From: Sasha Levin Date: Sat, 27 Jul 2024 14:04:14 +0000 (-0400) Subject: Fixes for 6.1 X-Git-Tag: v6.1.103~104 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9a300a9c81436fbce098a2546a320323529791d3;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-board-reset.patch b/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-board-reset.patch new file mode 100644 index 00000000000..414cdf9ae3a --- /dev/null +++ b/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-board-reset.patch @@ -0,0 +1,36 @@ +From 0169e0564f2f0190d48ea22a61f2bf88980b5ec6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:13:31 +0200 +Subject: ARM: dts: imx6qdl-kontron-samx6i: fix board reset + +From: Michael Walle + +[ Upstream commit b972d6b3b46345023aee56a95df8e2c137aa4ee4 ] + +On i.MX6 the board is reset by the watchdog. But in turn to do a +complete board reset, we have to assert the WDOG_B output which is +routed also to the CPLD which then do a complete power-cycle of the +board. + +Fixes: 2125212785c9 ("ARM: dts: imx6qdl-kontron-samx6i: add Kontron SMARC SoM Support") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +index d6c049b9a9c69..700780bf64f58 100644 +--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +@@ -817,5 +817,6 @@ &wdog1 { + /* CPLD is feeded by watchdog (hardwired) */ + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_wdog1>; ++ fsl,ext-reset-output; + status = "okay"; + }; +-- +2.43.0 + diff --git a/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-pcie-reset-polari.patch b/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-pcie-reset-polari.patch new file mode 100644 index 00000000000..21786d4b705 --- /dev/null +++ b/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-pcie-reset-polari.patch @@ -0,0 +1,35 @@ +From 38089b10f32c2dc76086e9731fe28abbfcf40347 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:13:38 +0200 +Subject: ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity + +From: Michael Walle + +[ Upstream commit df35c6e9027cf9affe699e632a48082ab1bbba4c ] + +The PCIe reset line is active low. Fix it. + +Fixes: 2a51f9dae13d ("ARM: dts: imx6qdl-kontron-samx6i: Add iMX6-based Kontron SMARC-sAMX6i module") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +index 78cbc2df279e6..668d33d1ff0c1 100644 +--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +@@ -732,7 +732,7 @@ &pcie { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_pcie>; + wake-up-gpio = <&gpio6 18 GPIO_ACTIVE_HIGH>; +- reset-gpio = <&gpio3 13 GPIO_ACTIVE_HIGH>; ++ reset-gpio = <&gpio3 13 GPIO_ACTIVE_LOW>; + }; + + /* LCD_BKLT_PWM */ +-- +2.43.0 + diff --git a/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-phy-mode.patch b/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-phy-mode.patch new file mode 100644 index 00000000000..15c4cd9ce0a --- /dev/null +++ b/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-phy-mode.patch @@ -0,0 +1,37 @@ +From a8e1b83df62c15155f8d22a6ccadaa442b4bd32b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:13:29 +0200 +Subject: ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode + +From: Michael Walle + +[ Upstream commit 0df3c7d7a73d75153090637392c0b73a63cdc24a ] + +The i.MX6 cannot add any RGMII delays. The PHY has to add both the RX +and TX delays on the RGMII interface. Fix the interface mode. While at +it, use the new phy-connection-type property name. + +Fixes: 5694eed98cca ("ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +index 85aeebc9485dd..d8c1dfb8c9abb 100644 +--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +@@ -259,7 +259,7 @@ smarc_flash: flash@0 { + &fec { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_enet>; +- phy-mode = "rgmii"; ++ phy-connection-type = "rgmii-id"; + phy-handle = <ðphy>; + + mdio { +-- +2.43.0 + diff --git a/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-phy-reset.patch b/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-phy-reset.patch new file mode 100644 index 00000000000..3f82a21e001 --- /dev/null +++ b/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-phy-reset.patch @@ -0,0 +1,49 @@ +From 359b26d30dfbc5c05fd21dbe0fcd0cbfc04aa79f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:13:30 +0200 +Subject: ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset + +From: Michael Walle + +[ Upstream commit edfea889a049abe80f0d55c0365bf60fbade272f ] + +The PHY reset line is connected to both the SoC (GPIO1_25) and +the CPLD. We must not use the GPIO1_25 as it will drive against +the output buffer of the CPLD. Instead there is another GPIO +(GPIO2_01), an input to the CPLD, which will tell the CPLD to +assert the PHY reset line. + +Fixes: 2a51f9dae13d ("ARM: dts: imx6qdl-kontron-samx6i: Add iMX6-based Kontron SMARC-sAMX6i module") +Fixes: 5694eed98cca ("ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +index d8c1dfb8c9abb..d6c049b9a9c69 100644 +--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +@@ -269,7 +269,7 @@ mdio { + ethphy: ethernet-phy@1 { + compatible = "ethernet-phy-ieee802.3-c22"; + reg = <1>; +- reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; ++ reset-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>; + reset-assert-us = <1000>; + }; + }; +@@ -516,7 +516,7 @@ MX6QDL_PAD_RGMII_RX_CTL__RGMII_RX_CTL 0x1b0b0 + MX6QDL_PAD_ENET_MDIO__ENET_MDIO 0x1b0b0 + MX6QDL_PAD_ENET_MDC__ENET_MDC 0x1b0b0 + MX6QDL_PAD_ENET_REF_CLK__ENET_TX_CLK 0x1b0b0 +- MX6QDL_PAD_ENET_CRS_DV__GPIO1_IO25 0x1b0b0 /* RST_GBE0_PHY# */ ++ MX6QDL_PAD_NANDF_D1__GPIO2_IO01 0x1b0b0 /* RST_GBE0_PHY# */ + >; + }; + +-- +2.43.0 + diff --git a/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-spi0-chip-selects.patch b/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-spi0-chip-selects.patch new file mode 100644 index 00000000000..de1b1381c77 --- /dev/null +++ b/queue-6.1/arm-dts-imx6qdl-kontron-samx6i-fix-spi0-chip-selects.patch @@ -0,0 +1,88 @@ +From dadc0ac9a77e466d70f4a3ea70176dc45d0fd216 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:13:33 +0200 +Subject: ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects + +From: Michael Walle + +[ Upstream commit 74e1c956a68a65d642447d852e95b3fbb69bebaa ] + +There is a comment in the imx6q variant dtsi claiming that these +modules will have one more chip select than the imx6dl variant. +This is wrong. Ordinary GPIOs are used for chip selects and both +variants of the module share the very same PCB and both have this +GPIO routed to the SPI0_CS1# pin of the SMARC connector. + +Fix it by moving the third chip select description to the common dtsi. + +Fixes: 2125212785c9 ("ARM: dts: imx6qdl-kontron-samx6i: add Kontron SMARC SoM Support") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6q-kontron-samx6i.dtsi | 23 ------------------- + arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 5 +++- + 2 files changed, 4 insertions(+), 24 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6q-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6q-kontron-samx6i.dtsi +index 4d6a0c3e8455f..ff062f4fd726e 100644 +--- a/arch/arm/boot/dts/imx6q-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/imx6q-kontron-samx6i.dtsi +@@ -5,31 +5,8 @@ + + #include "imx6q.dtsi" + #include "imx6qdl-kontron-samx6i.dtsi" +-#include + + / { + model = "Kontron SMARC sAMX6i Quad/Dual"; + compatible = "kontron,imx6q-samx6i", "fsl,imx6q"; + }; +- +-/* Quad/Dual SoMs have 3 chip-select signals */ +-&ecspi4 { +- cs-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>, +- <&gpio3 29 GPIO_ACTIVE_LOW>, +- <&gpio3 25 GPIO_ACTIVE_LOW>; +-}; +- +-&pinctrl_ecspi4 { +- fsl,pins = < +- MX6QDL_PAD_EIM_D21__ECSPI4_SCLK 0x100b1 +- MX6QDL_PAD_EIM_D28__ECSPI4_MOSI 0x100b1 +- MX6QDL_PAD_EIM_D22__ECSPI4_MISO 0x100b1 +- +- /* SPI4_IMX_CS2# - connected to internal flash */ +- MX6QDL_PAD_EIM_D24__GPIO3_IO24 0x1b0b0 +- /* SPI4_IMX_CS0# - connected to SMARC SPI0_CS0# */ +- MX6QDL_PAD_EIM_D29__GPIO3_IO29 0x1b0b0 +- /* SPI4_CS3# - connected to SMARC SPI0_CS1# */ +- MX6QDL_PAD_EIM_D25__GPIO3_IO25 0x1b0b0 +- >; +-}; +diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +index 700780bf64f58..78cbc2df279e6 100644 +--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +@@ -244,7 +244,8 @@ &ecspi4 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_ecspi4>; + cs-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>, +- <&gpio3 29 GPIO_ACTIVE_LOW>; ++ <&gpio3 29 GPIO_ACTIVE_LOW>, ++ <&gpio3 25 GPIO_ACTIVE_LOW>; + status = "okay"; + + /* default boot source: workaround #1 for errata ERR006282 */ +@@ -464,6 +465,8 @@ MX6QDL_PAD_EIM_D22__ECSPI4_MISO 0x100b1 + MX6QDL_PAD_EIM_D24__GPIO3_IO24 0x1b0b0 + /* SPI_IMX_CS0# - connected to SMARC SPI0_CS0# */ + MX6QDL_PAD_EIM_D29__GPIO3_IO29 0x1b0b0 ++ /* SPI4_CS3# - connected to SMARC SPI0_CS1# */ ++ MX6QDL_PAD_EIM_D25__GPIO3_IO25 0x1b0b0 + >; + }; + +-- +2.43.0 + diff --git a/queue-6.1/arm-spitz-fix-gpio-assignment-for-backlight.patch b/queue-6.1/arm-spitz-fix-gpio-assignment-for-backlight.patch new file mode 100644 index 00000000000..e69f67d265e --- /dev/null +++ b/queue-6.1/arm-spitz-fix-gpio-assignment-for-backlight.patch @@ -0,0 +1,91 @@ +From 4d4b61f1d38a41ee09a82413ec2c73435c4c8da8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 11:08:41 -0700 +Subject: ARM: spitz: fix GPIO assignment for backlight + +From: Dmitry Torokhov + +[ Upstream commit 78ab3d352f2982bf3f7e506bfbaba7afee1ed8a9 ] + +GPIOs controlling backlight on Spitz and Akita are coming from GPIO +expanders, not the pxa27xx-gpio block, correct it. + +Additionally GPIO lookup tables operate with pin numbers rather than +legacy GPIO numbers, fix that as well. Use raw numbers instead of legacy +GPIO names to avoid confusion. + +Fixes: ee0c8e494cc3 ("backlight: corgi: Convert to use GPIO descriptors") +Reviewed-by: Linus Walleij +Signed-off-by: Dmitry Torokhov +Link: https://lore.kernel.org/r/20240628180852.1738922-2-dmitry.torokhov@gmail.com +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-pxa/spitz.c | 30 ++++++++++-------------------- + 1 file changed, 10 insertions(+), 20 deletions(-) + +diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c +index 937f56bbaf6c6..effd28294da07 100644 +--- a/arch/arm/mach-pxa/spitz.c ++++ b/arch/arm/mach-pxa/spitz.c +@@ -512,10 +512,8 @@ static struct ads7846_platform_data spitz_ads7846_info = { + static struct gpiod_lookup_table spitz_lcdcon_gpio_table = { + .dev_id = "spi2.1", + .table = { +- GPIO_LOOKUP("gpio-pxa", SPITZ_GPIO_BACKLIGHT_CONT, +- "BL_CONT", GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("gpio-pxa", SPITZ_GPIO_BACKLIGHT_ON, +- "BL_ON", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("sharp-scoop.1", 6, "BL_CONT", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("sharp-scoop.1", 7, "BL_ON", GPIO_ACTIVE_HIGH), + { }, + }, + }; +@@ -523,10 +521,8 @@ static struct gpiod_lookup_table spitz_lcdcon_gpio_table = { + static struct gpiod_lookup_table akita_lcdcon_gpio_table = { + .dev_id = "spi2.1", + .table = { +- GPIO_LOOKUP("gpio-pxa", AKITA_GPIO_BACKLIGHT_CONT, +- "BL_CONT", GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("gpio-pxa", AKITA_GPIO_BACKLIGHT_ON, +- "BL_ON", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("i2c-max7310", 3, "BL_ON", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("i2c-max7310", 4, "BL_CONT", GPIO_ACTIVE_LOW), + { }, + }, + }; +@@ -953,12 +949,9 @@ static inline void spitz_i2c_init(void) {} + static struct gpiod_lookup_table spitz_audio_gpio_table = { + .dev_id = "spitz-audio", + .table = { +- GPIO_LOOKUP("sharp-scoop.0", SPITZ_GPIO_MUTE_L - SPITZ_SCP_GPIO_BASE, +- "mute-l", GPIO_ACTIVE_HIGH), +- GPIO_LOOKUP("sharp-scoop.0", SPITZ_GPIO_MUTE_R - SPITZ_SCP_GPIO_BASE, +- "mute-r", GPIO_ACTIVE_HIGH), +- GPIO_LOOKUP("sharp-scoop.1", SPITZ_GPIO_MIC_BIAS - SPITZ_SCP2_GPIO_BASE, +- "mic", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("sharp-scoop.0", 3, "mute-l", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("sharp-scoop.0", 4, "mute-r", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("sharp-scoop.1", 8, "mic", GPIO_ACTIVE_HIGH), + { }, + }, + }; +@@ -966,12 +959,9 @@ static struct gpiod_lookup_table spitz_audio_gpio_table = { + static struct gpiod_lookup_table akita_audio_gpio_table = { + .dev_id = "spitz-audio", + .table = { +- GPIO_LOOKUP("sharp-scoop.0", SPITZ_GPIO_MUTE_L - SPITZ_SCP_GPIO_BASE, +- "mute-l", GPIO_ACTIVE_HIGH), +- GPIO_LOOKUP("sharp-scoop.0", SPITZ_GPIO_MUTE_R - SPITZ_SCP_GPIO_BASE, +- "mute-r", GPIO_ACTIVE_HIGH), +- GPIO_LOOKUP("i2c-max7310", AKITA_GPIO_MIC_BIAS - AKITA_IOEXP_GPIO_BASE, +- "mic", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("sharp-scoop.0", 3, "mute-l", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("sharp-scoop.0", 4, "mute-r", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("i2c-max7310", 2, "mic", GPIO_ACTIVE_HIGH), + { }, + }, + }; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-amlogic-gx-correct-hdmi-clocks.patch b/queue-6.1/arm64-dts-amlogic-gx-correct-hdmi-clocks.patch new file mode 100644 index 00000000000..6a0fc442700 --- /dev/null +++ b/queue-6.1/arm64-dts-amlogic-gx-correct-hdmi-clocks.patch @@ -0,0 +1,63 @@ +From 0527613261d9a680024e42958d5aa384d04cacbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 17:27:30 +0200 +Subject: arm64: dts: amlogic: gx: correct hdmi clocks + +From: Jerome Brunet + +[ Upstream commit 0602ba0dcd0e76067a0b7543e92b2de3fb231073 ] + +The clocks provided to HDMI tx are not consistent between gx and g12: +* gx receives the peripheral clock as 'isfr' while g12 receives it as + 'iahb' +* g12 gets the HDMI system clock as 'isfr' but gx does not even get it. + It surely needs that clock since the driver is directly poking around + the clock controller's registers for that clock. + +Align gx SoCs with g12 and provide: + * the HDMI peripheral clock as 'iahb' + * the HDMI system clock as 'isfr' + +Fixes: 6939db7e0dbf ("ARM64: dts: meson-gx: Add support for HDMI output") +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20240626152733.1350376-2-jbrunet@baylibre.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi | 4 ++-- + arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi +index 7c029f552a23b..256c46771db78 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi +@@ -311,8 +311,8 @@ &hdmi_tx { + <&reset RESET_HDMI_SYSTEM_RESET>, + <&reset RESET_HDMI_TX>; + reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy"; +- clocks = <&clkc CLKID_HDMI_PCLK>, +- <&clkc CLKID_CLK81>, ++ clocks = <&clkc CLKID_HDMI>, ++ <&clkc CLKID_HDMI_PCLK>, + <&clkc CLKID_GCLK_VENCI_INT0>; + clock-names = "isfr", "iahb", "venci"; + }; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +index 3500229350522..a689bd14ece99 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +@@ -323,8 +323,8 @@ &hdmi_tx { + <&reset RESET_HDMI_SYSTEM_RESET>, + <&reset RESET_HDMI_TX>; + reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy"; +- clocks = <&clkc CLKID_HDMI_PCLK>, +- <&clkc CLKID_CLK81>, ++ clocks = <&clkc CLKID_HDMI>, ++ <&clkc CLKID_HDMI_PCLK>, + <&clkc CLKID_GCLK_VENCI_INT0>; + clock-names = "isfr", "iahb", "venci"; + }; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-amlogic-sm1-fix-spdif-compatibles.patch b/queue-6.1/arm64-dts-amlogic-sm1-fix-spdif-compatibles.patch new file mode 100644 index 00000000000..a835be8bb6e --- /dev/null +++ b/queue-6.1/arm64-dts-amlogic-sm1-fix-spdif-compatibles.patch @@ -0,0 +1,46 @@ +From 9b63c5ceb8c484b47fd3e56d688b96f991b418cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 13:18:43 +0200 +Subject: arm64: dts: amlogic: sm1: fix spdif compatibles + +From: Jerome Brunet + +[ Upstream commit b0aba467c329a89e8b325eda0cf60776958353fe ] + +The spdif input and output of g12 and sm1 are compatible but +sm1 should use the related compatible since it exists. + +Fixes: 86f2159468d5 ("arm64: dts: meson-sm1: add spdifin and pdifout nodes") +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20240625111845.928192-1-jbrunet@baylibre.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi +index 80737731af3fe..8bc4ef9d8a61a 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi +@@ -337,7 +337,7 @@ tdmin_lb: audio-controller@3c0 { + }; + + spdifin: audio-controller@400 { +- compatible = "amlogic,g12a-spdifin", ++ compatible = "amlogic,sm1-spdifin", + "amlogic,axg-spdifin"; + reg = <0x0 0x400 0x0 0x30>; + #sound-dai-cells = <0>; +@@ -351,7 +351,7 @@ spdifin: audio-controller@400 { + }; + + spdifout_a: audio-controller@480 { +- compatible = "amlogic,g12a-spdifout", ++ compatible = "amlogic,sm1-spdifout", + "amlogic,axg-spdifout"; + reg = <0x0 0x480 0x0 0x50>; + #sound-dai-cells = <0>; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-mediatek-mt7622-fix-emmc-pinctrl-mux.patch b/queue-6.1/arm64-dts-mediatek-mt7622-fix-emmc-pinctrl-mux.patch new file mode 100644 index 00000000000..11f30b4e1fa --- /dev/null +++ b/queue-6.1/arm64-dts-mediatek-mt7622-fix-emmc-pinctrl-mux.patch @@ -0,0 +1,66 @@ +From 73b4e744d80207acc0085e9b023ffeff14c0bd51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 09:49:16 +0200 +Subject: arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit aebba1030a5766cdf894ed4ab0cac7aed5aee9c1 ] + +Value "emmc_rst" is a group name and should be part of the "groups" +property. + +This fixes: +arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: pinctrl@10211000: emmc-pins-default:mux:function: ['emmc', 'emmc_rst'] is too long + from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt7622-pinctrl.yaml# +arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dtb: pinctrl@10211000: emmc-pins-default:mux:function: ['emmc', 'emmc_rst'] is too long + from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt7622-pinctrl.yaml# + +Fixes: 3725ba3f5574 ("arm64: dts: mt7622: add pinctrl related device nodes") +Fixes: 0b6286dd96c0 ("arm64: dts: mt7622: add bananapi BPI-R64 board") +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240604074916.7929-1-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 4 ++-- + arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +index b1ddc491d2936..9c9431455f854 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +@@ -286,8 +286,8 @@ asm_sel { + /* eMMC is shared pin with parallel NAND */ + emmc_pins_default: emmc-pins-default { + mux { +- function = "emmc", "emmc_rst"; +- groups = "emmc"; ++ function = "emmc"; ++ groups = "emmc", "emmc_rst"; + }; + + /* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7", +diff --git a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts +index 527dcb279ba52..f4bb9c6521c65 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts +@@ -244,8 +244,8 @@ &pio { + /* eMMC is shared pin with parallel NAND */ + emmc_pins_default: emmc-pins-default { + mux { +- function = "emmc", "emmc_rst"; +- groups = "emmc"; ++ function = "emmc"; ++ groups = "emmc", "emmc_rst"; + }; + + /* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7", +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-mediatek-mt8183-kukui-drop-bogus-output-en.patch b/queue-6.1/arm64-dts-mediatek-mt8183-kukui-drop-bogus-output-en.patch new file mode 100644 index 00000000000..444e4671507 --- /dev/null +++ b/queue-6.1/arm64-dts-mediatek-mt8183-kukui-drop-bogus-output-en.patch @@ -0,0 +1,51 @@ +From bdb94f01276c8dc0661f4ec512bdc6e2baf33b0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 15:56:12 +0800 +Subject: arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property + +From: Chen-Yu Tsai + +[ Upstream commit e9a9055fdcdc1e5a27cef118c5b4f09cdd2fa28e ] + +The "output-enable" property is set on uart1's RTS pin. This is bogus +because the hardware does not actually have a controllable output +buffer. Secondly, the implementation incorrectly treats this property +as a request to switch the pin to GPIO output. This does not fit the +intended semantic of "output-enable" and it does not have any affect +either because the pin is muxed to the UART function, not the GPIO +function. + +Drop the property. + +Fixes: cd894e274b74 ("arm64: dts: mt8183: Add krane-sku176 board") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20240412075613.1200048-1-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +index 1db97d94658b9..03ccdbb1c5edd 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +@@ -767,7 +767,6 @@ pins-tx { + }; + pins-rts { + pinmux = ; +- output-enable; + }; + pins-cts { + pinmux = ; +@@ -786,7 +785,6 @@ pins-tx { + }; + pins-rts { + pinmux = ; +- output-enable; + }; + pins-cts { + pinmux = ; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-mediatek-mt8183-kukui-jacuzzi-add-ports-no.patch b/queue-6.1/arm64-dts-mediatek-mt8183-kukui-jacuzzi-add-ports-no.patch new file mode 100644 index 00000000000..37c248c269c --- /dev/null +++ b/queue-6.1/arm64-dts-mediatek-mt8183-kukui-jacuzzi-add-ports-no.patch @@ -0,0 +1,69 @@ +From 15a2735cbfed9a7f36209fc701c5840cdff83c25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 16:39:29 +0800 +Subject: arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add ports node for + anx7625 + +From: Chen-Yu Tsai + +[ Upstream commit 4055416e6c51347e7dd5784065263fe0ced0bb7d ] + +The anx7625 binding requires a "ports" node as a container for the +"port" nodes. The jacuzzi dtsi file is missing it. + +Add a "ports" node under the anx7625 node, and move the port related +nodes and properties under it. + +Fixes: cabc71b08eb5 ("arm64: dts: mt8183: Add kukui-jacuzzi-damu board") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240131083931.3970388-1-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + .../dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 25 +++++++++++-------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +index 3d95625f1b0b4..d7fc924a9d0e3 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +@@ -168,21 +168,24 @@ anx_bridge: anx7625@58 { + vdd18-supply = <&pp1800_mipibrdg>; + vdd33-supply = <&vddio_mipibrdg>; + +- #address-cells = <1>; +- #size-cells = <0>; +- port@0 { +- reg = <0>; ++ ports { ++ #address-cells = <1>; ++ #size-cells = <0>; + +- anx7625_in: endpoint { +- remote-endpoint = <&dsi_out>; ++ port@0 { ++ reg = <0>; ++ ++ anx7625_in: endpoint { ++ remote-endpoint = <&dsi_out>; ++ }; + }; +- }; + +- port@1 { +- reg = <1>; ++ port@1 { ++ reg = <1>; + +- anx7625_out: endpoint { +- remote-endpoint = <&panel_in>; ++ anx7625_out: endpoint { ++ remote-endpoint = <&panel_in>; ++ }; + }; + }; + }; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-qcom-msm8996-specify-ufs-core_clk-frequenc.patch b/queue-6.1/arm64-dts-qcom-msm8996-specify-ufs-core_clk-frequenc.patch new file mode 100644 index 00000000000..cb2e2ee2b89 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8996-specify-ufs-core_clk-frequenc.patch @@ -0,0 +1,42 @@ +From 45e2d3b72934bcb381a3d534a498f31091745ada Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 03:04:31 +0300 +Subject: arm64: dts: qcom: msm8996: specify UFS core_clk frequencies + +From: Dmitry Baryshkov + +[ Upstream commit 02f838b7f8cdfb7a96b7f08e7f6716f230bdecba ] + +Follow the example of other platforms and specify core_clk frequencies +in the frequency table in addition to the core_clk_src frequencies. The +driver should be setting the leaf frequency instead of some interim +clock freq. + +Suggested-by: Nitin Rawat +Fixes: 57fc67ef0d35 ("arm64: dts: qcom: msm8996: Add ufs related nodes") +Reviewed-by: Konrad Dybcio +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240408-msm8996-fix-ufs-v4-1-ee1a28bf8579@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 986a5b5c05e48..3b9a4bf897014 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -2016,7 +2016,7 @@ ufshc: ufshc@624000 { + <&gcc GCC_UFS_RX_SYMBOL_0_CLK>; + freq-table-hz = + <100000000 200000000>, +- <0 0>, ++ <100000000 200000000>, + <0 0>, + <0 0>, + <0 0>, +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-qcom-msm8996-xiaomi-common-drop-excton-fro.patch b/queue-6.1/arm64-dts-qcom-msm8996-xiaomi-common-drop-excton-fro.patch new file mode 100644 index 00000000000..113af71e23c --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8996-xiaomi-common-drop-excton-fro.patch @@ -0,0 +1,38 @@ +From fc040324b9135974c3623422bcde5f0b70731e04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:39 +0300 +Subject: arm64: dts: qcom: msm8996-xiaomi-common: drop excton from the USB PHY + +From: Dmitry Baryshkov + +[ Upstream commit c1aefeae8cb7b71c1bb6d33b1bda7fc322094e16 ] + +The USB PHYs don't use extcon connectors, drop the extcon property from +the hsusb_phy1 node. + +Fixes: 46680fe9ba61 ("arm64: dts: qcom: msm8996: Add support for the Xiaomi MSM8996 platform") +Cc: Yassine Oudjana +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-13-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996-xiaomi-common.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-common.dtsi b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-common.dtsi +index 77819186086ac..de320bebe4124 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-common.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-common.dtsi +@@ -368,7 +368,6 @@ &usb3_dwc3 { + + &hsusb_phy1 { + status = "okay"; +- extcon = <&typec>; + + vdda-pll-supply = <&vreg_l12a_1p8>; + vdda-phy-dpdm-supply = <&vreg_l24a_3p075>; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-qcom-msm8998-enable-adreno_smmu-by-default.patch b/queue-6.1/arm64-dts-qcom-msm8998-enable-adreno_smmu-by-default.patch new file mode 100644 index 00000000000..e7fe74f7fdb --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8998-enable-adreno_smmu-by-default.patch @@ -0,0 +1,48 @@ +From 94daab312bf4f145bcc13178f32a037d79d0e708 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 16:27:44 +0200 +Subject: arm64: dts: qcom: msm8998: enable adreno_smmu by default + +From: Marc Gonzalez + +[ Upstream commit 98a0c4f2278b4d6c1c7722735c20b2247de6293f ] + +15 qcom platform DTSI files define an adreno_smmu node. +msm8998 is the only one with adreno_smmu disabled by default. + +There's no reason why this SMMU should be disabled by default, +it doesn't need any further configuration. + +Bring msm8998 in line with the 14 other platforms. + +This fixes GPU init failing with ENODEV: +msm_dpu c901000.display-controller: failed to load adreno gpu +msm_dpu c901000.display-controller: failed to bind 5000000.gpu (ops a3xx_ops): -19 + +Fixes: 87cd46d68aeac8 ("Configure Adreno GPU and related IOMMU") +Signed-off-by: Marc Gonzalez +Reviewed-by: Bryan O'Donoghue +Reviewed-by: Marijn Suijten +Reviewed-by: Jeffrey Hugo +Link: https://lore.kernel.org/r/be51d1a4-e8fc-48d1-9afb-a42b1d6ca478@freebox.fr +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi +index 7a41250539ff5..3d4941dc31d74 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -1457,7 +1457,6 @@ adreno_smmu: iommu@5040000 { + * SoC VDDMX RPM Power Domain in the Adreno driver. + */ + power-domains = <&gpucc GPU_GX_GDSC>; +- status = "disabled"; + }; + + gpucc: clock-controller@5065000 { +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-qcom-sdm845-add-power-domain-to-ufs-phy.patch b/queue-6.1/arm64-dts-qcom-sdm845-add-power-domain-to-ufs-phy.patch new file mode 100644 index 00000000000..f145dbb8db4 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sdm845-add-power-domain-to-ufs-phy.patch @@ -0,0 +1,38 @@ +From fae32908ed2d0bf9a7c1db4bd2353e0fef1d85c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:32 +0300 +Subject: arm64: dts: qcom: sdm845: add power-domain to UFS PHY + +From: Dmitry Baryshkov + +[ Upstream commit fd39ae8b9bc10419b1e4b849cdbc6755a967ade1 ] + +The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add +corresponding power-domain the the PHY node. + +Fixes: cc16687fbd74 ("arm64: dts: qcom: sdm845: add UFS controller") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-6-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 95c515da9f2e0..71644b9b8866a 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -2537,6 +2537,8 @@ ufs_mem_phy: phy@1d87000 { + clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>, + <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; + ++ power-domains = <&gcc UFS_PHY_GDSC>; ++ + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; + status = "disabled"; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-qcom-sm6350-add-missing-qcom-non-secure-do.patch b/queue-6.1/arm64-dts-qcom-sm6350-add-missing-qcom-non-secure-do.patch new file mode 100644 index 00000000000..b97b455528f --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm6350-add-missing-qcom-non-secure-do.patch @@ -0,0 +1,46 @@ +From e4dab00f449b4a040f2a4bb89c315335eeccda4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jul 2024 09:43:11 +0200 +Subject: arm64: dts: qcom: sm6350: Add missing qcom,non-secure-domain property + +From: Luca Weiss + +[ Upstream commit 81008068ee4f2c4c26e97a0404405bb4b450241b ] + +By default the DSP domains are secure, add the missing +qcom,non-secure-domain property to mark them as non-secure. + +Fixes: efc33c969f23 ("arm64: dts: qcom: sm6350: Add ADSP nodes") +Fixes: 8eb5287e8a42 ("arm64: dts: qcom: sm6350: Add CDSP nodes") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20240705-sm6350-fastrpc-fix-v2-1-89a43166c9bb@fairphone.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6350.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi +index 66998df053d52..ba078099b8054 100644 +--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi +@@ -895,6 +895,7 @@ fastrpc { + compatible = "qcom,fastrpc"; + qcom,glink-channels = "fastrpcglink-apps-dsp"; + label = "adsp"; ++ qcom,non-secure-domain; + #address-cells = <1>; + #size-cells = <0>; + +@@ -1002,6 +1003,7 @@ fastrpc { + compatible = "qcom,fastrpc"; + qcom,glink-channels = "fastrpcglink-apps-dsp"; + label = "cdsp"; ++ qcom,non-secure-domain; + #address-cells = <1>; + #size-cells = <0>; + +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-qcom-sm6350-add-power-domain-to-ufs-phy.patch b/queue-6.1/arm64-dts-qcom-sm6350-add-power-domain-to-ufs-phy.patch new file mode 100644 index 00000000000..28d0a824980 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm6350-add-power-domain-to-ufs-phy.patch @@ -0,0 +1,38 @@ +From 67f172207dc63a2ccaa98b7c2beff801d2b08475 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:34 +0300 +Subject: arm64: dts: qcom: sm6350: add power-domain to UFS PHY + +From: Dmitry Baryshkov + +[ Upstream commit 18c2727282c5264ff5502daac26c43000e8eb202 ] + +The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add +corresponding power-domain the the PHY node. + +Fixes: 5a814af5fc22 ("arm64: dts: qcom: sm6350: Add UFS nodes") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-8-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6350.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi +index 9da373090593c..66998df053d52 100644 +--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi +@@ -830,6 +830,8 @@ ufs_mem_phy: phy@1d87000 { + clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>, + <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; + ++ power-domains = <&gcc UFS_PHY_GDSC>; ++ + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; + +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-qcom-sm8250-add-power-domain-to-ufs-phy.patch b/queue-6.1/arm64-dts-qcom-sm8250-add-power-domain-to-ufs-phy.patch new file mode 100644 index 00000000000..094a7365f1d --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8250-add-power-domain-to-ufs-phy.patch @@ -0,0 +1,38 @@ +From d6a697f2e1f7889657c2e87c4aeb00d6f341d0bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:35 +0300 +Subject: arm64: dts: qcom: sm8250: add power-domain to UFS PHY + +From: Dmitry Baryshkov + +[ Upstream commit 154ed5ea328d8a97a4ef5d1447e6f06d11fe2bbe ] + +The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add +corresponding power-domain the the PHY node. + +Fixes: b7e2fba06622 ("arm64: dts: qcom: sm8250: Add UFS controller and PHY") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-9-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index 194fb00051d66..6a2852584405e 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -2179,6 +2179,8 @@ ufs_mem_phy: phy@1d87000 { + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; + ++ power-domains = <&gcc UFS_PHY_GDSC>; ++ + #phy-cells = <0>; + + status = "disabled"; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-qcom-sm8250-switch-ufs-qmp-phy-to-new-styl.patch b/queue-6.1/arm64-dts-qcom-sm8250-switch-ufs-qmp-phy-to-new-styl.patch new file mode 100644 index 00000000000..01e085592a7 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8250-switch-ufs-qmp-phy-to-new-styl.patch @@ -0,0 +1,71 @@ +From 1cf9c7eff96720ef4b401e0650c9821f356d4717 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 06:25:50 +0300 +Subject: arm64: dts: qcom: sm8250: switch UFS QMP PHY to new style of bindings + +From: Dmitry Baryshkov + +[ Upstream commit ba865bdcc688932980b8e5ec2154eaa33cd4a981 ] + +Change the UFS QMP PHY to use newer style of QMP PHY bindings (single +resource region, no per-PHY subnodes). + +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20231205032552.1583336-8-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: 154ed5ea328d ("arm64: dts: qcom: sm8250: add power-domain to UFS PHY") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 20 ++++++-------------- + 1 file changed, 6 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index 3d02adbc0b62f..194fb00051d66 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -2125,7 +2125,7 @@ ufs_mem_hc: ufshc@1d84000 { + "jedec,ufs-2.0"; + reg = <0 0x01d84000 0 0x3000>; + interrupts = ; +- phys = <&ufs_mem_phy_lanes>; ++ phys = <&ufs_mem_phy>; + phy-names = "ufsphy"; + lanes-per-direction = <2>; + #reset-cells = <1>; +@@ -2169,10 +2169,8 @@ ufs_mem_hc: ufshc@1d84000 { + + ufs_mem_phy: phy@1d87000 { + compatible = "qcom,sm8250-qmp-ufs-phy"; +- reg = <0 0x01d87000 0 0x1c0>; +- #address-cells = <2>; +- #size-cells = <2>; +- ranges; ++ reg = <0 0x01d87000 0 0x1000>; ++ + clock-names = "ref", + "ref_aux"; + clocks = <&rpmhcc RPMH_CXO_CLK>, +@@ -2180,16 +2178,10 @@ ufs_mem_phy: phy@1d87000 { + + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; +- status = "disabled"; + +- ufs_mem_phy_lanes: phy@1d87400 { +- reg = <0 0x01d87400 0 0x16c>, +- <0 0x01d87600 0 0x200>, +- <0 0x01d87c00 0 0x200>, +- <0 0x01d87800 0 0x16c>, +- <0 0x01d87a00 0 0x200>; +- #phy-cells = <0>; +- }; ++ #phy-cells = <0>; ++ ++ status = "disabled"; + }; + + ipa_virt: interconnect@1e00000 { +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-qcom-sm8450-add-power-domain-to-ufs-phy.patch b/queue-6.1/arm64-dts-qcom-sm8450-add-power-domain-to-ufs-phy.patch new file mode 100644 index 00000000000..3a39e7f64c8 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sm8450-add-power-domain-to-ufs-phy.patch @@ -0,0 +1,38 @@ +From af74da3d2be66deda55c42d546b4388fedf967b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:37 +0300 +Subject: arm64: dts: qcom: sm8450: add power-domain to UFS PHY + +From: Dmitry Baryshkov + +[ Upstream commit 27d3f57cf5a71484ea38770d4bfd10f6ef035cf4 ] + +The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add +corresponding power-domain the the PHY node. + +Fixes: 07fa917a335e ("arm64: dts: qcom: sm8450: add ufs nodes") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-11-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index 128542582b3d8..aa0977af9411a 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -3153,6 +3153,8 @@ ufs_mem_phy: phy@1d87000 { + <&gcc GCC_UFS_PHY_PHY_AUX_CLK>, + <&gcc GCC_UFS_0_CLKREF_EN>; + ++ power-domains = <&gcc UFS_PHY_GDSC>; ++ + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; + status = "disabled"; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-renesas-drop-specifying-the-gic_cpu_mask_s.patch b/queue-6.1/arm64-dts-renesas-drop-specifying-the-gic_cpu_mask_s.patch new file mode 100644 index 00000000000..a82d182e99d --- /dev/null +++ b/queue-6.1/arm64-dts-renesas-drop-specifying-the-gic_cpu_mask_s.patch @@ -0,0 +1,224 @@ +From 2a000138686b3d34fd0e6e8279cf2e18db645e65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 00:21:36 +0000 +Subject: arm64: dts: renesas: Drop specifying the GIC_CPU_MASK_SIMPLE() for + GICv3 systems + +From: Lad Prabhakar + +[ Upstream commit 8b6a006c914aac1702ef85b4ea42ff566b157c85 ] + +The GICv3 interrupts binding does not have a cpumask. The CPU mask only +applies to pre-GICv3. So just drop using them from GICv3 systems. + +Signed-off-by: Lad Prabhakar +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230206002136.29401-1-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Stable-dep-of: 6fca24a07e1d ("arm64: dts: renesas: r8a779a0: Add missing hypervisor virtual timer IRQ") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779a0.dtsi | 11 +++++------ + arch/arm64/boot/dts/renesas/r8a779f0.dtsi | 11 +++++------ + arch/arm64/boot/dts/renesas/r8a779g0.dtsi | 11 +++++------ + arch/arm64/boot/dts/renesas/r9a07g043u.dtsi | 8 ++++---- + arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 8 ++++---- + arch/arm64/boot/dts/renesas/r9a07g044c1.dtsi | 7 ------- + arch/arm64/boot/dts/renesas/r9a07g044l1.dtsi | 7 ------- + arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 8 ++++---- + arch/arm64/boot/dts/renesas/r9a07g054l1.dtsi | 7 ------- + 9 files changed, 27 insertions(+), 51 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi +index b677ef6705d94..fa76827c81c93 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi +@@ -2209,8 +2209,7 @@ gic: interrupt-controller@f1000000 { + interrupt-controller; + reg = <0x0 0xf1000000 0 0x20000>, + <0x0 0xf1060000 0 0x110000>; +- interrupts = ; ++ interrupts = ; + }; + + fcpvd0: fcp@fea10000 { +@@ -2857,9 +2856,9 @@ sensor5_crit: sensor5-crit { + + timer { + compatible = "arm,armv8-timer"; +- interrupts-extended = <&gic GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>; ++ interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; + }; + }; +diff --git a/arch/arm64/boot/dts/renesas/r8a779f0.dtsi b/arch/arm64/boot/dts/renesas/r8a779f0.dtsi +index 4092c0016035e..ba94e4d31cc8d 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779f0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779f0.dtsi +@@ -935,8 +935,7 @@ gic: interrupt-controller@f1000000 { + interrupt-controller; + reg = <0x0 0xf1000000 0 0x20000>, + <0x0 0xf1060000 0 0x110000>; +- interrupts = ; ++ interrupts = ; + }; + + prr: chipid@fff00044 { +@@ -991,10 +990,10 @@ sensor3_crit: sensor3-crit { + + timer { + compatible = "arm,armv8-timer"; +- interrupts-extended = <&gic GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>; ++ interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; + }; + + ufs30_clk: ufs30-clk { +diff --git a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +index 8aa3ea645668c..369370c0a61e3 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +@@ -550,8 +550,7 @@ gic: interrupt-controller@f1000000 { + interrupt-controller; + reg = <0x0 0xf1000000 0 0x20000>, + <0x0 0xf1060000 0 0x110000>; +- interrupts = ; ++ interrupts = ; + }; + + prr: chipid@fff00044 { +@@ -562,9 +561,9 @@ prr: chipid@fff00044 { + + timer { + compatible = "arm,armv8-timer"; +- interrupts-extended = <&gic GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>; ++ interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; + }; + }; +diff --git a/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi b/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi +index 011d4c88f4ed9..beab2bfd253b8 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi +@@ -41,10 +41,10 @@ psci { + + timer { + compatible = "arm,armv8-timer"; +- interrupts-extended = <&gic GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>; ++ interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; + }; + }; + +diff --git a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi +index d26488b5a82df..4a74906061dd8 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi +@@ -1091,9 +1091,9 @@ target: trip-point { + + timer { + compatible = "arm,armv8-timer"; +- interrupts-extended = <&gic GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>; ++ interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; + }; + }; +diff --git a/arch/arm64/boot/dts/renesas/r9a07g044c1.dtsi b/arch/arm64/boot/dts/renesas/r9a07g044c1.dtsi +index 1d57df706939c..56a979e82c4f1 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g044c1.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g044c1.dtsi +@@ -15,13 +15,6 @@ cpus { + /delete-node/ cpu-map; + /delete-node/ cpu@100; + }; +- +- timer { +- interrupts-extended = <&gic GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>; +- }; + }; + + &soc { +diff --git a/arch/arm64/boot/dts/renesas/r9a07g044l1.dtsi b/arch/arm64/boot/dts/renesas/r9a07g044l1.dtsi +index 9d89d4590358e..9cf27ca9f1d2a 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g044l1.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g044l1.dtsi +@@ -15,11 +15,4 @@ cpus { + /delete-node/ cpu-map; + /delete-node/ cpu@100; + }; +- +- timer { +- interrupts-extended = <&gic GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>; +- }; + }; +diff --git a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi +index b3d37ca942ee3..0e319cc2460c5 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi +@@ -1097,9 +1097,9 @@ target: trip-point { + + timer { + compatible = "arm,armv8-timer"; +- interrupts-extended = <&gic GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>; ++ interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; + }; + }; +diff --git a/arch/arm64/boot/dts/renesas/r9a07g054l1.dtsi b/arch/arm64/boot/dts/renesas/r9a07g054l1.dtsi +index c448cc6634c1a..d85a6ac0f0245 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g054l1.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g054l1.dtsi +@@ -15,11 +15,4 @@ cpus { + /delete-node/ cpu-map; + /delete-node/ cpu@100; + }; +- +- timer { +- interrupts-extended = <&gic GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>; +- }; + }; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-renesas-r8a779a0-add-missing-hypervisor-vi.patch b/queue-6.1/arm64-dts-renesas-r8a779a0-add-missing-hypervisor-vi.patch new file mode 100644 index 00000000000..6ded52033ec --- /dev/null +++ b/queue-6.1/arm64-dts-renesas-r8a779a0-add-missing-hypervisor-vi.patch @@ -0,0 +1,40 @@ +From b3190913910478a02352f1f7cb3e33beeb9cb7ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:57:31 +0200 +Subject: arm64: dts: renesas: r8a779a0: Add missing hypervisor virtual timer + IRQ + +From: Geert Uytterhoeven + +[ Upstream commit 6fca24a07e1de664c3d0b280043302e0387726df ] + +Add the missing fifth interrupt to the device node that represents the +ARM architected timer. While at it, add an interrupt-names property for +clarity, + +Fixes: 834c310f541839b6 ("arm64: dts: renesas: Add Renesas R8A779A0 SoC support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/671416fb31e3992101c32fe7e46147fe4cd623ae.1718890849.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779a0.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi +index fa76827c81c93..158c99b1a7b79 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi +@@ -2859,6 +2859,9 @@ timer { + interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, +- <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-names = "sec-phys", "phys", "virt", "hyp-phys", ++ "hyp-virt"; + }; + }; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-renesas-r8a779f0-add-missing-hypervisor-vi.patch b/queue-6.1/arm64-dts-renesas-r8a779f0-add-missing-hypervisor-vi.patch new file mode 100644 index 00000000000..4d286ead05e --- /dev/null +++ b/queue-6.1/arm64-dts-renesas-r8a779f0-add-missing-hypervisor-vi.patch @@ -0,0 +1,41 @@ +From a3eca2a75383c8f326fac8bd487f4c9295c1d7bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:57:32 +0200 +Subject: arm64: dts: renesas: r8a779f0: Add missing hypervisor virtual timer + IRQ + +From: Geert Uytterhoeven + +[ Upstream commit b1c34567aebe300f9a0f70320eaeef0b3d56ffc7 ] + +Add the missing fifth interrupt to the device node that represents the +ARM architected timer. While at it, add an interrupt-names property for +clarity, + +Fixes: c62331e8222f8f21 ("arm64: dts: renesas: Add Renesas R8A779F0 SoC support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/46deba1008f73e4b6864f937642d17f9d4ae7205.1718890849.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779f0.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779f0.dtsi b/arch/arm64/boot/dts/renesas/r8a779f0.dtsi +index ba94e4d31cc8d..140c4672ff5b0 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779f0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779f0.dtsi +@@ -993,7 +993,10 @@ timer { + interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, +- <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-names = "sec-phys", "phys", "virt", "hyp-phys", ++ "hyp-virt"; + }; + + ufs30_clk: ufs30-clk { +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-renesas-r8a779g0-add-l3-cache-controller.patch b/queue-6.1/arm64-dts-renesas-r8a779g0-add-l3-cache-controller.patch new file mode 100644 index 00000000000..375b8ae0c6c --- /dev/null +++ b/queue-6.1/arm64-dts-renesas-r8a779g0-add-l3-cache-controller.patch @@ -0,0 +1,44 @@ +From b48f0d2c99d8f2f687700af468c9c00afa1247bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 13:49:00 +0100 +Subject: arm64: dts: renesas: r8a779g0: Add L3 cache controller + +From: Geert Uytterhoeven + +[ Upstream commit f08407210db921a4c9eaeaa92d0c434858b9c6c4 ] + +Describe the cache configuration for the first Cortex-A76 CPU core on +the Renesas R-Car V4H (R8A779G0) SoC. + +Extracted from a larger patch in the BSP by Takeshi Kihara. + +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/dfd743b32198295afb78bc0ac337ef283fa3879a.1668429870.git.geert+renesas@glider.be +Stable-dep-of: 6fca24a07e1d ("arm64: dts: renesas: r8a779a0: Add missing hypervisor virtual timer IRQ") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779g0.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +index 868d1a3cbdf61..9f6a30cf315f2 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +@@ -23,6 +23,14 @@ a76_0: cpu@0 { + reg = <0>; + device_type = "cpu"; + power-domains = <&sysc R8A779G0_PD_A1E0D0C0>; ++ next-level-cache = <&L3_CA76_0>; ++ }; ++ ++ L3_CA76_0: cache-controller-0 { ++ compatible = "cache"; ++ power-domains = <&sysc R8A779G0_PD_A2E0D0>; ++ cache-unified; ++ cache-level = <3>; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-renesas-r8a779g0-add-missing-hypervisor-vi.patch b/queue-6.1/arm64-dts-renesas-r8a779g0-add-missing-hypervisor-vi.patch new file mode 100644 index 00000000000..c0bea97116d --- /dev/null +++ b/queue-6.1/arm64-dts-renesas-r8a779g0-add-missing-hypervisor-vi.patch @@ -0,0 +1,40 @@ +From e5050415d87f4b95f8a4acbfab6823b9c25e2a9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:57:33 +0200 +Subject: arm64: dts: renesas: r8a779g0: Add missing hypervisor virtual timer + IRQ + +From: Geert Uytterhoeven + +[ Upstream commit 6775165fc95052a03acc91e25bc20fcf286910a7 ] + +Add the missing fifth interrupt to the device node that represents the +ARM architected timer. While at it, add an interrupt-names property for +clarity, + +Fixes: 987da486d84a5643 ("arm64: dts: renesas: Add Renesas R8A779G0 SoC support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/5eeabbeaea1c5fd518a608f2e8013d260b00fd7e.1718890849.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779g0.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +index 369370c0a61e3..3de3ea0073c3e 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +@@ -564,6 +564,9 @@ timer { + interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, +- <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-names = "sec-phys", "phys", "virt", "hyp-phys", ++ "hyp-virt"; + }; + }; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-renesas-r8a779g0-add-secondary-ca76-cpu-co.patch b/queue-6.1/arm64-dts-renesas-r8a779g0-add-secondary-ca76-cpu-co.patch new file mode 100644 index 00000000000..4db2d18e562 --- /dev/null +++ b/queue-6.1/arm64-dts-renesas-r8a779g0-add-secondary-ca76-cpu-co.patch @@ -0,0 +1,135 @@ +From 8c8b8fd273d6831c0ff5b8d8a5cd4245f7f6210a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 13:49:01 +0100 +Subject: arm64: dts: renesas: r8a779g0: Add secondary CA76 CPU cores + +From: Geert Uytterhoeven + +[ Upstream commit 68c9c53d45fa9c48a89d8a9a4d1555b9e91add69 ] + +Complete the description of the Cortex-A76 CPU cores and L3 cache +controllers on the Renesas R-Car V4H (R8A779G0) SoC, including CPU +topology and PSCI support for enabling CPU cores. + +R-Car V4H has 4 Cortex-A76 cores, grouped in 2 clusters. + +Based on a patch in the BSP by Takeshi Kihara. + +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/ccb55458bd87f8ba70d28c61bcc254f22184824c.1668429870.git.geert+renesas@glider.be +Stable-dep-of: 6fca24a07e1d ("arm64: dts: renesas: r8a779a0: Add missing hypervisor virtual timer IRQ") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779g0.dtsi | 70 +++++++++++++++++++++-- + 1 file changed, 65 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +index 9f6a30cf315f2..8aa3ea645668c 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +@@ -18,12 +18,60 @@ cpus { + #address-cells = <1>; + #size-cells = <0>; + ++ cpu-map { ++ cluster0 { ++ core0 { ++ cpu = <&a76_0>; ++ }; ++ core1 { ++ cpu = <&a76_1>; ++ }; ++ }; ++ ++ cluster1 { ++ core0 { ++ cpu = <&a76_2>; ++ }; ++ core1 { ++ cpu = <&a76_3>; ++ }; ++ }; ++ }; ++ + a76_0: cpu@0 { + compatible = "arm,cortex-a76"; + reg = <0>; + device_type = "cpu"; + power-domains = <&sysc R8A779G0_PD_A1E0D0C0>; + next-level-cache = <&L3_CA76_0>; ++ enable-method = "psci"; ++ }; ++ ++ a76_1: cpu@100 { ++ compatible = "arm,cortex-a76"; ++ reg = <0x100>; ++ device_type = "cpu"; ++ power-domains = <&sysc R8A779G0_PD_A1E0D0C1>; ++ next-level-cache = <&L3_CA76_0>; ++ enable-method = "psci"; ++ }; ++ ++ a76_2: cpu@10000 { ++ compatible = "arm,cortex-a76"; ++ reg = <0x10000>; ++ device_type = "cpu"; ++ power-domains = <&sysc R8A779G0_PD_A1E0D1C0>; ++ next-level-cache = <&L3_CA76_1>; ++ enable-method = "psci"; ++ }; ++ ++ a76_3: cpu@10100 { ++ compatible = "arm,cortex-a76"; ++ reg = <0x10100>; ++ device_type = "cpu"; ++ power-domains = <&sysc R8A779G0_PD_A1E0D1C1>; ++ next-level-cache = <&L3_CA76_1>; ++ enable-method = "psci"; + }; + + L3_CA76_0: cache-controller-0 { +@@ -32,6 +80,18 @@ L3_CA76_0: cache-controller-0 { + cache-unified; + cache-level = <3>; + }; ++ ++ L3_CA76_1: cache-controller-1 { ++ compatible = "cache"; ++ power-domains = <&sysc R8A779G0_PD_A2E0D1>; ++ cache-unified; ++ cache-level = <3>; ++ }; ++ }; ++ ++ psci { ++ compatible = "arm,psci-1.0", "arm,psci-0.2"; ++ method = "smc"; + }; + + extal_clk: extal { +@@ -491,7 +551,7 @@ gic: interrupt-controller@f1000000 { + reg = <0x0 0xf1000000 0 0x20000>, + <0x0 0xf1060000 0 0x110000>; + interrupts = ; ++ (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>; + }; + + prr: chipid@fff00044 { +@@ -502,9 +562,9 @@ prr: chipid@fff00044 { + + timer { + compatible = "arm,armv8-timer"; +- interrupts-extended = <&gic GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>, +- <&gic GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(1) | IRQ_TYPE_LEVEL_LOW)>; ++ interrupts-extended = <&gic GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>, ++ <&gic GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>, ++ <&gic GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>, ++ <&gic GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>; + }; + }; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-renesas-r9a07g043u-add-missing-hypervisor-.patch b/queue-6.1/arm64-dts-renesas-r9a07g043u-add-missing-hypervisor-.patch new file mode 100644 index 00000000000..cf2a84a90a4 --- /dev/null +++ b/queue-6.1/arm64-dts-renesas-r9a07g043u-add-missing-hypervisor-.patch @@ -0,0 +1,42 @@ +From 092ec7a248b9292c87d14a6ed6e5f4e1cc50a247 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:57:34 +0200 +Subject: arm64: dts: renesas: r9a07g043u: Add missing hypervisor virtual timer + IRQ + +From: Geert Uytterhoeven + +[ Upstream commit 4036bae6dfd782d414040e7d714abc525b2e8792 ] + +Add the missing fifth interrupt to the device node that represents the +ARM architected timer. While at it, add an interrupt-names property for +clarity, + +Fixes: cf40c9689e5109bf ("arm64: dts: renesas: Add initial DTSI for RZ/G2UL SoC") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Lad Prabhakar +Link: https://lore.kernel.org/15cc7a7522b1658327a2bd0c4990d0131bbcb4d7.1718890849.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r9a07g043u.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi b/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi +index beab2bfd253b8..2e7db48462e1f 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi +@@ -44,7 +44,10 @@ timer { + interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, +- <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-names = "sec-phys", "phys", "virt", "hyp-phys", ++ "hyp-virt"; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-renesas-r9a07g044-add-missing-hypervisor-v.patch b/queue-6.1/arm64-dts-renesas-r9a07g044-add-missing-hypervisor-v.patch new file mode 100644 index 00000000000..4327fe86c4e --- /dev/null +++ b/queue-6.1/arm64-dts-renesas-r9a07g044-add-missing-hypervisor-v.patch @@ -0,0 +1,41 @@ +From b91bacfbc15daaa928545ec89b3b5d17665dd460 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:57:35 +0200 +Subject: arm64: dts: renesas: r9a07g044: Add missing hypervisor virtual timer + IRQ + +From: Geert Uytterhoeven + +[ Upstream commit ecbc5206a1a0532258144a4703cccf4e70f3fe6c ] + +Add the missing fifth interrupt to the device node that represents the +ARM architected timer. While at it, add an interrupt-names property for +clarity, + +Fixes: 68a45525297b2e9a ("arm64: dts: renesas: Add initial DTSI for RZ/G2{L,LC} SoC's") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Lad Prabhakar +Link: https://lore.kernel.org/21f556eb7e903d5b9f4c96188fd4b6ae0db71856.1718890849.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi +index 4a74906061dd8..4703fbc9a8e0a 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi +@@ -1094,6 +1094,9 @@ timer { + interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, +- <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-names = "sec-phys", "phys", "virt", "hyp-phys", ++ "hyp-virt"; + }; + }; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-renesas-r9a07g054-add-missing-hypervisor-v.patch b/queue-6.1/arm64-dts-renesas-r9a07g054-add-missing-hypervisor-v.patch new file mode 100644 index 00000000000..5b2ab0cc68a --- /dev/null +++ b/queue-6.1/arm64-dts-renesas-r9a07g054-add-missing-hypervisor-v.patch @@ -0,0 +1,41 @@ +From a923c0c051649c08f0633212b10e5ee7dd134bb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:57:36 +0200 +Subject: arm64: dts: renesas: r9a07g054: Add missing hypervisor virtual timer + IRQ + +From: Geert Uytterhoeven + +[ Upstream commit 2918674704aad620215c41979a331021fe3f1ec4 ] + +Add the missing fifth interrupt to the device node that represents the +ARM architected timer. While at it, add an interrupt-names property for +clarity, + +Fixes: 7c2b8198f4f321df ("arm64: dts: renesas: Add initial DTSI for RZ/V2L SoC") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Lad Prabhakar +Link: https://lore.kernel.org/834244e77e5f407ee6fab1ab5c10c98a8a933085.1718890849.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi +index 0e319cc2460c5..60a20a3ca12e3 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi +@@ -1100,6 +1100,9 @@ timer { + interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, +- <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-names = "sec-phys", "phys", "virt", "hyp-phys", ++ "hyp-virt"; + }; + }; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-rockchip-add-mdio-and-ethernet-phy-nodes-t.patch b/queue-6.1/arm64-dts-rockchip-add-mdio-and-ethernet-phy-nodes-t.patch new file mode 100644 index 00000000000..293e80d077b --- /dev/null +++ b/queue-6.1/arm64-dts-rockchip-add-mdio-and-ethernet-phy-nodes-t.patch @@ -0,0 +1,71 @@ +From f522adb75eb4a810ddaed6a0f57e8dce87cdfcb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 21:10:10 +0000 +Subject: arm64: dts: rockchip: Add mdio and ethernet-phy nodes to + rk3308-rock-pi-s + +From: Jonas Karlman + +[ Upstream commit 4b64ed510ed946a4e4ca6d51d6512bf5361f6a04 ] + +Be explicit about the Ethernet port and define mdio and ethernet-phy +nodes in the device tree for ROCK Pi S. + +Fixes: bc3753aed81f ("arm64: dts: rockchip: rock-pi-s add more peripherals") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20240521211029.1236094-8-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + .../boot/dts/rockchip/rk3308-rock-pi-s.dts | 26 ++++++++++++++++--- + 1 file changed, 23 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +index a78e76c865e8e..6b4afdde6e94c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +@@ -145,11 +145,25 @@ &emmc { + + &gmac { + clock_in_out = "output"; ++ phy-handle = <&rtl8201f>; + phy-supply = <&vcc_io>; +- snps,reset-gpio = <&gpio0 RK_PA7 GPIO_ACTIVE_LOW>; +- snps,reset-active-low; +- snps,reset-delays-us = <0 50000 50000>; + status = "okay"; ++ ++ mdio { ++ compatible = "snps,dwmac-mdio"; ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ rtl8201f: ethernet-phy@1 { ++ compatible = "ethernet-phy-ieee802.3-c22"; ++ reg = <1>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&mac_rst>; ++ reset-assert-us = <20000>; ++ reset-deassert-us = <50000>; ++ reset-gpios = <&gpio0 RK_PA7 GPIO_ACTIVE_LOW>; ++ }; ++ }; + }; + + &i2c1 { +@@ -160,6 +174,12 @@ &pinctrl { + pinctrl-names = "default"; + pinctrl-0 = <&rtc_32k>; + ++ gmac { ++ mac_rst: mac-rst { ++ rockchip,pins = <0 RK_PA7 RK_FUNC_GPIO &pcfg_pull_none>; ++ }; ++ }; ++ + leds { + green_led: green-led { + rockchip,pins = <0 RK_PA6 RK_FUNC_GPIO &pcfg_pull_none>; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-rockchip-add-missing-power-domains-for-rk3.patch b/queue-6.1/arm64-dts-rockchip-add-missing-power-domains-for-rk3.patch new file mode 100644 index 00000000000..966668ef93c --- /dev/null +++ b/queue-6.1/arm64-dts-rockchip-add-missing-power-domains-for-rk3.patch @@ -0,0 +1,43 @@ +From 02d3e4640a9fc389dae0ec2925b6f4bcf8bc022d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 04:12:52 +0300 +Subject: arm64: dts: rockchip: Add missing power-domains for rk356x vop_mmu + +From: Cristian Ciocaltea + +[ Upstream commit 9d42c3ee3ce37cdad6f98c9e77bfbd0d791ac7da ] + +The iommu@fe043e00 on RK356x SoC shares the VOP power domain, but the +power-domains property was not provided when the node has been added. + +The consequence is that an attempt to reload the rockchipdrm module will +freeze the entire system. That is because on probe time, +pm_runtime_get_suppliers() gets called for vop@fe040000, which blocks +when pm_runtime_get_sync() is being invoked for iommu@fe043e00. + +Fix the issue by adding the missing property. + +Fixes: 9d6c6d978f97 ("arm64: dts: rockchip: rk356x: Add VOP2 nodes") +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/20240702-rk356x-fix-vop-mmu-v1-1-a66d1a0c45ea@collabora.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk356x.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk356x.dtsi b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +index 99ad6fc51b584..e5c88f0007253 100644 +--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +@@ -737,6 +737,7 @@ vop_mmu: iommu@fe043e00 { + clocks = <&cru ACLK_VOP>, <&cru HCLK_VOP>; + clock-names = "aclk", "iface"; + #iommu-cells = <0>; ++ power-domains = <&power RK3568_PD_VO>; + status = "disabled"; + }; + +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-rockchip-add-pinctrl-for-uart0-to-rk3308-r.patch b/queue-6.1/arm64-dts-rockchip-add-pinctrl-for-uart0-to-rk3308-r.patch new file mode 100644 index 00000000000..c2a80fdc4b3 --- /dev/null +++ b/queue-6.1/arm64-dts-rockchip-add-pinctrl-for-uart0-to-rk3308-r.patch @@ -0,0 +1,40 @@ +From cb9db7ae840732fb21339991d3f2755b9ff31269 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 21:10:08 +0000 +Subject: arm64: dts: rockchip: Add pinctrl for UART0 to rk3308-rock-pi-s + +From: Jonas Karlman + +[ Upstream commit 7affb86ef62581e3475ce3e0a7640da1f2ee29f8 ] + +UAR0 CTS/RTS is not wired to any pin and is not used for the default +serial console use of UART0 on ROCK Pi S. + +Override the SoC defined pinctrl props to limit configuration of the +two xfer pins wired to one of the GPIO pin headers. + +Fixes: 2e04c25b1320 ("arm64: dts: rockchip: add ROCK Pi S DTS support") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20240521211029.1236094-6-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +index b9115c8828c72..a78e76c865e8e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +@@ -233,6 +233,8 @@ u2phy_otg: otg-port { + }; + + &uart0 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&uart0_xfer>; + status = "okay"; + }; + +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-rockchip-add-sdmmc-related-properties-on-r.patch b/queue-6.1/arm64-dts-rockchip-add-sdmmc-related-properties-on-r.patch new file mode 100644 index 00000000000..4e18a531a34 --- /dev/null +++ b/queue-6.1/arm64-dts-rockchip-add-sdmmc-related-properties-on-r.patch @@ -0,0 +1,42 @@ +From da749773f8546d4b1d52c3c3700dc4930a23735c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 21:10:07 +0000 +Subject: arm64: dts: rockchip: Add sdmmc related properties on + rk3308-rock-pi-s + +From: Jonas Karlman + +[ Upstream commit fc0daeccc384233eadfa9d5ddbd00159653c6bdc ] + +Add cap-mmc-highspeed to allow use of high speed MMC mode using an eMMC +to uSD board. Use disable-wp to signal that no physical write-protect +line is present. Also add vcc_io used for card and IO line power as +vmmc-supply. + +Fixes: 2e04c25b1320 ("arm64: dts: rockchip: add ROCK Pi S DTS support") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20240521211029.1236094-5-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +index edc8d2e3980d0..b9115c8828c72 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +@@ -211,7 +211,10 @@ &sdio { + }; + + &sdmmc { ++ cap-mmc-highspeed; + cap-sd-highspeed; ++ disable-wp; ++ vmmc-supply = <&vcc_io>; + status = "okay"; + }; + +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-rockchip-drop-invalid-mic-in-differential-.patch b/queue-6.1/arm64-dts-rockchip-drop-invalid-mic-in-differential-.patch new file mode 100644 index 00000000000..4fbe052578c --- /dev/null +++ b/queue-6.1/arm64-dts-rockchip-drop-invalid-mic-in-differential-.patch @@ -0,0 +1,48 @@ +From 6070e920a6730858096ac6eab80739ec1cc4c932 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jun 2024 00:57:20 +0300 +Subject: arm64: dts: rockchip: Drop invalid mic-in-differential on + rk3568-rock-3a + +From: Cristian Ciocaltea + +[ Upstream commit 406a554b382200abfabd1df423a425f6efee53e0 ] + +The 'mic-in-differential' DT property supported by the RK809/RK817 audio +codec driver is actually valid if prefixed with 'rockchip,': + + DTC_CHK arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dtb + rk3568-rock-3a.dtb: pmic@20: codec: 'mic-in-differential' does not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/mfd/rockchip,rk809.yaml# + +However, the board doesn't make use of differential signaling, hence +drop the incorrect property and the now unnecessary 'codec' node. + +Fixes: 22a442e6586c ("arm64: dts: rockchip: add basic dts for the radxa rock3 model a") +Reported-by: Jonas Karlman +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/20240622-rk809-fixes-v2-3-c0db420d3639@collabora.