From: Greg Kroah-Hartman Date: Sun, 16 Oct 2022 07:24:14 +0000 (+0200) Subject: 5.19-stable patches X-Git-Tag: v5.4.219~178 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=911a7f2b231f1484c5689e23fc9b9c6633e1366d;p=thirdparty%2Fkernel%2Fstable-queue.git 5.19-stable patches added patches: can-kvaser_usb-fix-use-of-uninitialized-completion.patch can-kvaser_usb_leaf-fix-can-state-after-restart.patch can-kvaser_usb_leaf-fix-overread-with-an-invalid-command.patch can-kvaser_usb_leaf-fix-tx-queue-out-of-sync-after-restart.patch cifs-destage-dirty-pages-before-re-reading-them-for-cache-none.patch cifs-fix-the-error-length-of-validate_negotiate_info-message.patch hv_netvsc-fix-race-between-vf-offering-and-vf-association-message-from-host.patch i2c-designware-fix-handling-of-real-but-unexpected-device-interrupts.patch iio-adc-ad7923-fix-channel-readings-for-some-variants.patch iio-dac-ad5593r-fix-i2c-read-protocol-requirements.patch iio-ltc2497-fix-reading-conversion-results.patch iio-pressure-dps310-refactor-startup-procedure.patch iio-pressure-dps310-reset-chip-after-timeout.patch mmc-core-add-sd-card-quirk-for-broken-discard.patch mmc-renesas_sdhi-fix-rounding-errors.patch mmc-sdhci-sprd-fix-minimum-clock-limit.patch mmc-sdhci-tegra-use-actual-clock-rate-for-sw-tuning-correction.patch usb-add-quirks-for-lenovo-onelink-dock.patch usb-gadget-uvc-fix-argument-to-sizeof-in-uvc_register_video.patch xhci-dbc-fix-memory-leak-in-xhci_alloc_dbc.patch --- diff --git a/queue-5.19/can-kvaser_usb-fix-use-of-uninitialized-completion.patch b/queue-5.19/can-kvaser_usb-fix-use-of-uninitialized-completion.patch new file mode 100644 index 00000000000..c15f53aa322 --- /dev/null +++ b/queue-5.19/can-kvaser_usb-fix-use-of-uninitialized-completion.patch @@ -0,0 +1,57 @@ +From cd7f30e174d09a02ca2afa5ef093fb0f0352e0d8 Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Mon, 10 Oct 2022 17:08:27 +0200 +Subject: can: kvaser_usb: Fix use of uninitialized completion + +From: Anssi Hannula + +commit cd7f30e174d09a02ca2afa5ef093fb0f0352e0d8 upstream. + +flush_comp is initialized when CMD_FLUSH_QUEUE is sent to the device and +completed when the device sends CMD_FLUSH_QUEUE_RESP. + +This causes completion of uninitialized completion if the device sends +CMD_FLUSH_QUEUE_RESP before CMD_FLUSH_QUEUE is ever sent (e.g. as a +response to a flush by a previously bound driver, or a misbehaving +device). + +Fix that by initializing flush_comp in kvaser_usb_init_one() like the +other completions. + +This issue is only triggerable after RX URBs have been set up, i.e. the +interface has been opened at least once. + +Cc: stable@vger.kernel.org +Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family") +Tested-by: Jimmy Assarsson +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010150829.199676-3-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 + + drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +@@ -712,6 +712,7 @@ static int kvaser_usb_init_one(struct kv + init_usb_anchor(&priv->tx_submitted); + init_completion(&priv->start_comp); + init_completion(&priv->stop_comp); ++ init_completion(&priv->flush_comp); + priv->can.ctrlmode_supported = 0; + + priv->dev = dev; +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -1914,7 +1914,7 @@ static int kvaser_usb_hydra_flush_queue( + { + int err; + +- init_completion(&priv->flush_comp); ++ reinit_completion(&priv->flush_comp); + + err = kvaser_usb_hydra_send_simple_cmd(priv->dev, CMD_FLUSH_QUEUE, + priv->channel); diff --git a/queue-5.19/can-kvaser_usb_leaf-fix-can-state-after-restart.patch b/queue-5.19/can-kvaser_usb_leaf-fix-can-state-after-restart.patch new file mode 100644 index 00000000000..f8efe37ea95 --- /dev/null +++ b/queue-5.19/can-kvaser_usb_leaf-fix-can-state-after-restart.patch @@ -0,0 +1,40 @@ +From 0be1a655fe68c8e6dcadbcbddb69cf2fb29881f5 Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Mon, 10 Oct 2022 17:08:29 +0200 +Subject: can: kvaser_usb_leaf: Fix CAN state after restart + +From: Anssi Hannula + +commit 0be1a655fe68c8e6dcadbcbddb69cf2fb29881f5 upstream. + +can_restart() expects CMD_START_CHIP to set the error state to +ERROR_ACTIVE as it calls netif_carrier_on() immediately afterwards. + +Otherwise the user may immediately trigger restart again and hit a +BUG_ON() in can_restart(). + +Fix kvaser_usb_leaf set_mode(CMD_START_CHIP) to set the expected state. + +Cc: stable@vger.kernel.org +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Tested-by: Jimmy Assarsson +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010150829.199676-5-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -1430,6 +1430,8 @@ static int kvaser_usb_leaf_set_mode(stru + err = kvaser_usb_leaf_simple_cmd_async(priv, CMD_START_CHIP); + if (err) + return err; ++ ++ priv->can.state = CAN_STATE_ERROR_ACTIVE; + break; + default: + return -EOPNOTSUPP; diff --git a/queue-5.19/can-kvaser_usb_leaf-fix-overread-with-an-invalid-command.patch b/queue-5.19/can-kvaser_usb_leaf-fix-overread-with-an-invalid-command.patch new file mode 100644 index 00000000000..b77ee42d1eb --- /dev/null +++ b/queue-5.19/can-kvaser_usb_leaf-fix-overread-with-an-invalid-command.patch @@ -0,0 +1,143 @@ +From 1499ecaea9d2ba68d5e18d80573b4561a8dc4ee7 Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Mon, 10 Oct 2022 17:08:26 +0200 +Subject: can: kvaser_usb_leaf: Fix overread with an invalid command + +From: Anssi Hannula + +commit 1499ecaea9d2ba68d5e18d80573b4561a8dc4ee7 upstream. + +For command events read from the device, +kvaser_usb_leaf_read_bulk_callback() verifies that cmd->len does not +exceed the size of the received data, but the actual kvaser_cmd handlers +will happily read any kvaser_cmd fields without checking for cmd->len. + +This can cause an overread if the last cmd in the buffer is shorter than +expected for the command type (with cmd->len showing the actual short +size). + +Maximum overread seems to be 22 bytes (CMD_LEAF_LOG_MESSAGE), some of +which are delivered to userspace as-is. + +Fix that by verifying the length of command before handling it. + +This issue can only occur after RX URBs have been set up, i.e. the +interface has been opened at least once. + +Cc: stable@vger.kernel.org +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Tested-by: Jimmy Assarsson +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010150829.199676-2-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 75 +++++++++++++++++++++++ + 1 file changed, 75 insertions(+) + +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -310,6 +310,38 @@ struct kvaser_cmd { + } u; + } __packed; + ++#define CMD_SIZE_ANY 0xff ++#define kvaser_fsize(field) sizeof_field(struct kvaser_cmd, field) ++ ++static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = { ++ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple), ++ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple), ++ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo), ++ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header), ++ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.leaf.softinfo), ++ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.leaf.rx_can), ++ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.leaf.rx_can), ++ [CMD_LEAF_LOG_MESSAGE] = kvaser_fsize(u.leaf.log_message), ++ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event), ++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event), ++ /* ignored events: */ ++ [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY, ++}; ++ ++static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = { ++ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple), ++ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple), ++ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo), ++ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header), ++ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.usbcan.softinfo), ++ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.usbcan.rx_can), ++ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.usbcan.rx_can), ++ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.usbcan.chip_state_event), ++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.error_event), ++ /* ignored events: */ ++ [CMD_USBCAN_CLOCK_OVERFLOW_EVENT] = CMD_SIZE_ANY, ++}; ++ + /* Summary of a kvaser error event, for a unified Leaf/Usbcan error + * handling. Some discrepancies between the two families exist: + * +@@ -397,6 +429,43 @@ static const struct kvaser_usb_dev_cfg k + .bittiming_const = &kvaser_usb_flexc_bittiming_const, + }; + ++static int kvaser_usb_leaf_verify_size(const struct kvaser_usb *dev, ++ const struct kvaser_cmd *cmd) ++{ ++ /* buffer size >= cmd->len ensured by caller */ ++ u8 min_size = 0; ++ ++ switch (dev->driver_info->family) { ++ case KVASER_LEAF: ++ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_leaf)) ++ min_size = kvaser_usb_leaf_cmd_sizes_leaf[cmd->id]; ++ break; ++ case KVASER_USBCAN: ++ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_usbcan)) ++ min_size = kvaser_usb_leaf_cmd_sizes_usbcan[cmd->id]; ++ break; ++ } ++ ++ if (min_size == CMD_SIZE_ANY) ++ return 0; ++ ++ if (min_size) { ++ min_size += CMD_HEADER_LEN; ++ if (cmd->len >= min_size) ++ return 0; ++ ++ dev_err_ratelimited(&dev->intf->dev, ++ "Received command %u too short (size %u, needed %u)", ++ cmd->id, cmd->len, min_size); ++ return -EIO; ++ } ++ ++ dev_warn_ratelimited(&dev->intf->dev, ++ "Unhandled command (%d, size %d)\n", ++ cmd->id, cmd->len); ++ return -EINVAL; ++} ++ + static void * + kvaser_usb_leaf_frame_to_cmd(const struct kvaser_usb_net_priv *priv, + const struct sk_buff *skb, int *cmd_len, +@@ -502,6 +571,9 @@ static int kvaser_usb_leaf_wait_cmd(cons + end: + kfree(buf); + ++ if (err == 0) ++ err = kvaser_usb_leaf_verify_size(dev, cmd); ++ + return err; + } + +@@ -1132,6 +1204,9 @@ static void kvaser_usb_leaf_stop_chip_re + static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev, + const struct kvaser_cmd *cmd) + { ++ if (kvaser_usb_leaf_verify_size(dev, cmd) < 0) ++ return; ++ + switch (cmd->id) { + case CMD_START_CHIP_REPLY: + kvaser_usb_leaf_start_chip_reply(dev, cmd); diff --git a/queue-5.19/can-kvaser_usb_leaf-fix-tx-queue-out-of-sync-after-restart.patch b/queue-5.19/can-kvaser_usb_leaf-fix-tx-queue-out-of-sync-after-restart.patch new file mode 100644 index 00000000000..1017beae2b9 --- /dev/null +++ b/queue-5.19/can-kvaser_usb_leaf-fix-tx-queue-out-of-sync-after-restart.patch @@ -0,0 +1,68 @@ +From 455561fb618fde40558776b5b8435f9420f335db Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Mon, 10 Oct 2022 17:08:28 +0200 +Subject: can: kvaser_usb_leaf: Fix TX queue out of sync after restart + +From: Anssi Hannula + +commit 455561fb618fde40558776b5b8435f9420f335db upstream. + +The TX queue seems to be implicitly flushed by the hardware during +bus-off or bus-off recovery, but the driver does not reset the TX +bookkeeping. + +Despite not resetting TX bookkeeping the driver still re-enables TX +queue unconditionally, leading to "cannot find free context" / +NETDEV_TX_BUSY errors if the TX queue was full at bus-off time. + +Fix that by resetting TX bookkeeping on CAN restart. + +Tested with 0bfd:0124 Kvaser Mini PCI Express 2xHS FW 4.18.778. + +Cc: stable@vger.kernel.org +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Tested-by: Jimmy Assarsson +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010150829.199676-4-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 2 ++ + drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 +- + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 2 ++ + 3 files changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h +@@ -177,6 +177,8 @@ struct kvaser_usb_dev_cfg { + extern const struct kvaser_usb_dev_ops kvaser_usb_hydra_dev_ops; + extern const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops; + ++void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv); ++ + int kvaser_usb_recv_cmd(const struct kvaser_usb *dev, void *cmd, int len, + int *actual_len); + +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +@@ -476,7 +476,7 @@ static void kvaser_usb_reset_tx_urb_cont + /* This method might sleep. Do not call it in the atomic context + * of URB completions. + */ +-static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv) ++void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv) + { + usb_kill_anchored_urbs(&priv->tx_submitted); + kvaser_usb_reset_tx_urb_contexts(priv); +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -1425,6 +1425,8 @@ static int kvaser_usb_leaf_set_mode(stru + + switch (mode) { + case CAN_MODE_START: ++ kvaser_usb_unlink_tx_urbs(priv); ++ + err = kvaser_usb_leaf_simple_cmd_async(priv, CMD_START_CHIP); + if (err) + return err; diff --git a/queue-5.19/cifs-destage-dirty-pages-before-re-reading-them-for-cache-none.patch b/queue-5.19/cifs-destage-dirty-pages-before-re-reading-them-for-cache-none.patch new file mode 100644 index 00000000000..b9a15b361d9 --- /dev/null +++ b/queue-5.19/cifs-destage-dirty-pages-before-re-reading-them-for-cache-none.patch @@ -0,0 +1,44 @@ +From bb44c31cdcac107344dd2fcc3bd0504a53575c51 Mon Sep 17 00:00:00 2001 +From: Ronnie Sahlberg +Date: Tue, 20 Sep 2022 14:32:02 +1000 +Subject: cifs: destage dirty pages before re-reading them for cache=none + +From: Ronnie Sahlberg + +commit bb44c31cdcac107344dd2fcc3bd0504a53575c51 upstream. + +This is the opposite case of kernel bugzilla 216301. +If we mmap a file using cache=none and then proceed to update the mmapped +area these updates are not reflected in a later pread() of that part of the +file. +To fix this we must first destage any dirty pages in the range before +we allow the pread() to proceed. + +Cc: stable@vger.kernel.org +Reviewed-by: Paulo Alcantara (SUSE) +Reviewed-by: Enzo Matsumiya +Signed-off-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/file.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -4024,6 +4024,15 @@ static ssize_t __cifs_readv( + len = ctx->len; + } + ++ if (direct) { ++ rc = filemap_write_and_wait_range(file->f_inode->i_mapping, ++ offset, offset + len - 1); ++ if (rc) { ++ kref_put(&ctx->refcount, cifs_aio_ctx_release); ++ return -EAGAIN; ++ } ++ } ++ + /* grab a lock here due to read response handlers can access ctx */ + mutex_lock(&ctx->aio_mutex); + diff --git a/queue-5.19/cifs-fix-the-error-length-of-validate_negotiate_info-message.patch b/queue-5.19/cifs-fix-the-error-length-of-validate_negotiate_info-message.patch new file mode 100644 index 00000000000..26e2f261ceb --- /dev/null +++ b/queue-5.19/cifs-fix-the-error-length-of-validate_negotiate_info-message.patch @@ -0,0 +1,45 @@ +From e98ecc6e94f4e6d21c06660b0f336df02836694f Mon Sep 17 00:00:00 2001 +From: Zhang Xiaoxu +Date: Mon, 26 Sep 2022 11:36:29 +0800 +Subject: cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message + +From: Zhang Xiaoxu + +commit e98ecc6e94f4e6d21c06660b0f336df02836694f upstream. + +Commit d5c7076b772a ("smb3: add smb3.1.1 to default dialect list") +extend the dialects from 3 to 4, but forget to decrease the extended +length when specific the dialect, then the message length is larger +than expected. + +This maybe leak some info through network because not initialize the +message body. + +After apply this patch, the VALIDATE_NEGOTIATE_INFO message length is +reduced from 28 bytes to 26 bytes. + +Fixes: d5c7076b772a ("smb3: add smb3.1.1 to default dialect list") +Signed-off-by: Zhang Xiaoxu +Cc: +Acked-by: Paulo Alcantara (SUSE) +Reviewed-by: Tom Talpey +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/smb2pdu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1168,9 +1168,9 @@ int smb3_validate_negotiate(const unsign + pneg_inbuf->Dialects[0] = + cpu_to_le16(server->vals->protocol_id); + pneg_inbuf->DialectCount = cpu_to_le16(1); +- /* structure is big enough for 3 dialects, sending only 1 */ ++ /* structure is big enough for 4 dialects, sending only 1 */ + inbuflen = sizeof(*pneg_inbuf) - +- sizeof(pneg_inbuf->Dialects[0]) * 2; ++ sizeof(pneg_inbuf->Dialects[0]) * 3; + } + + rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, diff --git a/queue-5.19/hv_netvsc-fix-race-between-vf-offering-and-vf-association-message-from-host.patch b/queue-5.19/hv_netvsc-fix-race-between-vf-offering-and-vf-association-message-from-host.patch new file mode 100644 index 00000000000..bb8f9b8735a --- /dev/null +++ b/queue-5.19/hv_netvsc-fix-race-between-vf-offering-and-vf-association-message-from-host.patch @@ -0,0 +1,101 @@ +From 365e1ececb2905f94cc10a5817c5b644a32a3ae2 Mon Sep 17 00:00:00 2001 +From: Gaurav Kohli +Date: Wed, 5 Oct 2022 22:52:59 -0700 +Subject: hv_netvsc: Fix race between VF offering and VF association message from host + +From: Gaurav Kohli + +commit 365e1ececb2905f94cc10a5817c5b644a32a3ae2 upstream. + +During vm boot, there might be possibility that vf registration +call comes before the vf association from host to vm. + +And this might break netvsc vf path, To prevent the same block +vf registration until vf bind message comes from host. + +Cc: stable@vger.kernel.org +Fixes: 00d7ddba11436 ("hv_netvsc: pair VF based on serial number") +Reviewed-by: Haiyang Zhang +Signed-off-by: Gaurav Kohli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/hyperv/hyperv_net.h | 3 ++- + drivers/net/hyperv/netvsc.c | 4 ++++ + drivers/net/hyperv/netvsc_drv.c | 19 +++++++++++++++++++ + 3 files changed, 25 insertions(+), 1 deletion(-) + +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -1051,7 +1051,8 @@ struct net_device_context { + u32 vf_alloc; + /* Serial number of the VF to team with */ + u32 vf_serial; +- ++ /* completion variable to confirm vf association */ ++ struct completion vf_add; + /* Is the current data path through the VF NIC? */ + bool data_path_is_vf; + +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -1580,6 +1580,10 @@ static void netvsc_send_vf(struct net_de + + net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated; + net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial; ++ ++ if (net_device_ctx->vf_alloc) ++ complete(&net_device_ctx->vf_add); ++ + netdev_info(ndev, "VF slot %u %s\n", + net_device_ctx->vf_serial, + net_device_ctx->vf_alloc ? "added" : "removed"); +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -2313,6 +2313,18 @@ static struct net_device *get_netvsc_bys + + } + ++ /* Fallback path to check synthetic vf with ++ * help of mac addr ++ */ ++ list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) { ++ ndev = hv_get_drvdata(ndev_ctx->device_ctx); ++ if (ether_addr_equal(vf_netdev->perm_addr, ndev->perm_addr)) { ++ netdev_notice(vf_netdev, ++ "falling back to mac addr based matching\n"); ++ return ndev; ++ } ++ } ++ + netdev_notice(vf_netdev, + "no netdev found for vf serial:%u\n", serial); + return NULL; +@@ -2409,6 +2421,11 @@ static int netvsc_vf_changed(struct net_ + if (net_device_ctx->data_path_is_vf == vf_is_up) + return NOTIFY_OK; + ++ if (vf_is_up && !net_device_ctx->vf_alloc) { ++ netdev_info(ndev, "Waiting for the VF association from host\n"); ++ wait_for_completion(&net_device_ctx->vf_add); ++ } ++ + ret = netvsc_switch_datapath(ndev, vf_is_up); + + if (ret) { +@@ -2440,6 +2457,7 @@ static int netvsc_unregister_vf(struct n + + netvsc_vf_setxdp(vf_netdev, NULL); + ++ reinit_completion(&net_device_ctx->vf_add); + netdev_rx_handler_unregister(vf_netdev); + netdev_upper_dev_unlink(vf_netdev, ndev); + RCU_INIT_POINTER(net_device_ctx->vf_netdev, NULL); +@@ -2479,6 +2497,7 @@ static int netvsc_probe(struct hv_device + + INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change); + ++ init_completion(&net_device_ctx->vf_add); + spin_lock_init(&net_device_ctx->lock); + INIT_LIST_HEAD(&net_device_ctx->reconfig_events); + INIT_DELAYED_WORK(&net_device_ctx->vf_takeover, netvsc_vf_setup); diff --git a/queue-5.19/i2c-designware-fix-handling-of-real-but-unexpected-device-interrupts.patch b/queue-5.19/i2c-designware-fix-handling-of-real-but-unexpected-device-interrupts.patch new file mode 100644 index 00000000000..73b76c43948 --- /dev/null +++ b/queue-5.19/i2c-designware-fix-handling-of-real-but-unexpected-device-interrupts.patch @@ -0,0 +1,109 @@ +From 301c8f5c32c8fb79c67539bc23972dc3ef48024c Mon Sep 17 00:00:00 2001 +From: Jarkko Nikula +Date: Tue, 27 Sep 2022 16:56:44 +0300 +Subject: i2c: designware: Fix handling of real but unexpected device interrupts + +From: Jarkko Nikula + +commit 301c8f5c32c8fb79c67539bc23972dc3ef48024c upstream. + +Commit c7b79a752871 ("mfd: intel-lpss: Add Intel Alder Lake PCH-S PCI +IDs") caused a regression on certain Gigabyte motherboards for Intel +Alder Lake-S where system crashes to NULL pointer dereference in +i2c_dw_xfer_msg() when system resumes from S3 sleep state ("deep"). + +I was able to debug the issue on Gigabyte Z690 AORUS ELITE and made +following notes: + +- Issue happens when resuming from S3 but not when resuming from + "s2idle" +- PCI device 00:15.0 == i2c_designware.0 is already in D0 state when + system enters into pci_pm_resume_noirq() while all other i2c_designware + PCI devices are in D3. Devices were runtime suspended and in D3 prior + entering into suspend +- Interrupt comes after pci_pm_resume_noirq() when device interrupts are + re-enabled +- According to register dump the interrupt really comes from the + i2c_designware.0. Controller is enabled, I2C target address register + points to a one detectable I2C device address 0x60 and the + DW_IC_RAW_INTR_STAT register START_DET, STOP_DET, ACTIVITY and + TX_EMPTY bits are set indicating completed I2C transaction. + +My guess is that the firmware uses this controller to communicate with +an on-board I2C device during resume but does not disable the controller +before giving control to an operating system. + +I was told the UEFI update fixes this but never the less it revealed the +driver is not ready to handle TX_EMPTY (or RX_FULL) interrupt when device +is supposed to be idle and state variables are not set (especially the +dev->msgs pointer which may point to NULL or stale old data). + +Introduce a new software status flag STATUS_ACTIVE indicating when the +controller is active in driver point of view. Now treat all interrupts +that occur when is not set as unexpected and mask all interrupts from +the controller. + +Fixes: c7b79a752871 ("mfd: intel-lpss: Add Intel Alder Lake PCH-S PCI IDs") +Reported-by: Samuel Clark +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215907 +Cc: stable@vger.kernel.org # v5.12+ +Signed-off-by: Jarkko Nikula +Reviewed-by: Andy Shevchenko +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-designware-core.h | 7 +++++-- + drivers/i2c/busses/i2c-designware-master.c | 13 +++++++++++++ + 2 files changed, 18 insertions(+), 2 deletions(-) + +--- a/drivers/i2c/busses/i2c-designware-core.h ++++ b/drivers/i2c/busses/i2c-designware-core.h +@@ -126,8 +126,9 @@ + * status codes + */ + #define STATUS_IDLE 0x0 +-#define STATUS_WRITE_IN_PROGRESS 0x1 +-#define STATUS_READ_IN_PROGRESS 0x2 ++#define STATUS_ACTIVE 0x1 ++#define STATUS_WRITE_IN_PROGRESS 0x2 ++#define STATUS_READ_IN_PROGRESS 0x4 + + /* + * operation modes +@@ -334,12 +335,14 @@ void i2c_dw_disable_int(struct dw_i2c_de + + static inline void __i2c_dw_enable(struct dw_i2c_dev *dev) + { ++ dev->status |= STATUS_ACTIVE; + regmap_write(dev->map, DW_IC_ENABLE, 1); + } + + static inline void __i2c_dw_disable_nowait(struct dw_i2c_dev *dev) + { + regmap_write(dev->map, DW_IC_ENABLE, 0); ++ dev->status &= ~STATUS_ACTIVE; + } + + void __i2c_dw_disable(struct dw_i2c_dev *dev); +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -716,6 +716,19 @@ static int i2c_dw_irq_handler_master(str + u32 stat; + + stat = i2c_dw_read_clear_intrbits(dev); ++ ++ if (!(dev->status & STATUS_ACTIVE)) { ++ /* ++ * Unexpected interrupt in driver point of view. State ++ * variables are either unset or stale so acknowledge and ++ * disable interrupts for suppressing further interrupts if ++ * interrupt really came from this HW (E.g. firmware has left ++ * the HW active). ++ */ ++ regmap_write(dev->map, DW_IC_INTR_MASK, 0); ++ return 0; ++ } ++ + if (stat & DW_IC_INTR_TX_ABRT) { + dev->cmd_err |= DW_IC_ERR_TX_ABRT; + dev->status = STATUS_IDLE; diff --git a/queue-5.19/iio-adc-ad7923-fix-channel-readings-for-some-variants.patch b/queue-5.19/iio-adc-ad7923-fix-channel-readings-for-some-variants.patch new file mode 100644 index 00000000000..750f7db7021 --- /dev/null +++ b/queue-5.19/iio-adc-ad7923-fix-channel-readings-for-some-variants.patch @@ -0,0 +1,48 @@ +From f4f43f01cff2f29779343ade755191afd2581c77 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Nuno=20S=C3=A1?= +Date: Mon, 12 Sep 2022 10:12:21 +0200 +Subject: iio: adc: ad7923: fix channel readings for some variants +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nuno Sá + +commit f4f43f01cff2f29779343ade755191afd2581c77 upstream. + +Some of the supported devices have 4 or 2 LSB trailing bits that should +not be taken into account. Hence we need to shift these bits out which +fits perfectly on the scan type shift property. This change fixes both +raw and buffered reads. + +Fixes: f2f7a449707e ("iio:adc:ad7923: Add support for the ad7904/ad7914/ad7924") +Fixes: 851644a60d20 ("iio: adc: ad7923: Add support for the ad7908/ad7918/ad7928") +Signed-off-by: Nuno Sá +Link: https://lore.kernel.org/r/20220912081223.173584-2-nuno.sa@analog.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7923.