hardirqs last disabled at (162): [<80c531ec>] _raw_spin_lock_irqsave+0x7c/0x80 +[ 5.008119] softirqs last enabled at (0): [<801110ac>] copy_process+0x810/0x2138 +[ 5.008356] softirqs last disabled at (0): [<00000000>] 0x0 +[ 5.008688] CPU: 0 PID: 117 Comm: kunit_try_catch Tainted: G N 6.4.4-rc3-g0e8d2fdfb188 #1 +[ 5.009011] Hardware name: Generic DT based system +[ 5.009277] unwind_backtrace from show_stack+0x18/0x1c +[ 5.009497] show_stack from dump_stack_lvl+0x38/0x5c +[ 5.009676] dump_stack_lvl from __might_resched+0x188/0x2d0 +[ 5.009860] __might_resched from __kmem_cache_alloc_node+0x1dc/0x25c +[ 5.010061] __kmem_cache_alloc_node from kmalloc_trace+0x30/0xc8 +[ 5.010254] kmalloc_trace from regcache_rbtree_write+0x26c/0x468 +[ 5.010446] regcache_rbtree_write from _regmap_write+0x88/0x140 +[ 5.010634] _regmap_write from regmap_write+0x44/0x68 +[ 5.010803] regmap_write from basic_read_write+0x8c/0x270 +[ 5.010980] basic_read_write from kunit_try_run_case+0x48/0xa0 + +Fixes: 28644c809f44 ("regmap: Add the rbtree cache support") +Reported-by: Guenter Roeck +Closes: https://lore.kernel.org/all/ee59d128-413c-48ad-a3aa-d9d350c80042@roeck-us.net/ +Signed-off-by: Dan Carpenter +Tested-by: Guenter Roeck +Link: https://lore.kernel.org/r/58f12a07-5f4b-4a8f-ab84-0a42d1908cb9@moroto.mountain +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regcache-rbtree.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c +index fabf87058d80b..ae6b8788d5f3f 100644 +--- a/drivers/base/regmap/regcache-rbtree.c ++++ b/drivers/base/regmap/regcache-rbtree.c +@@ -277,7 +277,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, + + blk = krealloc(rbnode->block, + blklen * map->cache_word_size, +- GFP_KERNEL); ++ map->alloc_flags); + if (!blk) + return -ENOMEM; + +@@ -286,7 +286,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, + if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) { + present = krealloc(rbnode->cache_present, + BITS_TO_LONGS(blklen) * sizeof(*present), +- GFP_KERNEL); ++ map->alloc_flags); + if (!present) + return -ENOMEM; + +@@ -320,7 +320,7 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg) + const struct regmap_range *range; + int i; + +- rbnode = kzalloc(sizeof(*rbnode), GFP_KERNEL); ++ rbnode = kzalloc(sizeof(*rbnode), map->alloc_flags); + if (!rbnode) + return NULL; + +@@ -346,13 +346,13 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg) + } + + rbnode->block = kmalloc_array(rbnode->blklen, map->cache_word_size, +- GFP_KERNEL); ++ map->alloc_flags); + if (!rbnode->block) + goto err_free; + + rbnode->cache_present = kcalloc(BITS_TO_LONGS(rbnode->blklen), + sizeof(*rbnode->cache_present), +- GFP_KERNEL); ++ map->alloc_flags); + if (!rbnode->cache_present) + goto err_free_block; + +-- +2.40.1 + diff --git a/queue-5.4/reiserfs-check-the-return-value-from-__getblk.patch b/queue-5.4/reiserfs-check-the-return-value-from-__getblk.patch new file mode 100644 index 00000000000..71889a00bde --- /dev/null +++ b/queue-5.4/reiserfs-check-the-return-value-from-__getblk.patch @@ -0,0 +1,49 @@ +From 22bf9c65ba071c80f8b418a7372b1825da6597db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 12:16:06 +0100 +Subject: reiserfs: Check the return value from __getblk() + +From: Matthew Wilcox + +[ Upstream commit ba38980add7ffc9e674ada5b4ded4e7d14e76581 ] + +__getblk() can return a NULL pointer if we run out of memory or if we +try to access beyond the end of the device; check it and handle it +appropriately. + +Signed-off-by: Matthew Wilcox (Oracle) +Link: https://lore.kernel.org/lkml/CAFcO6XOacq3hscbXevPQP7sXRoYFz34ZdKPYjmd6k5sZuhGFDw@mail.gmail.com/ +Tested-by: butt3rflyh4ck +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") # probably introduced in 2002 +Acked-by: Edward Shishkin +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/reiserfs/journal.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c +index 09ad022a78a55..b8277a5dfe40e 100644 +--- a/fs/reiserfs/journal.c ++++ b/fs/reiserfs/journal.c +@@ -2327,7 +2327,7 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev, + int i, j; + + bh = __getblk(dev, block, bufsize); +- if (buffer_uptodate(bh)) ++ if (!bh || buffer_uptodate(bh)) + return (bh); + + if (block + BUFNR > max_block) { +@@ -2337,6 +2337,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev, + j = 1; + for (i = 1; i < blocks; i++) { + bh = __getblk(dev, block + i, bufsize); ++ if (!bh) ++ break; + if (buffer_uptodate(bh)) { + brelse(bh); + break; +-- +2.40.1 + diff --git a/queue-5.4/revert-ib-isert-fix-incorrect-release-of-isert-conne.patch b/queue-5.4/revert-ib-isert-fix-incorrect-release-of-isert-conne.patch new file mode 100644 index 00000000000..7c790494887 --- /dev/null +++ b/queue-5.4/revert-ib-isert-fix-incorrect-release-of-isert-conne.patch @@ -0,0 +1,124 @@ +From 7dac4adc7a307625865e63d08143fcc5c27b93f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Aug 2023 10:57:14 +0300 +Subject: Revert "IB/isert: Fix incorrect release of isert connection" + +From: Leon Romanovsky + +[ Upstream commit dfe261107c080709459c32695847eec96238852b ] + +Commit: 699826f4e30a ("IB/isert: Fix incorrect release of isert connection") is +causing problems on OPA when DEVICE_REMOVAL is happening. + + ------------[ cut here ]------------ + WARNING: CPU: 52 PID: 2117247 at drivers/infiniband/core/cq.c:359 +ib_cq_pool_cleanup+0xac/0xb0 [ib_core] + Modules linked in: nfsd nfs_acl target_core_user uio tcm_fc libfc +scsi_transport_fc tcm_loop target_core_pscsi target_core_iblock target_core_file +rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs +rfkill rpcrdma rdma_ucm ib_srpt sunrpc ib_isert iscsi_target_mod target_core_mod +opa_vnic ib_iser libiscsi ib_umad scsi_transport_iscsi rdma_cm ib_ipoib iw_cm +ib_cm hfi1(-) rdmavt ib_uverbs intel_rapl_msr intel_rapl_common sb_edac ib_core +x86_pkg_temp_thermal intel_powerclamp coretemp i2c_i801 mxm_wmi rapl iTCO_wdt +ipmi_si iTCO_vendor_support mei_me ipmi_devintf mei intel_cstate ioatdma +intel_uncore i2c_smbus joydev pcspkr lpc_ich ipmi_msghandler acpi_power_meter +acpi_pad xfs libcrc32c sr_mod sd_mod cdrom t10_pi sg crct10dif_pclmul +crc32_pclmul crc32c_intel drm_kms_helper drm_shmem_helper ahci libahci +ghash_clmulni_intel igb drm libata dca i2c_algo_bit wmi fuse + CPU: 52 PID: 2117247 Comm: modprobe Not tainted 6.5.0-rc1+ #1 + Hardware name: Intel Corporation S2600CWR/S2600CW, BIOS +SE5C610.86B.01.01.0014.121820151719 12/18/2015 + RIP: 0010:ib_cq_pool_cleanup+0xac/0xb0 [ib_core] + Code: ff 48 8b 43 40 48 8d 7b 40 48 83 e8 40 4c 39 e7 75 b3 49 83 +c4 10 4d 39 fc 75 94 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc <0f> 0b eb a1 +90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f + RSP: 0018:ffffc10bea13fc80 EFLAGS: 00010206 + RAX: 000000000000010c RBX: ffff9bf5c7e66c00 RCX: 000000008020001d + RDX: 000000008020001e RSI: fffff175221f9900 RDI: ffff9bf5c7e67640 + RBP: ffff9bf5c7e67600 R08: ffff9bf5c7e64400 R09: 000000008020001d + R10: 0000000040000000 R11: 0000000000000000 R12: ffff9bee4b1e8a18 + R13: dead000000000122 R14: dead000000000100 R15: ffff9bee4b1e8a38 + FS: 00007ff1e6d38740(0000) GS:ffff9bfd9fb00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00005652044ecc68 CR3: 0000000889b5c005 CR4: 00000000001706e0 + Call Trace: + + ? __warn+0x80/0x130 + ? ib_cq_pool_cleanup+0xac/0xb0 [ib_core] + ? report_bug+0x195/0x1a0 + ? handle_bug+0x3c/0x70 + ? exc_invalid_op+0x14/0x70 + ? asm_exc_invalid_op+0x16/0x20 + ? ib_cq_pool_cleanup+0xac/0xb0 [ib_core] + disable_device+0x9d/0x160 [ib_core] + __ib_unregister_device+0x42/0xb0 [ib_core] + ib_unregister_device+0x22/0x30 [ib_core] + rvt_unregister_device+0x20/0x90 [rdmavt] + hfi1_unregister_ib_device+0x16/0xf0 [hfi1] + remove_one+0x55/0x1a0 [hfi1] + pci_device_remove+0x36/0xa0 + device_release_driver_internal+0x193/0x200 + driver_detach+0x44/0x90 + bus_remove_driver+0x69/0xf0 + pci_unregister_driver+0x2a/0xb0 + hfi1_mod_cleanup+0xc/0x3c [hfi1] + __do_sys_delete_module.constprop.0+0x17a/0x2f0 + ? exit_to_user_mode_prepare+0xc4/0xd0 + ? syscall_trace_enter.constprop.0+0x126/0x1a0 + do_syscall_64+0x5c/0x90 + ? syscall_exit_to_user_mode+0x12/0x30 + ? do_syscall_64+0x69/0x90 + ? syscall_exit_work+0x103/0x130 + ? syscall_exit_to_user_mode+0x12/0x30 + ? do_syscall_64+0x69/0x90 + ? exc_page_fault+0x65/0x150 + entry_SYSCALL_64_after_hwframe+0x6e/0xd8 + RIP: 0033:0x7ff1e643f5ab + Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 +66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 +ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 + RSP: 002b:00007ffec9103cc8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 + RAX: ffffffffffffffda RBX: 00005615267fdc50 RCX: 00007ff1e643f5ab + RDX: 0000000000000000 RSI: 0000000000000800 RDI: 00005615267fdcb8 + RBP: 00005615267fdc50 R08: 0000000000000000 R09: 0000000000000000 + R10: 00007ff1e659eac0 R11: 0000000000000206 R12: 00005615267fdcb8 + R13: 0000000000000000 R14: 00005615267fdcb8 R15: 00007ffec9105ff8 + + ---[ end trace 0000000000000000 ]--- + +And... + + restrack: ------------[ cut here ]------------ + infiniband hfi1_0: BUG: RESTRACK detected leak of resources + restrack: Kernel PD object allocated by ib_isert is not freed + restrack: Kernel CQ object allocated by ib_core is not freed + restrack: Kernel QP object allocated by rdma_cm is not freed + restrack: ------------[ cut here ]------------ + +Fixes: 699826f4e30a ("IB/isert: Fix incorrect release of isert connection") +Reported-by: Dennis Dalessandro +Closes: https://lore.kernel.org/all/921cd1d9-2879-f455-1f50-0053fe6a6655@cornelisnetworks.com +Link: https://lore.kernel.org/r/a27982d3235005c58f6d321f3fad5eb6e1beaf9e.1692604607.git.leonro@nvidia.com +Tested-by: Dennis Dalessandro +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/isert/ib_isert.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 5bb1fc7fd79c9..6ff92dca2898c 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -2646,6 +2646,8 @@ static void isert_wait_conn(struct iscsi_conn *conn) + isert_put_unsol_pending_cmds(conn); + isert_wait4cmds(conn); + isert_wait4logout(isert_conn); ++ ++ queue_work(isert_release_wq, &isert_conn->release_work); + } + + static void isert_free_conn(struct iscsi_conn *conn) +-- +2.40.1 + diff --git a/queue-5.4/rpmsg-glink-add-check-for-kstrdup.patch b/queue-5.4/rpmsg-glink-add-check-for-kstrdup.patch new file mode 100644 index 00000000000..58c02d44167 --- /dev/null +++ b/queue-5.4/rpmsg-glink-add-check-for-kstrdup.patch @@ -0,0 +1,39 @@ +From a5088c4ec7ebf570f7dc1e825e0ff8a12dce9fde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 11:06:31 +0800 +Subject: rpmsg: glink: Add check for kstrdup + +From: Jiasheng Jiang + +[ Upstream commit b5c9ee8296a3760760c7b5d2e305f91412adc795 ] + +Add check for the return value of kstrdup() and return the error +if it fails in order to avoid NULL pointer dereference. + +Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20230619030631.12361-1-jiasheng@iscas.ac.cn +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_glink_native.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index 11ba44dc551e4..f65db95e78aa4 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -222,6 +222,10 @@ static struct glink_channel *qcom_glink_alloc_channel(struct qcom_glink *glink, + + channel->glink = glink; + channel->name = kstrdup(name, GFP_KERNEL); ++ if (!channel->name) { ++ kfree(channel); ++ return ERR_PTR(-ENOMEM); ++ } + + init_completion(&channel->open_req); + init_completion(&channel->open_ack); +-- +2.40.1 + diff --git a/queue-5.4/scsi-be2iscsi-add-length-check-when-parsing-nlattrs.patch b/queue-5.4/scsi-be2iscsi-add-length-check-when-parsing-nlattrs.patch new file mode 100644 index 00000000000..c6664b5840b --- /dev/null +++ b/queue-5.4/scsi-be2iscsi-add-length-check-when-parsing-nlattrs.patch @@ -0,0 +1,46 @@ +From 9867af1f5e094ea1a80c0ba20011bda4e7c5444a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 15:59:38 +0800 +Subject: scsi: be2iscsi: Add length check when parsing nlattrs + +From: Lin Ma + +[ Upstream commit ee0268f230f66cb472df3424f380ea668da2749a ] + +beiscsi_iface_set_param() parses nlattr with nla_for_each_attr and assumes +every attributes can be viewed as struct iscsi_iface_param_info. + +This is not true because there is no any nla_policy to validate the +attributes passed from the upper function iscsi_set_iface_params(). + +Add the nla_len check before accessing the nlattr data and return EINVAL if +the length check fails. + +Fixes: 0e43895ec1f4 ("[SCSI] be2iscsi: adding functionality to change network settings using iscsiadm") +Signed-off-by: Lin Ma +Link: https://lore.kernel.org/r/20230723075938.3713864-1-linma@zju.edu.cn +Reviewed-by: Chris Leech +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/be2iscsi/be_iscsi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/scsi/be2iscsi/be_iscsi.c b/drivers/scsi/be2iscsi/be_iscsi.c +index 2058d50d62e12..737d7087723af 100644 +--- a/drivers/scsi/be2iscsi/be_iscsi.c ++++ b/drivers/scsi/be2iscsi/be_iscsi.c +@@ -441,6 +441,10 @@ int beiscsi_iface_set_param(struct Scsi_Host *shost, + } + + nla_for_each_attr(attrib, data, dt_len, rm_len) { ++ /* ignore nla_type as it is never used */ ++ if (nla_len(attrib) < sizeof(*iface_param)) ++ return -EINVAL; ++ + iface_param = nla_data(attrib); + + if (iface_param->param_type != ISCSI_NET_PARAM) +-- +2.40.1 + diff --git a/queue-5.4/scsi-core-use-32-bit-hostnum-in-scsi_host_lookup.patch b/queue-5.4/scsi-core-use-32-bit-hostnum-in-scsi_host_lookup.patch new file mode 100644 index 00000000000..0f3ea6a94c4 --- /dev/null +++ b/queue-5.4/scsi-core-use-32-bit-hostnum-in-scsi_host_lookup.patch @@ -0,0 +1,61 @@ +From 7cb9d386895e0052bc75101aa25c2b13917197db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 10:03:25 -0400 +Subject: scsi: core: Use 32-bit hostnum in scsi_host_lookup() + +From: Tony Battersby + +[ Upstream commit 62ec2092095b678ff89ce4ba51c2938cd1e8e630 ] + +Change scsi_host_lookup() hostnum argument type from unsigned short to +unsigned int to match the type used everywhere else. + +Fixes: 6d49f63b415c ("[SCSI] Make host_no an unsigned int") +Signed-off-by: Tony Battersby +Link: https://lore.kernel.org/r/a02497e7-c12b-ef15-47fc-3f0a0b00ffce@cybernetics.com +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hosts.c | 4 ++-- + include/scsi/scsi_host.