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts b/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts +index bab46db2b18cd..478620c782599 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts +@@ -481,10 +481,6 @@ regulator-state-mem { + }; + }; + }; +- +- codec { +- mic-in-differential; +- }; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-rockchip-fix-mic-in-differential-usage-on-.patch b/queue-6.1/arm64-dts-rockchip-fix-mic-in-differential-usage-on-.patch new file mode 100644 index 00000000000..4ba8c47b494 --- /dev/null +++ b/queue-6.1/arm64-dts-rockchip-fix-mic-in-differential-usage-on-.patch @@ -0,0 +1,45 @@ +From 65084b7d9e52fc9100367b6ef37acdfc29411b5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jun 2024 00:57:22 +0300 +Subject: arm64: dts: rockchip: Fix mic-in-differential usage on + rk3568-evb1-v10 + +From: Cristian Ciocaltea + +[ Upstream commit ec03073888ad23223ebb986e62583c20a9ed3c07 ] + +The 'mic-in-differential' DT property supported by the RK809/RK817 audio +codec driver is actually valid if prefixed with 'rockchip,': + + DTC_CHK arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dtb + + rk3568-evb1-v10.dtb: pmic@20: codec: 'mic-in-differential' does not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/mfd/rockchip,rk809.yaml# + +Make use of the correct property name. + +Fixes: 3e4c629ca680 ("arm64: dts: rockchip: enable rk809 audio codec on the rk3568 evb1-v10") +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/20240622-rk809-fixes-v2-5-c0db420d3639@collabora.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts +index 674792567fa6e..4fc8354e069a7 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts +@@ -478,7 +478,7 @@ regulator-state-mem { + }; + + codec { +- mic-in-differential; ++ rockchip,mic-in-differential; + }; + }; + }; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-rockchip-increase-vop-clk-rate-on-rk3328.patch b/queue-6.1/arm64-dts-rockchip-increase-vop-clk-rate-on-rk3328.patch new file mode 100644 index 00000000000..e024cc9d4e5 --- /dev/null +++ b/queue-6.1/arm64-dts-rockchip-increase-vop-clk-rate-on-rk3328.patch @@ -0,0 +1,42 @@ +From 44a073d158072050e89863fd4f4732fd2ad8c5a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jun 2024 17:03:52 +0000 +Subject: arm64: dts: rockchip: Increase VOP clk rate on RK3328 + +From: Jonas Karlman + +[ Upstream commit 0f2ddb128fa20f8441d903285632f2c69e90fae1 ] + +The VOP on RK3328 needs to run at a higher rate in order to produce a +proper 3840x2160 signal. + +Change to use 300MHz for VIO clk and 400MHz for VOP clk, same rates used +by vendor 4.4 kernel. + +Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20240615170417.3134517-2-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index d42846efff2fe..5adb2fbc2aafa 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -820,8 +820,8 @@ cru: clock-controller@ff440000 { + <0>, <24000000>, + <24000000>, <24000000>, + <15000000>, <15000000>, +- <100000000>, <100000000>, +- <100000000>, <100000000>, ++ <300000000>, <100000000>, ++ <400000000>, <100000000>, + <50000000>, <100000000>, + <100000000>, <100000000>, + <50000000>, <50000000>, +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-rockchip-update-wifi-bt-related-nodes-on-r.patch b/queue-6.1/arm64-dts-rockchip-update-wifi-bt-related-nodes-on-r.patch new file mode 100644 index 00000000000..0e0af389efc --- /dev/null +++ b/queue-6.1/arm64-dts-rockchip-update-wifi-bt-related-nodes-on-r.patch @@ -0,0 +1,107 @@ +From 1b9580e640d119bed5ffa23021a15f293e1ac441 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 21:10:16 +0000 +Subject: arm64: dts: rockchip: Update WIFi/BT related nodes on + rk3308-rock-pi-s + +From: Jonas Karlman + +[ Upstream commit 12c3ec878cbe3709782e85b88124abecc3bb8617 ] + +Update WiFi SDIO and BT UART related props to better reflect details +about the optional onboard RTL8723DS WiFi/BT module. + +Also correct the compatible used for bluetooth to match the WiFi/BT +module used on the board. + +Fixes: bc3753aed81f ("arm64: dts: rockchip: rock-pi-s add more peripherals") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20240521211029.1236094-14-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + .../boot/dts/rockchip/rk3308-rock-pi-s.dts | 40 +++++++++++++++++-- + 1 file changed, 36 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +index 6b4afdde6e94c..bc9e98fe0f013 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +@@ -17,6 +17,7 @@ aliases { + ethernet0 = &gmac; + mmc0 = &emmc; + mmc1 = &sdmmc; ++ mmc2 = &sdio; + }; + + chosen { +@@ -174,6 +175,20 @@ &pinctrl { + pinctrl-names = "default"; + pinctrl-0 = <&rtc_32k>; + ++ bluetooth { ++ bt_reg_on: bt-reg-on { ++ rockchip,pins = <4 RK_PB3 RK_FUNC_GPIO &pcfg_pull_none>; ++ }; ++ ++ bt_wake_host: bt-wake-host { ++ rockchip,pins = <4 RK_PB4 RK_FUNC_GPIO &pcfg_pull_down>; ++ }; ++ ++ host_wake_bt: host-wake-bt { ++ rockchip,pins = <4 RK_PB2 RK_FUNC_GPIO &pcfg_pull_none>; ++ }; ++ }; ++ + gmac { + mac_rst: mac-rst { + rockchip,pins = <0 RK_PA7 RK_FUNC_GPIO &pcfg_pull_none>; +@@ -223,11 +238,24 @@ &sdio { + cap-sd-highspeed; + cap-sdio-irq; + keep-power-in-suspend; +- max-frequency = <1000000>; ++ max-frequency = <100000000>; + mmc-pwrseq = <&sdio_pwrseq>; ++ no-mmc; ++ no-sd; + non-removable; +- sd-uhs-sdr104; ++ sd-uhs-sdr50; ++ vmmc-supply = <&vcc_io>; ++ vqmmc-supply = <&vcc_1v8>; + status = "okay"; ++ ++ rtl8723ds: wifi@1 { ++ reg = <1>; ++ interrupt-parent = <&gpio0>; ++ interrupts = ; ++ interrupt-names = "host-wake"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&wifi_host_wake>; ++ }; + }; + + &sdmmc { +@@ -259,12 +287,16 @@ &uart0 { + }; + + &uart4 { ++ uart-has-rtscts; + status = "okay"; + + bluetooth { +- compatible = "realtek,rtl8723bs-bt"; +- device-wake-gpios = <&gpio4 RK_PB3 GPIO_ACTIVE_HIGH>; ++ compatible = "realtek,rtl8723ds-bt"; ++ device-wake-gpios = <&gpio4 RK_PB2 GPIO_ACTIVE_HIGH>; ++ enable-gpios = <&gpio4 RK_PB3 GPIO_ACTIVE_HIGH>; + host-wake-gpios = <&gpio4 RK_PB4 GPIO_ACTIVE_HIGH>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&bt_reg_on &bt_wake_host &host_wake_bt>; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.1/asoc-amd-adjust-error-handling-in-case-of-absent-cod.patch b/queue-6.1/asoc-amd-adjust-error-handling-in-case-of-absent-cod.patch new file mode 100644 index 00000000000..c22580dc204 --- /dev/null +++ b/queue-6.1/asoc-amd-adjust-error-handling-in-case-of-absent-cod.patch @@ -0,0 +1,47 @@ +From c9c130fcc6db1a13ffffc9f8957031ff44af6488 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 22:10:07 +0300 +Subject: ASoC: amd: Adjust error handling in case of absent codec device + +From: Aleksandr Mishin + +[ Upstream commit 5080808c3339de2220c602ab7c7fa23dc6c1a5a3 ] + +acpi_get_first_physical_node() can return NULL in several cases (no such +device, ACPI table error, reference count drop to 0, etc). +Existing check just emit error message, but doesn't perform return. +Then this NULL pointer is passed to devm_acpi_dev_add_driver_gpios() +where it is dereferenced. + +Adjust this error handling by adding error code return. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 02527c3f2300 ("ASoC: amd: add Machine driver for Jadeite platform") +Signed-off-by: Aleksandr Mishin +Link: https://patch.msgid.link/20240703191007.8524-1-amishin@t-argos.ru +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp-es8336.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/amd/acp-es8336.c b/sound/soc/amd/acp-es8336.c +index 89499542c803f..f91a3c13ac235 100644 +--- a/sound/soc/amd/acp-es8336.c ++++ b/sound/soc/amd/acp-es8336.c +@@ -203,8 +203,10 @@ static int st_es8336_late_probe(struct snd_soc_card *card) + + codec_dev = acpi_get_first_physical_node(adev); + acpi_dev_put(adev); +- if (!codec_dev) ++ if (!codec_dev) { + dev_err(card->dev, "can not find codec dev\n"); ++ return -ENODEV; ++ } + + ret = devm_acpi_dev_add_driver_gpios(codec_dev, acpi_es8336_gpios); + if (ret) +-- +2.43.0 + diff --git a/queue-6.1/asoc-max98088-check-for-clk_prepare_enable-error.patch b/queue-6.1/asoc-max98088-check-for-clk_prepare_enable-error.patch new file mode 100644 index 00000000000..79499dac4f8 --- /dev/null +++ b/queue-6.1/asoc-max98088-check-for-clk_prepare_enable-error.patch @@ -0,0 +1,53 @@ +From 6a0794bdfbd168019b5a6c1017ca7d6ef808c52c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 16:05:34 +0800 +Subject: ASoC: max98088: Check for clk_prepare_enable() error + +From: Chen Ni + +[ Upstream commit 1a70579723fde3624a72dfea6e79e55be6e36659 ] + +clk_prepare_enable() may fail, so we should better check its return +value and propagate it in the case of error. + +Fixes: 62a7fc32a628 ("ASoC: max98088: Add master clock handling") +Signed-off-by: Chen Ni +Link: https://patch.msgid.link/20240628080534.843815-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98088.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c +index 405ec16be2b6a..eaabfe2cfd70d 100644 +--- a/sound/soc/codecs/max98088.c ++++ b/sound/soc/codecs/max98088.c +@@ -1318,6 +1318,7 @@ static int max98088_set_bias_level(struct snd_soc_component *component, + enum snd_soc_bias_level level) + { + struct max98088_priv *max98088 = snd_soc_component_get_drvdata(component); ++ int ret; + + switch (level) { + case SND_SOC_BIAS_ON: +@@ -1333,10 +1334,13 @@ static int max98088_set_bias_level(struct snd_soc_component *component, + */ + if (!IS_ERR(max98088->mclk)) { + if (snd_soc_component_get_bias_level(component) == +- SND_SOC_BIAS_ON) ++ SND_SOC_BIAS_ON) { + clk_disable_unprepare(max98088->mclk); +- else +- clk_prepare_enable(max98088->mclk); ++ } else { ++ ret = clk_prepare_enable(max98088->mclk); ++ if (ret) ++ return ret; ++ } + } + break; + +-- +2.43.0 + diff --git a/queue-6.1/asoc-qcom-adjust-issues-in-case-of-dt-error-in-asoc_.patch b/queue-6.1/asoc-qcom-adjust-issues-in-case-of-dt-error-in-asoc_.patch new file mode 100644 index 00000000000..116920214c4 --- /dev/null +++ b/queue-6.1/asoc-qcom-adjust-issues-in-case-of-dt-error-in-asoc_.patch @@ -0,0 +1,51 @@ +From 96aebc6df506aedbb81045a6d694b5c9a0af21e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 13:49:53 +0300 +Subject: ASoC: qcom: Adjust issues in case of DT error in + asoc_qcom_lpass_cpu_platform_probe() + +From: Aleksandr Mishin + +[ Upstream commit f9f7f29f64454bb20896c7d918c3abc3a1aa487b ] + +If IORESOURCE_MEM "lpass-rxtx-cdc-dma-lpm" or "lpass-va-cdc-dma-lpm" +resources is not provided in Device Tree due to any error, +platform_get_resource_byname() will return NULL which is later +dereferenced. According to sound/qcom,lpass-cpu.yaml, these resources +are provided, but DT can be broken due to any error. In such cases driver +must be able to protect itself, since the DT is external data for the +driver. +Adjust this issues by adding NULL return check. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: b138706225c9 ("ASoC: qcom: Add regmap config support for codec dma driver") +Signed-off-by: Aleksandr Mishin +Link: https://patch.msgid.link/20240605104953.12072-1-amishin@t-argos.ru +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/lpass-cpu.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c +index dbdaaa85ce481..4387cca893c5d 100644 +--- a/sound/soc/qcom/lpass-cpu.c ++++ b/sound/soc/qcom/lpass-cpu.c +@@ -1160,9 +1160,13 @@ int asoc_qcom_lpass_cpu_platform_probe(struct platform_device *pdev) + } + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "lpass-rxtx-cdc-dma-lpm"); ++ if (!res) ++ return -EINVAL; + drvdata->rxtx_cdc_dma_lpm_buf = res->start; + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "lpass-va-cdc-dma-lpm"); ++ if (!res) ++ return -EINVAL; + drvdata->va_cdc_dma_lpm_buf = res->start; + } + +-- +2.43.0 + diff --git a/queue-6.1/block-cleanup-bio_integrity_prep.patch b/queue-6.1/block-cleanup-bio_integrity_prep.patch new file mode 100644 index 00000000000..ec775b7d604 --- /dev/null +++ b/queue-6.1/block-cleanup-bio_integrity_prep.patch @@ -0,0 +1,71 @@ +From dd7160d3dd23716b6a3440ad6cfdd04f7f776c42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 14:18:39 +0900 +Subject: block: cleanup bio_integrity_prep + +From: Jinyoung Choi + +[ Upstream commit 51d74ec9b62f5813767a60226acaf943e26e7d7a ] + +If a problem occurs in the process of creating an integrity payload, the +status of bio is always BLK_STS_RESOURCE. + +Reviewed-by: Christoph Hellwig +Signed-off-by: Jinyoung Choi +Reviewed-by: "Martin K. Petersen" +Link: https://lore.kernel.org/r/20230725051839epcms2p8e4d20ad6c51326ad032e8406f59d0aaa@epcms2p8 +Signed-off-by: Jens Axboe +Stable-dep-of: 899ee2c3829c ("block: initialize integrity buffer to zero before writing it to media") +Signed-off-by: Sasha Levin +--- + block/bio-integrity.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/block/bio-integrity.c b/block/bio-integrity.c +index 8f0af7ac8573b..045553a164e0c 100644 +--- a/block/bio-integrity.c ++++ b/block/bio-integrity.c +@@ -199,7 +199,6 @@ bool bio_integrity_prep(struct bio *bio) + unsigned long start, end; + unsigned int len, nr_pages; + unsigned int bytes, offset, i; +- blk_status_t status; + + if (!bi) + return true; +@@ -227,7 +226,6 @@ bool bio_integrity_prep(struct bio *bio) + /* Allocate kernel buffer for protection data */ + len = bio_integrity_bytes(bi, bio_sectors(bio)); + buf = kmalloc(len, GFP_NOIO); +- status = BLK_STS_RESOURCE; + if (unlikely(buf == NULL)) { + printk(KERN_ERR "could not allocate integrity buffer\n"); + goto err_end_io; +@@ -242,7 +240,6 @@ bool bio_integrity_prep(struct bio *bio) + if (IS_ERR(bip)) { + printk(KERN_ERR "could not allocate data integrity bioset\n"); + kfree(buf); +- status = BLK_STS_RESOURCE; + goto err_end_io; + } + +@@ -270,7 +267,6 @@ bool bio_integrity_prep(struct bio *bio) + + if (ret == 0) { + printk(KERN_ERR "could not attach integrity payload\n"); +- status = BLK_STS_RESOURCE; + goto err_end_io; + } + +@@ -292,7 +288,7 @@ bool bio_integrity_prep(struct bio *bio) + return true; + + err_end_io: +- bio->bi_status = status; ++ bio->bi_status = BLK_STS_RESOURCE; + bio_endio(bio); + return false; + +-- +2.43.0 + diff --git a/queue-6.1/block-initialize-integrity-buffer-to-zero-before-wri.patch b/queue-6.1/block-initialize-integrity-buffer-to-zero-before-wri.patch new file mode 100644 index 00000000000..102b4a20b73 --- /dev/null +++ b/queue-6.1/block-initialize-integrity-buffer-to-zero-before-wri.patch @@ -0,0 +1,64 @@ +From c8f1cd8ee62d8fdfa4eff8a335b17ed5f5507a0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 10:48:11 +0200 +Subject: block: initialize integrity buffer to zero before writing it to media + +From: Christoph Hellwig + +[ Upstream commit 899ee2c3829c5ac14bfc7d3c4a5846c0b709b78f ] + +Metadata added by bio_integrity_prep is using plain kmalloc, which leads +to random kernel memory being written media. For PI metadata this is +limited to the app tag that isn't used by kernel generated metadata, +but for non-PI metadata the entire buffer leaks kernel memory. + +Fix this by adding the __GFP_ZERO flag to allocations for writes. + +Fixes: 7ba1ba12eeef ("block: Block layer data integrity support") +Signed-off-by: Christoph Hellwig +Reviewed-by: Martin K. Petersen +Reviewed-by: Kanchan Joshi +Reviewed-by: Chaitanya Kulkarni +Link: https://lore.kernel.org/r/20240613084839.1044015-2-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio-integrity.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/block/bio-integrity.c b/block/bio-integrity.c +index 045553a164e0c..adbc00449a9c6 100644 +--- a/block/bio-integrity.c ++++ b/block/bio-integrity.c +@@ -199,6 +199,7 @@ bool bio_integrity_prep(struct bio *bio) + unsigned long start, end; + unsigned int len, nr_pages; + unsigned int bytes, offset, i; ++ gfp_t gfp = GFP_NOIO; + + if (!bi) + return true; +@@ -221,11 +222,19 @@ bool bio_integrity_prep(struct bio *bio) + if (!bi->profile->generate_fn || + !(bi->flags & BLK_INTEGRITY_GENERATE)) + return true; ++ ++ /* ++ * Zero the memory allocated to not leak uninitialized kernel ++ * memory to disk. For PI this only affects the app tag, but ++ * for non-integrity metadata it affects the entire metadata ++ * buffer. ++ */ ++ gfp |= __GFP_ZERO; + } + + /* Allocate kernel buffer for protection data */ + len = bio_integrity_bytes(bi, bio_sectors(bio)); +- buf = kmalloc(len, GFP_NOIO); ++ buf = kmalloc(len, gfp); + if (unlikely(buf == NULL)) { + printk(KERN_ERR "could not allocate integrity buffer\n"); + goto err_end_io; +-- +2.43.0 + diff --git a/queue-6.1/block-mq-deadline-fix-the-tag-reservation-code.patch b/queue-6.1/block-mq-deadline-fix-the-tag-reservation-code.patch new file mode 100644 index 00000000000..5e713563ca2 --- /dev/null +++ b/queue-6.1/block-mq-deadline-fix-the-tag-reservation-code.patch @@ -0,0 +1,83 @@ +From ca04ffe33d7623a4bb5530ed6fab0fe4099a9636 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 10:01:49 -0700 +Subject: block/mq-deadline: Fix the tag reservation code + +From: Bart Van Assche + +[ Upstream commit 39823b47bbd40502632ffba90ebb34fff7c8b5e8 ] + +The current tag reservation code is based on a misunderstanding of the +meaning of data->shallow_depth. Fix the tag reservation code as follows: +* By default, do not reserve any tags for synchronous requests because + for certain use cases reserving tags reduces performance. See also + Harshit Mogalapalli, [bug-report] Performance regression with fio + sequential-write on a multipath setup, 2024-03-07 + (https://lore.kernel.org/linux-block/5ce2ae5d-61e2-4ede-ad55-551112602401@oracle.com/) +* Reduce min_shallow_depth to one because min_shallow_depth must be less + than or equal any shallow_depth value. +* Scale dd->async_depth from the range [1, nr_requests] to [1, + bits_per_sbitmap_word]. + +Cc: Christoph Hellwig +Cc: Damien Le Moal +Cc: Zhiguo Niu +Fixes: 07757588e507 ("block/mq-deadline: Reserve 25% of scheduler tags for synchronous requests") +Signed-off-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20240509170149.7639-3-bvanassche@acm.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/mq-deadline.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/block/mq-deadline.c b/block/mq-deadline.c +index f10c2a0d18d41..ff029e1acc4d5 100644 +--- a/block/mq-deadline.c ++++ b/block/mq-deadline.c +@@ -597,6 +597,20 @@ static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx) + return rq; + } + ++/* ++ * 'depth' is a number in the range 1..INT_MAX representing a number of ++ * requests. Scale it with a factor (1 << bt->sb.shift) / q->nr_requests since ++ * 1..(1 << bt->sb.shift) is the range expected by sbitmap_get_shallow(). ++ * Values larger than q->nr_requests have the same effect as q->nr_requests. ++ */ ++static int dd_to_word_depth(struct blk_mq_hw_ctx *hctx, unsigned int qdepth) ++{ ++ struct sbitmap_queue *bt = &hctx->sched_tags->bitmap_tags; ++ const unsigned int nrr = hctx->queue->nr_requests; ++ ++ return ((qdepth << bt->sb.shift) + nrr - 1) / nrr; ++} ++ + /* + * Called by __blk_mq_alloc_request(). The shallow_depth value set by this + * function is used by __blk_mq_get_tag(). +@@ -613,7 +627,7 @@ static void dd_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data) + * Throttle asynchronous requests and writes such that these requests + * do not block the allocation of synchronous requests. + */ +- data->shallow_depth = dd->async_depth; ++ data->shallow_depth = dd_to_word_depth(data->hctx, dd->async_depth); + } + + /* Called by blk_mq_update_nr_requests(). */ +@@ -623,9 +637,9 @@ static void dd_depth_updated(struct blk_mq_hw_ctx *hctx) + struct deadline_data *dd = q->elevator->elevator_data; + struct blk_mq_tags *tags = hctx->sched_tags; + +- dd->async_depth = max(1UL, 3 * q->nr_requests / 4); ++ dd->async_depth = q->nr_requests; + +- sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, dd->async_depth); ++ sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, 1); + } + + /* Called by blk_mq_init_hctx() and blk_mq_init_sched(). */ +-- +2.43.0 + diff --git a/queue-6.1/block-refactor-to-use-helper.patch b/queue-6.1/block-refactor-to-use-helper.patch new file mode 100644 index 00000000000..28f50485280 --- /dev/null +++ b/queue-6.1/block-refactor-to-use-helper.patch @@ -0,0 +1,48 @@ +From ee493c7860699cca2cf3e133656a5ba5d25cedb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 17:46:08 +0530 +Subject: block: refactor to use helper + +From: Nitesh Shetty + +[ Upstream commit 8f63fef5867fb5e8c29d9c14b6d739bfc1869d32 ] + +Reduce some code by making use of bio_integrity_bytes(). + +Signed-off-by: Nitesh Shetty +Reviewed-by: "Martin K. Petersen" +Link: https://lore.kernel.org/r/20230719121608.32105-1-nj.shetty@samsung.com +Signed-off-by: Jens Axboe +Stable-dep-of: 899ee2c3829c ("block: initialize integrity buffer to zero before writing it to media") +Signed-off-by: Sasha Levin +--- + block/bio-integrity.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/block/bio-integrity.c b/block/bio-integrity.c +index 4533eb4916610..8f0af7ac8573b 100644 +--- a/block/bio-integrity.c ++++ b/block/bio-integrity.c +@@ -199,7 +199,6 @@ bool bio_integrity_prep(struct bio *bio) + unsigned long start, end; + unsigned int len, nr_pages; + unsigned int bytes, offset, i; +- unsigned int intervals; + blk_status_t status; + + if (!bi) +@@ -224,10 +223,9 @@ bool bio_integrity_prep(struct bio *bio) + !(bi->flags & BLK_INTEGRITY_GENERATE)) + return true; + } +- intervals = bio_integrity_intervals(bi, bio_sectors(bio)); + + /* Allocate kernel buffer for protection data */ +- len = intervals * bi->tuple_size; ++ len = bio_integrity_bytes(bi, bio_sectors(bio)); + buf = kmalloc(len, GFP_NOIO); + status = BLK_STS_RESOURCE; + if (unlikely(buf == NULL)) { +-- +2.43.0 + diff --git a/queue-6.1/bna-adjust-name-buf-size-of-bna_tcb-and-bna_ccb-stru.patch b/queue-6.1/bna-adjust-name-buf-size-of-bna_tcb-and-bna_ccb-stru.patch new file mode 100644 index 00000000000..13b06ea0ec6 --- /dev/null +++ b/queue-6.1/bna-adjust-name-buf-size-of-bna_tcb-and-bna_ccb-stru.patch @@ -0,0 +1,77 @@ +From 35237d63eb12c197bdb8aca9ad63a1156e110402 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 10:50:08 +0000 +Subject: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures + +From: Alexey Kodanev + +[ Upstream commit c9741a03dc8e491e57b95fba0058ab46b7e506da ] + +To have enough space to write all possible sprintf() args. Currently +'name' size is 16, but the first '%s' specifier may already need at +least 16 characters, since 'bnad->netdev->name' is used there. + +For '%d' specifiers, assume that they require: + * 1 char for 'tx_id + tx_info->tcb[i]->id' sum, BNAD_MAX_TXQ_PER_TX is 8 + * 2 chars for 'rx_id + rx_info->rx_ctrl[i].ccb->id', BNAD_MAX_RXP_PER_RX + is 16 + +And replace sprintf with snprintf. + +Detected using the static analysis tool - Svace. + +Fixes: 8b230ed8ec96 ("bna: Brocade 10Gb Ethernet device driver") +Signed-off-by: Alexey Kodanev +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/brocade/bna/bna_types.h | 2 +- + drivers/net/ethernet/brocade/bna/bnad.c | 11 ++++++----- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/brocade/bna/bna_types.h b/drivers/net/ethernet/brocade/bna/bna_types.h +index 666b6922e24db..ebf54d74c2bbe 100644 +--- a/drivers/net/ethernet/brocade/bna/bna_types.h ++++ b/drivers/net/ethernet/brocade/bna/bna_types.h +@@ -410,7 +410,7 @@ struct bna_ib { + /* Tx object */ + + /* Tx datapath control structure */ +-#define BNA_Q_NAME_SIZE 16 ++#define BNA_Q_NAME_SIZE (IFNAMSIZ + 6) + struct bna_tcb { + /* Fast path */ + void **sw_qpt; +diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c +index d6d90f9722a7e..aecdb98f8a9c1 100644 +--- a/drivers/net/ethernet/brocade/bna/bnad.c ++++ b/drivers/net/ethernet/brocade/bna/bnad.c +@@ -1535,8 +1535,9 @@ bnad_tx_msix_register(struct bnad *bnad, struct bnad_tx_info *tx_info, + + for (i = 0; i < num_txqs; i++) { + vector_num = tx_info->tcb[i]->intr_vector; +- sprintf(tx_info->tcb[i]->name, "%s TXQ %d", bnad->netdev->name, +- tx_id + tx_info->tcb[i]->id); ++ snprintf(tx_info->tcb[i]->name, BNA_Q_NAME_SIZE, "%s TXQ %d", ++ bnad->netdev->name, ++ tx_id + tx_info->tcb[i]->id); + err = request_irq(bnad->msix_table[vector_num].vector, + (irq_handler_t)bnad_msix_tx, 0, + tx_info->tcb[i]->name, +@@ -1586,9 +1587,9 @@ bnad_rx_msix_register(struct bnad *bnad, struct bnad_rx_info *rx_info, + + for (i = 0; i < num_rxps; i++) { + vector_num = rx_info->rx_ctrl[i].ccb->intr_vector; +- sprintf(rx_info->rx_ctrl[i].ccb->name, "%s CQ %d", +- bnad->netdev->name, +- rx_id + rx_info->rx_ctrl[i].ccb->id); ++ snprintf(rx_info->rx_ctrl[i].ccb->name, BNA_Q_NAME_SIZE, ++ "%s CQ %d", bnad->netdev->name, ++ rx_id + rx_info->rx_ctrl[i].ccb->id); + err = request_irq(bnad->msix_table[vector_num].vector, + (irq_handler_t)bnad_msix_rx, 0, + rx_info->rx_ctrl[i].ccb->name, +-- +2.43.0 + diff --git a/queue-6.1/bnxt_re-fix-imm_data-endianness.patch b/queue-6.1/bnxt_re-fix-imm_data-endianness.patch new file mode 100644 index 00000000000..65d8080d30a --- /dev/null +++ b/queue-6.1/bnxt_re-fix-imm_data-endianness.patch @@ -0,0 +1,105 @@ +From 0afcffc91196cfcec7a7cc3617f5c75e1ce84c47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 14:21:02 +0200 +Subject: bnxt_re: Fix imm_data endianness + +From: Jack Wang + +[ Upstream commit 95b087f87b780daafad1dbb2c84e81b729d5d33f ] + +When map a device between servers with MLX and BCM RoCE nics, RTRS +server complain about unknown imm type, and can't map the device, + +After more debug, it seems bnxt_re wrongly handle the +imm_data, this patch fixed the compat issue with MLX for us. + +In off list discussion, Selvin confirmed HW is working in little endian format +and all data needs to be converted to LE while providing. + +This patch fix the endianness for imm_data + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Signed-off-by: Jack Wang +Link: https://lore.kernel.org/r/20240710122102.37569-1-jinpu.wang@ionos.com +Acked-by: Selvin Xavier +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++---- + drivers/infiniband/hw/bnxt_re/qplib_fp.h | 6 +++--- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index 6ed0568747eaa..4c34cb1cb7866 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -2359,7 +2359,7 @@ static int bnxt_re_build_send_wqe(struct bnxt_re_qp *qp, + break; + case IB_WR_SEND_WITH_IMM: + wqe->type = BNXT_QPLIB_SWQE_TYPE_SEND_WITH_IMM; +- wqe->send.imm_data = wr->ex.imm_data; ++ wqe->send.imm_data = be32_to_cpu(wr->ex.imm_data); + break; + case IB_WR_SEND_WITH_INV: + wqe->type = BNXT_QPLIB_SWQE_TYPE_SEND_WITH_INV; +@@ -2389,7 +2389,7 @@ static int bnxt_re_build_rdma_wqe(const struct ib_send_wr *wr, + break; + case IB_WR_RDMA_WRITE_WITH_IMM: + wqe->type = BNXT_QPLIB_SWQE_TYPE_RDMA_WRITE_WITH_IMM; +- wqe->rdma.imm_data = wr->ex.imm_data; ++ wqe->rdma.imm_data = be32_to_cpu(wr->ex.imm_data); + break; + case IB_WR_RDMA_READ: + wqe->type = BNXT_QPLIB_SWQE_TYPE_RDMA_READ; +@@ -3340,7 +3340,7 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *gsi_sqp, + wc->byte_len = orig_cqe->length; + wc->qp = &gsi_qp->ib_qp; + +- wc->ex.imm_data = orig_cqe->immdata; ++ wc->ex.imm_data = cpu_to_be32(le32_to_cpu(orig_cqe->immdata)); + wc->src_qp = orig_cqe->src_qp; + memcpy(wc->smac, orig_cqe->smac, ETH_ALEN); + if (bnxt_re_is_vlan_pkt(orig_cqe, &vlan_id, &sl)) { +@@ -3476,7 +3476,7 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc) + (unsigned long)(cqe->qp_handle), + struct bnxt_re_qp, qplib_qp); + wc->qp = &qp->ib_qp; +- wc->ex.imm_data = cqe->immdata; ++ wc->ex.imm_data = cpu_to_be32(le32_to_cpu(cqe->immdata)); + wc->src_qp = cqe->src_qp; + memcpy(wc->smac, cqe->smac, ETH_ALEN); + wc->port_num = 1; +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +index 49d89c0808275..4f1a845f9be6c 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +@@ -164,7 +164,7 @@ struct bnxt_qplib_swqe { + /* Send, with imm, inval key */ + struct { + union { +- __be32 imm_data; ++ u32 imm_data; + u32 inv_key; + }; + u32 q_key; +@@ -182,7 +182,7 @@ struct bnxt_qplib_swqe { + /* RDMA write, with imm, read */ + struct { + union { +- __be32 imm_data; ++ u32 imm_data; + u32 inv_key; + }; + u64 remote_va; +@@ -374,7 +374,7 @@ struct bnxt_qplib_cqe { + u16 cfa_meta; + u64 wr_id; + union { +- __be32 immdata; ++ __le32 immdata; + u32 invrkey; + }; + u64 qp_handle; +-- +2.43.0 + diff --git a/queue-6.1/bpf-annotate-btf-show-functions-with-__printf.patch b/queue-6.1/bpf-annotate-btf-show-functions-with-__printf.patch new file mode 100644 index 00000000000..32fbe5603ce --- /dev/null +++ b/queue-6.1/bpf-annotate-btf-show-functions-with-__printf.patch @@ -0,0 +1,56 @@ +From afb3e0e823a90711c02d55af6e8449127a72d80f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 19:23:21 +0100 +Subject: bpf: annotate BTF show functions with __printf + +From: Alan Maguire + +[ Upstream commit b3470da314fd8018ee237e382000c4154a942420 ] + +-Werror=suggest-attribute=format warns about two functions +in kernel/bpf/btf.c [1]; add __printf() annotations to silence +these warnings since for CONFIG_WERROR=y they will trigger +build failures. + +[1] https://lore.kernel.org/bpf/a8b20c72-6631-4404-9e1f-0410642d7d20@gmail.com/ + +Fixes: 31d0bc81637d ("bpf: Move to generic BTF show support, apply it to seq files/strings") +Reported-by: Mirsad Todorovac +Signed-off-by: Alan Maguire +Tested-by: Mirsad Todorovac +Link: https://lore.kernel.org/r/20240711182321.963667-1-alan.maguire@oracle.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 7582ec4fd4131..9d6524caf8ea9 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -6792,8 +6792,8 @@ static void btf_type_show(const struct btf *btf, u32 type_id, void *obj, + btf_type_ops(t)->show(btf, t, type_id, obj, 0, show); + } + +-static void btf_seq_show(struct btf_show *show, const char *fmt, +- va_list args) ++__printf(2, 0) static void btf_seq_show(struct btf_show *show, const char *fmt, ++ va_list args) + { + seq_vprintf((struct seq_file *)show->target, fmt, args); + } +@@ -6826,8 +6826,8 @@ struct btf_show_snprintf { + int len; /* length we would have written */ + }; + +-static void btf_snprintf_show(struct btf_show *show, const char *fmt, +- va_list args) ++__printf(2, 0) static void btf_snprintf_show(struct btf_show *show, const char *fmt, ++ va_list args) + { + struct btf_show_snprintf *ssnprintf = (struct btf_show_snprintf *)show; + int len; +-- +2.43.0 + diff --git a/queue-6.1/bpf-eliminate-remaining-make-w-1-warnings-in-kernel-.patch b/queue-6.1/bpf-eliminate-remaining-make-w-1-warnings-in-kernel-.patch new file mode 100644 index 00000000000..0ff0478cd1d --- /dev/null +++ b/queue-6.1/bpf-eliminate-remaining-make-w-1-warnings-in-kernel-.patch @@ -0,0 +1,60 @@ +From 231ac4f4b6445ef3f5946c3d4ff7c515b0091eac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 10:28:59 +0100 +Subject: bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alan Maguire + +[ Upstream commit 2454075f8e2915cebbe52a1195631bc7efe2b7e1 ] + +As reported by Mirsad [1] we still see format warnings in kernel/bpf/btf.o +at W=1 warning level: + + CC kernel/bpf/btf.o +./kernel/bpf/btf.c: In function ‘btf_type_seq_show_flags’: +./kernel/bpf/btf.c:7553:21: warning: assignment left-hand side might be a candidate for a format attribute [-Wsuggest-attribute=format] + 7553 | sseq.showfn = btf_seq_show; + | ^ +./kernel/bpf/btf.c: In function ‘btf_type_snprintf_show’: +./kernel/bpf/btf.c:7604:31: warning: assignment left-hand side might be a candidate for a format attribute [-Wsuggest-attribute=format] + 7604 | ssnprintf.show.showfn = btf_snprintf_show; + | ^ + +Combined with CONFIG_WERROR=y these can halt the build. + +The fix (annotating the structure field with __printf()) +suggested by Mirsad resolves these. Apologies I missed this last time. +No other W=1 warnings were observed in kernel/bpf after this fix. + +[1] https://lore.kernel.org/bpf/92c9d047-f058-400c-9c7d-81d4dc1ef71b@gmail.com/ + +Fixes: b3470da314fd ("bpf: annotate BTF show functions with __printf") +Reported-by: Mirsad Todorovac +Suggested-by: Mirsad Todorovac +Signed-off-by: Alan Maguire +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20240712092859.1390960-1-alan.maguire@oracle.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 9d6524caf8ea9..bb88fd2266a86 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -378,7 +378,7 @@ const char *btf_type_str(const struct btf_type *t) + struct btf_show { + u64 flags; + void *target; /* target of show operation (seq file, buffer) */ +- void (*showfn)(struct btf_show *show, const char *fmt, va_list args); ++ __printf(2, 0) void (*showfn)(struct btf_show *show, const char *fmt, va_list args); + const struct btf *btf; + /* below are used during iteration */ + struct { +-- +2.43.0 + diff --git a/queue-6.1/bpf-fix-null-pointer-dereference-in-resolve_prog_typ.patch b/queue-6.1/bpf-fix-null-pointer-dereference-in-resolve_prog_typ.patch new file mode 100644 index 00000000000..4b976625007 --- /dev/null +++ b/queue-6.1/bpf-fix-null-pointer-dereference-in-resolve_prog_typ.patch @@ -0,0 +1,110 @@ +From 3ae588ceab87b271835d808a9c4b30b555fd9fa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 22:58:18 +0800 +Subject: bpf: Fix null pointer dereference in resolve_prog_type() for + BPF_PROG_TYPE_EXT + +From: Tengda Wu + +[ Upstream commit f7866c35873377313ff94398f17d425b28b71de1 ] + +When loading a EXT program without specifying `attr->attach_prog_fd`, +the `prog->aux->dst_prog` will be null. At this time, calling +resolve_prog_type() anywhere will result in a null pointer dereference. + +Example stack trace: + +[ 8.107863] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 +[ 8.108262] Mem abort info: +[ 8.108384] ESR = 0x0000000096000004 +[ 8.108547] EC = 0x25: DABT (current EL), IL = 32 bits +[ 8.108722] SET = 0, FnV = 0 +[ 8.108827] EA = 0, S1PTW = 0 +[ 8.108939] FSC = 0x04: level 0 translation fault +[ 8.109102] Data abort info: +[ 8.109203] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 +[ 8.109399] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +[ 8.109614] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +[ 8.109836] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101354000 +[ 8.110011] [0000000000000004] pgd=0000000000000000, p4d=0000000000000000 +[ 8.112624] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP +[ 8.112783] Modules linked in: +[ 8.113120] CPU: 0 PID: 99 Comm: may_access_dire Not tainted 6.10.0-rc3-next-20240613-dirty #1 +[ 8.113230] Hardware name: linux,dummy-virt (DT) +[ 8.113390] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 8.113429] pc : may_access_direct_pkt_data+0x24/0xa0 +[ 8.113746] lr : add_subprog_and_kfunc+0x634/0x8e8 +[ 8.113798] sp : ffff80008283b9f0 +[ 8.113813] x29: ffff80008283b9f0 x28: ffff800082795048 x27: 0000000000000001 +[ 8.113881] x26: ffff0000c0bb2600 x25: 0000000000000000 x24: 0000000000000000 +[ 8.113897] x23: ffff0000c1134000 x22: 000000000001864f x21: ffff0000c1138000 +[ 8.113912] x20: 0000000000000001 x19: ffff0000c12b8000 x18: ffffffffffffffff +[ 8.113929] x17: 0000000000000000 x16: 0000000000000000 x15: 0720072007200720 +[ 8.113944] x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 +[ 8.113958] x11: 0720072007200720 x10: 0000000000f9fca4 x9 : ffff80008021f4e4 +[ 8.113991] x8 : 0101010101010101 x7 : 746f72705f6d656d x6 : 000000001e0e0f5f +[ 8.114006] x5 : 000000000001864f x4 : ffff0000c12b8000 x3 : 000000000000001c +[ 8.114020] x2 : 0000000000000002 x1 : 0000000000000000 x0 : 0000000000000000 +[ 8.114126] Call trace: +[ 8.114159] may_access_direct_pkt_data+0x24/0xa0 +[ 8.114202] bpf_check+0x3bc/0x28c0 +[ 8.114214] bpf_prog_load+0x658/0xa58 +[ 8.114227] __sys_bpf+0xc50/0x2250 +[ 8.114240] __arm64_sys_bpf+0x28/0x40 +[ 8.114254] invoke_syscall.constprop.0+0x54/0xf0 +[ 8.114273] do_el0_svc+0x4c/0xd8 +[ 8.114289] el0_svc+0x3c/0x140 +[ 8.114305] el0t_64_sync_handler+0x134/0x150 +[ 8.114331] el0t_64_sync+0x168/0x170 +[ 8.114477] Code: 7100707f 54000081 f9401c00 f9403800 (b9400403) +[ 8.118672] ---[ end trace 0000000000000000 ]--- + +One way to fix it is by forcing `attach_prog_fd` non-empty when +bpf_prog_load(). But this will lead to `libbpf_probe_bpf_prog_type` +API broken which use verifier log to probe prog type and will log +nothing if we reject invalid EXT prog before bpf_check(). + +Another way is by adding null check in resolve_prog_type(). + +The issue was introduced by commit 4a9c7bbe2ed4 ("bpf: Resolve to +prog->aux->dst_prog->type only for BPF_PROG_TYPE_EXT") which wanted +to correct type resolution for BPF_PROG_TYPE_TRACING programs. Before +that, the type resolution of BPF_PROG_TYPE_EXT prog actually follows +the logic below: + + prog->aux->dst_prog ? prog->aux->dst_prog->type : prog->type; + +It implies that when EXT program is not yet attached to `dst_prog`, +the prog type should be EXT itself. This code worked fine in the past. +So just keep using it. + +Fix this by returning `prog->type` for BPF_PROG_TYPE_EXT if `dst_prog` +is not present in resolve_prog_type(). + +Fixes: 4a9c7bbe2ed4 ("bpf: Resolve to prog->aux->dst_prog->type only for BPF_PROG_TYPE_EXT") +Signed-off-by: Tengda Wu +Signed-off-by: Daniel Borkmann +Acked-by: Daniel Borkmann +Cc: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/20240711145819.254178-2-wutengda@huaweicloud.com +Signed-off-by: Sasha Levin +--- + include/linux/bpf_verifier.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h +index f080ccf27d256..6a524c5462a6f 100644 +--- a/include/linux/bpf_verifier.h ++++ b/include/linux/bpf_verifier.h +@@ -645,7 +645,7 @@ static inline u32 type_flag(u32 type) + /* only use after check_attach_btf_id() */ + static inline enum bpf_prog_type resolve_prog_type(const struct bpf_prog *prog) + { +- return prog->type == BPF_PROG_TYPE_EXT ? ++ return (prog->type == BPF_PROG_TYPE_EXT && prog->aux->dst_prog) ? + prog->aux->dst_prog->type : prog->type; + } + +-- +2.43.0 + diff --git a/queue-6.1/bpftool-mount-bpffs-when-pinmaps-path-not-under-the-.patch b/queue-6.1/bpftool-mount-bpffs-when-pinmaps-path-not-under-the-.patch new file mode 100644 index 00000000000..2948d4bef57 --- /dev/null +++ b/queue-6.1/bpftool-mount-bpffs-when-pinmaps-path-not-under-the-.patch @@ -0,0 +1,46 @@ +From a67c2cccb962f1eab3e399b21541d777c257651a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 21:11:50 +0800 +Subject: bpftool: Mount bpffs when pinmaps path not under the bpffs + +From: Tao Chen + +[ Upstream commit da5f8fd1f0d393d5eaaba9ad8c22d1c26bb2bf9b ] + +As Quentin said [0], BPF map pinning will fail if the pinmaps path is not +under the bpffs, like: + + libbpf: specified path /home/ubuntu/test/sock_ops_map is not on BPF FS + Error: failed to pin all maps + + [0] https://github.com/libbpf/bpftool/issues/146 + +Fixes: 3767a94b3253 ("bpftool: add pinmaps argument to the load/loadall") +Signed-off-by: Tao Chen +Signed-off-by: Daniel Borkmann +Tested-by: Quentin Monnet +Reviewed-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20240702131150.15622-1-chen.dylane@gmail.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/prog.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index 7e0b846e17eef..21817eb510396 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -1707,6 +1707,10 @@ static int load_with_options(int argc, char **argv, bool first_prog_only) + } + + if (pinmaps) { ++ err = create_and_mount_bpffs_dir(pinmaps); ++ if (err) ++ goto err_unpin; ++ + err = bpf_object__pin_maps(obj, pinmaps); + if (err) { + p_err("failed to pin all maps"); +-- +2.43.0 + diff --git a/queue-6.1/bpftool-un-const-bpf_func_info-to-fix-it-for-llvm-17.patch b/queue-6.1/bpftool-un-const-bpf_func_info-to-fix-it-for-llvm-17.patch new file mode 100644 index 00000000000..e6d92b9543e --- /dev/null +++ b/queue-6.1/bpftool-un-const-bpf_func_info-to-fix-it-for-llvm-17.patch @@ -0,0 +1,58 @@ +From b2c009d346f476b4c95bcaf52bdc1f3111c53f14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 15:51:49 -0700 +Subject: bpftool: Un-const bpf_func_info to fix it for llvm 17 and newer + +From: Ivan Babrou + +[ Upstream commit f4aba3471cfb9ccf69b476463f19b4c50fef6b14 ] + +LLVM 17 started treating const structs as constants: + +* https://github.com/llvm/llvm-project/commit/0b2d5b967d98 + +Combined with pointer laundering via ptr_to_u64, which takes a const ptr, +but in reality treats the underlying memory as mutable, this makes clang +always pass zero to btf__type_by_id, which breaks full name resolution. + +Disassembly before (LLVM 16) and after (LLVM 17): + + - 8b 75 cc mov -0x34(%rbp),%esi + - e8 47 8d 02 00 call 3f5b0 + + 31 f6 xor %esi,%esi + + e8 a9 8c 02 00 call 3f510 + +It's a bigger project to fix this properly (and a question whether LLVM +itself should detect this), but for right now let's just fix bpftool. + +For more information, see this thread in bpf mailing list: + +* https://lore.kernel.org/bpf/CABWYdi0ymezpYsQsPv7qzpx2fWuTkoD1-wG1eT-9x-TSREFrQg@mail.gmail.com/T/ + +Fixes: b662000aff84 ("bpftool: Adding support for BTF program names") +Signed-off-by: Ivan Babrou +Signed-off-by: Andrii Nakryiko +Acked-by: Nick Desaulniers +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20240520225149.5517-1-ivan@cloudflare.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c +index e7a11cff7245a..db02b000fbebd 100644 +--- a/tools/bpf/bpftool/common.c ++++ b/tools/bpf/bpftool/common.c +@@ -333,7 +333,7 @@ void get_prog_full_name(const struct bpf_prog_info *prog_info, int prog_fd, + { + const char *prog_name = prog_info->name; + const struct btf_type *func_type; +- const struct bpf_func_info finfo = {}; ++ struct bpf_func_info finfo = {}; + struct bpf_prog_info info = {}; + __u32 info_len = sizeof(info); + struct btf *prog_btf = NULL; +-- +2.43.0 + diff --git a/queue-6.1/cgroup-cpuset-prevent-uaf-in-proc_cpuset_show.patch b/queue-6.1/cgroup-cpuset-prevent-uaf-in-proc_cpuset_show.patch new file mode 100644 index 00000000000..3ec503e7971 --- /dev/null +++ b/queue-6.1/cgroup-cpuset-prevent-uaf-in-proc_cpuset_show.patch @@ -0,0 +1,96 @@ +From 314b62481329a070a908d35df285559f7c03186b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 01:36:04 +0000 +Subject: cgroup/cpuset: Prevent UAF in proc_cpuset_show() + +From: Chen Ridong + +[ Upstream commit 1be59c97c83ccd67a519d8a49486b3a8a73ca28a ] + +An UAF can happen when /proc/cpuset is read as reported in [1]. + +This can be reproduced by the following methods: +1.add an mdelay(1000) before acquiring the cgroup_lock In the + cgroup_path_ns function. +2.$cat /proc//cpuset repeatly. +3.$mount -t cgroup -o cpuset cpuset /sys/fs/cgroup/cpuset/ +$umount /sys/fs/cgroup/cpuset/ repeatly. + +The race that cause this bug can be shown as below: + +(umount) | (cat /proc//cpuset) +css_release | proc_cpuset_show +css_release_work_fn | css = task_get_css(tsk, cpuset_cgrp_id); +css_free_rwork_fn | cgroup_path_ns(css->cgroup, ...); +cgroup_destroy_root | mutex_lock(&cgroup_mutex); +rebind_subsystems | +cgroup_free_root | + | // cgrp was freed, UAF + | cgroup_path_ns_locked(cgrp,..); + +When the cpuset is initialized, the root node top_cpuset.css.cgrp +will point to &cgrp_dfl_root.cgrp. In cgroup v1, the mount operation will +allocate cgroup_root, and top_cpuset.css.cgrp will point to the allocated +&cgroup_root.cgrp. When the umount operation is executed, +top_cpuset.css.cgrp will be rebound to &cgrp_dfl_root.cgrp. + +The problem is that when rebinding to cgrp_dfl_root, there are cases +where the cgroup_root allocated by setting up the root for cgroup v1 +is cached. This could lead to a Use-After-Free (UAF) if it is +subsequently freed. The descendant cgroups of cgroup v1 can only be +freed after the css is released. However, the css of the root will never +be released, yet the cgroup_root should be freed when it is unmounted. +This means that obtaining a reference to the css of the root does +not guarantee that css.cgrp->root will not be freed. + +Fix this problem by using rcu_read_lock in proc_cpuset_show(). +As cgroup_root is kfree_rcu after commit d23b5c577715 +("cgroup: Make operations on the cgroup root_list RCU safe"), +css->cgroup won't be freed during the critical section. +To call cgroup_path_ns_locked, css_set_lock is needed, so it is safe to +replace task_get_css with task_css. + +[1] https://syzkaller.appspot.com/bug?extid=9b1ff7be974a403aa4cd + +Fixes: a79a908fd2b0 ("cgroup: introduce cgroup namespaces") +Signed-off-by: Chen Ridong +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 278248907791f..370a6bce20a80 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -21,6 +21,7 @@ + * License. See the file COPYING in the main directory of the Linux + * distribution for more details. + */ ++#include "cgroup-internal.h" + + #include + #include +@@ -4213,10 +4214,14 @@ int proc_cpuset_show(struct seq_file *m, struct pid_namespace *ns, + if (!buf) + goto out; + +- css = task_get_css(tsk, cpuset_cgrp_id); +- retval = cgroup_path_ns(css->cgroup, buf, PATH_MAX, +- current->nsproxy->cgroup_ns); +- css_put(css); ++ rcu_read_lock(); ++ spin_lock_irq(&css_set_lock); ++ css = task_css(tsk, cpuset_cgrp_id); ++ retval = cgroup_path_ns_locked(css->cgroup, buf, PATH_MAX, ++ current->nsproxy->cgroup_ns); ++ spin_unlock_irq(&css_set_lock); ++ rcu_read_unlock(); ++ + if (retval == -E2BIG) + retval = -ENAMETOOLONG; + if (retval < 0) +-- +2.43.0 + diff --git a/queue-6.1/clk-en7523-fix-rate-divider-for-slic-and-spi-clocks.patch b/queue-6.1/clk-en7523-fix-rate-divider-for-slic-and-spi-clocks.patch new file mode 100644 index 00000000000..b361604d94a --- /dev/null +++ b/queue-6.1/clk-en7523-fix-rate-divider-for-slic-and-spi-clocks.patch @@ -0,0 +1,88 @@ +From 2a600164fb33dd8f73afd44b7c17d0ce09bbd537 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:25:49 +0200 +Subject: clk: en7523: fix rate divider for slic and spi clocks + +From: Lorenzo Bianconi + +[ Upstream commit 58c53d43142f222221e5a76a7016c4d8f3b84b97 ] + +Introduce div_offset field in en_clk_desc struct in order to fix rate +divider estimation in en7523_get_div routine for slic and spi fixed +rate clocks. +Moreover, fix base_shift for crypto clock. + +Fixes: 1e6273179190 ("clk: en7523: Add clock driver for Airoha EN7523 SoC") +Signed-off-by: Lorenzo Bianconi +Link: https://lore.kernel.org/r/c491bdea05d847f1f1294b94f14725d292eb95d0.1718615934.git.lorenzo@kernel.org +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-en7523.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/clk-en7523.c b/drivers/clk/clk-en7523.c +index 29f0126cbd05b..d22fae24a3dab 100644 +--- a/drivers/clk/clk-en7523.c ++++ b/drivers/clk/clk-en7523.c +@@ -41,6 +41,7 @@ struct en_clk_desc { + u8 div_shift; + u16 div_val0; + u8 div_step; ++ u8 div_offset; + }; + + struct en_clk_gate { +@@ -68,6 +69,7 @@ static const struct en_clk_desc en7523_base_clks[] = { + .div_bits = 3, + .div_shift = 0, + .div_step = 1, ++ .div_offset = 1, + }, { + .id = EN7523_CLK_EMI, + .name = "emi", +@@ -81,6 +83,7 @@ static const struct en_clk_desc en7523_base_clks[] = { + .div_bits = 3, + .div_shift = 0, + .div_step = 1, ++ .div_offset = 1, + }, { + .id = EN7523_CLK_BUS, + .name = "bus", +@@ -94,6 +97,7 @@ static const struct en_clk_desc en7523_base_clks[] = { + .div_bits = 3, + .div_shift = 0, + .div_step = 1, ++ .div_offset = 1, + }, { + .id = EN7523_CLK_SLIC, + .name = "slic", +@@ -134,13 +138,14 @@ static const struct en_clk_desc en7523_base_clks[] = { + .div_bits = 3, + .div_shift = 0, + .div_step = 1, ++ .div_offset = 1, + }, { + .id = EN7523_CLK_CRYPTO, + .name = "crypto", + + .base_reg = REG_CRYPTO_CLKSRC, + .base_bits = 1, +- .base_shift = 8, ++ .base_shift = 0, + .base_values = emi_base, + .n_base_values = ARRAY_SIZE(emi_base), + } +@@ -185,7 +190,7 @@ static u32 en7523_get_div(void __iomem *base, int i) + if (!val && desc->div_val0) + return desc->div_val0; + +- return (val + 1) * desc->div_step; ++ return (val + desc->div_offset) * desc->div_step; + } + + static int en7523_pci_is_enabled(struct clk_hw *hw) +-- +2.43.0 + diff --git a/queue-6.1/clk-qcom-branch-add-helper-functions-for-setting-ret.patch b/queue-6.1/clk-qcom-branch-add-helper-functions-for-setting-ret.patch new file mode 100644 index 00000000000..50a00fa5f04 --- /dev/null +++ b/queue-6.1/clk-qcom-branch-add-helper-functions-for-setting-ret.patch @@ -0,0 +1,63 @@ +From cc444e64a593e07bb200133b0ea8141b5afa1e47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 10:13:31 +0100 +Subject: clk: qcom: branch: Add helper functions for setting retain bits + +From: Konrad Dybcio + +[ Upstream commit b594e6f6605311785171b8d4600fe96e35625530 ] + +Most Qualcomm branch clocks come with a pretty usual set of bits that +can enable memory retention by means of not turning off parts of the +memory logic. Add them to the common header file and introduce helper +functions for setting them instead of using magic writes. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230208091340.124641-2-konrad.dybcio@linaro.org +Stable-dep-of: f38467b5a920 ("clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/clk-branch.h | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/drivers/clk/qcom/clk-branch.h b/drivers/clk/qcom/clk-branch.h +index 17a58119165e8..55b3a2c3afed9 100644 +--- a/drivers/clk/qcom/clk-branch.h ++++ b/drivers/clk/qcom/clk-branch.h +@@ -37,6 +37,32 @@ struct clk_branch { + struct clk_regmap clkr; + }; + ++/* Branch clock common bits for HLOS-owned clocks */ ++#define CBCR_FORCE_MEM_CORE_ON BIT(14) ++#define CBCR_FORCE_MEM_PERIPH_ON BIT(13) ++#define CBCR_FORCE_MEM_PERIPH_OFF BIT(12) ++ ++static inline void qcom_branch_set_force_mem_core(struct regmap *regmap, ++ struct clk_branch clk, bool on) ++{ ++ regmap_update_bits(regmap, clk.halt_reg, CBCR_FORCE_MEM_CORE_ON, ++ on ? CBCR_FORCE_MEM_CORE_ON : 0); ++} ++ ++static inline void qcom_branch_set_force_periph_on(struct regmap *regmap, ++ struct clk_branch clk, bool on) ++{ ++ regmap_update_bits(regmap, clk.halt_reg, CBCR_FORCE_MEM_PERIPH_ON, ++ on ? CBCR_FORCE_MEM_PERIPH_ON : 0); ++} ++ ++static inline void qcom_branch_set_force_periph_off(struct regmap *regmap, ++ struct clk_branch clk, bool on) ++{ ++ regmap_update_bits(regmap, clk.halt_reg, CBCR_FORCE_MEM_PERIPH_OFF, ++ on ? CBCR_FORCE_MEM_PERIPH_OFF : 0); ++} ++ + extern const struct clk_ops clk_branch_ops; + extern const struct clk_ops clk_branch2_ops; + extern const struct clk_ops clk_branch_simple_ops; +-- +2.43.0 + diff --git a/queue-6.1/clk-qcom-camcc-sc7280-add-parent-dependency-to-all-c.patch b/queue-6.1/clk-qcom-camcc-sc7280-add-parent-dependency-to-all-c.patch new file mode 100644 index 00000000000..22a182a669a --- /dev/null +++ b/queue-6.1/clk-qcom-camcc-sc7280-add-parent-dependency-to-all-c.patch @@ -0,0 +1,73 @@ +From 3052744d256b79627d890386c23b8759bea972e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 15:21:42 +0530 +Subject: clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs + +From: Taniya Das + +[ Upstream commit 63aec3e4d987fd43237f557460345bca3b51e530 ] + +Camera titan top GDSC is a parent supply to all other camera GDSCs. Titan +top GDSC is required to be enabled before enabling any other camera GDSCs +and it should be disabled only after all other camera GDSCs are disabled. +Ensure this behavior by marking titan top GDSC as parent of all other +camera GDSCs. + +Fixes: 1daec8cfebc2 ("clk: qcom: camcc: Add camera clock controller driver for SC7280") +Signed-off-by: Taniya Das +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240531095142.9688-4-quic_tdas@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/camcc-sc7280.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/clk/qcom/camcc-sc7280.c b/drivers/clk/qcom/camcc-sc7280.c +index ec163ea769f59..932096a972bc3 100644 +--- a/drivers/clk/qcom/camcc-sc7280.c ++++ b/drivers/clk/qcom/camcc-sc7280.c +@@ -2260,6 +2260,7 @@ static struct gdsc cam_cc_bps_gdsc = { + .name = "cam_cc_bps_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = HW_CTRL | RETAIN_FF_ENABLE, + }; + +@@ -2269,6 +2270,7 @@ static struct gdsc cam_cc_ife_0_gdsc = { + .name = "cam_cc_ife_0_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = RETAIN_FF_ENABLE, + }; + +@@ -2278,6 +2280,7 @@ static struct gdsc cam_cc_ife_1_gdsc = { + .name = "cam_cc_ife_1_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = RETAIN_FF_ENABLE, + }; + +@@ -2287,6 +2290,7 @@ static struct gdsc cam_cc_ife_2_gdsc = { + .name = "cam_cc_ife_2_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = RETAIN_FF_ENABLE, + }; + +@@ -2296,6 +2300,7 @@ static struct gdsc cam_cc_ipe_0_gdsc = { + .name = "cam_cc_ipe_0_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = HW_CTRL | RETAIN_FF_ENABLE, + }; + +-- +2.43.0 + diff --git a/queue-6.1/clk-qcom-gcc-sc7280-update-force-mem-core-bit-for-uf.patch b/queue-6.1/clk-qcom-gcc-sc7280-update-force-mem-core-bit-for-uf.patch new file mode 100644 index 00000000000..b175e714b25 --- /dev/null +++ b/queue-6.1/clk-qcom-gcc-sc7280-update-force-mem-core-bit-for-uf.patch @@ -0,0 +1,41 @@ +From a9ea6d8150ea373bde028baec765e015f206a686 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 15:21:41 +0530 +Subject: clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock + +From: Taniya Das + +[ Upstream commit f38467b5a920be1473710428a93c4e54b6f8a0c1 ] + +Update the force mem core bit for UFS ICE clock to force the core on signal +to remain active during halt state of the clk. When retention bit of the +clock is set the memories of the subsystem will retain the logic across +power states. + +Fixes: a3cc092196ef ("clk: qcom: Add Global Clock controller (GCC) driver for SC7280") +Signed-off-by: Taniya Das +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240531095142.9688-3-quic_tdas@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sc7280.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-sc7280.c b/drivers/clk/qcom/gcc-sc7280.c +index 46d41ebce2b08..2067e39840cb4 100644 +--- a/drivers/clk/qcom/gcc-sc7280.c ++++ b/drivers/clk/qcom/gcc-sc7280.c +@@ -3469,6 +3469,9 @@ static int gcc_sc7280_probe(struct platform_device *pdev) + regmap_update_bits(regmap, 0x71004, BIT(0), BIT(0)); + regmap_update_bits(regmap, 0x7100C, BIT(13), BIT(13)); + ++ /* FORCE_MEM_CORE_ON for ufs phy ice core clocks */ ++ qcom_branch_set_force_mem_core(regmap, gcc_ufs_phy_ice_core_clk, true); ++ + ret = qcom_cc_register_rcg_dfs(regmap, gcc_dfs_clocks, + ARRAY_SIZE(gcc_dfs_clocks)); + if (ret) +-- +2.43.0 + diff --git a/queue-6.1/clk-qcom-gpucc-sm8350-park-rcg-s-clk-source-at-xo-du.patch b/queue-6.1/clk-qcom-gpucc-sm8350-park-rcg-s-clk-source-at-xo-du.patch new file mode 100644 index 00000000000..680efba1165 --- /dev/null +++ b/queue-6.1/clk-qcom-gpucc-sm8350-park-rcg-s-clk-source-at-xo-du.patch @@ -0,0 +1,56 @@ +From 0267640a108c27cc2066e5bf5760dec54e124544 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 17:34:23 +0530 +Subject: clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during disable + +From: Taniya Das + +[ Upstream commit 313e2909023bef36ef7b6d1d9ff2d98febcaa28d ] + +The RCG's clk src has to be parked at XO while disabling as per the +HW recommendation, hence use clk_rcg2_shared_ops to achieve the same. + +Fixes: 160758b05ab1 ("clk: qcom: add support for SM8350 GPUCC") +Signed-off-by: Taniya Das +Reviewed-by: Dmitry Baryshkov +Tested-by: Dmitry Baryshkov # SM8350-HDK +Link: https://lore.kernel.org/r/20240621-sm8350-gpucc-fixes-v1-1-22db60c7c5d3@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gpucc-sm8350.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/gpucc-sm8350.c b/drivers/clk/qcom/gpucc-sm8350.c +index 5367ce654ac9a..cc9fcbc884650 100644 +--- a/drivers/clk/qcom/gpucc-sm8350.c ++++ b/drivers/clk/qcom/gpucc-sm8350.c +@@ -2,6 +2,7 @@ + /* + * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2022, Linaro Limited ++ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved. + */ + + #include +@@ -147,7 +148,7 @@ static struct clk_rcg2 gpu_cc_gmu_clk_src = { + .parent_data = gpu_cc_parent_data_0, + .num_parents = ARRAY_SIZE(gpu_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -169,7 +170,7 @@ static struct clk_rcg2 gpu_cc_hub_clk_src = { + .parent_data = gpu_cc_parent_data_1, + .num_parents = ARRAY_SIZE(gpu_cc_parent_data_1), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +-- +2.43.0 + diff --git a/queue-6.1/clk-qcom-park-shared-rcgs-upon-registration.patch b/queue-6.1/clk-qcom-park-shared-rcgs-upon-registration.patch new file mode 100644 index 00000000000..6deba9b9a7f --- /dev/null +++ b/queue-6.1/clk-qcom-park-shared-rcgs-upon-registration.patch @@ -0,0 +1,185 @@ +From 0e4ee39a485771656a7e6bbc474b65b5aa66f94b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 15:47:02 -0700 +Subject: clk: qcom: Park shared RCGs upon registration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stephen Boyd + +[ Upstream commit 01a0a6cc8cfd9952e72677d48d56cf6bc4e3a561 ] + +There's two problems with shared RCGs. + +The first problem is that they incorrectly report the parent after +commit 703db1f5da1e ("clk: qcom: rcg2: Cache CFG register updates for +parked RCGs"). That's because the cached CFG register value needs to be +populated when the clk is registered. clk_rcg2_shared_enable() writes +the cached CFG register value 'parked_cfg'. This value is initially zero +due to static initializers. If a driver calls clk_enable() before +setting a rate or parent, it will set the parent to '0' which is +(almost?) always XO, and may not reflect the parent at registration. In +the worst case, this switches the RCG from sourcing a fast PLL to the +slow crystal speed. + +The second problem is that the force enable bit isn't cleared. The force +enable bit is only used during parking and unparking of shared RCGs. +Otherwise it shouldn't be set because it keeps the RCG enabled even when +all the branches on the output of the RCG are disabled (the hardware has +a feedback mechanism so that any child branches keep the RCG enabled +when the branch enable bit is set). This problem wastes power if the clk +is unused, and is harmful in the case that the clk framework disables +the parent of the force enabled RCG. In the latter case, the GDSC the +shared RCG is associated with will get wedged if the RCG's source clk is +disabled and the GDSC tries to enable the RCG to do "housekeeping" while +powering on. + +Both of these problems combined with incorrect runtime PM usage in the +display driver lead to a black screen on Qualcomm sc7180 Trogdor +chromebooks. What happens is that the bootloader leaves the +'disp_cc_mdss_rot_clk' enabled and the 'disp_cc_mdss_rot_clk_src' force +enabled and parented to 'disp_cc_pll0'. The mdss driver probes and +runtime suspends, disabling the mdss_gdsc which uses the +'disp_cc_mdss_rot_clk_src' for "housekeeping". The +'disp_cc_mdss_rot_clk' is disabled during late init because the clk is +unused, but the parent 'disp_cc_mdss_rot_clk_src' is still force enabled +because the force enable bit was never cleared. Then 'disp_cc_pll0' is +disabled because it is also unused. That's because the clk framework +believes the parent of the RCG is XO when it isn't. A child device of +the mdss device (e.g. DSI) runtime resumes mdss which powers on the +mdss_gdsc. This wedges the GDSC because 'disp_cc_mdss_rot_clk_src' is +parented to 'disp_cc_pll0' and that PLL is off. With the GDSC wedged, +mdss_runtime_resume() tries to enable 'disp_cc_mdss_mdp_clk' but it +can't because the GDSC has wedged all the clks associated with the GDSC +causing clks to stay stuck off. + +This leads to the following warning seen at boot and a black screen +because the display driver fails to probe. + + disp_cc_mdss_mdp_clk status stuck at 'off' + WARNING: CPU: 1 PID: 81 at drivers/clk/qcom/clk-branch.c:87 clk_branch_toggle+0x114/0x168 + Modules linked in: + CPU: 1 PID: 81 Comm: kworker/u16:4 Not tainted 6.7.0-g0dd3ee311255 #1 f5757d475795053fd2ad52247a070cd50dd046f2 + Hardware name: Google Lazor (rev1 - 2) with LTE (DT) + Workqueue: events_unbound deferred_probe_work_func + pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : clk_branch_toggle+0x114/0x168 + lr : clk_branch_toggle+0x110/0x168 + sp : ffffffc08084b670 + pmr_save: 00000060 + x29: ffffffc08084b680 x28: ffffff808006de00 x27: 0000000000000001 + x26: ffffff8080dbd4f4 x25: 0000000000000000 x24: 0000000000000000 + x23: 0000000000000000 x22: ffffffd838461198 x21: ffffffd838007997 + x20: ffffffd837541d5c x19: 0000000000000001 x18: 0000000000000004 + x17: 0000000000000000 x16: 0000000000000010 x15: ffffffd837070fac + x14: 0000000000000003 x13: 0000000000000004 x12: 0000000000000001 + x11: c0000000ffffdfff x10: ffffffd838347aa0 x9 : 08dadf92e516c000 + x8 : 08dadf92e516c000 x7 : 0000000000000000 x6 : 0000000000000027 + x5 : ffffffd8385a61f2 x4 : 0000000000000000 x3 : ffffffc08084b398 + x2 : ffffffc08084b3a0 x1 : 00000000ffffdfff x0 : 00000000fffffff0 + Call trace: + clk_branch_toggle+0x114/0x168 + clk_branch2_enable+0x24/0x30 + clk_core_enable+0x5c/0x1c8 + clk_enable+0x38/0x58 + clk_bulk_enable+0x40/0xb0 + mdss_runtime_resume+0x68/0x258 + pm_generic_runtime_resume+0x30/0x44 + __genpd_runtime_resume+0x30/0x80 + genpd_runtime_resume+0x124/0x214 + __rpm_callback+0x7c/0x15c + rpm_callback+0x30/0x88 + rpm_resume+0x390/0x4d8 + rpm_resume+0x43c/0x4d8 + __pm_runtime_resume+0x54/0x98 + __device_attach+0xe0/0x170 + device_initial_probe+0x1c/0x28 + bus_probe_device+0x48/0xa4 + device_add+0x52c/0x6fc + mipi_dsi_device_register_full+0x104/0x1a8 + devm_mipi_dsi_device_register_full+0x28/0x78 + ti_sn_bridge_probe+0x1dc/0x2bc + auxiliary_bus_probe+0x4c/0x94 + really_probe+0xf8/0x270 + __driver_probe_device+0xa8/0x130 + driver_probe_device+0x44/0x104 + __device_attach_driver+0xa4/0xcc + bus_for_each_drv+0x94/0xe8 + __device_attach+0xf8/0x170 + device_initial_probe+0x1c/0x28 + bus_probe_device+0x48/0xa4 + deferred_probe_work_func+0x9c/0xd8 + +Fix these problems by parking shared RCGs at boot. This will properly +initialize the parked_cfg struct member so that the parent is reported +properly and ensure that the clk won't get stuck on or off because the +RCG is parented to the safe source (XO). + +Fixes: 703db1f5da1e ("clk: qcom: rcg2: Cache CFG register updates for parked RCGs") +Reported-by: Stephen Boyd +Closes: https://lore.kernel.org/r/1290a5a0f7f584fcce722eeb2a1fd898.sboyd@kernel.org +Closes: https://issuetracker.google.com/319956935 +Reported-by: Laura Nao +Closes: https://lore.kernel.org/r/20231218091806.7155-1-laura.nao@collabora.com +Cc: Bjorn Andersson +Cc: Dmitry Baryshkov +Cc: Douglas Anderson +Cc: Taniya Das +Signed-off-by: Stephen Boyd +Link: https://lore.kernel.org/r/20240502224703.103150-1-swboyd@chromium.org +Reviewed-by: Douglas Anderson +Tested-by: Nícolas F. R. A. Prado +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/clk-rcg2.c | 32 ++++++++++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c +index dc797bd137caf..e46bb60dcda41 100644 +--- a/drivers/clk/qcom/clk-rcg2.c ++++ b/drivers/clk/qcom/clk-rcg2.c +@@ -1136,7 +1136,39 @@ clk_rcg2_shared_recalc_rate(struct clk_hw *hw, unsigned long parent_rate) + return clk_rcg2_recalc_rate(hw, parent_rate); + } + ++static int clk_rcg2_shared_init(struct clk_hw *hw) ++{ ++ /* ++ * This does a few things: ++ * ++ * 1. Sets rcg->parked_cfg to reflect the value at probe so that the ++ * proper parent is reported from clk_rcg2_shared_get_parent(). ++ * ++ * 2. Clears the force enable bit of the RCG because we rely on child ++ * clks (branches) to turn the RCG on/off with a hardware feedback ++ * mechanism and only set the force enable bit in the RCG when we ++ * want to make sure the clk stays on for parent switches or ++ * parking. ++ * ++ * 3. Parks shared RCGs on the safe source at registration because we ++ * can't be certain that the parent clk will stay on during boot, ++ * especially if the parent is shared. If this RCG is enabled at ++ * boot, and the parent is turned off, the RCG will get stuck on. A ++ * GDSC can wedge if is turned on and the RCG is stuck on because ++ * the GDSC's controller will hang waiting for the clk status to ++ * toggle on when it never does. ++ * ++ * The safest option here is to "park" the RCG at init so that the clk ++ * can never get stuck on or off. This ensures the GDSC can't get ++ * wedged. ++ */ ++ clk_rcg2_shared_disable(hw); ++ ++ return 0; ++} ++ + const struct clk_ops clk_rcg2_shared_ops = { ++ .init = clk_rcg2_shared_init, + .enable = clk_rcg2_shared_enable, + .disable = clk_rcg2_shared_disable, + .get_parent = clk_rcg2_shared_get_parent, +-- +2.43.0 + diff --git a/queue-6.1/coresight-fix-ref-leak-when-of_coresight_parse_endpo.patch b/queue-6.1/coresight-fix-ref-leak-when-of_coresight_parse_endpo.patch new file mode 100644 index 00000000000..c255ed5e9a0 --- /dev/null +++ b/queue-6.1/coresight-fix-ref-leak-when-of_coresight_parse_endpo.patch @@ -0,0 +1,45 @@ +From 3ec1932fb0d996b8b1d3629ecb0f35d6304dd7ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 14:36:26 +0100 +Subject: coresight: Fix ref leak when of_coresight_parse_endpoint() fails + +From: James Clark + +[ Upstream commit 7fcb9cb2fe47294e16067c3cfd25332c8662a115 ] + +of_graph_get_next_endpoint() releases the reference to the previous +endpoint on each iteration, but when parsing fails the loop exits +early meaning the last reference is never dropped. + +Fix it by dropping the refcount in the exit condition. + +Fixes: d375b356e687 ("coresight: Fix support for sparsely populated ports") +Signed-off-by: James Clark +Reported-by: Laurent Pinchart +Reviewed-by: Laurent Pinchart +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20240529133626.90080-1-james.clark@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-platform.