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/iio/adc/ad7923.c ++++ b/drivers/iio/adc/ad7923.c +@@ -93,6 +93,7 @@ enum ad7923_id { + .sign = 'u', \ + .realbits = (bits), \ + .storagebits = 16, \ ++ .shift = 12 - (bits), \ + .endianness = IIO_BE, \ + }, \ + } +@@ -268,7 +269,8 @@ static int ad7923_read_raw(struct iio_de + return ret; + + if (chan->address == EXTRACT(ret, 12, 4)) +- *val = EXTRACT(ret, 0, 12); ++ *val = EXTRACT(ret, chan->scan_type.shift, ++ chan->scan_type.realbits); + else + return -EIO; + diff --git a/queue-5.19/iio-dac-ad5593r-fix-i2c-read-protocol-requirements.patch b/queue-5.19/iio-dac-ad5593r-fix-i2c-read-protocol-requirements.patch new file mode 100644 index 00000000000..7d783eee891 --- /dev/null +++ b/queue-5.19/iio-dac-ad5593r-fix-i2c-read-protocol-requirements.patch @@ -0,0 +1,113 @@ +From 558a25f903b4af6361b7fbeea08a6446a0745653 Mon Sep 17 00:00:00 2001 +From: Michael Hennerich +Date: Tue, 13 Sep 2022 09:34:12 +0200 +Subject: iio: dac: ad5593r: Fix i2c read protocol requirements +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Hennerich + +commit 558a25f903b4af6361b7fbeea08a6446a0745653 upstream. + +For reliable operation across the full range of supported +interface rates, the AD5593R needs a STOP condition between +address write, and data read (like show in the datasheet Figure 40) +so in turn i2c_smbus_read_word_swapped cannot be used. + +While at it, a simple helper was added to make the code simpler. + +Fixes: 56ca9db862bf ("iio: dac: Add support for the AD5592R/AD5593R ADCs/DACs") +Signed-off-by: Michael Hennerich +Signed-off-by: Nuno Sá +Cc: +Link: https://lore.kernel.org/r/20220913073413.140475-2-nuno.sa@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/ad5593r.c | 46 +++++++++++++++++++++++++++------------------- + 1 file changed, 27 insertions(+), 19 deletions(-) + +--- a/drivers/iio/dac/ad5593r.c ++++ b/drivers/iio/dac/ad5593r.c +@@ -13,6 +13,8 @@ + #include + #include + ++#include ++ + #define AD5593R_MODE_CONF (0 << 4) + #define AD5593R_MODE_DAC_WRITE (1 << 4) + #define AD5593R_MODE_ADC_READBACK (4 << 4) +@@ -20,6 +22,24 @@ + #define AD5593R_MODE_GPIO_READBACK (6 << 4) + #define AD5593R_MODE_REG_READBACK (7 << 4) + ++static int ad5593r_read_word(struct i2c_client *i2c, u8 reg, u16 *value) ++{ ++ int ret; ++ u8 buf[2]; ++ ++ ret = i2c_smbus_write_byte(i2c, reg); ++ if (ret < 0) ++ return ret; ++ ++ ret = i2c_master_recv(i2c, buf, sizeof(buf)); ++ if (ret < 0) ++ return ret; ++ ++ *value = get_unaligned_be16(buf); ++ ++ return 0; ++} ++ + static int ad5593r_write_dac(struct ad5592r_state *st, unsigned chan, u16 value) + { + struct i2c_client *i2c = to_i2c_client(st->dev); +@@ -38,13 +58,7 @@ static int ad5593r_read_adc(struct ad559 + if (val < 0) + return (int) val; + +- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_ADC_READBACK); +- if (val < 0) +- return (int) val; +- +- *value = (u16) val; +- +- return 0; ++ return ad5593r_read_word(i2c, AD5593R_MODE_ADC_READBACK, value); + } + + static int ad5593r_reg_write(struct ad5592r_state *st, u8 reg, u16 value) +@@ -58,25 +72,19 @@ static int ad5593r_reg_write(struct ad55 + static int ad5593r_reg_read(struct ad5592r_state *st, u8 reg, u16 *value) + { + struct i2c_client *i2c = to_i2c_client(st->dev); +- s32 val; +- +- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_REG_READBACK | reg); +- if (val < 0) +- return (int) val; + +- *value = (u16) val; +- +- return 0; ++ return ad5593r_read_word(i2c, AD5593R_MODE_REG_READBACK | reg, value); + } + + static int ad5593r_gpio_read(struct ad5592r_state *st, u8 *value) + { + struct i2c_client *i2c = to_i2c_client(st->dev); +- s32 val; ++ u16 val; ++ int ret; + +- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_GPIO_READBACK); +- if (val < 0) +- return (int) val; ++ ret = ad5593r_read_word(i2c, AD5593R_MODE_GPIO_READBACK, &val); ++ if (ret) ++ return ret; + + *value = (u8) val; + diff --git a/queue-5.19/iio-ltc2497-fix-reading-conversion-results.patch b/queue-5.19/iio-ltc2497-fix-reading-conversion-results.patch new file mode 100644 index 00000000000..606b02a582a --- /dev/null +++ b/queue-5.19/iio-ltc2497-fix-reading-conversion-results.patch @@ -0,0 +1,56 @@ +From 7f4f1096d5921f5d90547596f9ce80e0b924f887 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Mon, 15 Aug 2022 09:16:47 +0000 +Subject: iio: ltc2497: Fix reading conversion results +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit 7f4f1096d5921f5d90547596f9ce80e0b924f887 upstream. + +After the result of the previous conversion is read the chip +automatically starts a new conversion and doesn't accept new i2c +transfers until this conversion is completed which makes the function +return failure. + +So add an early return iff the programming of the new address isn't +needed. Note this will not fix the problem in general, but all cases +that are currently used. Once this changes we get the failure back, but +this can be addressed when the need arises. + +Fixes: 69548b7c2c4f ("iio: adc: ltc2497: split protocol independent part in a separate module ") +Reported-by: Meng Li +Signed-off-by: Uwe Kleine-König +Tested-by: Denys Zagorui +Cc: +Link: https://lore.kernel.org/r/20220815091647.1523532-1-dzagorui@cisco.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ltc2497.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/iio/adc/ltc2497.c ++++ b/drivers/iio/adc/ltc2497.c +@@ -41,6 +41,19 @@ static int ltc2497_result_and_measure(st + } + + *val = (be32_to_cpu(st->buf) >> 14) - (1 << 17); ++ ++ /* ++ * The part started a new conversion at the end of the above i2c ++ * transfer, so if the address didn't change since the last call ++ * everything is fine and we can return early. ++ * If not (which should only happen when some sort of bulk ++ * conversion is implemented) we have to program the new ++ * address. Note that this probably fails as the conversion that ++ * was triggered above is like not complete yet and the two ++ * operations have to be done in a single transfer. ++ */ ++ if (ddata->addr_prev == address) ++ return 0; + } + + ret = i2c_smbus_write_byte(st->client, diff --git a/queue-5.19/iio-pressure-dps310-refactor-startup-procedure.patch b/queue-5.19/iio-pressure-dps310-refactor-startup-procedure.patch new file mode 100644 index 00000000000..cdb1bfe489b --- /dev/null +++ b/queue-5.19/iio-pressure-dps310-refactor-startup-procedure.patch @@ -0,0 +1,239 @@ +From c2329717bdd3fa62f8a2f3d8d85ad0bee4556bd7 Mon Sep 17 00:00:00 2001 +From: Eddie James +Date: Thu, 15 Sep 2022 14:57:18 -0500 +Subject: iio: pressure: dps310: Refactor startup procedure + +From: Eddie James + +commit c2329717bdd3fa62f8a2f3d8d85ad0bee4556bd7 upstream. + +Move the startup procedure into a function, and correct a missing +check on the return code for writing the PRS_CFG register. + +Cc: +Signed-off-by: Eddie James +Reviewed-by: Joel Stanley +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20220915195719.136812-2-eajames@linux.ibm.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/pressure/dps310.c | 188 ++++++++++++++++++++++-------------------- + 1 file changed, 99 insertions(+), 89 deletions(-) + +--- a/drivers/iio/pressure/dps310.c ++++ b/drivers/iio/pressure/dps310.c +@@ -159,6 +159,102 @@ static int dps310_get_coefs(struct dps31 + return 0; + } + ++/* ++ * Some versions of the chip will read temperatures in the ~60C range when ++ * it's actually ~20C. This is the manufacturer recommended workaround ++ * to correct the issue. The registers used below are undocumented. ++ */ ++static int dps310_temp_workaround(struct dps310_data *data) ++{ ++ int rc; ++ int reg; ++ ++ rc = regmap_read(data->regmap, 0x32, ®); ++ if (rc) ++ return rc; ++ ++ /* ++ * If bit 1 is set then the device is okay, and the workaround does not ++ * need to be applied ++ */ ++ if (reg & BIT(1)) ++ return 0; ++ ++ rc = regmap_write(data->regmap, 0x0e, 0xA5); ++ if (rc) ++ return rc; ++ ++ rc = regmap_write(data->regmap, 0x0f, 0x96); ++ if (rc) ++ return rc; ++ ++ rc = regmap_write(data->regmap, 0x62, 0x02); ++ if (rc) ++ return rc; ++ ++ rc = regmap_write(data->regmap, 0x0e, 0x00); ++ if (rc) ++ return rc; ++ ++ return regmap_write(data->regmap, 0x0f, 0x00); ++} ++ ++static int dps310_startup(struct dps310_data *data) ++{ ++ int rc; ++ int ready; ++ ++ /* ++ * Set up pressure sensor in single sample, one measurement per second ++ * mode ++ */ ++ rc = regmap_write(data->regmap, DPS310_PRS_CFG, 0); ++ if (rc) ++ return rc; ++ ++ /* ++ * Set up external (MEMS) temperature sensor in single sample, one ++ * measurement per second mode ++ */ ++ rc = regmap_write(data->regmap, DPS310_TMP_CFG, DPS310_TMP_EXT); ++ if (rc) ++ return rc; ++ ++ /* Temp and pressure shifts are disabled when PRC <= 8 */ ++ rc = regmap_write_bits(data->regmap, DPS310_CFG_REG, ++ DPS310_PRS_SHIFT_EN | DPS310_TMP_SHIFT_EN, 0); ++ if (rc) ++ return rc; ++ ++ /* MEAS_CFG doesn't update correctly unless first written with 0 */ ++ rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG, ++ DPS310_MEAS_CTRL_BITS, 0); ++ if (rc) ++ return rc; ++ ++ /* Turn on temperature and pressure measurement in the background */ ++ rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG, ++ DPS310_MEAS_CTRL_BITS, DPS310_PRS_EN | ++ DPS310_TEMP_EN | DPS310_BACKGROUND); ++ if (rc) ++ return rc; ++ ++ /* ++ * Calibration coefficients required for reporting temperature. ++ * They are available 40ms after the device has started ++ */ ++ rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready, ++ ready & DPS310_COEF_RDY, 10000, 40000); ++ if (rc) ++ return rc; ++ ++ rc = dps310_get_coefs(data); ++ if (rc) ++ return rc; ++ ++ return dps310_temp_workaround(data); ++} ++ + static int dps310_get_pres_precision(struct dps310_data *data) + { + int rc; +@@ -677,52 +773,12 @@ static const struct iio_info dps310_info + .write_raw = dps310_write_raw, + }; + +-/* +- * Some verions of chip will read temperatures in the ~60C range when +- * its actually ~20C. This is the manufacturer recommended workaround +- * to correct the issue. The registers used below are undocumented. +- */ +-static int dps310_temp_workaround(struct dps310_data *data) +-{ +- int rc; +- int reg; +- +- rc = regmap_read(data->regmap, 0x32, ®); +- if (rc < 0) +- return rc; +- +- /* +- * If bit 1 is set then the device is okay, and the workaround does not +- * need to be applied +- */ +- if (reg & BIT(1)) +- return 0; +- +- rc = regmap_write(data->regmap, 0x0e, 0xA5); +- if (rc < 0) +- return rc; +- +- rc = regmap_write(data->regmap, 0x0f, 0x96); +- if (rc < 0) +- return rc; +- +- rc = regmap_write(data->regmap, 0x62, 0x02); +- if (rc < 0) +- return rc; +- +- rc = regmap_write(data->regmap, 0x0e, 0x00); +- if (rc < 0) +- return rc; +- +- return regmap_write(data->regmap, 0x0f, 0x00); +-} +- + static int dps310_probe(struct i2c_client *client, + const struct i2c_device_id *id) + { + struct dps310_data *data; + struct iio_dev *iio; +- int rc, ready; ++ int rc; + + iio = devm_iio_device_alloc(&client->dev, sizeof(*data)); + if (!iio) +@@ -747,54 +803,8 @@ static int dps310_probe(struct i2c_clien + if (rc) + return rc; + +- /* +- * Set up pressure sensor in single sample, one measurement per second +- * mode +- */ +- rc = regmap_write(data->regmap, DPS310_PRS_CFG, 0); +- +- /* +- * Set up external (MEMS) temperature sensor in single sample, one +- * measurement per second mode +- */ +- rc = regmap_write(data->regmap, DPS310_TMP_CFG, DPS310_TMP_EXT); +- if (rc < 0) +- return rc; +- +- /* Temp and pressure shifts are disabled when PRC <= 8 */ +- rc = regmap_write_bits(data->regmap, DPS310_CFG_REG, +- DPS310_PRS_SHIFT_EN | DPS310_TMP_SHIFT_EN, 0); +- if (rc < 0) +- return rc; +- +- /* MEAS_CFG doesn't update correctly unless first written with 0 */ +- rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG, +- DPS310_MEAS_CTRL_BITS, 0); +- if (rc < 0) +- return rc; +- +- /* Turn on temperature and pressure measurement in the background */ +- rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG, +- DPS310_MEAS_CTRL_BITS, DPS310_PRS_EN | +- DPS310_TEMP_EN | DPS310_BACKGROUND); +- if (rc < 0) +- return rc; +- +- /* +- * Calibration coefficients required for reporting temperature. +- * They are available 40ms after the device has started +- */ +- rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready, +- ready & DPS310_COEF_RDY, 10000, 40000); +- if (rc < 0) +- return rc; +- +- rc = dps310_get_coefs(data); +- if (rc < 0) +- return rc; +- +- rc = dps310_temp_workaround(data); +- if (rc < 0) ++ rc = dps310_startup(data); ++ if (rc) + return rc; + + rc = devm_iio_device_register(&client->dev, iio); diff --git a/queue-5.19/iio-pressure-dps310-reset-chip-after-timeout.patch b/queue-5.19/iio-pressure-dps310-reset-chip-after-timeout.patch new file mode 100644 index 00000000000..ddbbbf9d15d --- /dev/null +++ b/queue-5.19/iio-pressure-dps310-reset-chip-after-timeout.patch @@ -0,0 +1,148 @@ +From 7b4ab4abcea4c0c10b25187bf2569e5a07e9a20c Mon Sep 17 00:00:00 2001 +From: Eddie James +Date: Thu, 15 Sep 2022 14:57:19 -0500 +Subject: iio: pressure: dps310: Reset chip after timeout + +From: Eddie James + +commit 7b4ab4abcea4c0c10b25187bf2569e5a07e9a20c upstream. + +The DPS310 chip has been observed to get "stuck" such that pressure +and temperature measurements are never indicated as "ready" in the +MEAS_CFG register. The only solution is to reset the device and try +again. In order to avoid continual failures, use a boolean flag to +only try the reset after timeout once if errors persist. + +Fixes: ba6ec48e76bc ("iio: Add driver for Infineon DPS310") +Cc: +Signed-off-by: Eddie James +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20220915195719.136812-3-eajames@linux.ibm.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/pressure/dps310.c | 74 ++++++++++++++++++++++++++++++++++++------ + 1 file changed, 64 insertions(+), 10 deletions(-) + +--- a/drivers/iio/pressure/dps310.c ++++ b/drivers/iio/pressure/dps310.c +@@ -89,6 +89,7 @@ struct dps310_data { + s32 c00, c10, c20, c30, c01, c11, c21; + s32 pressure_raw; + s32 temp_raw; ++ bool timeout_recovery_failed; + }; + + static const struct iio_chan_spec dps310_channels[] = { +@@ -393,11 +394,69 @@ static int dps310_get_temp_k(struct dps3 + return scale_factors[ilog2(rc)]; + } + ++static int dps310_reset_wait(struct dps310_data *data) ++{ ++ int rc; ++ ++ rc = regmap_write(data->regmap, DPS310_RESET, DPS310_RESET_MAGIC); ++ if (rc) ++ return rc; ++ ++ /* Wait for device chip access: 2.5ms in specification */ ++ usleep_range(2500, 12000); ++ return 0; ++} ++ ++static int dps310_reset_reinit(struct dps310_data *data) ++{ ++ int rc; ++ ++ rc = dps310_reset_wait(data); ++ if (rc) ++ return rc; ++ ++ return dps310_startup(data); ++} ++ ++static int dps310_ready_status(struct dps310_data *data, int ready_bit, int timeout) ++{ ++ int sleep = DPS310_POLL_SLEEP_US(timeout); ++ int ready; ++ ++ return regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready, ready & ready_bit, ++ sleep, timeout); ++} ++ ++static int dps310_ready(struct dps310_data *data, int ready_bit, int timeout) ++{ ++ int rc; ++ ++ rc = dps310_ready_status(data, ready_bit, timeout); ++ if (rc) { ++ if (rc == -ETIMEDOUT && !data->timeout_recovery_failed) { ++ /* Reset and reinitialize the chip. */ ++ if (dps310_reset_reinit(data)) { ++ data->timeout_recovery_failed = true; ++ } else { ++ /* Try again to get sensor ready status. */ ++ if (dps310_ready_status(data, ready_bit, timeout)) ++ data->timeout_recovery_failed = true; ++ else ++ return 0; ++ } ++ } ++ ++ return rc; ++ } ++ ++ data->timeout_recovery_failed = false; ++ return 0; ++} ++ + static int dps310_read_pres_raw(struct dps310_data *data) + { + int rc; + int rate; +- int ready; + int timeout; + s32 raw; + u8 val[3]; +@@ -409,9 +468,7 @@ static int dps310_read_pres_raw(struct d + timeout = DPS310_POLL_TIMEOUT_US(rate); + + /* Poll for sensor readiness; base the timeout upon the sample rate. */ +- rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready, +- ready & DPS310_PRS_RDY, +- DPS310_POLL_SLEEP_US(timeout), timeout); ++ rc = dps310_ready(data, DPS310_PRS_RDY, timeout); + if (rc) + goto done; + +@@ -448,7 +505,6 @@ static int dps310_read_temp_raw(struct d + { + int rc; + int rate; +- int ready; + int timeout; + + if (mutex_lock_interruptible(&data->lock)) +@@ -458,10 +514,8 @@ static int dps310_read_temp_raw(struct d + timeout = DPS310_POLL_TIMEOUT_US(rate); + + /* Poll for sensor readiness; base the timeout upon the sample rate. */ +- rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready, +- ready & DPS310_TMP_RDY, +- DPS310_POLL_SLEEP_US(timeout), timeout); +- if (rc < 0) ++ rc = dps310_ready(data, DPS310_TMP_RDY, timeout); ++ if (rc) + goto done; + + rc = dps310_read_temp_ready(data); +@@ -756,7 +810,7 @@ static void dps310_reset(void *action_da + { + struct dps310_data *data = action_data; + +- regmap_write(data->regmap, DPS310_RESET, DPS310_RESET_MAGIC); ++ dps310_reset_wait(data); + } + + static const struct regmap_config dps310_regmap_config = { diff --git a/queue-5.19/io_uring-af_unix-defer-registered-files-gc-to-io_uring-release.patch b/queue-5.19/io_uring-af_unix-defer-registered-files-gc-to-io_uring-release.patch index 9cfa9c4ad35..9d2e5eb4cda 100644 --- a/queue-5.19/io_uring-af_unix-defer-registered-files-gc-to-io_uring-release.patch +++ b/queue-5.19/io_uring-af_unix-defer-registered-files-gc-to-io_uring-release.patch @@ -48,7 +48,7 @@ Signed-off-by: Greg Kroah-Hartman __u16 tc_index; /* traffic control index */ --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c -@@ -9500,6 +9500,7 @@ static int io_scm_file_account(struct io +@@ -9484,6 +9484,7 @@ static int io_scm_file_account(struct io UNIXCB(skb).fp = fpl; skb->sk = sk; diff --git a/queue-5.19/io_uring-correct-pinned_vm-accounting.patch b/queue-5.19/io_uring-correct-pinned_vm-accounting.patch index b3a7a7b8be2..ef82c747807 100644 --- a/queue-5.19/io_uring-correct-pinned_vm-accounting.patch +++ b/queue-5.19/io_uring-correct-pinned_vm-accounting.patch @@ -22,7 +22,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c -@@ -10727,12 +10727,6 @@ static void io_flush_apoll_cache(struct +@@ -10711,12 +10711,6 @@ static void io_flush_apoll_cache(struct static __cold void io_ring_ctx_free(struct io_ring_ctx *ctx) { io_sq_thread_finish(ctx); @@ -35,7 +35,7 @@ Signed-off-by: Greg Kroah-Hartman io_rsrc_refs_drop(ctx); /* __io_rsrc_put_work() may need uring_lock to progress, wait w/o it */ io_wait_rsrc_data(ctx->buf_data); -@@ -10771,6 +10765,10 @@ static __cold void io_ring_ctx_free(stru +@@ -10755,6 +10749,10 @@ static __cold void io_ring_ctx_free(stru #endif WARN_ON_ONCE(!list_empty(&ctx->ltimeout_list)); diff --git a/queue-5.19/io_uring-net-handle-einprogress-correct-for-ioring_op_connect.patch b/queue-5.19/io_uring-net-handle-einprogress-correct-for-ioring_op_connect.patch deleted file mode 100644 index 2fd41b8e589..00000000000 --- a/queue-5.19/io_uring-net-handle-einprogress-correct-for-ioring_op_connect.patch +++ /dev/null @@ -1,87 +0,0 @@ -From 3fb1bd68817288729179444caf1fd5c5c4d2d65d Mon Sep 17 00:00:00 2001 -From: Jens Axboe -Date: Tue, 4 Oct 2022 20:29:48 -0600 -Subject: io_uring/net: handle -EINPROGRESS correct for IORING_OP_CONNECT - -From: Jens Axboe - -commit 3fb1bd68817288729179444caf1fd5c5c4d2d65d upstream. - -We treat EINPROGRESS like EAGAIN, but if we're retrying post getting -EINPROGRESS, then we just need to check the socket for errors and -terminate the request. - -This was exposed on a bluetooth connection request which ends up -taking a while and hitting EINPROGRESS, and yields a CQE result of --EBADFD because we're retrying a connect on a socket that is now -connected. - -Cc: stable@vger.kernel.org -Fixes: 87f80d623c6c ("io_uring: handle connect -EINPROGRESS like -EAGAIN") -Link: https://github.com/axboe/liburing/issues/671 -Reported-by: Aidan Sun -Signed-off-by: Jens Axboe -Signed-off-by: Greg Kroah-Hartman ---- - io_uring/io_uring.c | 28 ++++++++++++++++++++++------ - 1 file changed, 22 insertions(+), 6 deletions(-) - ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -653,6 +653,7 @@ struct io_connect { - struct file *file; - struct sockaddr __user *addr; - int addr_len; -+ bool in_progress; - }; - - struct io_sr_msg { -@@ -6463,6 +6464,7 @@ static int io_connect_prep(struct io_kio - - conn->addr = u64_to_user_ptr(READ_ONCE(sqe->addr)); - conn->addr_len = READ_ONCE(sqe->addr2); -+ conn->in_progress = false; - return 0; - } - -@@ -6473,6 +6475,16 @@ static int io_connect(struct io_kiocb *r - int ret; - bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK; - -+ if (connect->in_progress) { -+ struct socket *socket; -+ -+ ret = -ENOTSOCK; -+ socket = sock_from_file(req->file); -+ if (socket) -+ ret = sock_error(socket->sk); -+ goto out; -+ } -+ - if (req_has_async_data(req)) { - io = req->async_data; - } else { -@@ -6489,13 +6501,17 @@ static int io_connect(struct io_kiocb *r - ret = __sys_connect_file(req->file, &io->address, - req->connect.addr_len, file_flags); - if ((ret == -EAGAIN || ret == -EINPROGRESS) && force_nonblock) { -- if (req_has_async_data(req)) -- return -EAGAIN; -- if (io_alloc_async_data(req)) { -- ret = -ENOMEM; -- goto out; -+ if (ret == -EINPROGRESS) { -+ connect->in_progress = true; -+ } else { -+ if (req_has_async_data(req)) -+ return -EAGAIN; -+ if (io_alloc_async_data(req)) { -+ ret = -ENOMEM; -+ goto out; -+ } -+ memcpy(req->async_data, &__io, sizeof(__io)); - } -- memcpy(req->async_data, &__io, sizeof(__io)); - return -EAGAIN; - } - if (ret == -ERESTARTSYS) diff --git a/queue-5.19/mmc-core-add-sd-card-quirk-for-broken-discard.patch b/queue-5.19/mmc-core-add-sd-card-quirk-for-broken-discard.patch new file mode 100644 index 00000000000..f25fe5b665b --- /dev/null +++ b/queue-5.19/mmc-core-add-sd-card-quirk-for-broken-discard.patch @@ -0,0 +1,91 @@ +From 07d2872bf4c864eb83d034263c155746a2fb7a3b Mon Sep 17 00:00:00 2001 +From: Avri Altman +Date: Wed, 28 Sep 2022 12:57:44 +0300 +Subject: mmc: core: Add SD card quirk for broken discard + +From: Avri Altman + +commit 07d2872bf4c864eb83d034263c155746a2fb7a3b upstream. + +Some SD-cards from Sandisk that are SDA-6.0 compliant reports they supports +discard, while they actually don't. This might cause mk2fs to fail while +trying to format the card and revert it to a read-only mode. + +To fix this problem, let's add a card quirk (MMC_QUIRK_BROKEN_SD_DISCARD) +to indicate that we shall fall-back to use the legacy erase command +instead. + +Signed-off-by: Avri Altman +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20220928095744.16455-1-avri.altman@wdc.com +[Ulf: Updated the commit message] +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/block.c | 6 +++++- + drivers/mmc/core/card.h | 6 ++++++ + drivers/mmc/core/quirks.h | 6 ++++++ + include/linux/mmc/card.h | 1 + + 4 files changed, 18 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -1140,8 +1140,12 @@ static void mmc_blk_issue_discard_rq(str + { + struct mmc_blk_data *md = mq->blkdata; + struct mmc_card *card = md->queue.card; ++ unsigned int arg = card->erase_arg; + +- mmc_blk_issue_erase_rq(mq, req, MMC_BLK_DISCARD, card->erase_arg); ++ if (mmc_card_broken_sd_discard(card)) ++ arg = SD_ERASE_ARG; ++ ++ mmc_blk_issue_erase_rq(mq, req, MMC_BLK_DISCARD, arg); + } + + static void mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq, +--- a/drivers/mmc/core/card.h ++++ b/drivers/mmc/core/card.h +@@ -73,6 +73,7 @@ struct mmc_fixup { + #define EXT_CSD_REV_ANY (-1u) + + #define CID_MANFID_SANDISK 0x2 ++#define CID_MANFID_SANDISK_SD 0x3 + #define CID_MANFID_ATP 0x9 + #define CID_MANFID_TOSHIBA 0x11 + #define CID_MANFID_MICRON 0x13 +@@ -258,4 +259,9 @@ static inline int mmc_card_broken_hpi(co + return c->quirks & MMC_QUIRK_BROKEN_HPI; + } + ++static inline int mmc_card_broken_sd_discard(const struct mmc_card *c) ++{ ++ return c->quirks & MMC_QUIRK_BROKEN_SD_DISCARD; ++} ++ + #endif +--- a/drivers/mmc/core/quirks.h ++++ b/drivers/mmc/core/quirks.h +@@ -100,6 +100,12 @@ static const struct mmc_fixup __maybe_un + MMC_FIXUP("V10016", CID_MANFID_KINGSTON, CID_OEMID_ANY, add_quirk_mmc, + MMC_QUIRK_TRIM_BROKEN), + ++ /* ++ * Some SD cards reports discard support while they don't ++ */ ++ MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd, ++ MMC_QUIRK_BROKEN_SD_DISCARD), ++ + END_FIXUP + }; + +--- a/include/linux/mmc/card.h ++++ b/include/linux/mmc/card.h +@@ -292,6 +292,7 @@ struct mmc_card { + #define MMC_QUIRK_BROKEN_IRQ_POLLING (1<<11) /* Polling SDIO_CCCR_INTx could create a fake interrupt */ + #define MMC_QUIRK_TRIM_BROKEN (1<<12) /* Skip trim */ + #define MMC_QUIRK_BROKEN_HPI (1<<13) /* Disable broken HPI support */ ++#define MMC_QUIRK_BROKEN_SD_DISCARD (1<<14) /* Disable broken SD discard support */ + + bool reenable_cmdq; /* Re-enable Command Queue */ + diff --git a/queue-5.19/mmc-renesas_sdhi-fix-rounding-errors.patch b/queue-5.19/mmc-renesas_sdhi-fix-rounding-errors.patch new file mode 100644 index 00000000000..df4aa52a539 --- /dev/null +++ b/queue-5.19/mmc-renesas_sdhi-fix-rounding-errors.patch @@ -0,0 +1,87 @@ +From f0c00454bf78975925eccc9737faaa4d4951edbf Mon Sep 17 00:00:00 2001 +From: Biju Das +Date: Wed, 28 Sep 2022 12:07:55 +0100 +Subject: mmc: renesas_sdhi: Fix rounding errors + +From: Biju Das + +commit f0c00454bf78975925eccc9737faaa4d4951edbf upstream. + +Due to clk rounding errors on RZ/G2L platforms, it selects a clock source +with a lower clock rate compared to a higher one. +For eg: The rounding error (533333333 Hz / 4 * 4 = 533333332 Hz < 5333333 +33 Hz) selects a clk source of 400 MHz instead of 533.333333 MHz. + +This patch fixes this issue by adding a margin of (1/1024) higher to +the clock rate. + +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Tested-by: Geert Uytterhoeven +Reviewed-by: Wolfram Sang +Tested-by: Wolfram Sang +Fixes: bb6d3fa98a41 ("clk: renesas: rcar-gen3: Switch to new SD clock handling") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20220928110755.849275-1-biju.das.jz@bp.renesas.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/renesas_sdhi_core.