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c +index b97e046c6a6e1..a8ae573294e57 100644 +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -518,7 +518,7 @@ EXPORT_SYMBOL(scsi_host_alloc); + static int __scsi_host_match(struct device *dev, const void *data) + { + struct Scsi_Host *p; +- const unsigned short *hostnum = data; ++ const unsigned int *hostnum = data; + + p = class_to_shost(dev); + return p->host_no == *hostnum; +@@ -535,7 +535,7 @@ static int __scsi_host_match(struct device *dev, const void *data) + * that scsi_host_get() took. The put_device() below dropped + * the reference from class_find_device(). + **/ +-struct Scsi_Host *scsi_host_lookup(unsigned short hostnum) ++struct Scsi_Host *scsi_host_lookup(unsigned int hostnum) + { + struct device *cdev; + struct Scsi_Host *shost = NULL; +diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h +index 31e0d6ca1ebaa..4488c3468c6de 100644 +--- a/include/scsi/scsi_host.h ++++ b/include/scsi/scsi_host.h +@@ -744,7 +744,7 @@ extern void scsi_remove_host(struct Scsi_Host *); + extern struct Scsi_Host *scsi_host_get(struct Scsi_Host *); + extern int scsi_host_busy(struct Scsi_Host *shost); + extern void scsi_host_put(struct Scsi_Host *t); +-extern struct Scsi_Host *scsi_host_lookup(unsigned short); ++extern struct Scsi_Host *scsi_host_lookup(unsigned int hostnum); + extern const char *scsi_host_state_name(enum scsi_host_state); + + static inline int __must_check scsi_add_host(struct Scsi_Host *host, +-- +2.40.1 + diff --git a/queue-5.4/scsi-fcoe-fix-potential-deadlock-on-fip-ctlr_lock.patch b/queue-5.4/scsi-fcoe-fix-potential-deadlock-on-fip-ctlr_lock.patch new file mode 100644 index 00000000000..e903d247cd8 --- /dev/null +++ b/queue-5.4/scsi-fcoe-fix-potential-deadlock-on-fip-ctlr_lock.patch @@ -0,0 +1,156 @@ +From f0a2f28572b370f46de81bf1369fe9036a545fbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 07:47:08 +0000 +Subject: scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock + +From: Chengfeng Ye + +[ Upstream commit 1a1975551943f681772720f639ff42fbaa746212 ] + +There is a long call chain that &fip->ctlr_lock is acquired by isr +fnic_isr_msix_wq_copy() under hard IRQ context. Thus other process context +code acquiring the lock should disable IRQ, otherwise deadlock could happen +if the IRQ preempts the execution while the lock is held in process context +on the same CPU. + +[ISR] +fnic_isr_msix_wq_copy() + -> fnic_wq_copy_cmpl_handler() + -> fnic_fcpio_cmpl_handler() + -> fnic_fcpio_flogi_reg_cmpl_handler() + -> fnic_flush_tx() + -> fnic_send_frame() + -> fcoe_ctlr_els_send() + -> spin_lock_bh(&fip->ctlr_lock) + +[Process Context] +1. fcoe_ctlr_timer_work() + -> fcoe_ctlr_flogi_send() + -> spin_lock_bh(&fip->ctlr_lock) + +2. fcoe_ctlr_recv_work() + -> fcoe_ctlr_recv_handler() + -> fcoe_ctlr_recv_els() + -> fcoe_ctlr_announce() + -> spin_lock_bh(&fip->ctlr_lock) + +3. fcoe_ctlr_recv_work() + -> fcoe_ctlr_recv_handler() + -> fcoe_ctlr_recv_els() + -> fcoe_ctlr_flogi_retry() + -> spin_lock_bh(&fip->ctlr_lock) + +4. -> fcoe_xmit() + -> fcoe_ctlr_els_send() + -> spin_lock_bh(&fip->ctlr_lock) + +spin_lock_bh() is not enough since fnic_isr_msix_wq_copy() is a +hardirq. + +These flaws were found by an experimental static analysis tool I am +developing for irq-related deadlock. + +The patch fix the potential deadlocks by spin_lock_irqsave() to disable +hard irq. + +Fixes: 794d98e77f59 ("[SCSI] libfcoe: retry rejected FLOGI to another FCF if possible") +Signed-off-by: Chengfeng Ye +Link: https://lore.kernel.org/r/20230817074708.7509-1-dg573847474@gmail.com +Reviewed-by: Davidlohr Bueso +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/fcoe/fcoe_ctlr.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c +index 7ce2a0434e1e5..d45e8c57051bf 100644 +--- a/drivers/scsi/fcoe/fcoe_ctlr.c ++++ b/drivers/scsi/fcoe/fcoe_ctlr.c +@@ -318,16 +318,17 @@ static void fcoe_ctlr_announce(struct fcoe_ctlr *fip) + { + struct fcoe_fcf *sel; + struct fcoe_fcf *fcf; ++ unsigned long flags; + + mutex_lock(&fip->ctlr_mutex); +- spin_lock_bh(&fip->ctlr_lock); ++ spin_lock_irqsave(&fip->ctlr_lock, flags); + + kfree_skb(fip->flogi_req); + fip->flogi_req = NULL; + list_for_each_entry(fcf, &fip->fcfs, list) + fcf->flogi_sent = 0; + +- spin_unlock_bh(&fip->ctlr_lock); ++ spin_unlock_irqrestore(&fip->ctlr_lock, flags); + sel = fip->sel_fcf; + + if (sel && ether_addr_equal(sel->fcf_mac, fip->dest_addr)) +@@ -697,6 +698,7 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport, + { + struct fc_frame *fp; + struct fc_frame_header *fh; ++ unsigned long flags; + u16 old_xid; + u8 op; + u8 mac[ETH_ALEN]; +@@ -730,11 +732,11 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport, + op = FIP_DT_FLOGI; + if (fip->mode == FIP_MODE_VN2VN) + break; +- spin_lock_bh(&fip->ctlr_lock); ++ spin_lock_irqsave(&fip->ctlr_lock, flags); + kfree_skb(fip->flogi_req); + fip->flogi_req = skb; + fip->flogi_req_send = 1; +- spin_unlock_bh(&fip->ctlr_lock); ++ spin_unlock_irqrestore(&fip->ctlr_lock, flags); + schedule_work(&fip->timer_work); + return -EINPROGRESS; + case ELS_FDISC: +@@ -1711,10 +1713,11 @@ static int fcoe_ctlr_flogi_send_locked(struct fcoe_ctlr *fip) + static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip) + { + struct fcoe_fcf *fcf; ++ unsigned long flags; + int error; + + mutex_lock(&fip->ctlr_mutex); +- spin_lock_bh(&fip->ctlr_lock); ++ spin_lock_irqsave(&fip->ctlr_lock, flags); + LIBFCOE_FIP_DBG(fip, "re-sending FLOGI - reselect\n"); + fcf = fcoe_ctlr_select(fip); + if (!fcf || fcf->flogi_sent) { +@@ -1725,7 +1728,7 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip) + fcoe_ctlr_solicit(fip, NULL); + error = fcoe_ctlr_flogi_send_locked(fip); + } +- spin_unlock_bh(&fip->ctlr_lock); ++ spin_unlock_irqrestore(&fip->ctlr_lock, flags); + mutex_unlock(&fip->ctlr_mutex); + return error; + } +@@ -1742,8 +1745,9 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip) + static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip) + { + struct fcoe_fcf *fcf; ++ unsigned long flags; + +- spin_lock_bh(&fip->ctlr_lock); ++ spin_lock_irqsave(&fip->ctlr_lock, flags); + fcf = fip->sel_fcf; + if (!fcf || !fip->flogi_req_send) + goto unlock; +@@ -1770,7 +1774,7 @@ static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip) + } else /* XXX */ + LIBFCOE_FIP_DBG(fip, "No FCF selected - defer send\n"); + unlock: +- spin_unlock_bh(&fip->ctlr_lock); ++ spin_unlock_irqrestore(&fip->ctlr_lock, flags); + } + + /** +-- +2.40.1 + diff --git a/queue-5.4/scsi-iscsi-add-strlen-check-in-iscsi_if_set-_host-_p.patch b/queue-5.4/scsi-iscsi-add-strlen-check-in-iscsi_if_set-_host-_p.patch new file mode 100644 index 00000000000..b9dd073d474 --- /dev/null +++ b/queue-5.4/scsi-iscsi-add-strlen-check-in-iscsi_if_set-_host-_p.patch @@ -0,0 +1,79 @@ +From 6b89876e69a8c08d0ce2e31bef5a1e7808c34c62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 15:58:20 +0800 +Subject: scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() + +From: Lin Ma + +[ Upstream commit ce51c817008450ef4188471db31639d42d37a5e1 ] + +The functions iscsi_if_set_param() and iscsi_if_set_host_param() convert an +nlattr payload to type char* and then call C string handling functions like +sscanf and kstrdup: + + char *data = (char*)ev + sizeof(*ev); + ... + sscanf(data, "%d", &value); + +However, since the nlattr is provided by the user-space program and the +nlmsg skb is allocated with GFP_KERNEL instead of GFP_ZERO flag (see +netlink_alloc_large_skb() in netlink_sendmsg()), dirty data on the heap can +lead to an OOB access for those string handling functions. + +By investigating how the bug is introduced, we find it is really +interesting as the old version parsing code starting from commit +fd7255f51a13 ("[SCSI] iscsi: add sysfs attrs for uspace sync up") treated +the nlattr as integer bytes instead of string and had length check in +iscsi_copy_param(): + + if (ev->u.set_param.len != sizeof(uint32_t)) + BUG(); + +But, since the commit a54a52caad4b ("[SCSI] iscsi: fixup set/get param +functions"), the code treated the nlattr as C string while forgetting to +add any strlen checks(), opening the possibility of an OOB access. + +Fix the potential OOB by adding the strlen() check before accessing the +buf. If the data passes this check, all low-level set_param handlers can +safely treat this buf as legal C string. + +Fixes: fd7255f51a13 ("[SCSI] iscsi: add sysfs attrs for uspace sync up") +Fixes: 1d9bf13a9cf9 ("[SCSI] iscsi class: add iscsi host set param event") +Signed-off-by: Lin Ma +Link: https://lore.kernel.org/r/20230723075820.3713119-1-linma@zju.edu.cn +Reviewed-by: Chris Leech +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_iscsi.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index f6cce0befa7de..51f53638629cb 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2767,6 +2767,10 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev) + if (!conn || !session) + return -EINVAL; + ++ /* data will be regarded as NULL-ended string, do length check */ ++ if (strlen(data) > ev->u.set_param.len) ++ return -EINVAL; ++ + switch (ev->u.set_param.param) { + case ISCSI_PARAM_SESS_RECOVERY_TMO: + sscanf(data, "%d", &value); +@@ -2919,6 +2923,10 @@ iscsi_set_host_param(struct iscsi_transport *transport, + return -ENODEV; + } + ++ /* see similar check in iscsi_if_set_param() */ ++ if (strlen(data) > ev->u.set_host_param.len) ++ return -EINVAL; ++ + err = transport->set_host_param(shost, ev->u.set_host_param.param, + data, ev->u.set_host_param.len); + scsi_host_put(shost); +-- +2.40.1 + diff --git a/queue-5.4/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_de.patch b/queue-5.4/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_de.patch new file mode 100644 index 00000000000..092acf385a0 --- /dev/null +++ b/queue-5.4/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_de.patch @@ -0,0 +1,67 @@ +From 354f52d4de359d0c68f906a05ec0a129e89aa79f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jul 2023 10:40:33 +0200 +Subject: scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() + directly + +From: Oleksandr Natalenko + +[ Upstream commit 31b5991a9a91ba97237ac9da509d78eec453ff72 ] + +The qedf_dbg_debug_cmd_read() function invokes sprintf() directly on a +__user pointer, which may crash the kernel. + +Avoid doing that by using a small on-stack buffer for scnprintf() and then +calling simple_read_from_buffer() which does a proper copy_to_user() call. + +Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") +Link: https://lore.kernel.org/lkml/20230724120241.40495-1-oleksandr@redhat.com/ +Link: https://lore.kernel.org/linux-scsi/20230726101236.11922-1-skashyap@marvell.com/ +Cc: Saurav Kashyap +Cc: Rob Evers +Cc: Johannes Thumshirn +Cc: David Laight +Cc: Jozef Bacik +Cc: Laurence Oberman +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: GR-QLogic-Storage-Upstream@marvell.com +Cc: linux-scsi@vger.kernel.org +Reviewed-by: Laurence Oberman +Reviewed-by: Johannes Thumshirn +Tested-by: Laurence Oberman +Acked-by: Saurav Kashyap +Signed-off-by: Oleksandr Natalenko +Link: https://lore.kernel.org/r/20230731084034.37021-3-oleksandr@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_debugfs.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c +index 88378a277a015..5e638732d6852 100644 +--- a/drivers/scsi/qedf/qedf_debugfs.c ++++ b/drivers/scsi/qedf/qedf_debugfs.c +@@ -140,15 +140,14 @@ qedf_dbg_debug_cmd_read(struct file *filp, char __user *buffer, size_t count, + loff_t *ppos) + { + int cnt; ++ char cbuf[32]; + struct qedf_dbg_ctx *qedf_dbg = + (struct qedf_dbg_ctx *)filp->private_data; + + QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "debug mask=0x%x\n", qedf_debug); +- cnt = sprintf(buffer, "debug mask = 0x%x\n", qedf_debug); ++ cnt = scnprintf(cbuf, sizeof(cbuf), "debug mask = 0x%x\n", qedf_debug); + +- cnt = min_t(int, count, cnt - *ppos); +- *ppos += cnt; +- return cnt; ++ return simple_read_from_buffer(buffer, count, ppos, cbuf, cnt); + } + + static ssize_t +-- +2.40.1 + diff --git a/queue-5.4/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_fp.patch b/queue-5.4/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_fp.patch new file mode 100644 index 00000000000..3682462dbe1 --- /dev/null +++ b/queue-5.4/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_fp.patch @@ -0,0 +1,112 @@ +From afc7ebb3b03ba75a053b48bbcc8450ad14375fbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jul 2023 10:40:34 +0200 +Subject: scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() + directly + +From: Oleksandr Natalenko + +[ Upstream commit 25dbc20deab5165f847b4eb42f376f725a986ee8 ] + +The qedf_dbg_fp_int_cmd_read() function invokes sprintf() directly on a +__user pointer, which may crash the kernel. + +Avoid doing that by vmalloc()'ating a buffer for scnprintf() and then +calling simple_read_from_buffer() which does a proper copy_to_user() call. + +Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") +Link: https://lore.kernel.org/lkml/20230724120241.40495-1-oleksandr@redhat.com/ +Link: https://lore.kernel.org/linux-scsi/20230726101236.11922-1-skashyap@marvell.com/ +Cc: Saurav Kashyap +Cc: Rob Evers +Cc: Johannes Thumshirn +Cc: David Laight +Cc: Jozef Bacik +Cc: Laurence Oberman +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: GR-QLogic-Storage-Upstream@marvell.com +Cc: linux-scsi@vger.kernel.org +Reviewed-by: Laurence Oberman +Reviewed-by: Johannes Thumshirn +Tested-by: Laurence Oberman +Acked-by: Saurav Kashyap +Signed-off-by: Oleksandr Natalenko +Link: https://lore.kernel.org/r/20230731084034.37021-4-oleksandr@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_dbg.h | 2 ++ + drivers/scsi/qedf/qedf_debugfs.c | 21 +++++++++++++++------ + 2 files changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/qedf/qedf_dbg.h b/drivers/scsi/qedf/qedf_dbg.h +index d979f095aeda0..73e5756cade62 100644 +--- a/drivers/scsi/qedf/qedf_dbg.h ++++ b/drivers/scsi/qedf/qedf_dbg.h +@@ -60,6 +60,8 @@ extern uint qedf_debug; + #define QEDF_LOG_NOTICE 0x40000000 /* Notice logs */ + #define QEDF_LOG_WARN 0x80000000 /* Warning logs */ + ++#define QEDF_DEBUGFS_LOG_LEN (2 * PAGE_SIZE) ++ + /* Debug context structure */ + struct qedf_dbg_ctx { + unsigned int host_no; +diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c +index 5e638732d6852..b0a28a6a9c64a 100644 +--- a/drivers/scsi/qedf/qedf_debugfs.c ++++ b/drivers/scsi/qedf/qedf_debugfs.c +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + + #include "qedf.h" + #include "qedf_dbg.h" +@@ -100,7 +101,9 @@ static ssize_t + qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count, + loff_t *ppos) + { ++ ssize_t ret; + size_t cnt = 0; ++ char *cbuf; + int id; + struct qedf_fastpath *fp = NULL; + struct qedf_dbg_ctx *qedf_dbg = +@@ -110,19 +113,25 @@ qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count, + + QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n"); + +- cnt = sprintf(buffer, "\nFastpath I/O completions\n\n"); ++ cbuf = vmalloc(QEDF_DEBUGFS_LOG_LEN); ++ if (!cbuf) ++ return 0; ++ ++ cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt, "\nFastpath I/O completions\n\n"); + + for (id = 0; id < qedf->num_queues; id++) { + fp = &(qedf->fp_array[id]); + if (fp->sb_id == QEDF_SB_ID_NULL) + continue; +- cnt += sprintf((buffer + cnt), "#%d: %lu\n", id, +- fp->completions); ++ cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt, ++ "#%d: %lu\n", id, fp->completions); + } + +- cnt = min_t(int, count, cnt - *ppos); +- *ppos += cnt; +- return cnt; ++ ret = simple_read_from_buffer(buffer, count, ppos, cbuf, cnt); ++ ++ vfree(cbuf); ++ ++ return ret; + } + + static ssize_t +-- +2.40.1 + diff --git a/queue-5.4/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_st.patch b/queue-5.4/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_st.patch new file mode 100644 index 00000000000..1f764be51ac --- /dev/null +++ b/queue-5.4/scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_st.patch @@ -0,0 +1,70 @@ +From efc086843d8a9e2ff2f82a3b88c82511bb8dcfd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jul 2023 10:40:32 +0200 +Subject: scsi: qedf: Do not touch __user pointer in + qedf_dbg_stop_io_on_error_cmd_read() directly + +From: Oleksandr Natalenko + +[ Upstream commit 7d3d20dee4f648ec44e9717d5f647d594d184433 ] + +The qedf_dbg_stop_io_on_error_cmd_read() function invokes sprintf() +directly on a __user pointer, which may crash the kernel. + +Avoid doing that by using a small on-stack buffer for scnprintf() and then +calling simple_read_from_buffer() which does a proper copy_to_user() call. + +Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") +Link: https://lore.kernel.org/lkml/20230724120241.40495-1-oleksandr@redhat.com/ +Link: https://lore.kernel.org/linux-scsi/20230726101236.11922-1-skashyap@marvell.com/ +Cc: Saurav Kashyap +Cc: Rob Evers +Cc: Johannes Thumshirn +Cc: David Laight +Cc: Jozef Bacik +Cc: Laurence Oberman +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: GR-QLogic-Storage-Upstream@marvell.com +Cc: linux-scsi@vger.kernel.org +Reviewed-by: Laurence Oberman +Reviewed-by: Johannes Thumshirn +Tested-by: Laurence Oberman +Acked-by: Saurav Kashyap +Signed-off-by: Oleksandr Natalenko +Link: https://lore.kernel.org/r/20230731084034.37021-2-oleksandr@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_debugfs.