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-platform.c b/drivers/hwtracing/coresight/coresight-platform.c +index 4758997141046..3f82ae07a18e5 100644 +--- a/drivers/hwtracing/coresight/coresight-platform.c ++++ b/drivers/hwtracing/coresight/coresight-platform.c +@@ -323,8 +323,10 @@ static int of_get_coresight_platform_data(struct device *dev, + continue; + + ret = of_coresight_parse_endpoint(dev, ep, pdata); +- if (ret) ++ if (ret) { ++ of_node_put(ep); + return ret; ++ } + } + + return 0; +-- +2.43.0 + diff --git a/queue-6.1/cpufreq-amd-pstate-ut-convert-nominal_freq-to-khz-du.patch b/queue-6.1/cpufreq-amd-pstate-ut-convert-nominal_freq-to-khz-du.patch new file mode 100644 index 00000000000..4cc5394fc26 --- /dev/null +++ b/queue-6.1/cpufreq-amd-pstate-ut-convert-nominal_freq-to-khz-du.patch @@ -0,0 +1,73 @@ +From f85ae19ed758f5a5c7e84c8a7f73149be6ed491a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 08:14:13 +0000 +Subject: cpufreq/amd-pstate-ut: Convert nominal_freq to khz during comparisons + +From: Dhananjay Ugwekar + +[ Upstream commit f21ab5ed4e8758b06230900f44b9dcbcfdc0c3ae ] + +cpudata->nominal_freq being in MHz whereas other frequencies being in +KHz breaks the amd-pstate-ut frequency sanity check. This fixes it. + +Fixes: e4731baaf294 ("cpufreq: amd-pstate: Fix the inconsistency in max frequency units") +Reported-by: David Arcari +Signed-off-by: Dhananjay Ugwekar +Reviewed-by: Mario Limonciello +Reviewed-by: Gautham R. Shenoy +Link: https://lore.kernel.org/r/20240702081413.5688-2-Dhananjay.Ugwekar@amd.com +Signed-off-by: Mario Limonciello +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/amd-pstate-ut.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/cpufreq/amd-pstate-ut.c b/drivers/cpufreq/amd-pstate-ut.c +index b448c8d6a16dd..9c1fc386c010f 100644 +--- a/drivers/cpufreq/amd-pstate-ut.c ++++ b/drivers/cpufreq/amd-pstate-ut.c +@@ -201,6 +201,7 @@ static void amd_pstate_ut_check_freq(u32 index) + int cpu = 0; + struct cpufreq_policy *policy = NULL; + struct amd_cpudata *cpudata = NULL; ++ u32 nominal_freq_khz; + + for_each_possible_cpu(cpu) { + policy = cpufreq_cpu_get(cpu); +@@ -208,13 +209,14 @@ static void amd_pstate_ut_check_freq(u32 index) + break; + cpudata = policy->driver_data; + +- if (!((cpudata->max_freq >= cpudata->nominal_freq) && +- (cpudata->nominal_freq > cpudata->lowest_nonlinear_freq) && ++ nominal_freq_khz = cpudata->nominal_freq*1000; ++ if (!((cpudata->max_freq >= nominal_freq_khz) && ++ (nominal_freq_khz > cpudata->lowest_nonlinear_freq) && + (cpudata->lowest_nonlinear_freq > cpudata->min_freq) && + (cpudata->min_freq > 0))) { + amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_FAIL; + pr_err("%s cpu%d max=%d >= nominal=%d > lowest_nonlinear=%d > min=%d > 0, the formula is incorrect!\n", +- __func__, cpu, cpudata->max_freq, cpudata->nominal_freq, ++ __func__, cpu, cpudata->max_freq, nominal_freq_khz, + cpudata->lowest_nonlinear_freq, cpudata->min_freq); + goto skip_test; + } +@@ -228,13 +230,13 @@ static void amd_pstate_ut_check_freq(u32 index) + + if (cpudata->boost_supported) { + if ((policy->max == cpudata->max_freq) || +- (policy->max == cpudata->nominal_freq)) ++ (policy->max == nominal_freq_khz)) + amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_PASS; + else { + amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_FAIL; + pr_err("%s cpu%d policy_max=%d should be equal cpu_max=%d or cpu_nominal=%d !\n", + __func__, cpu, policy->max, cpudata->max_freq, +- cpudata->nominal_freq); ++ nominal_freq_khz); + goto skip_test; + } + } else { +-- +2.43.0 + diff --git a/queue-6.1/cpufreq-ti-cpufreq-handle-deferred-probe-with-dev_er.patch b/queue-6.1/cpufreq-ti-cpufreq-handle-deferred-probe-with-dev_er.patch new file mode 100644 index 00000000000..88e7c8d5833 --- /dev/null +++ b/queue-6.1/cpufreq-ti-cpufreq-handle-deferred-probe-with-dev_er.patch @@ -0,0 +1,36 @@ +From da7c653771340914206bf4f73a89e9f7961b25a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 08:58:47 +0200 +Subject: cpufreq: ti-cpufreq: Handle deferred probe with dev_err_probe() + +From: Primoz Fiser + +[ Upstream commit 101388b8ef1027be72e399beeb97293cce67bb24 ] + +Handle deferred probing gracefully by using dev_err_probe() to not +spam console with unnecessary error messages. + +Fixes: f88d152dc739 ("cpufreq: ti: Migrate to dev_pm_opp_set_config()") +Signed-off-by: Primoz Fiser +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/ti-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c +index 61ef653bcf56f..15e2ef8303508 100644 +--- a/drivers/cpufreq/ti-cpufreq.c ++++ b/drivers/cpufreq/ti-cpufreq.c +@@ -381,7 +381,7 @@ static int ti_cpufreq_probe(struct platform_device *pdev) + + ret = dev_pm_opp_set_config(opp_data->cpu_dev, &config); + if (ret < 0) { +- dev_err(opp_data->cpu_dev, "Failed to set OPP config\n"); ++ dev_err_probe(opp_data->cpu_dev, ret, "Failed to set OPP config\n"); + goto fail_put_node; + } + +-- +2.43.0 + diff --git a/queue-6.1/crypto-qat-extend-scope-of-lock-in-adf_cfg_add_key_v.patch b/queue-6.1/crypto-qat-extend-scope-of-lock-in-adf_cfg_add_key_v.patch new file mode 100644 index 00000000000..4c4c69cee30 --- /dev/null +++ b/queue-6.1/crypto-qat-extend-scope-of-lock-in-adf_cfg_add_key_v.patch @@ -0,0 +1,52 @@ +From 79456f3d684d5e59c8adf7f6e74497bbc2aec6d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 15:38:50 +0100 +Subject: crypto: qat - extend scope of lock in adf_cfg_add_key_value_param() + +From: Nivas Varadharajan Mugunthakumar + +[ Upstream commit 6424da7d8b938fe66e7e771eaa949bc7b6c29c00 ] + +The function adf_cfg_add_key_value_param() attempts to access and modify +the key value store of the driver without locking. + +Extend the scope of cfg->lock to avoid a potential race condition. + +Fixes: 92bf269fbfe9 ("crypto: qat - change behaviour of adf_cfg_add_key_value_param()") +Signed-off-by: Nivas Varadharajan Mugunthakumar +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_cfg.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_cfg.c b/drivers/crypto/qat/qat_common/adf_cfg.c +index 1931e5b37f2bd..368d14d81503c 100644 +--- a/drivers/crypto/qat/qat_common/adf_cfg.c ++++ b/drivers/crypto/qat/qat_common/adf_cfg.c +@@ -276,17 +276,19 @@ int adf_cfg_add_key_value_param(struct adf_accel_dev *accel_dev, + * 3. if the key exists with the same value, then return without doing + * anything (the newly created key_val is freed). + */ ++ down_write(&cfg->lock); + if (!adf_cfg_key_val_get(accel_dev, section_name, key, temp_val)) { + if (strncmp(temp_val, key_val->val, sizeof(temp_val))) { + adf_cfg_keyval_remove(key, section); + } else { + kfree(key_val); +- return 0; ++ goto out; + } + } + +- down_write(&cfg->lock); + adf_cfg_keyval_add(key_val, section); ++ ++out: + up_write(&cfg->lock); + return 0; + } +-- +2.43.0 + diff --git a/queue-6.1/drm-amd-pm-fix-aldebaran-pcie-speed-reporting.patch b/queue-6.1/drm-amd-pm-fix-aldebaran-pcie-speed-reporting.patch new file mode 100644 index 00000000000..50e1148e3ec --- /dev/null +++ b/queue-6.1/drm-amd-pm-fix-aldebaran-pcie-speed-reporting.patch @@ -0,0 +1,39 @@ +From 571b9055f7c95405903f4208dc1b00d2fe62b5d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 14:14:10 +0530 +Subject: drm/amd/pm: Fix aldebaran pcie speed reporting + +From: Lijo Lazar + +[ Upstream commit b6420021e17e262c57bb289d0556ee181b014f9c ] + +Fix the field definitions for LC_CURRENT_DATA_RATE. + +Fixes: c05d1c401572 ("drm/amd/swsmu: add aldebaran smu13 ip support (v3)") +Signed-off-by: Lijo Lazar +Reviewed-by: Asad Kamal +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +index f3257cf4b06f2..3aab1caed2ac7 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +@@ -79,8 +79,8 @@ MODULE_FIRMWARE("amdgpu/smu_13_0_10.bin"); + #define PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD_MASK 0x00000070L + #define PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD__SHIFT 0x4 + #define smnPCIE_LC_SPEED_CNTL 0x11140290 +-#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK 0xC000 +-#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT 0xE ++#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK 0xE0 ++#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT 0x5 + + static const int link_width[] = {0, 1, 2, 4, 8, 12, 16}; + static const int link_speed[] = {25, 50, 80, 160}; +-- +2.43.0 + diff --git a/queue-6.1/drm-amdgpu-check-if-nbio-funcs-are-null-in-amdgpu_de.patch b/queue-6.1/drm-amdgpu-check-if-nbio-funcs-are-null-in-amdgpu_de.patch new file mode 100644 index 00000000000..a8c6c085ef4 --- /dev/null +++ b/queue-6.1/drm-amdgpu-check-if-nbio-funcs-are-null-in-amdgpu_de.patch @@ -0,0 +1,43 @@ +From dc43122bb3b6aabf53b502150fa999c9bc98bd44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 09:06:38 +0200 +Subject: drm/amdgpu: Check if NBIO funcs are NULL in amdgpu_device_baco_exit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Friedrich Vock + +[ Upstream commit 0cdb3f9740844b9d95ca413e3fcff11f81223ecf ] + +The special case for VM passthrough doesn't check adev->nbio.funcs +before dereferencing it. If GPUs that don't have an NBIO block are +passed through, this leads to a NULL pointer dereference on startup. + +Signed-off-by: Friedrich Vock +Fixes: 1bece222eabe ("drm/amdgpu: Clear doorbell interrupt status for Sienna Cichlid") +Cc: Alex Deucher +Cc: Christian König +Acked-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 157441dd07041..d4faa489bd5fa 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -5815,7 +5815,7 @@ int amdgpu_device_baco_exit(struct drm_device *dev) + adev->nbio.funcs->enable_doorbell_interrupt) + adev->nbio.funcs->enable_doorbell_interrupt(adev, true); + +- if (amdgpu_passthrough(adev) && ++ if (amdgpu_passthrough(adev) && adev->nbio.funcs && + adev->nbio.funcs->clear_doorbell_interrupt) + adev->nbio.funcs->clear_doorbell_interrupt(adev); + +-- +2.43.0 + diff --git a/queue-6.1/drm-amdgpu-remove-gc-hw-ip-9.3.0-from-noretry-1.patch b/queue-6.1/drm-amdgpu-remove-gc-hw-ip-9.3.0-from-noretry-1.patch new file mode 100644 index 00000000000..7e8054be128 --- /dev/null +++ b/queue-6.1/drm-amdgpu-remove-gc-hw-ip-9.3.0-from-noretry-1.patch @@ -0,0 +1,41 @@ +From e9be8fbc4f4aadf5aabddae9c10f1e05fde7fd7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2024 11:57:25 -0600 +Subject: drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1 + +From: Tim Van Patten + +[ Upstream commit 1446226d32a45bb7c4f63195a59be8c08defe658 ] + +The following commit updated gmc->noretry from 0 to 1 for GC HW IP +9.3.0: + + commit 5f3854f1f4e2 ("drm/amdgpu: add more cases to noretry=1") + +This causes the device to hang when a page fault occurs, until the +device is rebooted. Instead, revert back to gmc->noretry=0 so the device +is still responsive. + +Fixes: 5f3854f1f4e2 ("drm/amdgpu: add more cases to noretry=1") +Signed-off-by: Tim Van Patten +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +index ea0fb079f942a..fd98d2508a22a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +@@ -583,7 +583,6 @@ void amdgpu_gmc_noretry_set(struct amdgpu_device *adev) + struct amdgpu_gmc *gmc = &adev->gmc; + uint32_t gc_ver = adev->ip_versions[GC_HWIP][0]; + bool noretry_default = (gc_ver == IP_VERSION(9, 0, 1) || +- gc_ver == IP_VERSION(9, 3, 0) || + gc_ver == IP_VERSION(9, 4, 0) || + gc_ver == IP_VERSION(9, 4, 1) || + gc_ver == IP_VERSION(9, 4, 2) || +-- +2.43.0 + diff --git a/queue-6.1/drm-etnaviv-fix-dma-direction-handling-for-cached-rw.patch b/queue-6.1/drm-etnaviv-fix-dma-direction-handling-for-cached-rw.patch new file mode 100644 index 00000000000..d63ff387461 --- /dev/null +++ b/queue-6.1/drm-etnaviv-fix-dma-direction-handling-for-cached-rw.patch @@ -0,0 +1,42 @@ +From fccf727dfcec3595690c1b547b4ac7b0fb352d6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 19:11:06 +0200 +Subject: drm/etnaviv: fix DMA direction handling for cached RW buffers + +From: Lucas Stach + +[ Upstream commit 58979ad6330a70450ed78837be3095107d022ea9 ] + +The dma sync operation needs to be done with DMA_BIDIRECTIONAL when +the BO is prepared for both read and write operations. + +Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver") +Signed-off-by: Lucas Stach +Reviewed-by: Philipp Zabel +Reviewed-by: Christian Gmeiner +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_gem.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +index 5cf13e52f7c94..23d5058eca8d8 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +@@ -355,9 +355,11 @@ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj) + + static inline enum dma_data_direction etnaviv_op_to_dma_dir(u32 op) + { +- if (op & ETNA_PREP_READ) ++ op &= ETNA_PREP_READ | ETNA_PREP_WRITE; ++ ++ if (op == ETNA_PREP_READ) + return DMA_FROM_DEVICE; +- else if (op & ETNA_PREP_WRITE) ++ else if (op == ETNA_PREP_WRITE) + return DMA_TO_DEVICE; + else + return DMA_BIDIRECTIONAL; +-- +2.43.0 + diff --git a/queue-6.1/drm-mediatek-add-missing-plane-settings-when-async-u.patch b/queue-6.1/drm-mediatek-add-missing-plane-settings-when-async-u.patch new file mode 100644 index 00000000000..17d27ee7523 --- /dev/null +++ b/queue-6.1/drm-mediatek-add-missing-plane-settings-when-async-u.patch @@ -0,0 +1,41 @@ +From c5167dd4cc203eeff70301442c3593bddec28c24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 00:38:41 +0800 +Subject: drm/mediatek: Add missing plane settings when async update + +From: Hsiao Chien Sung + +[ Upstream commit 86b89dc669c400576dc23aa923bcf302f99e8e3a ] + +Fix an issue that plane coordinate was not saved when +calling async update. + +Fixes: 920fffcc8912 ("drm/mediatek: update cursors by using async atomic update") + +Reviewed-by: CK Hu +Reviewed-by: AngeloGioacchino Del Regno +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsiao Chien Sung +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240620-igt-v3-1-a9d62d2e2c7e@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_plane.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_plane.c b/drivers/gpu/drm/mediatek/mtk_drm_plane.c +index c4a0203d17e38..30d361671aa9c 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_plane.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_plane.c +@@ -157,6 +157,8 @@ static void mtk_plane_atomic_async_update(struct drm_plane *plane, + plane->state->src_y = new_state->src_y; + plane->state->src_h = new_state->src_h; + plane->state->src_w = new_state->src_w; ++ plane->state->dst.x1 = new_state->dst.x1; ++ plane->state->dst.y1 = new_state->dst.y1; + + mtk_plane_update_new_state(new_state, new_plane_state); + swap(plane->state->fb, new_state->fb); +-- +2.43.0 + diff --git a/queue-6.1/drm-mediatek-add-ovl-compatible-name-for-mt8195.patch b/queue-6.1/drm-mediatek-add-ovl-compatible-name-for-mt8195.patch new file mode 100644 index 00000000000..b6ecc8c0087 --- /dev/null +++ b/queue-6.1/drm-mediatek-add-ovl-compatible-name-for-mt8195.patch @@ -0,0 +1,39 @@ +From 1a4a976a73cb83191e1d7c49949bd3ffa4b48f67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 00:38:47 +0800 +Subject: drm/mediatek: Add OVL compatible name for MT8195 + +From: Hsiao Chien Sung + +[ Upstream commit 6fb7a0985fd16868b5d72eb3e3de7524a6000e6e ] + +Add OVL compatible name for MT8195. +Without this commit, DRM won't work after modifying the device tree. + +Reviewed-by: CK Hu +Reviewed-by: AngeloGioacchino Del Regno +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsiao Chien Sung +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240620-igt-v3-7-a9d62d2e2c7e@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index 25639fbfd374a..905275df09800 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -598,6 +598,8 @@ static const struct of_device_id mtk_ddp_comp_dt_ids[] = { + .data = (void *)MTK_DISP_OVL }, + { .compatible = "mediatek,mt8192-disp-ovl", + .data = (void *)MTK_DISP_OVL }, ++ { .compatible = "mediatek,mt8195-disp-ovl", ++ .data = (void *)MTK_DISP_OVL }, + { .compatible = "mediatek,mt8183-disp-ovl-2l", + .data = (void *)MTK_DISP_OVL_2L }, + { .compatible = "mediatek,mt8192-disp-ovl-2l", +-- +2.43.0 + diff --git a/queue-6.1/drm-meson-fix-canvas-release-in-bind-function.patch b/queue-6.1/drm-meson-fix-canvas-release-in-bind-function.patch new file mode 100644 index 00000000000..f7128140236 --- /dev/null +++ b/queue-6.1/drm-meson-fix-canvas-release-in-bind-function.patch @@ -0,0 +1,106 @@ +From b14634615379d5de6baedbac6cc1ef3bc836cd1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 15:58:27 +0000 +Subject: drm/meson: fix canvas release in bind function + +From: Yao Zi + +[ Upstream commit a695949b2e9bb6b6700a764c704731a306c4bebf ] + +Allocated canvases may not be released on the error exit path of +meson_drv_bind_master(), leading to resource leaking. Rewrite exit path +to release canvases on error. + +Fixes: 2bf6b5b0e374 ("drm/meson: exclusively use the canvas provider module") +Signed-off-by: Yao Zi +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20240703155826.10385-2-ziyao@disroot.org +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240703155826.10385-2-ziyao@disroot.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_drv.c | 37 +++++++++++++++---------------- + 1 file changed, 18 insertions(+), 19 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index fbac39aa38cc4..f0df41cf39a36 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -249,29 +249,20 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + if (ret) + goto free_drm; + ret = meson_canvas_alloc(priv->canvas, &priv->canvas_id_vd1_0); +- if (ret) { +- meson_canvas_free(priv->canvas, priv->canvas_id_osd1); +- goto free_drm; +- } ++ if (ret) ++ goto free_canvas_osd1; + ret = meson_canvas_alloc(priv->canvas, &priv->canvas_id_vd1_1); +- if (ret) { +- meson_canvas_free(priv->canvas, priv->canvas_id_osd1); +- meson_canvas_free(priv->canvas, priv->canvas_id_vd1_0); +- goto free_drm; +- } ++ if (ret) ++ goto free_canvas_vd1_0; + ret = meson_canvas_alloc(priv->canvas, &priv->canvas_id_vd1_2); +- if (ret) { +- meson_canvas_free(priv->canvas, priv->canvas_id_osd1); +- meson_canvas_free(priv->canvas, priv->canvas_id_vd1_0); +- meson_canvas_free(priv->canvas, priv->canvas_id_vd1_1); +- goto free_drm; +- } ++ if (ret) ++ goto free_canvas_vd1_1; + + priv->vsync_irq = platform_get_irq(pdev, 0); + + ret = drm_vblank_init(drm, 1); + if (ret) +- goto free_drm; ++ goto free_canvas_vd1_2; + + /* Assign limits per soc revision/package */ + for (i = 0 ; i < ARRAY_SIZE(meson_drm_soc_attrs) ; ++i) { +@@ -287,11 +278,11 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + */ + ret = drm_aperture_remove_framebuffers(&meson_driver); + if (ret) +- goto free_drm; ++ goto free_canvas_vd1_2; + + ret = drmm_mode_config_init(drm); + if (ret) +- goto free_drm; ++ goto free_canvas_vd1_2; + drm->mode_config.max_width = 3840; + drm->mode_config.max_height = 2160; + drm->mode_config.funcs = &meson_mode_config_funcs; +@@ -306,7 +297,7 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + if (priv->afbcd.ops) { + ret = priv->afbcd.ops->init(priv); + if (ret) +- goto free_drm; ++ goto free_canvas_vd1_2; + } + + /* Encoder Initialization */ +@@ -364,6 +355,14 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + exit_afbcd: + if (priv->afbcd.ops) + priv->afbcd.ops->exit(priv); ++free_canvas_vd1_2: ++ meson_canvas_free(priv->canvas, priv->canvas_id_vd1_2); ++free_canvas_vd1_1: ++ meson_canvas_free(priv->canvas, priv->canvas_id_vd1_1); ++free_canvas_vd1_0: ++ meson_canvas_free(priv->canvas, priv->canvas_id_vd1_0); ++free_canvas_osd1: ++ meson_canvas_free(priv->canvas, priv->canvas_id_osd1); + free_drm: + drm_dev_put(drm); + +-- +2.43.0 + diff --git a/queue-6.1/drm-mipi-dsi-fix-mipi_dsi_dcs_write_seq-macro-defini.patch b/queue-6.1/drm-mipi-dsi-fix-mipi_dsi_dcs_write_seq-macro-defini.patch new file mode 100644 index 00000000000..02c91c104d0 --- /dev/null +++ b/queue-6.1/drm-mipi-dsi-fix-mipi_dsi_dcs_write_seq-macro-defini.patch @@ -0,0 +1,56 @@ +From 046f3bca95a6240fde5fc3091a4b61861748f127 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 21:25:41 +0100 +Subject: drm/mipi-dsi: Fix mipi_dsi_dcs_write_seq() macro definition format + +From: Javier Martinez Canillas + +[ Upstream commit 51d3c0e7dc3cf1dd91c34b0f9bdadda310c7ed5b ] + +Change made using a `clang-format -i include/drm/drm_mipi_dsi.h` command. + +Suggested-by: Sam Ravnborg +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20230102202542.3494677-1-javierm@redhat.com +Stable-dep-of: 0b03829fdece ("drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_dcs_write_seq()") +Signed-off-by: Sasha Levin +--- + include/drm/drm_mipi_dsi.h | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h +index 66a7e01c62608..9dd1093b2dfa9 100644 +--- a/include/drm/drm_mipi_dsi.h ++++ b/include/drm/drm_mipi_dsi.h +@@ -309,15 +309,18 @@ int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi, + * @cmd: Command + * @seq: buffer containing data to be transmitted + */ +-#define mipi_dsi_dcs_write_seq(dsi, cmd, seq...) do { \ +- static const u8 d[] = { cmd, seq }; \ +- struct device *dev = &dsi->dev; \ +- int ret; \ +- ret = mipi_dsi_dcs_write_buffer(dsi, d, ARRAY_SIZE(d)); \ +- if (ret < 0) { \ +- dev_err_ratelimited(dev, "sending command %#02x failed: %d\n", cmd, ret); \ +- return ret; \ +- } \ ++#define mipi_dsi_dcs_write_seq(dsi, cmd, seq...) \ ++ do { \ ++ static const u8 d[] = { cmd, seq }; \ ++ struct device *dev = &dsi->dev; \ ++ int ret; \ ++ ret = mipi_dsi_dcs_write_buffer(dsi, d, ARRAY_SIZE(d)); \ ++ if (ret < 0) { \ ++ dev_err_ratelimited( \ ++ dev, "sending command %#02x failed: %d\n", \ ++ cmd, ret); \ ++ return ret; \ ++ } \ + } while (0) + + /** +-- +2.43.0 + diff --git a/queue-6.1/drm-mipi-dsi-fix-theoretical-int-overflow-in-mipi_ds.patch b/queue-6.1/drm-mipi-dsi-fix-theoretical-int-overflow-in-mipi_ds.patch new file mode 100644 index 00000000000..e3a456b4cb7 --- /dev/null +++ b/queue-6.1/drm-mipi-dsi-fix-theoretical-int-overflow-in-mipi_ds.patch @@ -0,0 +1,78 @@ +From 1eb108acc8ead7ec4887de24eec2e27af90f248e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 10:20:51 -0700 +Subject: drm/mipi-dsi: Fix theoretical int overflow in + mipi_dsi_dcs_write_seq() + +From: Douglas Anderson + +[ Upstream commit 0b03829fdece47beba9ecb7dbcbde4585ee3663e ] + +The mipi_dsi_dcs_write_seq() macro makes a call to +mipi_dsi_dcs_write_buffer() which returns a type ssize_t. The macro +then stores it in an int and checks to see if it's negative. This +could theoretically be a problem if "ssize_t" is larger than "int". + +To see the issue, imagine that "ssize_t" is 32-bits and "int" is +16-bits, you could see a problem if there was some code out there that +looked like: + + mipi_dsi_dcs_write_seq(dsi, cmd, <32767 bytes as arguments>); + +...since we'd get back that 32768 bytes were transferred and 32768 +stored in a 16-bit int would look negative. + +Though there are no callsites where we'd actually hit this (even if +"int" was only 16-bit), it's cleaner to make the types match so let's +fix it. + +Fixes: 2a9e9daf7523 ("drm/mipi-dsi: Introduce mipi_dsi_dcs_write_seq macro") +Reviewed-by: Neil Armstrong +Reviewed-by: Linus Walleij +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20240514102056.v5.1.I30fa4c8348ea316c886ef8a522a52fed617f930d@changeid +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240514102056.v5.1.I30fa4c8348ea316c886ef8a522a52fed617f930d@changeid +Signed-off-by: Sasha Levin +--- + include/drm/drm_mipi_dsi.h | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h +index 9dd1093b2dfa9..1a921e8943a03 100644 +--- a/include/drm/drm_mipi_dsi.h ++++ b/include/drm/drm_mipi_dsi.h +@@ -309,18 +309,18 @@ int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi, + * @cmd: Command + * @seq: buffer containing data to be transmitted + */ +-#define mipi_dsi_dcs_write_seq(dsi, cmd, seq...) \ +- do { \ +- static const u8 d[] = { cmd, seq }; \ +- struct device *dev = &dsi->dev; \ +- int ret; \ +- ret = mipi_dsi_dcs_write_buffer(dsi, d, ARRAY_SIZE(d)); \ +- if (ret < 0) { \ +- dev_err_ratelimited( \ +- dev, "sending command %#02x failed: %d\n", \ +- cmd, ret); \ +- return ret; \ +- } \ ++#define mipi_dsi_dcs_write_seq(dsi, cmd, seq...) \ ++ do { \ ++ static const u8 d[] = { cmd, seq }; \ ++ struct device *dev = &dsi->dev; \ ++ ssize_t ret; \ ++ ret = mipi_dsi_dcs_write_buffer(dsi, d, ARRAY_SIZE(d)); \ ++ if (ret < 0) { \ ++ dev_err_ratelimited( \ ++ dev, "sending command %#02x failed: %zd\n", \ ++ cmd, ret); \ ++ return ret; \ ++ } \ + } while (0) + + /** +-- +2.43.0 + diff --git a/queue-6.1/drm-msm-dpu-drop-validity-checks-for-clear_pending_f.patch b/queue-6.1/drm-msm-dpu-drop-validity-checks-for-clear_pending_f.patch new file mode 100644 index 00000000000..12546e80aae --- /dev/null +++ b/queue-6.1/drm-msm-dpu-drop-validity-checks-for-clear_pending_f.patch @@ -0,0 +1,84 @@ +From 2c07cdceaa9ee76db2d47a544c7e5040b1f7e65e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 13:17:30 -0700 +Subject: drm/msm/dpu: drop validity checks for clear_pending_flush() ctl op + +From: Abhinav Kumar + +[ Upstream commit 3d68e3dedd4b48f0358bdc187277e3315d8aa559 ] + +clear_pending_flush() ctl op is always assigned irrespective of the DPU +hardware revision. Hence there is no needed to check whether the op has +been assigned before calling it. + +Drop the checks across the driver for clear_pending_flush() and also +update its documentation that it is always expected to be assigned. + +changes in v2: + - instead of adding more validity checks just drop the one for clear_pending_flush + - update the documentation for clear_pending_flush() ctl op + - update the commit text reflecting these changes + +changes in v3: + - simplify the documentation of clear_pending_flush + +Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/all/464fbd84-0d1c-43c3-a40b-31656ac06456@moroto.mountain/T/ +Signed-off-by: Abhinav Kumar +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/600241/ +Link: https://lore.kernel.org/r/20240620201731.3694593-1-quic_abhinavk@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 3 +-- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 3 +-- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h | 3 ++- + 3 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +index 3632f0768aa9e..1bf41a82cd0f9 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +@@ -1653,8 +1653,7 @@ void dpu_encoder_trigger_kickoff_pending(struct drm_encoder *drm_enc) + phys = dpu_enc->phys_encs[i]; + + ctl = phys->hw_ctl; +- if (ctl->ops.clear_pending_flush) +- ctl->ops.clear_pending_flush(ctl); ++ ctl->ops.clear_pending_flush(ctl); + + /* update only for command mode primary ctl */ + if ((phys == dpu_enc->cur_master) && +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +index 42c7e378d504d..05a09d86e1838 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +@@ -548,8 +548,7 @@ static void dpu_encoder_phys_wb_disable(struct dpu_encoder_phys *phys_enc) + } + + /* reset h/w before final flush */ +- if (phys_enc->hw_ctl->ops.clear_pending_flush) +- phys_enc->hw_ctl->ops.clear_pending_flush(phys_enc->hw_ctl); ++ phys_enc->hw_ctl->ops.clear_pending_flush(phys_enc->hw_ctl); + + /* + * New CTL reset sequence from 5.0 MDP onwards. +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h +index 96c012ec84676..ec5265771cdf7 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h +@@ -81,7 +81,8 @@ struct dpu_hw_ctl_ops { + + /** + * Clear the value of the cached pending_flush_mask +- * No effect on hardware ++ * No effect on hardware. ++ * Required to be implemented. + * @ctx : ctl path ctx pointer + */ + void (*clear_pending_flush)(struct dpu_hw_ctl *ctx); +-- +2.43.0 + diff --git a/queue-6.1/drm-msm-dsi-set-video_compression_mode_ctrl_wc.patch b/queue-6.1/drm-msm-dsi-set-video_compression_mode_ctrl_wc.patch new file mode 100644 index 00000000000..b9a2da873f5 --- /dev/null +++ b/queue-6.1/drm-msm-dsi-set-video_compression_mode_ctrl_wc.patch @@ -0,0 +1,59 @@ +From 4b756f04b092366840e0d2bdc308ee672c02e12e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 13:56:49 +0800 +Subject: drm/msm/dsi: set VIDEO_COMPRESSION_MODE_CTRL_WC + +From: Jonathan Marek + +[ Upstream commit 9ecd0ddd223b68b4603e4766a1d51f6c6cda346e ] + +Video mode DSC won't work if this field is not set correctly. Set it to fix +video mode DSC (for slice_per_pkt==1 cases at least). + +Fixes: 08802f515c3c ("drm/msm/dsi: Add support for DSC configuration") +Signed-off-by: Jonathan Marek +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Jun Nie +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Reviewed-by: Jessica Zhang +Patchwork: https://patchwork.freedesktop.org/patch/596234/ +Link: https://lore.kernel.org/r/20240530-msm-drm-dsc-dsi-video-upstream-4-v6-5-2ab1d334c657@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/dsi_host.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index cd9ca36901611..034ad810fd653 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -848,6 +848,7 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod + u32 slice_per_intf, total_bytes_per_intf; + u32 pkt_per_line; + u32 eol_byte_num; ++ u32 bytes_per_pkt; + + /* first calculate dsc parameters and then program + * compress mode registers +@@ -855,6 +856,7 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod + slice_per_intf = DIV_ROUND_UP(hdisplay, dsc->slice_width); + + total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf; ++ bytes_per_pkt = dsc->slice_chunk_size; /* * slice_per_pkt; */ + + eol_byte_num = total_bytes_per_intf % 3; + +@@ -892,6 +894,7 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod + dsi_write(msm_host, REG_DSI_COMMAND_COMPRESSION_MODE_CTRL, reg_ctrl); + dsi_write(msm_host, REG_DSI_COMMAND_COMPRESSION_MODE_CTRL2, reg_ctrl2); + } else { ++ reg |= DSI_VIDEO_COMPRESSION_MODE_CTRL_WC(bytes_per_pkt); + dsi_write(msm_host, REG_DSI_VIDEO_COMPRESSION_MODE_CTRL, reg); + } + } +-- +2.43.0 + diff --git a/queue-6.1/drm-panel-boe-tv101wum-nl6-check-for-errors-on-the-n.patch b/queue-6.1/drm-panel-boe-tv101wum-nl6-check-for-errors-on-the-n.patch new file mode 100644 index 00000000000..79ac1b5d2d7 --- /dev/null +++ b/queue-6.1/drm-panel-boe-tv101wum-nl6-check-for-errors-on-the-n.patch @@ -0,0 +1,49 @@ +From 0db598ef835a53c4367f056b40297f2aefc6569d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 14:36:38 -0700 +Subject: drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare() + +From: Douglas Anderson + +[ Upstream commit 6320b9199dd99622668649c234d4e8a99e44a9c8 ] + +The mipi_dsi_dcs_nop() function returns an error but we weren't +checking it in boe_panel_prepare(). Add a check. This is highly +unlikely to matter in practice. If the NOP failed then likely later +MIPI commands would fail too. + +Found by code inspection. + +Fixes: 812562b8d881 ("drm/panel: boe-tv101wum-nl6: Fine tune the panel power sequence") +Signed-off-by: Douglas Anderson +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240517143643.3.Ibffbaa5b4999ac0e55f43bf353144433b099d727@changeid +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240517143643.3.Ibffbaa5b4999ac0e55f43bf353144433b099d727@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +index b26c4a09d0912..820d8d29b62bd 100644 +--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c ++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +@@ -1271,7 +1271,11 @@ static int boe_panel_prepare(struct drm_panel *panel) + usleep_range(10000, 11000); + + if (boe->desc->lp11_before_reset) { +- mipi_dsi_dcs_nop(boe->dsi); ++ ret = mipi_dsi_dcs_nop(boe->dsi); ++ if (ret < 0) { ++ dev_err(&boe->dsi->dev, "Failed to send NOP: %d\n", ret); ++ goto poweroff; ++ } + usleep_range(1000, 2000); + } + gpiod_set_value(boe->enable_gpio, 1); +-- +2.43.0 + diff --git a/queue-6.1/drm-panel-boe-tv101wum-nl6-if-prepare-fails-disable-.patch b/queue-6.1/drm-panel-boe-tv101wum-nl6-if-prepare-fails-disable-.patch new file mode 100644 index 00000000000..c2bd54cdd82 --- /dev/null +++ b/queue-6.1/drm-panel-boe-tv101wum-nl6-if-prepare-fails-disable-.patch @@ -0,0 +1,48 @@ +From 5b669f4ece6bac5323a0a0ae504aabd87202aae0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 14:36:37 -0700 +Subject: drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before + regulators + +From: Douglas Anderson + +[ Upstream commit 587c48f622374e5d47b1d515c6006a4df4dee882 ] + +The enable GPIO should clearly be set low before turning off +regulators. That matches both the inverse order that things were +enabled and also the order in unprepare(). + +Fixes: a869b9db7adf ("drm/panel: support for boe tv101wum-nl6 wuxga dsi video mode panel") +Signed-off-by: Douglas Anderson +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240517143643.2.Ieac346cd0f1606948ba39ceea06b55359fe972b6@changeid +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240517143643.2.Ieac346cd0f1606948ba39ceea06b55359fe972b6@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +index 1c008bd9102ff..b26c4a09d0912 100644 +--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c ++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +@@ -1292,13 +1292,13 @@ static int boe_panel_prepare(struct drm_panel *panel) + return 0; + + poweroff: ++ gpiod_set_value(boe->enable_gpio, 0); + regulator_disable(boe->avee); + poweroffavdd: + regulator_disable(boe->avdd); + poweroff1v8: + usleep_range(5000, 7000); + regulator_disable(boe->pp1800); +- gpiod_set_value(boe->enable_gpio, 0); + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.1/drm-qxl-add-check-for-drm_cvt_mode.patch b/queue-6.1/drm-qxl-add-check-for-drm_cvt_mode.patch new file mode 100644 index 00000000000..977282f8148 --- /dev/null +++ b/queue-6.1/drm-qxl-add-check-for-drm_cvt_mode.patch @@ -0,0 +1,39 @@ +From b98f5d557bead5b8c3196bf7b01b4f8526dec2e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 15:10:31 +0800 +Subject: drm/qxl: Add check for drm_cvt_mode + +From: Chen Ni + +[ Upstream commit 7bd09a2db0f617377027a2bb0b9179e6959edff3 ] + +Add check for the return value of drm_cvt_mode() and return the error if +it fails in order to avoid NULL pointer dereference. + +Fixes: 1b043677d4be ("drm/qxl: add qxl_add_mode helper function") +Signed-off-by: Chen Ni +Reviewed-by: Heng Qi +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20240621071031.1987974-1-nichen@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/qxl/qxl_display.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c +index f91a86225d5e7..462a4d2ac0b95 100644 +--- a/drivers/gpu/drm/qxl/qxl_display.c ++++ b/drivers/gpu/drm/qxl/qxl_display.c +@@ -236,6 +236,9 @@ static int qxl_add_mode(struct drm_connector *connector, + return 0; + + mode = drm_cvt_mode(dev, width, height, 60, false, false, false); ++ if (!mode) ++ return 0; ++ + if (preferred) + mode->type |= DRM_MODE_TYPE_PREFERRED; + mode->hdisplay = width; +-- +2.43.0 + diff --git a/queue-6.1/drm-rockchip-vop2-fix-the-port-mux-of-vp2.patch b/queue-6.1/drm-rockchip-vop2-fix-the-port-mux-of-vp2.patch new file mode 100644 index 00000000000..e36471d1509 --- /dev/null +++ b/queue-6.1/drm-rockchip-vop2-fix-the-port-mux-of-vp2.patch @@ -0,0 +1,38 @@ +From ee85395c24ac4623c61180d794fe90b4acd3593f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 18:19:05 +0800 +Subject: drm/rockchip: vop2: Fix the port mux of VP2 + +From: Andy Yan + +[ Upstream commit 2bdb481bf7a93c22b9fea8daefa2834aab23a70f ] + +The port mux of VP2 should be RK3568_OVL_PORT_SET__PORT2_MUX. + +Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") +Signed-off-by: Andy Yan +Acked-by: Sascha Hauer +Tested-by: Heiko Stuebner +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20240422101905.32703-2-andyshrk@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index a72642bb9cc60..80b8c83342840 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -1923,7 +1923,7 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp) + port_sel |= FIELD_PREP(RK3568_OVL_PORT_SET__PORT2_MUX, + (vp2->nlayers + vp1->nlayers + vp0->nlayers - 1)); + else +- port_sel |= FIELD_PREP(RK3568_OVL_PORT_SET__PORT1_MUX, 8); ++ port_sel |= FIELD_PREP(RK3568_OVL_PORT_SET__PORT2_MUX, 8); + + layer_sel = vop2_readl(vop2, RK3568_OVL_LAYER_SEL); + +-- +2.43.0 + diff --git a/queue-6.1/edac-i10nm-make-skx_common.o-a-separate-module.patch b/queue-6.1/edac-i10nm-make-skx_common.o-a-separate-module.patch new file mode 100644 index 00000000000..f55dfbc17a3 --- /dev/null +++ b/queue-6.1/edac-i10nm-make-skx_common.o-a-separate-module.patch @@ -0,0 +1,190 @@ +From 4e8e1e5ee25d0a31e42e0a732d8ab7b4bb403cb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 11:51:11 +0200 +Subject: EDAC, i10nm: make skx_common.o a separate module + +From: Arnd Bergmann + +[ Upstream commit 123b158635505c89ed0d3ef45c5845ff9030a466 ] + +Commit 598afa050403 ("kbuild: warn objects shared among multiple modules") +was added to track down cases where the same object is linked into +multiple modules. This can cause serious problems if some modules are +builtin while others are not. + +That test triggers this warning: + +scripts/Makefile.build:236: drivers/edac/Makefile: skx_common.o is added to multiple modules: i10nm_edac skx_edac + +Make this a separate module instead. + +[Tony: Added more background details to commit message] + +Fixes: d4dc89d069aa ("EDAC, i10nm: Add a driver for Intel 10nm server processors") +Signed-off-by: Arnd Bergmann +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/all/20240529095132.1929397-1-arnd@kernel.org/ +Signed-off-by: Sasha Levin +--- + drivers/edac/Makefile | 10 ++++++---- + drivers/edac/skx_common.c | 21 +++++++++++++++++++-- + drivers/edac/skx_common.h | 4 ++-- + 3 files changed, 27 insertions(+), 8 deletions(-) + +diff --git a/drivers/edac/Makefile b/drivers/edac/Makefile +index 2d1641a27a28f..a98e1981df157 100644 +--- a/drivers/edac/Makefile ++++ b/drivers/edac/Makefile +@@ -54,11 +54,13 @@ obj-$(CONFIG_EDAC_MPC85XX) += mpc85xx_edac_mod.o + layerscape_edac_mod-y := fsl_ddr_edac.o layerscape_edac.o + obj-$(CONFIG_EDAC_LAYERSCAPE) += layerscape_edac_mod.o + +-skx_edac-y := skx_common.o skx_base.o +-obj-$(CONFIG_EDAC_SKX) += skx_edac.o ++skx_edac_common-y := skx_common.o + +-i10nm_edac-y := skx_common.o i10nm_base.o +-obj-$(CONFIG_EDAC_I10NM) += i10nm_edac.o ++skx_edac-y := skx_base.o ++obj-$(CONFIG_EDAC_SKX) += skx_edac.o skx_edac_common.o ++ ++i10nm_edac-y := i10nm_base.o ++obj-$(CONFIG_EDAC_I10NM) += i10nm_edac.o skx_edac_common.o + + obj-$(CONFIG_EDAC_CELL) += cell_edac.o + obj-$(CONFIG_EDAC_PPC4XX) += ppc4xx_edac.o +diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c +index f0f8e98f6efb2..e218909f9f9e8 100644 +--- a/drivers/edac/skx_common.c ++++ b/drivers/edac/skx_common.c +@@ -48,7 +48,7 @@ static u64 skx_tolm, skx_tohm; + static LIST_HEAD(dev_edac_list); + static bool skx_mem_cfg_2lm; + +-int __init skx_adxl_get(void) ++int skx_adxl_get(void) + { + const char * const *names; + int i, j; +@@ -110,12 +110,14 @@ int __init skx_adxl_get(void) + + return -ENODEV; + } ++EXPORT_SYMBOL_GPL(skx_adxl_get); + +-void __exit skx_adxl_put(void) ++void skx_adxl_put(void) + { + kfree(adxl_values); + kfree(adxl_msg); + } ++EXPORT_SYMBOL_GPL(skx_adxl_put); + + static bool skx_adxl_decode(struct decoded_addr *res, bool error_in_1st_level_mem) + { +@@ -187,12 +189,14 @@ void skx_set_mem_cfg(bool mem_cfg_2lm) + { + skx_mem_cfg_2lm = mem_cfg_2lm; + } ++EXPORT_SYMBOL_GPL(skx_set_mem_cfg); + + void skx_set_decode(skx_decode_f decode, skx_show_retry_log_f show_retry_log) + { + driver_decode = decode; + skx_show_retry_rd_err_log = show_retry_log; + } ++EXPORT_SYMBOL_GPL(skx_set_decode); + + int skx_get_src_id(struct skx_dev *d, int off, u8 *id) + { +@@ -206,6 +210,7 @@ int skx_get_src_id(struct skx_dev *d, int off, u8 *id) + *id = GET_BITFIELD(reg, 12, 14); + return 0; + } ++EXPORT_SYMBOL_GPL(skx_get_src_id); + + int skx_get_node_id(struct skx_dev *d, u8 *id) + { +@@ -219,6 +224,7 @@ int skx_get_node_id(struct skx_dev *d, u8 *id) + *id = GET_BITFIELD(reg, 0, 2); + return 0; + } ++EXPORT_SYMBOL_GPL(skx_get_node_id); + + static int get_width(u32 mtr) + { +@@ -284,6 +290,7 @@ int skx_get_all_bus_mappings(struct res_config *cfg, struct list_head **list) + *list = &dev_edac_list; + return ndev; + } ++EXPORT_SYMBOL_GPL(skx_get_all_bus_mappings); + + int skx_get_hi_lo(unsigned int did, int off[], u64 *tolm, u64 *tohm) + { +@@ -323,6 +330,7 @@ int skx_get_hi_lo(unsigned int did, int off[], u64 *tolm, u64 *tohm) + pci_dev_put(pdev); + return -ENODEV; + } ++EXPORT_SYMBOL_GPL(skx_get_hi_lo); + + static int skx_get_dimm_attr(u32 reg, int lobit, int hibit, int add, + int minval, int maxval, const char *name) +@@ -394,6 +402,7 @@ int skx_get_dimm_info(u32 mtr, u32 mcmtr, u32 amap, struct dimm_info *dimm, + + return 1; + } ++EXPORT_SYMBOL_GPL(skx_get_dimm_info); + + int skx_get_nvdimm_info(struct dimm_info *dimm, struct skx_imc *imc, + int chan, int dimmno, const char *mod_str) +@@ -442,6 +451,7 @@ int skx_get_nvdimm_info(struct dimm_info *dimm, struct skx_imc *imc, + + return (size == 0 || size == ~0ull) ? 0 : 1; + } ++EXPORT_SYMBOL_GPL(skx_get_nvdimm_info); + + int skx_register_mci(struct skx_imc *imc, struct pci_dev *pdev, + const char *ctl_name, const char *mod_str, +@@ -512,6 +522,7 @@ int skx_register_mci(struct skx_imc *imc, struct pci_dev *pdev, + imc->mci = NULL; + return rc; + } ++EXPORT_SYMBOL_GPL(skx_register_mci); + + static void skx_unregister_mci(struct skx_imc *imc) + { +@@ -694,6 +705,7 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val, + mce->kflags |= MCE_HANDLED_EDAC; + return NOTIFY_DONE; + } ++EXPORT_SYMBOL_GPL(skx_mce_check_error); + + void skx_remove(void) + { +@@ -731,3 +743,8 @@ void skx_remove(void) + kfree(d); + } + } ++EXPORT_SYMBOL_GPL(skx_remove); ++ ++MODULE_LICENSE("GPL v2"); ++MODULE_AUTHOR("Tony Luck"); ++MODULE_DESCRIPTION("MC Driver for Intel server processors"); +diff --git a/drivers/edac/skx_common.h b/drivers/edac/skx_common.h +index 0cbadd3d2cd39..c0c174c101d2c 100644 +--- a/drivers/edac/skx_common.h ++++ b/drivers/edac/skx_common.h +@@ -178,8 +178,8 @@ typedef int (*get_dimm_config_f)(struct mem_ctl_info *mci, + typedef bool (*skx_decode_f)(struct decoded_addr *res); + typedef void (*skx_show_retry_log_f)(struct decoded_addr *res, char *msg, int len, bool scrub_err); + +-int __init skx_adxl_get(void); +-void __exit skx_adxl_put(void); ++int skx_adxl_get(void); ++void skx_adxl_put(void); + void skx_set_decode(skx_decode_f decode, skx_show_retry_log_f show_retry_log); + void skx_set_mem_cfg(bool mem_cfg_2lm); + +-- +2.43.0 + diff --git a/queue-6.1/ext4-avoid-writing-unitialized-memory-to-disk-in-ea-.patch b/queue-6.1/ext4-avoid-writing-unitialized-memory-to-disk-in-ea-.patch new file mode 100644 index 00000000000..36dc76be768 --- /dev/null +++ b/queue-6.1/ext4-avoid-writing-unitialized-memory-to-disk-in-ea-.patch @@ -0,0 +1,46 @@ +From 909b58075dac61adf0d00994d4214d1338929a2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 17:02:34 +0200 +Subject: ext4: avoid writing unitialized memory to disk in EA inodes + +From: Jan Kara + +[ Upstream commit 65121eff3e4c8c90f8126debf3c369228691c591 ] + +If the extended attribute size is not a multiple of block size, the last +block in the EA inode will have uninitialized tail which will get +written to disk. We will never expose the data to userspace but still +this is not a good practice so just zero out the tail of the block as it +isn't going to cause a noticeable performance overhead. + +Fixes: e50e5129f384 ("ext4: xattr-in-inode support") +Reported-by: syzbot+9c1fe13fcb51574b249b@syzkaller.appspotmail.com +Reported-by: Hugh Dickins +Signed-off-by: Jan Kara +Link: https://patch.msgid.link/20240613150234.25176-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/xattr.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 28d00ed833db4..f0a45d3ec4ebb 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1384,6 +1384,12 @@ static int ext4_xattr_inode_write(handle_t *handle, struct inode *ea_inode, + goto out; + + memcpy(bh->b_data, buf, csize); ++ /* ++ * Zero out block tail to avoid writing uninitialized memory ++ * to disk. ++ */ ++ if (csize < blocksize) ++ memset(bh->b_data + csize, 0, blocksize - csize); + set_buffer_uptodate(bh); + ext4_handle_dirty_metadata(handle, ea_inode, bh); + +-- +2.43.0 + diff --git a/queue-6.1/ext4-don-t-track-ranges-in-fast_commit-if-inode-has-.patch b/queue-6.1/ext4-don-t-track-ranges-in-fast_commit-if-inode-has-.patch new file mode 100644 index 00000000000..2160189903f --- /dev/null +++ b/queue-6.1/ext4-don-t-track-ranges-in-fast_commit-if-inode-has-.patch @@ -0,0 +1,49 @@ +From 4cb0be87e6dcc5afdbb8be3c23304ce6b221be22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 15:43:12 +0100 +Subject: ext4: don't track ranges in fast_commit if inode has inlined data + +From: Luis Henriques (SUSE) + +[ Upstream commit 7882b0187bbeb647967a7b5998ce4ad26ef68a9a ] + +When fast-commit needs to track ranges, it has to handle inodes that have +inlined data in a different way because ext4_fc_write_inode_data(), in the +actual commit path, will attempt to map the required blocks for the range. +However, inodes that have inlined data will have it's data stored in +inode->i_block and, eventually, in the extended attribute space. + +Unfortunately, because fast commit doesn't currently support extended +attributes, the solution is to mark this commit as ineligible. + +Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039883 +Signed-off-by: Luis Henriques (SUSE) +Tested-by: Ben Hutchings +Fixes: 9725958bb75c ("ext4: fast commit may miss tracking unwritten range during ftruncate") +Link: https://patch.msgid.link/20240618144312.17786-1-luis.henriques@linux.dev +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/fast_commit.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c +index 1110bfa0a5b73..19353a2f44bb3 100644 +--- a/fs/ext4/fast_commit.c ++++ b/fs/ext4/fast_commit.c +@@ -649,6 +649,12 @@ void ext4_fc_track_range(handle_t *handle, struct inode *inode, ext4_lblk_t star + if (ext4_test_mount_flag(inode->i_sb, EXT4_MF_FC_INELIGIBLE)) + return; + ++ if (ext4_has_inline_data(inode)) { ++ ext4_fc_mark_ineligible(inode->i_sb, EXT4_FC_REASON_XATTR, ++ handle); ++ return; ++ } ++ + args.start = start; + args.end = end; + +-- +2.43.0 + diff --git a/queue-6.1/ext4-fix-infinite-loop-when-replaying-fast_commit.patch b/queue-6.1/ext4-fix-infinite-loop-when-replaying-fast_commit.patch new file mode 100644 index 00000000000..2744621347c --- /dev/null +++ b/queue-6.1/ext4-fix-infinite-loop-when-replaying-fast_commit.patch @@ -0,0 +1,48 @@ +From ad5da244374938e9d42fcacd4e17c18250f3afc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 09:28:57 +0100 +Subject: ext4: fix infinite loop when replaying fast_commit + +From: Luis Henriques (SUSE) + +[ Upstream commit 907c3fe532253a6ef4eb9c4d67efb71fab58c706 ] + +When doing fast_commit replay an infinite loop may occur due to an +uninitialized extent_status struct. ext4_ext_determine_insert_hole() does +not detect the replay and calls ext4_es_find_extent_range(), which will +return immediately without initializing the 'es' variable. + +Because 'es' contains garbage, an integer overflow may happen causing an +infinite loop in this function, easily reproducible using fstest generic/039. + +This commit fixes this issue by unconditionally initializing the structure +in function ext4_es_find_extent_range(). + +Thanks to Zhang Yi, for figuring out the real problem! + +Fixes: 8016e29f4362 ("ext4: fast commit recovery path") +Signed-off-by: Luis Henriques (SUSE) +Reviewed-by: Zhang Yi +Link: https://patch.msgid.link/20240515082857.32730-1-luis.henriques@linux.dev +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents_status.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c +index 470d29fb407a5..9766d3b21ca2e 100644 +--- a/fs/ext4/extents_status.c ++++ b/fs/ext4/extents_status.c +@@ -312,6 +312,8 @@ void ext4_es_find_extent_range(struct inode *inode, + ext4_lblk_t lblk, ext4_lblk_t end, + struct extent_status *es) + { ++ es->es_lblk = es->es_len = es->es_pblk = 0; ++ + if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) + return; + +-- +2.43.0 + diff --git a/queue-6.1/firmware-turris-mox-rwtm-do-not-complete-if-there-ar.patch b/queue-6.1/firmware-turris-mox-rwtm-do-not-complete-if-there-ar.patch new file mode 100644 index 00000000000..9df601db763 --- /dev/null +++ b/queue-6.1/firmware-turris-mox-rwtm-do-not-complete-if-there-ar.patch @@ -0,0 +1,50 @@ +From 1c9507cb098eb97a8a504d2820e3253074862605 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 13:59:10 +0200 +Subject: firmware: turris-mox-rwtm: Do not complete if there are no waiters +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 0bafb172b111ab27251af0eb684e7bde9570ce4c ] + +Do not complete the "command done" completion if there are no waiters. +This can happen if a wait_for_completion() timed out or was interrupted. + +Fixes: 389711b37493 ("firmware: Add Turris Mox rWTM firmware driver") +Signed-off-by: Marek Behún +Reviewed-by: Andy Shevchenko +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/firmware/turris-mox-rwtm.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/turris-mox-rwtm.c b/drivers/firmware/turris-mox-rwtm.c +index c2d34dc8ba462..fa4b904d74df1 100644 +--- a/drivers/firmware/turris-mox-rwtm.c ++++ b/drivers/firmware/turris-mox-rwtm.c +@@ -2,7 +2,7 @@ + /* + * Turris Mox rWTM firmware driver + * +- * Copyright (C) 2019 Marek Behún ++ * Copyright (C) 2019, 2024 Marek Behún + */ + + #include +@@ -174,6 +174,9 @@ static void mox_rwtm_rx_callback(struct mbox_client *cl, void *data) + struct mox_rwtm *rwtm = dev_get_drvdata(cl->dev); + struct armada_37xx_rwtm_rx_msg *msg = data; + ++ if (completion_done(&rwtm->cmd_done)) ++ return; ++ + rwtm->reply = *msg; + complete(&rwtm->cmd_done); + } +-- +2.43.0 + diff --git a/queue-6.1/firmware-turris-mox-rwtm-fix-checking-return-value-o.patch b/queue-6.1/firmware-turris-mox-rwtm-fix-checking-return-value-o.patch new file mode 100644 index 00000000000..e09381471de --- /dev/null +++ b/queue-6.1/firmware-turris-mox-rwtm-fix-checking-return-value-o.patch @@ -0,0 +1,70 @@ +From 7e2edbdc95147f6063caa032593ed3ab468a508f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 13:59:11 +0200 +Subject: firmware: turris-mox-rwtm: Fix checking return value of + wait_for_completion_timeout() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 8467cfe821ac3526f7598682ad5f90689fa8cc49 ] + +The wait_for_completion_timeout() function returns 0 if timed out, and a +positive value if completed. Fix the usage of this function. + +Fixes: 389711b37493 ("firmware: Add Turris Mox rWTM firmware driver") +Fixes: 2eab59cf0d20 ("firmware: turris-mox-rwtm: fail probing when firmware does not support hwrng") +Signed-off-by: Marek Behún +Reviewed-by: Ilpo Järvinen +Reviewed-by: Andy Shevchenko +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/firmware/turris-mox-rwtm.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/firmware/turris-mox-rwtm.c b/drivers/firmware/turris-mox-rwtm.c +index fa4b904d74df1..98bdfadfa1d9e 100644 +--- a/drivers/firmware/turris-mox-rwtm.c ++++ b/drivers/firmware/turris-mox-rwtm.c +@@ -202,9 +202,8 @@ static int mox_get_board_info(struct mox_rwtm *rwtm) + if (ret < 0) + return ret; + +- ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2); +- if (ret < 0) +- return ret; ++ if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2)) ++ return -ETIMEDOUT; + + ret = mox_get_status(MBOX_CMD_BOARD_INFO, reply->retval); + if (ret == -ENODATA) { +@@ -238,9 +237,8 @@ static int mox_get_board_info(struct mox_rwtm *rwtm) + if (ret < 0) + return ret; + +- ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2); +- if (ret < 0) +- return ret; ++ if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2)) ++ return -ETIMEDOUT; + + ret = mox_get_status(MBOX_CMD_ECDSA_PUB_KEY, reply->retval); + if (ret == -ENODATA) { +@@ -277,9 +275,8 @@ static int check_get_random_support(struct mox_rwtm *rwtm) + if (ret < 0) + return ret; + +- ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2); +- if (ret < 0) +- return ret; ++ if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2)) ++ return -ETIMEDOUT; + + return mox_get_status(MBOX_CMD_GET_RANDOM, rwtm->reply.retval); + } +-- +2.43.0 + diff --git a/queue-6.1/firmware-turris-mox-rwtm-initialize-completion-befor.patch b/queue-6.1/firmware-turris-mox-rwtm-initialize-completion-befor.patch new file mode 100644 index 00000000000..15ea4efff4a --- /dev/null +++ b/queue-6.1/firmware-turris-mox-rwtm-initialize-completion-befor.patch @@ -0,0 +1,47 @@ +From 3e3cc7e1814792749a73373cc4f0e36af34f702e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 13:59:12 +0200 +Subject: firmware: turris-mox-rwtm: Initialize completion before mailbox +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 49e24c80d3c81c43e2a56101449e1eea32fcf292 ] + +Initialize the completion before the mailbox channel is requested. + +Fixes: 389711b37493 ("firmware: Add Turris Mox rWTM firmware driver") +Signed-off-by: Marek Behún +Reviewed-by: Andy Shevchenko +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/firmware/turris-mox-rwtm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/firmware/turris-mox-rwtm.c b/drivers/firmware/turris-mox-rwtm.c +index 98bdfadfa1d9e..c3d49fcc53305 100644 +--- a/drivers/firmware/turris-mox-rwtm.c ++++ b/drivers/firmware/turris-mox-rwtm.c +@@ -499,6 +499,7 @@ static int turris_mox_rwtm_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, rwtm); + + mutex_init(&rwtm->busy); ++ init_completion(&rwtm->cmd_done); + + rwtm->mbox_client.dev = dev; + rwtm->mbox_client.rx_callback = mox_rwtm_rx_callback; +@@ -512,8 +513,6 @@ static int turris_mox_rwtm_probe(struct platform_device *pdev) + goto remove_files; + } + +- init_completion(&rwtm->cmd_done); +- + ret = mox_get_board_info(rwtm); + if (ret < 0) + dev_warn(dev, "Cannot read board information: %i\n", ret); +-- +2.43.0 + diff --git a/queue-6.1/fs-ntfs3-add-missing-.dirty_folio-in-address_space_o.patch b/queue-6.1/fs-ntfs3-add-missing-.dirty_folio-in-address_space_o.patch new file mode 100644 index 00000000000..50fb9f6763d --- /dev/null +++ b/queue-6.1/fs-ntfs3-add-missing-.dirty_folio-in-address_space_o.patch @@ -0,0 +1,36 @@ +From 6d57c21e1f0cee2acde77271104e70552fb13b15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 09:58:13 +0300 +Subject: fs/ntfs3: Add missing .dirty_folio in address_space_operations + +From: Konstantin Komarov + +[ Upstream commit 0f9579d9e0331b6255132ac06bdf2c0a01cceb90 ] + +After switching from pages to folio [1], it became evident that +the initialization of .dirty_folio for page cache operations was missed for +compressed files. + +[1] https://lore.kernel.org/ntfs3/20240422193203.3534108-1-willy@infradead.org + +Fixes: 82cae269cfa95 ("fs/ntfs3: Add initialization of super block") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/inode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index 0130b8583bf5a..28cbae3954315 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -1967,5 +1967,6 @@ const struct address_space_operations ntfs_aops = { + const struct address_space_operations ntfs_aops_cmpr = { + .read_folio = ntfs_read_folio, + .readahead = ntfs_readahead, ++ .dirty_folio = block_dirty_folio, + }; + // clang-format on +-- +2.43.0 + diff --git a/queue-6.1/fs-ntfs3-fix-field-spanning-write-in-index_hdr.patch b/queue-6.1/fs-ntfs3-fix-field-spanning-write-in-index_hdr.patch new file mode 100644 index 00000000000..25f60acc83f --- /dev/null +++ b/queue-6.1/fs-ntfs3-fix-field-spanning-write-in-index_hdr.patch @@ -0,0 +1,84 @@ +From ad6e00c95b98f0b6e721fa43f4ac613fdcf6a65c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 15:13:09 +0300 +Subject: fs/ntfs3: Fix field-spanning write in INDEX_HDR + +From: Konstantin Komarov + +[ Upstream commit 2f3e176fee66ac86ae387787bf06457b101d9f7a ] + +Fields flags and res[3] replaced with one 4 byte flags. + +Fixes: 4534a70b7056 ("fs/ntfs3: Add headers and misc files") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 4 ++-- + fs/ntfs3/ntfs.h | 9 +++++---- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 730629235ffa1..9c36e0f3468d7 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -979,7 +979,7 @@ static struct indx_node *indx_new(struct ntfs_index *indx, + hdr->used = + cpu_to_le32(eo + sizeof(struct NTFS_DE) + sizeof(u64)); + de_set_vbn_le(e, *sub_vbn); +- hdr->flags = 1; ++ hdr->flags = NTFS_INDEX_HDR_HAS_SUBNODES; + } else { + e->size = cpu_to_le16(sizeof(struct NTFS_DE)); + hdr->used = cpu_to_le32(eo + sizeof(struct NTFS_DE)); +@@ -1677,7 +1677,7 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, + e->size = cpu_to_le16(sizeof(struct NTFS_DE) + sizeof(u64)); + e->flags = NTFS_IE_HAS_SUBNODES | NTFS_IE_LAST; + +- hdr->flags = 1; ++ hdr->flags = NTFS_INDEX_HDR_HAS_SUBNODES; + hdr->used = hdr->total = + cpu_to_le32(new_root_size - offsetof(struct INDEX_ROOT, ihdr)); + +diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h +index b992ec42a1d92..625f2b52bd586 100644 +--- a/fs/ntfs3/ntfs.h ++++ b/fs/ntfs3/ntfs.h +@@ -686,14 +686,15 @@ static inline bool de_has_vcn_ex(const struct NTFS_DE *e) + offsetof(struct ATTR_FILE_NAME, name) + \ + NTFS_NAME_LEN * sizeof(short), 8) + ++#define NTFS_INDEX_HDR_HAS_SUBNODES cpu_to_le32(1) ++ + struct INDEX_HDR { + __le32 de_off; // 0x00: The offset from the start of this structure + // to the first NTFS_DE. + __le32 used; // 0x04: The size of this structure plus all + // entries (quad-word aligned). + __le32 total; // 0x08: The allocated size of for this structure plus all entries. +- u8 flags; // 0x0C: 0x00 = Small directory, 0x01 = Large directory. +- u8 res[3]; ++ __le32 flags; // 0x0C: 0x00 = Small directory, 0x01 = Large directory. + + // + // de_off + used <= total +@@ -740,7 +741,7 @@ static inline struct NTFS_DE *hdr_next_de(const struct INDEX_HDR *hdr, + + static inline bool hdr_has_subnode(const struct INDEX_HDR *hdr) + { +- return hdr->flags & 1; ++ return hdr->flags & NTFS_INDEX_HDR_HAS_SUBNODES; + } + + struct INDEX_BUFFER { +@@ -760,7 +761,7 @@ static inline bool ib_is_empty(const struct INDEX_BUFFER *ib) + + static inline bool ib_is_leaf(const struct INDEX_BUFFER *ib) + { +- return !(ib->ihdr.flags & 1); ++ return !(ib->ihdr.flags & NTFS_INDEX_HDR_HAS_SUBNODES); + } + + /* Index root structure ( 0x90 ). */ +-- +2.43.0 + diff --git a/queue-6.1/fs-ntfs3-fix-getting-file-type.patch b/queue-6.1/fs-ntfs3-fix-getting-file-type.patch new file mode 100644 index 00000000000..982292aab04 --- /dev/null +++ b/queue-6.1/fs-ntfs3-fix-getting-file-type.patch @@ -0,0 +1,36 @@ +From 12ac1ab436ffa27457d180fea66e783549f0f38c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 10:41:39 +0300 +Subject: fs/ntfs3: Fix getting file type + +From: Konstantin Komarov + +[ Upstream commit 24c5100aceedcd47af89aaa404d4c96cd2837523 ] + +An additional condition causes the mft record to be read from disk +and get the file type dt_type. + +Fixes: 22457c047ed97 ("fs/ntfs3: Modified fix directory element type detection") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/dir.