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +--- a/drivers/mmc/host/renesas_sdhi_core.c ++++ b/drivers/mmc/host/renesas_sdhi_core.c +@@ -128,6 +128,7 @@ static unsigned int renesas_sdhi_clk_upd + struct clk *ref_clk = priv->clk; + unsigned int freq, diff, best_freq = 0, diff_min = ~0; + unsigned int new_clock, clkh_shift = 0; ++ unsigned int new_upper_limit; + int i; + + /* +@@ -153,13 +154,20 @@ static unsigned int renesas_sdhi_clk_upd + * greater than, new_clock. As we can divide by 1 << i for + * any i in [0, 9] we want the input clock to be as close as + * possible, but no greater than, new_clock << i. ++ * ++ * Add an upper limit of 1/1024 rate higher to the clock rate to fix ++ * clk rate jumping to lower rate due to rounding error (eg: RZ/G2L has ++ * 3 clk sources 533.333333 MHz, 400 MHz and 266.666666 MHz. The request ++ * for 533.333333 MHz will selects a slower 400 MHz due to rounding ++ * error (533333333 Hz / 4 * 4 = 533333332 Hz < 533333333 Hz)). + */ + for (i = min(9, ilog2(UINT_MAX / new_clock)); i >= 0; i--) { + freq = clk_round_rate(ref_clk, new_clock << i); +- if (freq > (new_clock << i)) { ++ new_upper_limit = (new_clock << i) + ((new_clock << i) >> 10); ++ if (freq > new_upper_limit) { + /* Too fast; look for a slightly slower option */ + freq = clk_round_rate(ref_clk, (new_clock << i) / 4 * 3); +- if (freq > (new_clock << i)) ++ if (freq > new_upper_limit) + continue; + } + +@@ -181,6 +189,7 @@ static unsigned int renesas_sdhi_clk_upd + static void renesas_sdhi_set_clock(struct tmio_mmc_host *host, + unsigned int new_clock) + { ++ unsigned int clk_margin; + u32 clk = 0, clock; + + sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, ~CLK_CTL_SCLKEN & +@@ -194,7 +203,13 @@ static void renesas_sdhi_set_clock(struc + host->mmc->actual_clock = renesas_sdhi_clk_update(host, new_clock); + clock = host->mmc->actual_clock / 512; + +- for (clk = 0x80000080; new_clock >= (clock << 1); clk >>= 1) ++ /* ++ * Add a margin of 1/1024 rate higher to the clock rate in order ++ * to avoid clk variable setting a value of 0 due to the margin ++ * provided for actual_clock in renesas_sdhi_clk_update(). ++ */ ++ clk_margin = new_clock >> 10; ++ for (clk = 0x80000080; new_clock + clk_margin >= (clock << 1); clk >>= 1) + clock <<= 1; + + /* 1/1 clock is option */ diff --git a/queue-5.19/mmc-sdhci-sprd-fix-minimum-clock-limit.patch b/queue-5.19/mmc-sdhci-sprd-fix-minimum-clock-limit.patch new file mode 100644 index 00000000000..0113d88e63d --- /dev/null +++ b/queue-5.19/mmc-sdhci-sprd-fix-minimum-clock-limit.patch @@ -0,0 +1,39 @@ +From 6e141772e6465f937458b35ddcfd0a981b6f5280 Mon Sep 17 00:00:00 2001 +From: Wenchao Chen +Date: Tue, 11 Oct 2022 18:49:35 +0800 +Subject: mmc: sdhci-sprd: Fix minimum clock limit + +From: Wenchao Chen + +commit 6e141772e6465f937458b35ddcfd0a981b6f5280 upstream. + +The Spreadtrum controller supports 100KHz minimal clock rate, which means +that the current value 400KHz is wrong. + +Unfortunately this has also lead to fail to initialize some cards, which +are allowed to require 100KHz to work. So, let's fix the problem by +changing the minimal supported clock rate to 100KHz. + +Signed-off-by: Wenchao Chen +Acked-by: Adrian Hunter +Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20221011104935.10980-1-wenchao.chen666@gmail.com +[Ulf: Clarified to commit-message] +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-sprd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/host/sdhci-sprd.c ++++ b/drivers/mmc/host/sdhci-sprd.c +@@ -309,7 +309,7 @@ static unsigned int sdhci_sprd_get_max_c + + static unsigned int sdhci_sprd_get_min_clock(struct sdhci_host *host) + { +- return 400000; ++ return 100000; + } + + static void sdhci_sprd_set_uhs_signaling(struct sdhci_host *host, diff --git a/queue-5.19/mmc-sdhci-tegra-use-actual-clock-rate-for-sw-tuning-correction.patch b/queue-5.19/mmc-sdhci-tegra-use-actual-clock-rate-for-sw-tuning-correction.patch new file mode 100644 index 00000000000..f5df1af6331 --- /dev/null +++ b/queue-5.19/mmc-sdhci-tegra-use-actual-clock-rate-for-sw-tuning-correction.patch @@ -0,0 +1,42 @@ +From b78870e7f41534cc719c295d1f8809aca93aeeab Mon Sep 17 00:00:00 2001 +From: Prathamesh Shete +Date: Thu, 6 Oct 2022 18:36:22 +0530 +Subject: mmc: sdhci-tegra: Use actual clock rate for SW tuning correction + +From: Prathamesh Shete + +commit b78870e7f41534cc719c295d1f8809aca93aeeab upstream. + +Ensure tegra_host member "curr_clk_rate" holds the actual clock rate +instead of requested clock rate for proper use during tuning correction +algorithm. Actual clk rate may not be the same as the requested clk +frequency depending on the parent clock source set. Tuning correction +algorithm depends on certain parameters which are sensitive to current +clk rate. If the host clk is selected instead of the actual clock rate, +tuning correction algorithm may end up applying invalid correction, +which could result in errors + +Fixes: ea8fc5953e8b ("mmc: tegra: update hw tuning process") +Signed-off-by: Aniruddha TVS Rao +Signed-off-by: Prathamesh Shete +Acked-by: Adrian Hunter +Acked-by: Thierry Reding +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20221006130622.22900-4-pshete@nvidia.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/host/sdhci-tegra.c ++++ b/drivers/mmc/host/sdhci-tegra.c +@@ -773,7 +773,7 @@ static void tegra_sdhci_set_clock(struct + dev_err(dev, "failed to set clk rate to %luHz: %d\n", + host_clk, err); + +- tegra_host->curr_clk_rate = host_clk; ++ tegra_host->curr_clk_rate = clk_get_rate(pltfm_host->clk); + if (tegra_host->ddr_signaling) + host->max_clk = host_clk; + else diff --git a/queue-5.19/series b/queue-5.19/series index c357b890caf..128954a2f00 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -11,6 +11,25 @@ mtd-rawnand-atmel-unmap-streaming-dma-mappings.patch io_uring-rw-fix-unexpected-link-breakage.patch io_uring-net-fix-fast_iov-assignment-in-io_setup_async_msg.patch io_uring-net-don-t-update-msg_name-if-not-provided.patch -io_uring-net-handle-einprogress-correct-for-ioring_op_connect.patch io_uring-af_unix-defer-registered-files-gc-to-io_uring-release.patch io_uring-correct-pinned_vm-accounting.patch +hv_netvsc-fix-race-between-vf-offering-and-vf-association-message-from-host.patch +cifs-destage-dirty-pages-before-re-reading-them-for-cache-none.patch +cifs-fix-the-error-length-of-validate_negotiate_info-message.patch +iio-dac-ad5593r-fix-i2c-read-protocol-requirements.patch +iio-ltc2497-fix-reading-conversion-results.patch +iio-adc-ad7923-fix-channel-readings-for-some-variants.patch +iio-pressure-dps310-refactor-startup-procedure.patch +iio-pressure-dps310-reset-chip-after-timeout.patch +xhci-dbc-fix-memory-leak-in-xhci_alloc_dbc.patch +usb-gadget-uvc-fix-argument-to-sizeof-in-uvc_register_video.patch +usb-add-quirks-for-lenovo-onelink-dock.patch +mmc-core-add-sd-card-quirk-for-broken-discard.patch +can-kvaser_usb-fix-use-of-uninitialized-completion.patch +can-kvaser_usb_leaf-fix-overread-with-an-invalid-command.patch +can-kvaser_usb_leaf-fix-tx-queue-out-of-sync-after-restart.patch +can-kvaser_usb_leaf-fix-can-state-after-restart.patch +mmc-renesas_sdhi-fix-rounding-errors.patch +mmc-sdhci-tegra-use-actual-clock-rate-for-sw-tuning-correction.patch +mmc-sdhci-sprd-fix-minimum-clock-limit.patch +i2c-designware-fix-handling-of-real-but-unexpected-device-interrupts.patch diff --git a/queue-5.19/usb-add-quirks-for-lenovo-onelink-dock.patch b/queue-5.19/usb-add-quirks-for-lenovo-onelink-dock.patch new file mode 100644 index 00000000000..c9c974d6d99 --- /dev/null +++ b/queue-5.19/usb-add-quirks-for-lenovo-onelink-dock.patch @@ -0,0 +1,146 @@ +From 37d49519b41405b08748392c6a7f193d9f77ecd2 Mon Sep 17 00:00:00 2001 +From: Jean-Francois Le Fillatre +Date: Tue, 27 Sep 2022 09:34:07 +0200 +Subject: usb: add quirks for Lenovo OneLink+ Dock + +From: Jean-Francois Le Fillatre + +commit 37d49519b41405b08748392c6a7f193d9f77ecd2 upstream. + +The Lenovo OneLink+ Dock contains two VL812 USB3.0 controllers: +17ef:1018 upstream +17ef:1019 downstream + +These hubs suffer from two separate problems: + +1) After the host system was suspended and woken up, the hubs appear to + be in a random state. Some downstream ports (both internal to the + built-in audio and network controllers, and external to USB sockets) + may no longer be functional. The exact list of disabled ports (if + any) changes from wakeup to wakeup. Ports remain in that state until + the dock is power-cycled, or until the laptop is rebooted. + + Wakeup sources connected to the hubs (keyboard, WoL on the integrated + gigabit controller) will wake the system up from suspend, but they + may no longer work after wakeup (and in that case will no longer work + as wakeup source in a subsequent suspend-wakeup cycle). + + This issue appears in the logs with messages such as: + + usb 1-6.1-port4: cannot disable (err = -71) + usb 1-6-port2: cannot disable (err = -71) + usb 1-6.1: clear tt 1 (80c0) error -71 + usb 1-6-port4: cannot disable (err = -71) + usb 1-6.4: PM: dpm_run_callback(): usb_dev_resume+0x0/0x10 [usbcore] returns -71 + usb 1-6.4: PM: failed to resume async: error -71 + usb 1-7: reset full-speed USB device number 5 using xhci_hcd + usb 1-6.1-port1: cannot reset (err = -71) + usb 1-6.1-port1: cannot reset (err = -71) + usb 1-6.1-port1: cannot reset (err = -71) + usb 1-6.1-port1: cannot reset (err = -71) + usb 1-6.1-port1: cannot reset (err = -71) + usb 1-6.1-port1: Cannot enable. Maybe the USB cable is bad? + usb 1-6.1-port1: cannot disable (err = -71) + usb 1-6.1-port1: cannot reset (err = -71) + usb 1-6.1-port1: cannot reset (err = -71) + usb 1-6.1-port1: cannot reset (err = -71) + usb 1-6.1-port1: cannot reset (err = -71) + usb 1-6.1-port1: cannot reset (err = -71) + usb 1-6.1-port1: Cannot enable. Maybe the USB cable is bad? + usb 1-6.1-port1: cannot disable (err = -71) + +2) Some USB devices cannot be enumerated properly. So far I have only + seen the issue with USB 3.0 devices. The same devices work without + problem directly connected to the host system, to other systems or to + other hubs (even when those hubs are connected to the OneLink+ dock). + + One very reliable reproducer is this USB 3.0 HDD enclosure: + 152d:9561 JMicron Technology Corp. / JMicron USA Technology Corp. Mobius + + I have seen it happen sporadically with other USB 3.0 enclosures, + with controllers from different manufacturers, all self-powered. + + Typical messages in the logs: + + xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command + xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command + usb 2-1.4: device not accepting address 6, error -62 + xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command + xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command + usb 2-1.4: device not accepting address 7, error -62 + usb 2-1-port4: attempt power cycle + xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command + xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command + usb 2-1.4: device not accepting address 8, error -62 + xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command + xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command + usb 2-1.4: device not accepting address 9, error -62 + usb 2-1-port4: unable to enumerate USB device + +Through trial and error, I found that the USB_QUIRK_RESET_RESUME solved +the second issue. Further testing then uncovered the first issue. Test +results are summarized in this table: + +======================================================================================= +Settings USB2 hotplug USB3 hotplug State after waking up +--------------------------------------------------------------------------------------- + +power/control=auto works fails broken + +usbcore.autosuspend=-1 works works broken +OR power/control=on + +power/control=auto works (1) works (1) works +and USB_QUIRK_RESET_RESUME + +power/control=on works works works +and USB_QUIRK_RESET_RESUME + +HUB_QUIRK_DISABLE_AUTOSUSPEND works works works +and USB_QUIRK_RESET_RESUME + +======================================================================================= + +In those results, the power/control settings are applied to both hubs, +both on the USB2 and USB3 side, before each test. + +From those results, USB_QUIRK_RESET_RESUME is required to reset the hubs +properly after a suspend-wakeup cycle, and the hubs must not autosuspend +to work around the USB3 issue. + +A secondary effect of USB_QUIRK_RESET_RESUME is to prevent the hubs' +upstream links from suspending (the downstream ports can still suspend). +This secondary effect is used in results (1). It is enough to solve the +USB3 problem. + +Setting USB_QUIRK_RESET_RESUME on those hubs is the smallest patch that +solves both issues. + +Prior to creating this patch, I have used the USB_QUIRK_RESET_RESUME via +the kernel command line for over a year without noticing any side +effect. + +Thanks to Oliver Neukum @Suse for explanations of the operations of +USB_QUIRK_RESET_RESUME, and requesting more testing. + +Signed-off-by: Jean-Francois Le Fillatre +Cc: stable +Link: https://lore.kernel.org/r/20220927073407.5672-1-jflf_kernel@gmx.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -437,6 +437,10 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x1532, 0x0116), .driver_info = + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + ++ /* Lenovo ThinkPad OneLink+ Dock twin hub controllers (VIA Labs VL812) */ ++ { USB_DEVICE(0x17ef, 0x1018), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x17ef, 0x1019), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* Lenovo USB-C to Ethernet Adapter RTL8153-04 */ + { USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM }, + diff --git a/queue-5.19/usb-gadget-uvc-fix-argument-to-sizeof-in-uvc_register_video.patch b/queue-5.19/usb-gadget-uvc-fix-argument-to-sizeof-in-uvc_register_video.patch new file mode 100644 index 00000000000..717140a80b0 --- /dev/null +++ b/queue-5.19/usb-gadget-uvc-fix-argument-to-sizeof-in-uvc_register_video.patch @@ -0,0 +1,79 @@ +From a15e17acce5aaae54243f55a7349c2225450b9bc Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Wed, 28 Sep 2022 13:19:21 -0700 +Subject: usb: gadget: uvc: Fix argument to sizeof() in uvc_register_video() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nathan Chancellor + +commit a15e17acce5aaae54243f55a7349c2225450b9bc upstream. + +When building s390 allmodconfig after commit 9b91a6523078 ("usb: gadget: +uvc: increase worker prio to WQ_HIGHPRI"), the following error occurs: + + In file included from ../include/linux/string.h:253, + from ../include/linux/bitmap.h:11, + from ../include/linux/cpumask.h:12, + from ../include/linux/smp.h:13, + from ../include/linux/lockdep.h:14, + from ../include/linux/rcupdate.h:29, + from ../include/linux/rculist.h:11, + from ../include/linux/pid.h:5, + from ../include/linux/sched.h:14, + from ../include/linux/ratelimit.h:6, + from ../include/linux/dev_printk.h:16, + from ../include/linux/device.h:15, + from ../drivers/usb/gadget/function/f_uvc.c:9: + In function ‘fortify_memset_chk’, + inlined from ‘uvc_register_video’ at ../drivers/usb/gadget/function/f_uvc.c:424:2: + ../include/linux/fortify-string.h:301:25: error: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] + 301 | __write_overflow_field(p_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +This points to the memset() in uvc_register_video(). It is clear that +the argument to sizeof() is incorrect, as uvc->vdev (a 'struct +video_device') is being zeroed out but the size of uvc->video (a 'struct +uvc_video') is being used as the third arugment to memset(). + +pahole shows that prior to commit 9b91a6523078 ("usb: gadget: uvc: +increase worker prio to WQ_HIGHPRI"), 'struct video_device' and +'struct ucv_video' had the same size, meaning that the argument to +sizeof() is incorrect semantically but there is no visible issue: + + $ pahole -s build/drivers/usb/gadget/function/f_uvc.o | grep -E "(uvc_video|video_device)\s+" + video_device 1400 4 + uvc_video 1400 3 + +After that change, uvc_video becomes slightly larger, meaning that the +memset() will overwrite by 8 bytes: + + $ pahole -s build/drivers/usb/gadget/function/f_uvc.o | grep -E "(uvc_video|video_device)\s+" + video_device 1400 4 + uvc_video 1408 3 + +Fix the arugment to sizeof() so that there is no overwrite. + +Cc: stable@vger.kernel.org +Fixes: e4ce9ed835bc ("usb: gadget: uvc: ensure the vdev is unset") +Signed-off-by: Nathan Chancellor +Reviewed-by: Laurent Pinchart +Reviewed-by: Kees Cook +Link: https://lore.kernel.org/r/20220928201921.3152163-1-nathan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_uvc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_uvc.c ++++ b/drivers/usb/gadget/function/f_uvc.c +@@ -421,7 +421,7 @@ uvc_register_video(struct uvc_device *uv + int ret; + + /* TODO reference counting. */ +- memset(&uvc->vdev, 0, sizeof(uvc->video)); ++ memset(&uvc->vdev, 0, sizeof(uvc->vdev)); + uvc->vdev.v4l2_dev = &uvc->v4l2_dev; + uvc->vdev.v4l2_dev->dev = &cdev->gadget->dev; + uvc->vdev.fops = &uvc_v4l2_fops; diff --git a/queue-5.19/xhci-dbc-fix-memory-leak-in-xhci_alloc_dbc.patch b/queue-5.19/xhci-dbc-fix-memory-leak-in-xhci_alloc_dbc.patch new file mode 100644 index 00000000000..d648c81ae08 --- /dev/null +++ b/queue-5.19/xhci-dbc-fix-memory-leak-in-xhci_alloc_dbc.patch @@ -0,0 +1,33 @@ +From d591b32e519603524a35b172156db71df9116902 Mon Sep 17 00:00:00 2001 +From: Rafael Mendonca +Date: Wed, 21 Sep 2022 15:34:46 +0300 +Subject: xhci: dbc: Fix memory leak in xhci_alloc_dbc() + +From: Rafael Mendonca + +commit d591b32e519603524a35b172156db71df9116902 upstream. + +If DbC is already in use, then the allocated memory for the xhci_dbc struct +doesn't get freed before returning NULL, which leads to a memleak. + +Fixes: 534675942e90 ("xhci: dbc: refactor xhci_dbc_init()") +Cc: stable@vger.kernel.org +Signed-off-by: Rafael Mendonca +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220921123450.671459-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-dbgcap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -988,7 +988,7 @@ xhci_alloc_dbc(struct device *dev, void + dbc->driver = driver; + + if (readl(&dbc->regs->control) & DBC_CTRL_DBC_ENABLE) +- return NULL; ++ goto err; + + INIT_DELAYED_WORK(&dbc->event_work, xhci_dbc_handle_events); + spin_lock_init(&dbc->lock);