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c +index b88bed9bb1338..88378a277a015 100644 +--- a/drivers/scsi/qedf/qedf_debugfs.c ++++ b/drivers/scsi/qedf/qedf_debugfs.c +@@ -187,18 +187,17 @@ qedf_dbg_stop_io_on_error_cmd_read(struct file *filp, char __user *buffer, + size_t count, loff_t *ppos) + { + int cnt; ++ char cbuf[7]; + struct qedf_dbg_ctx *qedf_dbg = + (struct qedf_dbg_ctx *)filp->private_data; + struct qedf_ctx *qedf = container_of(qedf_dbg, + struct qedf_ctx, dbg_ctx); + + QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n"); +- cnt = sprintf(buffer, "%s\n", ++ cnt = scnprintf(cbuf, sizeof(cbuf), "%s\n", + qedf->stop_io_on_error ? "true" : "false"); + +- cnt = min_t(int, count, cnt - *ppos); +- *ppos += cnt; +- return cnt; ++ return simple_read_from_buffer(buffer, count, ppos, cbuf, cnt); + } + + static ssize_t +-- +2.40.1 + diff --git a/queue-5.4/scsi-qla4xxx-add-length-check-when-parsing-nlattrs.patch b/queue-5.4/scsi-qla4xxx-add-length-check-when-parsing-nlattrs.patch new file mode 100644 index 00000000000..31d4d1448c1 --- /dev/null +++ b/queue-5.4/scsi-qla4xxx-add-length-check-when-parsing-nlattrs.patch @@ -0,0 +1,80 @@ +From 5b21c79081e81209f62a8dbac9a6c46e1ed6746c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 16:00:53 +0800 +Subject: scsi: qla4xxx: Add length check when parsing nlattrs + +From: Lin Ma + +[ Upstream commit 47cd3770e31df942e2bb925a9a855c79ed0662eb ] + +There are three places that qla4xxx parses nlattrs: + + - qla4xxx_set_chap_entry() + + - qla4xxx_iface_set_param() + + - qla4xxx_sysfs_ddb_set_param() + +and each of them directly converts the nlattr to specific pointer of +structure without length checking. This could be dangerous as those +attributes are not validated and a malformed nlattr (e.g., length 0) could +result in an OOB read that leaks heap dirty data. + +Add the nla_len check before accessing the nlattr data and return EINVAL if +the length check fails. + +Fixes: 26ffd7b45fe9 ("[SCSI] qla4xxx: Add support to set CHAP entries") +Fixes: 1e9e2be3ee03 ("[SCSI] qla4xxx: Add flash node mgmt support") +Fixes: 00c31889f751 ("[SCSI] qla4xxx: fix data alignment and use nl helpers") +Signed-off-by: Lin Ma +Link: https://lore.kernel.org/r/20230723080053.3714534-1-linma@zju.edu.cn +Reviewed-by: Chris Leech +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla4xxx/ql4_os.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index df43cf6405a8e..ea15bbe0397fc 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -939,6 +939,11 @@ static int qla4xxx_set_chap_entry(struct Scsi_Host *shost, void *data, int len) + memset(&chap_rec, 0, sizeof(chap_rec)); + + nla_for_each_attr(attr, data, len, rem) { ++ if (nla_len(attr) < sizeof(*param_info)) { ++ rc = -EINVAL; ++ goto exit_set_chap; ++ } ++ + param_info = nla_data(attr); + + switch (param_info->param) { +@@ -2723,6 +2728,11 @@ qla4xxx_iface_set_param(struct Scsi_Host *shost, void *data, uint32_t len) + } + + nla_for_each_attr(attr, data, len, rem) { ++ if (nla_len(attr) < sizeof(*iface_param)) { ++ rval = -EINVAL; ++ goto exit_init_fw_cb; ++ } ++ + iface_param = nla_data(attr); + + if (iface_param->param_type == ISCSI_NET_PARAM) { +@@ -8093,6 +8103,11 @@ qla4xxx_sysfs_ddb_set_param(struct iscsi_bus_flash_session *fnode_sess, + + memset((void *)&chap_tbl, 0, sizeof(chap_tbl)); + nla_for_each_attr(attr, data, len, rem) { ++ if (nla_len(attr) < sizeof(*fnode_param)) { ++ rc = -EINVAL; ++ goto exit_set_param; ++ } ++ + fnode_param = nla_data(attr); + + switch (fnode_param->param) { +-- +2.40.1 + diff --git a/queue-5.4/serial-sprd-assign-sprd_port-after-initialized-to-av.patch b/queue-5.4/serial-sprd-assign-sprd_port-after-initialized-to-av.patch new file mode 100644 index 00000000000..4e17126782e --- /dev/null +++ b/queue-5.4/serial-sprd-assign-sprd_port-after-initialized-to-av.patch @@ -0,0 +1,118 @@ +From b2043e4062612e9d7075e71a45ac74ed0d3afe47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 14:40:52 +0800 +Subject: serial: sprd: Assign sprd_port after initialized to avoid wrong + access + +From: Chunyan Zhang + +[ Upstream commit f9608f1887568b728839d006024585ab02ef29e5 ] + +The global pointer 'sprd_port' may not zero when sprd_probe returns +failure, that is a risk for sprd_port to be accessed afterward, and +may lead to unexpected errors. + +For example: + +There are two UART ports, UART1 is used for console and configured in +kernel command line, i.e. "console="; + +The UART1 probe failed and the memory allocated to sprd_port[1] was +released, but sprd_port[1] was not set to NULL; + +In UART2 probe, the same virtual address was allocated to sprd_port[2], +and UART2 probe process finally will go into sprd_console_setup() to +register UART1 as console since it is configured as preferred console +(filled to console_cmdline[]), but the console parameters (sprd_port[1]) +belong to UART2. + +So move the sprd_port[] assignment to where the port already initialized +can avoid the above issue. + +Fixes: b7396a38fb28 ("tty/serial: Add Spreadtrum sc9836-uart driver support") +Signed-off-by: Chunyan Zhang +Link: https://lore.kernel.org/r/20230725064053.235448-1-chunyan.zhang@unisoc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sprd_serial.c | 25 +++++++++++++++++-------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index 9cf771a9cff62..18f5a7f438329 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -1103,7 +1103,7 @@ static bool sprd_uart_is_console(struct uart_port *uport) + static int sprd_clk_init(struct uart_port *uport) + { + struct clk *clk_uart, *clk_parent; +- struct sprd_uart_port *u = sprd_port[uport->line]; ++ struct sprd_uart_port *u = container_of(uport, struct sprd_uart_port, port); + + clk_uart = devm_clk_get(uport->dev, "uart"); + if (IS_ERR(clk_uart)) { +@@ -1146,22 +1146,22 @@ static int sprd_probe(struct platform_device *pdev) + { + struct resource *res; + struct uart_port *up; ++ struct sprd_uart_port *sport; + int irq; + int index; + int ret; + + index = of_alias_get_id(pdev->dev.of_node, "serial"); +- if (index < 0 || index >= ARRAY_SIZE(sprd_port)) { ++ if (index < 0 || index >= UART_NR_MAX) { + dev_err(&pdev->dev, "got a wrong serial alias id %d\n", index); + return -EINVAL; + } + +- sprd_port[index] = devm_kzalloc(&pdev->dev, sizeof(*sprd_port[index]), +- GFP_KERNEL); +- if (!sprd_port[index]) ++ sport = devm_kzalloc(&pdev->dev, sizeof(*sport), GFP_KERNEL); ++ if (!sport) + return -ENOMEM; + +- up = &sprd_port[index]->port; ++ up = &sport->port; + up->dev = &pdev->dev; + up->line = index; + up->type = PORT_SPRD; +@@ -1191,7 +1191,7 @@ static int sprd_probe(struct platform_device *pdev) + * Allocate one dma buffer to prepare for receive transfer, in case + * memory allocation failure at runtime. + */ +- ret = sprd_rx_alloc_buf(sprd_port[index]); ++ ret = sprd_rx_alloc_buf(sport); + if (ret) + return ret; + +@@ -1202,14 +1202,23 @@ static int sprd_probe(struct platform_device *pdev) + return ret; + } + } ++ + sprd_ports_num++; ++ sprd_port[index] = sport; + + ret = uart_add_one_port(&sprd_uart_driver, up); + if (ret) +- sprd_remove(pdev); ++ goto clean_port; + + platform_set_drvdata(pdev, up); + ++ return 0; ++ ++clean_port: ++ sprd_port[index] = NULL; ++ if (--sprd_ports_num == 0) ++ uart_unregister_driver(&sprd_uart_driver); ++ sprd_rx_free_buf(sport); + return ret; + } + +-- +2.40.1 + diff --git a/queue-5.4/serial-sprd-fix-dma-buffer-leak-issue.patch b/queue-5.4/serial-sprd-fix-dma-buffer-leak-issue.patch new file mode 100644 index 00000000000..47933d1a785 --- /dev/null +++ b/queue-5.4/serial-sprd-fix-dma-buffer-leak-issue.patch @@ -0,0 +1,54 @@ +From 8d5dc210114c7c9568eca714ba146696d8d449e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 14:40:53 +0800 +Subject: serial: sprd: Fix DMA buffer leak issue + +From: Chunyan Zhang + +[ Upstream commit cd119fdc3ee1450fbf7f78862b5de44c42b6e47f ] + +Release DMA buffer when _probe() returns failure to avoid memory leak. + +Fixes: f4487db58eb7 ("serial: sprd: Add DMA mode support") +Signed-off-by: Chunyan Zhang +Reviewed-by: Baolin Wang +Link: https://lore.kernel.org/r/20230725064053.235448-2-chunyan.zhang@unisoc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sprd_serial.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index 18f5a7f438329..8b45b3ab63416 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -371,7 +371,7 @@ static void sprd_rx_free_buf(struct sprd_uart_port *sp) + if (sp->rx_dma.virt) + dma_free_coherent(sp->port.dev, SPRD_UART_RX_SIZE, + sp->rx_dma.virt, sp->rx_dma.phys_addr); +- ++ sp->rx_dma.virt = NULL; + } + + static int sprd_rx_dma_config(struct uart_port *port, u32 burst) +@@ -1199,7 +1199,7 @@ static int sprd_probe(struct platform_device *pdev) + ret = uart_register_driver(&sprd_uart_driver); + if (ret < 0) { + pr_err("Failed to register SPRD-UART driver\n"); +- return ret; ++ goto free_rx_buf; + } + } + +@@ -1218,6 +1218,7 @@ static int sprd_probe(struct platform_device *pdev) + sprd_port[index] = NULL; + if (--sprd_ports_num == 0) + uart_unregister_driver(&sprd_uart_driver); ++free_rx_buf: + sprd_rx_free_buf(sport); + return ret; + } +-- +2.40.1 + diff --git a/queue-5.4/serial-sprd-getting-port-index-via-serial-aliases-on.patch b/queue-5.4/serial-sprd-getting-port-index-via-serial-aliases-on.patch new file mode 100644 index 00000000000..1d691db912b --- /dev/null +++ b/queue-5.4/serial-sprd-getting-port-index-via-serial-aliases-on.patch @@ -0,0 +1,84 @@ +From 9f24d2754195a7e0f8374a57ca3e5b08702c902a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Mar 2020 18:50:48 +0800 +Subject: serial: sprd: getting port index via serial aliases only + +From: Chunyan Zhang + +[ Upstream commit 4b7349cb4e26e79429ecd619eb588bf384f69fdb ] + +This patch simplifies the process of getting serial port number, with +this patch, serial devices must have aliases configured in devicetree. + +The serial port searched out via sprd_port array maybe wrong if we don't +have serial alias defined in devicetree, and specify console with command +line, we would get the wrong port number if other serial ports probe +failed before console's. So using aliases is mandatory. + +Reviewed-by: Baolin Wang +Signed-off-by: Chunyan Zhang +Link: https://lore.kernel.org/r/20200318105049.19623-2-zhang.lyra@gmail.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: f9608f188756 ("serial: sprd: Assign sprd_port after initialized to avoid wrong access") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sprd_serial.c | 36 +++++--------------------------- + 1 file changed, 5 insertions(+), 31 deletions(-) + +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index 07573de70445c..e6acf2c848f39 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -1073,29 +1073,6 @@ static struct uart_driver sprd_uart_driver = { + .cons = SPRD_CONSOLE, + }; + +-static int sprd_probe_dt_alias(int index, struct device *dev) +-{ +- struct device_node *np; +- int ret = index; +- +- if (!IS_ENABLED(CONFIG_OF)) +- return ret; +- +- np = dev->of_node; +- if (!np) +- return ret; +- +- ret = of_alias_get_id(np, "serial"); +- if (ret < 0) +- ret = index; +- else if (ret >= ARRAY_SIZE(sprd_port) || sprd_port[ret] != NULL) { +- dev_warn(dev, "requested serial port %d not available.\n", ret); +- ret = index; +- } +- +- return ret; +-} +- + static int sprd_remove(struct platform_device *dev) + { + struct sprd_uart_port *sup = platform_get_drvdata(dev); +@@ -1173,14 +1150,11 @@ static int sprd_probe(struct platform_device *pdev) + int index; + int ret; + +- for (index = 0; index < ARRAY_SIZE(sprd_port); index++) +- if (sprd_port[index] == NULL) +- break; +- +- if (index == ARRAY_SIZE(sprd_port)) +- return -EBUSY; +- +- index = sprd_probe_dt_alias(index, &pdev->dev); ++ index = of_alias_get_id(pdev->dev.of_node, "serial"); ++ if (index < 0 || index >= ARRAY_SIZE(sprd_port)) { ++ dev_err(&pdev->dev, "got a wrong serial alias id %d\n", index); ++ return -EINVAL; ++ } + + sprd_port[index] = devm_kzalloc(&pdev->dev, sizeof(*sprd_port[index]), + GFP_KERNEL); +-- +2.40.1 + diff --git a/queue-5.4/serial-sprd-remove-redundant-sprd_port-cleanup.patch b/queue-5.4/serial-sprd-remove-redundant-sprd_port-cleanup.patch new file mode 100644 index 00000000000..8a395eea9af --- /dev/null +++ b/queue-5.4/serial-sprd-remove-redundant-sprd_port-cleanup.patch @@ -0,0 +1,41 @@ +From 6d3a47886fafab898818c4a1c74e6a0e936d1c82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Mar 2020 18:50:49 +0800 +Subject: serial: sprd: remove redundant sprd_port cleanup + +From: Chunyan Zhang + +[ Upstream commit 72534077475fc489f8358c0e214cc1a4d658c8c2 ] + +We don't need to cleanup sprd_port anymore, since we've dropped the way +of using the sprd_port[] array to get port index. + +Reviewed-by: Baolin Wang +Signed-off-by: Chunyan Zhang +Link: https://lore.kernel.org/r/20200318105049.19623-3-zhang.lyra@gmail.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: f9608f188756 ("serial: sprd: Assign sprd_port after initialized to avoid wrong access") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sprd_serial.