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c +index 98f57d0c702eb..dcd689ed4baae 100644 +--- a/fs/ntfs3/dir.c ++++ b/fs/ntfs3/dir.c +@@ -326,7 +326,8 @@ static inline int ntfs_filldir(struct ntfs_sb_info *sbi, struct ntfs_inode *ni, + * It does additional locks/reads just to get the type of name. + * Should we use additional mount option to enable branch below? + */ +- if ((fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT) && ++ if (((fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT) || ++ fname->dup.ea_size) && + ino != ni->mi.rno) { + struct inode *inode = ntfs_iget5(sbi->sb, &e->ref, NULL); + if (!IS_ERR_OR_NULL(inode)) { +-- +2.43.0 + diff --git a/queue-6.1/fs-ntfs3-fix-transform-resident-to-nonresident-for-c.patch b/queue-6.1/fs-ntfs3-fix-transform-resident-to-nonresident-for-c.patch new file mode 100644 index 00000000000..c93d93a8d29 --- /dev/null +++ b/queue-6.1/fs-ntfs3-fix-transform-resident-to-nonresident-for-c.patch @@ -0,0 +1,56 @@ +From 8b861e8f14d3d37b44fdba82659f8cc244969d7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2024 01:10:01 +0300 +Subject: fs/ntfs3: Fix transform resident to nonresident for compressed files +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Konstantin Komarov + +[ Upstream commit 25610ff98d4a34e6a85cbe4fd8671be6b0829f8f ] + +Сorrected calculation of required space len (in clusters) +for attribute data storage in case of compression. + +Fixes: be71b5cba2e64 ("fs/ntfs3: Add attrib operations") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 180996c213ccf..f39987f080ee1 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -242,7 +242,7 @@ int attr_make_nonresident(struct ntfs_inode *ni, struct ATTRIB *attr, + struct ntfs_sb_info *sbi; + struct ATTRIB *attr_s; + struct MFT_REC *rec; +- u32 used, asize, rsize, aoff, align; ++ u32 used, asize, rsize, aoff; + bool is_data; + CLST len, alen; + char *next; +@@ -263,10 +263,13 @@ int attr_make_nonresident(struct ntfs_inode *ni, struct ATTRIB *attr, + rsize = le32_to_cpu(attr->res.data_size); + is_data = attr->type == ATTR_DATA && !attr->name_len; + +- align = sbi->cluster_size; +- if (is_attr_compressed(attr)) +- align <<= NTFS_LZNT_CUNIT; +- len = (rsize + align - 1) >> sbi->cluster_bits; ++ /* len - how many clusters required to store 'rsize' bytes */ ++ if (is_attr_compressed(attr)) { ++ u8 shift = sbi->cluster_bits + NTFS_LZNT_CUNIT; ++ len = ((rsize + (1u << shift) - 1) >> shift) << NTFS_LZNT_CUNIT; ++ } else { ++ len = bytes_to_cluster(sbi, rsize); ++ } + + run_init(run); + +-- +2.43.0 + diff --git a/queue-6.1/fs-ntfs3-keep-runs-for-mft-attr_data-and-mft-attr_bi.patch b/queue-6.1/fs-ntfs3-keep-runs-for-mft-attr_data-and-mft-attr_bi.patch new file mode 100644 index 00000000000..761977b756b --- /dev/null +++ b/queue-6.1/fs-ntfs3-keep-runs-for-mft-attr_data-and-mft-attr_bi.patch @@ -0,0 +1,36 @@ +From b77dc0eb2467361fa579779ba7aebe54c89c712a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 17:11:37 +0300 +Subject: fs/ntfs3: Keep runs for $MFT::$ATTR_DATA and $MFT::$ATTR_BITMAP + +From: Konstantin Komarov + +[ Upstream commit eb95678ee930d67d79fc83f0a700245ae7230455 ] + +We skip the run_truncate_head call also for $MFT::$ATTR_BITMAP. +Otherwise wnd_map()/run_lookup_entry will not find the disk position for the bitmap parts. + +Fixes: 0e5b044cbf3a ("fs/ntfs3: Refactoring attr_set_size to restore after errors") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 94b26c951752e..0388e6b42100f 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -681,7 +681,8 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type, + goto undo_2; + } + +- if (!is_mft) ++ /* keep runs for $MFT::$ATTR_DATA and $MFT::$ATTR_BITMAP. */ ++ if (ni->mi.rno != MFT_REC_MFT) + run_truncate_head(run, evcn + 1); + + svcn = le64_to_cpu(attr->nres.svcn); +-- +2.43.0 + diff --git a/queue-6.1/fs-ntfs3-merge-synonym-compression_unit-and-ntfs_lzn.patch b/queue-6.1/fs-ntfs3-merge-synonym-compression_unit-and-ntfs_lzn.patch new file mode 100644 index 00000000000..072c29d4a7c --- /dev/null +++ b/queue-6.1/fs-ntfs3-merge-synonym-compression_unit-and-ntfs_lzn.patch @@ -0,0 +1,94 @@ +From 438c23e8f3a29e672f243523ae7ebbbfa55abdde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2024 00:41:02 +0300 +Subject: fs/ntfs3: Merge synonym COMPRESSION_UNIT and NTFS_LZNT_CUNIT + +From: Konstantin Komarov + +[ Upstream commit 487f8d482a7e51a640b8f955a398f906a4f83951 ] + +COMPRESSION_UNIT and NTFS_LZNT_CUNIT mean the same thing +(1u< +Stable-dep-of: 25610ff98d4a ("fs/ntfs3: Fix transform resident to nonresident for compressed files") +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 2 +- + fs/ntfs3/frecord.c | 2 +- + fs/ntfs3/fslog.c | 2 +- + fs/ntfs3/inode.c | 2 +- + fs/ntfs3/ntfs.h | 3 --- + 5 files changed, 4 insertions(+), 7 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 2618bf5a37892..180996c213ccf 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -265,7 +265,7 @@ int attr_make_nonresident(struct ntfs_inode *ni, struct ATTRIB *attr, + + align = sbi->cluster_size; + if (is_attr_compressed(attr)) +- align <<= COMPRESSION_UNIT; ++ align <<= NTFS_LZNT_CUNIT; + len = (rsize + align - 1) >> sbi->cluster_bits; + + run_init(run); +diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c +index d260260900241..02465ab3f398c 100644 +--- a/fs/ntfs3/frecord.c ++++ b/fs/ntfs3/frecord.c +@@ -1501,7 +1501,7 @@ int ni_insert_nonresident(struct ntfs_inode *ni, enum ATTR_TYPE type, + + if (is_ext) { + if (flags & ATTR_FLAG_COMPRESSED) +- attr->nres.c_unit = COMPRESSION_UNIT; ++ attr->nres.c_unit = NTFS_LZNT_CUNIT; + attr->nres.total_size = attr->nres.alloc_size; + } + +diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c +index 6d0d9b1c3b2e7..90ade8965b7e1 100644 +--- a/fs/ntfs3/fslog.c ++++ b/fs/ntfs3/fslog.c +@@ -2999,7 +2999,7 @@ static struct ATTRIB *attr_create_nonres_log(struct ntfs_sb_info *sbi, + if (is_ext) { + attr->name_off = SIZEOF_NONRESIDENT_EX_LE; + if (is_attr_compressed(attr)) +- attr->nres.c_unit = COMPRESSION_UNIT; ++ attr->nres.c_unit = NTFS_LZNT_CUNIT; + + attr->nres.run_off = + cpu_to_le16(SIZEOF_NONRESIDENT_EX + name_size); +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index 2c8c32d9fcaa1..0130b8583bf5a 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -1459,7 +1459,7 @@ struct inode *ntfs_create_inode(struct user_namespace *mnt_userns, + attr->size = cpu_to_le32(SIZEOF_NONRESIDENT_EX + 8); + attr->name_off = SIZEOF_NONRESIDENT_EX_LE; + attr->flags = ATTR_FLAG_COMPRESSED; +- attr->nres.c_unit = COMPRESSION_UNIT; ++ attr->nres.c_unit = NTFS_LZNT_CUNIT; + asize = SIZEOF_NONRESIDENT_EX + 8; + } else { + attr->size = cpu_to_le32(SIZEOF_NONRESIDENT + 8); +diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h +index 1197d1a232962..b992ec42a1d92 100644 +--- a/fs/ntfs3/ntfs.h ++++ b/fs/ntfs3/ntfs.h +@@ -82,9 +82,6 @@ typedef u32 CLST; + #define RESIDENT_LCN ((CLST)-2) + #define COMPRESSED_LCN ((CLST)-3) + +-#define COMPRESSION_UNIT 4 +-#define COMPRESS_MAX_CLUSTER 0x1000 +- + enum RECORD_NUM { + MFT_REC_MFT = 0, + MFT_REC_MIRR = 1, +-- +2.43.0 + diff --git a/queue-6.1/fs-ntfs3-missed-error-return.patch b/queue-6.1/fs-ntfs3-missed-error-return.patch new file mode 100644 index 00000000000..a6430a240cf --- /dev/null +++ b/queue-6.1/fs-ntfs3-missed-error-return.patch @@ -0,0 +1,32 @@ +From 868fcf64d699dc5eb760e0cbd59883d5a5da4e32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 13:43:09 +0300 +Subject: fs/ntfs3: Missed error return + +From: Konstantin Komarov + +[ Upstream commit 2cbbd96820255fff4f0ad1533197370c9ccc570b ] + +Fixes: 3f3b442b5ad2 ("fs/ntfs3: Add bitmap") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/bitmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c +index c055bbdfe0f7c..dfe4930ccec64 100644 +--- a/fs/ntfs3/bitmap.c ++++ b/fs/ntfs3/bitmap.c +@@ -1356,7 +1356,7 @@ int wnd_extend(struct wnd_bitmap *wnd, size_t new_bits) + + err = ntfs_vbo_to_lbo(sbi, &wnd->run, vbo, &lbo, &bytes); + if (err) +- break; ++ return err; + + bh = ntfs_bread(sb, lbo >> sb->s_blocksize_bits); + if (!bh) +-- +2.43.0 + diff --git a/queue-6.1/fs-ntfs3-missed-ni_flag_update_parent-setting.patch b/queue-6.1/fs-ntfs3-missed-ni_flag_update_parent-setting.patch new file mode 100644 index 00000000000..b25ca2bdf34 --- /dev/null +++ b/queue-6.1/fs-ntfs3-missed-ni_flag_update_parent-setting.patch @@ -0,0 +1,31 @@ +From cb8ac90009a4d1353706686c811e0514f0e463b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 20:36:03 +0300 +Subject: fs/ntfs3: Missed NI_FLAG_UPDATE_PARENT setting + +From: Konstantin Komarov + +[ Upstream commit 1c308ace1fd6de93bd0b7e1a5e8963ab27e2c016 ] + +Fixes: be71b5cba2e64 ("fs/ntfs3: Add attrib operations") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index f39987f080ee1..94b26c951752e 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -1640,6 +1640,7 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, + + attr_b->nres.total_size = cpu_to_le64(total_size); + inode_set_bytes(&ni->vfs_inode, total_size); ++ ni->ni_flags |= NI_FLAG_UPDATE_PARENT; + + mi_b->dirty = true; + mark_inode_dirty(&ni->vfs_inode); +-- +2.43.0 + diff --git a/queue-6.1/fs-ntfs3-replace-inode_trylock-with-inode_lock.patch b/queue-6.1/fs-ntfs3-replace-inode_trylock-with-inode_lock.patch new file mode 100644 index 00000000000..231d4ff893f --- /dev/null +++ b/queue-6.1/fs-ntfs3-replace-inode_trylock-with-inode_lock.patch @@ -0,0 +1,37 @@ +From eee2f80b9d7d404fd535acaae38985a0dc5dd611 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 10:54:07 +0300 +Subject: fs/ntfs3: Replace inode_trylock with inode_lock + +From: Konstantin Komarov + +[ Upstream commit 69505fe98f198ee813898cbcaf6770949636430b ] + +The issue was detected due to xfstest 465 failing. + +Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/file.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c +index 14efe46df91ef..6f03de747e375 100644 +--- a/fs/ntfs3/file.c ++++ b/fs/ntfs3/file.c +@@ -396,10 +396,7 @@ static int ntfs_file_mmap(struct file *file, struct vm_area_struct *vma) + } + + if (ni->i_valid < to) { +- if (!inode_trylock(inode)) { +- err = -EAGAIN; +- goto out; +- } ++ inode_lock(inode); + err = ntfs_extend_initialized_size(file, ni, + ni->i_valid, to); + inode_unlock(inode); +-- +2.43.0 + diff --git a/queue-6.1/fs-ntfs3-use-align-kernel-macro.patch b/queue-6.1/fs-ntfs3-use-align-kernel-macro.patch new file mode 100644 index 00000000000..6ffc1dc2e5a --- /dev/null +++ b/queue-6.1/fs-ntfs3-use-align-kernel-macro.patch @@ -0,0 +1,61 @@ +From 98027b7cdbd71bbce59a5c4c917dbed1963a8c36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Oct 2022 20:12:02 +0300 +Subject: fs/ntfs3: Use ALIGN kernel macro + +From: Konstantin Komarov + +[ Upstream commit 97a6815e50619377704e6566fb2b77c1aa4e2647 ] + +This way code will be more readable. + +Signed-off-by: Konstantin Komarov +Stable-dep-of: 25610ff98d4a ("fs/ntfs3: Fix transform resident to nonresident for compressed files") +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fsntfs.c | 2 +- + fs/ntfs3/ntfs.h | 1 - + fs/ntfs3/ntfs_fs.h | 2 ++ + 3 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index 4c2d079b3d49b..97723a839c81a 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -475,7 +475,7 @@ static int ntfs_extend_mft(struct ntfs_sb_info *sbi) + struct ATTRIB *attr; + struct wnd_bitmap *wnd = &sbi->mft.bitmap; + +- new_mft_total = (wnd->nbits + MFT_INCREASE_CHUNK + 127) & (CLST)~127; ++ new_mft_total = ALIGN(wnd->nbits + NTFS_MFT_INCREASE_STEP, 128); + new_mft_bytes = (u64)new_mft_total << sbi->record_bits; + + /* Step 1: Resize $MFT::DATA. */ +diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h +index 324c0b036fdc1..1197d1a232962 100644 +--- a/fs/ntfs3/ntfs.h ++++ b/fs/ntfs3/ntfs.h +@@ -84,7 +84,6 @@ typedef u32 CLST; + + #define COMPRESSION_UNIT 4 + #define COMPRESS_MAX_CLUSTER 0x1000 +-#define MFT_INCREASE_CHUNK 1024 + + enum RECORD_NUM { + MFT_REC_MFT = 0, +diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h +index 0f9bec29f2b70..3e65ccccdb899 100644 +--- a/fs/ntfs3/ntfs_fs.h ++++ b/fs/ntfs3/ntfs_fs.h +@@ -197,6 +197,8 @@ struct ntfs_index { + + /* Minimum MFT zone. */ + #define NTFS_MIN_MFT_ZONE 100 ++/* Step to increase the MFT. */ ++#define NTFS_MFT_INCREASE_STEP 1024 + + /* Ntfs file system in-core superblock data. */ + struct ntfs_sb_info { +-- +2.43.0 + diff --git a/queue-6.1/fs-proc-task_mmu-indicate-pm_file-for-pmd-mapped-fil.patch b/queue-6.1/fs-proc-task_mmu-indicate-pm_file-for-pmd-mapped-fil.patch new file mode 100644 index 00000000000..08b9affbdf0 --- /dev/null +++ b/queue-6.1/fs-proc-task_mmu-indicate-pm_file-for-pmd-mapped-fil.patch @@ -0,0 +1,65 @@ +From 04de4f2b70559d97221b7e1922f1d86a64424294 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 14:23:52 +0200 +Subject: fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP + +From: David Hildenbrand + +[ Upstream commit 3f9f022e975d930709848a86a1c79775b0585202 ] + +Patch series "fs/proc: move page_mapcount() to fs/proc/internal.h". + +With all other page_mapcount() users in the tree gone, move +page_mapcount() to fs/proc/internal.h, rename it and extend the +documentation to prevent future (ab)use. + +... of course, I find some issues while working on that code that I sort +first ;) + +We'll now only end up calling page_mapcount() [now +folio_precise_page_mapcount()] on pages mapped via present page table +entries. Except for /proc/kpagecount, that still does questionable +things, but we'll leave that legacy interface as is for now. + +Did a quick sanity check. Likely we would want some better selfestest for +/proc/$/pagemap + smaps. I'll see if I can find some time to write some +more. + +This patch (of 6): + +Looks like we never taught pagemap_pmd_range() about the existence of +PMD-mapped file THPs. Seems to date back to the times when we first added +support for non-anon THPs in the form of shmem THP. + +Link: https://lkml.kernel.org/r/20240607122357.115423-1-david@redhat.com +Link: https://lkml.kernel.org/r/20240607122357.115423-2-david@redhat.com +Signed-off-by: David Hildenbrand +Fixes: 800d8c63b2e9 ("shmem: add huge pages support") +Acked-by: Kirill A. Shutemov +Reviewed-by: Lance Yang +Reviewed-by: Oscar Salvador +Cc: David Hildenbrand +Cc: Jonathan Corbet +Cc: Alexey Dobriyan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/proc/task_mmu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index a954305fbc31b..484886cdd272c 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -1513,6 +1513,8 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + } + #endif + ++ if (page && !PageAnon(page)) ++ flags |= PM_FILE; + if (page && !migration && page_mapcount(page) == 1) + flags |= PM_MMAP_EXCLUSIVE; + +-- +2.43.0 + diff --git a/queue-6.1/gss_krb5-fix-the-error-handling-path-for-crypto_sync.patch b/queue-6.1/gss_krb5-fix-the-error-handling-path-for-crypto_sync.patch new file mode 100644 index 00000000000..c1186895cae --- /dev/null +++ b/queue-6.1/gss_krb5-fix-the-error-handling-path-for-crypto_sync.patch @@ -0,0 +1,38 @@ +From cdde8597d2bab6d9162f5534b351ec63b6b6da40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jul 2024 14:50:08 +0800 +Subject: gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey + +From: Gaosheng Cui + +[ Upstream commit a3123341dc358952ce2bf8067fbdfb7eaadf71bb ] + +If we fail to call crypto_sync_skcipher_setkey, we should free the +memory allocation for cipher, replace err_return with err_free_cipher +to free the memory of cipher. + +Fixes: 4891f2d008e4 ("gss_krb5: import functionality to derive keys into the kernel") +Signed-off-by: Gaosheng Cui +Reviewed-by: Simon Horman +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + net/sunrpc/auth_gss/gss_krb5_keys.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sunrpc/auth_gss/gss_krb5_keys.c b/net/sunrpc/auth_gss/gss_krb5_keys.c +index 726c076950c04..fc4639687c0fd 100644 +--- a/net/sunrpc/auth_gss/gss_krb5_keys.c ++++ b/net/sunrpc/auth_gss/gss_krb5_keys.c +@@ -161,7 +161,7 @@ u32 krb5_derive_key(const struct gss_krb5_enctype *gk5e, + if (IS_ERR(cipher)) + goto err_return; + if (crypto_sync_skcipher_setkey(cipher, inkey->data, inkey->len)) +- goto err_return; ++ goto err_free_cipher; + + /* allocate and set up buffers */ + +-- +2.43.0 + diff --git a/queue-6.1/hfsplus-fix-to-avoid-false-alarm-of-circular-locking.patch b/queue-6.1/hfsplus-fix-to-avoid-false-alarm-of-circular-locking.patch new file mode 100644 index 00000000000..74b66d94b4b --- /dev/null +++ b/queue-6.1/hfsplus-fix-to-avoid-false-alarm-of-circular-locking.patch @@ -0,0 +1,211 @@ +From ef43f9d4c7ca1a0e470c2394ec099c14f1bf8d77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 22:23:04 +0800 +Subject: hfsplus: fix to avoid false alarm of circular locking +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chao Yu + +[ Upstream commit be4edd1642ee205ed7bbf66edc0453b1be1fb8d7 ] + +Syzbot report potential ABBA deadlock as below: + +loop0: detected capacity change from 0 to 1024 +====================================================== +WARNING: possible circular locking dependency detected +6.9.0-syzkaller-10323-g8f6a15f095a6 #0 Not tainted +------------------------------------------------------ +syz-executor171/5344 is trying to acquire lock: +ffff88807cb980b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595 + +but task is already holding lock: +ffff88807a930108 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x2da/0xb50 fs/hfsplus/extents.c:576 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}: + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __mutex_lock_common kernel/locking/mutex.c:608 [inline] + __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752 + hfsplus_file_extend+0x21b/0x1b70 fs/hfsplus/extents.c:457 + hfsplus_bmap_reserve+0x105/0x4e0 fs/hfsplus/btree.c:358 + hfsplus_rename_cat+0x1d0/0x1050 fs/hfsplus/catalog.c:456 + hfsplus_rename+0x12e/0x1c0 fs/hfsplus/dir.c:552 + vfs_rename+0xbdb/0xf00 fs/namei.c:4887 + do_renameat2+0xd94/0x13f0 fs/namei.c:5044 + __do_sys_rename fs/namei.c:5091 [inline] + __se_sys_rename fs/namei.c:5089 [inline] + __x64_sys_rename+0x86/0xa0 fs/namei.c:5089 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +-> #0 (&tree->tree_lock){+.+.}-{3:3}: + check_prev_add kernel/locking/lockdep.c:3134 [inline] + check_prevs_add kernel/locking/lockdep.c:3253 [inline] + validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 + __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __mutex_lock_common kernel/locking/mutex.c:608 [inline] + __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752 + hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595 + hfsplus_setattr+0x1ce/0x280 fs/hfsplus/inode.c:265 + notify_change+0xb9d/0xe70 fs/attr.c:497 + do_truncate+0x220/0x310 fs/open.c:65 + handle_truncate fs/namei.c:3308 [inline] + do_open fs/namei.c:3654 [inline] + path_openat+0x2a3d/0x3280 fs/namei.c:3807 + do_filp_open+0x235/0x490 fs/namei.c:3834 + do_sys_openat2+0x13e/0x1d0 fs/open.c:1406 + do_sys_open fs/open.c:1421 [inline] + __do_sys_creat fs/open.c:1497 [inline] + __se_sys_creat fs/open.c:1491 [inline] + __x64_sys_creat+0x123/0x170 fs/open.c:1491 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&HFSPLUS_I(inode)->extents_lock); + lock(&tree->tree_lock); + lock(&HFSPLUS_I(inode)->extents_lock); + lock(&tree->tree_lock); + +This is a false alarm as tree_lock mutex are different, one is +from sbi->cat_tree, and another is from sbi->ext_tree: + +Thread A Thread B +- hfsplus_rename + - hfsplus_rename_cat + - hfs_find_init + - mutext_lock(cat_tree->tree_lock) + - hfsplus_setattr + - hfsplus_file_truncate + - mutex_lock(hip->extents_lock) + - hfs_find_init + - mutext_lock(ext_tree->tree_lock) + - hfs_bmap_reserve + - hfsplus_file_extend + - mutex_lock(hip->extents_lock) + +So, let's call mutex_lock_nested for tree_lock mutex lock, and pass +correct lock class for it. + +Fixes: 31651c607151 ("hfsplus: avoid deadlock on file truncation") +Reported-by: syzbot+6030b3b1b9bf70e538c4@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-fsdevel/000000000000e37a4005ef129563@google.com +Cc: Ernesto A. Fernández +Signed-off-by: Chao Yu +Link: https://lore.kernel.org/r/20240607142304.455441-1-chao@kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/hfsplus/bfind.c | 15 ++------------- + fs/hfsplus/extents.c | 9 ++++++--- + fs/hfsplus/hfsplus_fs.h | 21 +++++++++++++++++++++ + 3 files changed, 29 insertions(+), 16 deletions(-) + +diff --git a/fs/hfsplus/bfind.c b/fs/hfsplus/bfind.c +index ca2ba8c9f82ef..901e83d65d202 100644 +--- a/fs/hfsplus/bfind.c ++++ b/fs/hfsplus/bfind.c +@@ -25,19 +25,8 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) + fd->key = ptr + tree->max_key_len + 2; + hfs_dbg(BNODE_REFS, "find_init: %d (%p)\n", + tree->cnid, __builtin_return_address(0)); +- switch (tree->cnid) { +- case HFSPLUS_CAT_CNID: +- mutex_lock_nested(&tree->tree_lock, CATALOG_BTREE_MUTEX); +- break; +- case HFSPLUS_EXT_CNID: +- mutex_lock_nested(&tree->tree_lock, EXTENTS_BTREE_MUTEX); +- break; +- case HFSPLUS_ATTR_CNID: +- mutex_lock_nested(&tree->tree_lock, ATTR_BTREE_MUTEX); +- break; +- default: +- BUG(); +- } ++ mutex_lock_nested(&tree->tree_lock, ++ hfsplus_btree_lock_class(tree)); + return 0; + } + +diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c +index 721f779b4ec3e..91354e769642f 100644 +--- a/fs/hfsplus/extents.c ++++ b/fs/hfsplus/extents.c +@@ -430,7 +430,8 @@ int hfsplus_free_fork(struct super_block *sb, u32 cnid, + hfsplus_free_extents(sb, ext_entry, total_blocks - start, + total_blocks); + total_blocks = start; +- mutex_lock(&fd.tree->tree_lock); ++ mutex_lock_nested(&fd.tree->tree_lock, ++ hfsplus_btree_lock_class(fd.tree)); + } while (total_blocks > blocks); + hfs_find_exit(&fd); + +@@ -592,7 +593,8 @@ void hfsplus_file_truncate(struct inode *inode) + alloc_cnt, alloc_cnt - blk_cnt); + hfsplus_dump_extent(hip->first_extents); + hip->first_blocks = blk_cnt; +- mutex_lock(&fd.tree->tree_lock); ++ mutex_lock_nested(&fd.tree->tree_lock, ++ hfsplus_btree_lock_class(fd.tree)); + break; + } + res = __hfsplus_ext_cache_extent(&fd, inode, alloc_cnt); +@@ -606,7 +608,8 @@ void hfsplus_file_truncate(struct inode *inode) + hfsplus_free_extents(sb, hip->cached_extents, + alloc_cnt - start, alloc_cnt - blk_cnt); + hfsplus_dump_extent(hip->cached_extents); +- mutex_lock(&fd.tree->tree_lock); ++ mutex_lock_nested(&fd.tree->tree_lock, ++ hfsplus_btree_lock_class(fd.tree)); + if (blk_cnt > start) { + hip->extent_state |= HFSPLUS_EXT_DIRTY; + break; +diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h +index 6aa919e594834..7db213cd1eea8 100644 +--- a/fs/hfsplus/hfsplus_fs.h ++++ b/fs/hfsplus/hfsplus_fs.h +@@ -552,6 +552,27 @@ static inline __be32 __hfsp_ut2mt(time64_t ut) + return cpu_to_be32(lower_32_bits(ut) + HFSPLUS_UTC_OFFSET); + } + ++static inline enum hfsplus_btree_mutex_classes ++hfsplus_btree_lock_class(struct hfs_btree *tree) ++{ ++ enum hfsplus_btree_mutex_classes class; ++ ++ switch (tree->cnid) { ++ case HFSPLUS_CAT_CNID: ++ class = CATALOG_BTREE_MUTEX; ++ break; ++ case HFSPLUS_EXT_CNID: ++ class = EXTENTS_BTREE_MUTEX; ++ break; ++ case HFSPLUS_ATTR_CNID: ++ class = ATTR_BTREE_MUTEX; ++ break; ++ default: ++ BUG(); ++ } ++ return class; ++} ++ + /* compatibility */ + #define hfsp_mt2ut(t) (struct timespec64){ .tv_sec = __hfsp_mt2ut(t) } + #define hfsp_ut2mt(t) __hfsp_ut2mt((t).tv_sec) +-- +2.43.0 + diff --git a/queue-6.1/hwmon-adt7475-fix-default-duty-on-fan-is-disabled.patch b/queue-6.1/hwmon-adt7475-fix-default-duty-on-fan-is-disabled.patch new file mode 100644 index 00000000000..0fbd0d89a40 --- /dev/null +++ b/queue-6.1/hwmon-adt7475-fix-default-duty-on-fan-is-disabled.patch @@ -0,0 +1,38 @@ +From 998e329b044747887fd845260a7bd6a0c14cdcae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2024 15:32:52 +0800 +Subject: hwmon: (adt7475) Fix default duty on fan is disabled + +From: Wayne Tung + +[ Upstream commit 39b24cced70fdc336dbc0070f8b3bde61d8513a8 ] + +According to the comments on fan is disabled, we change to manual mode +and set the duty cycle to 0. +For setting the duty cycle part, the register is wrong. Fix it. + +Fixes: 1c301fc5394f ("hwmon: Add a driver for the ADT7475 hardware monitoring chip") +Signed-off-by: Wayne Tung +Link: https://lore.kernel.org/r/20240701073252.317397-1-chineweff@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/adt7475.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c +index 6a6ebcc896b1d..3ac6744276750 100644 +--- a/drivers/hwmon/adt7475.c ++++ b/drivers/hwmon/adt7475.c +@@ -1863,7 +1863,7 @@ static void adt7475_read_pwm(struct i2c_client *client, int index) + data->pwm[CONTROL][index] &= ~0xE0; + data->pwm[CONTROL][index] |= (7 << 5); + +- i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index), ++ i2c_smbus_write_byte_data(client, PWM_REG(index), + data->pwm[INPUT][index]); + + i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index), +-- +2.43.0 + diff --git a/queue-6.1/hwmon-max6697-fix-swapped-temp-1-8-critical-alarms.patch b/queue-6.1/hwmon-max6697-fix-swapped-temp-1-8-critical-alarms.patch new file mode 100644 index 00000000000..ccc52d47554 --- /dev/null +++ b/queue-6.1/hwmon-max6697-fix-swapped-temp-1-8-critical-alarms.patch @@ -0,0 +1,48 @@ +From e7abd446847e23597a24da5089562b52f904292f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jul 2024 12:03:53 -0700 +Subject: hwmon: (max6697) Fix swapped temp{1,8} critical alarms + +From: Guenter Roeck + +[ Upstream commit 1ea3fd1eb9869fcdcbc9c68f9728bfc47b9503f1 ] + +The critical alarm bit for the local temperature sensor (temp1) is in +bit 7 of register 0x45 (not bit 6), and the critical alarm bit for remote +temperature sensor 7 (temp8) is in bit 6 (not bit 7). + +This only affects MAX6581 since all other chips supported by this driver +do not support those critical alarms. + +Fixes: 5372d2d71c46 ("hwmon: Driver for Maxim MAX6697 and compatibles") +Reviewed-by: Tzung-Bi Shih +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/max6697.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c +index 563e73f071d07..266baae94e3ee 100644 +--- a/drivers/hwmon/max6697.c ++++ b/drivers/hwmon/max6697.c +@@ -430,14 +430,14 @@ static SENSOR_DEVICE_ATTR_RO(temp6_max_alarm, alarm, 20); + static SENSOR_DEVICE_ATTR_RO(temp7_max_alarm, alarm, 21); + static SENSOR_DEVICE_ATTR_RO(temp8_max_alarm, alarm, 23); + +-static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 14); ++static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 15); + static SENSOR_DEVICE_ATTR_RO(temp2_crit_alarm, alarm, 8); + static SENSOR_DEVICE_ATTR_RO(temp3_crit_alarm, alarm, 9); + static SENSOR_DEVICE_ATTR_RO(temp4_crit_alarm, alarm, 10); + static SENSOR_DEVICE_ATTR_RO(temp5_crit_alarm, alarm, 11); + static SENSOR_DEVICE_ATTR_RO(temp6_crit_alarm, alarm, 12); + static SENSOR_DEVICE_ATTR_RO(temp7_crit_alarm, alarm, 13); +-static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 15); ++static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 14); + + static SENSOR_DEVICE_ATTR_RO(temp2_fault, alarm, 1); + static SENSOR_DEVICE_ATTR_RO(temp3_fault, alarm, 2); +-- +2.43.0 + diff --git a/queue-6.1/hwmon-max6697-fix-underflow-when-writing-limit-attri.patch b/queue-6.1/hwmon-max6697-fix-underflow-when-writing-limit-attri.patch new file mode 100644 index 00000000000..7e7650a4680 --- /dev/null +++ b/queue-6.1/hwmon-max6697-fix-underflow-when-writing-limit-attri.patch @@ -0,0 +1,40 @@ +From b3b1554c3d19eb6f2fe04da4ef2c7f39a37bdc0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jul 2024 14:26:19 -0700 +Subject: hwmon: (max6697) Fix underflow when writing limit attributes + +From: Guenter Roeck + +[ Upstream commit cbf7467828cd4ec7ceac7a8b5b5ddb2f69f07b0e ] + +Using DIV_ROUND_CLOSEST() on an unbound value can result in underflows. +Indeed, module test scripts report: + +temp1_max: Suspected underflow: [min=0, read 255000, written -9223372036854775808] +temp1_crit: Suspected underflow: [min=0, read 255000, written -9223372036854775808] + +Fix by introducing an extra set of clamping. + +Fixes: 5372d2d71c46 ("hwmon: Driver for Maxim MAX6697 and compatibles") +Reviewed-by: Tzung-Bi Shih +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/max6697.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c +index 2895cea541934..563e73f071d07 100644 +--- a/drivers/hwmon/max6697.c ++++ b/drivers/hwmon/max6697.c +@@ -312,6 +312,7 @@ static ssize_t temp_store(struct device *dev, + return ret; + + mutex_lock(&data->update_lock); ++ temp = clamp_val(temp, -1000000, 1000000); /* prevent underflow */ + temp = DIV_ROUND_CLOSEST(temp, 1000) + data->temp_offset; + temp = clamp_val(temp, 0, data->type == max6581 ? 255 : 127); + data->temp[nr][index] = temp; +-- +2.43.0 + diff --git a/queue-6.1/iio-frequency-adrf6780-rm-clk-provider-include.patch b/queue-6.1/iio-frequency-adrf6780-rm-clk-provider-include.patch new file mode 100644 index 00000000000..50c6cdd55b5 --- /dev/null +++ b/queue-6.1/iio-frequency-adrf6780-rm-clk-provider-include.patch @@ -0,0 +1,36 @@ +From aef19453bf56c0b1fe9d49a7be7b94a7ec089285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 12:28:34 +0300 +Subject: iio: frequency: adrf6780: rm clk provider include + +From: Antoniu Miclaus + +[ Upstream commit e2261b4a4de2804698935eb44f98dc897e1c44c3 ] + +The driver has no clock provider implementation, therefore remove the +include. + +Fixes: 63aaf6d06d87 ("iio: frequency: adrf6780: add support for ADRF6780") +Signed-off-by: Antoniu Miclaus +Link: https://lore.kernel.org/r/20240530092835.36892-1-antoniu.miclaus@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/frequency/adrf6780.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/iio/frequency/adrf6780.c b/drivers/iio/frequency/adrf6780.c +index b4defb82f37e3..3f46032c92752 100644 +--- a/drivers/iio/frequency/adrf6780.c ++++ b/drivers/iio/frequency/adrf6780.c +@@ -9,7 +9,6 @@ + #include + #include + #include +-#include + #include + #include + #include +-- +2.43.0 + diff --git a/queue-6.1/input-elan_i2c-do-not-leave-interrupt-disabled-on-su.patch b/queue-6.1/input-elan_i2c-do-not-leave-interrupt-disabled-on-su.patch new file mode 100644 index 00000000000..4ba41b54139 --- /dev/null +++ b/queue-6.1/input-elan_i2c-do-not-leave-interrupt-disabled-on-su.patch @@ -0,0 +1,36 @@ +From e47bd6cb2f26e08eb63e5cc57da25f007c18229d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 23:02:48 -0700 +Subject: Input: elan_i2c - do not leave interrupt disabled on suspend failure + +From: Dmitry Torokhov + +[ Upstream commit 5f82c1e04721e7cd98e604eb4e58f0724d8e5a65 ] + +Make sure interrupts are not left disabled when we fail to suspend the +touch controller. + +Fixes: 6696777c6506 ("Input: add driver for Elan I2C/SMbus touchpad") +Link: https://lore.kernel.org/r/ZmKiiL-1wzKrhqBj@google.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/elan_i2c_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index d4eb59b55bf1f..5fa0d6ef627bc 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -1372,6 +1372,8 @@ static int __maybe_unused elan_suspend(struct device *dev) + } + + err: ++ if (ret) ++ enable_irq(client->irq); + mutex_unlock(&data->sysfs_mutex); + return ret; + } +-- +2.43.0 + diff --git a/queue-6.1/input-qt1050-handle-chip_id-reading-error.patch b/queue-6.1/input-qt1050-handle-chip_id-reading-error.patch new file mode 100644 index 00000000000..07c7f7e7878 --- /dev/null +++ b/queue-6.1/input-qt1050-handle-chip_id-reading-error.patch @@ -0,0 +1,49 @@ +From 955bc399e005d23b40181bd7815c2bb74cdf2611 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 20:30:18 +0200 +Subject: Input: qt1050 - handle CHIP_ID reading error + +From: Andrei Lalaev + +[ Upstream commit 866a5c7e2781cf1b019072288f1f5c64186dcb63 ] + +If the device is missing, we get the following error: + + qt1050 3-0041: ID -1340767592 not supported + +Let's handle this situation and print more informative error +when reading of CHIP_ID fails: + + qt1050 3-0041: Failed to read chip ID: -6 + +Fixes: cbebf5addec1 ("Input: qt1050 - add Microchip AT42QT1050 support") +Signed-off-by: Andrei Lalaev +Reviewed-by: Marco Felsch +Link: https://lore.kernel.org/r/20240617183018.916234-1-andrey.lalaev@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/qt1050.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/keyboard/qt1050.c b/drivers/input/keyboard/qt1050.c +index 403060d05c3b3..7193a4198e214 100644 +--- a/drivers/input/keyboard/qt1050.c ++++ b/drivers/input/keyboard/qt1050.c +@@ -226,7 +226,12 @@ static bool qt1050_identify(struct qt1050_priv *ts) + int err; + + /* Read Chip ID */ +- regmap_read(ts->regmap, QT1050_CHIP_ID, &val); ++ err = regmap_read(ts->regmap, QT1050_CHIP_ID, &val); ++ if (err) { ++ dev_err(&ts->client->dev, "Failed to read chip ID: %d\n", err); ++ return false; ++ } ++ + if (val != QT1050_CHIP_ID_VER) { + dev_err(&ts->client->dev, "ID %d not supported\n", val); + return false; +-- +2.43.0 + diff --git a/queue-6.1/interconnect-qcom-qcm2290-fix-mas_snoc_bimc-rpm-mast.patch b/queue-6.1/interconnect-qcom-qcm2290-fix-mas_snoc_bimc-rpm-mast.patch new file mode 100644 index 00000000000..092acfb19ed --- /dev/null +++ b/queue-6.1/interconnect-qcom-qcm2290-fix-mas_snoc_bimc-rpm-mast.patch @@ -0,0 +1,39 @@ +From 518e60832bba345d8e9f972841ca65cab82a3bf0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 16:42:18 +0200 +Subject: interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID + +From: Konrad Dybcio + +[ Upstream commit cd5ce4589081190281cc2537301edd4275fe55eb ] + +The value was wrong, resulting in misprogramming of the hardware. +Fix it. + +Fixes: 1a14b1ac3935 ("interconnect: qcom: Add QCM2290 driver support") +Reported-by: Stephan Gerhold +Closes: https://lore.kernel.org/linux-arm-msm/ZgMs_xZVzWH5uK-v@gerhold.net/ +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240618-topic-2290_icc_2-v1-1-64446888a133@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/qcm2290.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/interconnect/qcom/qcm2290.c b/drivers/interconnect/qcom/qcm2290.c +index ca7ad37ea6777..d75bb918e1bb7 100644 +--- a/drivers/interconnect/qcom/qcm2290.c ++++ b/drivers/interconnect/qcom/qcm2290.c +@@ -166,7 +166,7 @@ static struct qcom_icc_node mas_snoc_bimc = { + .qos.ap_owned = true, + .qos.qos_port = 6, + .qos.qos_mode = NOC_QOS_MODE_BYPASS, +- .mas_rpm_id = 164, ++ .mas_rpm_id = 3, + .slv_rpm_id = -1, + .num_links = ARRAY_SIZE(mas_snoc_bimc_links), + .links = mas_snoc_bimc_links, +-- +2.43.0 + diff --git a/queue-6.1/iommu-vt-d-fix-identity-map-bounds-in-si_domain_init.patch b/queue-6.1/iommu-vt-d-fix-identity-map-bounds-in-si_domain_init.patch new file mode 100644 index 00000000000..b8670ecf0be --- /dev/null +++ b/queue-6.1/iommu-vt-d-fix-identity-map-bounds-in-si_domain_init.patch @@ -0,0 +1,43 @@ +From 7791aef05dbfe44ed4e6997fbb8df563281de155 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jul 2024 16:49:13 -0700 +Subject: iommu/vt-d: Fix identity map bounds in si_domain_init() + +From: Jon Pan-Doh + +[ Upstream commit 31000732d56b43765d51e08cccb68818fbc0032c ] + +Intel IOMMU operates on inclusive bounds (both generally aas well as +iommu_domain_identity_map()). Meanwhile, for_each_mem_pfn_range() uses +exclusive bounds for end_pfn. This creates an off-by-one error when +switching between the two. + +Fixes: c5395d5c4a82 ("intel-iommu: Clean up iommu_domain_identity_map()") +Signed-off-by: Jon Pan-Doh +Tested-by: Sudheer Dantuluri +Suggested-by: Gary Zibrat +Reviewed-by: Lu Baolu +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20240709234913.2749386-1-pandoh@google.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index e3a95a347c3b9..7b9502c30fe94 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -2444,7 +2444,7 @@ static int __init si_domain_init(int hw) + for_each_mem_pfn_range(i, nid, &start_pfn, &end_pfn, NULL) { + ret = iommu_domain_identity_map(si_domain, + mm_to_dma_pfn_start(start_pfn), +- mm_to_dma_pfn_end(end_pfn)); ++ mm_to_dma_pfn_end(end_pfn-1)); + if (ret) + return ret; + } +-- +2.43.0 + diff --git a/queue-6.1/iommu-vt-d-fix-to-convert-mm-pfn-to-dma-pfn.patch b/queue-6.1/iommu-vt-d-fix-to-convert-mm-pfn-to-dma-pfn.patch new file mode 100644 index 00000000000..604ec23d672 --- /dev/null +++ b/queue-6.1/iommu-vt-d-fix-to-convert-mm-pfn-to-dma-pfn.patch @@ -0,0 +1,97 @@ +From 795d972906f1bde1b6c42d30b3a796f93f94f206 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 20:48:05 +0800 +Subject: iommu/vt-d: Fix to convert mm pfn to dma pfn + +From: Yanfei Xu + +[ Upstream commit fb5f50a43d9fd44fd6bc4f4dbcf9d3ec5b556558 ] + +For the case that VT-d page is smaller than mm page, converting dma pfn +should be handled in two cases which are for start pfn and for end pfn. +Currently the calculation of end dma pfn is incorrect and the result is +less than real page frame number which is causing the mapping of iova +always misses some page frames. + +Rename the mm_to_dma_pfn() to mm_to_dma_pfn_start() and add a new helper +for converting end dma pfn named mm_to_dma_pfn_end(). + +Signed-off-by: Yanfei Xu +Link: https://lore.kernel.org/r/20230625082046.979742-1-yanfei.xu@intel.com +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Stable-dep-of: 31000732d56b ("iommu/vt-d: Fix identity map bounds in si_domain_init()") +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index e111b35a7aff2..e3a95a347c3b9 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -113,13 +113,17 @@ static inline unsigned long lvl_to_nr_pages(unsigned int lvl) + + /* VT-d pages must always be _smaller_ than MM pages. Otherwise things + are never going to work. */ +-static inline unsigned long mm_to_dma_pfn(unsigned long mm_pfn) ++static inline unsigned long mm_to_dma_pfn_start(unsigned long mm_pfn) + { + return mm_pfn << (PAGE_SHIFT - VTD_PAGE_SHIFT); + } ++static inline unsigned long mm_to_dma_pfn_end(unsigned long mm_pfn) ++{ ++ return ((mm_pfn + 1) << (PAGE_SHIFT - VTD_PAGE_SHIFT)) - 1; ++} + static inline unsigned long page_to_dma_pfn(struct page *pg) + { +- return mm_to_dma_pfn(page_to_pfn(pg)); ++ return mm_to_dma_pfn_start(page_to_pfn(pg)); + } + static inline unsigned long virt_to_dma_pfn(void *p) + { +@@ -2439,8 +2443,8 @@ static int __init si_domain_init(int hw) + + for_each_mem_pfn_range(i, nid, &start_pfn, &end_pfn, NULL) { + ret = iommu_domain_identity_map(si_domain, +- mm_to_dma_pfn(start_pfn), +- mm_to_dma_pfn(end_pfn)); ++ mm_to_dma_pfn_start(start_pfn), ++ mm_to_dma_pfn_end(end_pfn)); + if (ret) + return ret; + } +@@ -2461,8 +2465,8 @@ static int __init si_domain_init(int hw) + continue; + + ret = iommu_domain_identity_map(si_domain, +- mm_to_dma_pfn(start >> PAGE_SHIFT), +- mm_to_dma_pfn(end >> PAGE_SHIFT)); ++ mm_to_dma_pfn_start(start >> PAGE_SHIFT), ++ mm_to_dma_pfn_end(end >> PAGE_SHIFT)); + if (ret) + return ret; + } +@@ -3698,8 +3702,8 @@ static int intel_iommu_memory_notifier(struct notifier_block *nb, + unsigned long val, void *v) + { + struct memory_notify *mhp = v; +- unsigned long start_vpfn = mm_to_dma_pfn(mhp->start_pfn); +- unsigned long last_vpfn = mm_to_dma_pfn(mhp->start_pfn + ++ unsigned long start_vpfn = mm_to_dma_pfn_start(mhp->start_pfn); ++ unsigned long last_vpfn = mm_to_dma_pfn_end(mhp->start_pfn + + mhp->nr_pages - 1); + + switch (val) { +@@ -4401,7 +4405,7 @@ static void intel_iommu_tlb_sync(struct iommu_domain *domain, + unsigned long i; + + nrpages = aligned_nrpages(gather->start, size); +- start_pfn = mm_to_dma_pfn(iova_pfn); ++ start_pfn = mm_to_dma_pfn_start(iova_pfn); + + xa_for_each(&dmar_domain->iommu_array, i, info) + iommu_flush_iotlb_psi(info->iommu, dmar_domain, +-- +2.43.0 + diff --git a/queue-6.1/ipv4-fix-incorrect-tos-in-fibmatch-route-get-reply.patch b/queue-6.1/ipv4-fix-incorrect-tos-in-fibmatch-route-get-reply.patch new file mode 100644 index 00000000000..9289be9b8b4 --- /dev/null +++ b/queue-6.1/ipv4-fix-incorrect-tos-in-fibmatch-route-get-reply.patch @@ -0,0 +1,135 @@ +From 5f8e504ce46cdc824ada363e8aea01ebdd080432 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 17:23:54 +0300 +Subject: ipv4: Fix incorrect TOS in fibmatch route get reply + +From: Ido Schimmel + +[ Upstream commit f036e68212c11e5a7edbb59b5e25299341829485 ] + +The TOS value that is returned to user space in the route get reply is +the one with which the lookup was performed ('fl4->flowi4_tos'). This is +fine when the matched route is configured with a TOS as it would not +match if its TOS value did not match the one with which the lookup was +performed. + +However, matching on TOS is only performed when the route's TOS is not +zero. It is therefore possible to have the kernel incorrectly return a +non-zero TOS: + + # ip link add name dummy1 up type dummy + # ip address add 192.0.2.1/24 dev dummy1 + # ip route get fibmatch 192.0.2.2 tos 0xfc + 192.0.2.0/24 tos 0x1c dev dummy1 proto kernel scope link src 192.0.2.1 + +Fix by instead returning the DSCP field from the FIB result structure +which was populated during the route lookup. + +Output after the patch: + + # ip link add name dummy1 up type dummy + # ip address add 192.0.2.1/24 dev dummy1 + # ip route get fibmatch 192.0.2.2 tos 0xfc + 192.0.2.0/24 dev dummy1 proto kernel scope link src 192.0.2.1 + +Extend the existing selftests to not only verify that the correct route +is returned, but that it is also returned with correct "tos" value (or +without it). + +Fixes: b61798130f1b ("net: ipv4: RTM_GETROUTE: return matched fib result when requested") +Signed-off-by: Ido Schimmel +Reviewed-by: David Ahern +Reviewed-by: Guillaume Nault +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/route.c | 2 +- + tools/testing/selftests/net/fib_tests.sh | 24 ++++++++++++------------ + 2 files changed, 13 insertions(+), 13 deletions(-) + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 01b98590591db..da193840fc007 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -3398,7 +3398,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, + fri.tb_id = table_id; + fri.dst = res.prefix; + fri.dst_len = res.prefixlen; +- fri.dscp = inet_dsfield_to_dscp(fl4.flowi4_tos); ++ fri.dscp = res.dscp; + fri.type = rt->rt_type; + fri.offload = 0; + fri.trap = 0; +diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh +index e5db2a2a67df9..26f30c6fa0f29 100755 +--- a/tools/testing/selftests/net/fib_tests.sh ++++ b/tools/testing/selftests/net/fib_tests.sh +@@ -1485,53 +1485,53 @@ ipv4_rt_dsfield() + + # DSCP 0x10 should match the specific route, no matter the ECN bits + $IP route get fibmatch 172.16.102.1 dsfield 0x10 | \ +- grep -q "via 172.16.103.2" ++ grep -q "172.16.102.0/24 tos 0x10 via 172.16.103.2" + log_test $? 0 "IPv4 route with DSCP and ECN:Not-ECT" + + $IP route get fibmatch 172.16.102.1 dsfield 0x11 | \ +- grep -q "via 172.16.103.2" ++ grep -q "172.16.102.0/24 tos 0x10 via 172.16.103.2" + log_test $? 0 "IPv4 route with DSCP and ECN:ECT(1)" + + $IP route get fibmatch 172.16.102.1 dsfield 0x12 | \ +- grep -q "via 172.16.103.2" ++ grep -q "172.16.102.0/24 tos 0x10 via 172.16.103.2" + log_test $? 0 "IPv4 route with DSCP and ECN:ECT(0)" + + $IP route get fibmatch 172.16.102.1 dsfield 0x13 | \ +- grep -q "via 172.16.103.2" ++ grep -q "172.16.102.0/24 tos 0x10 via 172.16.103.2" + log_test $? 0 "IPv4 route with DSCP and ECN:CE" + + # Unknown DSCP should match the generic route, no matter the ECN bits + $IP route get fibmatch 172.16.102.1 dsfield 0x14 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with unknown DSCP and ECN:Not-ECT" + + $IP route get fibmatch 172.16.102.1 dsfield 0x15 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with unknown DSCP and ECN:ECT(1)" + + $IP route get fibmatch 172.16.102.1 dsfield 0x16 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with unknown DSCP and ECN:ECT(0)" + + $IP route get fibmatch 172.16.102.1 dsfield 0x17 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with unknown DSCP and ECN:CE" + + # Null DSCP should match the generic route, no matter the ECN bits + $IP route get fibmatch 172.16.102.1 dsfield 0x00 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with no DSCP and ECN:Not-ECT" + + $IP route get fibmatch 172.16.102.1 dsfield 0x01 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with no DSCP and ECN:ECT(1)" + + $IP route get fibmatch 172.16.102.1 dsfield 0x02 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with no DSCP and ECN:ECT(0)" + + $IP route get fibmatch 172.16.102.1 dsfield 0x03 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with no DSCP and ECN:CE" + } + +-- +2.43.0 + diff --git a/queue-6.1/ipv4-fix-incorrect-tos-in-route-get-reply.patch b/queue-6.1/ipv4-fix-incorrect-tos-in-route-get-reply.patch new file mode 100644 index 00000000000..a3af9c0dff4 --- /dev/null +++ b/queue-6.1/ipv4-fix-incorrect-tos-in-route-get-reply.patch @@ -0,0 +1,122 @@ +From 1a0c0a08c3c3245eb434f2f6bf0e18c22b24bf38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 17:23:53 +0300 +Subject: ipv4: Fix incorrect TOS in route get reply + +From: Ido Schimmel + +[ Upstream commit 338bb57e4c2a1c2c6fc92f9c0bd35be7587adca7 ] + +The TOS value that is returned to user space in the route get reply is +the one with which the lookup was performed ('fl4->flowi4_tos'). This is +fine when the matched route is configured with a TOS as it would not +match if its TOS value did not match the one with which the lookup was +performed. + +However, matching on TOS is only performed when the route's TOS is not +zero. It is therefore possible to have the kernel incorrectly return a +non-zero TOS: + + # ip link add name dummy1 up type dummy + # ip address add 192.0.2.1/24 dev dummy1 + # ip route get 192.0.2.2 tos 0xfc + 192.0.2.2 tos 0x1c dev dummy1 src 192.0.2.1 uid 0 + cache + +Fix by adding a DSCP field to the FIB result structure (inside an +existing 4 bytes hole), populating it in the route lookup and using it +when filling the route get reply. + +Output after the patch: + + # ip link add name dummy1 up type dummy + # ip address add 192.0.2.1/24 dev dummy1 + # ip route get 192.0.2.2 tos 0xfc + 192.0.2.2 dev dummy1 src 192.0.2.1 uid 0 + cache + +Fixes: 1a00fee4ffb2 ("ipv4: Remove rt_key_{src,dst,tos} from struct rtable.") +Signed-off-by: Ido Schimmel +Reviewed-by: David Ahern +Reviewed-by: Guillaume Nault +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + include/net/ip_fib.h | 1 + + net/ipv4/fib_trie.c | 1 + + net/ipv4/route.c | 14 +++++++------- + 3 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h +index 15de07d365405..ca1700c2a5733 100644 +--- a/include/net/ip_fib.h ++++ b/include/net/ip_fib.h +@@ -173,6 +173,7 @@ struct fib_result { + unsigned char type; + unsigned char scope; + u32 tclassid; ++ dscp_t dscp; + struct fib_nh_common *nhc; + struct fib_info *fi; + struct fib_table *table; +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index 9bdfdab906fe0..77b97c48da5ea 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -1628,6 +1628,7 @@ int fib_table_lookup(struct fib_table *tb, const struct flowi4 *flp, + res->nhc = nhc; + res->type = fa->fa_type; + res->scope = fi->fib_scope; ++ res->dscp = fa->fa_dscp; + res->fi = fi; + res->table = tb; + res->fa_head = &n->leaf; +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index fcbacd39febe0..01b98590591db 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -2934,9 +2934,9 @@ EXPORT_SYMBOL_GPL(ip_route_output_tunnel); + + /* called with rcu_read_lock held */ + static int rt_fill_info(struct net *net, __be32 dst, __be32 src, +- struct rtable *rt, u32 table_id, struct flowi4 *fl4, +- struct sk_buff *skb, u32 portid, u32 seq, +- unsigned int flags) ++ struct rtable *rt, u32 table_id, dscp_t dscp, ++ struct flowi4 *fl4, struct sk_buff *skb, u32 portid, ++ u32 seq, unsigned int flags) + { + struct rtmsg *r; + struct nlmsghdr *nlh; +@@ -2952,7 +2952,7 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src, + r->rtm_family = AF_INET; + r->rtm_dst_len = 32; + r->rtm_src_len = 0; +- r->rtm_tos = fl4 ? fl4->flowi4_tos : 0; ++ r->rtm_tos = inet_dscp_to_dsfield(dscp); + r->rtm_table = table_id < 256 ? table_id : RT_TABLE_COMPAT; + if (nla_put_u32(skb, RTA_TABLE, table_id)) + goto nla_put_failure; +@@ -3102,7 +3102,7 @@ static int fnhe_dump_bucket(struct net *net, struct sk_buff *skb, + goto next; + + err = rt_fill_info(net, fnhe->fnhe_daddr, 0, rt, +- table_id, NULL, skb, ++ table_id, 0, NULL, skb, + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, flags); + if (err) +@@ -3425,8 +3425,8 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, + err = fib_dump_info(skb, NETLINK_CB(in_skb).portid, + nlh->nlmsg_seq, RTM_NEWROUTE, &fri, 0); + } else { +- err = rt_fill_info(net, dst, src, rt, table_id, &fl4, skb, +- NETLINK_CB(in_skb).portid, ++ err = rt_fill_info(net, dst, src, rt, table_id, res.dscp, &fl4, ++ skb, NETLINK_CB(in_skb).portid, + nlh->nlmsg_seq, 0); + } + if (err < 0) +-- +2.43.0 + diff --git a/queue-6.1/ipvs-avoid-unnecessary-calls-to-skb_is_gso_sctp.patch b/queue-6.1/ipvs-avoid-unnecessary-calls-to-skb_is_gso_sctp.patch new file mode 100644 index 00000000000..e3d3fea6d41 --- /dev/null +++ b/queue-6.1/ipvs-avoid-unnecessary-calls-to-skb_is_gso_sctp.patch @@ -0,0 +1,47 @@ +From 309e616885da4c5dbd021ee245f849bc22227d77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 18:54:44 +0200 +Subject: ipvs: Avoid unnecessary calls to skb_is_gso_sctp + +From: Ismael Luceno + +[ Upstream commit 53796b03295cf7ab1fc8600016fa6dfbf4a494a0 ] + +In the context of the SCTP SNAT/DNAT handler, these calls can only +return true. + +Fixes: e10d3ba4d434 ("ipvs: Fix checksumming on GSO of SCTP packets") +Signed-off-by: Ismael Luceno +Acked-by: Julian Anastasov +Acked-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c +index 1e689c7141271..83e452916403d 100644 +--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c ++++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c +@@ -126,7 +126,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, + if (sctph->source != cp->vport || payload_csum || + skb->ip_summed == CHECKSUM_PARTIAL) { + sctph->source = cp->vport; +- if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) ++ if (!skb_is_gso(skb)) + sctp_nat_csum(skb, sctph, sctphoff); + } else { + skb->ip_summed = CHECKSUM_UNNECESSARY; +@@ -175,7 +175,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, + (skb->ip_summed == CHECKSUM_PARTIAL && + !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) { + sctph->dest = cp->dport; +- if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) ++ if (!skb_is_gso(skb)) + sctp_nat_csum(skb, sctph, sctphoff); + } else if (skb->ip_summed != CHECKSUM_PARTIAL) { + skb->ip_summed = CHECKSUM_UNNECESSARY; +-- +2.43.0 + diff --git a/queue-6.1/jump_label-fix-concurrency-issues-in-static_key_slow.patch b/queue-6.1/jump_label-fix-concurrency-issues-in-static_key_slow.patch new file mode 100644 index 00000000000..3812c73f52d --- /dev/null +++ b/queue-6.1/jump_label-fix-concurrency-issues-in-static_key_slow.patch @@ -0,0 +1,143 @@ +From b1b6e53096c0e9be3b8407be5fd02a432efec062 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jun 2024 14:46:36 +0200 +Subject: jump_label: Fix concurrency issues in static_key_slow_dec() + +From: Thomas Gleixner + +[ Upstream commit 83ab38ef0a0b2407d43af9575bb32333fdd74fb2 ] + +The commit which tried to fix the concurrency issues of concurrent +static_key_slow_inc() failed to fix the equivalent issues +vs. static_key_slow_dec(): + +CPU0 CPU1 + +static_key_slow_dec() + static_key_slow_try_dec() + + key->enabled == 1 + val = atomic_fetch_add_unless(&key->enabled, -1, 1); + if (val == 1) + return false; + + jump_label_lock(); + if (atomic_dec_and_test(&key->enabled)) { + --> key->enabled == 0 + __jump_label_update() + + static_key_slow_dec() + static_key_slow_try_dec() + + key->enabled == 0 + val = atomic_fetch_add_unless(&key->enabled, -1, 1); + + --> key->enabled == -1 <- FAIL + +There is another bug in that code, when there is a concurrent +static_key_slow_inc() which enables the key as that sets key->enabled to -1 +so on the other CPU + + val = atomic_fetch_add_unless(&key->enabled, -1, 1); + +will succeed and decrement to -2, which is invalid. + +Cure all of this by replacing the atomic_fetch_add_unless() with a +atomic_try_cmpxchg() loop similar to static_key_fast_inc_not_disabled(). + +[peterz: add WARN_ON_ONCE for the -1 race] +Fixes: 4c5ea0a9cd02 ("locking/static_key: Fix concurrent static_key_slow_inc()") +Reported-by: Yue Sun +Reported-by: Xingwei Lee +Signed-off-by: Thomas Gleixner +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20240610124406.422897838@linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/jump_label.c | 45 +++++++++++++++++++++++++++++---------------- + 1 file changed, 29 insertions(+), 16 deletions(-) + +diff --git a/kernel/jump_label.c b/kernel/jump_label.c +index d9c822bbffb8d..eec802175ccc6 100644 +--- a/kernel/jump_label.c ++++ b/kernel/jump_label.c +@@ -131,7 +131,7 @@ bool static_key_fast_inc_not_disabled(struct static_key *key) + STATIC_KEY_CHECK_USE(key); + /* + * Negative key->enabled has a special meaning: it sends +- * static_key_slow_inc() down the slow path, and it is non-zero ++ * static_key_slow_inc/dec() down the slow path, and it is non-zero + * so it counts as "enabled" in jump_label_update(). Note that + * atomic_inc_unless_negative() checks >= 0, so roll our own. + */ +@@ -150,7 +150,7 @@ bool static_key_slow_inc_cpuslocked(struct static_key *key) + lockdep_assert_cpus_held(); + + /* +- * Careful if we get concurrent static_key_slow_inc() calls; ++ * Careful if we get concurrent static_key_slow_inc/dec() calls; + * later calls must wait for the first one to _finish_ the + * jump_label_update() process. At the same time, however, + * the jump_label_update() call below wants to see +@@ -247,20 +247,32 @@ EXPORT_SYMBOL_GPL(static_key_disable); + + static bool static_key_slow_try_dec(struct static_key *key) + { +- int val; +- +- val = atomic_fetch_add_unless(&key->enabled, -1, 1); +- if (val == 1) +- return false; ++ int v; + + /* +- * The negative count check is valid even when a negative +- * key->enabled is in use by static_key_slow_inc(); a +- * __static_key_slow_dec() before the first static_key_slow_inc() +- * returns is unbalanced, because all other static_key_slow_inc() +- * instances block while the update is in progress. ++ * Go into the slow path if key::enabled is less than or equal than ++ * one. One is valid to shut down the key, anything less than one ++ * is an imbalance, which is handled at the call site. ++ * ++ * That includes the special case of '-1' which is set in ++ * static_key_slow_inc_cpuslocked(), but that's harmless as it is ++ * fully serialized in the slow path below. By the time this task ++ * acquires the jump label lock the value is back to one and the ++ * retry under the lock must succeed. + */ +- WARN(val < 0, "jump label: negative count!\n"); ++ v = atomic_read(&key->enabled); ++ do { ++ /* ++ * Warn about the '-1' case though; since that means a ++ * decrement is concurrent with a first (0->1) increment. IOW ++ * people are trying to disable something that wasn't yet fully ++ * enabled. This suggests an ordering problem on the user side. ++ */ ++ WARN_ON_ONCE(v < 0); ++ if (v <= 1) ++ return false; ++ } while (!likely(atomic_try_cmpxchg(&key->enabled, &v, v - 1))); ++ + return true; + } + +@@ -271,10 +283,11 @@ static void __static_key_slow_dec_cpuslocked(struct static_key *key) + if (static_key_slow_try_dec(key)) + return; + +- jump_label_lock(); +- if (atomic_dec_and_test(&key->enabled)) ++ guard(mutex)(&jump_label_mutex); ++ if (atomic_cmpxchg(&key->enabled, 1, 0)) + jump_label_update(key); +- jump_label_unlock(); ++ else ++ WARN_ON_ONCE(!static_key_slow_try_dec(key)); + } + + static void __static_key_slow_dec(struct static_key *key) +-- +2.43.0 + diff --git a/queue-6.1/jump_label-prevent-key-enabled-int-overflow.patch b/queue-6.1/jump_label-prevent-key-enabled-int-overflow.patch new file mode 100644 index 00000000000..e410546d171 --- /dev/null +++ b/queue-6.1/jump_label-prevent-key-enabled-int-overflow.patch @@ -0,0 +1,180 @@ +From 2a27114a104b1c93d69fbc0a72f309581c4ed418 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 17:38:55 +0000 +Subject: jump_label: Prevent key->enabled int overflow + +From: Dmitry Safonov + +[ Upstream commit eb8c507296f6038d46010396d91b42a05c3b64d9 ] + +1. With CONFIG_JUMP_LABEL=n static_key_slow_inc() doesn't have any + protection against key->enabled refcounter overflow. +2. With CONFIG_JUMP_LABEL=y static_key_slow_inc_cpuslocked() + still may turn the refcounter negative as (v + 1) may overflow. + +key->enabled is indeed a ref-counter as it's documented in multiple +places: top comment in jump_label.h, Documentation/staging/static-keys.rst, +etc. + +As -1 is reserved for static key that's in process of being enabled, +functions would break with negative key->enabled refcount: +- for CONFIG_JUMP_LABEL=n negative return of static_key_count() + breaks static_key_false(), static_key_true() +- the ref counter may become 0 from negative side by too many + static_key_slow_inc() calls and lead to use-after-free issues. + +These flaws result in that some users have to introduce an additional +mutex and prevent the reference counter from overflowing themselves, +see bpf_enable_runtime_stats() checking the counter against INT_MAX / 2. + +Prevent the reference counter overflow by checking if (v + 1) > 0. +Change functions API to return whether the increment was successful. + +Signed-off-by: Dmitry Safonov +Acked-by: Jakub Kicinski +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Jakub Kicinski +Stable-dep-of: 83ab38ef0a0b ("jump_label: Fix concurrency issues in static_key_slow_dec()") +Signed-off-by: Sasha Levin +--- + include/linux/jump_label.h | 21 +++++++++++--- + kernel/jump_label.c | 56 ++++++++++++++++++++++++++++++-------- + 2 files changed, 61 insertions(+), 16 deletions(-) + +diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h +index 570831ca99518..4e968ebadce60 100644 +--- a/include/linux/jump_label.h ++++ b/include/linux/jump_label.h +@@ -224,9 +224,10 @@ extern bool arch_jump_label_transform_queue(struct jump_entry *entry, + enum jump_label_type type); + extern void arch_jump_label_transform_apply(void); + extern int jump_label_text_reserved(void *start, void *end); +-extern void static_key_slow_inc(struct static_key *key); ++extern bool static_key_slow_inc(struct static_key *key); ++extern bool static_key_fast_inc_not_disabled(struct static_key *key); + extern void static_key_slow_dec(struct static_key *key); +-extern void static_key_slow_inc_cpuslocked(struct static_key *key); ++extern bool static_key_slow_inc_cpuslocked(struct static_key *key); + extern void static_key_slow_dec_cpuslocked(struct static_key *key); + extern int static_key_count(struct static_key *key); + extern void static_key_enable(struct static_key *key); +@@ -278,11 +279,23 @@ static __always_inline bool static_key_true(struct static_key *key) + return false; + } + +-static inline void static_key_slow_inc(struct static_key *key) ++static inline bool static_key_fast_inc_not_disabled(struct static_key *key) + { ++ int v; ++ + STATIC_KEY_CHECK_USE(key); +- atomic_inc(&key->enabled); ++ /* ++ * Prevent key->enabled getting negative to follow the same semantics ++ * as for CONFIG_JUMP_LABEL=y, see kernel/jump_label.c comment. ++ */ ++ v = atomic_read(&key->enabled); ++ do { ++ if (v < 0 || (v + 1) < 0) ++ return false; ++ } while (!likely(atomic_try_cmpxchg(&key->enabled, &v, v + 1))); ++ return true; + } ++#define static_key_slow_inc(key) static_key_fast_inc_not_disabled(key) + + static inline void static_key_slow_dec(struct static_key *key) + { +diff --git a/kernel/jump_label.c b/kernel/jump_label.c +index 4d6c6f5f60db8..d9c822bbffb8d 100644 +--- a/kernel/jump_label.c ++++ b/kernel/jump_label.c +@@ -113,9 +113,40 @@ int static_key_count(struct static_key *key) + } + EXPORT_SYMBOL_GPL(static_key_count); + +-void static_key_slow_inc_cpuslocked(struct static_key *key) ++/* ++ * static_key_fast_inc_not_disabled - adds a user for a static key ++ * @key: static key that must be already enabled ++ * ++ * The caller must make sure that the static key can't get disabled while ++ * in this function. It doesn't patch jump labels, only adds a user to ++ * an already enabled static key. ++ * ++ * Returns true if the increment was done. Unlike refcount_t the ref counter ++ * is not saturated, but will fail to increment on overflow. ++ */ ++bool static_key_fast_inc_not_disabled(struct static_key *key) + { ++ int v; ++ + STATIC_KEY_CHECK_USE(key); ++ /* ++ * Negative key->enabled has a special meaning: it sends ++ * static_key_slow_inc() down the slow path, and it is non-zero ++ * so it counts as "enabled" in jump_label_update(). Note that ++ * atomic_inc_unless_negative() checks >= 0, so roll our own. ++ */ ++ v = atomic_read(&key->enabled); ++ do { ++ if (v <= 0 || (v + 1) < 0) ++ return false; ++ } while (!likely(atomic_try_cmpxchg(&key->enabled, &v, v + 1))); ++ ++ return true; ++} ++EXPORT_SYMBOL_GPL(static_key_fast_inc_not_disabled); ++ ++bool static_key_slow_inc_cpuslocked(struct static_key *key) ++{ + lockdep_assert_cpus_held(); + + /* +@@ -124,15 +155,9 @@ void static_key_slow_inc_cpuslocked(struct static_key *key) + * jump_label_update() process. At the same time, however, + * the jump_label_update() call below wants to see + * static_key_enabled(&key) for jumps to be updated properly. +- * +- * So give a special meaning to negative key->enabled: it sends +- * static_key_slow_inc() down the slow path, and it is non-zero +- * so it counts as "enabled" in jump_label_update(). Note that +- * atomic_inc_unless_negative() checks >= 0, so roll our own. + */ +- for (int v = atomic_read(&key->enabled); v > 0; ) +- if (likely(atomic_try_cmpxchg(&key->enabled, &v, v + 1))) +- return; ++ if (static_key_fast_inc_not_disabled(key)) ++ return true; + + jump_label_lock(); + if (atomic_read(&key->enabled) == 0) { +@@ -144,16 +169,23 @@ void static_key_slow_inc_cpuslocked(struct static_key *key) + */ + atomic_set_release(&key->enabled, 1); + } else { +- atomic_inc(&key->enabled); ++ if (WARN_ON_ONCE(!static_key_fast_inc_not_disabled(key))) { ++ jump_label_unlock(); ++ return false; ++ } + } + jump_label_unlock(); ++ return true; + } + +-void static_key_slow_inc(struct static_key *key) ++bool static_key_slow_inc(struct static_key *key) + { ++ bool ret; ++ + cpus_read_lock(); +- static_key_slow_inc_cpuslocked(key); ++ ret = static_key_slow_inc_cpuslocked(key); + cpus_read_unlock(); ++ return ret; + } + EXPORT_SYMBOL_GPL(static_key_slow_inc); + +-- +2.43.0 + diff --git a/queue-6.1/jump_label-use-atomic_try_cmpxchg-in-static_key_slow.patch b/queue-6.1/jump_label-use-atomic_try_cmpxchg-in-static_key_slow.patch new file mode 100644 index 00000000000..249778058ca --- /dev/null +++ b/queue-6.1/jump_label-use-atomic_try_cmpxchg-in-static_key_slow.patch @@ -0,0 +1,59 @@ +From ee1559a0e746c10261a4b85509174c59bee930db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 16:08:50 +0200 +Subject: jump_label: Use atomic_try_cmpxchg() in + static_key_slow_inc_cpuslocked() + +From: Uros Bizjak + +[ Upstream commit d0c006402e7941558e5283ae434e2847c7999378 ] + +Use atomic_try_cmpxchg() instead of atomic_cmpxchg (*ptr, old, new) == +old in static_key_slow_inc_cpuslocked(). x86 CMPXCHG instruction +returns success in ZF flag, so this change saves a compare after +cmpxchg (and related move instruction in front of cmpxchg). + +Also, atomic_try_cmpxchg() implicitly assigns old *ptr value to "old" when +cmpxchg fails, enabling further code simplifications. + +No functional change intended. + +Signed-off-by: Uros Bizjak +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20221019140850.3395-1-ubizjak@gmail.com +Stable-dep-of: 83ab38ef0a0b ("jump_label: Fix concurrency issues in static_key_slow_dec()") +Signed-off-by: Sasha Levin +--- + kernel/jump_label.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/kernel/jump_label.c b/kernel/jump_label.c +index 714ac4c3b556d..4d6c6f5f60db8 100644 +--- a/kernel/jump_label.c ++++ b/kernel/jump_label.c +@@ -115,8 +115,6 @@ EXPORT_SYMBOL_GPL(static_key_count); + + void static_key_slow_inc_cpuslocked(struct static_key *key) + { +- int v, v1; +- + STATIC_KEY_CHECK_USE(key); + lockdep_assert_cpus_held(); + +@@ -132,11 +130,9 @@ void static_key_slow_inc_cpuslocked(struct static_key *key) + * so it counts as "enabled" in jump_label_update(). Note that + * atomic_inc_unless_negative() checks >= 0, so roll our own. + */ +- for (v = atomic_read(&key->enabled); v > 0; v = v1) { +- v1 = atomic_cmpxchg(&key->enabled, v, v + 1); +- if (likely(v1 == v)) ++ for (int v = atomic_read(&key->enabled); v > 0; ) ++ if (likely(atomic_try_cmpxchg(&key->enabled, &v, v + 1))) + return; +- } + + jump_label_lock(); + if (atomic_read(&key->enabled) == 0) { +-- +2.43.0 + diff --git a/queue-6.1/kernfs-convert-kernfs_path_from_node_locked-from-str.patch b/queue-6.1/kernfs-convert-kernfs_path_from_node_locked-from-str.patch new file mode 100644 index 00000000000..8f519767fc3 --- /dev/null +++ b/queue-6.1/kernfs-convert-kernfs_path_from_node_locked-from-str.patch @@ -0,0 +1,220 @@ +From 79ae69bdadc0acaa758208288c46d50e55d1fa8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 13:17:40 -0800 +Subject: kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to + strscpy() + +From: Kees Cook + +[ Upstream commit ff6d413b0b59466e5acf2e42f294b1842ae130a1 ] + +One of the last remaining users of strlcpy() in the kernel is +kernfs_path_from_node_locked(), which passes back the problematic "length +we _would_ have copied" return value to indicate truncation. Convert the +chain of all callers to use the negative return value (some of which +already doing this explicitly). All callers were already also checking +for negative return values, so the risk to missed checks looks very low. + +In this analysis, it was found that cgroup1_release_agent() actually +didn't handle the "too large" condition, so this is technically also a +bug fix. :) + +Here's the chain of callers, and resolution identifying each one as now +handling the correct return value: + +kernfs_path_from_node_locked() + kernfs_path_from_node() + pr_cont_kernfs_path() + returns void + kernfs_path() + sysfs_warn_dup() + return value ignored + cgroup_path() + blkg_path() + bfq_bic_update_cgroup() + return value ignored + TRACE_IOCG_PATH() + return value ignored + TRACE_CGROUP_PATH() + return value ignored + perf_event_cgroup() + return value ignored + task_group_path() + return value ignored + damon_sysfs_memcg_path_eq() + return value ignored + get_mm_memcg_path() + return value ignored + lru_gen_seq_show() + return value ignored + cgroup_path_from_kernfs_id() + return value ignored + cgroup_show_path() + already converted "too large" error to negative value + cgroup_path_ns_locked() + cgroup_path_ns() + bpf_iter_cgroup_show_fdinfo() + return value ignored + cgroup1_release_agent() + wasn't checking "too large" error + proc_cgroup_show() + already converted "too large" to negative value + +Cc: Greg Kroah-Hartman +Cc: Tejun Heo +Cc: Zefan Li +Cc: Johannes Weiner +Cc: Waiman Long +Cc: +Co-developed-by: Azeem Shaikh +Signed-off-by: Azeem Shaikh +Link: https://lore.kernel.org/r/20231116192127.1558276-3-keescook@chromium.org +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20231212211741.164376-3-keescook@chromium.