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index e6acf2c848f39..9cf771a9cff62 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -1205,10 +1205,8 @@ static int sprd_probe(struct platform_device *pdev) + sprd_ports_num++; + + ret = uart_add_one_port(&sprd_uart_driver, up); +- if (ret) { +- sprd_port[index] = NULL; ++ if (ret) + sprd_remove(pdev); +- } + + platform_set_drvdata(pdev, up); + +-- +2.40.1 + diff --git a/queue-5.4/serial-tegra-handle-clk-prepare-error-in-tegra_uart_.patch b/queue-5.4/serial-tegra-handle-clk-prepare-error-in-tegra_uart_.patch new file mode 100644 index 00000000000..19d4b54de7a --- /dev/null +++ b/queue-5.4/serial-tegra-handle-clk-prepare-error-in-tegra_uart_.patch @@ -0,0 +1,41 @@ +From 29ff2b1baada90b6859cadb17072303b505b63b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 18:54:06 +0800 +Subject: serial: tegra: handle clk prepare error in tegra_uart_hw_init() + +From: Yi Yang + +[ Upstream commit 5abd01145d0cc6cd1b7c2fe6ee0b9ea0fa13671e ] + +In tegra_uart_hw_init(), the return value of clk_prepare_enable() should +be checked since it might fail. + +Fixes: e9ea096dd225 ("serial: tegra: add serial driver") +Signed-off-by: Yi Yang +Link: https://lore.kernel.org/r/20230817105406.228674-1-yiyang13@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial-tegra.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index 7930f2a81b4c1..2b5d26df5fcfc 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -1000,7 +1000,11 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + tup->ier_shadow = 0; + tup->current_baud = 0; + +- clk_prepare_enable(tup->uart_clk); ++ ret = clk_prepare_enable(tup->uart_clk); ++ if (ret) { ++ dev_err(tup->uport.dev, "could not enable clk\n"); ++ return ret; ++ } + + /* Reset the UART controller to clear all previous status.*/ + reset_control_assert(tup->rst); +-- +2.40.1 + diff --git a/queue-5.4/series b/queue-5.4/series index 9d35245ab70..2e0584c0271 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -45,3 +45,161 @@ powerpc-32s-fix-assembler-warning-about-r0.patch udf-check-consistency-of-space-bitmap-descriptor.patch udf-handle-error-when-adding-extent-to-a-file.patch revert-net-macsec-preserve-ingress-frame-ordering.patch +reiserfs-check-the-return-value-from-__getblk.patch +eventfd-export-eventfd_ctx_do_read.patch +eventfd-prevent-underflow-for-eventfd-semaphores.patch +new-helper-lookup_positive_unlocked.patch +fs-fix-error-checking-for-d_hash_and_lookup.patch +tmpfs-verify-g-u-id-mount-options-correctly.patch +opp-fix-passing-0-to-ptr_err-in-_opp_attach_genpd.patch +x86-asm-make-more-symbols-local.patch +x86-boot-annotate-local-functions.patch +x86-decompressor-don-t-rely-on-upper-32-bits-of-gprs.patch +perf-imx_ddr-don-t-enable-counter0-if-none-of-4-coun.patch +cpufreq-powernow-k8-use-related_cpus-instead-of-cpus.patch +bpf-clear-the-probe_addr-for-uprobe.patch +tcp-tcp_enter_quickack_mode-should-be-static.patch +regmap-rbtree-use-alloc_flags-for-memory-allocations.patch +spi-tegra20-sflash-fix-to-check-return-value-of-plat.patch +can-gs_usb-gs_usb_receive_bulk_callback-count-rx-ove.patch +wifi-mwifiex-fix-oob-and-integer-underflow-when-rx-p.patch +mwifiex-switch-from-pci_-to-dma_-api.patch +wifi-mwifiex-fix-error-recovery-in-pcie-buffer-descr.patch +crypto-stm32-properly-handle-pm_runtime_get-failing.patch +bluetooth-nokia-fix-value-check-in-nokia_bluetooth_s.patch +crypto-caam-fix-unchecked-return-value-error.patch +hwrng-iproc-rng200-use-semicolons-rather-than-commas.patch +hwrng-iproc-rng200-implement-suspend-and-resume-call.patch +lwt-fix-return-values-of-bpf-xmit-ops.patch +lwt-check-lwtunnel_xmit_continue-strictly.patch +fs-ocfs2-namei-check-return-value-of-ocfs2_add_entry.patch +wifi-mwifiex-fix-memory-leak-in-mwifiex_histogram_re.patch +wifi-mwifiex-fix-missed-return-in-oob-checks-failed-.patch +wifi-ath9k-fix-races-between-ath9k_wmi_cmd-and-ath9k.patch +wifi-ath9k-protect-wmi-command-response-buffer-repla.patch +wifi-mwifiex-avoid-possible-null-skb-pointer-derefer.patch +wifi-ath9k-use-is_err-with-debugfs_create_dir.patch +net-arcnet-do-not-call-kfree_skb-under-local_irq_dis.patch +mlxsw-i2c-fix-chunk-size-setting-in-output-mailbox-b.patch +mlxsw-i2c-limit-single-transaction-buffer-size.patch +net-sched-sch_hfsc-ensure-inner-classes-have-fsc-cur.patch +netrom-deny-concurrent-connect.patch +drm-bridge-tc358764-fix-debug-print-parameter-order.patch +quota-avoid-increasing-dqst_lookups-when-iterating-o.patch +quota-factor-out-dquot_write_dquot.patch +quota-rename-dquot_active-to-inode_quota_active.patch +quota-add-new-helper-dquot_active.patch +quota-fix-dqput-to-follow-the-guarantees-dquot_srcu-.patch +drm-amdgpu-avoid-integer-overflow-warning-in-amdgpu_.patch +arm-dts-bcm53573-drop-nonexistent-default-off-led-tr.patch +arm-dts-bcm53573-add-cells-sizes-to-pcie-node.patch +arm-dts-bcm53573-use-updated-spi-gpio-binding-proper.patch +drm-etnaviv-fix-dumping-of-active-mmu-context.patch +arm-dts-s3c6410-move-fixed-clocks-under-root-node-in.patch +arm-dts-s3c6410-align-node-srom-bus-node-name-with-d.patch +arm-dts-s3c64xx-align-pinctrl-with-dtschema.patch +arm-dts-samsung-s3c6410-mini6410-correct-ethernet-re.patch +arm-dts-s5pv210-add-rtc-32-khz-clock-in-smdkv210.patch +arm-dts-s5pv210-use-defines-for-irq-flags-in-smdkv21.patch +arm-dts-s5pv210-correct-ethernet-unit-address-in-smd.patch +arm-dts-s5pv210-add-dummy-5v-regulator-for-backlight.patch +arm-dts-samsung-s5pv210-smdkv210-correct-ethernet-re.patch +drm-adv7511-fix-low-refresh-rate-register-for-adv753.patch +arm-dts-bcm53573-fix-ethernet-info-for-luxul-devices.patch +arm64-dts-qcom-sdm845-add-missing-rpmh-power-domain-.patch +drm-amdgpu-update-min-to-min_t-in-amdgpu_info_ioctl.patch +md-bitmap-don-t-set-max_write_behind-if-there-is-no-.patch +md-md-bitmap-hold-reconfig_mutex-in-backlog_store.patch +drm-tegra-remove-superfluous-error-messages-around-p.patch +drm-tegra-dpaux-fix-incorrect-return-value-of-platfo.patch +of-unittest-fix-null-pointer-dereferencing-in-of_uni.patch +drm-armada-fix-off-by-one-error-in-armada_overlay_ge.patch +drm-panel-simple-add-missing-connector-type-and-pixe.patch +ima-remove-deprecated-ima_trusted_keyring-kconfig.patch +drm-msm-mdp5-don-t-leak-some-plane-state.patch +smackfs-prevent-underflow-in-smk_set_cipso.patch +audit-fix-possible-soft-lockup-in-__audit_inode_chil.patch +drm-mediatek-fix-potential-memory-leak-if-vmap-fail.patch +md-raid1-free-the-r1bio-before-waiting-for-blocked-r.patch +md-raid1-hold-the-barrier-until-handle_read_error-fi.patch +of-unittest-fix-overlay-type-in-apply-revert-check.patch +alsa-ac97-fix-possible-error-value-of-rac97.patch +ipmi-ssif-add-check-for-kstrdup.patch +ipmi-ssif-fix-a-memory-leak-when-scanning-for-an-ada.patch +drivers-clk-keystone-fix-parameter-judgment-in-_of_p.patch +clk-sunxi-ng-modify-mismatched-function-name.patch +pci-mark-nvidia-t4-gpus-to-avoid-bus-reset.patch +pci-pciehp-use-rmw-accessors-for-changing-lnkctl.patch +pci-aspm-use-rmw-accessors-for-changing-lnkctl.patch +clk-imx-composite-8m-fix-clock-pauses-when-set_rate-.patch +powerpc-fadump-reset-dump-area-size-if-fadump-memory.patch +pci-add-defines-for-enter-compliance-transmit-margin.patch +drm-amdgpu-correct-transmit-margin-masks.patch +drm-amdgpu-replace-numbers-with-pci_exp_lnkctl2-defi.patch +drm-amdgpu-prefer-pcie_capability_read_word.patch +drm-amdgpu-use-rmw-accessors-for-changing-lnkctl.patch +drm-radeon-correct-transmit-margin-masks.patch +drm-radeon-replace-numbers-with-pci_exp_lnkctl2-defi.patch +drm-radeon-prefer-pcie_capability_read_word.patch +drm-radeon-use-rmw-accessors-for-changing-lnkctl.patch +wifi-ath10k-use-rmw-accessors-for-changing-lnkctl.patch +nfs-blocklayout-use-the-passed-in-gfp-flags.patch +powerpc-iommu-fix-notifiers-being-shared-by-pci-and-.patch +jfs-validate-max-amount-of-blocks-before-allocation.patch +fs-lockd-avoid-possible-wrong-null-parameter.patch +nfsd-da_addr_body-field-missing-in-some-getdeviceinf.patch +nfs-guard-against-readdir-loop-when-entry-names-exce.patch +media-v4l2-fwnode-fix-v4l2_fwnode_parse_link-handlin.patch +media-v4l2-fwnode-simplify-v4l2_fwnode_parse_link.patch +media-v4l2-core-fix-a-potential-resource-leak-in-v4l.patch +drivers-usb-smsusb-fix-error-handling-code-in-smsusb.patch +media-dib7000p-fix-potential-division-by-zero.patch +media-dvb-usb-m920x-fix-a-potential-memory-leak-in-m.patch +media-cx24120-add-retval-check-for-cx24120_message_s.patch +media-mediatek-vcodec-return-null-if-no-vdec_fb-is-f.patch +usb-phy-mxs-fix-getting-wrong-state-with-mxs_phy_is_.patch +scsi-iscsi-add-strlen-check-in-iscsi_if_set-_host-_p.patch +scsi-be2iscsi-add-length-check-when-parsing-nlattrs.patch +scsi-qla4xxx-add-length-check-when-parsing-nlattrs.patch +serial-sprd-getting-port-index-via-serial-aliases-on.patch +serial-sprd-remove-redundant-sprd_port-cleanup.patch +serial-sprd-assign-sprd_port-after-initialized-to-av.patch +serial-sprd-fix-dma-buffer-leak-issue.patch +x86-apm-drop-the-duplicate-apm_minor_dev-macro.patch +scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_st.patch +scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_de.patch +scsi-qedf-do-not-touch-__user-pointer-in-qedf_dbg_fp.patch +coresight-tmc-explicit-type-conversions-to-prevent-i.patch +dma-buf-sync_file-fix-docs-syntax.patch +driver-core-test_async-fix-an-error-code.patch +ib-uverbs-fix-an-potential-error-pointer-dereference.patch +iommu-vt-d-fix-to-flush-cache-of-pasid-directory-tab.patch +media-go7007-remove-redundant-if-statement.patch +usb-gadget-f_mass_storage-fix-unused-variable-warnin.patch +media-i2c-ov5640-configure-hvp-lines-in-s_power-call.patch +media-ov5640-enable-mipi-interface-in-ov5640_set_pow.patch +media-i2c-ov2680-set-v4l2_ctrl_flag_modify_layout-on.patch +media-ov2680-remove-auto-gain-and-auto-exposure-cont.patch +media-ov2680-fix-ov2680_bayer_order.patch +media-ov2680-fix-vflip-hflip-set-functions.patch +media-ov2680-fix-regulators-being-left-enabled-on-ov.patch +scsi-core-use-32-bit-hostnum-in-scsi_host_lookup.patch +scsi-fcoe-fix-potential-deadlock-on-fip-ctlr_lock.patch +serial-tegra-handle-clk-prepare-error-in-tegra_uart_.patch +amba-bus-fix-refcount-leak.patch +revert-ib-isert-fix-incorrect-release-of-isert-conne.patch +rdma-siw-balance-the-reference-of-cep-kref-in-the-er.patch +rdma-siw-correct-wrong-debug-message.patch +hid-logitech-dj-fix-error-handling-in-logi_dj_recv_s.patch +hid-multitouch-correct-devm-device-reference-for-hid.patch +x86-speculation-mark-all-skylake-cpus-as-vulnerable-.patch +tracing-fix-race-issue-between-cpu-buffer-write-and-.patch +phy-rockchip-inno-hdmi-use-correct-vco_div_5-macro-o.patch +phy-rockchip-inno-hdmi-round-fractal-pixclock-in-rk3.patch +phy-rockchip-inno-hdmi-do-not-power-on-rk3328-post-p.patch +rpmsg-glink-add-check-for-kstrdup.patch +mtd-rawnand-fsmc-handle-clk-prepare-error-in-fsmc_na.patch +um-fix-hostaudio-build-errors.patch +dmaengine-ste_dma40-add-missing-irq-check-in-d40_pro.patch +cpufreq-fix-the-race-condition-while-updating-the-tr.patch +virtio_ring-fix-avail_wrap_counter-in-virtqueue_add_.patch diff --git a/queue-5.4/smackfs-prevent-underflow-in-smk_set_cipso.patch b/queue-5.4/smackfs-prevent-underflow-in-smk_set_cipso.patch new file mode 100644 index 00000000000..0a586eb609d --- /dev/null +++ b/queue-5.4/smackfs-prevent-underflow-in-smk_set_cipso.patch @@ -0,0 +1,37 @@ +From dfdd7647309464c879c1df1816880323d57c23a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 08:52:39 +0300 +Subject: smackfs: Prevent underflow in smk_set_cipso() + +From: Dan Carpenter + +[ Upstream commit 3ad49d37cf5759c3b8b68d02e3563f633d9c1aee ] + +There is a upper bound to "catlen" but no lower bound to prevent +negatives. I don't see that this necessarily causes a problem but we +may as well be safe. + +Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel") +Signed-off-by: Dan Carpenter +Signed-off-by: Casey Schaufler +Signed-off-by: Sasha Levin +--- + security/smack/smackfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c +index 6b6fec04c412b..a71975ea88a94 100644 +--- a/security/smack/smackfs.c ++++ b/security/smack/smackfs.c +@@ -895,7 +895,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + } + + ret = sscanf(rule, "%d", &catlen); +- if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM) ++ if (ret != 1 || catlen < 0 || catlen > SMACK_CIPSO_MAXCATNUM) + goto out; + + if (format == SMK_FIXED24_FMT && +-- +2.40.1 + diff --git a/queue-5.4/spi-tegra20-sflash-fix-to-check-return-value-of-plat.patch b/queue-5.4/spi-tegra20-sflash-fix-to-check-return-value-of-plat.patch new file mode 100644 index 00000000000..48752a014bb --- /dev/null +++ b/queue-5.4/spi-tegra20-sflash-fix-to-check-return-value-of-plat.patch @@ -0,0 +1,44 @@ +From e022fb42cb818fa43552ee9306f972dc7230ab7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jul 2023 23:49:09 +0800 +Subject: spi: tegra20-sflash: fix to check return value of platform_get_irq() + in tegra_sflash_probe() + +From: Zhang Shurong + +[ Upstream commit 29a449e765ff70a5bd533be94babb6d36985d096 ] + +The platform_get_irq might be failed and return a negative result. So +there should have an error handling code. + +Fixed this by adding an error handling code. + +Fixes: 8528547bcc33 ("spi: tegra: add spi driver for sflash controller") +Signed-off-by: Zhang Shurong +Link: https://lore.kernel.org/r/tencent_71FC162D589E4788C2152AAC84CD8D5C6D06@qq.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra20-sflash.