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 1be59c97c83c ("cgroup/cpuset: Prevent UAF in proc_cpuset_show()") +Signed-off-by: Sasha Levin +--- + fs/kernfs/dir.c | 34 +++++++++++++++++----------------- + kernel/cgroup/cgroup-v1.c | 2 +- + kernel/cgroup/cgroup.c | 4 ++-- + kernel/cgroup/cpuset.c | 2 +- + 4 files changed, 21 insertions(+), 21 deletions(-) + +diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c +index 44b907874fba1..2c74b24fc22aa 100644 +--- a/fs/kernfs/dir.c ++++ b/fs/kernfs/dir.c +@@ -127,7 +127,7 @@ static struct kernfs_node *kernfs_common_ancestor(struct kernfs_node *a, + * + * [3] when @kn_to is %NULL result will be "(null)" + * +- * Return: the length of the full path. If the full length is equal to or ++ * Return: the length of the constructed path. If the path would have been + * greater than @buflen, @buf contains the truncated path with the trailing + * '\0'. On error, -errno is returned. + */ +@@ -138,16 +138,17 @@ static int kernfs_path_from_node_locked(struct kernfs_node *kn_to, + struct kernfs_node *kn, *common; + const char parent_str[] = "/.."; + size_t depth_from, depth_to, len = 0; ++ ssize_t copied; + int i, j; + + if (!kn_to) +- return strlcpy(buf, "(null)", buflen); ++ return strscpy(buf, "(null)", buflen); + + if (!kn_from) + kn_from = kernfs_root(kn_to)->kn; + + if (kn_from == kn_to) +- return strlcpy(buf, "/", buflen); ++ return strscpy(buf, "/", buflen); + + if (!buf) + return -EINVAL; +@@ -161,18 +162,19 @@ static int kernfs_path_from_node_locked(struct kernfs_node *kn_to, + + buf[0] = '\0'; + +- for (i = 0; i < depth_from; i++) +- len += strlcpy(buf + len, parent_str, +- len < buflen ? buflen - len : 0); ++ for (i = 0; i < depth_from; i++) { ++ copied = strscpy(buf + len, parent_str, buflen - len); ++ if (copied < 0) ++ return copied; ++ len += copied; ++ } + + /* Calculate how many bytes we need for the rest */ + for (i = depth_to - 1; i >= 0; i--) { + for (kn = kn_to, j = 0; j < i; j++) + kn = kn->parent; +- len += strlcpy(buf + len, "/", +- len < buflen ? buflen - len : 0); +- len += strlcpy(buf + len, kn->name, +- len < buflen ? buflen - len : 0); ++ ++ len += scnprintf(buf + len, buflen - len, "/%s", kn->name); + } + + return len; +@@ -217,7 +219,7 @@ int kernfs_name(struct kernfs_node *kn, char *buf, size_t buflen) + * path (which includes '..'s) as needed to reach from @from to @to is + * returned. + * +- * Return: the length of the full path. If the full length is equal to or ++ * Return: the length of the constructed path. If the path would have been + * greater than @buflen, @buf contains the truncated path with the trailing + * '\0'. On error, -errno is returned. + */ +@@ -268,12 +270,10 @@ void pr_cont_kernfs_path(struct kernfs_node *kn) + sz = kernfs_path_from_node(kn, NULL, kernfs_pr_cont_buf, + sizeof(kernfs_pr_cont_buf)); + if (sz < 0) { +- pr_cont("(error)"); +- goto out; +- } +- +- if (sz >= sizeof(kernfs_pr_cont_buf)) { +- pr_cont("(name too long)"); ++ if (sz == -E2BIG) ++ pr_cont("(name too long)"); ++ else ++ pr_cont("(error)"); + goto out; + } + +diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c +index 289cc873cb719..c2d28ffee3b7b 100644 +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -802,7 +802,7 @@ void cgroup1_release_agent(struct work_struct *work) + goto out_free; + + ret = cgroup_path_ns(cgrp, pathbuf, PATH_MAX, &init_cgroup_ns); +- if (ret < 0 || ret >= PATH_MAX) ++ if (ret < 0) + goto out_free; + + argv[0] = agentbuf; +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 97ecca43386d9..1e008ea467c0a 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -1910,7 +1910,7 @@ int cgroup_show_path(struct seq_file *sf, struct kernfs_node *kf_node, + len = kernfs_path_from_node(kf_node, ns_cgroup->kn, buf, PATH_MAX); + spin_unlock_irq(&css_set_lock); + +- if (len >= PATH_MAX) ++ if (len == -E2BIG) + len = -ERANGE; + else if (len > 0) { + seq_escape(sf, buf, " \t\n\\"); +@@ -6287,7 +6287,7 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns, + if (cgroup_on_dfl(cgrp) || !(tsk->flags & PF_EXITING)) { + retval = cgroup_path_ns_locked(cgrp, buf, PATH_MAX, + current->nsproxy->cgroup_ns); +- if (retval >= PATH_MAX) ++ if (retval == -E2BIG) + retval = -ENAMETOOLONG; + if (retval < 0) + goto out_unlock; +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 01f5a019e0f54..278248907791f 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -4217,7 +4217,7 @@ int proc_cpuset_show(struct seq_file *m, struct pid_namespace *ns, + retval = cgroup_path_ns(css->cgroup, buf, PATH_MAX, + current->nsproxy->cgroup_ns); + css_put(css); +- if (retval >= PATH_MAX) ++ if (retval == -E2BIG) + retval = -ENAMETOOLONG; + if (retval < 0) + goto out_free; +-- +2.43.0 + diff --git a/queue-6.1/kernfs-fix-all-kernel-doc-warnings-and-multiple-typo.patch b/queue-6.1/kernfs-fix-all-kernel-doc-warnings-and-multiple-typo.patch new file mode 100644 index 00000000000..248f014aafb --- /dev/null +++ b/queue-6.1/kernfs-fix-all-kernel-doc-warnings-and-multiple-typo.patch @@ -0,0 +1,496 @@ +From 26ceb0962ca09d0e3e4ccd99c5c33546abeb72fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 19:14:56 -0800 +Subject: kernfs: fix all kernel-doc warnings and multiple typos + +From: Randy Dunlap + +[ Upstream commit 24b3e3dd9c9c742a4dd18e71b6963f9e7ab72911 ] + +Fix kernel-doc warnings. Many of these are about a function's +return value, so use the kernel-doc Return: format to fix those + +Use % prefix on numeric constant values. + +dir.c: fix typos/spellos +file.c fix typo: s/taret/target/ + +Fix all of these kernel-doc warnings: + +dir.c:305: warning: missing initial short description on line: + * kernfs_name_hash + +dir.c:137: warning: No description found for return value of 'kernfs_path_from_node_locked' +dir.c:196: warning: No description found for return value of 'kernfs_name' +dir.c:224: warning: No description found for return value of 'kernfs_path_from_node' +dir.c:292: warning: No description found for return value of 'kernfs_get_parent' +dir.c:312: warning: No description found for return value of 'kernfs_name_hash' +dir.c:404: warning: No description found for return value of 'kernfs_unlink_sibling' +dir.c:588: warning: No description found for return value of 'kernfs_node_from_dentry' +dir.c:806: warning: No description found for return value of 'kernfs_find_ns' +dir.c:879: warning: No description found for return value of 'kernfs_find_and_get_ns' +dir.c:904: warning: No description found for return value of 'kernfs_walk_and_get_ns' +dir.c:927: warning: No description found for return value of 'kernfs_create_root' +dir.c:996: warning: No description found for return value of 'kernfs_root_to_node' +dir.c:1016: warning: No description found for return value of 'kernfs_create_dir_ns' +dir.c:1048: warning: No description found for return value of 'kernfs_create_empty_dir' +dir.c:1306: warning: No description found for return value of 'kernfs_next_descendant_post' +dir.c:1568: warning: No description found for return value of 'kernfs_remove_self' +dir.c:1630: warning: No description found for return value of 'kernfs_remove_by_name_ns' +dir.c:1667: warning: No description found for return value of 'kernfs_rename_ns' + +file.c:66: warning: No description found for return value of 'of_on' +file.c:88: warning: No description found for return value of 'kernfs_deref_open_node_locked' +file.c:1036: warning: No description found for return value of '__kernfs_create_file' + +inode.c:100: warning: No description found for return value of 'kernfs_setattr' + +mount.c:160: warning: No description found for return value of 'kernfs_root_from_sb' +mount.c:198: warning: No description found for return value of 'kernfs_node_dentry' +mount.c:302: warning: No description found for return value of 'kernfs_super_ns' +mount.c:318: warning: No description found for return value of 'kernfs_get_tree' + +symlink.c:28: warning: No description found for return value of 'kernfs_create_link' + +Signed-off-by: Randy Dunlap +Cc: Greg Kroah-Hartman +Cc: Tejun Heo +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20221112031456.22980-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 1be59c97c83c ("cgroup/cpuset: Prevent UAF in proc_cpuset_show()") +Signed-off-by: Sasha Levin +--- + fs/kernfs/dir.c | 82 ++++++++++++++++++++++--------------- + fs/kernfs/file.c | 18 ++++---- + fs/kernfs/inode.c | 8 ++-- + fs/kernfs/kernfs-internal.h | 2 +- + fs/kernfs/mount.c | 10 +++-- + fs/kernfs/symlink.c | 2 +- + 6 files changed, 74 insertions(+), 48 deletions(-) + +diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c +index a00e11ebfa775..44b907874fba1 100644 +--- a/fs/kernfs/dir.c ++++ b/fs/kernfs/dir.c +@@ -125,9 +125,9 @@ static struct kernfs_node *kernfs_common_ancestor(struct kernfs_node *a, + * kn_to: /n1/n2/n3 [depth=3] + * result: /../.. + * +- * [3] when @kn_to is NULL result will be "(null)" ++ * [3] when @kn_to is %NULL result will be "(null)" + * +- * Returns the length of the full path. If the full length is equal to or ++ * Return: the length of the full path. If the full length is equal to or + * greater than @buflen, @buf contains the truncated path with the trailing + * '\0'. On error, -errno is returned. + */ +@@ -185,10 +185,12 @@ static int kernfs_path_from_node_locked(struct kernfs_node *kn_to, + * @buflen: size of @buf + * + * Copies the name of @kn into @buf of @buflen bytes. The behavior is +- * similar to strlcpy(). It returns the length of @kn's name and if @buf +- * isn't long enough, it's filled upto @buflen-1 and nul terminated. ++ * similar to strlcpy(). + * +- * Fills buffer with "(null)" if @kn is NULL. ++ * Fills buffer with "(null)" if @kn is %NULL. ++ * ++ * Return: the length of @kn's name and if @buf isn't long enough, ++ * it's filled up to @buflen-1 and nul terminated. + * + * This function can be called from any context. + */ +@@ -215,7 +217,7 @@ int kernfs_name(struct kernfs_node *kn, char *buf, size_t buflen) + * path (which includes '..'s) as needed to reach from @from to @to is + * returned. + * +- * Returns the length of the full path. If the full length is equal to or ++ * Return: the length of the full path. If the full length is equal to or + * greater than @buflen, @buf contains the truncated path with the trailing + * '\0'. On error, -errno is returned. + */ +@@ -287,6 +289,8 @@ void pr_cont_kernfs_path(struct kernfs_node *kn) + * + * Determines @kn's parent, pins and returns it. This function can be + * called from any context. ++ * ++ * Return: parent node of @kn + */ + struct kernfs_node *kernfs_get_parent(struct kernfs_node *kn) + { +@@ -302,11 +306,11 @@ struct kernfs_node *kernfs_get_parent(struct kernfs_node *kn) + } + + /** +- * kernfs_name_hash ++ * kernfs_name_hash - calculate hash of @ns + @name + * @name: Null terminated string to hash + * @ns: Namespace tag to hash + * +- * Returns 31 bit hash of ns + name (so it fits in an off_t ) ++ * Return: 31-bit hash of ns + name (so it fits in an off_t) + */ + static unsigned int kernfs_name_hash(const char *name, const void *ns) + { +@@ -354,8 +358,8 @@ static int kernfs_sd_compare(const struct kernfs_node *left, + * Locking: + * kernfs_rwsem held exclusive + * +- * RETURNS: +- * 0 on susccess -EEXIST on failure. ++ * Return: ++ * %0 on success, -EEXIST on failure. + */ + static int kernfs_link_sibling(struct kernfs_node *kn) + { +@@ -394,8 +398,10 @@ static int kernfs_link_sibling(struct kernfs_node *kn) + * @kn: kernfs_node of interest + * + * Try to unlink @kn from its sibling rbtree which starts from +- * kn->parent->dir.children. Returns %true if @kn was actually +- * removed, %false if @kn wasn't on the rbtree. ++ * kn->parent->dir.children. ++ * ++ * Return: %true if @kn was actually removed, ++ * %false if @kn wasn't on the rbtree. + * + * Locking: + * kernfs_rwsem held exclusive +@@ -419,10 +425,10 @@ static bool kernfs_unlink_sibling(struct kernfs_node *kn) + * @kn: kernfs_node to get an active reference to + * + * Get an active reference of @kn. This function is noop if @kn +- * is NULL. ++ * is %NULL. + * +- * RETURNS: +- * Pointer to @kn on success, NULL on failure. ++ * Return: ++ * Pointer to @kn on success, %NULL on failure. + */ + struct kernfs_node *kernfs_get_active(struct kernfs_node *kn) + { +@@ -442,7 +448,7 @@ struct kernfs_node *kernfs_get_active(struct kernfs_node *kn) + * @kn: kernfs_node to put an active reference to + * + * Put an active reference to @kn. This function is noop if @kn +- * is NULL. ++ * is %NULL. + */ + void kernfs_put_active(struct kernfs_node *kn) + { +@@ -464,7 +470,7 @@ void kernfs_put_active(struct kernfs_node *kn) + * kernfs_drain - drain kernfs_node + * @kn: kernfs_node to drain + * +- * Drain existing usages and nuke all existing mmaps of @kn. Mutiple ++ * Drain existing usages and nuke all existing mmaps of @kn. Multiple + * removers may invoke this function concurrently on @kn and all will + * return after draining is complete. + */ +@@ -577,7 +583,7 @@ EXPORT_SYMBOL_GPL(kernfs_put); + * kernfs_node_from_dentry - determine kernfs_node associated with a dentry + * @dentry: the dentry in question + * +- * Return the kernfs_node associated with @dentry. If @dentry is not a ++ * Return: the kernfs_node associated with @dentry. If @dentry is not a + * kernfs one, %NULL is returned. + * + * While the returned kernfs_node will stay accessible as long as @dentry +@@ -698,8 +704,8 @@ struct kernfs_node *kernfs_new_node(struct kernfs_node *parent, + * @id's lower 32bits encode ino and upper gen. If the gen portion is + * zero, all generations are matched. + * +- * RETURNS: +- * NULL on failure. Return a kernfs node with reference counter incremented ++ * Return: %NULL on failure, ++ * otherwise a kernfs node with reference counter incremented. + */ + struct kernfs_node *kernfs_find_and_get_node_by_id(struct kernfs_root *root, + u64 id) +@@ -747,8 +753,8 @@ struct kernfs_node *kernfs_find_and_get_node_by_id(struct kernfs_root *root, + * function increments nlink of the parent's inode if @kn is a + * directory and link into the children list of the parent. + * +- * RETURNS: +- * 0 on success, -EEXIST if entry with the given name already ++ * Return: ++ * %0 on success, -EEXIST if entry with the given name already + * exists. + */ + int kernfs_add_one(struct kernfs_node *kn) +@@ -811,8 +817,9 @@ int kernfs_add_one(struct kernfs_node *kn) + * @name: name to look for + * @ns: the namespace tag to use + * +- * Look for kernfs_node with name @name under @parent. Returns pointer to +- * the found kernfs_node on success, %NULL on failure. ++ * Look for kernfs_node with name @name under @parent. ++ * ++ * Return: pointer to the found kernfs_node on success, %NULL on failure. + */ + static struct kernfs_node *kernfs_find_ns(struct kernfs_node *parent, + const unsigned char *name, +@@ -885,8 +892,9 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent, + * @ns: the namespace tag to use + * + * Look for kernfs_node with name @name under @parent and get a reference +- * if found. This function may sleep and returns pointer to the found +- * kernfs_node on success, %NULL on failure. ++ * if found. This function may sleep. ++ * ++ * Return: pointer to the found kernfs_node on success, %NULL on failure. + */ + struct kernfs_node *kernfs_find_and_get_ns(struct kernfs_node *parent, + const char *name, const void *ns) +@@ -910,8 +918,9 @@ EXPORT_SYMBOL_GPL(kernfs_find_and_get_ns); + * @ns: the namespace tag to use + * + * Look for kernfs_node with path @path under @parent and get a reference +- * if found. This function may sleep and returns pointer to the found +- * kernfs_node on success, %NULL on failure. ++ * if found. This function may sleep. ++ * ++ * Return: pointer to the found kernfs_node on success, %NULL on failure. + */ + struct kernfs_node *kernfs_walk_and_get_ns(struct kernfs_node *parent, + const char *path, const void *ns) +@@ -933,7 +942,7 @@ struct kernfs_node *kernfs_walk_and_get_ns(struct kernfs_node *parent, + * @flags: KERNFS_ROOT_* flags + * @priv: opaque data associated with the new directory + * +- * Returns the root of the new hierarchy on success, ERR_PTR() value on ++ * Return: the root of the new hierarchy on success, ERR_PTR() value on + * failure. + */ + struct kernfs_root *kernfs_create_root(struct kernfs_syscall_ops *scops, +@@ -1005,6 +1014,8 @@ void kernfs_destroy_root(struct kernfs_root *root) + /** + * kernfs_root_to_node - return the kernfs_node associated with a kernfs_root + * @root: root to use to lookup ++ * ++ * Return: @root's kernfs_node + */ + struct kernfs_node *kernfs_root_to_node(struct kernfs_root *root) + { +@@ -1021,7 +1032,7 @@ struct kernfs_node *kernfs_root_to_node(struct kernfs_root *root) + * @priv: opaque data associated with the new directory + * @ns: optional namespace tag of the directory + * +- * Returns the created node on success, ERR_PTR() value on failure. ++ * Return: the created node on success, ERR_PTR() value on failure. + */ + struct kernfs_node *kernfs_create_dir_ns(struct kernfs_node *parent, + const char *name, umode_t mode, +@@ -1055,7 +1066,7 @@ struct kernfs_node *kernfs_create_dir_ns(struct kernfs_node *parent, + * @parent: parent in which to create a new directory + * @name: name of the new directory + * +- * Returns the created node on success, ERR_PTR() value on failure. ++ * Return: the created node on success, ERR_PTR() value on failure. + */ + struct kernfs_node *kernfs_create_empty_dir(struct kernfs_node *parent, + const char *name) +@@ -1304,6 +1315,8 @@ static struct kernfs_node *kernfs_leftmost_descendant(struct kernfs_node *pos) + * Find the next descendant to visit for post-order traversal of @root's + * descendants. @root is included in the iteration and the last node to be + * visited. ++ * ++ * Return: the next descendant to visit or %NULL when done. + */ + static struct kernfs_node *kernfs_next_descendant_post(struct kernfs_node *pos, + struct kernfs_node *root) +@@ -1567,6 +1580,8 @@ void kernfs_unbreak_active_protection(struct kernfs_node *kn) + * the whole kernfs_ops which won the arbitration. This can be used to + * guarantee, for example, all concurrent writes to a "delete" file to + * finish only after the whole operation is complete. ++ * ++ * Return: %true if @kn is removed by this call, otherwise %false. + */ + bool kernfs_remove_self(struct kernfs_node *kn) + { +@@ -1627,7 +1642,8 @@ bool kernfs_remove_self(struct kernfs_node *kn) + * @ns: namespace tag of the kernfs_node to remove + * + * Look for the kernfs_node with @name and @ns under @parent and remove it. +- * Returns 0 on success, -ENOENT if such entry doesn't exist. ++ * ++ * Return: %0 on success, -ENOENT if such entry doesn't exist. + */ + int kernfs_remove_by_name_ns(struct kernfs_node *parent, const char *name, + const void *ns) +@@ -1665,6 +1681,8 @@ int kernfs_remove_by_name_ns(struct kernfs_node *parent, const char *name, + * @new_parent: new parent to put @sd under + * @new_name: new name + * @new_ns: new namespace tag ++ * ++ * Return: %0 on success, -errno on failure. + */ + int kernfs_rename_ns(struct kernfs_node *kn, struct kernfs_node *new_parent, + const char *new_name, const void *new_ns) +diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c +index 9ab6c92e02dab..e4a50e4ff0d23 100644 +--- a/fs/kernfs/file.c ++++ b/fs/kernfs/file.c +@@ -33,7 +33,7 @@ struct kernfs_open_node { + * pending queue is implemented as a singly linked list of kernfs_nodes. + * The list is terminated with the self pointer so that whether a + * kernfs_node is on the list or not can be determined by testing the next +- * pointer for NULL. ++ * pointer for %NULL. + */ + #define KERNFS_NOTIFY_EOL ((void *)&kernfs_notify_list) + +@@ -59,8 +59,10 @@ static inline struct mutex *kernfs_open_file_mutex_lock(struct kernfs_node *kn) + } + + /** +- * of_on - Return the kernfs_open_node of the specified kernfs_open_file +- * @of: taret kernfs_open_file ++ * of_on - Get the kernfs_open_node of the specified kernfs_open_file ++ * @of: target kernfs_open_file ++ * ++ * Return: the kernfs_open_node of the kernfs_open_file + */ + static struct kernfs_open_node *of_on(struct kernfs_open_file *of) + { +@@ -82,6 +84,8 @@ static struct kernfs_open_node *of_on(struct kernfs_open_file *of) + * outside RCU read-side critical section. + * + * The caller needs to make sure that kernfs_open_file_mutex is held. ++ * ++ * Return: @kn->attr.open when kernfs_open_file_mutex is held. + */ + static struct kernfs_open_node * + kernfs_deref_open_node_locked(struct kernfs_node *kn) +@@ -548,11 +552,11 @@ static int kernfs_fop_mmap(struct file *file, struct vm_area_struct *vma) + * If @kn->attr.open exists, increment its reference count; otherwise, + * create one. @of is chained to the files list. + * +- * LOCKING: ++ * Locking: + * Kernel thread context (may sleep). + * +- * RETURNS: +- * 0 on success, -errno on failure. ++ * Return: ++ * %0 on success, -errno on failure. + */ + static int kernfs_get_open_node(struct kernfs_node *kn, + struct kernfs_open_file *of) +@@ -1024,7 +1028,7 @@ const struct file_operations kernfs_file_fops = { + * @ns: optional namespace tag of the file + * @key: lockdep key for the file's active_ref, %NULL to disable lockdep + * +- * Returns the created node on success, ERR_PTR() value on error. ++ * Return: the created node on success, ERR_PTR() value on error. + */ + struct kernfs_node *__kernfs_create_file(struct kernfs_node *parent, + const char *name, +diff --git a/fs/kernfs/inode.c b/fs/kernfs/inode.c +index 3d783d80f5daa..076ba9884916c 100644 +--- a/fs/kernfs/inode.c ++++ b/fs/kernfs/inode.c +@@ -94,7 +94,7 @@ int __kernfs_setattr(struct kernfs_node *kn, const struct iattr *iattr) + * @kn: target node + * @iattr: iattr to set + * +- * Returns 0 on success, -errno on failure. ++ * Return: %0 on success, -errno on failure. + */ + int kernfs_setattr(struct kernfs_node *kn, const struct iattr *iattr) + { +@@ -241,11 +241,11 @@ static void kernfs_init_inode(struct kernfs_node *kn, struct inode *inode) + * allocated and basics are initialized. New inode is returned + * locked. + * +- * LOCKING: ++ * Locking: + * Kernel thread context (may sleep). + * +- * RETURNS: +- * Pointer to allocated inode on success, NULL on failure. ++ * Return: ++ * Pointer to allocated inode on success, %NULL on failure. + */ + struct inode *kernfs_get_inode(struct super_block *sb, struct kernfs_node *kn) + { +diff --git a/fs/kernfs/kernfs-internal.h b/fs/kernfs/kernfs-internal.h +index fc5821effd97d..9046d9f39e635 100644 +--- a/fs/kernfs/kernfs-internal.h ++++ b/fs/kernfs/kernfs-internal.h +@@ -58,7 +58,7 @@ struct kernfs_root { + * kernfs_root - find out the kernfs_root a kernfs_node belongs to + * @kn: kernfs_node of interest + * +- * Return the kernfs_root @kn belongs to. ++ * Return: the kernfs_root @kn belongs to. + */ + static inline struct kernfs_root *kernfs_root(struct kernfs_node *kn) + { +diff --git a/fs/kernfs/mount.c b/fs/kernfs/mount.c +index d0859f72d2d64..e08e8d9998070 100644 +--- a/fs/kernfs/mount.c ++++ b/fs/kernfs/mount.c +@@ -153,7 +153,7 @@ static const struct export_operations kernfs_export_ops = { + * kernfs_root_from_sb - determine kernfs_root associated with a super_block + * @sb: the super_block in question + * +- * Return the kernfs_root associated with @sb. If @sb is not a kernfs one, ++ * Return: the kernfs_root associated with @sb. If @sb is not a kernfs one, + * %NULL is returned. + */ + struct kernfs_root *kernfs_root_from_sb(struct super_block *sb) +@@ -167,7 +167,7 @@ struct kernfs_root *kernfs_root_from_sb(struct super_block *sb) + * find the next ancestor in the path down to @child, where @parent was the + * ancestor whose descendant we want to find. + * +- * Say the path is /a/b/c/d. @child is d, @parent is NULL. We return the root ++ * Say the path is /a/b/c/d. @child is d, @parent is %NULL. We return the root + * node. If @parent is b, then we return the node for c. + * Passing in d as @parent is not ok. + */ +@@ -192,6 +192,8 @@ static struct kernfs_node *find_next_ancestor(struct kernfs_node *child, + * kernfs_node_dentry - get a dentry for the given kernfs_node + * @kn: kernfs_node for which a dentry is needed + * @sb: the kernfs super_block ++ * ++ * Return: the dentry pointer + */ + struct dentry *kernfs_node_dentry(struct kernfs_node *kn, + struct super_block *sb) +@@ -296,7 +298,7 @@ static int kernfs_set_super(struct super_block *sb, struct fs_context *fc) + * kernfs_super_ns - determine the namespace tag of a kernfs super_block + * @sb: super_block of interest + * +- * Return the namespace tag associated with kernfs super_block @sb. ++ * Return: the namespace tag associated with kernfs super_block @sb. + */ + const void *kernfs_super_ns(struct super_block *sb) + { +@@ -313,6 +315,8 @@ const void *kernfs_super_ns(struct super_block *sb) + * implementation, which should set the specified ->@fs_type and ->@flags, and + * specify the hierarchy and namespace tag to mount via ->@root and ->@ns, + * respectively. ++ * ++ * Return: %0 on success, -errno on failure. + */ + int kernfs_get_tree(struct fs_context *fc) + { +diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c +index 0ab13824822f7..45371a70caa71 100644 +--- a/fs/kernfs/symlink.c ++++ b/fs/kernfs/symlink.c +@@ -19,7 +19,7 @@ + * @name: name of the symlink + * @target: target node for the symlink to point to + * +- * Returns the created node on success, ERR_PTR() value on error. ++ * Return: the created node on success, ERR_PTR() value on error. + * Ownership of the link matches ownership of the target. + */ + struct kernfs_node *kernfs_create_link(struct kernfs_node *parent, +-- +2.43.0 + diff --git a/queue-6.1/leds-trigger-unregister-sysfs-attributes-before-call.patch b/queue-6.1/leds-trigger-unregister-sysfs-attributes-before-call.patch new file mode 100644 index 00000000000..b082741bc11 --- /dev/null +++ b/queue-6.1/leds-trigger-unregister-sysfs-attributes-before-call.patch @@ -0,0 +1,57 @@ +From 53f55e1070de2589063d8637ab6afeca390b84e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 18:25:33 +0200 +Subject: leds: trigger: Unregister sysfs attributes before calling + deactivate() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit c0dc9adf9474ecb7106e60e5472577375aedaed3 ] + +Triggers which have trigger specific sysfs attributes typically store +related data in trigger-data allocated by the activate() callback and +freed by the deactivate() callback. + +Calling device_remove_groups() after calling deactivate() leaves a window +where the sysfs attributes show/store functions could be called after +deactivation and then operate on the just freed trigger-data. + +Move the device_remove_groups() call to before deactivate() to close +this race window. + +This also makes the deactivation path properly do things in reverse order +of the activation path which calls the activate() callback before calling +device_add_groups(). + +Fixes: a7e7a3156300 ("leds: triggers: add device attribute support") +Cc: Uwe Kleine-König +Signed-off-by: Hans de Goede +Acked-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20240504162533.76780-1-hdegoede@redhat.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/led-triggers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c +index 072491d3e17b0..024b73f84ce0c 100644 +--- a/drivers/leds/led-triggers.c ++++ b/drivers/leds/led-triggers.c +@@ -179,9 +179,9 @@ int led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trig) + + cancel_work_sync(&led_cdev->set_brightness_work); + led_stop_software_blink(led_cdev); ++ device_remove_groups(led_cdev->dev, led_cdev->trigger->groups); + if (led_cdev->trigger->deactivate) + led_cdev->trigger->deactivate(led_cdev); +- device_remove_groups(led_cdev->dev, led_cdev->trigger->groups); + led_cdev->trigger = NULL; + led_cdev->trigger_data = NULL; + led_cdev->activated = false; +-- +2.43.0 + diff --git a/queue-6.1/lib-objagg-fix-general-protection-fault.patch b/queue-6.1/lib-objagg-fix-general-protection-fault.patch new file mode 100644 index 00000000000..f48ed610959 --- /dev/null +++ b/queue-6.1/lib-objagg-fix-general-protection-fault.patch @@ -0,0 +1,75 @@ +From ad7df9394ff70206b55991c8c7cc01a2d99ce3fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 16:49:41 +0200 +Subject: lib: objagg: Fix general protection fault + +From: Ido Schimmel + +[ Upstream commit b4a3a89fffcdf09702b1f161b914e52abca1894d ] + +The library supports aggregation of objects into other objects only if +the parent object does not have a parent itself. That is, nesting is not +supported. + +Aggregation happens in two cases: Without and with hints, where hints +are a pre-computed recommendation on how to aggregate the provided +objects. + +Nesting is not possible in the first case due to a check that prevents +it, but in the second case there is no check because the assumption is +that nesting cannot happen when creating objects based on hints. The +violation of this assumption leads to various warnings and eventually to +a general protection fault [1]. + +Before fixing the root cause, error out when nesting happens and warn. + +[1] +general protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI +CPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G W 6.9.0-rc6-custom-gd9b4f1cca7fb #7 +Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 +Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work +RIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80 +[...] +Call Trace: + + mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0 + mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 + mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 + mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 + process_one_work+0x151/0x370 + worker_thread+0x2cb/0x3e0 + kthread+0xd0/0x100 + ret_from_fork+0x34/0x50 + ret_from_fork_asm+0x1a/0x30 + + +Fixes: 9069a3817d82 ("lib: objagg: implement optimization hints assembly and use hints for object creation") +Reported-by: Alexander Zubkov +Signed-off-by: Ido Schimmel +Reviewed-by: Amit Cohen +Tested-by: Alexander Zubkov +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + lib/objagg.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/lib/objagg.c b/lib/objagg.c +index 1e248629ed643..90f3aa68c30a0 100644 +--- a/lib/objagg.c ++++ b/lib/objagg.c +@@ -167,6 +167,9 @@ static int objagg_obj_parent_assign(struct objagg *objagg, + { + void *delta_priv; + ++ if (WARN_ON(!objagg_obj_is_root(parent))) ++ return -EINVAL; ++ + delta_priv = objagg->ops->delta_create(objagg->priv, parent->obj, + objagg_obj->obj); + if (IS_ERR(delta_priv)) +-- +2.43.0 + diff --git a/queue-6.1/libbpf-checking-the-btf_type-kind-when-fixing-variab.patch b/queue-6.1/libbpf-checking-the-btf_type-kind-when-fixing-variab.patch new file mode 100644 index 00000000000..8e1cffe0133 --- /dev/null +++ b/queue-6.1/libbpf-checking-the-btf_type-kind-when-fixing-variab.patch @@ -0,0 +1,78 @@ +From 5c6ad24635636763fb23a02e95013ae59f973989 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 05:23:55 -0700 +Subject: libbpf: Checking the btf_type kind when fixing variable offsets + +From: Donglin Peng + +[ Upstream commit cc5083d1f3881624ad2de1f3cbb3a07e152cb254 ] + +I encountered an issue when building the test_progs from the repository [1]: + + $ pwd + /work/Qemu/x86_64/linux-6.10-rc2/tools/testing/selftests/bpf/ + + $ make test_progs V=1 + [...] + ./tools/sbin/bpftool gen object ./ip_check_defrag.bpf.linked2.o ./ip_check_defrag.bpf.linked1.o + libbpf: failed to find symbol for variable 'bpf_dynptr_slice' in section '.ksyms' + Error: failed to link './ip_check_defrag.bpf.linked1.o': No such file or directory (2) + [...] + +Upon investigation, I discovered that the btf_types referenced in the '.ksyms' +section had a kind of BTF_KIND_FUNC instead of BTF_KIND_VAR: + + $ bpftool btf dump file ./ip_check_defrag.bpf.linked1.o + [...] + [2] DATASEC '.ksyms' size=0 vlen=2 + type_id=16 offset=0 size=0 (FUNC 'bpf_dynptr_from_skb') + type_id=17 offset=0 size=0 (FUNC 'bpf_dynptr_slice') + [...] + [16] FUNC 'bpf_dynptr_from_skb' type_id=82 linkage=extern + [17] FUNC 'bpf_dynptr_slice' type_id=85 linkage=extern + [...] + +For a detailed analysis, please refer to [2]. We can add a kind checking to +fix the issue. + + [1] https://github.com/eddyz87/bpf/tree/binsort-btf-dedup + [2] https://lore.kernel.org/all/0c0ef20c-c05e-4db9-bad7-2cbc0d6dfae7@oracle.com/ + +Fixes: 8fd27bf69b86 ("libbpf: Add BPF static linker BTF and BTF.ext support") +Signed-off-by: Donglin Peng +Signed-off-by: Daniel Borkmann +Reviewed-by: Alan Maguire +Acked-by: Eduard Zingerman +Link: https://lore.kernel.org/bpf/20240619122355.426405-1-dolinux.peng@gmail.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/linker.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c +index 4ac02c28e152a..8a7cb830bff14 100644 +--- a/tools/lib/bpf/linker.c ++++ b/tools/lib/bpf/linker.c +@@ -2189,10 +2189,17 @@ static int linker_fixup_btf(struct src_obj *obj) + vi = btf_var_secinfos(t); + for (j = 0, m = btf_vlen(t); j < m; j++, vi++) { + const struct btf_type *vt = btf__type_by_id(obj->btf, vi->type); +- const char *var_name = btf__str_by_offset(obj->btf, vt->name_off); +- int var_linkage = btf_var(vt)->linkage; ++ const char *var_name; ++ int var_linkage; + Elf64_Sym *sym; + ++ /* could be a variable or function */ ++ if (!btf_is_var(vt)) ++ continue; ++ ++ var_name = btf__str_by_offset(obj->btf, vt->name_off); ++ var_linkage = btf_var(vt)->linkage; ++ + /* no need to patch up static or extern vars */ + if (var_linkage != BTF_VAR_GLOBAL_ALLOCATED) + continue; +-- +2.43.0 + diff --git a/queue-6.1/locking-rwsem-add-__always_inline-annotation-to-__do.patch b/queue-6.1/locking-rwsem-add-__always_inline-annotation-to-__do.patch new file mode 100644 index 00000000000..93049c1daf0 --- /dev/null +++ b/queue-6.1/locking-rwsem-add-__always_inline-annotation-to-__do.patch @@ -0,0 +1,71 @@ +From 68c711cdc231d222916c4e9c0900049db7701ec2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 23:08:27 -0700 +Subject: locking/rwsem: Add __always_inline annotation to + __down_write_common() and inlined callers + +From: John Stultz + +[ Upstream commit e81859fe64ad42dccefe134d1696e0635f78d763 ] + +Apparently despite it being marked inline, the compiler +may not inline __down_write_common() which makes it difficult +to identify the cause of lock contention, as the wchan of the +blocked function will always be listed as __down_write_common(). + +So add __always_inline annotation to the common function (as +well as the inlined helper callers) to force it to be inlined +so a more useful blocking function will be listed (via wchan). + +This mirrors commit 92cc5d00a431 ("locking/rwsem: Add +__always_inline annotation to __down_read_common() and inlined +callers") which did the same for __down_read_common. + +I sort of worry that I'm playing wack-a-mole here, and talking +with compiler people, they tell me inline means nothing, which +makes me want to cry a little. So I'm wondering if we need to +replace all the inlines with __always_inline, or remove them +because either we mean something by it, or not. + +Fixes: c995e638ccbb ("locking/rwsem: Fold __down_{read,write}*()") +Reported-by: Tim Murray +Signed-off-by: John Stultz +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Waiman Long +Link: https://lkml.kernel.org/r/20240709060831.495366-1-jstultz@google.com +Signed-off-by: Sasha Levin +--- + kernel/locking/rwsem.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index 92d8e2c4edda0..ffc2bbe391879 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -1308,7 +1308,7 @@ static inline int __down_read_trylock(struct rw_semaphore *sem) + /* + * lock for writing + */ +-static inline int __down_write_common(struct rw_semaphore *sem, int state) ++static __always_inline int __down_write_common(struct rw_semaphore *sem, int state) + { + if (unlikely(!rwsem_write_trylock(sem))) { + if (IS_ERR(rwsem_down_write_slowpath(sem, state))) +@@ -1318,12 +1318,12 @@ static inline int __down_write_common(struct rw_semaphore *sem, int state) + return 0; + } + +-static inline void __down_write(struct rw_semaphore *sem) ++static __always_inline void __down_write(struct rw_semaphore *sem) + { + __down_write_common(sem, TASK_UNINTERRUPTIBLE); + } + +-static inline int __down_write_killable(struct rw_semaphore *sem) ++static __always_inline int __down_write_killable(struct rw_semaphore *sem) + { + return __down_write_common(sem, TASK_KILLABLE); + } +-- +2.43.0 + diff --git a/queue-6.1/m68k-atari-fix-tt-bootup-freeze-unexpected-scu-inter.patch b/queue-6.1/m68k-atari-fix-tt-bootup-freeze-unexpected-scu-inter.patch new file mode 100644 index 00000000000..bedd7b03954 --- /dev/null +++ b/queue-6.1/m68k-atari-fix-tt-bootup-freeze-unexpected-scu-inter.patch @@ -0,0 +1,58 @@ +From f44ae7c0a1200911478f266cb49ecc97e0a0ad1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 17:49:01 +0300 +Subject: m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt + messages +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Eero Tamminen + +[ Upstream commit f70065a9fd988983b2c693631b801f25a615fc04 ] + +Avoid freeze on Atari TT / MegaSTe boot with continuous messages of: + + unexpected interrupt from 112 + +Which was due to VBL interrupt being enabled in SCU sys mask, but there +being no handler for that any more. + +(Bug and fix were first verified on real Atari TT HW by Christian, + this patch later on in Hatari emulator.) + +Fixes: 1fa0b29f3a43f9dd ("fbdev: Kill Atari vblank cursor blinking") +Reported-by: Nicolas Pomarède +Closes: https://listengine.tuxfamily.org/lists.tuxfamily.org/hatari-devel/2024/06/msg00016.html +Closes: https://lore.kernel.org/all/9aa793d7-82ed-4fbd-bce5-60810d8a9119@helsinkinet.fi +Tested-by: Christian Zietz +Signed-off-by: Eero Tamminen +Reviewed-by: Michael Schmitz +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20240624144901.5236-1-oak@helsinkinet.fi +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/atari/ataints.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c +index 56f02ea2c248d..715d1e0d973e6 100644 +--- a/arch/m68k/atari/ataints.c ++++ b/arch/m68k/atari/ataints.c +@@ -302,11 +302,7 @@ void __init atari_init_IRQ(void) + + if (ATARIHW_PRESENT(SCU)) { + /* init the SCU if present */ +- tt_scu.sys_mask = 0x10; /* enable VBL (for the cursor) and +- * disable HSYNC interrupts (who +- * needs them?) MFP and SCC are +- * enabled in VME mask +- */ ++ tt_scu.sys_mask = 0x0; /* disable all interrupts */ + tt_scu.vme_mask = 0x60; /* enable MFP and SCC ints */ + } else { + /* If no SCU and no Hades, the HSYNC interrupt needs to be +-- +2.43.0 + diff --git a/queue-6.1/m68k-cmpxchg-fix-return-value-for-default-case-in-__.patch b/queue-6.1/m68k-cmpxchg-fix-return-value-for-default-case-in-__.patch new file mode 100644 index 00000000000..7c88aad87a5 --- /dev/null +++ b/queue-6.1/m68k-cmpxchg-fix-return-value-for-default-case-in-__.patch @@ -0,0 +1,38 @@ +From dcf6afb818e537ef4a511dc21e9387d9de9ea988 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 05:41:17 +0200 +Subject: m68k: cmpxchg: Fix return value for default case in __arch_xchg() + +From: Thorsten Blum + +[ Upstream commit 21b9e722ad28c19c2bc83f18f540b3dbd89bf762 ] + +The return value of __invalid_xchg_size() is assigned to tmp instead of +the return variable x. Assign it to x instead. + +Fixes: 2501cf768e4009a0 ("m68k: Fix xchg/cmpxchg to fail to link if given an inappropriate pointer") +Signed-off-by: Thorsten Blum +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20240702034116.140234-2-thorsten.blum@toblux.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/include/asm/cmpxchg.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/m68k/include/asm/cmpxchg.h b/arch/m68k/include/asm/cmpxchg.h +index 6cf464cdab067..694a44a5c3b05 100644 +--- a/arch/m68k/include/asm/cmpxchg.h ++++ b/arch/m68k/include/asm/cmpxchg.h +@@ -32,7 +32,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz + x = tmp; + break; + default: +- tmp = __invalid_xchg_size(x, ptr, size); ++ x = __invalid_xchg_size(x, ptr, size); + break; + } + +-- +2.43.0 + diff --git a/queue-6.1/macintosh-therm_windtunnel-fix-module-unload.patch b/queue-6.1/macintosh-therm_windtunnel-fix-module-unload.patch new file mode 100644 index 00000000000..383d3b64386 --- /dev/null +++ b/queue-6.1/macintosh-therm_windtunnel-fix-module-unload.patch @@ -0,0 +1,48 @@ +From 7c4090cb7973945a26ff0e1e8deb78fe68cc0165 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 23:54:17 -0400 +Subject: macintosh/therm_windtunnel: fix module unload. + +From: Nick Bowler + +[ Upstream commit fd748e177194ebcbbaf98df75152a30e08230cc6 ] + +The of_device_unregister call in therm_windtunnel's module_exit procedure +does not fully reverse the effects of of_platform_device_create in the +module_init prodedure. Once you unload this module, it is impossible +to load it ever again since only the first of_platform_device_create +call on the fan node succeeds. + +This driver predates first git commit, and it turns out back then +of_platform_device_create worked differently than it does today. +So this is actually an old regression. + +The appropriate function to undo of_platform_device_create now appears +to be of_platform_device_destroy, and switching to use this makes it +possible to unload and load the module as expected. + +Signed-off-by: Nick Bowler +Fixes: c6e126de43e7 ("of: Keep track of populated platform devices") +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240711035428.16696-1-nbowler@draconx.ca +Signed-off-by: Sasha Levin +--- + drivers/macintosh/therm_windtunnel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/macintosh/therm_windtunnel.c b/drivers/macintosh/therm_windtunnel.c +index b8228ca404544..ab9b381c8ff11 100644 +--- a/drivers/macintosh/therm_windtunnel.c ++++ b/drivers/macintosh/therm_windtunnel.c +@@ -548,7 +548,7 @@ g4fan_exit( void ) + platform_driver_unregister( &therm_of_driver ); + + if( x.of_dev ) +- of_device_unregister( x.of_dev ); ++ of_platform_device_destroy(&x.of_dev->dev, NULL); + } + + module_init(g4fan_init); +-- +2.43.0 + diff --git a/queue-6.1/md-fix-deadlock-between-mddev_suspend-and-flush-bio.patch b/queue-6.1/md-fix-deadlock-between-mddev_suspend-and-flush-bio.patch new file mode 100644 index 00000000000..1fe0977d36a --- /dev/null +++ b/queue-6.1/md-fix-deadlock-between-mddev_suspend-and-flush-bio.patch @@ -0,0 +1,144 @@ +From 4dc12f630e019d0441c85723a4c028f3e57103f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 May 2024 02:52:57 +0800 +Subject: md: fix deadlock between mddev_suspend and flush bio + +From: Li Nan + +[ Upstream commit 611d5cbc0b35a752e657a83eebadf40d814d006b ] + +Deadlock occurs when mddev is being suspended while some flush bio is in +progress. It is a complex issue. + +T1. the first flush is at the ending stage, it clears 'mddev->flush_bio' + and tries to submit data, but is blocked because mddev is suspended + by T4. +T2. the second flush sets 'mddev->flush_bio', and attempts to queue + md_submit_flush_data(), which is already running (T1) and won't + execute again if on the same CPU as T1. +T3. the third flush inc active_io and tries to flush, but is blocked because + 'mddev->flush_bio' is not NULL (set by T2). +T4. mddev_suspend() is called and waits for active_io dec to 0 which is inc + by T3. + + T1 T2 T3 T4 + (flush 1) (flush 2) (third 3) (suspend) + md_submit_flush_data + mddev->flush_bio = NULL; + . + . md_flush_request + . mddev->flush_bio = bio + . queue submit_flushes + . . + . . md_handle_request + . . active_io + 1 + . . md_flush_request + . . wait !mddev->flush_bio + . . + . . mddev_suspend + . . wait !active_io + . . + . submit_flushes + . queue_work md_submit_flush_data + . //md_submit_flush_data is already running (T1) + . + md_handle_request + wait resume + +The root issue is non-atomic inc/dec of active_io during flush process. +active_io is dec before md_submit_flush_data is queued, and inc soon +after md_submit_flush_data() run. + md_flush_request + active_io + 1 + submit_flushes + active_io - 1 + md_submit_flush_data + md_handle_request + active_io + 1 + make_request + active_io - 1 + +If active_io is dec after md_handle_request() instead of within +submit_flushes(), make_request() can be called directly intead of +md_handle_request() in md_submit_flush_data(), and active_io will +only inc and dec once in the whole flush process. Deadlock will be +fixed. + +Additionally, the only difference between fixing the issue and before is +that there is no return error handling of make_request(). But after +previous patch cleaned md_write_start(), make_requst() only return error +in raid5_make_request() by dm-raid, see commit 41425f96d7aa ("dm-raid456, +md/raid456: fix a deadlock for dm-raid456 while io concurrent with +reshape)". Since dm always splits data and flush operation into two +separate io, io size of flush submitted by dm always is 0, make_request() +will not be called in md_submit_flush_data(). To prevent future +modifications from introducing issues, add WARN_ON to ensure +make_request() no error is returned in this context. + +Fixes: fa2bbff7b0b4 ("md: synchronize flush io with array reconfiguration") +Signed-off-by: Li Nan +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20240525185257.3896201-3-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 26 +++++++++++++++----------- + 1 file changed, 15 insertions(+), 11 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 506c998c0ca59..7dc1c42accccd 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -527,13 +527,9 @@ static void md_end_flush(struct bio *bio) + + rdev_dec_pending(rdev, mddev); + +- if (atomic_dec_and_test(&mddev->flush_pending)) { +- /* The pair is percpu_ref_get() from md_flush_request() */ +- percpu_ref_put(&mddev->active_io); +- ++ if (atomic_dec_and_test(&mddev->flush_pending)) + /* The pre-request flush has finished */ + queue_work(md_wq, &mddev->flush_work); +- } + } + + static void md_submit_flush_data(struct work_struct *ws); +@@ -564,12 +560,8 @@ static void submit_flushes(struct work_struct *ws) + rcu_read_lock(); + } + rcu_read_unlock(); +- if (atomic_dec_and_test(&mddev->flush_pending)) { +- /* The pair is percpu_ref_get() from md_flush_request() */ +- percpu_ref_put(&mddev->active_io); +- ++ if (atomic_dec_and_test(&mddev->flush_pending)) + queue_work(md_wq, &mddev->flush_work); +- } + } + + static void md_submit_flush_data(struct work_struct *ws) +@@ -594,8 +586,20 @@ static void md_submit_flush_data(struct work_struct *ws) + bio_endio(bio); + } else { + bio->bi_opf &= ~REQ_PREFLUSH; +- md_handle_request(mddev, bio); ++ ++ /* ++ * make_requst() will never return error here, it only ++ * returns error in raid5_make_request() by dm-raid. ++ * Since dm always splits data and flush operation into ++ * two separate io, io size of flush submitted by dm ++ * always is 0, make_request() will not be called here. ++ */ ++ if (WARN_ON_ONCE(!mddev->pers->make_request(mddev, bio))) ++ bio_io_error(bio);; + } ++ ++ /* The pair is percpu_ref_get() from md_flush_request() */ ++ percpu_ref_put(&mddev->active_io); + } + + /* +-- +2.43.0 + diff --git a/queue-6.1/media-dvb-usb-fix-unexpected-infinite-loop-in-dvb_us.patch b/queue-6.1/media-dvb-usb-fix-unexpected-infinite-loop-in-dvb_us.patch new file mode 100644 index 00000000000..7b7a4204019 --- /dev/null +++ b/queue-6.1/media-dvb-usb-fix-unexpected-infinite-loop-in-dvb_us.patch @@ -0,0 +1,144 @@ +From df9f039332149c6319dc20604aeafe0913d4eda4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 20:44:14 +0800 +Subject: media: dvb-usb: Fix unexpected infinite loop in + dvb_usb_read_remote_control() + +From: Zheng Yejian + +[ Upstream commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c ] + +Infinite log printing occurs during fuzz test: + + rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ... + ... + dvb-usb: schedule remote query interval to 100 msecs. + dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ... + dvb-usb: bulk message failed: -22 (1/0) + dvb-usb: bulk message failed: -22 (1/0) + dvb-usb: bulk message failed: -22 (1/0) + ... + dvb-usb: bulk message failed: -22 (1/0) + +Looking into the codes, there is a loop in dvb_usb_read_remote_control(), +that is in rc_core_dvb_usb_remote_init() create a work that will call +dvb_usb_read_remote_control(), and this work will reschedule itself at +'rc_interval' intervals to recursively call dvb_usb_read_remote_control(), +see following code snippet: + + rc_core_dvb_usb_remote_init() { + ... + INIT_DELAYED_WORK(&d->rc_query_work, dvb_usb_read_remote_control); + schedule_delayed_work(&d->rc_query_work, + msecs_to_jiffies(rc_interval)); + ... + } + + dvb_usb_read_remote_control() { + ... + err = d->props.rc.core.rc_query(d); + if (err) + err(...) // Did not return even if query failed + schedule_delayed_work(&d->rc_query_work, + msecs_to_jiffies(rc_interval)); + } + +When the infinite log printing occurs, the query callback +'d->props.rc.core.rc_query' is cxusb_rc_query(). And the log is due to +the failure of finding a valid 'generic_bulk_ctrl_endpoint' +in usb_bulk_msg(), see following code snippet: + + cxusb_rc_query() { + cxusb_ctrl_msg() { + dvb_usb_generic_rw() { + ret = usb_bulk_msg(d->udev, usb_sndbulkpipe(d->udev, + d->props.generic_bulk_ctrl_endpoint),...); + if (ret) + err("bulk message failed: %d (%d/%d)",ret,wlen,actlen); + ... + } + ... + } + +By analyzing the corresponding USB descriptor, it shows that the +bNumEndpoints is 0 in its interface descriptor, but +the 'generic_bulk_ctrl_endpoint' is 1, that means user don't configure +a valid endpoint for 'generic_bulk_ctrl_endpoint', therefore this +'invalid' USB device should be rejected before it calls into +dvb_usb_read_remote_control(). + +To fix it, we need to add endpoint check for 'generic_bulk_ctrl_endpoint'. +And as Sean suggested, the same check and clear halts should be done for +'generic_bulk_ctrl_endpoint_response'. So introduce +dvb_usb_check_bulk_endpoint() to do it for both of them. + +Fixes: 4d43e13f723e ("V4L/DVB (4643): Multi-input patch for DVB-USB device") +Signed-off-by: Zheng Yejian +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++++++++++++++++++++--- + 1 file changed, 31 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c +index 58eea8ab54779..6cf6d08cc4ec9 100644 +--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c ++++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c +@@ -23,11 +23,40 @@ static int dvb_usb_force_pid_filter_usage; + module_param_named(force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int, 0444); + MODULE_PARM_DESC(force_pid_filter_usage, "force all dvb-usb-devices to use a PID filter, if any (default: 0)."); + ++static int dvb_usb_check_bulk_endpoint(struct dvb_usb_device *d, u8 endpoint) ++{ ++ if (endpoint) { ++ int ret; ++ ++ ret = usb_pipe_type_check(d->udev, usb_sndbulkpipe(d->udev, endpoint)); ++ if (ret) ++ return ret; ++ ret = usb_pipe_type_check(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); ++ if (ret) ++ return ret; ++ } ++ return 0; ++} ++ ++static void dvb_usb_clear_halt(struct dvb_usb_device *d, u8 endpoint) ++{ ++ if (endpoint) { ++ usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, endpoint)); ++ usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); ++ } ++} ++ + static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) + { + struct dvb_usb_adapter *adap; + int ret, n, o; + ++ ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint); ++ if (ret) ++ return ret; ++ ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint_response); ++ if (ret) ++ return ret; + for (n = 0; n < d->props.num_adapters; n++) { + adap = &d->adapter[n]; + adap->dev = d; +@@ -103,10 +132,8 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) + * when reloading the driver w/o replugging the device + * sometimes a timeout occurs, this helps + */ +- if (d->props.generic_bulk_ctrl_endpoint != 0) { +- usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); +- usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); +- } ++ dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint); ++ dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint_response); + + return 0; + +-- +2.43.0 + diff --git a/queue-6.1/media-i2c-fix-imx412-exposure-control.patch b/queue-6.1/media-i2c-fix-imx412-exposure-control.patch new file mode 100644 index 00000000000..ba3a4bcb49b --- /dev/null +++ b/queue-6.1/media-i2c-fix-imx412-exposure-control.patch @@ -0,0 +1,97 @@ +From 5c1be7b0ec1a8916d9ddd6775fdeaac33b526214 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 13:53:07 +0100 +Subject: media: i2c: Fix imx412 exposure control + +From: Bryan O'Donoghue + +[ Upstream commit a1956bf53a2774014ee1768b484af2c38c633a25 ] + +Currently we have the following algorithm to calculate what value should be +written to the exposure control of imx412. + +lpfr = imx412->vblank + imx412->cur_mode->height; +shutter = lpfr - exposure; + +The 'shutter' value is given to IMX412_REG_EXPOSURE_CIT however, the above +algorithm will result in the value given to IMX412_REG_EXPOSURE_CIT +decreasing as the requested exposure value from user-space goes up. + +e.g. +[ 2255.713989] imx412 20-001a: Received exp 1608, analog gain 0 +[ 2255.714002] imx412 20-001a: Set exp 1608, analog gain 0, shutter 1938, lpfr 3546 +[ 2256.302770] imx412 20-001a: Received exp 2586, analog gain 100 +[ 2256.302800] imx412 20-001a: Set exp 2586, analog gain 100, shutter 960, lpfr 3546 +[ 2256.753755] imx412 20-001a: Received exp 3524, analog gain 110 +[ 2256.753772] imx412 20-001a: Set exp 3524, analog gain 110, shutter 22, lpfr 3546 + +This behaviour results in the image having less exposure as the requested +exposure value from user-space increases. + +Other sensor drivers such as ov5675, imx218, hid556 and others take the +requested exposure value and use the value directly. + +Take the example of the above cited sensor drivers and directly apply the +requested exposure value from user-space. The 'lpfr' variable still +functions as before but the 'shutter' variable can be dispensed with as a +result. + +Once done a similar run of the test application requesting higher exposure +looks like this, with 'exp' written directly to the sensor. + +[ 133.207884] imx412 20-001a: Received exp 1608, analog gain 0 +[ 133.207899] imx412 20-001a: Set exp 1608, analog gain 0, lpfr 3546 +[ 133.905309] imx412 20-001a: Received exp 2844, analog gain 100 +[ 133.905344] imx412 20-001a: Set exp 2844, analog gain 100, lpfr 3546 +[ 134.241705] imx412 20-001a: Received exp 3524, analog gain 110 +[ 134.241775] imx412 20-001a: Set exp 3524, analog gain 110, lpfr 3546 + +The result is then setting the sensor exposure to lower values results in +darker, less exposure images and vice versa with higher exposure values. + +Fixes: 9214e86c0cc1 ("media: i2c: Add imx412 camera sensor driver") +Tested-by: Bryan O'Donoghue # qrb5165-rb5/imx577 +Reviewed-by: Jacopo Mondi +Reviewed-by: Gjorgji Rosikopulos +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx412.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/i2c/imx412.c b/drivers/media/i2c/imx412.c +index 7f6d29e0e7c40..77fa6253ba3e3 100644 +--- a/drivers/media/i2c/imx412.c ++++ b/drivers/media/i2c/imx412.c +@@ -544,14 +544,13 @@ static int imx412_update_controls(struct imx412 *imx412, + */ + static int imx412_update_exp_gain(struct imx412 *imx412, u32 exposure, u32 gain) + { +- u32 lpfr, shutter; ++ u32 lpfr; + int ret; + + lpfr = imx412->vblank + imx412->cur_mode->height; +- shutter = lpfr - exposure; + +- dev_dbg(imx412->dev, "Set exp %u, analog gain %u, shutter %u, lpfr %u", +- exposure, gain, shutter, lpfr); ++ dev_dbg(imx412->dev, "Set exp %u, analog gain %u, lpfr %u", ++ exposure, gain, lpfr); + + ret = imx412_write_reg(imx412, IMX412_REG_HOLD, 1, 1); + if (ret) +@@ -561,7 +560,7 @@ static int imx412_update_exp_gain(struct imx412 *imx412, u32 exposure, u32 gain) + if (ret) + goto error_release_group_hold; + +- ret = imx412_write_reg(imx412, IMX412_REG_EXPOSURE_CIT, 2, shutter); ++ ret = imx412_write_reg(imx412, IMX412_REG_EXPOSURE_CIT, 2, exposure); + if (ret) + goto error_release_group_hold; + +-- +2.43.0 + diff --git a/queue-6.1/media-imon-fix-race-getting-ictx-lock.patch b/queue-6.1/media-imon-fix-race-getting-ictx-lock.patch new file mode 100644 index 00000000000..712a8f8b0e0 --- /dev/null +++ b/queue-6.1/media-imon-fix-race-getting-ictx-lock.patch @@ -0,0 +1,51 @@ +From 35e1dcb8c1dbc97e0545351ea79a1a29a028816a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 21:10:27 +0000 +Subject: media: imon: Fix race getting ictx->lock + +From: Ricardo Ribalda + +[ Upstream commit 24147897507cd3a7d63745d1518a638bf4132238 ] + +Lets fix a race between mutex_is_lock() and mutex_lock(). + +<-mutex is not locked +if (!mutex_is_locked(&ictx->lock)) { + unlock = true; <- mutex is locked externaly + mutex_lock(&ictx->lock); +} + +Let's use mutex_trylock() that does mutex_is_lock() and mutex_lock() +atomically. + +Fix the following cocci warning: +drivers/media/rc/imon.c:1167:1-7: preceding lock on line 1153 + +Fixes: 23ef710e1a6c ("[media] imon: add conditional locking in change_protocol") +Signed-off-by: Ricardo Ribalda +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/rc/imon.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c +index 5719dda6e0f0e..e5590a708f1c5 100644 +--- a/drivers/media/rc/imon.c ++++ b/drivers/media/rc/imon.c +@@ -1148,10 +1148,7 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 *rc_proto) + + memcpy(ictx->usb_tx_buf, &ir_proto_packet, sizeof(ir_proto_packet)); + +- if (!mutex_is_locked(&ictx->lock)) { +- unlock = true; +- mutex_lock(&ictx->lock); +- } ++ unlock = mutex_trylock(&ictx->lock); + + retval = send_packet(ictx); + if (retval) +-- +2.43.0 + diff --git a/queue-6.1/media-pci-ivtv-add-check-for-dma-map-result.patch b/queue-6.1/media-pci-ivtv-add-check-for-dma-map-result.patch new file mode 100644 index 00000000000..5b643f61ca7 --- /dev/null +++ b/queue-6.1/media-pci-ivtv-add-check-for-dma-map-result.patch @@ -0,0 +1,91 @@ +From 6a8f956e0f173cf77103556db0ad05e5becc2a6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 02:32:23 +0300 +Subject: media: pci: ivtv: Add check for DMA map result + +From: Mikhail Kobuk + +[ Upstream commit 629913d6d79508b166c66e07e4857e20233d85a9 ] + +In case DMA fails, 'dma->SG_length' is 0. This value is later used to +access 'dma->SGarray[dma->SG_length - 1]', which will cause out of +bounds access. + +Add check to return early on invalid value. Adjust warnings accordingly. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 1932dc2f4cf6 ("media: pci/ivtv: switch from 'pci_' to 'dma_' API") +Signed-off-by: Mikhail Kobuk +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/ivtv/ivtv-udma.c | 8 ++++++++ + drivers/media/pci/ivtv/ivtv-yuv.c | 6 ++++++ + drivers/media/pci/ivtv/ivtvfb.c | 6 +++--- + 3 files changed, 17 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/pci/ivtv/ivtv-udma.c b/drivers/media/pci/ivtv/ivtv-udma.c +index 210be8290f24d..fd76f88975ae3 100644 +--- a/drivers/media/pci/ivtv/ivtv-udma.c ++++ b/drivers/media/pci/ivtv/ivtv-udma.c +@@ -131,6 +131,8 @@ int ivtv_udma_setup(struct ivtv *itv, unsigned long ivtv_dest_addr, + + /* Fill SG List with new values */ + if (ivtv_udma_fill_sg_list(dma, &user_dma, 0) < 0) { ++ IVTV_DEBUG_WARN("%s: could not allocate bounce buffers for highmem userspace buffers\n", ++ __func__); + unpin_user_pages(dma->map, dma->page_count); + dma->page_count = 0; + return -ENOMEM; +@@ -139,6 +141,12 @@ int ivtv_udma_setup(struct ivtv *itv, unsigned long ivtv_dest_addr, + /* Map SG List */ + dma->SG_length = dma_map_sg(&itv->pdev->dev, dma->SGlist, + dma->page_count, DMA_TO_DEVICE); ++ if (!dma->SG_length) { ++ IVTV_DEBUG_WARN("%s: DMA map error, SG_length is 0\n", __func__); ++ unpin_user_pages(dma->map, dma->page_count); ++ dma->page_count = 0; ++ return -EINVAL; ++ } + + /* Fill SG Array with new values */ + ivtv_udma_fill_sg_array (dma, ivtv_dest_addr, 0, -1); +diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c +index 4ba10c34a16a4..bd0b80331602d 100644 +--- a/drivers/media/pci/ivtv/ivtv-yuv.c ++++ b/drivers/media/pci/ivtv/ivtv-yuv.c +@@ -115,6 +115,12 @@ static int ivtv_yuv_prep_user_dma(struct ivtv *itv, struct ivtv_user_dma *dma, + } + dma->SG_length = dma_map_sg(&itv->pdev->dev, dma->SGlist, + dma->page_count, DMA_TO_DEVICE); ++ if (!dma->SG_length) { ++ IVTV_DEBUG_WARN("%s: DMA map error, SG_length is 0\n", __func__); ++ unpin_user_pages(dma->map, dma->page_count); ++ dma->page_count = 0; ++ return -EINVAL; ++ } + + /* Fill SG Array with new values */ + ivtv_udma_fill_sg_array(dma, y_buffer_offset, uv_buffer_offset, y_size); +diff --git a/drivers/media/pci/ivtv/ivtvfb.c b/drivers/media/pci/ivtv/ivtvfb.c +index 00ac94d4ab19d..a642becdc0d73 100644 +--- a/drivers/media/pci/ivtv/ivtvfb.c ++++ b/drivers/media/pci/ivtv/ivtvfb.c +@@ -281,10 +281,10 @@ static int ivtvfb_prep_dec_dma_to_device(struct ivtv *itv, + /* Map User DMA */ + if (ivtv_udma_setup(itv, ivtv_dest_addr, userbuf, size_in_bytes) <= 0) { + mutex_unlock(&itv->udma.lock); +- IVTVFB_WARN("ivtvfb_prep_dec_dma_to_device, Error with pin_user_pages: %d bytes, %d pages returned\n", +- size_in_bytes, itv->udma.page_count); ++ IVTVFB_WARN("%s, Error in ivtv_udma_setup: %d bytes, %d pages returned\n", ++ __func__, size_in_bytes, itv->udma.page_count); + +- /* pin_user_pages must have failed completely */ ++ /* pin_user_pages or DMA must have failed completely */ + return -EIO; + } + +-- +2.43.0 + diff --git a/queue-6.1/media-rcar-csi2-cleanup-subdevice-in-remove.patch b/queue-6.1/media-rcar-csi2-cleanup-subdevice-in-remove.patch new file mode 100644 index 00000000000..9b1f406fa58 --- /dev/null +++ b/queue-6.1/media-rcar-csi2-cleanup-subdevice-in-remove.patch @@ -0,0 +1,43 @@ +From c1c7bf54938b99b26080777b52c5a64290e0d19c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 18:11:26 +0200 +Subject: media: rcar-csi2: Cleanup subdevice in remove() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jacopo Mondi + +[ Upstream commit f6d64d0d2897ed4e85ac00afe43e45c8b8fc0c44 ] + +Cleanup the V4L2 subdevice in the driver's remove function to +ensure its async connection are freed, and guarantee in future that +the subdev active state is cleaned up. + +Fixes: 769afd212b16 ("media: rcar-csi2: add Renesas R-Car MIPI CSI-2 receiver driver") +Signed-off-by: Jacopo Mondi +Reviewed-by: Laurent Pinchart +Reviewed-by: Niklas Söderlund +Tested-by: Niklas Söderlund +Link: https://lore.kernel.org/r/20240617161135.130719-4-jacopo.mondi@ideasonboard.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/media/platform/renesas/rcar-vin/rcar-csi2.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/renesas/rcar-vin/rcar-csi2.c b/drivers/media/platform/renesas/rcar-vin/rcar-csi2.c +index 001c4b7c59758..3b6657d4877a5 100644 +--- a/drivers/media/platform/renesas/rcar-vin/rcar-csi2.c ++++ b/drivers/media/platform/renesas/rcar-vin/rcar-csi2.c +@@ -1583,6 +1583,7 @@ static int rcsi2_remove(struct platform_device *pdev) + v4l2_async_nf_unregister(&priv->notifier); + v4l2_async_nf_cleanup(&priv->notifier); + v4l2_async_unregister_subdev(&priv->subdev); ++ v4l2_subdev_cleanup(&priv->subdev); + + pm_runtime_disable(&pdev->dev); + +-- +2.43.0 + diff --git a/queue-6.1/media-rcar-csi2-disable-runtime_pm-in-probe-error.patch b/queue-6.1/media-rcar-csi2-disable-runtime_pm-in-probe-error.patch new file mode 100644 index 00000000000..6d9b59c74b2 --- /dev/null +++ b/queue-6.1/media-rcar-csi2-disable-runtime_pm-in-probe-error.patch @@ -0,0 +1,49 @@ +From 96acf80f5eb795b19bc37a3712e81e6ef019f6dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 18:11:25 +0200 +Subject: media: rcar-csi2: Disable runtime_pm in probe error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jacopo Mondi + +[ Upstream commit e306183628f7c2e95f9bf853d8fcb86288f606de ] + +Disable pm_runtime in the probe() function error path. + +Fixes: 769afd212b16 ("media: rcar-csi2: add Renesas R-Car MIPI CSI-2 receiver driver") +Signed-off-by: Jacopo Mondi +Reviewed-by: Laurent Pinchart +Reviewed-by: Niklas Söderlund +Tested-by: Niklas Söderlund +Link: https://lore.kernel.org/r/20240617161135.130719-3-jacopo.mondi@ideasonboard.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/media/platform/renesas/rcar-vin/rcar-csi2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/renesas/rcar-vin/rcar-csi2.c b/drivers/media/platform/renesas/rcar-vin/rcar-csi2.c +index 174aa6176f540..001c4b7c59758 100644 +--- a/drivers/media/platform/renesas/rcar-vin/rcar-csi2.c ++++ b/drivers/media/platform/renesas/rcar-vin/rcar-csi2.c +@@ -1559,12 +1559,14 @@ static int rcsi2_probe(struct platform_device *pdev) + + ret = v4l2_async_register_subdev(&priv->subdev); + if (ret < 0) +- goto error_async; ++ goto error_pm_runtime; + + dev_info(priv->dev, "%d lanes found\n", priv->lanes); + + return 0; + ++error_pm_runtime: ++ pm_runtime_disable(&pdev->dev); + error_async: + v4l2_async_nf_unregister(&priv->notifier); + v4l2_async_nf_cleanup(&priv->notifier); +-- +2.43.0 + diff --git a/queue-6.1/media-rcar-vin-fix-yuyv8_1x16-handling-for-csi-2.patch b/queue-6.1/media-rcar-vin-fix-yuyv8_1x16-handling-for-csi-2.patch new file mode 100644 index 00000000000..44ea2a708b4 --- /dev/null +++ b/queue-6.1/media-rcar-vin-fix-yuyv8_1x16-handling-for-csi-2.patch @@ -0,0 +1,71 @@ +From 1c68607274fd8da3ae52e8fba283efa7f496e0f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 18:11:24 +0200 +Subject: media: rcar-vin: Fix YUYV8_1X16 handling for CSI-2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jacopo Mondi + +[ Upstream commit 9caf253e8ad6f4c66f5591bac900f9f68b6b6620 ] + +The YUYV8_1X16 and UYVY8_1X16 formats are treated as 'ITU-R +BT.601/BT.1358 16-bit YCbCr-422 input' (YUV16 - 0x5) in the R-Car VIN +driver and are thus disallowed when capturing frames from the R-Car +CSI-2 interface according to the hardware manual. + +As the 1X16 format variants are meant to be used with serial busses they +have to be treated as 'YCbCr-422 8-bit data input' (0x1) when capturing +from CSI-2, which is a valid setting for CSI-2. + +Commit 78b3f9d75a62 ("media: rcar-vin: Add check that input interface +and format are valid") disallowed capturing YUV16 when using the CSI-2 +interface. Fix this by using YUV8_BT601 for YCbCr422 when CSI-2 is in +use. + +Fixes: 78b3f9d75a62 ("media: rcar-vin: Add check that input interface and format are valid") +Signed-off-by: Jacopo Mondi +Reviewed-by: Laurent Pinchart +Reviewed-by: Niklas Söderlund +Tested-by: Niklas Söderlund +Link: https://lore.kernel.org/r/20240617161135.130719-2-jacopo.mondi@ideasonboard.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + .../media/platform/renesas/rcar-vin/rcar-dma.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c +index ef5adffae1972..8bfb020b2f260 100644 +--- a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c ++++ b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c +@@ -665,12 +665,22 @@ static int rvin_setup(struct rvin_dev *vin) + */ + switch (vin->mbus_code) { + case MEDIA_BUS_FMT_YUYV8_1X16: +- /* BT.601/BT.1358 16bit YCbCr422 */ +- vnmc |= VNMC_INF_YUV16; ++ if (vin->is_csi) ++ /* YCbCr422 8-bit */ ++ vnmc |= VNMC_INF_YUV8_BT601; ++ else ++ /* BT.601/BT.1358 16bit YCbCr422 */ ++ vnmc |= VNMC_INF_YUV16; + input_is_yuv = true; + break; + case MEDIA_BUS_FMT_UYVY8_1X16: +- vnmc |= VNMC_INF_YUV16 | VNMC_YCAL; ++ if (vin->is_csi) ++ /* YCbCr422 8-bit */ ++ vnmc |= VNMC_INF_YUV8_BT601; ++ else ++ /* BT.601/BT.1358 16bit YCbCr422 */ ++ vnmc |= VNMC_INF_YUV16; ++ vnmc |= VNMC_YCAL; + input_is_yuv = true; + break; + case MEDIA_BUS_FMT_UYVY8_2X8: +-- +2.43.0 + diff --git a/queue-6.1/media-renesas-vsp1-fix-_irqsave-and-_irq-mix.patch b/queue-6.1/media-renesas-vsp1-fix-_irqsave-and-_irq-mix.patch new file mode 100644 index 00000000000..6f678dc31a8 --- /dev/null +++ b/queue-6.1/media-renesas-vsp1-fix-_irqsave-and-_irq-mix.patch @@ -0,0 +1,117 @@ +From 56debde8c1790b91a93d38f2b24a913eae56ef67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 May 2024 20:22:27 +0300 +Subject: media: renesas: vsp1: Fix _irqsave and _irq mix + +From: Laurent Pinchart + +[ Upstream commit 57edbbcf5258c378a9b9d0c80d33b03a010b22c8 ] + +The histogram support mixes _irqsave and _irq, causing the following +smatch warning: + + drivers/media/platform/renesas/vsp1/vsp1_histo.c:153 histo_stop_streaming() + warn: mixing irqsave and irq + +The histo_stop_streaming() calls spin_lock_irqsave() followed by +wait_event_lock_irq(). The former hints that interrupts may be disabled +by the caller, while the latter reenables interrupts unconditionally. +This doesn't cause any real bug, as the function is always called with +interrupts enabled, but the pattern is still incorrect. + +Fix the problem by using spin_lock_irq() instead of spin_lock_irqsave() +in histo_stop_streaming(). While at it, switch to spin_lock_irq() and +spin_lock() as appropriate elsewhere. + +Fixes: 99362e32332b ("[media] v4l: vsp1: Add histogram support") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/linux-renesas-soc/164d74ff-312c-468f-be64-afa7182cd2f4@moroto.mountain/ +Reviewed-by: Kieran Bingham +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + .../media/platform/renesas/vsp1/vsp1_histo.c | 20 ++++++++----------- + 1 file changed, 8 insertions(+), 12 deletions(-) + +diff --git a/drivers/media/platform/renesas/vsp1/vsp1_histo.c b/drivers/media/platform/renesas/vsp1/vsp1_histo.c +index f22449dd654cb..c0f1002f4ecf1 100644 +--- a/drivers/media/platform/renesas/vsp1/vsp1_histo.c ++++ b/drivers/media/platform/renesas/vsp1/vsp1_histo.c +@@ -36,9 +36,8 @@ struct vsp1_histogram_buffer * + vsp1_histogram_buffer_get(struct vsp1_histogram *histo) + { + struct vsp1_histogram_buffer *buf = NULL; +- unsigned long flags; + +- spin_lock_irqsave(&histo->irqlock, flags); ++ spin_lock(&histo->irqlock); + + if (list_empty(&histo->irqqueue)) + goto done; +@@ -49,7 +48,7 @@ vsp1_histogram_buffer_get(struct vsp1_histogram *histo) + histo->readout = true; + + done: +- spin_unlock_irqrestore(&histo->irqlock, flags); ++ spin_unlock(&histo->irqlock); + return buf; + } + +@@ -58,7 +57,6 @@ void vsp1_histogram_buffer_complete(struct vsp1_histogram *histo, + size_t size) + { + struct vsp1_pipeline *pipe = histo->entity.pipe; +- unsigned long flags; + + /* + * The pipeline pointer is guaranteed to be valid as this function is +@@ -70,10 +68,10 @@ void vsp1_histogram_buffer_complete(struct vsp1_histogram *histo, + vb2_set_plane_payload(&buf->buf.vb2_buf, 0, size); + vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_DONE); + +- spin_lock_irqsave(&histo->irqlock, flags); ++ spin_lock(&histo->irqlock); + histo->readout = false; + wake_up(&histo->wait_queue); +- spin_unlock_irqrestore(&histo->irqlock, flags); ++ spin_unlock(&histo->irqlock); + } + + /* ----------------------------------------------------------------------------- +@@ -124,11 +122,10 @@ static void histo_buffer_queue(struct vb2_buffer *vb) + struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb); + struct vsp1_histogram *histo = vb2_get_drv_priv(vb->vb2_queue); + struct vsp1_histogram_buffer *buf = to_vsp1_histogram_buffer(vbuf); +- unsigned long flags; + +- spin_lock_irqsave(&histo->irqlock, flags); ++ spin_lock_irq(&histo->irqlock); + list_add_tail(&buf->queue, &histo->irqqueue); +- spin_unlock_irqrestore(&histo->irqlock, flags); ++ spin_unlock_irq(&histo->irqlock); + } + + static int histo_start_streaming(struct vb2_queue *vq, unsigned int count) +@@ -140,9 +137,8 @@ static void histo_stop_streaming(struct vb2_queue *vq) + { + struct vsp1_histogram *histo = vb2_get_drv_priv(vq); + struct vsp1_histogram_buffer *buffer; +- unsigned long flags; + +- spin_lock_irqsave(&histo->irqlock, flags); ++ spin_lock_irq(&histo->irqlock); + + /* Remove all buffers from the IRQ queue. */ + list_for_each_entry(buffer, &histo->irqqueue, queue) +@@ -152,7 +148,7 @@ static void histo_stop_streaming(struct vb2_queue *vq) + /* Wait for the buffer being read out (if any) to complete. */ + wait_event_lock_irq(histo->wait_queue, !histo->readout, histo->irqlock); + +- spin_unlock_irqrestore(&histo->irqlock, flags); ++ spin_unlock_irq(&histo->irqlock); + } + + static const struct vb2_ops histo_video_queue_qops = { +-- +2.43.0 + diff --git a/queue-6.1/media-renesas-vsp1-store-rpf-partition-configuration.patch b/queue-6.1/media-renesas-vsp1-store-rpf-partition-configuration.patch new file mode 100644 index 00000000000..642e43f4396 --- /dev/null +++ b/queue-6.1/media-renesas-vsp1-store-rpf-partition-configuration.patch @@ -0,0 +1,66 @@ +From 066bcedd57c936e975024d1114600245e03169dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Nov 2023 03:11:51 +0200 +Subject: media: renesas: vsp1: Store RPF partition configuration per RPF + instance + +From: Laurent Pinchart + +[ Upstream commit a213bc09b1025c771ee722ee341af1d84375db8a ] + +The vsp1_partition structure stores the RPF partition configuration in a +single field for all RPF instances, while each RPF can have its own +configuration. Fix it by storing the configuration separately for each +RPF instance. + +Signed-off-by: Laurent Pinchart +Fixes: ab45e8585182 ("media: v4l: vsp1: Allow entities to participate in the partition algorithm") +Reviewed-by: Jacopo Mondi +Signed-off-by: Sasha Levin +--- + drivers/media/platform/renesas/vsp1/vsp1_pipe.h | 2 +- + drivers/media/platform/renesas/vsp1/vsp1_rpf.c | 8 +++++--- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/renesas/vsp1/vsp1_pipe.h b/drivers/media/platform/renesas/vsp1/vsp1_pipe.h +index ae646c9ef3373..15daf35bda216 100644 +--- a/drivers/media/platform/renesas/vsp1/vsp1_pipe.h ++++ b/drivers/media/platform/renesas/vsp1/vsp1_pipe.h +@@ -73,7 +73,7 @@ struct vsp1_partition_window { + * @wpf: The WPF partition window configuration + */ + struct vsp1_partition { +- struct vsp1_partition_window rpf; ++ struct vsp1_partition_window rpf[VSP1_MAX_RPF]; + struct vsp1_partition_window uds_sink; + struct vsp1_partition_window uds_source; + struct vsp1_partition_window sru; +diff --git a/drivers/media/platform/renesas/vsp1/vsp1_rpf.c b/drivers/media/platform/renesas/vsp1/vsp1_rpf.c +index 75083cb234fe3..996a3058d5b76 100644 +--- a/drivers/media/platform/renesas/vsp1/vsp1_rpf.c ++++ b/drivers/media/platform/renesas/vsp1/vsp1_rpf.c +@@ -271,8 +271,8 @@ static void rpf_configure_partition(struct vsp1_entity *entity, + * 'width' need to be adjusted. + */ + if (pipe->partitions > 1) { +- crop.width = pipe->partition->rpf.width; +- crop.left += pipe->partition->rpf.left; ++ crop.width = pipe->partition->rpf[rpf->entity.index].width; ++ crop.left += pipe->partition->rpf[rpf->entity.index].left; + } + + if (pipe->interlaced) { +@@ -327,7 +327,9 @@ static void rpf_partition(struct vsp1_entity *entity, + unsigned int partition_idx, + struct vsp1_partition_window *window) + { +- partition->rpf = *window; ++ struct vsp1_rwpf *rpf = to_rwpf(&entity->subdev); ++ ++ partition->rpf[rpf->entity.index] = *window; + } + + static const struct vsp1_entity_operations rpf_entity_ops = { +-- +2.43.0 + diff --git a/queue-6.1/media-uvcvideo-override-default-flags.patch b/queue-6.1/media-uvcvideo-override-default-flags.patch new file mode 100644 index 00000000000..dc8083a6840 --- /dev/null +++ b/queue-6.1/media-uvcvideo-override-default-flags.patch @@ -0,0 +1,68 @@ +From e16b8ded3532a071273c317cf420a384fa1a3478 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Jun 2024 14:50:53 +0800 +Subject: media: uvcvideo: Override default flags + +From: Daniel Schaefer + +[ Upstream commit 86419686e66da5b90a07fb8a40ab138fe97189b5 ] + +When the UVC device has a control that is readonly it doesn't set the +SET_CUR flag. For example the privacy control has SET_CUR flag set in +the defaults in the `uvc_ctrls` variable. Even if the device does not +have it set, it's not cleared by uvc_ctrl_get_flags(). + +Originally written with assignment in commit 859086ae3636 ("media: +uvcvideo: Apply flags from device to actual properties"). But changed to +|= in commit 0dc68cabdb62 ("media: uvcvideo: Prevent setting unavailable +flags"). It would not clear the default flags. + +With this patch applied the correct flags are reported to user space. +Tested with: + +``` +> v4l2-ctl --list-ctrls | grep privacy +privacy 0x009a0910 (bool) : default=0 value=0 flags=read-only +``` + +Signed-off-by: Daniel Schaefer +Fixes: 0dc68cabdb62 ("media: uvcvideo: Prevent setting unavailable flags") +Reviewed-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20240602065053.36850-1-dhs@frame.work +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_ctrl.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index 6d7535efc09de..dffc9d03235c4 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -1959,7 +1959,13 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev, + else + ret = uvc_query_ctrl(dev, UVC_GET_INFO, ctrl->entity->id, + dev->intfnum, info->selector, data, 1); +- if (!ret) ++ ++ if (!ret) { ++ info->flags &= ~(UVC_CTRL_FLAG_GET_CUR | ++ UVC_CTRL_FLAG_SET_CUR | ++ UVC_CTRL_FLAG_AUTO_UPDATE | ++ UVC_CTRL_FLAG_ASYNCHRONOUS); ++ + info->flags |= (data[0] & UVC_CONTROL_CAP_GET ? + UVC_CTRL_FLAG_GET_CUR : 0) + | (data[0] & UVC_CONTROL_CAP_SET ? +@@ -1968,6 +1974,7 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev, + UVC_CTRL_FLAG_AUTO_UPDATE : 0) + | (data[0] & UVC_CONTROL_CAP_ASYNCHRONOUS ? + UVC_CTRL_FLAG_ASYNCHRONOUS : 0); ++ } + + kfree(data); + return ret; +-- +2.43.0 + diff --git a/queue-6.1/media-v4l-async-fix-null-pointer-dereference-in-addi.patch b/queue-6.1/media-v4l-async-fix-null-pointer-dereference-in-addi.patch new file mode 100644 index 00000000000..afa2f39f3ca --- /dev/null +++ b/queue-6.1/media-v4l-async-fix-null-pointer-dereference-in-addi.patch @@ -0,0 +1,44 @@ +From 5f89209bba1e4f075011d83ea0361e3be6751ece Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 10:51:49 +0800 +Subject: media: v4l: async: Fix NULL pointer dereference in adding ancillary + links + +From: ChiYuan Huang + +[ Upstream commit 9b4667ea67854f0b116fe22ad11ef5628c5b5b5f ] + +In v4l2_async_create_ancillary_links(), ancillary links are created for +lens and flash sub-devices. These are sub-device to sub-device links and +if the async notifier is related to a V4L2 device, the source sub-device +of the ancillary link is NULL, leading to a NULL pointer dereference. +Check the notifier's sd field is non-NULL in +v4l2_async_create_ancillary_links(). + +Fixes: aa4faf6eb271 ("media: v4l2-async: Create links during v4l2_async_match_notify()") +Signed-off-by: ChiYuan Huang +[Sakari Ailus: Reword the subject and commit messages slightly.] +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-async.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c +index 008a2a3e312e0..7471dbd140409 100644 +--- a/drivers/media/v4l2-core/v4l2-async.c ++++ b/drivers/media/v4l2-core/v4l2-async.c +@@ -302,6 +302,9 @@ static int v4l2_async_create_ancillary_links(struct v4l2_async_notifier *n, + sd->entity.function != MEDIA_ENT_F_FLASH) + return 0; + ++ if (!n->sd) ++ return 0; ++ + link = media_create_ancillary_link(&n->sd->entity, &sd->entity); + + #endif +-- +2.43.0 + diff --git a/queue-6.1/media-venus-flush-all-buffers-in-output-plane-stream.patch b/queue-6.1/media-venus-flush-all-buffers-in-output-plane-stream.patch new file mode 100644 index 00000000000..9f3fe3c1ac2 --- /dev/null +++ b/queue-6.1/media-venus-flush-all-buffers-in-output-plane-stream.patch @@ -0,0 +1,43 @@ +From bf551e31412d66f8ff6bc334c9cab5c77cfc7b61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jan 2024 11:42:14 +0530 +Subject: media: venus: flush all buffers in output plane streamoff + +From: Dikshita Agarwal + +[ Upstream commit e750a4b1224142bd8dd057b0d5adf8a5608b7e77 ] + +For scenarios, when source change is followed by VIDIOC_STREAMOFF +on output plane, driver should discard any queued OUTPUT +buffers, which are not decoded or dequeued. +Flush with HFI_FLUSH_INPUT does not have any actual impact. +So, fix it, by invoking HFI_FLUSH_ALL, which will flush all +queued buffers. + +Fixes: 85872f861d4c ("media: venus: Mark last capture buffer") +Signed-off-by: Dikshita Agarwal +Tested-by: Nathan Hebert +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Stanimir Varbanov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/vdec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c +index 1a52c2ea2da5b..9c00afd261aa3 100644 +--- a/drivers/media/platform/qcom/venus/vdec.c ++++ b/drivers/media/platform/qcom/venus/vdec.c +@@ -1221,7 +1221,7 @@ static int vdec_stop_output(struct venus_inst *inst) + break; + case VENUS_DEC_STATE_INIT: + case VENUS_DEC_STATE_CAPTURE_SETUP: +- ret = hfi_session_flush(inst, HFI_FLUSH_INPUT, true); ++ ret = hfi_session_flush(inst, HFI_FLUSH_ALL, true); + break; + default: + break; +-- +2.43.0 + diff --git a/queue-6.1/memory-fsl_ifc-make-fsl_ifc-config-visible-and-selec.patch b/queue-6.1/memory-fsl_ifc-make-fsl_ifc-config-visible-and-selec.patch new file mode 100644 index 00000000000..af1a75cd363 --- /dev/null +++ b/queue-6.1/memory-fsl_ifc-make-fsl_ifc-config-visible-and-selec.patch @@ -0,0 +1,54 @@ +From f6b9fc3d0d3741f0a62345e90793195b276b5120 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 16:46:36 +0200 +Subject: memory: fsl_ifc: Make FSL_IFC config visible and selectable + +From: Esben Haabendal + +[ Upstream commit 9ba0cae3cac07c21c583f9ff194f74043f90d29c ] + +While use of fsl_ifc driver with NAND flash is fine, as the fsl_ifc_nand +driver selects FSL_IFC automatically, we need the CONFIG_FSL_IFC option to +be selectable for platforms using fsl_ifc with NOR flash. + +Fixes: ea0c0ad6b6eb ("memory: Enable compile testing for most of the drivers") +Reviewed-by: Miquel Raynal +Signed-off-by: Esben Haabendal +Link: https://lore.kernel.org/r/20240530-fsl-ifc-config-v3-1-1fd2c3d233dd@geanix.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/Kconfig | 2 +- + drivers/mtd/nand/raw/Kconfig | 3 +-- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/memory/Kconfig b/drivers/memory/Kconfig +index fac290e48e0b8..15a9e66f031d1 100644 +--- a/drivers/memory/Kconfig ++++ b/drivers/memory/Kconfig +@@ -178,7 +178,7 @@ config FSL_CORENET_CF + represents a coherency violation. + + config FSL_IFC +- bool "Freescale IFC driver" if COMPILE_TEST ++ bool "Freescale IFC driver" + depends on FSL_SOC || ARCH_LAYERSCAPE || SOC_LS1021A || COMPILE_TEST + depends on HAS_IOMEM + +diff --git a/drivers/mtd/nand/raw/Kconfig b/drivers/mtd/nand/raw/Kconfig +index 4cd40af362de2..900b121219394 100644 +--- a/drivers/mtd/nand/raw/Kconfig ++++ b/drivers/mtd/nand/raw/Kconfig +@@ -248,8 +248,7 @@ config MTD_NAND_FSL_IFC + tristate "Freescale IFC NAND controller" + depends on FSL_SOC || ARCH_LAYERSCAPE || SOC_LS1021A || COMPILE_TEST + depends on HAS_IOMEM +- select FSL_IFC +- select MEMORY ++ depends on FSL_IFC + help + Various Freescale chips e.g P1010, include a NAND Flash machine + with built-in hardware ECC capabilities. +-- +2.43.0 + diff --git a/queue-6.1/mfd-omap-usb-tll-use-struct_size-to-allocate-tll.patch b/queue-6.1/mfd-omap-usb-tll-use-struct_size-to-allocate-tll.patch new file mode 100644 index 00000000000..be119730df3 --- /dev/null +++ b/queue-6.1/mfd-omap-usb-tll-use-struct_size-to-allocate-tll.patch @@ -0,0 +1,69 @@ +From 71bbd66230ff8ecefa860f2605d442122eadd4f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 21:37:03 +0200 +Subject: mfd: omap-usb-tll: Use struct_size to allocate tll + +From: Javier Carrasco + +[ Upstream commit 40176714c818b0b6a2ca8213cdb7654fbd49b742 ] + +Commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") +changed the memory allocation of 'tll' to consolidate it into a single +allocation, introducing an incorrect size calculation. + +In particular, the allocation for the array of pointers was converted +into a single-pointer allocation. + +The memory allocation used to occur in two steps: + +tll = devm_kzalloc(dev, sizeof(struct usbtll_omap), GFP_KERNEL); +tll->ch_clk = devm_kzalloc(dev, sizeof(struct clk *) * tll->nch, + GFP_KERNEL); + +And it turned that into the following allocation: + +tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]), + GFP_KERNEL); + +sizeof(tll->ch_clk[nch]) returns the size of a single pointer instead of +the expected nch pointers. + +This bug went unnoticed because the allocation size was small enough to +fit within the minimum size of a memory allocation for this particular +case [1]. + +The complete allocation can still be done at once with the struct_size +macro, which comes in handy for structures with a trailing flexible +array. + +Fix the memory allocation to obtain the original size again. + +Link: https://lore.kernel.org/all/202406261121.2FFD65647@keescook/ [1] +Fixes: 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") +Reviewed-by: Kees Cook +Signed-off-by: Javier Carrasco +Fixes: commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") +Link: https://lore.kernel.org/r/20240626-omap-usb-tll-counted_by-v2-1-4bedf20d1b51@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/omap-usb-tll.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c +index 080d7970a3774..5971b5cb290a1 100644 +--- a/drivers/mfd/omap-usb-tll.c ++++ b/drivers/mfd/omap-usb-tll.c +@@ -237,8 +237,7 @@ static int usbtll_omap_probe(struct platform_device *pdev) + break; + } + +- tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]), +- GFP_KERNEL); ++ tll = devm_kzalloc(dev, struct_size(tll, ch_clk, nch), GFP_KERNEL); + if (!tll) { + pm_runtime_put_sync(dev); + pm_runtime_disable(dev); +-- +2.43.0 + diff --git a/queue-6.1/mfd-rsmu-split-core-code-into-separate-module.patch b/queue-6.1/mfd-rsmu-split-core-code-into-separate-module.patch new file mode 100644 index 00000000000..1553d03897f --- /dev/null +++ b/queue-6.1/mfd-rsmu-split-core-code-into-separate-module.patch @@ -0,0 +1,61 @@ +From 29c2cf6900db4f6badaa06dcd74b325fdfad07d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 11:48:47 +0200 +Subject: mfd: rsmu: Split core code into separate module + +From: Arnd Bergmann + +[ Upstream commit c879a8c39dd55e7fabdd8d13341f7bc5200db377 ] + +Linking a file into two modules can have unintended side-effects +and produces a W=1 warning: + +scripts/Makefile.build:236: drivers/mfd/Makefile: rsmu_core.o is added to multiple modules: rsmu-i2c rsmu-spi + +Make this one a separate module instead. + +Fixes: a1867f85e06e ("mfd: Add Renesas Synchronization Management Unit (SMU) support") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20240529094856.1869543-1-arnd@kernel.org +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/Makefile | 6 ++---- + drivers/mfd/rsmu_core.c | 2 ++ + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile +index 7ed3ef4a698cf..e26c64bf7cb77 100644 +--- a/drivers/mfd/Makefile ++++ b/drivers/mfd/Makefile +@@ -276,7 +276,5 @@ obj-$(CONFIG_MFD_INTEL_M10_BMC) += intel-m10-bmc.o + obj-$(CONFIG_MFD_ATC260X) += atc260x-core.o + obj-$(CONFIG_MFD_ATC260X_I2C) += atc260x-i2c.o + +-rsmu-i2c-objs := rsmu_core.o rsmu_i2c.o +-rsmu-spi-objs := rsmu_core.o rsmu_spi.o +-obj-$(CONFIG_MFD_RSMU_I2C) += rsmu-i2c.o +-obj-$(CONFIG_MFD_RSMU_SPI) += rsmu-spi.o ++obj-$(CONFIG_MFD_RSMU_I2C) += rsmu_i2c.o rsmu_core.o ++obj-$(CONFIG_MFD_RSMU_SPI) += rsmu_spi.o rsmu_core.o +diff --git a/drivers/mfd/rsmu_core.c b/drivers/mfd/rsmu_core.c +index 29437fd0bd5bf..fd04a6e5dfa31 100644 +--- a/drivers/mfd/rsmu_core.c ++++ b/drivers/mfd/rsmu_core.c +@@ -78,11 +78,13 @@ int rsmu_core_init(struct rsmu_ddata *rsmu) + + return ret; + } ++EXPORT_SYMBOL_GPL(rsmu_core_init); + + void rsmu_core_exit(struct rsmu_ddata *rsmu) + { + mutex_destroy(&rsmu->lock); + } ++EXPORT_SYMBOL_GPL(rsmu_core_exit); + + MODULE_DESCRIPTION("Renesas SMU core driver"); + MODULE_LICENSE("GPL"); +-- +2.43.0 + diff --git a/queue-6.1/mips-octeron-remove-source-file-executable-bit.patch b/queue-6.1/mips-octeron-remove-source-file-executable-bit.patch new file mode 100644 index 00000000000..cdbad229137 --- /dev/null +++ b/queue-6.1/mips-octeron-remove-source-file-executable-bit.patch @@ -0,0 +1,27 @@ +From effee73f4f880d9607d7609d4469ecd5dfabff2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jul 2024 16:48:30 +0900 +Subject: MIPS: Octeron: remove source file executable bit + +From: Dominique Martinet + +[ Upstream commit 89c7f5078935872cf47a713a645affb5037be694 ] + +This does not matter the least, but there is no other .[ch] file in the +repo that is executable, so clean this up. + +Fixes: 29b83a64df3b ("MIPS: Octeon: Add PCIe link status check") +Signed-off-by: Dominique Martinet +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/pci/pcie-octeon.c | 0 + 1 file changed, 0 insertions(+), 0 deletions(-) + mode change 100755 => 100644 arch/mips/pci/pcie-octeon.c + +diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c +old mode 100755 +new mode 100644 +-- +2.43.0 + diff --git a/queue-6.1/mlxsw-spectrum_acl-fix-acl-scale-regression-and-firm.patch b/queue-6.1/mlxsw-spectrum_acl-fix-acl-scale-regression-and-firm.patch new file mode 100644 index 00000000000..cfac4fcef01 --- /dev/null +++ b/queue-6.1/mlxsw-spectrum_acl-fix-acl-scale-regression-and-firm.patch @@ -0,0 +1,252 @@ +From 4d0c52643c7a7758d26e39680758bea52201a503 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 16:49:43 +0200 +Subject: mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors + +From: Ido Schimmel + +[ Upstream commit 75d8d7a63065b18df9555dbaab0b42d4c6f20943 ] + +ACLs that reside in the algorithmic TCAM (A-TCAM) in Spectrum-2 and +newer ASICs can share the same mask if their masks only differ in up to +8 consecutive bits. For example, consider the following filters: + + # tc filter add dev swp1 ingress pref 1 proto ip flower dst_ip 192.0.2.0/24 action drop + # tc filter add dev swp1 ingress pref 1 proto ip flower dst_ip 198.51.100.128/25 action drop + +The second filter can use the same mask as the first (dst_ip/24) with a +delta of 1 bit. + +However, the above only works because the two filters have different +values in the common unmasked part (dst_ip/24). When entries have the +same value in the common unmasked part they create undesired collisions +in the device since many entries now have the same key. This leads to +firmware errors such as [1] and to a reduced scale. + +Fix by adjusting the hash table key to only include the value in the +common unmasked part. That is, without including the delta bits. That +way the driver will detect the collision during filter insertion and +spill the filter into the circuit TCAM (C-TCAM). + +Add a test case that fails without the fix and adjust existing cases +that check C-TCAM spillage according to the above limitation. + +[1] +mlxsw_spectrum2 0000:06:00.0: EMAD reg access failed (tid=3379b18a00003394,reg_id=3027(ptce3),type=write,status=8(resource not available)) + +Fixes: c22291f7cf45 ("mlxsw: spectrum: acl: Implement delta for ERP") +Reported-by: Alexander Zubkov +Signed-off-by: Ido Schimmel +Reviewed-by: Amit Cohen +Tested-by: Alexander Zubkov +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../mellanox/mlxsw/spectrum_acl_atcam.c | 18 +++--- + .../mlxsw/spectrum_acl_bloom_filter.c | 2 +- + .../mellanox/mlxsw/spectrum_acl_tcam.h | 9 +-- + .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 55 +++++++++++++++++-- + 4 files changed, 63 insertions(+), 21 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c +index 4b713832fdd55..f5c0a4214c4e5 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c +@@ -391,7 +391,8 @@ mlxsw_sp_acl_atcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp, + if (err) + return err; + +- lkey_id = aregion->ops->lkey_id_get(aregion, aentry->enc_key, erp_id); ++ lkey_id = aregion->ops->lkey_id_get(aregion, aentry->ht_key.enc_key, ++ erp_id); + if (IS_ERR(lkey_id)) + return PTR_ERR(lkey_id); + aentry->lkey_id = lkey_id; +@@ -399,7 +400,7 @@ mlxsw_sp_acl_atcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp, + kvdl_index = mlxsw_afa_block_first_kvdl_index(rulei->act_block); + mlxsw_reg_ptce3_pack(ptce3_pl, true, MLXSW_REG_PTCE3_OP_WRITE_WRITE, + priority, region->tcam_region_info, +- aentry->enc_key, erp_id, ++ aentry->ht_key.enc_key, erp_id, + aentry->delta_info.start, + aentry->delta_info.mask, + aentry->delta_info.value, +@@ -428,7 +429,7 @@ mlxsw_sp_acl_atcam_region_entry_remove(struct mlxsw_sp *mlxsw_sp, + + mlxsw_reg_ptce3_pack(ptce3_pl, false, MLXSW_REG_PTCE3_OP_WRITE_WRITE, 0, + region->tcam_region_info, +- aentry->enc_key, erp_id, ++ aentry->ht_key.enc_key, erp_id, + aentry->delta_info.start, + aentry->delta_info.mask, + aentry->delta_info.value, +@@ -457,7 +458,7 @@ mlxsw_sp_acl_atcam_region_entry_action_replace(struct mlxsw_sp *mlxsw_sp, + kvdl_index = mlxsw_afa_block_first_kvdl_index(rulei->act_block); + mlxsw_reg_ptce3_pack(ptce3_pl, true, MLXSW_REG_PTCE3_OP_WRITE_UPDATE, + priority, region->tcam_region_info, +- aentry->enc_key, erp_id, ++ aentry->ht_key.enc_key, erp_id, + aentry->delta_info.start, + aentry->delta_info.mask, + aentry->delta_info.value, +@@ -480,15 +481,13 @@ __mlxsw_sp_acl_atcam_entry_add(struct mlxsw_sp *mlxsw_sp, + int err; + + mlxsw_afk_encode(afk, region->key_info, &rulei->values, +- aentry->ht_key.full_enc_key, mask); ++ aentry->ht_key.enc_key, mask); + + erp_mask = mlxsw_sp_acl_erp_mask_get(aregion, mask, false); + if (IS_ERR(erp_mask)) + return PTR_ERR(erp_mask); + aentry->erp_mask = erp_mask; + aentry->ht_key.erp_id = mlxsw_sp_acl_erp_mask_erp_id(erp_mask); +- memcpy(aentry->enc_key, aentry->ht_key.full_enc_key, +- sizeof(aentry->enc_key)); + + /* Compute all needed delta information and clear the delta bits + * from the encrypted key. +@@ -497,9 +496,8 @@ __mlxsw_sp_acl_atcam_entry_add(struct mlxsw_sp *mlxsw_sp, + aentry->delta_info.start = mlxsw_sp_acl_erp_delta_start(delta); + aentry->delta_info.mask = mlxsw_sp_acl_erp_delta_mask(delta); + aentry->delta_info.value = +- mlxsw_sp_acl_erp_delta_value(delta, +- aentry->ht_key.full_enc_key); +- mlxsw_sp_acl_erp_delta_clear(delta, aentry->enc_key); ++ mlxsw_sp_acl_erp_delta_value(delta, aentry->ht_key.enc_key); ++ mlxsw_sp_acl_erp_delta_clear(delta, aentry->ht_key.enc_key); + + /* Add rule to the list of A-TCAM rules, assuming this + * rule is intended to A-TCAM. In case this rule does +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c +index 95f63fcf4ba1f..a54eedb69a3f5 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c +@@ -249,7 +249,7 @@ __mlxsw_sp_acl_bf_key_encode(struct mlxsw_sp_acl_atcam_region *aregion, + memcpy(chunk + pad_bytes, &erp_region_id, + sizeof(erp_region_id)); + memcpy(chunk + key_offset, +- &aentry->enc_key[chunk_key_offsets[chunk_index]], ++ &aentry->ht_key.enc_key[chunk_key_offsets[chunk_index]], + chunk_key_len); + chunk += chunk_len; + } +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h +index edbbc89e7a719..24ba15d8b4168 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h +@@ -171,9 +171,9 @@ struct mlxsw_sp_acl_atcam_region { + }; + + struct mlxsw_sp_acl_atcam_entry_ht_key { +- char full_enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN]; /* Encoded +- * key. +- */ ++ char enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN]; /* Encoded key, minus ++ * delta bits. ++ */ + u8 erp_id; + }; + +@@ -185,9 +185,6 @@ struct mlxsw_sp_acl_atcam_entry { + struct rhash_head ht_node; + struct list_head list; /* Member in entries_list */ + struct mlxsw_sp_acl_atcam_entry_ht_key ht_key; +- char enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN]; /* Encoded key, +- * minus delta bits. +- */ + struct { + u16 start; + u8 mask; +diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh +index 616d3581419ca..21d0f419cc6d7 100755 +--- a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh ++++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh +@@ -11,7 +11,7 @@ ALL_TESTS="single_mask_test identical_filters_test two_masks_test \ + multiple_masks_test ctcam_edge_cases_test delta_simple_test \ + delta_two_masks_one_key_test delta_simple_rehash_test \ + bloom_simple_test bloom_complex_test bloom_delta_test \ +- max_erp_entries_test max_group_size_test" ++ max_erp_entries_test max_group_size_test collision_test" + NUM_NETIFS=2 + source $lib_dir/lib.sh + source $lib_dir/tc_common.sh +@@ -457,7 +457,7 @@ delta_two_masks_one_key_test() + { + # If 2 keys are the same and only differ in mask in a way that + # they belong under the same ERP (second is delta of the first), +- # there should be no C-TCAM spill. ++ # there should be C-TCAM spill. + + RET=0 + +@@ -474,8 +474,8 @@ delta_two_masks_one_key_test() + tp_record "mlxsw:*" "tc filter add dev $h2 ingress protocol ip \ + pref 2 handle 102 flower $tcflags dst_ip 192.0.2.2 \ + action drop" +- tp_check_hits "mlxsw:mlxsw_sp_acl_atcam_entry_add_ctcam_spill" 0 +- check_err $? "incorrect C-TCAM spill while inserting the second rule" ++ tp_check_hits "mlxsw:mlxsw_sp_acl_atcam_entry_add_ctcam_spill" 1 ++ check_err $? "C-TCAM spill did not happen while inserting the second rule" + + $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \ + -t ip -q +@@ -1087,6 +1087,53 @@ max_group_size_test() + log_test "max ACL group size test ($tcflags). max size $max_size" + } + ++collision_test() ++{ ++ # Filters cannot share an eRP if in the common unmasked part (i.e., ++ # without the delta bits) they have the same values. If the driver does ++ # not prevent such configuration (by spilling into the C-TCAM), then ++ # multiple entries will be present in the device with the same key, ++ # leading to collisions and a reduced scale. ++ # ++ # Create such a scenario and make sure all the filters are successfully ++ # added. ++ ++ RET=0 ++ ++ local ret ++ ++ if [[ "$tcflags" != "skip_sw" ]]; then ++ return 0; ++ fi ++ ++ # Add a single dst_ip/24 filter and multiple dst_ip/32 filters that all ++ # have the same values in the common unmasked part (dst_ip/24). ++ ++ tc filter add dev $h2 ingress pref 1 proto ipv4 handle 101 \ ++ flower $tcflags dst_ip 198.51.100.0/24 \ ++ action drop ++ ++ for i in {0..255}; do ++ tc filter add dev $h2 ingress pref 2 proto ipv4 \ ++ handle $((102 + i)) \ ++ flower $tcflags dst_ip 198.51.100.${i}/32 \ ++ action drop ++ ret=$? ++ [[ $ret -ne 0 ]] && break ++ done ++ ++ check_err $ret "failed to add all the filters" ++ ++ for i in {255..0}; do ++ tc filter del dev $h2 ingress pref 2 proto ipv4 \ ++ handle $((102 + i)) flower ++ done ++ ++ tc filter del dev $h2 ingress pref 1 proto ipv4 handle 101 flower ++ ++ log_test "collision test ($tcflags)" ++} ++ + setup_prepare() + { + h1=${NETIFS[p1]} +-- +2.43.0 + diff --git a/queue-6.1/mlxsw-spectrum_acl_erp-fix-object-nesting-warning.patch b/queue-6.1/mlxsw-spectrum_acl_erp-fix-object-nesting-warning.patch new file mode 100644 index 00000000000..866b25ada7b --- /dev/null +++ b/queue-6.1/mlxsw-spectrum_acl_erp-fix-object-nesting-warning.patch @@ -0,0 +1,184 @@ +From 57e1cae563b86bda3c98204e10b003cebdce656b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 16:49:42 +0200 +Subject: mlxsw: spectrum_acl_erp: Fix object nesting warning + +From: Ido Schimmel + +[ Upstream commit 97d833ceb27dc19f8777d63f90be4a27b5daeedf ] + +ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM +(A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can +contain more ACLs (i.e., tc filters), but the number of masks in each +region (i.e., tc chain) is limited. + +In order to mitigate the effects of the above limitation, the device +allows filters to share a single mask if their masks only differ in up +to 8 consecutive bits. For example, dst_ip/25 can be represented using +dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the +number of masks being used (and therefore does not support mask +aggregation), but can contain a limited number of filters. + +The driver uses the "objagg" library to perform the mask aggregation by +passing it objects that consist of the filter's mask and whether the +filter is to be inserted into the A-TCAM or the C-TCAM since filters in +different TCAMs cannot share a mask. + +The set of created objects is dependent on the insertion order of the +filters and is not necessarily optimal. Therefore, the driver will +periodically ask the library to compute a more optimal set ("hints") by +looking at all the existing objects. + +When the library asks the driver whether two objects can be aggregated +the driver only compares the provided masks and ignores the A-TCAM / +C-TCAM indication. This is the right thing to do since the goal is to +move as many filters as possible to the A-TCAM. The driver also forbids +two identical masks from being aggregated since this can only happen if +one was intentionally put in the C-TCAM to avoid a conflict in the +A-TCAM. + +The above can result in the following set of hints: + +H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + delta +H3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + delta + +After getting the hints from the library the driver will start migrating +filters from one region to another while consulting the computed hints +and instructing the device to perform a lookup in both regions during +the transition. + +Assuming a filter with mask X is being migrated into the A-TCAM in the +new region, the hints lookup will return H1. Since H2 is the parent of +H1, the library will try to find the object associated with it and +create it if necessary in which case another hints lookup (recursive) +will be performed. This hints lookup for {mask Y, A-TCAM} will either +return H2 or H3 since the driver passes the library an object comparison +function that ignores the A-TCAM / C-TCAM indication. + +This can eventually lead to nested objects which are not supported by +the library [1]. + +Fix by removing the object comparison function from both the driver and +the library as the driver was the only user. That way the lookup will +only return exact matches. + +I do not have a reliable reproducer that can reproduce the issue in a +timely manner, but before the fix the issue would reproduce in several +minutes and with the fix it does not reproduce in over an hour. + +Note that the current usefulness of the hints is limited because they +include the C-TCAM indication and represent aggregation that cannot +actually happen. This will be addressed in net-next. + +[1] +WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0 +Modules linked in: +CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42 +Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018 +Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work +RIP: 0010:objagg_obj_parent_assign+0xb5/0xd0 +[...] +Call Trace: + + __objagg_obj_get+0x2bb/0x580 + objagg_obj_get+0xe/0x80 + mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 + mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 + mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 + mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 + mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 + process_one_work+0x151/0x370 + +Fixes: 9069a3817d82 ("lib: objagg: implement optimization hints assembly and use hints for object creation") +Signed-off-by: Ido Schimmel +Reviewed-by: Amit Cohen +Tested-by: Alexander Zubkov +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 13 ------------- + include/linux/objagg.h | 1 - + lib/objagg.c | 15 --------------- + 3 files changed, 29 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c +index d231f4d2888be..9eee229303cce 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c +@@ -1217,18 +1217,6 @@ static bool mlxsw_sp_acl_erp_delta_check(void *priv, const void *parent_obj, + return err ? false : true; + } + +-static int mlxsw_sp_acl_erp_hints_obj_cmp(const void *obj1, const void *obj2) +-{ +- const struct mlxsw_sp_acl_erp_key *key1 = obj1; +- const struct mlxsw_sp_acl_erp_key *key2 = obj2; +- +- /* For hints purposes, two objects are considered equal +- * in case the masks are the same. Does not matter what +- * the "ctcam" value is. +- */ +- return memcmp(key1->mask, key2->mask, sizeof(key1->mask)); +-} +- + static void *mlxsw_sp_acl_erp_delta_create(void *priv, void *parent_obj, + void *obj) + { +@@ -1308,7 +1296,6 @@ static void mlxsw_sp_acl_erp_root_destroy(void *priv, void *root_priv) + static const struct objagg_ops mlxsw_sp_acl_erp_objagg_ops = { + .obj_size = sizeof(struct mlxsw_sp_acl_erp_key), + .delta_check = mlxsw_sp_acl_erp_delta_check, +- .hints_obj_cmp = mlxsw_sp_acl_erp_hints_obj_cmp, + .delta_create = mlxsw_sp_acl_erp_delta_create, + .delta_destroy = mlxsw_sp_acl_erp_delta_destroy, + .root_create = mlxsw_sp_acl_erp_root_create, +diff --git a/include/linux/objagg.h b/include/linux/objagg.h +index 78021777df462..6df5b887dc547 100644 +--- a/include/linux/objagg.h ++++ b/include/linux/objagg.h +@@ -8,7 +8,6 @@ struct objagg_ops { + size_t obj_size; + bool (*delta_check)(void *priv, const void *parent_obj, + const void *obj); +- int (*hints_obj_cmp)(const void *obj1, const void *obj2); + void * (*delta_create)(void *priv, void *parent_obj, void *obj); + void (*delta_destroy)(void *priv, void *delta_priv); + void * (*root_create)(void *priv, void *obj, unsigned int root_id); +diff --git a/lib/objagg.c b/lib/objagg.c +index 90f3aa68c30a0..1608895b009c8 100644 +--- a/lib/objagg.c ++++ b/lib/objagg.c +@@ -906,20 +906,6 @@ static const struct objagg_opt_algo *objagg_opt_algos[] = { + [OBJAGG_OPT_ALGO_SIMPLE_GREEDY] = &objagg_opt_simple_greedy, + }; + +-static int objagg_hints_obj_cmp(struct rhashtable_compare_arg *arg, +- const void *obj) +-{ +- struct rhashtable *ht = arg->ht; +- struct objagg_hints *objagg_hints = +- container_of(ht, struct objagg_hints, node_ht); +- const struct objagg_ops *ops = objagg_hints->ops; +- const char *ptr = obj; +- +- ptr += ht->p.key_offset; +- return ops->hints_obj_cmp ? ops->hints_obj_cmp(ptr, arg->key) : +- memcmp(ptr, arg->key, ht->p.key_len); +-} +- + /** + * objagg_hints_get - obtains hints instance + * @objagg: objagg instance +@@ -958,7 +944,6 @@ struct objagg_hints *objagg_hints_get(struct objagg *objagg, + offsetof(struct objagg_hints_node, obj); + objagg_hints->ht_params.head_offset = + offsetof(struct objagg_hints_node, ht_node); +- objagg_hints->ht_params.obj_cmpfn = objagg_hints_obj_cmp; + + err = rhashtable_init(&objagg_hints->node_ht, &objagg_hints->ht_params); + if (err) +-- +2.43.0 + diff --git a/queue-6.1/mtd-make-mtd_test.c-a-separate-module.patch b/queue-6.1/mtd-make-mtd_test.c-a-separate-module.patch new file mode 100644 index 00000000000..b56a0301fb6 --- /dev/null +++ b/queue-6.1/mtd-make-mtd_test.c-a-separate-module.patch @@ -0,0 +1,114 @@ +From 2394ada099d1e67123382059ee5b758c3413c733 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 11:50:39 +0200 +Subject: mtd: make mtd_test.c a separate module + +From: Arnd Bergmann + +[ Upstream commit a5cf054d325e6f362e82fe6d124a1871a4af8174 ] + +This file gets linked into nine different modules, which causes a warning: + +scripts/Makefile.build:236: drivers/mtd/tests/Makefile: mtd_test.o is added to multiple modules: mtd_nandbiterrs mtd_oobtest mtd_pagetest mtd_readtest mtd_speedtest mtd_stresstest mtd_subpagetest mtd_torturetest + +Make it a separate module instead. + +Fixes: a995c792280d ("mtd: tests: rename sources in order to link a helper object") +Signed-off-by: Arnd Bergmann +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20240529095049.1915393-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/mtd/tests/Makefile | 34 +++++++++++++++++----------------- + drivers/mtd/tests/mtd_test.c | 9 +++++++++ + 2 files changed, 26 insertions(+), 17 deletions(-) + +diff --git a/drivers/mtd/tests/Makefile b/drivers/mtd/tests/Makefile +index 5de0378f90dbd..7dae831ee8b6b 100644 +--- a/drivers/mtd/tests/Makefile ++++ b/drivers/mtd/tests/Makefile +@@ -1,19 +1,19 @@ + # SPDX-License-Identifier: GPL-2.0 +-obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o ++obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o mtd_test.o + +-mtd_oobtest-objs := oobtest.o mtd_test.o +-mtd_pagetest-objs := pagetest.o mtd_test.o +-mtd_readtest-objs := readtest.o mtd_test.o +-mtd_speedtest-objs := speedtest.o mtd_test.o +-mtd_stresstest-objs := stresstest.o mtd_test.o +-mtd_subpagetest-objs := subpagetest.o mtd_test.o +-mtd_torturetest-objs := torturetest.o mtd_test.o +-mtd_nandbiterrs-objs := nandbiterrs.o mtd_test.o ++mtd_oobtest-objs := oobtest.o ++mtd_pagetest-objs := pagetest.o ++mtd_readtest-objs := readtest.o ++mtd_speedtest-objs := speedtest.o ++mtd_stresstest-objs := stresstest.o ++mtd_subpagetest-objs := subpagetest.o ++mtd_torturetest-objs := torturetest.o ++mtd_nandbiterrs-objs := nandbiterrs.o +diff --git a/drivers/mtd/tests/mtd_test.c b/drivers/mtd/tests/mtd_test.c +index c84250beffdc9..f391e0300cdc9 100644 +--- a/drivers/mtd/tests/mtd_test.c ++++ b/drivers/mtd/tests/mtd_test.c +@@ -25,6 +25,7 @@ int mtdtest_erase_eraseblock(struct mtd_info *mtd, unsigned int ebnum) + + return 0; + } ++EXPORT_SYMBOL_GPL(mtdtest_erase_eraseblock); + + static int is_block_bad(struct mtd_info *mtd, unsigned int ebnum) + { +@@ -57,6 +58,7 @@ int mtdtest_scan_for_bad_eraseblocks(struct mtd_info *mtd, unsigned char *bbt, + + return 0; + } ++EXPORT_SYMBOL_GPL(mtdtest_scan_for_bad_eraseblocks); + + int mtdtest_erase_good_eraseblocks(struct mtd_info *mtd, unsigned char *bbt, + unsigned int eb, int ebcnt) +@@ -75,6 +77,7 @@ int mtdtest_erase_good_eraseblocks(struct mtd_info *mtd, unsigned char *bbt, + + return 0; + } ++EXPORT_SYMBOL_GPL(mtdtest_erase_good_eraseblocks); + + int mtdtest_read(struct mtd_info *mtd, loff_t addr, size_t size, void *buf) + { +@@ -92,6 +95,7 @@ int mtdtest_read(struct mtd_info *mtd, loff_t addr, size_t size, void *buf) + + return err; + } ++EXPORT_SYMBOL_GPL(mtdtest_read); + + int mtdtest_write(struct mtd_info *mtd, loff_t addr, size_t size, + const void *buf) +@@ -107,3 +111,8 @@ int mtdtest_write(struct mtd_info *mtd, loff_t addr, size_t size, + + return err; + } ++EXPORT_SYMBOL_GPL(mtdtest_write); ++ ++MODULE_LICENSE("GPL"); ++MODULE_DESCRIPTION("MTD function test helpers"); ++MODULE_AUTHOR("Akinobu Mita"); +-- +2.43.0 + diff --git a/queue-6.1/net-bridge-mst-check-vlan-state-for-egress-decision.patch b/queue-6.1/net-bridge-mst-check-vlan-state-for-egress-decision.patch new file mode 100644 index 00000000000..7a853ff6aae --- /dev/null +++ b/queue-6.1/net-bridge-mst-check-vlan-state-for-egress-decision.patch @@ -0,0 +1,45 @@ +From a169b5c37dc76222fd69483f6a38cb4de64c1482 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 13:31:33 +1200 +Subject: net: bridge: mst: Check vlan state for egress decision + +From: Elliot Ayrey + +[ Upstream commit 0a1868b93fad5938dbcca77286b25bf211c49f7a ] + +If a port is blocking in the common instance but forwarding in an MST +instance, traffic egressing the bridge will be dropped because the +state of the common instance is overriding that of the MST instance. + +Fix this by skipping the port state check in MST mode to allow +checking the vlan state via br_allowed_egress(). This is similar to +what happens in br_handle_frame_finish() when checking ingress +traffic, which was introduced in the change below. + +Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode") +Signed-off-by: Elliot Ayrey +Acked-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_forward.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c +index 9661698e86e40..a32d73f381558 100644 +--- a/net/bridge/br_forward.c ++++ b/net/bridge/br_forward.c +@@ -25,8 +25,8 @@ static inline int should_deliver(const struct net_bridge_port *p, + + vg = nbp_vlan_group_rcu(p); + return ((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) && +- p->state == BR_STATE_FORWARDING && br_allowed_egress(vg, skb) && +- nbp_switchdev_allowed_egress(p, skb) && ++ (br_mst_is_enabled(p->br) || p->state == BR_STATE_FORWARDING) && ++ br_allowed_egress(vg, skb) && nbp_switchdev_allowed_egress(p, skb) && + !br_skb_isolated(p, skb); + } + +-- +2.43.0 + diff --git a/queue-6.1/net-dsa-b53-limit-chip-wide-jumbo-frame-config-to-cp.patch b/queue-6.1/net-dsa-b53-limit-chip-wide-jumbo-frame-config-to-cp.patch new file mode 100644 index 00000000000..08f325f10c9 --- /dev/null +++ b/queue-6.1/net-dsa-b53-limit-chip-wide-jumbo-frame-config-to-cp.patch @@ -0,0 +1,49 @@ +From e9256304ffff223269098cbe9b93bf9898aa279c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jul 2024 11:08:20 +0200 +Subject: net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports + +From: Martin Willi + +[ Upstream commit c5118072e228e7e4385fc5ac46b2e31cf6c4f2d3 ] + +Broadcom switches supported by the b53 driver use a chip-wide jumbo frame +configuration. In the commit referenced with the Fixes tag, the setting +is applied just for the last port changing its MTU. + +While configuring CPU ports accounts for tagger overhead, user ports do +not. When setting the MTU for a user port, the chip-wide setting is +reduced to not include the tagger overhead, resulting in an potentially +insufficient chip-wide maximum frame size for the CPU port. + +As, by design, the CPU port MTU is adjusted for any user port change, +apply the chip-wide setting only for CPU ports. This aligns the driver +to the behavior of other switch drivers. + +Fixes: 6ae5834b983a ("net: dsa: b53: add MTU configuration support") +Suggested-by: Vladimir Oltean +Signed-off-by: Martin Willi +Reviewed-by: Vladimir Oltean +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/b53/b53_common.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index 59cdfc51ce06a..922e5934de733 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -2221,6 +2221,9 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu) + if (is5325(dev) || is5365(dev)) + return -EOPNOTSUPP; + ++ if (!dsa_is_cpu_port(ds, port)) ++ return 0; ++ + enable_jumbo = (mtu >= JMS_MIN_SIZE); + allow_10_100 = (dev->chip_id == BCM583XX_DEVICE_ID); + +-- +2.43.0 + diff --git a/queue-6.1/net-dsa-mv88e6xxx-limit-chip-wide-frame-size-config-.patch b/queue-6.1/net-dsa-mv88e6xxx-limit-chip-wide-frame-size-config-.patch new file mode 100644 index 00000000000..863bd1d1633 --- /dev/null +++ b/queue-6.1/net-dsa-mv88e6xxx-limit-chip-wide-frame-size-config-.patch @@ -0,0 +1,50 @@ +From 37f7bc2cbf7d3cbad57eca868a63f8b255b5974b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jul 2024 11:08:19 +0200 +Subject: net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports + +From: Martin Willi + +[ Upstream commit 66b6095c264e1b4e0a441c6329861806504e06c6 ] + +Marvell chips not supporting per-port jumbo frame size configurations use +a chip-wide frame size configuration. In the commit referenced with the +Fixes tag, the setting is applied just for the last port changing its MTU. + +While configuring CPU ports accounts for tagger overhead, user ports do +not. When setting the MTU for a user port, the chip-wide setting is +reduced to not include the tagger overhead, resulting in an potentially +insufficient maximum frame size for the CPU port. Specifically, sending +full-size frames from the CPU port on a MV88E6097 having a user port MTU +of 1500 bytes results in dropped frames. + +As, by design, the CPU port MTU is adjusted for any user port change, +apply the chip-wide setting only for CPU ports. + +Fixes: 1baf0fac10fb ("net: dsa: mv88e6xxx: Use chip-wide max frame size for MTU") +Suggested-by: Vladimir Oltean +Signed-off-by: Martin Willi +Reviewed-by: Vladimir Oltean +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 4938550a67c02..d94b46316a117 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3606,7 +3606,8 @@ static int mv88e6xxx_change_mtu(struct dsa_switch *ds, int port, int new_mtu) + mv88e6xxx_reg_lock(chip); + if (chip->info->ops->port_set_jumbo_size) + ret = chip->info->ops->port_set_jumbo_size(chip, port, new_mtu); +- else if (chip->info->ops->set_max_frame_size) ++ else if (chip->info->ops->set_max_frame_size && ++ dsa_is_cpu_port(ds, port)) + ret = chip->info->ops->set_max_frame_size(chip, new_mtu); + mv88e6xxx_reg_unlock(chip); + +-- +2.43.0 + diff --git a/queue-6.1/net-esp-cleanup-esp_output_tail_tcp-in-case-of-unsup.patch b/queue-6.1/net-esp-cleanup-esp_output_tail_tcp-in-case-of-unsup.patch new file mode 100644 index 00000000000..a04b9fccba2 --- /dev/null +++ b/queue-6.1/net-esp-cleanup-esp_output_tail_tcp-in-case-of-unsup.patch @@ -0,0 +1,63 @@ +From 3df18897a96c792da5e28ae7803c960a1d3fd825 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 May 2024 13:04:39 +0000 +Subject: net: esp: cleanup esp_output_tail_tcp() in case of unsupported + ESPINTCP + +From: Hagar Hemdan + +[ Upstream commit 96f887a612e4cda89efc3f54bc10c1997e3ab0e9 ] + +xmit() functions should consume skb or return error codes in error +paths. +When the configuration "CONFIG_INET_ESPINTCP" is not set, the +implementation of the function "esp_output_tail_tcp" violates this rule. +The function frees the skb and returns the error code. +This change removes the kfree_skb from both functions, for both +esp4 and esp6. +WARN_ON is added because esp_output_tail_tcp() should never be called if +CONFIG_INET_ESPINTCP is not set. + +This bug was discovered and resolved using Coverity Static Analysis +Security Testing (SAST) by Synopsys, Inc. + +Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)") +Signed-off-by: Hagar Hemdan +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/ipv4/esp4.c | 3 +-- + net/ipv6/esp6.c | 3 +-- + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c +index e2546961add3e..419969b268225 100644 +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -238,8 +238,7 @@ static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb) + #else + static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb) + { +- kfree_skb(skb); +- ++ WARN_ON(1); + return -EOPNOTSUPP; + } + #endif +diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c +index c2dcb5c613b6b..a021c88d3d9b8 100644 +--- a/net/ipv6/esp6.c ++++ b/net/ipv6/esp6.c +@@ -255,8 +255,7 @@ static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb) + #else + static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb) + { +- kfree_skb(skb); +- ++ WARN_ON(1); + return -EOPNOTSUPP; + } + #endif +-- +2.43.0 + diff --git a/queue-6.1/net-fec-fix-fec_ecr_en1588-being-cleared-on-link-dow.patch b/queue-6.1/net-fec-fix-fec_ecr_en1588-being-cleared-on-link-dow.patch new file mode 100644 index 00000000000..685041d9006 --- /dev/null +++ b/queue-6.1/net-fec-fix-fec_ecr_en1588-being-cleared-on-link-dow.patch @@ -0,0 +1,50 @@ +From b974a9f548a41d1f9ef40980ef2273f01489f6c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 14:31:11 +0200 +Subject: net: fec: Fix FEC_ECR_EN1588 being cleared on link-down +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Csókás, Bence + +[ Upstream commit c32fe1986f27cac329767d3497986e306cad1d5e ] + +FEC_ECR_EN1588 bit gets cleared after MAC reset in `fec_stop()`, which +makes all 1588 functionality shut down, and all the extended registers +disappear, on link-down, making the adapter fall back to compatibility +"dumb mode". However, some functionality needs to be retained (e.g. PPS) +even without link. + +Fixes: 6605b730c061 ("FEC: Add time stamping code and a PTP hardware clock") +Cc: Richard Cochran +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/netdev/5fa9fadc-a89d-467a-aae9-c65469ff5fe1@lunn.ch/ +Signed-off-by: Csókás, Bence +Reviewed-by: Wei Fang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index ef70290beaeb0..0a5c3d27ed3b0 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -1342,6 +1342,12 @@ fec_stop(struct net_device *ndev) + writel(FEC_ECR_ETHEREN, fep->hwp + FEC_ECNTRL); + writel(rmii_mode, fep->hwp + FEC_R_CNTRL); + } ++ ++ if (fep->bufdesc_ex) { ++ val = readl(fep->hwp + FEC_ECNTRL); ++ val |= FEC_ECR_EN1588; ++ writel(val, fep->hwp + FEC_ECNTRL); ++ } + } + + static void +-- +2.43.0 + diff --git a/queue-6.1/net-fec-refactor-define-magic-constants.patch b/queue-6.1/net-fec-refactor-define-magic-constants.patch new file mode 100644 index 00000000000..7fade1ce243 --- /dev/null +++ b/queue-6.1/net-fec-refactor-define-magic-constants.patch @@ -0,0 +1,149 @@ +From 35677900cf64c643ee57f18e52d1dc12c0dcc626 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 16:37:17 +0100 +Subject: net: fec: Refactor: #define magic constants +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Csókás Bence + +[ Upstream commit ff049886671ccd4e624a30ec464cb20e4c39a313 ] + +Add defines for bits of ECR, RCR control registers, TX watermark etc. + +Signed-off-by: Csókás Bence +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20240212153717.10023-1-csokas.bence@prolan.hu +Signed-off-by: Jakub Kicinski +Stable-dep-of: c32fe1986f27 ("net: fec: Fix FEC_ECR_EN1588 being cleared on link-down") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 46 +++++++++++++++-------- + 1 file changed, 30 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 0a3df468316e5..ef70290beaeb0 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -267,8 +267,8 @@ MODULE_PARM_DESC(macaddr, "FEC Ethernet MAC address"); + #define PKT_MINBUF_SIZE 64 + + /* FEC receive acceleration */ +-#define FEC_RACC_IPDIS (1 << 1) +-#define FEC_RACC_PRODIS (1 << 2) ++#define FEC_RACC_IPDIS BIT(1) ++#define FEC_RACC_PRODIS BIT(2) + #define FEC_RACC_SHIFT16 BIT(7) + #define FEC_RACC_OPTIONS (FEC_RACC_IPDIS | FEC_RACC_PRODIS) + +@@ -300,8 +300,23 @@ MODULE_PARM_DESC(macaddr, "FEC Ethernet MAC address"); + #define FEC_MMFR_TA (2 << 16) + #define FEC_MMFR_DATA(v) (v & 0xffff) + /* FEC ECR bits definition */ +-#define FEC_ECR_MAGICEN (1 << 2) +-#define FEC_ECR_SLEEP (1 << 3) ++#define FEC_ECR_RESET BIT(0) ++#define FEC_ECR_ETHEREN BIT(1) ++#define FEC_ECR_MAGICEN BIT(2) ++#define FEC_ECR_SLEEP BIT(3) ++#define FEC_ECR_EN1588 BIT(4) ++#define FEC_ECR_BYTESWP BIT(8) ++/* FEC RCR bits definition */ ++#define FEC_RCR_LOOP BIT(0) ++#define FEC_RCR_HALFDPX BIT(1) ++#define FEC_RCR_MII BIT(2) ++#define FEC_RCR_PROMISC BIT(3) ++#define FEC_RCR_BC_REJ BIT(4) ++#define FEC_RCR_FLOWCTL BIT(5) ++#define FEC_RCR_RMII BIT(8) ++#define FEC_RCR_10BASET BIT(9) ++/* TX WMARK bits */ ++#define FEC_TXWMRK_STRFWD BIT(8) + + #define FEC_MII_TIMEOUT 30000 /* us */ + +@@ -1038,7 +1053,7 @@ fec_restart(struct net_device *ndev) + struct fec_enet_private *fep = netdev_priv(ndev); + u32 temp_mac[2]; + u32 rcntl = OPT_FRAME_SIZE | 0x04; +- u32 ecntl = 0x2; /* ETHEREN */ ++ u32 ecntl = FEC_ECR_ETHEREN; + + /* Whack a reset. We should wait for this. + * For i.MX6SX SOC, enet use AXI bus, we use disable MAC +@@ -1116,18 +1131,18 @@ fec_restart(struct net_device *ndev) + fep->phy_interface == PHY_INTERFACE_MODE_RGMII_TXID) + rcntl |= (1 << 6); + else if (fep->phy_interface == PHY_INTERFACE_MODE_RMII) +- rcntl |= (1 << 8); ++ rcntl |= FEC_RCR_RMII; + else +- rcntl &= ~(1 << 8); ++ rcntl &= ~FEC_RCR_RMII; + + /* 1G, 100M or 10M */ + if (ndev->phydev) { + if (ndev->phydev->speed == SPEED_1000) + ecntl |= (1 << 5); + else if (ndev->phydev->speed == SPEED_100) +- rcntl &= ~(1 << 9); ++ rcntl &= ~FEC_RCR_10BASET; + else +- rcntl |= (1 << 9); ++ rcntl |= FEC_RCR_10BASET; + } + } else { + #ifdef FEC_MIIGSK_ENR +@@ -1186,13 +1201,13 @@ fec_restart(struct net_device *ndev) + + if (fep->quirks & FEC_QUIRK_ENET_MAC) { + /* enable ENET endian swap */ +- ecntl |= (1 << 8); ++ ecntl |= FEC_ECR_BYTESWP; + /* enable ENET store and forward mode */ +- writel(1 << 8, fep->hwp + FEC_X_WMRK); ++ writel(FEC_TXWMRK_STRFWD, fep->hwp + FEC_X_WMRK); + } + + if (fep->bufdesc_ex) +- ecntl |= (1 << 4); ++ ecntl |= FEC_ECR_EN1588; + + if (fep->quirks & FEC_QUIRK_DELAYED_CLKS_SUPPORT && + fep->rgmii_txc_dly) +@@ -1291,7 +1306,7 @@ static void + fec_stop(struct net_device *ndev) + { + struct fec_enet_private *fep = netdev_priv(ndev); +- u32 rmii_mode = readl(fep->hwp + FEC_R_CNTRL) & (1 << 8); ++ u32 rmii_mode = readl(fep->hwp + FEC_R_CNTRL) & FEC_RCR_RMII; + u32 val; + + /* We cannot expect a graceful transmit stop without link !!! */ +@@ -1310,7 +1325,7 @@ fec_stop(struct net_device *ndev) + if (fep->quirks & FEC_QUIRK_HAS_MULTI_QUEUES) { + writel(0, fep->hwp + FEC_ECNTRL); + } else { +- writel(1, fep->hwp + FEC_ECNTRL); ++ writel(FEC_ECR_RESET, fep->hwp + FEC_ECNTRL); + udelay(10); + } + } else { +@@ -1324,12 +1339,11 @@ fec_stop(struct net_device *ndev) + /* We have to keep ENET enabled to have MII interrupt stay working */ + if (fep->quirks & FEC_QUIRK_ENET_MAC && + !(fep->wol_flag & FEC_WOL_FLAG_SLEEP_ON)) { +- writel(2, fep->hwp + FEC_ECNTRL); ++ writel(FEC_ECR_ETHEREN, fep->hwp + FEC_ECNTRL); + writel(rmii_mode, fep->hwp + FEC_R_CNTRL); + } + } + +- + static void + fec_timeout(struct net_device *ndev, unsigned int txqueue) + { +-- +2.43.0 + diff --git a/queue-6.1/net-flow_dissector-use-debug_net_warn_on_once.patch b/queue-6.1/net-flow_dissector-use-debug_net_warn_on_once.patch new file mode 100644 index 00000000000..b4ebd798400 --- /dev/null +++ b/queue-6.1/net-flow_dissector-use-debug_net_warn_on_once.patch @@ -0,0 +1,81 @@ +From 5bd53158fbab52f195a31d5325d072c3533d18ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 16:14:42 +0200 +Subject: net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE + +From: Pablo Neira Ayuso + +[ Upstream commit 120f1c857a73e52132e473dee89b340440cb692b ] + +The following splat is easy to reproduce upstream as well as in -stable +kernels. Florian Westphal provided the following commit: + + d1dab4f71d37 ("net: add and use __skb_get_hash_symmetric_net") + +but this complementary fix has been also suggested by Willem de Bruijn +and it can be easily backported to -stable kernel which consists in +using DEBUG_NET_WARN_ON_ONCE instead to silence the following splat +given __skb_get_hash() is used by the nftables tracing infrastructure to +to identify packets in traces. + +[69133.561393] ------------[ cut here ]------------ +[69133.561404] WARNING: CPU: 0 PID: 43576 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x134f/ +[...] +[69133.561944] CPU: 0 PID: 43576 Comm: socat Not tainted 6.10.0-rc7+ #379 +[69133.561959] RIP: 0010:__skb_flow_dissect+0x134f/0x2ad0 +[69133.561970] Code: 83 f9 04 0f 84 b3 00 00 00 45 85 c9 0f 84 aa 00 00 00 41 83 f9 02 0f 84 81 fc ff +ff 44 0f b7 b4 24 80 00 00 00 e9 8b f9 ff ff <0f> 0b e9 20 f3 ff ff 41 f6 c6 20 0f 84 e4 ef ff ff 48 8d 7b 12 e8 +[69133.561979] RSP: 0018:ffffc90000006fc0 EFLAGS: 00010246 +[69133.561988] RAX: 0000000000000000 RBX: ffffffff82f33e20 RCX: ffffffff81ab7e19 +[69133.561994] RDX: dffffc0000000000 RSI: ffffc90000007388 RDI: ffff888103a1b418 +[69133.562001] RBP: ffffc90000007310 R08: 0000000000000000 R09: 0000000000000000 +[69133.562007] R10: ffffc90000007388 R11: ffffffff810cface R12: ffff888103a1b400 +[69133.562013] R13: 0000000000000000 R14: ffffffff82f33e2a R15: ffffffff82f33e28 +[69133.562020] FS: 00007f40f7131740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000 +[69133.562027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[69133.562033] CR2: 00007f40f7346ee0 CR3: 000000015d200001 CR4: 00000000001706f0 +[69133.562040] Call Trace: +[69133.562044] +[69133.562049] ? __warn+0x9f/0x1a0 +[ 1211.841384] ? __skb_flow_dissect+0x107e/0x2860 +[...] +[ 1211.841496] ? bpf_flow_dissect+0x160/0x160 +[ 1211.841753] __skb_get_hash+0x97/0x280 +[ 1211.841765] ? __skb_get_hash_symmetric+0x230/0x230 +[ 1211.841776] ? mod_find+0xbf/0xe0 +[ 1211.841786] ? get_stack_info_noinstr+0x12/0xe0 +[ 1211.841798] ? bpf_ksym_find+0x56/0xe0 +[ 1211.841807] ? __rcu_read_unlock+0x2a/0x70 +[ 1211.841819] nft_trace_init+0x1b9/0x1c0 [nf_tables] +[ 1211.841895] ? nft_trace_notify+0x830/0x830 [nf_tables] +[ 1211.841964] ? get_stack_info+0x2b/0x80 +[ 1211.841975] ? nft_do_chain_arp+0x80/0x80 [nf_tables] +[ 1211.842044] nft_do_chain+0x79c/0x850 [nf_tables] + +Fixes: 9b52e3f267a6 ("flow_dissector: handle no-skb use case") +Suggested-by: Willem de Bruijn +Signed-off-by: Pablo Neira Ayuso +Reviewed-by: Willem de Bruijn +Link: https://patch.msgid.link/20240715141442.43775-1-pablo@netfilter.