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c +index ecb620169753a..bfef41c717f35 100644 +--- a/drivers/spi/spi-tegra20-sflash.c ++++ b/drivers/spi/spi-tegra20-sflash.c +@@ -456,7 +456,11 @@ static int tegra_sflash_probe(struct platform_device *pdev) + goto exit_free_master; + } + +- tsd->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ goto exit_free_master; ++ tsd->irq = ret; ++ + ret = request_irq(tsd->irq, tegra_sflash_isr, 0, + dev_name(&pdev->dev), tsd); + if (ret < 0) { +-- +2.40.1 + diff --git a/queue-5.4/tcp-tcp_enter_quickack_mode-should-be-static.patch b/queue-5.4/tcp-tcp_enter_quickack_mode-should-be-static.patch new file mode 100644 index 00000000000..1371a76dc0a --- /dev/null +++ b/queue-5.4/tcp-tcp_enter_quickack_mode-should-be-static.patch @@ -0,0 +1,60 @@ +From 554d3ffd5d5049b7eb790af83f2b6ee8bd0c1191 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 16:20:49 +0000 +Subject: tcp: tcp_enter_quickack_mode() should be static + +From: Eric Dumazet + +[ Upstream commit 03b123debcbc8db987bda17ed8412cc011064c22 ] + +After commit d2ccd7bc8acd ("tcp: avoid resetting ACK timer in DCTCP"), +tcp_enter_quickack_mode() is only used from net/ipv4/tcp_input.c. + +Fixes: d2ccd7bc8acd ("tcp: avoid resetting ACK timer in DCTCP") +Signed-off-by: Eric Dumazet +Cc: Yuchung Cheng +Cc: Neal Cardwell +Link: https://lore.kernel.org/r/20230718162049.1444938-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 1 - + net/ipv4/tcp_input.c | 3 +-- + 2 files changed, 1 insertion(+), 3 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 4e909148fce39..3192ade55ad18 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -343,7 +343,6 @@ ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos, + struct pipe_inode_info *pipe, size_t len, + unsigned int flags); + +-void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks); + static inline void tcp_dec_quickack_mode(struct sock *sk, + const unsigned int pkts) + { +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 8308c3c3a6e46..1dfc1a5c21cd3 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -222,7 +222,7 @@ static void tcp_incr_quickack(struct sock *sk, unsigned int max_quickacks) + icsk->icsk_ack.quick = quickacks; + } + +-void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks) ++static void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks) + { + struct inet_connection_sock *icsk = inet_csk(sk); + +@@ -230,7 +230,6 @@ void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks) + inet_csk_exit_pingpong_mode(sk); + icsk->icsk_ack.ato = TCP_ATO_MIN; + } +-EXPORT_SYMBOL(tcp_enter_quickack_mode); + + /* Send ACKs quickly, if "quick" count is not exhausted + * and the session is not interactive. +-- +2.40.1 + diff --git a/queue-5.4/tmpfs-verify-g-u-id-mount-options-correctly.patch b/queue-5.4/tmpfs-verify-g-u-id-mount-options-correctly.patch new file mode 100644 index 00000000000..0ac4cd4e8d4 --- /dev/null +++ b/queue-5.4/tmpfs-verify-g-u-id-mount-options-correctly.patch @@ -0,0 +1,98 @@ +From 1d8ff09052dd9dade4044ba9c5cc57cc3e3b6f00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Aug 2023 18:17:04 +0200 +Subject: tmpfs: verify {g,u}id mount options correctly + +From: Christian Brauner + +[ Upstream commit 0200679fc7953177941e41c2a4241d0b6c2c5de8 ] + +A while ago we received the following report: + +"The other outstanding issue I noticed comes from the fact that +fsconfig syscalls may occur in a different userns than that which +called fsopen. That means that resolving the uid/gid via +current_user_ns() can save a kuid that isn't mapped in the associated +namespace when the filesystem is finally mounted. This means that it +is possible for an unprivileged user to create files owned by any +group in a tmpfs mount (since we can set the SUID bit on the tmpfs +directory), or a tmpfs that is owned by any user, including the root +group/user." + +The contract for {g,u}id mount options and {g,u}id values in general set +from userspace has always been that they are translated according to the +caller's idmapping. In so far, tmpfs has been doing the correct thing. +But since tmpfs is mountable in unprivileged contexts it is also +necessary to verify that the resulting {k,g}uid is representable in the +namespace of the superblock to avoid such bugs as above. + +The new mount api's cross-namespace delegation abilities are already +widely used. After having talked to a bunch of userspace this is the +most faithful solution with minimal regression risks. I know of one +users - systemd - that makes use of the new mount api in this way and +they don't set unresolable {g,u}ids. So the regression risk is minimal. + +Link: https://lore.kernel.org/lkml/CALxfFW4BXhEwxR0Q5LSkg-8Vb4r2MONKCcUCVioehXQKr35eHg@mail.gmail.com +Fixes: f32356261d44 ("vfs: Convert ramfs, shmem, tmpfs, devtmpfs, rootfs to use the new mount API") +Reviewed-by: "Seth Forshee (DigitalOcean)" +Reported-by: Seth Jenkins +Message-Id: <20230801-vfs-fs_context-uidgid-v1-1-daf46a050bbf@kernel.org> +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + mm/shmem.c | 28 ++++++++++++++++++++++++---- + 1 file changed, 24 insertions(+), 4 deletions(-) + +diff --git a/mm/shmem.c b/mm/shmem.c +index aae2f408f9053..264229680ad75 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -3417,6 +3417,8 @@ static int shmem_parse_one(struct fs_context *fc, struct fs_parameter *param) + unsigned long long size; + char *rest; + int opt; ++ kuid_t kuid; ++ kgid_t kgid; + + opt = fs_parse(fc, &shmem_fs_parameters, param, &result); + if (opt < 0) +@@ -3452,14 +3454,32 @@ static int shmem_parse_one(struct fs_context *fc, struct fs_parameter *param) + ctx->mode = result.uint_32 & 07777; + break; + case Opt_uid: +- ctx->uid = make_kuid(current_user_ns(), result.uint_32); +- if (!uid_valid(ctx->uid)) ++ kuid = make_kuid(current_user_ns(), result.uint_32); ++ if (!uid_valid(kuid)) + goto bad_value; ++ ++ /* ++ * The requested uid must be representable in the ++ * filesystem's idmapping. ++ */ ++ if (!kuid_has_mapping(fc->user_ns, kuid)) ++ goto bad_value; ++ ++ ctx->uid = kuid; + break; + case Opt_gid: +- ctx->gid = make_kgid(current_user_ns(), result.uint_32); +- if (!gid_valid(ctx->gid)) ++ kgid = make_kgid(current_user_ns(), result.uint_32); ++ if (!gid_valid(kgid)) + goto bad_value; ++ ++ /* ++ * The requested gid must be representable in the ++ * filesystem's idmapping. ++ */ ++ if (!kgid_has_mapping(fc->user_ns, kgid)) ++ goto bad_value; ++ ++ ctx->gid = kgid; + break; + case Opt_huge: + ctx->huge = result.uint_32; +-- +2.40.1 + diff --git a/queue-5.4/tracing-fix-race-issue-between-cpu-buffer-write-and-.patch b/queue-5.4/tracing-fix-race-issue-between-cpu-buffer-write-and-.patch new file mode 100644 index 00000000000..32432d92162 --- /dev/null +++ b/queue-5.4/tracing-fix-race-issue-between-cpu-buffer-write-and-.patch @@ -0,0 +1,141 @@ +From c5d7092e36c282cc427568558778e250ea858764 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Aug 2023 21:27:39 +0800 +Subject: tracing: Fix race issue between cpu buffer write and swap + +From: Zheng Yejian + +[ Upstream commit 3163f635b20e9e1fb4659e74f47918c9dddfe64e ] + +Warning happened in rb_end_commit() at code: + if (RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))) + + WARNING: CPU: 0 PID: 139 at kernel/trace/ring_buffer.c:3142 + rb_commit+0x402/0x4a0 + Call Trace: + ring_buffer_unlock_commit+0x42/0x250 + trace_buffer_unlock_commit_regs+0x3b/0x250 + trace_event_buffer_commit+0xe5/0x440 + trace_event_buffer_reserve+0x11c/0x150 + trace_event_raw_event_sched_switch+0x23c/0x2c0 + __traceiter_sched_switch+0x59/0x80 + __schedule+0x72b/0x1580 + schedule+0x92/0x120 + worker_thread+0xa0/0x6f0 + +It is because the race between writing event into cpu buffer and swapping +cpu buffer through file per_cpu/cpu0/snapshot: + + Write on CPU 0 Swap buffer by per_cpu/cpu0/snapshot on CPU 1 + -------- -------- + tracing_snapshot_write() + [...] + + ring_buffer_lock_reserve() + cpu_buffer = buffer->buffers[cpu]; // 1. Suppose find 'cpu_buffer_a'; + [...] + rb_reserve_next_event() + [...] + + ring_buffer_swap_cpu() + if (local_read(&cpu_buffer_a->committing)) + goto out_dec; + if (local_read(&cpu_buffer_b->committing)) + goto out_dec; + buffer_a->buffers[cpu] = cpu_buffer_b; + buffer_b->buffers[cpu] = cpu_buffer_a; + // 2. cpu_buffer has swapped here. + + rb_start_commit(cpu_buffer); + if (unlikely(READ_ONCE(cpu_buffer->buffer) + != buffer)) { // 3. This check passed due to 'cpu_buffer->buffer' + [...] // has not changed here. + return NULL; + } + cpu_buffer_b->buffer = buffer_a; + cpu_buffer_a->buffer = buffer_b; + [...] + + // 4. Reserve event from 'cpu_buffer_a'. + + ring_buffer_unlock_commit() + [...] + cpu_buffer = buffer->buffers[cpu]; // 5. Now find 'cpu_buffer_b' !!! + rb_commit(cpu_buffer) + rb_end_commit() // 6. WARN for the wrong 'committing' state !!! + +Based on above analysis, we can easily reproduce by following testcase: + ``` bash + #!/bin/bash + + dmesg -n 7 + sysctl -w kernel.panic_on_warn=1 + TR=/sys/kernel/tracing + echo 7 > ${TR}/buffer_size_kb + echo "sched:sched_switch" > ${TR}/set_event + while [ true ]; do + echo 1 > ${TR}/per_cpu/cpu0/snapshot + done & + while [ true ]; do + echo 1 > ${TR}/per_cpu/cpu0/snapshot + done & + while [ true ]; do + echo 1 > ${TR}/per_cpu/cpu0/snapshot + done & + ``` + +To fix it, IIUC, we can use smp_call_function_single() to do the swap on +the target cpu where the buffer is located, so that above race would be +avoided. + +Link: https://lore.kernel.org/linux-trace-kernel/20230831132739.4070878-1-zhengyejian1@huawei.com + +Cc: +Fixes: f1affcaaa861 ("tracing: Add snapshot in the per_cpu trace directories") +Signed-off-by: Zheng Yejian +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index ad0ee4de92485..dd64ce26d48dd 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -6791,6 +6791,11 @@ static int tracing_snapshot_open(struct inode *inode, struct file *file) + return ret; + } + ++static void tracing_swap_cpu_buffer(void *tr) ++{ ++ update_max_tr_single((struct trace_array *)tr, current, smp_processor_id()); ++} ++ + static ssize_t + tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt, + loff_t *ppos) +@@ -6849,13 +6854,15 @@ tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt, + ret = tracing_alloc_snapshot_instance(tr); + if (ret < 0) + break; +- local_irq_disable(); + /* Now, we're going to swap */ +- if (iter->cpu_file == RING_BUFFER_ALL_CPUS) ++ if (iter->cpu_file == RING_BUFFER_ALL_CPUS) { ++ local_irq_disable(); + update_max_tr(tr, current, smp_processor_id(), NULL); +- else +- update_max_tr_single(tr, current, iter->cpu_file); +- local_irq_enable(); ++ local_irq_enable(); ++ } else { ++ smp_call_function_single(iter->cpu_file, tracing_swap_cpu_buffer, ++ (void *)tr, 1); ++ } + break; + default: + if (tr->allocated_snapshot) { +-- +2.40.1 + diff --git a/queue-5.4/um-fix-hostaudio-build-errors.patch b/queue-5.4/um-fix-hostaudio-build-errors.patch new file mode 100644 index 00000000000..ef17382e11b --- /dev/null +++ b/queue-5.4/um-fix-hostaudio-build-errors.patch @@ -0,0 +1,148 @@ +From 83ab673170a31465eb4c4b6de50e5364b77e487b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Aug 2023 22:15:00 -0700 +Subject: um: Fix hostaudio build errors + +From: Randy Dunlap + +[ Upstream commit db4bfcba7bb8d10f00bba2a3da6b9a9c2a1d7b71 ] + +Use "select" to ensure that the required kconfig symbols are set +as expected. +Drop HOSTAUDIO since it is now equivalent to UML_SOUND. + +Set CONFIG_SOUND=m in ARCH=um defconfig files to maintain the +status quo of the default configs. + +Allow SOUND with UML regardless of HAS_IOMEM. Otherwise there is a +kconfig warning for unmet dependencies. (This was not an issue when +SOUND was defined in arch/um/drivers/Kconfig. I have done 50 randconfig +builds and didn't find any issues.) + +This fixes build errors when CONFIG_SOUND is not set: + +ld: arch/um/drivers/hostaudio_kern.o: in function `hostaudio_cleanup_module': +hostaudio_kern.c:(.exit.text+0xa): undefined reference to `unregister_sound_mixer' +ld: hostaudio_kern.c:(.exit.text+0x15): undefined reference to `unregister_sound_dsp' +ld: arch/um/drivers/hostaudio_kern.o: in function `hostaudio_init_module': +hostaudio_kern.c:(.init.text+0x19): undefined reference to `register_sound_dsp' +ld: hostaudio_kern.c:(.init.text+0x31): undefined reference to `register_sound_mixer' +ld: hostaudio_kern.c:(.init.text+0x49): undefined reference to `unregister_sound_dsp' + +and this kconfig warning: +WARNING: unmet direct dependencies detected for SOUND + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Fixes: d886e87cb82b ("sound: make OSS sound core optional") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Closes: lore.kernel.org/r/202307141416.vxuRVpFv-lkp@intel.com +Cc: Richard Weinberger +Cc: Anton Ivanov +Cc: Johannes Berg +Cc: linux-um@lists.infradead.org +Cc: Tejun Heo +Cc: Takashi Iwai +Cc: Jaroslav Kysela +Cc: Masahiro Yamada +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Nicolas Schier +Cc: linux-kbuild@vger.kernel.org +Cc: alsa-devel@alsa-project.org +Reviewed-by: Masahiro Yamada +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/configs/i386_defconfig | 1 + + arch/um/configs/x86_64_defconfig | 1 + + arch/um/drivers/Kconfig | 16 +++------------- + arch/um/drivers/Makefile | 2 +- + sound/Kconfig | 2 +- + 5 files changed, 7 insertions(+), 15 deletions(-) + +diff --git a/arch/um/configs/i386_defconfig b/arch/um/configs/i386_defconfig +index 73e98bb57bf51..4229ac9165e83 100644 +--- a/arch/um/configs/i386_defconfig ++++ b/arch/um/configs/i386_defconfig +@@ -35,6 +35,7 @@ CONFIG_TTY_CHAN=y + CONFIG_XTERM_CHAN=y + CONFIG_CON_CHAN="pts" + CONFIG_SSL_CHAN="pts" ++CONFIG_SOUND=m + CONFIG_UML_SOUND=m + CONFIG_DEVTMPFS=y + CONFIG_DEVTMPFS_MOUNT=y +diff --git a/arch/um/configs/x86_64_defconfig b/arch/um/configs/x86_64_defconfig +index 3281d7600225b..f6993a0067272 100644 +--- a/arch/um/configs/x86_64_defconfig ++++ b/arch/um/configs/x86_64_defconfig +@@ -33,6 +33,7 @@ CONFIG_TTY_CHAN=y + CONFIG_XTERM_CHAN=y + CONFIG_CON_CHAN="pts" + CONFIG_SSL_CHAN="pts" ++CONFIG_SOUND=m + CONFIG_UML_SOUND=m + CONFIG_DEVTMPFS=y + CONFIG_DEVTMPFS_MOUNT=y +diff --git a/arch/um/drivers/Kconfig b/arch/um/drivers/Kconfig +index 388096fb45a25..12f54a4a3747d 100644 +--- a/arch/um/drivers/Kconfig ++++ b/arch/um/drivers/Kconfig +@@ -104,24 +104,14 @@ config SSL_CHAN + + config UML_SOUND + tristate "Sound support" ++ depends on SOUND ++ select SOUND_OSS_CORE + help + This option enables UML sound support. If enabled, it will pull in +- soundcore and the UML hostaudio relay, which acts as a intermediary ++ the UML hostaudio relay, which acts as a intermediary + between the host's dsp and mixer devices and the UML sound system. + It is safe to say 'Y' here. + +-config SOUND +- tristate +- default UML_SOUND +- +-config SOUND_OSS_CORE +- bool +- default UML_SOUND +- +-config HOSTAUDIO +- tristate +- default UML_SOUND +- + endmenu + + menu "UML Network Devices" +diff --git a/arch/um/drivers/Makefile b/arch/um/drivers/Makefile +index a290821e355c2..4d7fb606a5f04 100644 +--- a/arch/um/drivers/Makefile ++++ b/arch/um/drivers/Makefile +@@ -52,7 +52,7 @@ obj-$(CONFIG_UML_NET) += net.o + obj-$(CONFIG_MCONSOLE) += mconsole.o + obj-$(CONFIG_MMAPPER) += mmapper_kern.o + obj-$(CONFIG_BLK_DEV_UBD) += ubd.o +-obj-$(CONFIG_HOSTAUDIO) += hostaudio.o ++obj-$(CONFIG_UML_SOUND) += hostaudio.o + obj-$(CONFIG_NULL_CHAN) += null.o + obj-$(CONFIG_PORT_CHAN) += port.o + obj-$(CONFIG_PTY_CHAN) += pty.o +diff --git a/sound/Kconfig b/sound/Kconfig +index 36785410fbe15..aaf2022ffc57d 100644 +--- a/sound/Kconfig ++++ b/sound/Kconfig +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0-only + menuconfig SOUND + tristate "Sound card support" +- depends on HAS_IOMEM ++ depends on HAS_IOMEM || UML + help + If you have a sound card in your computer, i.e. if it can say more + than an occasional beep, say Y. +-- +2.40.1 + diff --git a/queue-5.4/usb-gadget-f_mass_storage-fix-unused-variable-warnin.patch b/queue-5.4/usb-gadget-f_mass_storage-fix-unused-variable-warnin.patch new file mode 100644 index 00000000000..1d170590555 --- /dev/null +++ b/queue-5.4/usb-gadget-f_mass_storage-fix-unused-variable-warnin.patch @@ -0,0 +1,37 @@ +From fa0fdd9bdc6309b8d59e29ee0fdef00b55293a7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 13:47:04 -0400 +Subject: USB: gadget: f_mass_storage: Fix unused variable warning + +From: Alan Stern + +[ Upstream commit 55c3e571d2a0aabef4f1354604443f1c415d2e85 ] + +Fix a "variable set but not used" warning in f_mass_storage.c. rc is +used if verbose debugging is enabled but not otherwise. + +Signed-off-by: Alan Stern +Fixes: d5e2b67aae79 ("USB: g_mass_storage: template f_mass_storage.c file created") +Link: https://lore.kernel.org/r/cfed16c7-aa46-494b-ba84-b0e0dc99be3a@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_mass_storage.