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/flow_dissector.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index 0c85c8a9e752f..fba8eb1bb2815 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -1013,7 +1013,7 @@ bool __skb_flow_dissect(const struct net *net, + } + } + +- WARN_ON_ONCE(!net); ++ DEBUG_NET_WARN_ON_ONCE(!net); + if (net) { + enum netns_bpf_attach_type type = NETNS_BPF_FLOW_DISSECTOR; + struct bpf_prog_array *run_array; +-- +2.43.0 + diff --git a/queue-6.1/net-missing-check-virtio.patch b/queue-6.1/net-missing-check-virtio.patch new file mode 100644 index 00000000000..f98604d28a3 --- /dev/null +++ b/queue-6.1/net-missing-check-virtio.patch @@ -0,0 +1,119 @@ +From 9d4d7dd7a752450dd82e4580f5e13fd7b3865bb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 12:54:48 +0300 +Subject: net: missing check virtio + +From: Denis Arefev + +[ Upstream commit e269d79c7d35aa3808b1f3c1737d63dab504ddc8 ] + +Two missing check in virtio_net_hdr_to_skb() allowed syzbot +to crash kernels again + +1. After the skb_segment function the buffer may become non-linear +(nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere +the __skb_linearize function will not be executed, then the buffer will +remain non-linear. Then the condition (offset >= skb_headlen(skb)) +becomes true, which causes WARN_ON_ONCE in skb_checksum_help. + +2. The struct sk_buff and struct virtio_net_hdr members must be +mathematically related. +(gso_size) must be greater than (needed) otherwise WARN_ON_ONCE. +(remainder) must be greater than (needed) otherwise WARN_ON_ONCE. +(remainder) may be 0 if division is without remainder. + +offset+2 (4191) > skb_headlen() (1116) +WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 +Modules linked in: +CPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0 +Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 +RIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 +Code: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 <0f> 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef +RSP: 0018:ffffc90003a9f338 EFLAGS: 00010286 +RAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209 +RDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001 +RBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c +R13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d +FS: 0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777 + ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584 + ip_finish_output_gso net/ipv4/ip_output.c:286 [inline] + __ip_finish_output net/ipv4/ip_output.c:308 [inline] + __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295 + ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 + NF_HOOK_COND include/linux/netfilter.h:303 [inline] + ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433 + dst_output include/net/dst.h:451 [inline] + ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129 + iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 + ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline] + sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076 + __netdev_start_xmit include/linux/netdevice.h:4940 [inline] + netdev_start_xmit include/linux/netdevice.h:4954 [inline] + xmit_one net/core/dev.c:3545 [inline] + dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561 + __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346 + dev_queue_xmit include/linux/netdevice.h:3134 [inline] + packet_xmit+0x257/0x380 net/packet/af_packet.c:276 + packet_snd net/packet/af_packet.c:3087 [inline] + packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg+0xd5/0x180 net/socket.c:745 + __sys_sendto+0x255/0x340 net/socket.c:2190 + __do_sys_sendto net/socket.c:2202 [inline] + __se_sys_sendto net/socket.c:2198 [inline] + __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller + +Fixes: 0f6925b3e8da ("virtio_net: Do not pull payload in skb->head") +Signed-off-by: Denis Arefev +Message-Id: <20240613095448.27118-1-arefev@swemel.ru> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + include/linux/virtio_net.h | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h +index 6047058d67037..29b19d0a324c7 100644 +--- a/include/linux/virtio_net.h ++++ b/include/linux/virtio_net.h +@@ -51,6 +51,7 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, + unsigned int thlen = 0; + unsigned int p_off = 0; + unsigned int ip_proto; ++ u64 ret, remainder, gso_size; + + if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { + switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { +@@ -87,6 +88,16 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, + u32 off = __virtio16_to_cpu(little_endian, hdr->csum_offset); + u32 needed = start + max_t(u32, thlen, off + sizeof(__sum16)); + ++ if (hdr->gso_size) { ++ gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); ++ ret = div64_u64_rem(skb->len, gso_size, &remainder); ++ if (!(ret && (hdr->gso_size > needed) && ++ ((remainder > needed) || (remainder == 0)))) { ++ return -EINVAL; ++ } ++ skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG; ++ } ++ + if (!pskb_may_pull(skb, needed)) + return -EINVAL; + +-- +2.43.0 + diff --git a/queue-6.1/net-smc-set-rmb-s-sg_max_single_alloc-limitation-onl.patch b/queue-6.1/net-smc-set-rmb-s-sg_max_single_alloc-limitation-onl.patch new file mode 100644 index 00000000000..9ee5a0cccf8 --- /dev/null +++ b/queue-6.1/net-smc-set-rmb-s-sg_max_single_alloc-limitation-onl.patch @@ -0,0 +1,57 @@ +From b6b90f894aea1de6712f5cc726c24abc697d6a25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 11:00:18 +0800 +Subject: net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when + CONFIG_ARCH_NO_SG_CHAIN is defined + +From: Guangguan Wang + +[ Upstream commit 3ac14b9dfbd345e891d48d89f6c2fa519848f0f4 ] + +SG_MAX_SINGLE_ALLOC is used to limit maximum number of entries that +will be allocated in one piece of scatterlist. When the entries of +scatterlist exceeds SG_MAX_SINGLE_ALLOC, sg chain will be used. From +commit 7c703e54cc71 ("arch: switch the default on ARCH_HAS_SG_CHAIN"), +we can know that the macro CONFIG_ARCH_NO_SG_CHAIN is used to identify +whether sg chain is supported. So, SMC-R's rmb buffer should be limited +by SG_MAX_SINGLE_ALLOC only when the macro CONFIG_ARCH_NO_SG_CHAIN is +defined. + +Fixes: a3fe3d01bd0d ("net/smc: introduce sg-logic for RMBs") +Signed-off-by: Guangguan Wang +Co-developed-by: Wen Gu +Signed-off-by: Wen Gu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index 64b6dd439938e..10d79cb55528d 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -1959,7 +1959,6 @@ int smc_conn_create(struct smc_sock *smc, struct smc_init_info *ini) + */ + static u8 smc_compress_bufsize(int size, bool is_smcd, bool is_rmb) + { +- const unsigned int max_scat = SG_MAX_SINGLE_ALLOC * PAGE_SIZE; + u8 compressed; + + if (size <= SMC_BUF_MIN_SIZE) +@@ -1969,9 +1968,11 @@ static u8 smc_compress_bufsize(int size, bool is_smcd, bool is_rmb) + compressed = min_t(u8, ilog2(size) + 1, + is_smcd ? SMCD_DMBE_SIZES : SMCR_RMBE_SIZES); + ++#ifdef CONFIG_ARCH_NO_SG_CHAIN + if (!is_smcd && is_rmb) + /* RMBs are backed by & limited to max size of scatterlists */ +- compressed = min_t(u8, compressed, ilog2(max_scat >> 14)); ++ compressed = min_t(u8, compressed, ilog2((SG_MAX_SINGLE_ALLOC * PAGE_SIZE) >> 14)); ++#endif + + return compressed; + } +-- +2.43.0 + diff --git a/queue-6.1/netfilter-ctnetlink-use-helper-function-to-calculate.patch b/queue-6.1/netfilter-ctnetlink-use-helper-function-to-calculate.patch new file mode 100644 index 00000000000..e52d6e1f1ea --- /dev/null +++ b/queue-6.1/netfilter-ctnetlink-use-helper-function-to-calculate.patch @@ -0,0 +1,38 @@ +From 9dd1bdb79894c0997d4018333739beb4f0dc458e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jul 2024 16:47:38 +0200 +Subject: netfilter: ctnetlink: use helper function to calculate expect ID + +From: Pablo Neira Ayuso + +[ Upstream commit 782161895eb4ac45cf7cfa8db375bd4766cb8299 ] + +Delete expectation path is missing a call to the nf_expect_get_id() +helper function to calculate the expectation ID, otherwise LSB of the +expectation object address is leaked to userspace. + +Fixes: 3c79107631db ("netfilter: ctnetlink: don't use conntrack/expect object addresses as id") +Reported-by: zdi-disclosures@trendmicro.com +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_netlink.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 9ee8abd3e4b10..9672b0e00d6bf 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -3415,7 +3415,8 @@ static int ctnetlink_del_expect(struct sk_buff *skb, + + if (cda[CTA_EXPECT_ID]) { + __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); +- if (ntohl(id) != (u32)(unsigned long)exp) { ++ ++ if (id != nf_expect_get_id(exp)) { + nf_ct_expect_put(exp); + return -ENOENT; + } +-- +2.43.0 + diff --git a/queue-6.1/netfilter-nf_set_pipapo-fix-initial-map-fill.patch b/queue-6.1/netfilter-nf_set_pipapo-fix-initial-map-fill.patch new file mode 100644 index 00000000000..ba9c22e4d68 --- /dev/null +++ b/queue-6.1/netfilter-nf_set_pipapo-fix-initial-map-fill.patch @@ -0,0 +1,142 @@ +From 8986699b154b5c306b82f83142df2e2cf29e801c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 13:54:03 +0200 +Subject: netfilter: nf_set_pipapo: fix initial map fill + +From: Florian Westphal + +[ Upstream commit 791a615b7ad2258c560f91852be54b0480837c93 ] + +The initial buffer has to be inited to all-ones, but it must restrict +it to the size of the first field, not the total field size. + +After each round in the map search step, the result and the fill map +are swapped, so if we have a set where f->bsize of the first element +is smaller than m->bsize_max, those one-bits are leaked into future +rounds result map. + +This makes pipapo find an incorrect matching results for sets where +first field size is not the largest. + +Followup patch adds a test case to nft_concat_range.sh selftest script. + +Thanks to Stefano Brivio for pointing out that we need to zero out +the remainder explicitly, only correcting memset() argument isn't enough. + +Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") +Reported-by: Yi Chen +Cc: Stefano Brivio +Signed-off-by: Florian Westphal +Reviewed-by: Stefano Brivio +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_set_pipapo.c | 4 ++-- + net/netfilter/nft_set_pipapo.h | 21 +++++++++++++++++++++ + net/netfilter/nft_set_pipapo_avx2.c | 10 ++++++---- + 3 files changed, 29 insertions(+), 6 deletions(-) + +diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c +index 261b505e3b3fa..d9c1c467ea684 100644 +--- a/net/netfilter/nft_set_pipapo.c ++++ b/net/netfilter/nft_set_pipapo.c +@@ -432,7 +432,7 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, + res_map = scratch->map + (map_index ? m->bsize_max : 0); + fill_map = scratch->map + (map_index ? 0 : m->bsize_max); + +- memset(res_map, 0xff, m->bsize_max * sizeof(*res_map)); ++ pipapo_resmap_init(m, res_map); + + nft_pipapo_for_each_field(f, i, m) { + bool last = i == m->field_count - 1; +@@ -538,7 +538,7 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, + goto out; + } + +- memset(res_map, 0xff, m->bsize_max * sizeof(*res_map)); ++ pipapo_resmap_init(m, res_map); + + nft_pipapo_for_each_field(f, i, m) { + bool last = i == m->field_count - 1; +diff --git a/net/netfilter/nft_set_pipapo.h b/net/netfilter/nft_set_pipapo.h +index 73a4518308be4..519a2e6dc206f 100644 +--- a/net/netfilter/nft_set_pipapo.h ++++ b/net/netfilter/nft_set_pipapo.h +@@ -285,4 +285,25 @@ static u64 pipapo_estimate_size(const struct nft_set_desc *desc) + return size; + } + ++/** ++ * pipapo_resmap_init() - Initialise result map before first use ++ * @m: Matching data, including mapping table ++ * @res_map: Result map ++ * ++ * Initialize all bits covered by the first field to one, so that after ++ * the first step, only the matching bits of the first bit group remain. ++ * ++ * If other fields have a large bitmap, set remainder of res_map to 0. ++ */ ++static inline void pipapo_resmap_init(const struct nft_pipapo_match *m, unsigned long *res_map) ++{ ++ const struct nft_pipapo_field *f = m->f; ++ int i; ++ ++ for (i = 0; i < f->bsize; i++) ++ res_map[i] = ULONG_MAX; ++ ++ for (i = f->bsize; i < m->bsize_max; i++) ++ res_map[i] = 0ul; ++} + #endif /* _NFT_SET_PIPAPO_H */ +diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c +index d08407d589eac..8910a5ac7ed12 100644 +--- a/net/netfilter/nft_set_pipapo_avx2.c ++++ b/net/netfilter/nft_set_pipapo_avx2.c +@@ -1036,6 +1036,7 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, + + /** + * nft_pipapo_avx2_lookup_slow() - Fallback function for uncommon field sizes ++ * @mdata: Matching data, including mapping table + * @map: Previous match result, used as initial bitmap + * @fill: Destination bitmap to be filled with current match result + * @f: Field, containing lookup and mapping tables +@@ -1051,7 +1052,8 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, + * Return: -1 on no match, rule index of match if @last, otherwise first long + * word index to be checked next (i.e. first filled word). + */ +-static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill, ++static int nft_pipapo_avx2_lookup_slow(const struct nft_pipapo_match *mdata, ++ unsigned long *map, unsigned long *fill, + const struct nft_pipapo_field *f, + int offset, const u8 *pkt, + bool first, bool last) +@@ -1060,7 +1062,7 @@ static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill, + int i, ret = -1, b; + + if (first) +- memset(map, 0xff, bsize * sizeof(*map)); ++ pipapo_resmap_init(mdata, map); + + for (i = offset; i < bsize; i++) { + if (f->bb == 8) +@@ -1186,7 +1188,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, + } else if (f->groups == 16) { + NFT_SET_PIPAPO_AVX2_LOOKUP(8, 16); + } else { +- ret = nft_pipapo_avx2_lookup_slow(res, fill, f, ++ ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f, + ret, rp, + first, last); + } +@@ -1202,7 +1204,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, + } else if (f->groups == 32) { + NFT_SET_PIPAPO_AVX2_LOOKUP(4, 32); + } else { +- ret = nft_pipapo_avx2_lookup_slow(res, fill, f, ++ ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f, + ret, rp, + first, last); + } +-- +2.43.0 + diff --git a/queue-6.1/netfilter-nf_tables-rise-cap-on-selinux-secmark-cont.patch b/queue-6.1/netfilter-nf_tables-rise-cap-on-selinux-secmark-cont.patch new file mode 100644 index 00000000000..028026f2d19 --- /dev/null +++ b/queue-6.1/netfilter-nf_tables-rise-cap-on-selinux-secmark-cont.patch @@ -0,0 +1,34 @@ +From e5e0084d2a1b3644f6d429151bf1305dfd3cb641 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 20:16:59 +0200 +Subject: netfilter: nf_tables: rise cap on SELinux secmark context + +From: Pablo Neira Ayuso + +[ Upstream commit e29630247be24c3987e2b048f8e152771b32d38b ] + +secmark context is artificially limited 256 bytes, rise it to 4Kbytes. + +Fixes: fb961945457f ("netfilter: nf_tables: add SECMARK support") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter/nf_tables.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h +index 707af820f1a97..672b2e1b47f24 100644 +--- a/include/uapi/linux/netfilter/nf_tables.h ++++ b/include/uapi/linux/netfilter/nf_tables.h +@@ -1324,7 +1324,7 @@ enum nft_secmark_attributes { + #define NFTA_SECMARK_MAX (__NFTA_SECMARK_MAX - 1) + + /* Max security context length */ +-#define NFT_SECMARK_CTX_MAXLEN 256 ++#define NFT_SECMARK_CTX_MAXLEN 4096 + + /** + * enum nft_reject_types - nf_tables reject expression reject types +-- +2.43.0 + diff --git a/queue-6.1/netfilter-nft_set_pipapo-constify-lookup-fn-args-whe.patch b/queue-6.1/netfilter-nft_set_pipapo-constify-lookup-fn-args-whe.patch new file mode 100644 index 00000000000..d485ab92e7e --- /dev/null +++ b/queue-6.1/netfilter-nft_set_pipapo-constify-lookup-fn-args-whe.patch @@ -0,0 +1,265 @@ +From c016b3bbf1e6a7c49c179734bab1e35187a2aab1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 16:23:37 +0100 +Subject: netfilter: nft_set_pipapo: constify lookup fn args where possible + +From: Florian Westphal + +[ Upstream commit f04df573faf90bb828a2241b650598c02c074323 ] + +Those get called from packet path, content must not be modified. +No functional changes intended. + +Reviewed-by: Stefano Brivio +Signed-off-by: Florian Westphal +Stable-dep-of: 791a615b7ad2 ("netfilter: nf_set_pipapo: fix initial map fill") +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_set_pipapo.c | 18 +++++---- + net/netfilter/nft_set_pipapo.h | 6 +-- + net/netfilter/nft_set_pipapo_avx2.c | 59 +++++++++++++++++------------ + 3 files changed, 48 insertions(+), 35 deletions(-) + +diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c +index a56ed216c2233..261b505e3b3fa 100644 +--- a/net/netfilter/nft_set_pipapo.c ++++ b/net/netfilter/nft_set_pipapo.c +@@ -360,7 +360,7 @@ + * Return: -1 on no match, bit position on 'match_only', 0 otherwise. + */ + int pipapo_refill(unsigned long *map, int len, int rules, unsigned long *dst, +- union nft_pipapo_map_bucket *mt, bool match_only) ++ const union nft_pipapo_map_bucket *mt, bool match_only) + { + unsigned long bitset; + int k, ret = -1; +@@ -412,9 +412,9 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, + struct nft_pipapo_scratch *scratch; + unsigned long *res_map, *fill_map; + u8 genmask = nft_genmask_cur(net); ++ const struct nft_pipapo_match *m; ++ const struct nft_pipapo_field *f; + const u8 *rp = (const u8 *)key; +- struct nft_pipapo_match *m; +- struct nft_pipapo_field *f; + bool map_index; + int i; + +@@ -519,11 +519,13 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, + { + struct nft_pipapo_elem *ret = ERR_PTR(-ENOENT); + struct nft_pipapo *priv = nft_set_priv(set); +- struct nft_pipapo_match *m = priv->clone; + unsigned long *res_map, *fill_map = NULL; +- struct nft_pipapo_field *f; ++ const struct nft_pipapo_match *m; ++ const struct nft_pipapo_field *f; + int i; + ++ m = priv->clone; ++ + res_map = kmalloc_array(m->bsize_max, sizeof(*res_map), GFP_ATOMIC); + if (!res_map) { + ret = ERR_PTR(-ENOMEM); +@@ -1595,7 +1597,7 @@ static void pipapo_gc(const struct nft_set *_set, struct nft_pipapo_match *m) + + while ((rules_f0 = pipapo_rules_same_key(m->f, first_rule))) { + union nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS]; +- struct nft_pipapo_field *f; ++ const struct nft_pipapo_field *f; + int i, start, rules_fx; + + start = first_rule; +@@ -2041,8 +2043,8 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, + { + struct nft_pipapo *priv = nft_set_priv(set); + struct net *net = read_pnet(&set->net); +- struct nft_pipapo_match *m; +- struct nft_pipapo_field *f; ++ const struct nft_pipapo_match *m; ++ const struct nft_pipapo_field *f; + int i, r; + + rcu_read_lock(); +diff --git a/net/netfilter/nft_set_pipapo.h b/net/netfilter/nft_set_pipapo.h +index 30a3d092cd841..73a4518308be4 100644 +--- a/net/netfilter/nft_set_pipapo.h ++++ b/net/netfilter/nft_set_pipapo.h +@@ -185,7 +185,7 @@ struct nft_pipapo_elem { + }; + + int pipapo_refill(unsigned long *map, int len, int rules, unsigned long *dst, +- union nft_pipapo_map_bucket *mt, bool match_only); ++ const union nft_pipapo_map_bucket *mt, bool match_only); + + /** + * pipapo_and_field_buckets_4bit() - Intersect 4-bit buckets +@@ -193,7 +193,7 @@ int pipapo_refill(unsigned long *map, int len, int rules, unsigned long *dst, + * @dst: Area to store result + * @data: Input data selecting table buckets + */ +-static inline void pipapo_and_field_buckets_4bit(struct nft_pipapo_field *f, ++static inline void pipapo_and_field_buckets_4bit(const struct nft_pipapo_field *f, + unsigned long *dst, + const u8 *data) + { +@@ -221,7 +221,7 @@ static inline void pipapo_and_field_buckets_4bit(struct nft_pipapo_field *f, + * @dst: Area to store result + * @data: Input data selecting table buckets + */ +-static inline void pipapo_and_field_buckets_8bit(struct nft_pipapo_field *f, ++static inline void pipapo_and_field_buckets_8bit(const struct nft_pipapo_field *f, + unsigned long *dst, + const u8 *data) + { +diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c +index a3a8ddca99189..d08407d589eac 100644 +--- a/net/netfilter/nft_set_pipapo_avx2.c ++++ b/net/netfilter/nft_set_pipapo_avx2.c +@@ -212,8 +212,9 @@ static int nft_pipapo_avx2_refill(int offset, unsigned long *map, + * word index to be checked next (i.e. first filled word). + */ + static int nft_pipapo_avx2_lookup_4b_2(unsigned long *map, unsigned long *fill, +- struct nft_pipapo_field *f, int offset, +- const u8 *pkt, bool first, bool last) ++ const struct nft_pipapo_field *f, ++ int offset, const u8 *pkt, ++ bool first, bool last) + { + int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b; + u8 pg[2] = { pkt[0] >> 4, pkt[0] & 0xf }; +@@ -274,8 +275,9 @@ static int nft_pipapo_avx2_lookup_4b_2(unsigned long *map, unsigned long *fill, + * word index to be checked next (i.e. first filled word). + */ + static int nft_pipapo_avx2_lookup_4b_4(unsigned long *map, unsigned long *fill, +- struct nft_pipapo_field *f, int offset, +- const u8 *pkt, bool first, bool last) ++ const struct nft_pipapo_field *f, ++ int offset, const u8 *pkt, ++ bool first, bool last) + { + int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b; + u8 pg[4] = { pkt[0] >> 4, pkt[0] & 0xf, pkt[1] >> 4, pkt[1] & 0xf }; +@@ -350,8 +352,9 @@ static int nft_pipapo_avx2_lookup_4b_4(unsigned long *map, unsigned long *fill, + * word index to be checked next (i.e. first filled word). + */ + static int nft_pipapo_avx2_lookup_4b_8(unsigned long *map, unsigned long *fill, +- struct nft_pipapo_field *f, int offset, +- const u8 *pkt, bool first, bool last) ++ const struct nft_pipapo_field *f, ++ int offset, const u8 *pkt, ++ bool first, bool last) + { + u8 pg[8] = { pkt[0] >> 4, pkt[0] & 0xf, pkt[1] >> 4, pkt[1] & 0xf, + pkt[2] >> 4, pkt[2] & 0xf, pkt[3] >> 4, pkt[3] & 0xf, +@@ -445,8 +448,9 @@ static int nft_pipapo_avx2_lookup_4b_8(unsigned long *map, unsigned long *fill, + * word index to be checked next (i.e. first filled word). + */ + static int nft_pipapo_avx2_lookup_4b_12(unsigned long *map, unsigned long *fill, +- struct nft_pipapo_field *f, int offset, +- const u8 *pkt, bool first, bool last) ++ const struct nft_pipapo_field *f, ++ int offset, const u8 *pkt, ++ bool first, bool last) + { + u8 pg[12] = { pkt[0] >> 4, pkt[0] & 0xf, pkt[1] >> 4, pkt[1] & 0xf, + pkt[2] >> 4, pkt[2] & 0xf, pkt[3] >> 4, pkt[3] & 0xf, +@@ -534,8 +538,9 @@ static int nft_pipapo_avx2_lookup_4b_12(unsigned long *map, unsigned long *fill, + * word index to be checked next (i.e. first filled word). + */ + static int nft_pipapo_avx2_lookup_4b_32(unsigned long *map, unsigned long *fill, +- struct nft_pipapo_field *f, int offset, +- const u8 *pkt, bool first, bool last) ++ const struct nft_pipapo_field *f, ++ int offset, const u8 *pkt, ++ bool first, bool last) + { + u8 pg[32] = { pkt[0] >> 4, pkt[0] & 0xf, pkt[1] >> 4, pkt[1] & 0xf, + pkt[2] >> 4, pkt[2] & 0xf, pkt[3] >> 4, pkt[3] & 0xf, +@@ -669,8 +674,9 @@ static int nft_pipapo_avx2_lookup_4b_32(unsigned long *map, unsigned long *fill, + * word index to be checked next (i.e. first filled word). + */ + static int nft_pipapo_avx2_lookup_8b_1(unsigned long *map, unsigned long *fill, +- struct nft_pipapo_field *f, int offset, +- const u8 *pkt, bool first, bool last) ++ const struct nft_pipapo_field *f, ++ int offset, const u8 *pkt, ++ bool first, bool last) + { + int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b; + unsigned long *lt = f->lt, bsize = f->bsize; +@@ -726,8 +732,9 @@ static int nft_pipapo_avx2_lookup_8b_1(unsigned long *map, unsigned long *fill, + * word index to be checked next (i.e. first filled word). + */ + static int nft_pipapo_avx2_lookup_8b_2(unsigned long *map, unsigned long *fill, +- struct nft_pipapo_field *f, int offset, +- const u8 *pkt, bool first, bool last) ++ const struct nft_pipapo_field *f, ++ int offset, const u8 *pkt, ++ bool first, bool last) + { + int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b; + unsigned long *lt = f->lt, bsize = f->bsize; +@@ -790,8 +797,9 @@ static int nft_pipapo_avx2_lookup_8b_2(unsigned long *map, unsigned long *fill, + * word index to be checked next (i.e. first filled word). + */ + static int nft_pipapo_avx2_lookup_8b_4(unsigned long *map, unsigned long *fill, +- struct nft_pipapo_field *f, int offset, +- const u8 *pkt, bool first, bool last) ++ const struct nft_pipapo_field *f, ++ int offset, const u8 *pkt, ++ bool first, bool last) + { + int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b; + unsigned long *lt = f->lt, bsize = f->bsize; +@@ -865,8 +873,9 @@ static int nft_pipapo_avx2_lookup_8b_4(unsigned long *map, unsigned long *fill, + * word index to be checked next (i.e. first filled word). + */ + static int nft_pipapo_avx2_lookup_8b_6(unsigned long *map, unsigned long *fill, +- struct nft_pipapo_field *f, int offset, +- const u8 *pkt, bool first, bool last) ++ const struct nft_pipapo_field *f, ++ int offset, const u8 *pkt, ++ bool first, bool last) + { + int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b; + unsigned long *lt = f->lt, bsize = f->bsize; +@@ -950,8 +959,9 @@ static int nft_pipapo_avx2_lookup_8b_6(unsigned long *map, unsigned long *fill, + * word index to be checked next (i.e. first filled word). + */ + static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, +- struct nft_pipapo_field *f, int offset, +- const u8 *pkt, bool first, bool last) ++ const struct nft_pipapo_field *f, ++ int offset, const u8 *pkt, ++ bool first, bool last) + { + int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b; + unsigned long *lt = f->lt, bsize = f->bsize; +@@ -1042,8 +1052,9 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, + * word index to be checked next (i.e. first filled word). + */ + static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill, +- struct nft_pipapo_field *f, int offset, +- const u8 *pkt, bool first, bool last) ++ const struct nft_pipapo_field *f, ++ int offset, const u8 *pkt, ++ bool first, bool last) + { + unsigned long bsize = f->bsize; + int i, ret = -1, b; +@@ -1119,9 +1130,9 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, + struct nft_pipapo *priv = nft_set_priv(set); + struct nft_pipapo_scratch *scratch; + u8 genmask = nft_genmask_cur(net); ++ const struct nft_pipapo_match *m; ++ const struct nft_pipapo_field *f; + const u8 *rp = (const u8 *)key; +- struct nft_pipapo_match *m; +- struct nft_pipapo_field *f; + unsigned long *res, *fill; + bool map_index; + int i, ret = 0; +-- +2.43.0 + diff --git a/queue-6.1/nfsv4.1-another-fix-for-exchgid4_flag_use_pnfs_ds-fo.patch b/queue-6.1/nfsv4.1-another-fix-for-exchgid4_flag_use_pnfs_ds-fo.patch new file mode 100644 index 00000000000..f324ef36e94 --- /dev/null +++ b/queue-6.1/nfsv4.1-another-fix-for-exchgid4_flag_use_pnfs_ds-fo.patch @@ -0,0 +1,66 @@ +From 04abae5b84f7d3cf0e4a2b8a2bd8e9b6c219e975 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 09:28:27 -0400 +Subject: NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server + +From: Olga Kornievskaia + +[ Upstream commit 4840c00003a2275668a13b82c9f5b1aed80183aa ] + +Previously in order to mark the communication with the DS server, +we tried to use NFS_CS_DS in cl_flags. However, this flag would +only be saved for the DS server and in case where DS equals MDS, +the client would not find a matching nfs_client in nfs_match_client +that represents the MDS (but is also a DS). + +Instead, don't rely on the NFS_CS_DS but instead use NFS_CS_PNFS. + +Fixes: 379e4adfddd6 ("NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server") +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4client.c | 6 ++---- + fs/nfs/nfs4proc.c | 2 +- + 2 files changed, 3 insertions(+), 5 deletions(-) + +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 84b345efcec00..02caeec2c1739 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -230,9 +230,8 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) + __set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags); + __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags); + __set_bit(NFS_CS_NO_RETRANS_TIMEOUT, &clp->cl_flags); +- +- if (test_bit(NFS_CS_DS, &cl_init->init_flags)) +- __set_bit(NFS_CS_DS, &clp->cl_flags); ++ if (test_bit(NFS_CS_PNFS, &cl_init->init_flags)) ++ __set_bit(NFS_CS_PNFS, &clp->cl_flags); + /* + * Set up the connection to the server before we add add to the + * global list. +@@ -997,7 +996,6 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv, + if (mds_srv->flags & NFS_MOUNT_NORESVPORT) + __set_bit(NFS_CS_NORESVPORT, &cl_init.init_flags); + +- __set_bit(NFS_CS_DS, &cl_init.init_flags); + __set_bit(NFS_CS_PNFS, &cl_init.init_flags); + cl_init.max_connect = NFS_MAX_TRANSPORTS; + /* +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index cc620fc7aaf7b..467e9439ededb 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -8821,7 +8821,7 @@ nfs4_run_exchange_id(struct nfs_client *clp, const struct cred *cred, + #ifdef CONFIG_NFS_V4_1_MIGRATION + calldata->args.flags |= EXCHGID4_FLAG_SUPP_MOVED_MIGR; + #endif +- if (test_bit(NFS_CS_DS, &clp->cl_flags)) ++ if (test_bit(NFS_CS_PNFS, &clp->cl_flags)) + calldata->args.flags |= EXCHGID4_FLAG_USE_PNFS_DS; + msg.rpc_argp = &calldata->args; + msg.rpc_resp = &calldata->res; +-- +2.43.0 + diff --git a/queue-6.1/nilfs2-avoid-undefined-behavior-in-nilfs_cnt32_ge-ma.patch b/queue-6.1/nilfs2-avoid-undefined-behavior-in-nilfs_cnt32_ge-ma.patch new file mode 100644 index 00000000000..83d2a856dac --- /dev/null +++ b/queue-6.1/nilfs2-avoid-undefined-behavior-in-nilfs_cnt32_ge-ma.patch @@ -0,0 +1,47 @@ +From 67301c4fe7430183b17ecf469b1e1512ffac1731 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 03:35:12 +0900 +Subject: nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro + +From: Ryusuke Konishi + +[ Upstream commit 0f3819e8c483771a59cf9d3190cd68a7a990083c ] + +According to the C standard 3.4.3p3, the result of signed integer overflow +is undefined. The macro nilfs_cnt32_ge(), which compares two sequence +numbers, uses signed integer subtraction that can overflow, and therefore +the result of the calculation may differ from what is expected due to +undefined behavior in different environments. + +Similar to an earlier change to the jiffies-related comparison macros in +commit 5a581b367b5d ("jiffies: Avoid undefined behavior from signed +overflow"), avoid this potential issue by changing the definition of the +macro to perform the subtraction as unsigned integers, then cast the +result to a signed integer for comparison. + +Link: https://lkml.kernel.org/r/20130727225828.GA11864@linux.vnet.ibm.com +Link: https://lkml.kernel.org/r/20240702183512.6390-1-konishi.ryusuke@gmail.com +Fixes: 9ff05123e3bf ("nilfs2: segment constructor") +Signed-off-by: Ryusuke Konishi +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/nilfs2/segment.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c +index 04943ab40a011..5110c50be2918 100644 +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -136,7 +136,7 @@ static void nilfs_dispose_list(struct the_nilfs *, struct list_head *, int); + + #define nilfs_cnt32_ge(a, b) \ + (typecheck(__u32, a) && typecheck(__u32, b) && \ +- ((__s32)(a) - (__s32)(b) >= 0)) ++ ((__s32)((a) - (b)) >= 0)) + + static int nilfs_prepare_segment_lock(struct super_block *sb, + struct nilfs_transaction_info *ti) +-- +2.43.0 + diff --git a/queue-6.1/nvmet-auth-fix-nvmet_auth-hash-error-handling.patch b/queue-6.1/nvmet-auth-fix-nvmet_auth-hash-error-handling.patch new file mode 100644 index 00000000000..69026a9c623 --- /dev/null +++ b/queue-6.1/nvmet-auth-fix-nvmet_auth-hash-error-handling.patch @@ -0,0 +1,89 @@ +From 46afda19b221ce8a225588568e0836dbefa26262 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jul 2024 14:46:25 +0800 +Subject: nvmet-auth: fix nvmet_auth hash error handling + +From: Gaosheng Cui + +[ Upstream commit 89f58f96d1e2357601c092d85b40a2109cf25ef3 ] + +If we fail to call nvme_auth_augmented_challenge, or fail to kmalloc +for shash, we should free the memory allocation for challenge, so add +err path out_free_challenge to fix the memory leak. + +Fixes: 7a277c37d352 ("nvmet-auth: Diffie-Hellman key exchange support") +Signed-off-by: Gaosheng Cui +Reviewed-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/auth.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c +index e900525b78665..aacc05ec00c2b 100644 +--- a/drivers/nvme/target/auth.c ++++ b/drivers/nvme/target/auth.c +@@ -314,7 +314,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, + req->sq->dhchap_c1, + challenge, shash_len); + if (ret) +- goto out_free_response; ++ goto out_free_challenge; + } + + pr_debug("ctrl %d qid %d host response seq %u transaction %d\n", +@@ -325,7 +325,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, + GFP_KERNEL); + if (!shash) { + ret = -ENOMEM; +- goto out_free_response; ++ goto out_free_challenge; + } + shash->tfm = shash_tfm; + ret = crypto_shash_init(shash); +@@ -361,9 +361,10 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, + goto out; + ret = crypto_shash_final(shash, response); + out: ++ kfree(shash); ++out_free_challenge: + if (challenge != req->sq->dhchap_c1) + kfree(challenge); +- kfree(shash); + out_free_response: + kfree_sensitive(host_response); + out_free_tfm: +@@ -426,14 +427,14 @@ int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response, + req->sq->dhchap_c2, + challenge, shash_len); + if (ret) +- goto out_free_response; ++ goto out_free_challenge; + } + + shash = kzalloc(sizeof(*shash) + crypto_shash_descsize(shash_tfm), + GFP_KERNEL); + if (!shash) { + ret = -ENOMEM; +- goto out_free_response; ++ goto out_free_challenge; + } + shash->tfm = shash_tfm; + +@@ -470,9 +471,10 @@ int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response, + goto out; + ret = crypto_shash_final(shash, response); + out: ++ kfree(shash); ++out_free_challenge: + if (challenge != req->sq->dhchap_c2) + kfree(challenge); +- kfree(shash); + out_free_response: + kfree_sensitive(ctrl_response); + out_free_tfm: +-- +2.43.0 + diff --git a/queue-6.1/opp-ti-fix-ti_opp_supply_probe-wrong-return-values.patch b/queue-6.1/opp-ti-fix-ti_opp_supply_probe-wrong-return-values.patch new file mode 100644 index 00000000000..9ab3e190205 --- /dev/null +++ b/queue-6.1/opp-ti-fix-ti_opp_supply_probe-wrong-return-values.patch @@ -0,0 +1,43 @@ +From 828ed33646f8729b949531d1d6b5fc95116934e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 09:01:27 +0200 +Subject: OPP: ti: Fix ti_opp_supply_probe wrong return values + +From: Primoz Fiser + +[ Upstream commit 3a1ac6b8f603a9310274990a0ad563a5fb709f59 ] + +Function ti_opp_supply_probe() since commit 6baee034cb55 ("OPP: ti: +Migrate to dev_pm_opp_set_config_regulators()") returns wrong values +when all goes well and hence driver probing eventually fails. + +Fixes: 6baee034cb55 ("OPP: ti: Migrate to dev_pm_opp_set_config_regulators()") +Signed-off-by: Primoz Fiser +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/ti-opp-supply.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/opp/ti-opp-supply.c b/drivers/opp/ti-opp-supply.c +index 8f3f13fbbb25a..a8a696d2e03ab 100644 +--- a/drivers/opp/ti-opp-supply.c ++++ b/drivers/opp/ti-opp-supply.c +@@ -400,10 +400,12 @@ static int ti_opp_supply_probe(struct platform_device *pdev) + } + + ret = dev_pm_opp_set_config_regulators(cpu_dev, ti_opp_config_regulators); +- if (ret < 0) ++ if (ret < 0) { + _free_optimized_voltages(dev, &opp_data); ++ return ret; ++ } + +- return ret; ++ return 0; + } + + static struct platform_driver ti_opp_supply_driver = { +-- +2.43.0 + diff --git a/queue-6.1/pci-dwc-fix-index-0-incorrectly-being-interpreted-as.patch b/queue-6.1/pci-dwc-fix-index-0-incorrectly-being-interpreted-as.patch new file mode 100644 index 00000000000..2b32ed23950 --- /dev/null +++ b/queue-6.1/pci-dwc-fix-index-0-incorrectly-being-interpreted-as.patch @@ -0,0 +1,100 @@ +From c485b5ba027614cac226dcbfc184b7f10060bd97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 12:08:41 -0400 +Subject: PCI: dwc: Fix index 0 incorrectly being interpreted as a free ATU + slot +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frank Li + +[ Upstream commit c2a57ee0f2f1ad8c970ff58b78a43e85abbdeb7f ] + +When PERST# assert and deassert happens on the PERST# supported platforms, +both iATU0 and iATU6 will map inbound window to BAR0. DMA will access the +area that was previously allocated (iATU0) for BAR0, instead of the new +area (iATU6) for BAR0. + +Right now, this isn't an issue because both iATU0 and iATU6 should +translate inbound accesses to BAR0 to the same allocated memory area. +However, having two separate inbound mappings for the same BAR is a +disaster waiting to happen. + +The mappings between PCI BAR and iATU inbound window are maintained in the +dw_pcie_ep::bar_to_atu[] array. While allocating a new inbound iATU map for +a BAR, dw_pcie_ep_inbound_atu() API checks for the availability of the +existing mapping in the array and if it is not found (i.e., value in the +array indexed by the BAR is found to be 0), it allocates a new map value +using find_first_zero_bit(). + +The issue is the existing logic failed to consider the fact that the map +value '0' is a valid value for BAR0, so find_first_zero_bit() will return +'0' as the map value for BAR0 (note that it returns the first zero bit +position). + +Due to this, when PERST# assert + deassert happens on the PERST# supported +platforms, the inbound window allocation restarts from BAR0 and the +existing logic to find the BAR mapping will return '6' for BAR0 instead of +'0' due to the fact that it considers '0' as an invalid map value. + +Fix this issue by always incrementing the map value before assigning to +bar_to_atu[] array and then decrementing it while fetching. This will make +sure that the map value '0' always represents the invalid mapping." + +Fixes: 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address") +Closes: https://lore.kernel.org/linux-pci/ZXsRp+Lzg3x%2Fnhk3@x1-carbon/ +Link: https://lore.kernel.org/linux-pci/20240412160841.925927-1-Frank.Li@nxp.com +Reported-by: Niklas Cassel +Tested-by: Niklas Cassel +Signed-off-by: Frank Li +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-designware-ep.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c +index 506d6d061d4cd..449ad709495d3 100644 +--- a/drivers/pci/controller/dwc/pcie-designware-ep.c ++++ b/drivers/pci/controller/dwc/pcie-designware-ep.c +@@ -165,7 +165,7 @@ static int dw_pcie_ep_inbound_atu(struct dw_pcie_ep *ep, u8 func_no, int type, + if (!ep->bar_to_atu[bar]) + free_win = find_first_zero_bit(ep->ib_window_map, pci->num_ib_windows); + else +- free_win = ep->bar_to_atu[bar]; ++ free_win = ep->bar_to_atu[bar] - 1; + + if (free_win >= pci->num_ib_windows) { + dev_err(pci->dev, "No free inbound window\n"); +@@ -179,7 +179,11 @@ static int dw_pcie_ep_inbound_atu(struct dw_pcie_ep *ep, u8 func_no, int type, + return ret; + } + +- ep->bar_to_atu[bar] = free_win; ++ /* ++ * Always increment free_win before assignment, since value 0 is used to identify ++ * unallocated mapping. ++ */ ++ ep->bar_to_atu[bar] = free_win + 1; + set_bit(free_win, ep->ib_window_map); + + return 0; +@@ -216,7 +220,10 @@ static void dw_pcie_ep_clear_bar(struct pci_epc *epc, u8 func_no, u8 vfunc_no, + struct dw_pcie_ep *ep = epc_get_drvdata(epc); + struct dw_pcie *pci = to_dw_pcie_from_ep(ep); + enum pci_barno bar = epf_bar->barno; +- u32 atu_index = ep->bar_to_atu[bar]; ++ u32 atu_index = ep->bar_to_atu[bar] - 1; ++ ++ if (!ep->bar_to_atu[bar]) ++ return; + + __dw_pcie_ep_reset_bar(pci, func_no, bar, epf_bar->flags); + +-- +2.43.0 + diff --git a/queue-6.1/pci-endpoint-clean-up-error-handling-in-vpci_scan_bu.patch b/queue-6.1/pci-endpoint-clean-up-error-handling-in-vpci_scan_bu.patch new file mode 100644 index 00000000000..e6ce20dc7d1 --- /dev/null +++ b/queue-6.1/pci-endpoint-clean-up-error-handling-in-vpci_scan_bu.patch @@ -0,0 +1,68 @@ +From 55eedca768607589e75eed9912ce271e85355472 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jun 2024 12:33:39 +0300 +Subject: PCI: endpoint: Clean up error handling in vpci_scan_bus() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit 8e0f5a96c534f781e8c57ca30459448b3bfe5429 ] + +Smatch complains about inconsistent NULL checking in vpci_scan_bus(): + + drivers/pci/endpoint/functions/pci-epf-vntb.c:1024 vpci_scan_bus() error: we previously assumed 'vpci_bus' could be null (see line 1021) + +Instead of printing an error message and then crashing we should return +an error code and clean up. + +Also the NULL check is reversed so it prints an error for success +instead of failure. + +Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP") +Link: https://lore.kernel.org/linux-pci/68e0f6a4-fd57-45d0-945b-0876f2c8cb86@moroto.mountain +Signed-off-by: Dan Carpenter +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/pci-epf-vntb.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c +index b4c1a4f6029d4..3725cdfae1efa 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c ++++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c +@@ -1032,8 +1032,10 @@ static int vpci_scan_bus(void *sysdata) + struct epf_ntb *ndev = sysdata; + + vpci_bus = pci_scan_bus(ndev->vbus_number, &vpci_ops, sysdata); +- if (vpci_bus) +- pr_err("create pci bus\n"); ++ if (!vpci_bus) { ++ pr_err("create pci bus failed\n"); ++ return -EINVAL; ++ } + + pci_bus_add_devices(vpci_bus); + +@@ -1355,10 +1357,14 @@ static int epf_ntb_bind(struct pci_epf *epf) + goto err_bar_alloc; + } + +- vpci_scan_bus(ntb); ++ ret = vpci_scan_bus(ntb); ++ if (ret) ++ goto err_unregister; + + return 0; + ++err_unregister: ++ pci_unregister_driver(&vntb_pci_driver); + err_bar_alloc: + epf_ntb_config_spad_bar_free(ntb); + +-- +2.43.0 + diff --git a/queue-6.1/pci-endpoint-fix-error-handling-in-epf_ntb_epc_clean.patch b/queue-6.1/pci-endpoint-fix-error-handling-in-epf_ntb_epc_clean.patch new file mode 100644 index 00000000000..b3fe6b415e2 --- /dev/null +++ b/queue-6.1/pci-endpoint-fix-error-handling-in-epf_ntb_epc_clean.patch @@ -0,0 +1,67 @@ +From 4d6fcb2942e741314d886719d255875a3749b43e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jun 2024 12:33:49 +0300 +Subject: PCI: endpoint: Fix error handling in epf_ntb_epc_cleanup() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit 6bba3c0ac5dc54737998a0982b2e272242c87e0f ] + +There are two issues related to epf_ntb_epc_cleanup(): + + 1) It should call epf_ntb_config_sspad_bar_clear() + 2) The epf_ntb_bind() function should call epf_ntb_epc_cleanup() + to cleanup. + +I also changed the ordering a bit. Unwinding should be done in the +mirror order from how they are allocated. + +Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP") +Link: https://lore.kernel.org/linux-pci/aaffbe8d-7094-4083-8146-185f4a84e8a1@moroto.mountain +Signed-off-by: Dan Carpenter +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/pci-epf-vntb.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c +index 3725cdfae1efa..6708d2e789cb4 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c ++++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c +@@ -813,8 +813,9 @@ static int epf_ntb_epc_init(struct epf_ntb *ntb) + */ + static void epf_ntb_epc_cleanup(struct epf_ntb *ntb) + { +- epf_ntb_db_bar_clear(ntb); + epf_ntb_mw_bar_clear(ntb, ntb->num_mws); ++ epf_ntb_db_bar_clear(ntb); ++ epf_ntb_config_sspad_bar_clear(ntb); + } + + #define EPF_NTB_R(_name) \ +@@ -1354,7 +1355,7 @@ static int epf_ntb_bind(struct pci_epf *epf) + ret = pci_register_driver(&vntb_pci_driver); + if (ret) { + dev_err(dev, "failure register vntb pci driver\n"); +- goto err_bar_alloc; ++ goto err_epc_cleanup; + } + + ret = vpci_scan_bus(ntb); +@@ -1365,6 +1366,8 @@ static int epf_ntb_bind(struct pci_epf *epf) + + err_unregister: + pci_unregister_driver(&vntb_pci_driver); ++err_epc_cleanup: ++ epf_ntb_epc_cleanup(ntb); + err_bar_alloc: + epf_ntb_config_spad_bar_free(ntb); + +-- +2.43.0 + diff --git a/queue-6.1/pci-fix-resource-double-counting-on-remove-rescan.patch b/queue-6.1/pci-fix-resource-double-counting-on-remove-rescan.patch new file mode 100644 index 00000000000..72c813b745e --- /dev/null +++ b/queue-6.1/pci-fix-resource-double-counting-on-remove-rescan.patch @@ -0,0 +1,73 @@ +From d3d10b3b43b30789487f4a84eeb18bb626b0190a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 13:25:16 +0300 +Subject: PCI: Fix resource double counting on remove & rescan +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 903534fa7d30214d8ba840ab1cd9e917e0c88e41 ] + +pbus_size_mem() keeps the size of the optional resources in +children_add_size. When calculating the PCI bridge window size, +calculate_memsize() lower bounds size by old_size before adding +children_add_size and performing the window size alignment. This +results in double counting for the resources in children_add_size +because old_size may be based on the previous size of the bridge +window after it has already included children_add_size (that is, +size1 in pbus_size_mem() from an earlier invocation of that +function). + +As a result, on repeated remove of the bus & rescan cycles the resource +size keeps increasing when children_add_size is non-zero as can be seen +from this extract: + + iomem0: 23fffd00000-23fffdfffff : PCI Bus 0000:03 # 1MiB + iomem1: 20000000000-200001fffff : PCI Bus 0000:03 # 2MiB + iomem2: 20000000000-200002fffff : PCI Bus 0000:03 # 3MiB + iomem3: 20000000000-200003fffff : PCI Bus 0000:03 # 4MiB + iomem4: 20000000000-200004fffff : PCI Bus 0000:03 # 5MiB + +Solve the double counting by moving old_size check later in +calculate_memsize() so that children_add_size is already accounted for. + +After the patch, the bridge window retains its size as expected: + + iomem0: 23fffd00000-23fffdfffff : PCI Bus 0000:03 # 1MiB + iomem1: 20000000000-200000fffff : PCI Bus 0000:03 # 1MiB + iomem2: 20000000000-200000fffff : PCI Bus 0000:03 # 1MiB + +Fixes: a4ac9fea016f ("PCI : Calculate right add_size") +Link: https://lore.kernel.org/r/20240507102523.57320-2-ilpo.jarvinen@linux.intel.com +Tested-by: Lidong Wang +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Reviewed-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pci/setup-bus.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c +index c690572b10ce7..b8cb990044fb2 100644 +--- a/drivers/pci/setup-bus.c ++++ b/drivers/pci/setup-bus.c +@@ -824,11 +824,9 @@ static resource_size_t calculate_memsize(resource_size_t size, + size = min_size; + if (old_size == 1) + old_size = 0; +- if (size < old_size) +- size = old_size; + +- size = ALIGN(max(size, add_size) + children_add_size, align); +- return size; ++ size = max(size, add_size) + children_add_size; ++ return ALIGN(max(size, old_size), align); + } + + resource_size_t __weak pcibios_window_alignment(struct pci_bus *bus, +-- +2.43.0 + diff --git a/queue-6.1/pci-keystone-don-t-enable-bar-0-for-am654x.patch b/queue-6.1/pci-keystone-don-t-enable-bar-0-for-am654x.patch new file mode 100644 index 00000000000..0058151394c --- /dev/null +++ b/queue-6.1/pci-keystone-don-t-enable-bar-0-for-am654x.patch @@ -0,0 +1,113 @@ +From c4896f3042a766a99e27ff352ba63712f0c2b88b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 14:20:41 +0530 +Subject: PCI: keystone: Don't enable BAR 0 for AM654x +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Siddharth Vadapalli + +[ Upstream commit 9ffa0e70b2daf9b0271e4960b7c8a2350e2cda08 ] + +After 6ab15b5e7057 ("PCI: dwc: keystone: Convert .scan_bus() callback to +use add_bus"), ks_pcie_v3_65_add_bus() enabled BAR 0 for both v3.65a and +v4.90a devices. On the AM654x SoC, which uses v4.90a, enabling BAR 0 +causes Completion Timeouts when setting up MSI-X. These timeouts delay +boot of the AM654x by about 45 seconds. + +Move the BAR 0 initialization to ks_pcie_msi_host_init(), which is only +used for v3.65a devices, and remove ks_pcie_v3_65_add_bus(). + +[bhelgaas: commit log] +Fixes: 6ab15b5e7057 ("PCI: dwc: keystone: Convert .scan_bus() callback to use add_bus") +Link: https://lore.kernel.org/linux-pci/20240328085041.2916899-3-s-vadapalli@ti.com +Suggested-by: Bjorn Helgaas +Suggested-by: Niklas Cassel +Suggested-by: Serge Semin +Signed-off-by: Siddharth Vadapalli +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-keystone.c | 52 ++++++++--------------- + 1 file changed, 18 insertions(+), 34 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c +index 348a9f755d0ba..438aa5fa4c64b 100644 +--- a/drivers/pci/controller/dwc/pci-keystone.c ++++ b/drivers/pci/controller/dwc/pci-keystone.c +@@ -291,6 +291,24 @@ static void ks_pcie_clear_dbi_mode(struct keystone_pcie *ks_pcie) + + static int ks_pcie_msi_host_init(struct dw_pcie_rp *pp) + { ++ struct dw_pcie *pci = to_dw_pcie_from_pp(pp); ++ struct keystone_pcie *ks_pcie = to_keystone_pcie(pci); ++ ++ /* Configure and set up BAR0 */ ++ ks_pcie_set_dbi_mode(ks_pcie); ++ ++ /* Enable BAR0 */ ++ dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, 1); ++ dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, SZ_4K - 1); ++ ++ ks_pcie_clear_dbi_mode(ks_pcie); ++ ++ /* ++ * For BAR0, just setting bus address for inbound writes (MSI) should ++ * be sufficient. Use physical address to avoid any conflicts. ++ */ ++ dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, ks_pcie->app.start); ++ + pp->msi_irq_chip = &ks_pcie_msi_irq_chip; + return dw_pcie_allocate_domains(pp); + } +@@ -448,44 +466,10 @@ static struct pci_ops ks_child_pcie_ops = { + .write = pci_generic_config_write, + }; + +-/** +- * ks_pcie_v3_65_add_bus() - keystone add_bus post initialization +- * @bus: A pointer to the PCI bus structure. +- * +- * This sets BAR0 to enable inbound access for MSI_IRQ register +- */ +-static int ks_pcie_v3_65_add_bus(struct pci_bus *bus) +-{ +- struct dw_pcie_rp *pp = bus->sysdata; +- struct dw_pcie *pci = to_dw_pcie_from_pp(pp); +- struct keystone_pcie *ks_pcie = to_keystone_pcie(pci); +- +- if (!pci_is_root_bus(bus)) +- return 0; +- +- /* Configure and set up BAR0 */ +- ks_pcie_set_dbi_mode(ks_pcie); +- +- /* Enable BAR0 */ +- dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, 1); +- dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, SZ_4K - 1); +- +- ks_pcie_clear_dbi_mode(ks_pcie); +- +- /* +- * For BAR0, just setting bus address for inbound writes (MSI) should +- * be sufficient. Use physical address to avoid any conflicts. +- */ +- dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, ks_pcie->app.start); +- +- return 0; +-} +- + static struct pci_ops ks_pcie_ops = { + .map_bus = dw_pcie_own_conf_map_bus, + .read = pci_generic_config_read, + .write = pci_generic_config_write, +- .add_bus = ks_pcie_v3_65_add_bus, + }; + + /** +-- +2.43.0 + diff --git a/queue-6.1/pci-keystone-fix-null-pointer-dereference-in-case-of.patch b/queue-6.1/pci-keystone-fix-null-pointer-dereference-in-case-of.patch new file mode 100644 index 00000000000..08184e05b80 --- /dev/null +++ b/queue-6.1/pci-keystone-fix-null-pointer-dereference-in-case-of.patch @@ -0,0 +1,98 @@ +From 265775be1a0a65c3915b8f8408a25a0331383d4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 May 2024 09:15:17 +0300 +Subject: PCI: keystone: Fix NULL pointer dereference in case of DT error in + ks_pcie_setup_rc_app_regs() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Aleksandr Mishin + +[ Upstream commit a231707a91f323af1e5d9f1722055ec2fc1c7775 ] + +If IORESOURCE_MEM is not provided in Device Tree due to +any error, resource_list_first_type() will return NULL and +pci_parse_request_of_pci_ranges() will just emit a warning. + +This will cause a NULL pointer dereference. Fix this bug by adding NULL +return check. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 0f71c60ffd26 ("PCI: dwc: Remove storing of PCI resources") +Link: https://lore.kernel.org/linux-pci/20240505061517.11527-1-amishin@t-argos.ru +Suggested-by: Bjorn Helgaas +Suggested-by: Manivannan Sadhasivam +Signed-off-by: Aleksandr Mishin +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-keystone.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c +index 438aa5fa4c64b..6007ffcb4752a 100644 +--- a/drivers/pci/controller/dwc/pci-keystone.c ++++ b/drivers/pci/controller/dwc/pci-keystone.c +@@ -403,17 +403,22 @@ static const struct irq_domain_ops ks_pcie_legacy_irq_domain_ops = { + .xlate = irq_domain_xlate_onetwocell, + }; + +-static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) ++static int ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) + { + u32 val; + u32 num_viewport = ks_pcie->num_viewport; + struct dw_pcie *pci = ks_pcie->pci; + struct dw_pcie_rp *pp = &pci->pp; +- u64 start, end; ++ struct resource_entry *entry; + struct resource *mem; ++ u64 start, end; + int i; + +- mem = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM)->res; ++ entry = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM); ++ if (!entry) ++ return -ENODEV; ++ ++ mem = entry->res; + start = mem->start; + end = mem->end; + +@@ -424,7 +429,7 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) + ks_pcie_clear_dbi_mode(ks_pcie); + + if (ks_pcie->is_am6) +- return; ++ return 0; + + val = ilog2(OB_WIN_SIZE); + ks_pcie_app_writel(ks_pcie, OB_SIZE, val); +@@ -441,6 +446,8 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) + val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); + val |= OB_XLAT_EN_VAL; + ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); ++ ++ return 0; + } + + static void __iomem *ks_pcie_other_map_bus(struct pci_bus *bus, +@@ -802,7 +809,10 @@ static int __init ks_pcie_host_init(struct dw_pcie_rp *pp) + return ret; + + ks_pcie_stop_link(pci); +- ks_pcie_setup_rc_app_regs(ks_pcie); ++ ret = ks_pcie_setup_rc_app_regs(ks_pcie); ++ if (ret) ++ return ret; ++ + writew(PCI_IO_RANGE_TYPE_32 | (PCI_IO_RANGE_TYPE_32 << 8), + pci->dbi_base + PCI_IO_BASE); + +-- +2.43.0 + diff --git a/queue-6.1/pci-keystone-relocate-ks_pcie_set-clear_dbi_mode.patch b/queue-6.1/pci-keystone-relocate-ks_pcie_set-clear_dbi_mode.patch new file mode 100644 index 00000000000..99dc8f7118d --- /dev/null +++ b/queue-6.1/pci-keystone-relocate-ks_pcie_set-clear_dbi_mode.patch @@ -0,0 +1,130 @@ +From e90eb78e17de81a2bb35de8086f559a51690096e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 14:20:40 +0530 +Subject: PCI: keystone: Relocate ks_pcie_set/clear_dbi_mode() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Siddharth Vadapalli + +[ Upstream commit 5125fdc3292eea20870d4e6cefa62dc1245ce7ec ] + +Relocate ks_pcie_set_dbi_mode() and ks_pcie_clear_dbi_mode() to avoid +forward declaration in a subsequent patch. No functional change intended. + +Link: https://lore.kernel.org/linux-pci/20240328085041.2916899-2-s-vadapalli@ti.com +Signed-off-by: Siddharth Vadapalli +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Stable-dep-of: 9ffa0e70b2da ("PCI: keystone: Don't enable BAR 0 for AM654x") +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-keystone.c | 84 +++++++++++------------ + 1 file changed, 42 insertions(+), 42 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c +index 7ecad72cff7e7..348a9f755d0ba 100644 +--- a/drivers/pci/controller/dwc/pci-keystone.c ++++ b/drivers/pci/controller/dwc/pci-keystone.c +@@ -247,6 +247,48 @@ static struct irq_chip ks_pcie_msi_irq_chip = { + .irq_unmask = ks_pcie_msi_unmask, + }; + ++/** ++ * ks_pcie_set_dbi_mode() - Set DBI mode to access overlaid BAR mask registers ++ * @ks_pcie: A pointer to the keystone_pcie structure which holds the KeyStone ++ * PCIe host controller driver information. ++ * ++ * Since modification of dbi_cs2 involves different clock domain, read the ++ * status back to ensure the transition is complete. ++ */ ++static void ks_pcie_set_dbi_mode(struct keystone_pcie *ks_pcie) ++{ ++ u32 val; ++ ++ val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); ++ val |= DBI_CS2; ++ ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); ++ ++ do { ++ val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); ++ } while (!(val & DBI_CS2)); ++} ++ ++/** ++ * ks_pcie_clear_dbi_mode() - Disable DBI mode ++ * @ks_pcie: A pointer to the keystone_pcie structure which holds the KeyStone ++ * PCIe host controller driver information. ++ * ++ * Since modification of dbi_cs2 involves different clock domain, read the ++ * status back to ensure the transition is complete. ++ */ ++static void ks_pcie_clear_dbi_mode(struct keystone_pcie *ks_pcie) ++{ ++ u32 val; ++ ++ val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); ++ val &= ~DBI_CS2; ++ ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); ++ ++ do { ++ val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); ++ } while (val & DBI_CS2); ++} ++ + static int ks_pcie_msi_host_init(struct dw_pcie_rp *pp) + { + pp->msi_irq_chip = &ks_pcie_msi_irq_chip; +@@ -343,48 +385,6 @@ static const struct irq_domain_ops ks_pcie_legacy_irq_domain_ops = { + .xlate = irq_domain_xlate_onetwocell, + }; + +-/** +- * ks_pcie_set_dbi_mode() - Set DBI mode to access overlaid BAR mask registers +- * @ks_pcie: A pointer to the keystone_pcie structure which holds the KeyStone +- * PCIe host controller driver information. +- * +- * Since modification of dbi_cs2 involves different clock domain, read the +- * status back to ensure the transition is complete. +- */ +-static void ks_pcie_set_dbi_mode(struct keystone_pcie *ks_pcie) +-{ +- u32 val; +- +- val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); +- val |= DBI_CS2; +- ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); +- +- do { +- val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); +- } while (!(val & DBI_CS2)); +-} +- +-/** +- * ks_pcie_clear_dbi_mode() - Disable DBI mode +- * @ks_pcie: A pointer to the keystone_pcie structure which holds the KeyStone +- * PCIe host controller driver information. +- * +- * Since modification of dbi_cs2 involves different clock domain, read the +- * status back to ensure the transition is complete. +- */ +-static void ks_pcie_clear_dbi_mode(struct keystone_pcie *ks_pcie) +-{ +- u32 val; +- +- val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); +- val &= ~DBI_CS2; +- ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); +- +- do { +- val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); +- } while (val & DBI_CS2); +-} +- + static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) + { + u32 val; +-- +2.43.0 + diff --git a/queue-6.1/pci-qcom-ep-disable-resources-unconditionally-during.patch b/queue-6.1/pci-qcom-ep-disable-resources-unconditionally-during.patch new file mode 100644 index 00000000000..95ca0746bf7 --- /dev/null +++ b/queue-6.1/pci-qcom-ep-disable-resources-unconditionally-during.patch @@ -0,0 +1,52 @@ +From adbb3f170d4e26d828d256da84b2783eacd50545 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 11:43:42 +0530 +Subject: PCI: qcom-ep: Disable resources unconditionally during PERST# assert +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Manivannan Sadhasivam + +[ Upstream commit 912315715d7b74f7abdb6f063ebace44ee288af9 ] + +All EP specific resources are enabled during PERST# deassert. As a counter +operation, all resources should be disabled during PERST# assert. There is +no point in skipping that if the link was not enabled. + +This will also result in enablement of the resources twice if PERST# got +deasserted again. So remove the check from qcom_pcie_perst_assert() and +disable all the resources unconditionally. + +Fixes: f55fee56a631 ("PCI: qcom-ep: Add Qualcomm PCIe Endpoint controller driver") +Link: https://lore.kernel.org/linux-pci/20240430-pci-epf-rework-v4-1-22832d0d456f@linaro.org +Tested-by: Niklas Cassel +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-qcom-ep.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-qcom-ep.c b/drivers/pci/controller/dwc/pcie-qcom-ep.c +index 1c7fd05ce0280..f2bf3eba2254e 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom-ep.c ++++ b/drivers/pci/controller/dwc/pcie-qcom-ep.c +@@ -446,12 +446,6 @@ static int qcom_pcie_perst_deassert(struct dw_pcie *pci) + static void qcom_pcie_perst_assert(struct dw_pcie *pci) + { + struct qcom_pcie_ep *pcie_ep = to_pcie_ep(pci); +- struct device *dev = pci->dev; +- +- if (pcie_ep->link_status == QCOM_PCIE_EP_LINK_DISABLED) { +- dev_dbg(dev, "Link is already disabled\n"); +- return; +- } + + qcom_pcie_disable_resources(pcie_ep); + pcie_ep->link_status = QCOM_PCIE_EP_LINK_DISABLED; +-- +2.43.0 + diff --git a/queue-6.1/pci-rcar-demote-warn-to-dev_warn_ratelimited-in-rcar.patch b/queue-6.1/pci-rcar-demote-warn-to-dev_warn_ratelimited-in-rcar.patch new file mode 100644 index 00000000000..abad8e1795c --- /dev/null +++ b/queue-6.1/pci-rcar-demote-warn-to-dev_warn_ratelimited-in-rcar.patch @@ -0,0 +1,77 @@ +From 3a6601b6f7dad1febce1ab2451d26daffb66fd2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 May 2024 01:54:50 +0200 +Subject: PCI: rcar: Demote WARN() to dev_warn_ratelimited() in + rcar_pcie_wakeup() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit c93637e6a4c4e1d0e85ef7efac78d066bbb24d96 ] + +Avoid large backtrace, it is sufficient to warn the user that there has +been a link problem. Either the link has failed and the system is in need +of maintenance, or the link continues to work and user has been informed. +The message from the warning can be looked up in the sources. + +This makes an actual link issue less verbose. + +First of all, this controller has a limitation in that the controller +driver has to assist the hardware with transition to L1 link state by +writing L1IATN to PMCTRL register, the L1 and L0 link state switching +is not fully automatic on this controller. + +In case of an ASMedia ASM1062 PCIe SATA controller which does not support +ASPM, on entry to suspend or during platform pm_test, the SATA controller +enters D3hot state and the link enters L1 state. If the SATA controller +wakes up before rcar_pcie_wakeup() was called and returns to D0, the link +returns to L0 before the controller driver even started its transition to +L1 link state. At this point, the SATA controller did send an PM_ENTER_L1 +DLLP to the PCIe controller and the PCIe controller received it, and the +PCIe controller did set PMSR PMEL1RX bit. + +Once rcar_pcie_wakeup() is called, if the link is already back in L0 state +and PMEL1RX bit is set, the controller driver has no way to determine if +it should perform the link transition to L1 state, or treat the link as if +it is in L0 state. Currently the driver attempts to perform the transition +to L1 link state unconditionally, which in this specific case fails with a +PMSR L1FAEG poll timeout, however the link still works as it is already +back in L0 state. + +Reduce this warning verbosity. In case the link is really broken, the +rcar_pcie_config_access() would fail, otherwise it will succeed and any +system with this controller and ASM1062 can suspend without generating +a backtrace. + +Fixes: 84b576146294 ("PCI: rcar: Finish transition to L1 state in rcar_pcie_config_access()") +Link: https://lore.kernel.org/linux-pci/20240511235513.77301-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Marek Vasut +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-rcar-host.