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c +index 7c96c4665178e..6c8aba574e6e9 100644 +--- a/drivers/usb/gadget/function/f_mass_storage.c ++++ b/drivers/usb/gadget/function/f_mass_storage.c +@@ -950,7 +950,7 @@ static void invalidate_sub(struct fsg_lun *curlun) + { + struct file *filp = curlun->filp; + struct inode *inode = file_inode(filp); +- unsigned long rc; ++ unsigned long __maybe_unused rc; + + rc = invalidate_mapping_pages(inode->i_mapping, 0, -1); + VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc); +-- +2.40.1 + diff --git a/queue-5.4/usb-phy-mxs-fix-getting-wrong-state-with-mxs_phy_is_.patch b/queue-5.4/usb-phy-mxs-fix-getting-wrong-state-with-mxs_phy_is_.patch new file mode 100644 index 00000000000..aa027cbf2d3 --- /dev/null +++ b/queue-5.4/usb-phy-mxs-fix-getting-wrong-state-with-mxs_phy_is_.patch @@ -0,0 +1,50 @@ +From 9f6b5859a608c404805d3f80459e7828b6bb90b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 19:03:52 +0800 +Subject: usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() + +From: Xu Yang + +[ Upstream commit 5eda42aebb7668b4dcff025cd3ccb0d3d7c53da6 ] + +The function mxs_phy_is_otg_host() will return true if OTG_ID_VALUE is +0 at USBPHY_CTRL register. However, OTG_ID_VALUE will not reflect the real +state if the ID pin is float, such as Host-only or Type-C cases. The value +of OTG_ID_VALUE is always 1 which means device mode. +This patch will fix the issue by judging the current mode based on +last_event. The controller will update last_event in time. + +Fixes: 7b09e67639d6 ("usb: phy: mxs: refine mxs_phy_disconnect_line") +Signed-off-by: Xu Yang +Acked-by: Peter Chen +Link: https://lore.kernel.org/r/20230627110353.1879477-2-xu.yang_2@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-mxs-usb.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c +index 70b8c8248caf7..5bcad9041284e 100644 +--- a/drivers/usb/phy/phy-mxs-usb.c ++++ b/drivers/usb/phy/phy-mxs-usb.c +@@ -388,14 +388,8 @@ static void __mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool disconnect) + + static bool mxs_phy_is_otg_host(struct mxs_phy *mxs_phy) + { +- void __iomem *base = mxs_phy->phy.io_priv; +- u32 phyctrl = readl(base + HW_USBPHY_CTRL); +- +- if (IS_ENABLED(CONFIG_USB_OTG) && +- !(phyctrl & BM_USBPHY_CTRL_OTG_ID_VALUE)) +- return true; +- +- return false; ++ return IS_ENABLED(CONFIG_USB_OTG) && ++ mxs_phy->phy.last_event == USB_EVENT_ID; + } + + static void mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool on) +-- +2.40.1 + diff --git a/queue-5.4/virtio_ring-fix-avail_wrap_counter-in-virtqueue_add_.patch b/queue-5.4/virtio_ring-fix-avail_wrap_counter-in-virtqueue_add_.patch new file mode 100644 index 00000000000..6abcd3a52d4 --- /dev/null +++ b/queue-5.4/virtio_ring-fix-avail_wrap_counter-in-virtqueue_add_.patch @@ -0,0 +1,80 @@ +From 22ddce94a0aa38ca23ef33951c1b7e4e7c3b5f66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Aug 2023 05:10:59 +0000 +Subject: virtio_ring: fix avail_wrap_counter in virtqueue_add_packed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yuan Yao + +[ Upstream commit 1acfe2c1225899eab5ab724c91b7e1eb2881b9ab ] + +In current packed virtqueue implementation, the avail_wrap_counter won't +flip, in the case when the driver supplies a descriptor chain with a +length equals to the queue size; total_sg == vq->packed.vring.num. + +Let’s assume the following situation: +vq->packed.vring.num=4 +vq->packed.next_avail_idx: 1 +vq->packed.avail_wrap_counter: 0 + +Then the driver adds a descriptor chain containing 4 descriptors. + +We expect the following result with avail_wrap_counter flipped: +vq->packed.next_avail_idx: 1 +vq->packed.avail_wrap_counter: 1 + +But, the current implementation gives the following result: +vq->packed.next_avail_idx: 1 +vq->packed.avail_wrap_counter: 0 + +To reproduce the bug, you can set a packed queue size as small as +possible, so that the driver is more likely to provide a descriptor +chain with a length equal to the packed queue size. For example, in +qemu run following commands: +sudo qemu-system-x86_64 \ +-enable-kvm \ +-nographic \ +-kernel "path/to/kernel_image" \ +-m 1G \ +-drive file="path/to/rootfs",if=none,id=disk \ +-device virtio-blk,drive=disk \ +-drive file="path/to/disk_image",if=none,id=rwdisk \ +-device virtio-blk,drive=rwdisk,packed=on,queue-size=4,\ +indirect_desc=off \ +-append "console=ttyS0 root=/dev/vda rw init=/bin/bash" + +Inside the VM, create a directory and mount the rwdisk device on it. The +rwdisk will hang and mount operation will not complete. + +This commit fixes the wrap counter error by flipping the +packed.avail_wrap_counter, when start of descriptor chain equals to the +end of descriptor chain (head == i). + +Fixes: 1ce9e6055fa0 ("virtio_ring: introduce packed ring support") +Signed-off-by: Yuan Yao +Message-Id: <20230808051110.3492693-1-yuanyaogoog@chromium.org> +Acked-by: Jason Wang +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_ring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index b5c0509112769..e3c78c9f84584 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -1180,7 +1180,7 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq, + } + } + +- if (i < head) ++ if (i <= head) + vq->packed.avail_wrap_counter ^= 1; + + /* We're using some buffers from the free list. */ +-- +2.40.1 + diff --git a/queue-5.4/wifi-ath10k-use-rmw-accessors-for-changing-lnkctl.patch b/queue-5.4/wifi-ath10k-use-rmw-accessors-for-changing-lnkctl.patch new file mode 100644 index 00000000000..7d9832af7ed --- /dev/null +++ b/queue-5.4/wifi-ath10k-use-rmw-accessors-for-changing-lnkctl.patch @@ -0,0 +1,61 @@ +From ca07efc8081e5da95f87985a665c753198cf31cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:05:02 +0300 +Subject: wifi: ath10k: Use RMW accessors for changing LNKCTL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit f139492a09f15254fa261245cdbd65555cdf39e3 ] + +Don't assume that only the driver would be accessing LNKCTL. ASPM policy +changes can trigger write to LNKCTL outside of driver's control. + +Use RMW capability accessors which does proper locking to avoid losing +concurrent updates to the register value. On restore, clear the ASPMC field +properly. + +Suggested-by: Lukas Wunner +Fixes: 76d870ed09ab ("ath10k: enable ASPM") +Link: https://lore.kernel.org/r/20230717120503.15276-11-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Reviewed-by: Simon Horman +Acked-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/pci.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c +index c28328c96307b..464dd0246a97d 100644 +--- a/drivers/net/wireless/ath/ath10k/pci.c ++++ b/drivers/net/wireless/ath/ath10k/pci.c +@@ -1960,8 +1960,9 @@ static int ath10k_pci_hif_start(struct ath10k *ar) + ath10k_pci_irq_enable(ar); + ath10k_pci_rx_post(ar); + +- pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL, +- ar_pci->link_ctl); ++ pcie_capability_clear_and_set_word(ar_pci->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_ASPMC, ++ ar_pci->link_ctl & PCI_EXP_LNKCTL_ASPMC); + + return 0; + } +@@ -2818,8 +2819,8 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar, + + pcie_capability_read_word(ar_pci->pdev, PCI_EXP_LNKCTL, + &ar_pci->link_ctl); +- pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL, +- ar_pci->link_ctl & ~PCI_EXP_LNKCTL_ASPMC); ++ pcie_capability_clear_word(ar_pci->pdev, PCI_EXP_LNKCTL, ++ PCI_EXP_LNKCTL_ASPMC); + + /* + * Bring the target up cleanly. +-- +2.40.1 + diff --git a/queue-5.4/wifi-ath9k-fix-races-between-ath9k_wmi_cmd-and-ath9k.patch b/queue-5.4/wifi-ath9k-fix-races-between-ath9k_wmi_cmd-and-ath9k.patch new file mode 100644 index 00000000000..17c3e0a0e9d --- /dev/null +++ b/queue-5.4/wifi-ath9k-fix-races-between-ath9k_wmi_cmd-and-ath9k.patch @@ -0,0 +1,129 @@ +From 008080fd9467d071c00c383b723e98cb3b89825b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 22:26:06 +0300 +Subject: wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit b674fb513e2e7a514fcde287c0f73915d393fdb6 ] + +Currently, the synchronization between ath9k_wmi_cmd() and +ath9k_wmi_ctrl_rx() is exposed to a race condition which, although being +rather unlikely, can lead to invalid behaviour of ath9k_wmi_cmd(). + +Consider the following scenario: + +CPU0 CPU1 + +ath9k_wmi_cmd(...) + mutex_lock(&wmi->op_mutex) + ath9k_wmi_cmd_issue(...) + wait_for_completion_timeout(...) + --- + timeout + --- + /* the callback is being processed + * before last_seq_id became zero + */ + ath9k_wmi_ctrl_rx(...) + spin_lock_irqsave(...) + /* wmi->last_seq_id check here + * doesn't detect timeout yet + */ + spin_unlock_irqrestore(...) + /* last_seq_id is zeroed to + * indicate there was a timeout + */ + wmi->last_seq_id = 0 + mutex_unlock(&wmi->op_mutex) + return -ETIMEDOUT + +ath9k_wmi_cmd(...) + mutex_lock(&wmi->op_mutex) + /* the buffer is replaced with + * another one + */ + wmi->cmd_rsp_buf = rsp_buf + wmi->cmd_rsp_len = rsp_len + ath9k_wmi_cmd_issue(...) + spin_lock_irqsave(...) + spin_unlock_irqrestore(...) + wait_for_completion_timeout(...) + /* the continuation of the + * callback left after the first + * ath9k_wmi_cmd call + */ + ath9k_wmi_rsp_callback(...) + /* copying data designated + * to already timeouted + * WMI command into an + * inappropriate wmi_cmd_buf + */ + memcpy(...) + complete(&wmi->cmd_wait) + /* awakened by the bogus callback + * => invalid return result + */ + mutex_unlock(&wmi->op_mutex) + return 0 + +To fix this, update last_seq_id on timeout path inside ath9k_wmi_cmd() +under the wmi_lock. Move ath9k_wmi_rsp_callback() under wmi_lock inside +ath9k_wmi_ctrl_rx() so that the wmi->cmd_wait can be completed only for +initially designated wmi_cmd call, otherwise the path would be rejected +with last_seq_id check. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Signed-off-by: Fedor Pchelkin +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230425192607.18015-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/wmi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c +index ef861b19fd477..96482ad23145c 100644 +--- a/drivers/net/wireless/ath/ath9k/wmi.c ++++ b/drivers/net/wireless/ath/ath9k/wmi.c +@@ -239,10 +239,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb, + spin_unlock_irqrestore(&wmi->wmi_lock, flags); + goto free_skb; + } +- spin_unlock_irqrestore(&wmi->wmi_lock, flags); + + /* WMI command response */ + ath9k_wmi_rsp_callback(wmi, skb); ++ spin_unlock_irqrestore(&wmi->wmi_lock, flags); + + free_skb: + kfree_skb(skb); +@@ -305,8 +305,8 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + struct ath_common *common = ath9k_hw_common(ah); + u16 headroom = sizeof(struct htc_frame_hdr) + + sizeof(struct wmi_cmd_hdr); ++ unsigned long time_left, flags; + struct sk_buff *skb; +- unsigned long time_left; + int ret = 0; + + if (ah->ah_flags & AH_UNPLUGGED) +@@ -342,7 +342,9 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + if (!time_left) { + ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n", + wmi_cmd_to_name(cmd_id)); ++ spin_lock_irqsave(&wmi->wmi_lock, flags); + wmi->last_seq_id = 0; ++ spin_unlock_irqrestore(&wmi->wmi_lock, flags); + mutex_unlock(&wmi->op_mutex); + return -ETIMEDOUT; + } +-- +2.40.1 + diff --git a/queue-5.4/wifi-ath9k-protect-wmi-command-response-buffer-repla.patch b/queue-5.4/wifi-ath9k-protect-wmi-command-response-buffer-repla.patch new file mode 100644 index 00000000000..18a4b5e376a --- /dev/null +++ b/queue-5.4/wifi-ath9k-protect-wmi-command-response-buffer-repla.patch @@ -0,0 +1,78 @@ +From 6601f2d0dd36a45548f4ea4f398ffeb578eb0b8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 22:26:07 +0300 +Subject: wifi: ath9k: protect WMI command response buffer replacement with a + lock +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit 454994cfa9e4c18b6df9f78b60db8eadc20a6c25 ] + +If ath9k_wmi_cmd() has exited with a timeout, it is possible that during +next ath9k_wmi_cmd() call the wmi_rsp callback for previous wmi command +writes to new wmi->cmd_rsp_buf and makes a completion. This results in an +invalid ath9k_wmi_cmd() return value. + +Move the replacement of WMI command response buffer and length under +wmi_lock. Note that last_seq_id value is updated there, too. + +Thus, the buffer cannot be written to by a belated wmi_rsp callback +because that path is properly rejected by the last_seq_id check. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Signed-off-by: Fedor Pchelkin +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230425192607.18015-2-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/wmi.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c +index 96482ad23145c..dd8027b8af63e 100644 +--- a/drivers/net/wireless/ath/ath9k/wmi.c ++++ b/drivers/net/wireless/ath/ath9k/wmi.c +@@ -280,7 +280,8 @@ int ath9k_wmi_connect(struct htc_target *htc, struct wmi *wmi, + + static int ath9k_wmi_cmd_issue(struct wmi *wmi, + struct sk_buff *skb, +- enum wmi_cmd_id cmd, u16 len) ++ enum wmi_cmd_id cmd, u16 len, ++ u8 *rsp_buf, u32 rsp_len) + { + struct wmi_cmd_hdr *hdr; + unsigned long flags; +@@ -290,6 +291,11 @@ static int ath9k_wmi_cmd_issue(struct wmi *wmi, + hdr->seq_no = cpu_to_be16(++wmi->tx_seq_id); + + spin_lock_irqsave(&wmi->wmi_lock, flags); ++ ++ /* record the rsp buffer and length */ ++ wmi->cmd_rsp_buf = rsp_buf; ++ wmi->cmd_rsp_len = rsp_len; ++ + wmi->last_seq_id = wmi->tx_seq_id; + spin_unlock_irqrestore(&wmi->wmi_lock, flags); + +@@ -330,11 +336,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + goto out; + } + +- /* record the rsp buffer and length */ +- wmi->cmd_rsp_buf = rsp_buf; +- wmi->cmd_rsp_len = rsp_len; +- +- ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len); ++ ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len, rsp_buf, rsp_len); + if (ret) + goto out; + +-- +2.40.1 + diff --git a/queue-5.4/wifi-ath9k-use-is_err-with-debugfs_create_dir.patch b/queue-5.4/wifi-ath9k-use-is_err-with-debugfs_create_dir.patch new file mode 100644 index 00000000000..983f3da9fe8 --- /dev/null +++ b/queue-5.4/wifi-ath9k-use-is_err-with-debugfs_create_dir.patch @@ -0,0 +1,44 @@ +From 8780cb04ad8ce8af80dda96db4963193df5c9fd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 11:03:44 +0800 +Subject: wifi: ath9k: use IS_ERR() with debugfs_create_dir() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wang Ming + +[ Upstream commit 1e4134610d93271535ecf900a676e1f094e9944c ] + +The debugfs_create_dir() function returns error pointers, +it never returns NULL. Most incorrect error checks were fixed, +but the one in ath9k_htc_init_debug() was forgotten. + +Fix the remaining error check. + +Fixes: e5facc75fa91 ("ath9k_htc: Cleanup HTC debugfs") +Signed-off-by: Wang Ming +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230713030358.12379-1-machel@vivo.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c +index b3ed65e5c4da8..c55aab01fff5d 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c +@@ -491,7 +491,7 @@ int ath9k_htc_init_debug(struct ath_hw *ah) + + priv->debug.debugfs_phy = debugfs_create_dir(KBUILD_MODNAME, + priv->hw->wiphy->debugfsdir); +- if (!priv->debug.debugfs_phy) ++ if (IS_ERR(priv->debug.debugfs_phy)) + return -ENOMEM; + + ath9k_cmn_spectral_init_debug(&priv->spec_priv, priv->debug.debugfs_phy); +-- +2.40.1 + diff --git a/queue-5.4/wifi-mwifiex-avoid-possible-null-skb-pointer-derefer.patch b/queue-5.4/wifi-mwifiex-avoid-possible-null-skb-pointer-derefer.patch new file mode 100644 index 00000000000..80d9a95f10f --- /dev/null +++ b/queue-5.4/wifi-mwifiex-avoid-possible-null-skb-pointer-derefer.patch @@ -0,0 +1,50 @@ +From 8d1d58a61ca7fe9a669e2207fb3c9f77b4447f44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Aug 2023 12:49:57 +0300 +Subject: wifi: mwifiex: avoid possible NULL skb pointer dereference + +From: Dmitry Antipov + +[ Upstream commit 35a7a1ce7c7d61664ee54f5239a1f120ab95a87e ] + +In 'mwifiex_handle_uap_rx_forward()', always check the value +returned by 'skb_copy()' to avoid potential NULL pointer +dereference in 'mwifiex_uap_queue_bridged_pkt()', and drop +original skb in case of copying failure. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 838e4f449297 ("mwifiex: improve uAP RX handling") +Acked-by: Brian Norris +Signed-off-by: Dmitry Antipov +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230814095041.16416-1-dmantipov@yandex.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +index 4d2d309289426..cb3f72eee230a 100644 +--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c ++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +@@ -265,7 +265,15 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv, + + if (is_multicast_ether_addr(ra)) { + skb_uap = skb_copy(skb, GFP_ATOMIC); +- mwifiex_uap_queue_bridged_pkt(priv, skb_uap); ++ if (likely(skb_uap)) { ++ mwifiex_uap_queue_bridged_pkt(priv, skb_uap); ++ } else { ++ mwifiex_dbg(adapter, ERROR, ++ "failed to copy skb for uAP\n"); ++ priv->stats.rx_dropped++; ++ dev_kfree_skb_any(skb); ++ return -1; ++ } + } else { + if (mwifiex_get_sta_entry(priv, ra)) { + /* Requeue Intra-BSS packet */ +-- +2.40.1 + diff --git a/queue-5.4/wifi-mwifiex-fix-error-recovery-in-pcie-buffer-descr.patch b/queue-5.4/wifi-mwifiex-fix-error-recovery-in-pcie-buffer-descr.patch new file mode 100644 index 00000000000..60525cce1de --- /dev/null +++ b/queue-5.4/wifi-mwifiex-fix-error-recovery-in-pcie-buffer-descr.patch @@ -0,0 +1,121 @@ +From c2a44b3b7771a4dcc2befffc4fb81b666a5c7abf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jul 2023 10:43:07 +0300 +Subject: wifi: mwifiex: fix error recovery in PCIE buffer descriptor + management + +From: Dmitry Antipov + +[ Upstream commit 288c63d5cb4667a51a04668b3e2bb0ea499bc5f4 ] + +Add missing 'kfree_skb()' in 'mwifiex_init_rxq_ring()' and never do +'kfree(card->rxbd_ring_vbase)' because this area is DMAed and should +be released with 'dma_free_coherent()'. The latter is performed in +'mwifiex_pcie_delete_rxbd_ring()', which is now called to recover +from possible errors in 'mwifiex_pcie_create_rxbd_ring()'. Likewise +for 'mwifiex_pcie_init_evt_ring()', 'kfree(card->evtbd_ring_vbase)' +'mwifiex_pcie_delete_evtbd_ring()' and 'mwifiex_pcie_create_rxbd_ring()'. + +Fixes: d930faee141b ("mwifiex: add support for Marvell pcie8766 chipset") +Signed-off-by: Dmitry Antipov +Acked-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230731074334.56463-1-dmantipov@yandex.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/pcie.c | 25 ++++++++++++++------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index 80dde94b65c87..78d7674e71f9f 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -50,6 +50,8 @@ static int mwifiex_pcie_probe_of(struct device *dev) + } + + static void mwifiex_pcie_work(struct work_struct *work); ++static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter); ++static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter); + + static int + mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb, +@@ -627,14 +629,15 @@ static int mwifiex_init_rxq_ring(struct mwifiex_adapter *adapter) + if (!skb) { + mwifiex_dbg(adapter, ERROR, + "Unable to allocate skb for RX ring.\n"); +- kfree(card->rxbd_ring_vbase); + return -ENOMEM; + } + + if (mwifiex_map_pci_memory(adapter, skb, + MWIFIEX_RX_DATA_BUF_SIZE, +- DMA_FROM_DEVICE)) +- return -1; ++ DMA_FROM_DEVICE)) { ++ kfree_skb(skb); ++ return -ENOMEM; ++ } + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); + +@@ -684,7 +687,6 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) + if (!skb) { + mwifiex_dbg(adapter, ERROR, + "Unable to allocate skb for EVENT buf.\n"); +- kfree(card->evtbd_ring_vbase); + return -ENOMEM; + } + skb_put(skb, MAX_EVENT_SIZE); +@@ -692,8 +694,7 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) + if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE, + DMA_FROM_DEVICE)) { + kfree_skb(skb); +- kfree(card->evtbd_ring_vbase); +- return -1; ++ return -ENOMEM; + } + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); +@@ -892,6 +893,7 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter) + */ + static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter) + { ++ int ret; + struct pcie_service_card *card = adapter->card; + const struct mwifiex_pcie_card_reg *reg = card->pcie.reg; + +@@ -930,7 +932,10 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter) + (u32)((u64)card->rxbd_ring_pbase >> 32), + card->rxbd_ring_size); + +- return mwifiex_init_rxq_ring(adapter); ++ ret = mwifiex_init_rxq_ring(adapter); ++ if (ret) ++ mwifiex_pcie_delete_rxbd_ring(adapter); ++ return ret; + } + + /* +@@ -961,6 +966,7 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter) + */ + static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter) + { ++ int ret; + struct pcie_service_card *card = adapter->card; + const struct mwifiex_pcie_card_reg *reg = card->pcie.reg; + +@@ -995,7 +1001,10 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter) + (u32)((u64)card->evtbd_ring_pbase >> 32), + card->evtbd_ring_size); + +- return mwifiex_pcie_init_evt_ring(adapter); ++ ret = mwifiex_pcie_init_evt_ring(adapter); ++ if (ret) ++ mwifiex_pcie_delete_evtbd_ring(adapter); ++ return ret; + } + + /* +-- +2.40.1 + diff --git a/queue-5.4/wifi-mwifiex-fix-memory-leak-in-mwifiex_histogram_re.patch b/queue-5.4/wifi-mwifiex-fix-memory-leak-in-mwifiex_histogram_re.patch new file mode 100644 index 00000000000..caeded95c1a --- /dev/null +++ b/queue-5.4/wifi-mwifiex-fix-memory-leak-in-mwifiex_histogram_re.patch @@ -0,0 +1,52 @@ +From 814ba393890298e490b615bac6dcfc6cf3f7b6ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Aug 2023 19:07:15 +0300 +Subject: wifi: mwifiex: fix memory leak in mwifiex_histogram_read() + +From: Dmitry Antipov + +[ Upstream commit 9c8fd72a5c2a031cbc680a2990107ecd958ffcdb ] + +Always free the zeroed page on return from 'mwifiex_histogram_read()'. + +Fixes: cbf6e05527a7 ("mwifiex: add rx histogram statistics support") + +Acked-by: Brian Norris +Signed-off-by: Dmitry Antipov +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230802160726.85545-1-dmantipov@yandex.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/debugfs.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c +index 8ab114cf3467f..e4cb7ce1c8b85 100644 +--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c ++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c +@@ -265,8 +265,11 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf, + if (!p) + return -ENOMEM; + +- if (!priv || !priv->hist_data) +- return -EFAULT; ++ if (!priv || !priv->hist_data) { ++ ret = -EFAULT; ++ goto free_and_exit; ++ } ++ + phist_data = priv->hist_data; + + p += sprintf(p, "\n" +@@ -321,6 +324,8 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf, + ret = simple_read_from_buffer(ubuf, count, ppos, (char *)page, + (unsigned long)p - page); + ++free_and_exit: ++ free_page(page); + return ret; + } + +-- +2.40.1 + diff --git a/queue-5.4/wifi-mwifiex-fix-missed-return-in-oob-checks-failed-.patch b/queue-5.4/wifi-mwifiex-fix-missed-return-in-oob-checks-failed-.patch new file mode 100644 index 00000000000..d88e8e0c1e8 --- /dev/null +++ b/queue-5.4/wifi-mwifiex-fix-missed-return-in-oob-checks-failed-.patch @@ -0,0 +1,51 @@ +From de0d4305924069a0a6cd3274a947525239d04d16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 08:39:11 +0000 +Subject: wifi: mwifiex: Fix missed return in oob checks failed path + +From: Polaris Pi + +[ Upstream commit 2785851c627f2db05f9271f7f63661b5dbd95c4c ] + +Add missed return in mwifiex_uap_queue_bridged_pkt() and +mwifiex_process_rx_packet(). + +Fixes: 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") +Signed-off-by: Polaris Pi +Reported-by: Dmitry Antipov +Acked-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230810083911.3725248-1-pinkperfect2021@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/sta_rx.c | 1 + + drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c +index 53eef44739571..a42b8ff33b23f 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c +@@ -104,6 +104,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, + skb->len, rx_pkt_off); + priv->stats.rx_dropped++; + dev_kfree_skb_any(skb); ++ return -1; + } + + if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, +diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +index 8e263bcc8f432..4d2d309289426 100644 +--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c ++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +@@ -122,6 +122,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv, + skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset)); + priv->stats.rx_dropped++; + dev_kfree_skb_any(skb); ++ return; + } + + if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, +-- +2.40.1 + diff --git a/queue-5.4/wifi-mwifiex-fix-oob-and-integer-underflow-when-rx-p.patch b/queue-5.4/wifi-mwifiex-fix-oob-and-integer-underflow-when-rx-p.patch new file mode 100644 index 00000000000..aa30fc4c9f4 --- /dev/null +++ b/queue-5.4/wifi-mwifiex-fix-oob-and-integer-underflow-when-rx-p.patch @@ -0,0 +1,127 @@ +From 255d4337c21da379ea733f1cffe90845e3d246c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 07:07:41 +0000 +Subject: wifi: mwifiex: Fix OOB and integer underflow when rx packets + +From: Polaris Pi + +[ Upstream commit 11958528161731c58e105b501ed60b83a91ea941 ] + +Make sure mwifiex_process_mgmt_packet, +mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, +mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet +not out-of-bounds access the skb->data buffer. + +Fixes: 2dbaf751b1de ("mwifiex: report received management frames to cfg80211") +Signed-off-by: Polaris Pi +Reviewed-by: Matthew Wang +Reviewed-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230723070741.1544662-1-pinkperfect2021@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/sta_rx.c | 11 ++++++++++- + .../net/wireless/marvell/mwifiex/uap_txrx.c | 19 +++++++++++++++++++ + drivers/net/wireless/marvell/mwifiex/util.c | 10 +++++++--- + 3 files changed, 36 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c +index 52a2ce2e78b08..53eef44739571 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c +@@ -98,6 +98,14 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, + rx_pkt_len = le16_to_cpu(local_rx_pd->rx_pkt_length); + rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off; + ++ if (sizeof(*rx_pkt_hdr) + rx_pkt_off > skb->len) { ++ mwifiex_dbg(priv->adapter, ERROR, ++ "wrong rx packet offset: len=%d, rx_pkt_off=%d\n", ++ skb->len, rx_pkt_off); ++ priv->stats.rx_dropped++; ++ dev_kfree_skb_any(skb); ++ } ++ + if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, + sizeof(bridge_tunnel_header))) || + (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header, +@@ -206,7 +214,8 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv, + + rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_offset; + +- if ((rx_pkt_offset + rx_pkt_length) > (u16) skb->len) { ++ if ((rx_pkt_offset + rx_pkt_length) > skb->len || ++ sizeof(rx_pkt_hdr->eth803_hdr) + rx_pkt_offset > skb->len) { + mwifiex_dbg(adapter, ERROR, + "wrong rx packet: len=%d, rx_pkt_offset=%d, rx_pkt_length=%d\n", + skb->len, rx_pkt_offset, rx_pkt_length); +diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +index 354b09c5e8dc0..8e263bcc8f432 100644 +--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c ++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +@@ -115,6 +115,15 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv, + return; + } + ++ if (sizeof(*rx_pkt_hdr) + ++ le16_to_cpu(uap_rx_pd->rx_pkt_offset) > skb->len) { ++ mwifiex_dbg(adapter, ERROR, ++ "wrong rx packet offset: len=%d,rx_pkt_offset=%d\n", ++ skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset)); ++ priv->stats.rx_dropped++; ++ dev_kfree_skb_any(skb); ++ } ++ + if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, + sizeof(bridge_tunnel_header))) || + (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header, +@@ -383,6 +392,16 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv, + rx_pkt_type = le16_to_cpu(uap_rx_pd->rx_pkt_type); + rx_pkt_hdr = (void *)uap_rx_pd + le16_to_cpu(uap_rx_pd->rx_pkt_offset); + ++ if (le16_to_cpu(uap_rx_pd->rx_pkt_offset) + ++ sizeof(rx_pkt_hdr->eth803_hdr) > skb->len) { ++ mwifiex_dbg(adapter, ERROR, ++ "wrong rx packet for struct ethhdr: len=%d, offset=%d\n", ++ skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset)); ++ priv->stats.rx_dropped++; ++ dev_kfree_skb_any(skb); ++ return 0; ++ } ++ + ether_addr_copy(ta, rx_pkt_hdr->eth803_hdr.h_source); + + if ((le16_to_cpu(uap_rx_pd->rx_pkt_offset) + +diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c +index 3b0d318276811..135b197fb4a36 100644 +--- a/drivers/net/wireless/marvell/mwifiex/util.c ++++ b/drivers/net/wireless/marvell/mwifiex/util.c +@@ -405,11 +405,15 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv, + } + + rx_pd = (struct rxpd *)skb->data; ++ pkt_len = le16_to_cpu(rx_pd->rx_pkt_length); ++ if (pkt_len < sizeof(struct ieee80211_hdr) + sizeof(pkt_len)) { ++ mwifiex_dbg(priv->adapter, ERROR, "invalid rx_pkt_length"); ++ return -1; ++ } + + skb_pull(skb, le16_to_cpu(rx_pd->rx_pkt_offset)); + skb_pull(skb, sizeof(pkt_len)); +- +- pkt_len = le16_to_cpu(rx_pd->rx_pkt_length); ++ pkt_len -= sizeof(pkt_len); + + ieee_hdr = (void *)skb->data; + if (ieee80211_is_mgmt(ieee_hdr->frame_control)) { +@@ -422,7 +426,7 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv, + skb->data + sizeof(struct ieee80211_hdr), + pkt_len - sizeof(struct ieee80211_hdr)); + +- pkt_len -= ETH_ALEN + sizeof(pkt_len); ++ pkt_len -= ETH_ALEN; + rx_pd->rx_pkt_length = cpu_to_le16(pkt_len); + + cfg80211_rx_mgmt(&priv->wdev, priv->roc_cfg.chan.center_freq, +-- +2.40.1 + diff --git a/queue-5.4/x86-apm-drop-the-duplicate-apm_minor_dev-macro.patch b/queue-5.4/x86-apm-drop-the-duplicate-apm_minor_dev-macro.patch new file mode 100644 index 00000000000..fccdc8eaccc --- /dev/null +++ b/queue-5.4/x86-apm-drop-the-duplicate-apm_minor_dev-macro.patch @@ -0,0 +1,46 @@ +From 97f73e758df86f68c3ebbc0e81642bc500d79084 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 18:11:20 -0700 +Subject: x86/APM: drop the duplicate APM_MINOR_DEV macro + +From: Randy Dunlap + +[ Upstream commit 4ba2909638a29630a346d6c4907a3105409bee7d ] + +This source file already includes , which contains +the same macro. It doesn't need to be defined here again. + +Fixes: 874bcd00f520 ("apm-emulation: move APM_MINOR_DEV to include/linux/miscdevice.h") +Signed-off-by: Randy Dunlap +Cc: Jiri Kosina +Cc: x86@kernel.org +Cc: Sohil Mehta +Cc: Corentin Labbe +Reviewed-by: Sohil Mehta +Link: https://lore.kernel.org/r/20230728011120.759-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apm_32.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c +index 660270359d393..166d9991e7111 100644 +--- a/arch/x86/kernel/apm_32.c ++++ b/arch/x86/kernel/apm_32.c +@@ -237,12 +237,6 @@ + extern int (*console_blank_hook)(int); + #endif + +-/* +- * The apm_bios device is one of the misc char devices. +- * This is its minor number. +- */ +-#define APM_MINOR_DEV 134 +- + /* + * Various options can be changed at boot time as follows: + * (We allow underscores for compatibility with the modules code) +-- +2.40.1 + diff --git a/queue-5.4/x86-asm-make-more-symbols-local.patch b/queue-5.4/x86-asm-make-more-symbols-local.patch new file mode 100644 index 00000000000..b3effac8b51 --- /dev/null +++ b/queue-5.4/x86-asm-make-more-symbols-local.patch @@ -0,0 +1,114 @@ +From 3768e74bb5a6ecb11a9e308a0d76357c2b190bd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 11:22:13 +0200 +Subject: x86/asm: Make more symbols local + +From: Jiri Slaby + +[ Upstream commit 30a2441cae7b149ff484a697bf9eb8de53240a4f ] + +During the assembly cleanup patchset review, I found more symbols which +are used only locally. So make them really local by prepending ".L" to +them. Namely: + + - wakeup_idt is used only in realmode/rm/wakeup_asm.S. + - in_pm32 is used only in boot/pmjump.S. + - retint_user is used only in entry/entry_64.S, perhaps since commit + 2ec67971facc ("x86/entry/64/compat: Remove most of the fast system + call machinery"), where entry_64_compat's caller was removed. + +Drop GLOBAL from all of them too. I do not see more candidates in the +series. + +Signed-off-by: Jiri Slaby +Acked-by: Borislav Petkov +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: bp@alien8.de +Cc: hpa@zytor.com +Link: https://lkml.kernel.org/r/20191011092213.31470-1-jslaby@suse.cz +Signed-off-by: Ingo Molnar +Stable-dep-of: 264b82fdb498 ("x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved") +Signed-off-by: Sasha Levin +--- + arch/x86/boot/pmjump.S | 6 +++--- + arch/x86/entry/entry_64.S | 4 ++-- + arch/x86/realmode/rm/wakeup_asm.S | 6 +++--- + 3 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/boot/pmjump.S b/arch/x86/boot/pmjump.S +index c22f9a7d1aeb9..ea88d52eeac70 100644 +--- a/arch/x86/boot/pmjump.S ++++ b/arch/x86/boot/pmjump.S +@@ -40,13 +40,13 @@ GLOBAL(protected_mode_jump) + + # Transition to 32-bit mode + .byte 0x66, 0xea # ljmpl opcode +-2: .long in_pm32 # offset ++2: .long .Lin_pm32 # offset + .word __BOOT_CS # segment + ENDPROC(protected_mode_jump) + + .code32 + .section ".text32","ax" +-GLOBAL(in_pm32) ++.Lin_pm32: + # Set up data segments for flat 32-bit mode + movl %ecx, %ds + movl %ecx, %es +@@ -72,4 +72,4 @@ GLOBAL(in_pm32) + lldt %cx + + jmpl *%eax # Jump to the 32-bit entrypoint +-ENDPROC(in_pm32) ++ENDPROC(.Lin_pm32) +diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S +index bd7a4ad0937c4..640c7d36c26c7 100644 +--- a/arch/x86/entry/entry_64.S ++++ b/arch/x86/entry/entry_64.S +@@ -618,7 +618,7 @@ ret_from_intr: + jz retint_kernel + + /* Interrupt came from user space */ +-GLOBAL(retint_user) ++.Lretint_user: + mov %rsp,%rdi + call prepare_exit_to_usermode + TRACE_IRQS_IRETQ +@@ -1392,7 +1392,7 @@ ENTRY(error_exit) + TRACE_IRQS_OFF + testb $3, CS(%rsp) + jz retint_kernel +- jmp retint_user ++ jmp .Lretint_user + END(error_exit) + + /* +diff --git a/arch/x86/realmode/rm/wakeup_asm.S b/arch/x86/realmode/rm/wakeup_asm.S +index 05ac9c17c8111..dad6198f1a266 100644 +--- a/arch/x86/realmode/rm/wakeup_asm.S ++++ b/arch/x86/realmode/rm/wakeup_asm.S +@@ -73,7 +73,7 @@ ENTRY(wakeup_start) + movw %ax, %fs + movw %ax, %gs + +- lidtl wakeup_idt ++ lidtl .Lwakeup_idt + + /* Clear the EFLAGS */ + pushl $0 +@@ -171,8 +171,8 @@ END(wakeup_gdt) + + /* This is the standard real-mode IDT */ + .balign 16 +-GLOBAL(wakeup_idt) ++.Lwakeup_idt: + .word 0xffff /* limit */ + .long 0 /* address */ + .word 0 +-END(wakeup_idt) ++END(.Lwakeup_idt) +-- +2.40.1 + diff --git a/queue-5.4/x86-boot-annotate-local-functions.patch b/queue-5.4/x86-boot-annotate-local-functions.patch new file mode 100644 index 00000000000..ef81035a17e --- /dev/null +++ b/queue-5.4/x86-boot-annotate-local-functions.patch @@ -0,0 +1,127 @@ +From 6e1dd0156493e0c9c62d07759f14944698875170 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 13:50:47 +0200 +Subject: x86/boot: Annotate local functions + +From: Jiri Slaby + +[ Upstream commit deff8a24e1021fb39dddf5f6bc5832e0e3a632ea ] + +.Lrelocated, .Lpaging_enabled, .Lno_longmode, and .Lin_pm32 are +self-standing local functions, annotate them as such and preserve "no +alignment". + +The annotations do not generate anything yet. + +Signed-off-by: Jiri Slaby +Signed-off-by: Borislav Petkov +Cc: Cao jin +Cc: Greg Kroah-Hartman +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Kate Stewart +Cc: "Kirill A. Shutemov" +Cc: linux-arch@vger.kernel.org +Cc: Thomas Gleixner +Cc: Wei Huang +Cc: x86-ml +Cc: Xiaoyao Li +Link: https://lkml.kernel.org/r/20191011115108.12392-8-jslaby@suse.cz +Stable-dep-of: 264b82fdb498 ("x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved") +Signed-off-by: Sasha Levin +--- + arch/x86/boot/compressed/head_32.S | 3 ++- + arch/x86/boot/compressed/head_64.S | 9 ++++++--- + arch/x86/boot/pmjump.S | 4 ++-- + 3 files changed, 10 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S +index d7c0fcc1dbf9e..b788b986f3351 100644 +--- a/arch/x86/boot/compressed/head_32.S ++++ b/arch/x86/boot/compressed/head_32.S +@@ -210,7 +210,7 @@ ENDPROC(efi32_stub_entry) + #endif + + .text +-.Lrelocated: ++SYM_FUNC_START_LOCAL_NOALIGN(.Lrelocated) + + /* + * Clear BSS (stack is currently empty) +@@ -261,6 +261,7 @@ ENDPROC(efi32_stub_entry) + */ + xorl %ebx, %ebx + jmp *%eax ++SYM_FUNC_END(.Lrelocated) + + #ifdef CONFIG_EFI_STUB + .data +diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S +index 50c9eeb36f0d8..95ee795d97964 100644 +--- a/arch/x86/boot/compressed/head_64.S ++++ b/arch/x86/boot/compressed/head_64.S +@@ -517,7 +517,7 @@ ENDPROC(efi64_stub_entry) + #endif + + .text +-.Lrelocated: ++SYM_FUNC_START_LOCAL_NOALIGN(.Lrelocated) + + /* + * Clear BSS (stack is currently empty) +@@ -546,6 +546,7 @@ ENDPROC(efi64_stub_entry) + * Jump to the decompressed kernel. + */ + jmp *%rax ++SYM_FUNC_END(.Lrelocated) + + /* + * Adjust the global offset table +@@ -641,9 +642,10 @@ ENTRY(trampoline_32bit_src) + lret + + .code64 +-.Lpaging_enabled: ++SYM_FUNC_START_LOCAL_NOALIGN(.Lpaging_enabled) + /* Return from the trampoline */ + jmp *%rdi ++SYM_FUNC_END(.Lpaging_enabled) + + /* + * The trampoline code has a size limit. +@@ -653,11 +655,12 @@ ENTRY(trampoline_32bit_src) + .org trampoline_32bit_src + TRAMPOLINE_32BIT_CODE_SIZE + + .code32 +-.Lno_longmode: ++SYM_FUNC_START_LOCAL_NOALIGN(.Lno_longmode) + /* This isn't an x86-64 CPU, so hang intentionally, we cannot continue */ + 1: + hlt + jmp 1b ++SYM_FUNC_END(.Lno_longmode) + + #include "../../kernel/verify_cpu.S" + +diff --git a/arch/x86/boot/pmjump.S b/arch/x86/boot/pmjump.S +index ea88d52eeac70..81658fe353808 100644 +--- a/arch/x86/boot/pmjump.S ++++ b/arch/x86/boot/pmjump.S +@@ -46,7 +46,7 @@ ENDPROC(protected_mode_jump) + + .code32 + .section ".text32","ax" +-.Lin_pm32: ++SYM_FUNC_START_LOCAL_NOALIGN(.Lin_pm32) + # Set up data segments for flat 32-bit mode + movl %ecx, %ds + movl %ecx, %es +@@ -72,4 +72,4 @@ ENDPROC(protected_mode_jump) + lldt %cx + + jmpl *%eax # Jump to the 32-bit entrypoint +-ENDPROC(.Lin_pm32) ++SYM_FUNC_END(.Lin_pm32) +-- +2.40.1 + diff --git a/queue-5.4/x86-decompressor-don-t-rely-on-upper-32-bits-of-gprs.patch b/queue-5.4/x86-decompressor-don-t-rely-on-upper-32-bits-of-gprs.patch new file mode 100644 index 00000000000..840d8ff933f --- /dev/null +++ b/queue-5.4/x86-decompressor-don-t-rely-on-upper-32-bits-of-gprs.patch @@ -0,0 +1,113 @@ +From 6fd234885c819b460c628881f1392480c7771002 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Aug 2023 18:26:58 +0200 +Subject: x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ard Biesheuvel + +[ Upstream commit 264b82fdb4989cf6a44a2bcd0c6ea05e8026b2ac ] + +The 4-to-5 level mode switch trampoline disables long mode and paging in +order to be able to flick the LA57 bit. According to section 3.4.1.1 of +the x86 architecture manual [0], 64-bit GPRs might not retain the upper +32 bits of their contents across such a mode switch. + +Given that RBP, RBX and RSI are live at this point, preserve them on the +stack, along with the return address that might be above 4G as well. + +[0] Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture + + "Because the upper 32 bits of 64-bit general-purpose registers are + undefined in 32-bit modes, the upper 32 bits of any general-purpose + register are not preserved when switching from 64-bit mode to a 32-bit + mode (to protected mode or compatibility mode). Software must not + depend on these bits to maintain a value after a 64-bit to 32-bit + mode switch." + +Fixes: 194a9749c73d650c ("x86/boot/compressed/64: Handle 5-level paging boot if kernel is above 4G") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230807162720.545787-2-ardb@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/boot/compressed/head_64.S | 30 +++++++++++++++++++++++------- + 1 file changed, 23 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S +index 95ee795d97964..d8164e6abaaff 100644 +--- a/arch/x86/boot/compressed/head_64.S ++++ b/arch/x86/boot/compressed/head_64.S +@@ -381,11 +381,25 @@ ENTRY(startup_64) + /* Save the trampoline address in RCX */ + movq %rax, %rcx + ++ /* Set up 32-bit addressable stack */ ++ leaq TRAMPOLINE_32BIT_STACK_END(%rcx), %rsp ++ ++ /* ++ * Preserve live 64-bit registers on the stack: this is necessary ++ * because the architecture does not guarantee that GPRs will retain ++ * their full 64-bit values across a 32-bit mode switch. ++ */ ++ pushq %rbp ++ pushq %rbx ++ pushq %rsi ++ + /* +- * Load the address of trampoline_return() into RDI. +- * It will be used by the trampoline to return to the main code. ++ * Push the 64-bit address of trampoline_return() onto the new stack. ++ * It will be used by the trampoline to return to the main code. Due to ++ * the 32-bit mode switch, it cannot be kept it in a register either. + */ + leaq trampoline_return(%rip), %rdi ++ pushq %rdi + + /* Switch to compatibility mode (CS.L = 0 CS.D = 1) via far return */ + pushq $__KERNEL32_CS +@@ -393,6 +407,11 @@ ENTRY(startup_64) + pushq %rax + lretq + trampoline_return: ++ /* Restore live 64-bit registers */ ++ popq %rsi ++ popq %rbx ++ popq %rbp ++ + /* Restore the stack, the 32-bit trampoline uses its own stack */ + leaq boot_stack_end(%rbx), %rsp + +@@ -573,7 +592,7 @@ SYM_FUNC_END(.Lrelocated) + /* + * This is the 32-bit trampoline that will be copied over to low memory. + * +- * RDI contains the return address (might be above 4G). ++ * Return address is at the top of the stack (might be above 4G). + * ECX contains the base address of the trampoline memory. + * Non zero RDX means trampoline needs to enable 5-level paging. + */ +@@ -583,9 +602,6 @@ ENTRY(trampoline_32bit_src) + movl %eax, %ds + movl %eax, %ss + +- /* Set up new stack */ +- leal TRAMPOLINE_32BIT_STACK_END(%ecx), %esp +- + /* Disable paging */ + movl %cr0, %eax + btrl $X86_CR0_PG_BIT, %eax +@@ -644,7 +660,7 @@ ENTRY(trampoline_32bit_src) + .code64 + SYM_FUNC_START_LOCAL_NOALIGN(.Lpaging_enabled) + /* Return from the trampoline */ +- jmp *%rdi ++ retq + SYM_FUNC_END(.Lpaging_enabled) + + /* +-- +2.40.1 + diff --git a/queue-5.4/x86-speculation-mark-all-skylake-cpus-as-vulnerable-.patch b/queue-5.4/x86-speculation-mark-all-skylake-cpus-as-vulnerable-.patch new file mode 100644 index 00000000000..a838e074edd --- /dev/null +++ b/queue-5.4/x86-speculation-mark-all-skylake-cpus-as-vulnerable-.patch @@ -0,0 +1,76 @@ +From a7761ea02692f01e4c093fb1da43bb744f7c6f86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Aug 2023 08:07:25 -0700 +Subject: x86/speculation: Mark all Skylake CPUs as vulnerable to GDS + +From: Dave Hansen + +[ Upstream commit c9f4c45c8ec3f07f4f083f9750032a1ec3eab6b2 ] + +The Gather Data Sampling (GDS) vulnerability is common to all Skylake +processors. However, the "client" Skylakes* are now in this list: + + https://www.intel.com/content/www/us/en/support/articles/000022396/processors.html + +which means they are no longer included for new vulnerabilities here: + + https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html + +or in other GDS documentation. Thus, they were not included in the +original GDS mitigation patches. + +Mark SKYLAKE and SKYLAKE_L as vulnerable to GDS to match all the +other Skylake CPUs (which include Kaby Lake). Also group the CPUs +so that the ones that share the exact same vulnerabilities are next +to each other. + +Last, move SRBDS to the end of each line. This makes it clear at a +glance that SKYLAKE_X is unique. Of the five Skylakes, it is the +only "server" CPU and has a different implementation from the +clients of the "special register" hardware, making it immune to SRBDS. + +This makes the diff much harder to read, but the resulting table is +worth it. + +I very much appreciate the report from Michael Zhivich about this +issue. Despite what level of support a hardware vendor is providing, +the kernel very much needs an accurate and up-to-date list of +vulnerable CPUs. More reports like this are very welcome. + +* Client Skylakes are CPUID 406E3/506E3 which is family 6, models + 0x4E and 0x5E, aka INTEL_FAM6_SKYLAKE and INTEL_FAM6_SKYLAKE_L. + +Reported-by: Michael Zhivich +Fixes: 8974eb588283 ("x86/speculation: Add Gather Data Sampling mitigation") +Signed-off-by: Dave Hansen +Signed-off-by: Ingo Molnar +Reviewed-by: Daniel Sneddon +Cc: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/common.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 0c0c2cb038ad2..1592f309c3c1f 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1147,11 +1147,11 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { + VULNBL_INTEL_STEPPINGS(BROADWELL_G, X86_STEPPING_ANY, SRBDS), + VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO), + VULNBL_INTEL_STEPPINGS(BROADWELL, X86_STEPPING_ANY, SRBDS), +- VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED), + VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED | GDS), +- VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED), +- VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS), +- VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS), ++ VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), ++ VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), ++ VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), ++ VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS), + VULNBL_INTEL_STEPPINGS(CANNONLAKE_L, X86_STEPPING_ANY, RETBLEED), + VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS), + VULNBL_INTEL_STEPPINGS(ICELAKE_D, X86_STEPPING_ANY, MMIO | GDS), +-- +2.40.1 +