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pcie-rcar-host.c b/drivers/pci/controller/pcie-rcar-host.c +index e4faf90feaf5c..d0fe5076d9777 100644 +--- a/drivers/pci/controller/pcie-rcar-host.c ++++ b/drivers/pci/controller/pcie-rcar-host.c +@@ -92,7 +92,11 @@ static int rcar_pcie_wakeup(struct device *pcie_dev, void __iomem *pcie_base) + writel(L1IATN, pcie_base + PMCTLR); + ret = readl_poll_timeout_atomic(pcie_base + PMSR, val, + val & L1FAEG, 10, 1000); +- WARN(ret, "Timeout waiting for L1 link state, ret=%d\n", ret); ++ if (ret) { ++ dev_warn_ratelimited(pcie_dev, ++ "Timeout waiting for L1 link state, ret=%d\n", ++ ret); ++ } + writel(L1FAEG | PMEL1RX, pcie_base + PMSR); + } + +-- +2.43.0 + diff --git a/queue-6.1/perf-fix-default-aux_watermark-calculation.patch b/queue-6.1/perf-fix-default-aux_watermark-calculation.patch new file mode 100644 index 00000000000..ceeccd59eb2 --- /dev/null +++ b/queue-6.1/perf-fix-default-aux_watermark-calculation.patch @@ -0,0 +1,47 @@ +From 00368713ec4676441d9cc364168d18a787c808fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 23:11:00 +0300 +Subject: perf: Fix default aux_watermark calculation + +From: Adrian Hunter + +[ Upstream commit 43deb76b19663a96ec2189d8f4eb9a9dc2d7623f ] + +The default aux_watermark is half the AUX area buffer size. In general, +on a 64-bit architecture, the AUX area buffer size could be a bigger than +fits in a 32-bit type, but the calculation does not allow for that +possibility. + +However the aux_watermark value is recorded in a u32, so should not be +more than U32_MAX either. + +Fix by doing the calculation in a correctly sized type, and limiting the +result to U32_MAX. + +Fixes: d68e6799a5c8 ("perf: Cap allocation order at aux_watermark") +Signed-off-by: Adrian Hunter +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20240624201101.60186-7-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + kernel/events/ring_buffer.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c +index 45965f13757e4..f3a3c294ff2b3 100644 +--- a/kernel/events/ring_buffer.c ++++ b/kernel/events/ring_buffer.c +@@ -683,7 +683,9 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event, + * max_order, to aid PMU drivers in double buffering. + */ + if (!watermark) +- watermark = nr_pages << (PAGE_SHIFT - 1); ++ watermark = min_t(unsigned long, ++ U32_MAX, ++ (unsigned long)nr_pages << (PAGE_SHIFT - 1)); + + /* + * Use aux_watermark as the basis for chunking to +-- +2.43.0 + diff --git a/queue-6.1/perf-fix-perf_aux_size-for-greater-than-32-bit-size.patch b/queue-6.1/perf-fix-perf_aux_size-for-greater-than-32-bit-size.patch new file mode 100644 index 00000000000..9ac459f49ad --- /dev/null +++ b/queue-6.1/perf-fix-perf_aux_size-for-greater-than-32-bit-size.patch @@ -0,0 +1,37 @@ +From 1d9fb5d9fd3522d5e20bda0eb63ebc5a78aac08a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 23:10:58 +0300 +Subject: perf: Fix perf_aux_size() for greater-than 32-bit size + +From: Adrian Hunter + +[ Upstream commit 3df94a5b1078dfe2b0c03f027d018800faf44c82 ] + +perf_buffer->aux_nr_pages uses a 32-bit type, so a cast is needed to +calculate a 64-bit size. + +Fixes: 45bfb2e50471 ("perf: Add AUX area to ring buffer for raw data streams") +Signed-off-by: Adrian Hunter +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20240624201101.60186-5-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + kernel/events/internal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/internal.h b/kernel/events/internal.h +index 5150d5f84c033..386d21c7edfa0 100644 +--- a/kernel/events/internal.h ++++ b/kernel/events/internal.h +@@ -128,7 +128,7 @@ static inline unsigned long perf_data_size(struct perf_buffer *rb) + + static inline unsigned long perf_aux_size(struct perf_buffer *rb) + { +- return rb->aux_nr_pages << PAGE_SHIFT; ++ return (unsigned long)rb->aux_nr_pages << PAGE_SHIFT; + } + + #define __DEFINE_OUTPUT_COPY_BODY(advance_buf, memcpy_func, ...) \ +-- +2.43.0 + diff --git a/queue-6.1/perf-intel-pt-fix-aux_watermark-calculation-for-64-b.patch b/queue-6.1/perf-intel-pt-fix-aux_watermark-calculation-for-64-b.patch new file mode 100644 index 00000000000..fd5c4746220 --- /dev/null +++ b/queue-6.1/perf-intel-pt-fix-aux_watermark-calculation-for-64-b.patch @@ -0,0 +1,38 @@ +From 099c66b6f929098e1253046cac5a574de4e7c83c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 13:45:31 +0300 +Subject: perf intel-pt: Fix aux_watermark calculation for 64-bit size + +From: Adrian Hunter + +[ Upstream commit 36b4cd990a8fd3f5b748883050e9d8c69fe6398d ] + +aux_watermark is a u32. For a 64-bit size, cap the aux_watermark +calculation at UINT_MAX instead of truncating it to 32-bits. + +Fixes: 874fc35cdd55 ("perf intel-pt: Use aux_watermark") +Signed-off-by: Adrian Hunter +Link: https://lore.kernel.org/r/20240625104532.11990-2-adrian.hunter@intel.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/arch/x86/util/intel-pt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c +index af102f471e9f4..357eef045f3be 100644 +--- a/tools/perf/arch/x86/util/intel-pt.c ++++ b/tools/perf/arch/x86/util/intel-pt.c +@@ -780,7 +780,8 @@ static int intel_pt_recording_options(struct auxtrace_record *itr, + } + + if (!opts->auxtrace_snapshot_mode && !opts->auxtrace_sample_mode) { +- u32 aux_watermark = opts->auxtrace_mmap_pages * page_size / 4; ++ size_t aw = opts->auxtrace_mmap_pages * (size_t)page_size / 4; ++ u32 aux_watermark = aw > UINT_MAX ? UINT_MAX : aw; + + intel_pt_evsel->core.attr.aux_watermark = aux_watermark; + } +-- +2.43.0 + diff --git a/queue-6.1/perf-intel-pt-fix-exclude_guest-setting.patch b/queue-6.1/perf-intel-pt-fix-exclude_guest-setting.patch new file mode 100644 index 00000000000..15295e3d2bc --- /dev/null +++ b/queue-6.1/perf-intel-pt-fix-exclude_guest-setting.patch @@ -0,0 +1,69 @@ +From 6023a570dcc40fccacd5bac6735f37f9d49585f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 13:45:32 +0300 +Subject: perf intel-pt: Fix exclude_guest setting + +From: Adrian Hunter + +[ Upstream commit b40934ae32232140e85dc7dc1c3ea0e296986723 ] + +In the past, the exclude_guest setting has had no effect on Intel PT +tracing, but that may not be the case in the future. + +Set the flag correctly based upon whether KVM is using Intel PT +"Host/Guest" mode, which is determined by the kvm_intel module +parameter pt_mode: + + pt_mode=0 System-wide mode : host and guest output to host buffer + pt_mode=1 Host/Guest mode : host/guest output to host/guest + buffers respectively + +Fixes: 6e86bfdc4a60 ("perf intel-pt: Support decoding of guest kernel") +Signed-off-by: Adrian Hunter +Link: https://lore.kernel.org/r/20240625104532.11990-3-adrian.hunter@intel.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/arch/x86/util/intel-pt.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c +index 357eef045f3be..9daec588103bc 100644 +--- a/tools/perf/arch/x86/util/intel-pt.c ++++ b/tools/perf/arch/x86/util/intel-pt.c +@@ -32,6 +32,7 @@ + #include "../../../util/tsc.h" + #include // page_size + #include "../../../util/intel-pt.h" ++#include + + #define KiB(x) ((x) * 1024) + #define MiB(x) ((x) * 1024 * 1024) +@@ -440,6 +441,16 @@ static int intel_pt_track_switches(struct evlist *evlist) + return 0; + } + ++static bool intel_pt_exclude_guest(void) ++{ ++ int pt_mode; ++ ++ if (sysfs__read_int("module/kvm_intel/parameters/pt_mode", &pt_mode)) ++ pt_mode = 0; ++ ++ return pt_mode == 1; ++} ++ + static void intel_pt_valid_str(char *str, size_t len, u64 valid) + { + unsigned int val, last = 0, state = 1; +@@ -643,6 +654,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr, + } + evsel->core.attr.freq = 0; + evsel->core.attr.sample_period = 1; ++ evsel->core.attr.exclude_guest = intel_pt_exclude_guest(); + evsel->no_aux_samples = true; + evsel->needs_auxtrace_mmap = true; + intel_pt_evsel = evsel; +-- +2.43.0 + diff --git a/queue-6.1/perf-prevent-passing-zero-nr_pages-to-rb_alloc_aux.patch b/queue-6.1/perf-prevent-passing-zero-nr_pages-to-rb_alloc_aux.patch new file mode 100644 index 00000000000..5da0dbb2b01 --- /dev/null +++ b/queue-6.1/perf-prevent-passing-zero-nr_pages-to-rb_alloc_aux.patch @@ -0,0 +1,51 @@ +From e8966af33071b01d7043e2df904a77bd6adcbb11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 23:10:59 +0300 +Subject: perf: Prevent passing zero nr_pages to rb_alloc_aux() + +From: Adrian Hunter + +[ Upstream commit dbc48c8f41c208082cfa95e973560134489e3309 ] + +nr_pages is unsigned long but gets passed to rb_alloc_aux() as an int, +and is stored as an int. + +Only power-of-2 values are accepted, so if nr_pages is a 64_bit value, it +will be passed to rb_alloc_aux() as zero. + +That is not ideal because: + 1. the value is incorrect + 2. rb_alloc_aux() is at risk of misbehaving, although it manages to + return -ENOMEM in that case, it is a result of passing zero to get_order() + even though the get_order() result is documented to be undefined in that + case. + +Fix by simply validating the maximum supported value in the first place. +Use -ENOMEM error code for consistency with the current error code that +is returned in that case. + +Fixes: 45bfb2e50471 ("perf: Add AUX area to ring buffer for raw data streams") +Signed-off-by: Adrian Hunter +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20240624201101.60186-6-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 413a69aecf5c7..b8333b8e6a782 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -6307,6 +6307,8 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) + return -EINVAL; + + nr_pages = vma_size / PAGE_SIZE; ++ if (nr_pages > INT_MAX) ++ return -ENOMEM; + + mutex_lock(&event->mmap_mutex); + ret = -EINVAL; +-- +2.43.0 + diff --git a/queue-6.1/perf-report-fix-condition-in-sort__sym_cmp.patch b/queue-6.1/perf-report-fix-condition-in-sort__sym_cmp.patch new file mode 100644 index 00000000000..bfccda3ccce --- /dev/null +++ b/queue-6.1/perf-report-fix-condition-in-sort__sym_cmp.patch @@ -0,0 +1,42 @@ +From 0d3f6250af50e2868af5b0f5220dc989a23ee3dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 10:05:25 -0700 +Subject: perf report: Fix condition in sort__sym_cmp() + +From: Namhyung Kim + +[ Upstream commit cb39d05e67dc24985ff9f5150e71040fa4d60ab8 ] + +It's expected that both hist entries are in the same hists when +comparing two. But the current code in the function checks one without +dso sort key and other with the key. This would make the condition true +in any case. + +I guess the intention of the original commit was to add '!' for the +right side too. But as it should be the same, let's just remove it. + +Fixes: 69849fc5d2119 ("perf hists: Move sort__has_dso into struct perf_hpp_list") +Reviewed-by: Kan Liang +Signed-off-by: Namhyung Kim +Link: https://lore.kernel.org/r/20240621170528.608772-2-namhyung@kernel.org +Signed-off-by: Sasha Levin +--- + tools/perf/util/sort.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c +index 6882b17144994..1821c81892df5 100644 +--- a/tools/perf/util/sort.c ++++ b/tools/perf/util/sort.c +@@ -275,7 +275,7 @@ sort__sym_cmp(struct hist_entry *left, struct hist_entry *right) + * comparing symbol address alone is not enough since it's a + * relative address within a dso. + */ +- if (!hists__has(left->hists, dso) || hists__has(right->hists, dso)) { ++ if (!hists__has(left->hists, dso)) { + ret = sort__dso_cmp(left, right); + if (ret != 0) + return ret; +-- +2.43.0 + diff --git a/queue-6.1/perf-test-make-test_arm_callgraph_fp.sh-more-robust.patch b/queue-6.1/perf-test-make-test_arm_callgraph_fp.sh-more-robust.patch new file mode 100644 index 00000000000..dfdd5e55799 --- /dev/null +++ b/queue-6.1/perf-test-make-test_arm_callgraph_fp.sh-more-robust.patch @@ -0,0 +1,131 @@ +From be4520d4c5deb5001c6ef37a5ce93d21872eda25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 15:03:14 +0100 +Subject: perf test: Make test_arm_callgraph_fp.sh more robust + +From: James Clark + +[ Upstream commit ff16aeb9b83441b8458d4235496cf320189a0c60 ] + +The 2 second sleep can cause the test to fail on very slow network file +systems because Perf ends up being killed before it finishes starting +up. + +Fix it by making the leafloop workload end after a fixed time like the +other workloads so there is no need to kill it after 2 seconds. + +Also remove the 1 second start sampling delay because it is similarly +fragile. Instead, search through all samples for a matching one, rather +than just checking the first sample and hoping it's in the right place. + +Fixes: cd6382d82752 ("perf test arm64: Test unwinding using fame-pointer (fp) mode") +Signed-off-by: James Clark +Acked-by: Namhyung Kim +Cc: German Gomez +Cc: Spoorthy S +Cc: Kajol Jain +Signed-off-by: Namhyung Kim +Link: https://lore.kernel.org/r/20240612140316.3006660-1-james.clark@arm.com +Signed-off-by: Sasha Levin +--- + .../perf/tests/shell/test_arm_callgraph_fp.sh | 27 +++++++------------ + tools/perf/tests/workloads/leafloop.c | 20 +++++++++++--- + 2 files changed, 26 insertions(+), 21 deletions(-) + +diff --git a/tools/perf/tests/shell/test_arm_callgraph_fp.sh b/tools/perf/tests/shell/test_arm_callgraph_fp.sh +index 66dfdfdad553f..60cd35c73e47d 100755 +--- a/tools/perf/tests/shell/test_arm_callgraph_fp.sh ++++ b/tools/perf/tests/shell/test_arm_callgraph_fp.sh +@@ -14,28 +14,21 @@ cleanup_files() + + trap cleanup_files EXIT TERM INT + +-# Add a 1 second delay to skip samples that are not in the leaf() function + # shellcheck disable=SC2086 +-perf record -o "$PERF_DATA" --call-graph fp -e cycles//u -D 1000 --user-callchains -- $TEST_PROGRAM 2> /dev/null & +-PID=$! ++perf record -o "$PERF_DATA" --call-graph fp -e cycles//u --user-callchains -- $TEST_PROGRAM + +-echo " + Recording (PID=$PID)..." +-sleep 2 +-echo " + Stopping perf-record..." +- +-kill $PID +-wait $PID ++# Try opening the file so any immediate errors are visible in the log ++perf script -i "$PERF_DATA" -F comm,ip,sym | head -n4 + +-# expected perf-script output: ++# expected perf-script output if 'leaf' has been inserted correctly: + # +-# program ++# perf + # 728 leaf + # 753 parent + # 76c leafloop +-# ... ++# ... remaining stack to main() ... + +-perf script -i "$PERF_DATA" -F comm,ip,sym | head -n4 +-perf script -i "$PERF_DATA" -F comm,ip,sym | head -n4 | \ +- awk '{ if ($2 != "") sym[i++] = $2 } END { if (sym[0] != "leaf" || +- sym[1] != "parent" || +- sym[2] != "leafloop") exit 1 }' ++# Each frame is separated by a tab, some spaces and an address ++SEP="[[:space:]]+ [[:xdigit:]]+" ++perf script -i "$PERF_DATA" -F comm,ip,sym | tr '\n' ' ' | \ ++ grep -E -q "perf $SEP leaf $SEP parent $SEP leafloop" +diff --git a/tools/perf/tests/workloads/leafloop.c b/tools/perf/tests/workloads/leafloop.c +index 1bf5cc97649b0..f7561767e32cd 100644 +--- a/tools/perf/tests/workloads/leafloop.c ++++ b/tools/perf/tests/workloads/leafloop.c +@@ -1,6 +1,8 @@ + /* SPDX-License-Identifier: GPL-2.0 */ ++#include + #include + #include ++#include + #include "../tests.h" + + /* We want to check these symbols in perf script */ +@@ -8,10 +10,16 @@ noinline void leaf(volatile int b); + noinline void parent(volatile int b); + + static volatile int a; ++static volatile sig_atomic_t done; ++ ++static void sighandler(int sig __maybe_unused) ++{ ++ done = 1; ++} + + noinline void leaf(volatile int b) + { +- for (;;) ++ while (!done) + a += b; + } + +@@ -22,12 +30,16 @@ noinline void parent(volatile int b) + + static int leafloop(int argc, const char **argv) + { +- int c = 1; ++ int sec = 1; + + if (argc > 0) +- c = atoi(argv[0]); ++ sec = atoi(argv[0]); ++ ++ signal(SIGINT, sighandler); ++ signal(SIGALRM, sighandler); ++ alarm(sec); + +- parent(c); ++ parent(sec); + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.1/perf-test-replace-arm-callgraph-fp-test-workload-wit.patch b/queue-6.1/perf-test-replace-arm-callgraph-fp-test-workload-wit.patch new file mode 100644 index 00000000000..ad5582aff4d --- /dev/null +++ b/queue-6.1/perf-test-replace-arm-callgraph-fp-test-workload-wit.patch @@ -0,0 +1,97 @@ +From 87579c3dcc7b010e356be8fe72210093fd80eb2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Nov 2022 15:38:48 -0800 +Subject: perf test: Replace arm callgraph fp test workload with leafloop + +From: Namhyung Kim + +[ Upstream commit 7cf0b4a73a4a4f36bb4ef53d066b811b7621c635 ] + +So that it can get rid of requirement of a compiler. + +Reviewed-by: Leo Yan +Signed-off-by: Namhyung Kim +Tested-by: James Clark +Cc: Adrian Hunter +Cc: Athira Jajeev +Cc: German Gomez +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Peter Zijlstra +Cc: Zhengjun Xing +Link: https://lore.kernel.org/r/20221116233854.1596378-7-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: ff16aeb9b834 ("perf test: Make test_arm_callgraph_fp.sh more robust") +Signed-off-by: Sasha Levin +--- + .../perf/tests/shell/test_arm_callgraph_fp.sh | 34 ++----------------- + 1 file changed, 3 insertions(+), 31 deletions(-) + +diff --git a/tools/perf/tests/shell/test_arm_callgraph_fp.sh b/tools/perf/tests/shell/test_arm_callgraph_fp.sh +index ec108d45d3c61..e61d8deaa0c41 100755 +--- a/tools/perf/tests/shell/test_arm_callgraph_fp.sh ++++ b/tools/perf/tests/shell/test_arm_callgraph_fp.sh +@@ -4,44 +4,16 @@ + + lscpu | grep -q "aarch64" || exit 2 + +-if ! [ -x "$(command -v cc)" ]; then +- echo "failed: no compiler, install gcc" +- exit 2 +-fi +- + PERF_DATA=$(mktemp /tmp/__perf_test.perf.data.XXXXX) +-TEST_PROGRAM_SOURCE=$(mktemp /tmp/test_program.XXXXX.c) +-TEST_PROGRAM=$(mktemp /tmp/test_program.XXXXX) ++TEST_PROGRAM="perf test -w leafloop" + + cleanup_files() + { + rm -f $PERF_DATA +- rm -f $TEST_PROGRAM_SOURCE +- rm -f $TEST_PROGRAM + } + + trap cleanup_files exit term int + +-cat << EOF > $TEST_PROGRAM_SOURCE +-int a = 0; +-void leaf(void) { +- for (;;) +- a += a; +-} +-void parent(void) { +- leaf(); +-} +-int main(void) { +- parent(); +- return 0; +-} +-EOF +- +-echo " + Compiling test program ($TEST_PROGRAM)..." +- +-CFLAGS="-g -O0 -fno-inline -fno-omit-frame-pointer" +-cc $CFLAGS $TEST_PROGRAM_SOURCE -o $TEST_PROGRAM || exit 1 +- + # Add a 1 second delay to skip samples that are not in the leaf() function + perf record -o $PERF_DATA --call-graph fp -e cycles//u -D 1000 --user-callchains -- $TEST_PROGRAM 2> /dev/null & + PID=$! +@@ -58,11 +30,11 @@ wait $PID + # program + # 728 leaf + # 753 parent +-# 76c main ++# 76c leafloop + # ... + + perf script -i $PERF_DATA -F comm,ip,sym | head -n4 + perf script -i $PERF_DATA -F comm,ip,sym | head -n4 | \ + awk '{ if ($2 != "") sym[i++] = $2 } END { if (sym[0] != "leaf" || + sym[1] != "parent" || +- sym[2] != "main") exit 1 }' ++ sym[2] != "leafloop") exit 1 }' +-- +2.43.0 + diff --git a/queue-6.1/perf-tests-arm_callgraph_fp-address-shellcheck-warni.patch b/queue-6.1/perf-tests-arm_callgraph_fp-address-shellcheck-warni.patch new file mode 100644 index 00000000000..8ed1ccc5903 --- /dev/null +++ b/queue-6.1/perf-tests-arm_callgraph_fp-address-shellcheck-warni.patch @@ -0,0 +1,74 @@ +From 95fa541b0cb3b4cba864523dc52a9afebd61064e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 22:11:31 +0530 +Subject: perf tests arm_callgraph_fp: Address shellcheck warnings about signal + names and adding double quotes for expression +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Spoorthy S + +[ Upstream commit 1bb17b4c6c91ad4d9468247cf5f5464fa6440668 ] + +Running shellcheck -S on test_arm_calligraph_fp throws warnings SC2086 and SC3049, + +      $shellcheck -S warning tests/shell/test_arm_callgraph_fp.sh +         rm -f $PERF_DATA +            : Double quote to prevent globbing and word splitting. +         trap cleanup_files exit term int +       : In POSIX sh, using lower/mixed case for signal names is undefined. + +After fixing the warnings, + +      $shellcheck tests/shell/test_arm_callgraph_fp.sh +      $ echo $? +      0 + +To address the POSIX shell warnings added changes to convert Lowercase +signal names to uppercase in the script and double quoted the +command substitutions($fix to "$fix") to solve Globbing warnings. + +Signed-off-by: Spoorthy S +Cc: Disha Goel +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: John Garry +Cc: Madhavan Srinivasan +Cc: Namhyung Kim +Cc: Ravi Bangoria +Cc: linuxppc-dev@lists.ozlabs.org +Link: https://lore.kernel.org/r/20230613164145.50488-4-atrajeev@linux.vnet.ibm.com +Signed-off-by: Athira Rajeev +Signed-off-by: Kajol Jain +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: ff16aeb9b834 ("perf test: Make test_arm_callgraph_fp.sh more robust") +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/test_arm_callgraph_fp.sh | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/tests/shell/test_arm_callgraph_fp.sh b/tools/perf/tests/shell/test_arm_callgraph_fp.sh +index e61d8deaa0c41..1380e0d12dce3 100755 +--- a/tools/perf/tests/shell/test_arm_callgraph_fp.sh ++++ b/tools/perf/tests/shell/test_arm_callgraph_fp.sh +@@ -9,13 +9,13 @@ TEST_PROGRAM="perf test -w leafloop" + + cleanup_files() + { +- rm -f $PERF_DATA ++ rm -f "$PERF_DATA" + } + +-trap cleanup_files exit term int ++trap cleanup_files EXIT TERM INT + + # Add a 1 second delay to skip samples that are not in the leaf() function +-perf record -o $PERF_DATA --call-graph fp -e cycles//u -D 1000 --user-callchains -- $TEST_PROGRAM 2> /dev/null & ++perf record -o "$PERF_DATA" --call-graph fp -e cycles//u -D 1000 --user-callchains -- "$TEST_PROGRAM" 2> /dev/null & + PID=$! + + echo " + Recording (PID=$PID)..." +-- +2.43.0 + diff --git a/queue-6.1/perf-tests-fix-test_arm_callgraph_fp-variable-expans.patch b/queue-6.1/perf-tests-fix-test_arm_callgraph_fp-variable-expans.patch new file mode 100644 index 00000000000..1998199ebbb --- /dev/null +++ b/queue-6.1/perf-tests-fix-test_arm_callgraph_fp-variable-expans.patch @@ -0,0 +1,66 @@ +From c5db01b8462f8d6ee25844aa1d5a53341b32d39b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 11:18:09 +0100 +Subject: perf tests: Fix test_arm_callgraph_fp variable expansion + +From: James Clark + +[ Upstream commit 33fe7c08446af6dda0ff08ff4fa9c921e574477f ] + +$TEST_PROGRAM is a command with spaces so it's supposed to be word +split. The referenced fix to fix the shellcheck warnings incorrectly +quoted this string so unquote it to fix the test. + +At the same time silence the shellcheck warning for that line and fix +two more shellcheck errors at the end of the script. + +Fixes: 1bb17b4c6c91 ("perf tests arm_callgraph_fp: Address shellcheck warnings about signal names and adding double quotes for expression") +Signed-off-by: James Clark +Acked-by: Namhyung Kim +Cc: Mark Rutland +Cc: Ian Rogers +Cc: spoorts2@in.ibm.com +Cc: Peter Zijlstra +Cc: Adrian Hunter +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Kajol Jain +Cc: Alexander Shishkin +Cc: Athira Rajeev +Cc: Ingo Molnar +Link: https://lore.kernel.org/r/20230622101809.2431897-1-james.clark@arm.com +Signed-off-by: Namhyung Kim +Stable-dep-of: ff16aeb9b834 ("perf test: Make test_arm_callgraph_fp.sh more robust") +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/test_arm_callgraph_fp.sh | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/tests/shell/test_arm_callgraph_fp.sh b/tools/perf/tests/shell/test_arm_callgraph_fp.sh +index 1380e0d12dce3..66dfdfdad553f 100755 +--- a/tools/perf/tests/shell/test_arm_callgraph_fp.sh ++++ b/tools/perf/tests/shell/test_arm_callgraph_fp.sh +@@ -15,7 +15,8 @@ cleanup_files() + trap cleanup_files EXIT TERM INT + + # Add a 1 second delay to skip samples that are not in the leaf() function +-perf record -o "$PERF_DATA" --call-graph fp -e cycles//u -D 1000 --user-callchains -- "$TEST_PROGRAM" 2> /dev/null & ++# shellcheck disable=SC2086 ++perf record -o "$PERF_DATA" --call-graph fp -e cycles//u -D 1000 --user-callchains -- $TEST_PROGRAM 2> /dev/null & + PID=$! + + echo " + Recording (PID=$PID)..." +@@ -33,8 +34,8 @@ wait $PID + # 76c leafloop + # ... + +-perf script -i $PERF_DATA -F comm,ip,sym | head -n4 +-perf script -i $PERF_DATA -F comm,ip,sym | head -n4 | \ ++perf script -i "$PERF_DATA" -F comm,ip,sym | head -n4 ++perf script -i "$PERF_DATA" -F comm,ip,sym | head -n4 | \ + awk '{ if ($2 != "") sym[i++] = $2 } END { if (sym[0] != "leaf" || + sym[1] != "parent" || + sym[2] != "leafloop") exit 1 }' +-- +2.43.0 + diff --git a/queue-6.1/perf-x86-intel-cstate-fix-alderlake-raptorlake-meteo.patch b/queue-6.1/perf-x86-intel-cstate-fix-alderlake-raptorlake-meteo.patch new file mode 100644 index 00000000000..56e16decfed --- /dev/null +++ b/queue-6.1/perf-x86-intel-cstate-fix-alderlake-raptorlake-meteo.patch @@ -0,0 +1,63 @@ +From 5de52c39fda4a77883e34d7b757c47bea5d16a6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 11:17:56 +0800 +Subject: perf/x86/intel/cstate: Fix Alderlake/Raptorlake/Meteorlake + +From: Zhang Rui + +[ Upstream commit 2c3aedd9db6295619d21e50ad29efda614023bf1 ] + +For Alderlake, the spec changes after the patch submitted and PC7/PC9 +are removed. + +Raptorlake and Meteorlake, which copy the Alderlake cstate PMU, also +don't have PC7/PC9. + +Remove PC7/PC9 support for Alderlake/Raptorlake/Meteorlake. + +Fixes: d0ca946bcf84 ("perf/x86/cstate: Add Alder Lake CPU support") +Signed-off-by: Zhang Rui +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kan Liang +Link: https://lore.kernel.org/r/20240628031758.43103-2-rui.zhang@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/cstate.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c +index 551741e79e038..8175bff77efa7 100644 +--- a/arch/x86/events/intel/cstate.c ++++ b/arch/x86/events/intel/cstate.c +@@ -80,7 +80,7 @@ + * MSR_PKG_C7_RESIDENCY: Package C7 Residency Counter. + * perf code: 0x03 + * Available model: NHM,WSM,SNB,IVB,HSW,BDW,SKL,CNL, +- * KBL,CML,ICL,TGL,RKL,ADL,RPL,MTL ++ * KBL,CML,ICL,TGL,RKL + * Scope: Package (physical package) + * MSR_PKG_C8_RESIDENCY: Package C8 Residency Counter. + * perf code: 0x04 +@@ -89,8 +89,7 @@ + * Scope: Package (physical package) + * MSR_PKG_C9_RESIDENCY: Package C9 Residency Counter. + * perf code: 0x05 +- * Available model: HSW ULT,KBL,CNL,CML,ICL,TGL,RKL, +- * ADL,RPL,MTL ++ * Available model: HSW ULT,KBL,CNL,CML,ICL,TGL,RKL + * Scope: Package (physical package) + * MSR_PKG_C10_RESIDENCY: Package C10 Residency Counter. + * perf code: 0x06 +@@ -584,9 +583,7 @@ static const struct cstate_model adl_cstates __initconst = { + .pkg_events = BIT(PERF_CSTATE_PKG_C2_RES) | + BIT(PERF_CSTATE_PKG_C3_RES) | + BIT(PERF_CSTATE_PKG_C6_RES) | +- BIT(PERF_CSTATE_PKG_C7_RES) | + BIT(PERF_CSTATE_PKG_C8_RES) | +- BIT(PERF_CSTATE_PKG_C9_RES) | + BIT(PERF_CSTATE_PKG_C10_RES), + }; + +-- +2.43.0 + diff --git a/queue-6.1/perf-x86-intel-pt-fix-pt_topa_entry_for_page-address.patch b/queue-6.1/perf-x86-intel-pt-fix-pt_topa_entry_for_page-address.patch new file mode 100644 index 00000000000..a84a79a7323 --- /dev/null +++ b/queue-6.1/perf-x86-intel-pt-fix-pt_topa_entry_for_page-address.patch @@ -0,0 +1,42 @@ +From 510b1d869a5f59ef89e7df108adfd7aa47e45cb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 23:10:57 +0300 +Subject: perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation + +From: Adrian Hunter + +[ Upstream commit 3520b251dcae2b4a27b95cd6f745c54fd658bda5 ] + +Currently, perf allocates an array of page pointers which is limited in +size by MAX_PAGE_ORDER. That in turn limits the maximum Intel PT buffer +size to 2GiB. Should that limitation be lifted, the Intel PT driver can +support larger sizes, except for one calculation in +pt_topa_entry_for_page(), which is limited to 32-bits. + +Fix pt_topa_entry_for_page() address calculation by adding a cast. + +Fixes: 39152ee51b77 ("perf/x86/intel/pt: Get rid of reverse lookup table for ToPA") +Signed-off-by: Adrian Hunter +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20240624201101.60186-4-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/pt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c +index 42a55794004a7..e347e56030fd9 100644 +--- a/arch/x86/events/intel/pt.c ++++ b/arch/x86/events/intel/pt.c +@@ -989,7 +989,7 @@ pt_topa_entry_for_page(struct pt_buffer *buf, unsigned int pg) + * order allocations, there shouldn't be many of these. + */ + list_for_each_entry(topa, &buf->tables, list) { +- if (topa->offset + topa->size > pg << PAGE_SHIFT) ++ if (topa->offset + topa->size > (unsigned long)pg << PAGE_SHIFT) + goto found; + } + +-- +2.43.0 + diff --git a/queue-6.1/perf-x86-serialize-set_attr_rdpmc.patch b/queue-6.1/perf-x86-serialize-set_attr_rdpmc.patch new file mode 100644 index 00000000000..77b49f307db --- /dev/null +++ b/queue-6.1/perf-x86-serialize-set_attr_rdpmc.patch @@ -0,0 +1,70 @@ +From 91b03b8c750d9080fb278f83ddb69d04de7b4a9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jun 2024 14:46:35 +0200 +Subject: perf/x86: Serialize set_attr_rdpmc() + +From: Thomas Gleixner + +[ Upstream commit bb9bb45f746b0f9457de9c3fc4da143a6351bdc9 ] + +Yue and Xingwei reported a jump label failure. It's caused by the lack of +serialization in set_attr_rdpmc(): + +CPU0 CPU1 + +Assume: x86_pmu.attr_rdpmc == 0 + +if (val != x86_pmu.attr_rdpmc) { + if (val == 0) + ... + else if (x86_pmu.attr_rdpmc == 0) + static_branch_dec(&rdpmc_never_available_key); + + if (val != x86_pmu.attr_rdpmc) { + if (val == 0) + ... + else if (x86_pmu.attr_rdpmc == 0) + FAIL, due to imbalance ---> static_branch_dec(&rdpmc_never_available_key); + +The reported BUG() is a consequence of the above and of another bug in the +jump label core code. The core code needs a separate fix, but that cannot +prevent the imbalance problem caused by set_attr_rdpmc(). + +Prevent this by serializing set_attr_rdpmc() locally. + +Fixes: a66734297f78 ("perf/x86: Add /sys/devices/cpu/rdpmc=2 to allow rdpmc for all tasks") +Closes: https://lore.kernel.org/r/CAEkJfYNzfW1vG=ZTMdz_Weoo=RXY1NDunbxnDaLyj8R4kEoE_w@mail.gmail.com +Reported-by: Yue Sun +Reported-by: Xingwei Lee +Signed-off-by: Thomas Gleixner +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20240610124406.359476013@linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/events/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index 1394312b732a3..2b2c9fd74ef90 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -2573,6 +2573,7 @@ static ssize_t set_attr_rdpmc(struct device *cdev, + struct device_attribute *attr, + const char *buf, size_t count) + { ++ static DEFINE_MUTEX(rdpmc_mutex); + unsigned long val; + ssize_t ret; + +@@ -2586,6 +2587,8 @@ static ssize_t set_attr_rdpmc(struct device *cdev, + if (x86_pmu.attr_rdpmc_broken) + return -ENOTSUPP; + ++ guard(mutex)(&rdpmc_mutex); ++ + if (val != x86_pmu.attr_rdpmc) { + /* + * Changing into or out of never available or always available, +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-core-fix-possible-memory-leak-when-pinctrl_e.patch b/queue-6.1/pinctrl-core-fix-possible-memory-leak-when-pinctrl_e.patch new file mode 100644 index 00000000000..aa9fe5dec17 --- /dev/null +++ b/queue-6.1/pinctrl-core-fix-possible-memory-leak-when-pinctrl_e.patch @@ -0,0 +1,59 @@ +From b444927b204a571eafc021a98d2a86af54494d59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:37:02 +0800 +Subject: pinctrl: core: fix possible memory leak when pinctrl_enable() fails + +From: Yang Yingliang + +[ Upstream commit ae1cf4759972c5fe665ee4c5e0c29de66fe3cf4a ] + +In devm_pinctrl_register(), if pinctrl_enable() fails in pinctrl_register(), +the "pctldev" has not been added to dev resources, so devm_pinctrl_dev_release() +can not be called, it leads memory leak. + +Introduce pinctrl_uninit_controller(), call it in the error path to free memory. + +Fixes: 5038a66dad01 ("pinctrl: core: delete incorrect free in pinctrl_enable()") +Signed-off-by: Yang Yingliang +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20240606023704.3931561-2-yangyingliang@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/core.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index db5fc55a5c964..3b6051d632181 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -2062,6 +2062,14 @@ pinctrl_init_controller(struct pinctrl_desc *pctldesc, struct device *dev, + return ERR_PTR(ret); + } + ++static void pinctrl_uninit_controller(struct pinctrl_dev *pctldev, struct pinctrl_desc *pctldesc) ++{ ++ pinctrl_free_pindescs(pctldev, pctldesc->pins, ++ pctldesc->npins); ++ mutex_destroy(&pctldev->mutex); ++ kfree(pctldev); ++} ++ + static int pinctrl_claim_hogs(struct pinctrl_dev *pctldev) + { + pctldev->p = create_pinctrl(pctldev->dev, pctldev); +@@ -2142,8 +2150,10 @@ struct pinctrl_dev *pinctrl_register(struct pinctrl_desc *pctldesc, + return pctldev; + + error = pinctrl_enable(pctldev); +- if (error) ++ if (error) { ++ pinctrl_uninit_controller(pctldev, pctldesc); + return ERR_PTR(error); ++ } + + return pctldev; + } +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-freescale-mxs-fix-refcount-of-child.patch b/queue-6.1/pinctrl-freescale-mxs-fix-refcount-of-child.patch new file mode 100644 index 00000000000..1d7eb523134 --- /dev/null +++ b/queue-6.1/pinctrl-freescale-mxs-fix-refcount-of-child.patch @@ -0,0 +1,43 @@ +From 1ce486ca3ede304f383f76e6128ae301f8d4f43f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 21:20:16 +0800 +Subject: pinctrl: freescale: mxs: Fix refcount of child + +From: Peng Fan + +[ Upstream commit 7f500f2011c0bbb6e1cacab74b4c99222e60248e ] + +of_get_next_child() will increase refcount of the returned node, need +use of_node_put() on it when done. + +Per current implementation, 'child' will be override by +for_each_child_of_node(np, child), so use of_get_child_count to avoid +refcount leakage. + +Fixes: 17723111e64f ("pinctrl: add pinctrl-mxs support") +Signed-off-by: Peng Fan +Link: https://lore.kernel.org/20240504-pinctrl-cleanup-v2-18-26c5f2dc1181@nxp.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/freescale/pinctrl-mxs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/freescale/pinctrl-mxs.c b/drivers/pinctrl/freescale/pinctrl-mxs.c +index 735cedd0958a2..5b0fcf15f2804 100644 +--- a/drivers/pinctrl/freescale/pinctrl-mxs.c ++++ b/drivers/pinctrl/freescale/pinctrl-mxs.c +@@ -405,8 +405,8 @@ static int mxs_pinctrl_probe_dt(struct platform_device *pdev, + int ret; + u32 val; + +- child = of_get_next_child(np, NULL); +- if (!child) { ++ val = of_get_child_count(np); ++ if (val == 0) { + dev_err(&pdev->dev, "no group is defined\n"); + return -ENOENT; + } +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-renesas-r8a779g0-fix-canfd5-suffix.patch b/queue-6.1/pinctrl-renesas-r8a779g0-fix-canfd5-suffix.patch new file mode 100644 index 00000000000..18d53cdd3b4 --- /dev/null +++ b/queue-6.1/pinctrl-renesas-r8a779g0-fix-canfd5-suffix.patch @@ -0,0 +1,97 @@ +From 9ba703bd97a7d67352e0f7db181bfda1dc6691eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:48 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix CANFD5 suffix + +From: Geert Uytterhoeven + +[ Upstream commit 77fa9007ac31e80674beadc452d3f3614f283e18 ] + +CAN-FD instance 5 has two alternate pin groups: "canfd5" and "canfd5_b". +Rename the former to "canfd5_a" to increase uniformity. + +While at it, remove the unneeded separator. + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 050442ae4c74f830 ("pinctrl: renesas: r8a779g0: Add pins, groups and functions") +Fixes: c2b4b2cd632d17e7 ("pinctrl: renesas: r8a779g0: Add missing CANFD5_B") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/10b22d54086ed11cdfeb0004583029ccf249bdb9.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 24 +++++++++++------------- + 1 file changed, 11 insertions(+), 13 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index acf7664ea835b..245212ebbfc9c 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -335,8 +335,8 @@ + /* IP0SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP0SR2_3_0 FM(FXR_TXDA) FM(CANFD1_TX) FM(TPU0TO2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_7_4 FM(FXR_TXENA_N) FM(CANFD1_RX) FM(TPU0TO3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_11_8 FM(RXDA_EXTFXR) FM(CANFD5_TX) FM(IRQ5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_15_12 FM(CLK_EXTFXR) FM(CANFD5_RX) FM(IRQ4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_11_8 FM(RXDA_EXTFXR) FM(CANFD5_TX_A) FM(IRQ5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_15_12 FM(CLK_EXTFXR) FM(CANFD5_RX_A) FM(IRQ4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_19_16 FM(RXDB_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_23_20 FM(FXR_TXENB_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_27_24 FM(FXR_TXDB) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -890,11 +890,11 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP0SR2_7_4, TPU0TO3_A), + + PINMUX_IPSR_GPSR(IP0SR2_11_8, RXDA_EXTFXR), +- PINMUX_IPSR_GPSR(IP0SR2_11_8, CANFD5_TX), ++ PINMUX_IPSR_GPSR(IP0SR2_11_8, CANFD5_TX_A), + PINMUX_IPSR_GPSR(IP0SR2_11_8, IRQ5), + + PINMUX_IPSR_GPSR(IP0SR2_15_12, CLK_EXTFXR), +- PINMUX_IPSR_GPSR(IP0SR2_15_12, CANFD5_RX), ++ PINMUX_IPSR_GPSR(IP0SR2_15_12, CANFD5_RX_A), + PINMUX_IPSR_GPSR(IP0SR2_15_12, IRQ4_B), + + PINMUX_IPSR_GPSR(IP0SR2_19_16, RXDB_EXTFXR), +@@ -1507,15 +1507,14 @@ static const unsigned int canfd4_data_mux[] = { + }; + + /* - CANFD5 ----------------------------------------------------------------- */ +-static const unsigned int canfd5_data_pins[] = { +- /* CANFD5_TX, CANFD5_RX */ ++static const unsigned int canfd5_data_a_pins[] = { ++ /* CANFD5_TX_A, CANFD5_RX_A */ + RCAR_GP_PIN(2, 2), RCAR_GP_PIN(2, 3), + }; +-static const unsigned int canfd5_data_mux[] = { +- CANFD5_TX_MARK, CANFD5_RX_MARK, ++static const unsigned int canfd5_data_a_mux[] = { ++ CANFD5_TX_A_MARK, CANFD5_RX_A_MARK, + }; + +-/* - CANFD5_B ----------------------------------------------------------------- */ + static const unsigned int canfd5_data_b_pins[] = { + /* CANFD5_TX_B, CANFD5_RX_B */ + RCAR_GP_PIN(1, 8), RCAR_GP_PIN(1, 9), +@@ -2551,8 +2550,8 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(canfd2_data), + SH_PFC_PIN_GROUP(canfd3_data), + SH_PFC_PIN_GROUP(canfd4_data), +- SH_PFC_PIN_GROUP(canfd5_data), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(canfd5_data_b), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(canfd5_data_a), ++ SH_PFC_PIN_GROUP(canfd5_data_b), + SH_PFC_PIN_GROUP(canfd6_data), + SH_PFC_PIN_GROUP(canfd7_data), + SH_PFC_PIN_GROUP(can_clk), +@@ -2756,8 +2755,7 @@ static const char * const canfd4_groups[] = { + }; + + static const char * const canfd5_groups[] = { +- /* suffix might be updated */ +- "canfd5_data", ++ "canfd5_data_a", + "canfd5_data_b", + }; + +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-renesas-r8a779g0-fix-fxr_txen-ab-suffixes.patch b/queue-6.1/pinctrl-renesas-r8a779g0-fix-fxr_txen-ab-suffixes.patch new file mode 100644 index 00000000000..0eeef9fc910 --- /dev/null +++ b/queue-6.1/pinctrl-renesas-r8a779g0-fix-fxr_txen-ab-suffixes.patch @@ -0,0 +1,103 @@ +From e4d19a356ea0591789032fd1d29c33aba414b2ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:49 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix FXR_TXEN[AB] suffixes + +From: Geert Uytterhoeven + +[ Upstream commit 4976d61ca39ce51f422e094de53b46e2e3ac5c0d ] + +The Pin Multiplex attachment in Rev.1.10 of the R-Car V4H Series +Hardware User's Manual still has two alternate pins named both +"FXR_TXEN[AB]". To differentiate, the pin control driver uses +"FXR_TXEN[AB]" and "FXR_TXEN[AB]_X", which were considered temporary +names until the conflict was sorted out. + +Fix this by adopting R-Car V4M naming: + - Rename "FXR_TXEN[AB]" to "FXR_TXEN[AB]_A", + - Rename "FXR_TXEN[AB]_X" to "FXR_TXEN[AB]_B". + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 1c2646b5cebfff07 ("pinctrl: renesas: r8a779g0: Add missing FlexRay") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/5e1e9abb46c311d4c54450d991072d6d0e66f14c.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index 245212ebbfc9c..1f64aeab186fc 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -116,11 +116,11 @@ + #define GPSR2_8 F_(TPU0TO0, IP1SR2_3_0) + #define GPSR2_7 F_(TPU0TO1, IP0SR2_31_28) + #define GPSR2_6 F_(FXR_TXDB, IP0SR2_27_24) +-#define GPSR2_5 F_(FXR_TXENB_N, IP0SR2_23_20) ++#define GPSR2_5 F_(FXR_TXENB_N_A, IP0SR2_23_20) + #define GPSR2_4 F_(RXDB_EXTFXR, IP0SR2_19_16) + #define GPSR2_3 F_(CLK_EXTFXR, IP0SR2_15_12) + #define GPSR2_2 F_(RXDA_EXTFXR, IP0SR2_11_8) +-#define GPSR2_1 F_(FXR_TXENA_N, IP0SR2_7_4) ++#define GPSR2_1 F_(FXR_TXENA_N_A, IP0SR2_7_4) + #define GPSR2_0 F_(FXR_TXDA, IP0SR2_3_0) + + /* GPSR3 */ +@@ -334,18 +334,18 @@ + /* SR2 */ + /* IP0SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP0SR2_3_0 FM(FXR_TXDA) FM(CANFD1_TX) FM(TPU0TO2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_7_4 FM(FXR_TXENA_N) FM(CANFD1_RX) FM(TPU0TO3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_7_4 FM(FXR_TXENA_N_A) FM(CANFD1_RX) FM(TPU0TO3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_11_8 FM(RXDA_EXTFXR) FM(CANFD5_TX_A) FM(IRQ5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_15_12 FM(CLK_EXTFXR) FM(CANFD5_RX_A) FM(IRQ4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_19_16 FM(RXDB_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_23_20 FM(FXR_TXENB_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_23_20 FM(FXR_TXENB_N_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_27_24 FM(FXR_TXDB) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_31_28 FM(TPU0TO1) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP1SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP1SR2_3_0 FM(TPU0TO0) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_7_4 FM(CAN_CLK) FM(FXR_TXENA_N_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_11_8 FM(CANFD0_TX) FM(FXR_TXENB_N_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_7_4 FM(CAN_CLK) FM(FXR_TXENA_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_11_8 FM(CANFD0_TX) FM(FXR_TXENB_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_15_12 FM(CANFD0_RX) FM(STPWT_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -885,7 +885,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP0SR2_3_0, CANFD1_TX), + PINMUX_IPSR_GPSR(IP0SR2_3_0, TPU0TO2_A), + +- PINMUX_IPSR_GPSR(IP0SR2_7_4, FXR_TXENA_N), ++ PINMUX_IPSR_GPSR(IP0SR2_7_4, FXR_TXENA_N_A), + PINMUX_IPSR_GPSR(IP0SR2_7_4, CANFD1_RX), + PINMUX_IPSR_GPSR(IP0SR2_7_4, TPU0TO3_A), + +@@ -899,7 +899,7 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP0SR2_19_16, RXDB_EXTFXR), + +- PINMUX_IPSR_GPSR(IP0SR2_23_20, FXR_TXENB_N), ++ PINMUX_IPSR_GPSR(IP0SR2_23_20, FXR_TXENB_N_A), + + PINMUX_IPSR_GPSR(IP0SR2_27_24, FXR_TXDB), + +@@ -913,10 +913,10 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR2_3_0, TCLK1_A), + + PINMUX_IPSR_GPSR(IP1SR2_7_4, CAN_CLK), +- PINMUX_IPSR_GPSR(IP1SR2_7_4, FXR_TXENA_N_X), ++ PINMUX_IPSR_GPSR(IP1SR2_7_4, FXR_TXENA_N_B), + + PINMUX_IPSR_GPSR(IP1SR2_11_8, CANFD0_TX), +- PINMUX_IPSR_GPSR(IP1SR2_11_8, FXR_TXENB_N_X), ++ PINMUX_IPSR_GPSR(IP1SR2_11_8, FXR_TXENB_N_B), + + PINMUX_IPSR_GPSR(IP1SR2_15_12, CANFD0_RX), + PINMUX_IPSR_GPSR(IP1SR2_15_12, STPWT_EXTFXR), +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-renesas-r8a779g0-fix-h-scif1-suffixes.patch b/queue-6.1/pinctrl-renesas-r8a779g0-fix-h-scif1-suffixes.patch new file mode 100644 index 00000000000..a4635f83306 --- /dev/null +++ b/queue-6.1/pinctrl-renesas-r8a779g0-fix-h-scif1-suffixes.patch @@ -0,0 +1,380 @@ +From 76991abd72533f232403441714e6a630af8facb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:50 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix (H)SCIF1 suffixes + +From: Geert Uytterhoeven + +[ Upstream commit 3cf834a1669ea433aeee4c82c642776899c87451 ] + +The Pin Multiplex attachment in Rev.1.10 of the R-Car V4H Series +Hardware User's Manual still has two alternate pin groups (GP0_14-18 +and GP1_6-10) each named both HSCIF1 and SCIF1. To differentiate, the +pin control driver uses "(h)scif1" and "(h)scif1_x", which were +considered temporary names until the conflict was sorted out. + +Fix this by adopting R-Car V4M naming: + - Rename "(h)scif1" to "(h)scif1_a", + - Rename "(h)scif1_x" to "(h)scif1_b". + +Adopt the R-Car V4M naming "(h)scif1_a" and "(h)scif1_b" to increase +uniformity. + +While at it, remove unneeded separators. + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 050442ae4c74f830 ("pinctrl: renesas: r8a779g0: Add pins, groups and functions") +Fixes: cf4f7891847bc558 ("pinctrl: renesas: r8a779g0: Add missing HSCIF1_X") +Fixes: 9c151c2be92becf2 ("pinctrl: renesas: r8a779g0: Add missing SCIF1_X") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/5009130d1867e12abf9b231c8838fd05e2b28bee.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 208 ++++++++++++------------- + 1 file changed, 102 insertions(+), 106 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index 1f64aeab186fc..36e043cff9441 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -285,13 +285,13 @@ + #define IP1SR0_15_12 FM(MSIOF5_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_19_16 FM(MSIOF5_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1) FM(IRQ2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_27_24 FM(MSIOF2_SS1) FM(HTX1) FM(TX1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_31_28 FM(MSIOF2_SYNC) FM(HRX1) FM(RX1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_27_24 FM(MSIOF2_SS1) FM(HTX1_A) FM(TX1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_31_28 FM(MSIOF2_SYNC) FM(HRX1_A) FM(RX1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP2SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP2SR0_3_0 FM(MSIOF2_TXD) FM(HCTS1_N) FM(CTS1_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR0_7_4 FM(MSIOF2_SCK) FM(HRTS1_N) FM(RTS1_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR0_11_8 FM(MSIOF2_RXD) FM(HSCK1) FM(SCK1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR0_3_0 FM(MSIOF2_TXD) FM(HCTS1_N_A) FM(CTS1_N_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR0_7_4 FM(MSIOF2_SCK) FM(HRTS1_N_A) FM(RTS1_N_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR0_11_8 FM(MSIOF2_RXD) FM(HSCK1_A) FM(SCK1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR1 */ + /* IP0SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +@@ -301,13 +301,13 @@ + #define IP0SR1_15_12 FM(MSIOF1_SCK) FM(HSCK3_A) FM(CTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR1_19_16 FM(MSIOF1_TXD) FM(HRX3_A) FM(SCK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR1_23_20 FM(MSIOF1_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_27_24 FM(MSIOF0_SS2) FM(HTX1_X) FM(TX1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_31_28 FM(MSIOF0_SS1) FM(HRX1_X) FM(RX1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_27_24 FM(MSIOF0_SS2) FM(HTX1_B) FM(TX1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_31_28 FM(MSIOF0_SS1) FM(HRX1_B) FM(RX1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP1SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR1_3_0 FM(MSIOF0_SYNC) FM(HCTS1_N_X) FM(CTS1_N_X) FM(CANFD5_TX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_7_4 FM(MSIOF0_TXD) FM(HRTS1_N_X) FM(RTS1_N_X) FM(CANFD5_RX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_11_8 FM(MSIOF0_SCK) FM(HSCK1_X) FM(SCK1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_3_0 FM(MSIOF0_SYNC) FM(HCTS1_N_B) FM(CTS1_N_B) FM(CANFD5_TX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_7_4 FM(MSIOF0_TXD) FM(HRTS1_N_B) FM(RTS1_N_B) FM(CANFD5_RX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_11_8 FM(MSIOF0_SCK) FM(HSCK1_B) FM(SCK1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR1_15_12 FM(MSIOF0_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR1_19_16 FM(HTX0) FM(TX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR1_23_20 FM(HCTS0_N) FM(CTS0_N) FM(PWM8_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -748,25 +748,25 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR0_23_20, IRQ2_A), + + PINMUX_IPSR_GPSR(IP1SR0_27_24, MSIOF2_SS1), +- PINMUX_IPSR_GPSR(IP1SR0_27_24, HTX1), +- PINMUX_IPSR_GPSR(IP1SR0_27_24, TX1), ++ PINMUX_IPSR_GPSR(IP1SR0_27_24, HTX1_A), ++ PINMUX_IPSR_GPSR(IP1SR0_27_24, TX1_A), + + PINMUX_IPSR_GPSR(IP1SR0_31_28, MSIOF2_SYNC), +- PINMUX_IPSR_GPSR(IP1SR0_31_28, HRX1), +- PINMUX_IPSR_GPSR(IP1SR0_31_28, RX1), ++ PINMUX_IPSR_GPSR(IP1SR0_31_28, HRX1_A), ++ PINMUX_IPSR_GPSR(IP1SR0_31_28, RX1_A), + + /* IP2SR0 */ + PINMUX_IPSR_GPSR(IP2SR0_3_0, MSIOF2_TXD), +- PINMUX_IPSR_GPSR(IP2SR0_3_0, HCTS1_N), +- PINMUX_IPSR_GPSR(IP2SR0_3_0, CTS1_N), ++ PINMUX_IPSR_GPSR(IP2SR0_3_0, HCTS1_N_A), ++ PINMUX_IPSR_GPSR(IP2SR0_3_0, CTS1_N_A), + + PINMUX_IPSR_GPSR(IP2SR0_7_4, MSIOF2_SCK), +- PINMUX_IPSR_GPSR(IP2SR0_7_4, HRTS1_N), +- PINMUX_IPSR_GPSR(IP2SR0_7_4, RTS1_N), ++ PINMUX_IPSR_GPSR(IP2SR0_7_4, HRTS1_N_A), ++ PINMUX_IPSR_GPSR(IP2SR0_7_4, RTS1_N_A), + + PINMUX_IPSR_GPSR(IP2SR0_11_8, MSIOF2_RXD), +- PINMUX_IPSR_GPSR(IP2SR0_11_8, HSCK1), +- PINMUX_IPSR_GPSR(IP2SR0_11_8, SCK1), ++ PINMUX_IPSR_GPSR(IP2SR0_11_8, HSCK1_A), ++ PINMUX_IPSR_GPSR(IP2SR0_11_8, SCK1_A), + + /* IP0SR1 */ + PINMUX_IPSR_GPSR(IP0SR1_3_0, MSIOF1_SS2), +@@ -792,27 +792,27 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP0SR1_23_20, MSIOF1_RXD), + + PINMUX_IPSR_GPSR(IP0SR1_27_24, MSIOF0_SS2), +- PINMUX_IPSR_GPSR(IP0SR1_27_24, HTX1_X), +- PINMUX_IPSR_GPSR(IP0SR1_27_24, TX1_X), ++ PINMUX_IPSR_GPSR(IP0SR1_27_24, HTX1_B), ++ PINMUX_IPSR_GPSR(IP0SR1_27_24, TX1_B), + + PINMUX_IPSR_GPSR(IP0SR1_31_28, MSIOF0_SS1), +- PINMUX_IPSR_GPSR(IP0SR1_31_28, HRX1_X), +- PINMUX_IPSR_GPSR(IP0SR1_31_28, RX1_X), ++ PINMUX_IPSR_GPSR(IP0SR1_31_28, HRX1_B), ++ PINMUX_IPSR_GPSR(IP0SR1_31_28, RX1_B), + + /* IP1SR1 */ + PINMUX_IPSR_GPSR(IP1SR1_3_0, MSIOF0_SYNC), +- PINMUX_IPSR_GPSR(IP1SR1_3_0, HCTS1_N_X), +- PINMUX_IPSR_GPSR(IP1SR1_3_0, CTS1_N_X), ++ PINMUX_IPSR_GPSR(IP1SR1_3_0, HCTS1_N_B), ++ PINMUX_IPSR_GPSR(IP1SR1_3_0, CTS1_N_B), + PINMUX_IPSR_GPSR(IP1SR1_3_0, CANFD5_TX_B), + + PINMUX_IPSR_GPSR(IP1SR1_7_4, MSIOF0_TXD), +- PINMUX_IPSR_GPSR(IP1SR1_7_4, HRTS1_N_X), +- PINMUX_IPSR_GPSR(IP1SR1_7_4, RTS1_N_X), ++ PINMUX_IPSR_GPSR(IP1SR1_7_4, HRTS1_N_B), ++ PINMUX_IPSR_GPSR(IP1SR1_7_4, RTS1_N_B), + PINMUX_IPSR_GPSR(IP1SR1_7_4, CANFD5_RX_B), + + PINMUX_IPSR_GPSR(IP1SR1_11_8, MSIOF0_SCK), +- PINMUX_IPSR_GPSR(IP1SR1_11_8, HSCK1_X), +- PINMUX_IPSR_GPSR(IP1SR1_11_8, SCK1_X), ++ PINMUX_IPSR_GPSR(IP1SR1_11_8, HSCK1_B), ++ PINMUX_IPSR_GPSR(IP1SR1_11_8, SCK1_B), + + PINMUX_IPSR_GPSR(IP1SR1_15_12, MSIOF0_RXD), + +@@ -1574,49 +1574,48 @@ static const unsigned int hscif0_ctrl_mux[] = { + }; + + /* - HSCIF1 ----------------------------------------------------------------- */ +-static const unsigned int hscif1_data_pins[] = { +- /* HRX1, HTX1 */ ++static const unsigned int hscif1_data_a_pins[] = { ++ /* HRX1_A, HTX1_A */ + RCAR_GP_PIN(0, 15), RCAR_GP_PIN(0, 14), + }; +-static const unsigned int hscif1_data_mux[] = { +- HRX1_MARK, HTX1_MARK, ++static const unsigned int hscif1_data_a_mux[] = { ++ HRX1_A_MARK, HTX1_A_MARK, + }; +-static const unsigned int hscif1_clk_pins[] = { +- /* HSCK1 */ ++static const unsigned int hscif1_clk_a_pins[] = { ++ /* HSCK1_A */ + RCAR_GP_PIN(0, 18), + }; +-static const unsigned int hscif1_clk_mux[] = { +- HSCK1_MARK, ++static const unsigned int hscif1_clk_a_mux[] = { ++ HSCK1_A_MARK, + }; +-static const unsigned int hscif1_ctrl_pins[] = { +- /* HRTS1_N, HCTS1_N */ ++static const unsigned int hscif1_ctrl_a_pins[] = { ++ /* HRTS1_N_A, HCTS1_N_A */ + RCAR_GP_PIN(0, 17), RCAR_GP_PIN(0, 16), + }; +-static const unsigned int hscif1_ctrl_mux[] = { +- HRTS1_N_MARK, HCTS1_N_MARK, ++static const unsigned int hscif1_ctrl_a_mux[] = { ++ HRTS1_N_A_MARK, HCTS1_N_A_MARK, + }; + +-/* - HSCIF1_X---------------------------------------------------------------- */ +-static const unsigned int hscif1_data_x_pins[] = { +- /* HRX1_X, HTX1_X */ ++static const unsigned int hscif1_data_b_pins[] = { ++ /* HRX1_B, HTX1_B */ + RCAR_GP_PIN(1, 7), RCAR_GP_PIN(1, 6), + }; +-static const unsigned int hscif1_data_x_mux[] = { +- HRX1_X_MARK, HTX1_X_MARK, ++static const unsigned int hscif1_data_b_mux[] = { ++ HRX1_B_MARK, HTX1_B_MARK, + }; +-static const unsigned int hscif1_clk_x_pins[] = { +- /* HSCK1_X */ ++static const unsigned int hscif1_clk_b_pins[] = { ++ /* HSCK1_B */ + RCAR_GP_PIN(1, 10), + }; +-static const unsigned int hscif1_clk_x_mux[] = { +- HSCK1_X_MARK, ++static const unsigned int hscif1_clk_b_mux[] = { ++ HSCK1_B_MARK, + }; +-static const unsigned int hscif1_ctrl_x_pins[] = { +- /* HRTS1_N_X, HCTS1_N_X */ ++static const unsigned int hscif1_ctrl_b_pins[] = { ++ /* HRTS1_N_B, HCTS1_N_B */ + RCAR_GP_PIN(1, 9), RCAR_GP_PIN(1, 8), + }; +-static const unsigned int hscif1_ctrl_x_mux[] = { +- HRTS1_N_X_MARK, HCTS1_N_X_MARK, ++static const unsigned int hscif1_ctrl_b_mux[] = { ++ HRTS1_N_B_MARK, HCTS1_N_B_MARK, + }; + + /* - HSCIF2 ----------------------------------------------------------------- */ +@@ -2236,49 +2235,48 @@ static const unsigned int scif0_ctrl_mux[] = { + }; + + /* - SCIF1 ------------------------------------------------------------------ */ +-static const unsigned int scif1_data_pins[] = { +- /* RX1, TX1 */ ++static const unsigned int scif1_data_a_pins[] = { ++ /* RX1_A, TX1_A */ + RCAR_GP_PIN(0, 15), RCAR_GP_PIN(0, 14), + }; +-static const unsigned int scif1_data_mux[] = { +- RX1_MARK, TX1_MARK, ++static const unsigned int scif1_data_a_mux[] = { ++ RX1_A_MARK, TX1_A_MARK, + }; +-static const unsigned int scif1_clk_pins[] = { +- /* SCK1 */ ++static const unsigned int scif1_clk_a_pins[] = { ++ /* SCK1_A */ + RCAR_GP_PIN(0, 18), + }; +-static const unsigned int scif1_clk_mux[] = { +- SCK1_MARK, ++static const unsigned int scif1_clk_a_mux[] = { ++ SCK1_A_MARK, + }; +-static const unsigned int scif1_ctrl_pins[] = { +- /* RTS1_N, CTS1_N */ ++static const unsigned int scif1_ctrl_a_pins[] = { ++ /* RTS1_N_A, CTS1_N_A */ + RCAR_GP_PIN(0, 17), RCAR_GP_PIN(0, 16), + }; +-static const unsigned int scif1_ctrl_mux[] = { +- RTS1_N_MARK, CTS1_N_MARK, ++static const unsigned int scif1_ctrl_a_mux[] = { ++ RTS1_N_A_MARK, CTS1_N_A_MARK, + }; + +-/* - SCIF1_X ------------------------------------------------------------------ */ +-static const unsigned int scif1_data_x_pins[] = { +- /* RX1_X, TX1_X */ ++static const unsigned int scif1_data_b_pins[] = { ++ /* RX1_B, TX1_B */ + RCAR_GP_PIN(1, 7), RCAR_GP_PIN(1, 6), + }; +-static const unsigned int scif1_data_x_mux[] = { +- RX1_X_MARK, TX1_X_MARK, ++static const unsigned int scif1_data_b_mux[] = { ++ RX1_B_MARK, TX1_B_MARK, + }; +-static const unsigned int scif1_clk_x_pins[] = { +- /* SCK1_X */ ++static const unsigned int scif1_clk_b_pins[] = { ++ /* SCK1_B */ + RCAR_GP_PIN(1, 10), + }; +-static const unsigned int scif1_clk_x_mux[] = { +- SCK1_X_MARK, ++static const unsigned int scif1_clk_b_mux[] = { ++ SCK1_B_MARK, + }; +-static const unsigned int scif1_ctrl_x_pins[] = { +- /* RTS1_N_X, CTS1_N_X */ ++static const unsigned int scif1_ctrl_b_pins[] = { ++ /* RTS1_N_B, CTS1_N_B */ + RCAR_GP_PIN(1, 9), RCAR_GP_PIN(1, 8), + }; +-static const unsigned int scif1_ctrl_x_mux[] = { +- RTS1_N_X_MARK, CTS1_N_X_MARK, ++static const unsigned int scif1_ctrl_b_mux[] = { ++ RTS1_N_B_MARK, CTS1_N_B_MARK, + }; + + /* - SCIF3 ------------------------------------------------------------------ */ +@@ -2559,12 +2557,12 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(hscif0_data), + SH_PFC_PIN_GROUP(hscif0_clk), + SH_PFC_PIN_GROUP(hscif0_ctrl), +- SH_PFC_PIN_GROUP(hscif1_data), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif1_clk), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif1_ctrl), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif1_data_x), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif1_clk_x), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif1_ctrl_x), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(hscif1_data_a), ++ SH_PFC_PIN_GROUP(hscif1_clk_a), ++ SH_PFC_PIN_GROUP(hscif1_ctrl_a), ++ SH_PFC_PIN_GROUP(hscif1_data_b), ++ SH_PFC_PIN_GROUP(hscif1_clk_b), ++ SH_PFC_PIN_GROUP(hscif1_ctrl_b), + SH_PFC_PIN_GROUP(hscif2_data), + SH_PFC_PIN_GROUP(hscif2_clk), + SH_PFC_PIN_GROUP(hscif2_ctrl), +@@ -2658,12 +2656,12 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(scif0_data), + SH_PFC_PIN_GROUP(scif0_clk), + SH_PFC_PIN_GROUP(scif0_ctrl), +- SH_PFC_PIN_GROUP(scif1_data), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif1_clk), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif1_ctrl), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif1_data_x), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif1_clk_x), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif1_ctrl_x), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(scif1_data_a), ++ SH_PFC_PIN_GROUP(scif1_clk_a), ++ SH_PFC_PIN_GROUP(scif1_ctrl_a), ++ SH_PFC_PIN_GROUP(scif1_data_b), ++ SH_PFC_PIN_GROUP(scif1_clk_b), ++ SH_PFC_PIN_GROUP(scif1_ctrl_b), + SH_PFC_PIN_GROUP(scif3_data), /* suffix might be updated */ + SH_PFC_PIN_GROUP(scif3_clk), /* suffix might be updated */ + SH_PFC_PIN_GROUP(scif3_ctrl), /* suffix might be updated */ +@@ -2778,13 +2776,12 @@ static const char * const hscif0_groups[] = { + }; + + static const char * const hscif1_groups[] = { +- /* suffix might be updated */ +- "hscif1_data", +- "hscif1_clk", +- "hscif1_ctrl", +- "hscif1_data_x", +- "hscif1_clk_x", +- "hscif1_ctrl_x", ++ "hscif1_data_a", ++ "hscif1_clk_a", ++ "hscif1_ctrl_a", ++ "hscif1_data_b", ++ "hscif1_clk_b", ++ "hscif1_ctrl_b", + }; + + static const char * const hscif2_groups[] = { +@@ -2961,13 +2958,12 @@ static const char * const scif0_groups[] = { + }; + + static const char * const scif1_groups[] = { +- /* suffix might be updated */ +- "scif1_data", +- "scif1_clk", +- "scif1_ctrl", +- "scif1_data_x", +- "scif1_clk_x", +- "scif1_ctrl_x", ++ "scif1_data_a", ++ "scif1_clk_a", ++ "scif1_ctrl_a", ++ "scif1_data_b", ++ "scif1_clk_b", ++ "scif1_ctrl_b", + }; + + static const char * const scif3_groups[] = { +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-renesas-r8a779g0-fix-h-scif3-suffixes.patch b/queue-6.1/pinctrl-renesas-r8a779g0-fix-h-scif3-suffixes.patch new file mode 100644 index 00000000000..d1cd3650fbb --- /dev/null +++ b/queue-6.1/pinctrl-renesas-r8a779g0-fix-h-scif3-suffixes.patch @@ -0,0 +1,360 @@ +From 4abbaa6b7207b3ad1c3d11ebd1ec8d35b3f66e90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:51 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix (H)SCIF3 suffixes + +From: Geert Uytterhoeven + +[ Upstream commit 5350f38150a171322b50c0a48efa671885f87050 ] + +(H)SCIF instance 3 has two alternate pin groups: "hscif3" and +"hscif3_a", resp. "scif3" and "scif3_a", but the actual meanings of the +pins within the groups do not match. + +Increase uniformity by adopting R-Car V4M naming: + - Rename "hscif3_a" to "hscif3_b", + - Rename "hscif3" to "hscif3_a", + - Rename "scif3" to "scif3_b". + +While at it, remove unneeded separators. + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 050442ae4c74f830 ("pinctrl: renesas: r8a779g0: Add pins, groups and functions") +Fixes: 213b713255defaa6 ("pinctrl: renesas: r8a779g0: Add missing HSCIF3_A") +Fixes: 49e4697656bdd1cd ("pinctrl: renesas: r8a779g0: Add missing SCIF3") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/61fdde58e369e8070ffd3c5811c089e6219c7ecc.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 192 ++++++++++++------------- + 1 file changed, 94 insertions(+), 98 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index 36e043cff9441..b295b367f9b7f 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -71,11 +71,11 @@ + #define GPSR0_0 F_(GP0_00, IP0SR0_3_0) + + /* GPSR1 */ +-#define GPSR1_28 F_(HTX3, IP3SR1_19_16) +-#define GPSR1_27 F_(HCTS3_N, IP3SR1_15_12) +-#define GPSR1_26 F_(HRTS3_N, IP3SR1_11_8) +-#define GPSR1_25 F_(HSCK3, IP3SR1_7_4) +-#define GPSR1_24 F_(HRX3, IP3SR1_3_0) ++#define GPSR1_28 F_(HTX3_A, IP3SR1_19_16) ++#define GPSR1_27 F_(HCTS3_N_A, IP3SR1_15_12) ++#define GPSR1_26 F_(HRTS3_N_A, IP3SR1_11_8) ++#define GPSR1_25 F_(HSCK3_A, IP3SR1_7_4) ++#define GPSR1_24 F_(HRX3_A, IP3SR1_3_0) + #define GPSR1_23 F_(GP1_23, IP2SR1_31_28) + #define GPSR1_22 F_(AUDIO_CLKIN, IP2SR1_27_24) + #define GPSR1_21 F_(AUDIO_CLKOUT, IP2SR1_23_20) +@@ -295,11 +295,11 @@ + + /* SR1 */ + /* IP0SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR1_3_0 FM(MSIOF1_SS2) FM(HTX3_A) FM(TX3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_7_4 FM(MSIOF1_SS1) FM(HCTS3_N_A) FM(RX3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_11_8 FM(MSIOF1_SYNC) FM(HRTS3_N_A) FM(RTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_15_12 FM(MSIOF1_SCK) FM(HSCK3_A) FM(CTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_19_16 FM(MSIOF1_TXD) FM(HRX3_A) FM(SCK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_3_0 FM(MSIOF1_SS2) FM(HTX3_B) FM(TX3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_7_4 FM(MSIOF1_SS1) FM(HCTS3_N_B) FM(RX3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_11_8 FM(MSIOF1_SYNC) FM(HRTS3_N_B) FM(RTS3_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_15_12 FM(MSIOF1_SCK) FM(HSCK3_B) FM(CTS3_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_19_16 FM(MSIOF1_TXD) FM(HRX3_B) FM(SCK3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR1_23_20 FM(MSIOF1_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR1_27_24 FM(MSIOF0_SS2) FM(HTX1_B) FM(TX1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR1_31_28 FM(MSIOF0_SS1) FM(HRX1_B) FM(RX1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -325,11 +325,11 @@ + #define IP2SR1_31_28 F_(0, 0) FM(TCLK2) FM(MSIOF4_SS1) FM(IRQ3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP3SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP3SR1_3_0 FM(HRX3) FM(SCK3_A) FM(MSIOF4_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_7_4 FM(HSCK3) FM(CTS3_N_A) FM(MSIOF4_SCK) FM(TPU0TO0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_11_8 FM(HRTS3_N) FM(RTS3_N_A) FM(MSIOF4_TXD) FM(TPU0TO1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_15_12 FM(HCTS3_N) FM(RX3_A) FM(MSIOF4_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_19_16 FM(HTX3) FM(TX3_A) FM(MSIOF4_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_3_0 FM(HRX3_A) FM(SCK3_A) FM(MSIOF4_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_7_4 FM(HSCK3_A) FM(CTS3_N_A) FM(MSIOF4_SCK) FM(TPU0TO0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_11_8 FM(HRTS3_N_A) FM(RTS3_N_A) FM(MSIOF4_TXD) FM(TPU0TO1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_15_12 FM(HCTS3_N_A) FM(RX3_A) FM(MSIOF4_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_19_16 FM(HTX3_A) FM(TX3_A) FM(MSIOF4_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR2 */ + /* IP0SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +@@ -770,24 +770,24 @@ static const u16 pinmux_data[] = { + + /* IP0SR1 */ + PINMUX_IPSR_GPSR(IP0SR1_3_0, MSIOF1_SS2), +- PINMUX_IPSR_GPSR(IP0SR1_3_0, HTX3_A), +- PINMUX_IPSR_GPSR(IP0SR1_3_0, TX3), ++ PINMUX_IPSR_GPSR(IP0SR1_3_0, HTX3_B), ++ PINMUX_IPSR_GPSR(IP0SR1_3_0, TX3_B), + + PINMUX_IPSR_GPSR(IP0SR1_7_4, MSIOF1_SS1), +- PINMUX_IPSR_GPSR(IP0SR1_7_4, HCTS3_N_A), +- PINMUX_IPSR_GPSR(IP0SR1_7_4, RX3), ++ PINMUX_IPSR_GPSR(IP0SR1_7_4, HCTS3_N_B), ++ PINMUX_IPSR_GPSR(IP0SR1_7_4, RX3_B), + + PINMUX_IPSR_GPSR(IP0SR1_11_8, MSIOF1_SYNC), +- PINMUX_IPSR_GPSR(IP0SR1_11_8, HRTS3_N_A), +- PINMUX_IPSR_GPSR(IP0SR1_11_8, RTS3_N), ++ PINMUX_IPSR_GPSR(IP0SR1_11_8, HRTS3_N_B), ++ PINMUX_IPSR_GPSR(IP0SR1_11_8, RTS3_N_B), + + PINMUX_IPSR_GPSR(IP0SR1_15_12, MSIOF1_SCK), +- PINMUX_IPSR_GPSR(IP0SR1_15_12, HSCK3_A), +- PINMUX_IPSR_GPSR(IP0SR1_15_12, CTS3_N), ++ PINMUX_IPSR_GPSR(IP0SR1_15_12, HSCK3_B), ++ PINMUX_IPSR_GPSR(IP0SR1_15_12, CTS3_N_B), + + PINMUX_IPSR_GPSR(IP0SR1_19_16, MSIOF1_TXD), +- PINMUX_IPSR_GPSR(IP0SR1_19_16, HRX3_A), +- PINMUX_IPSR_GPSR(IP0SR1_19_16, SCK3), ++ PINMUX_IPSR_GPSR(IP0SR1_19_16, HRX3_B), ++ PINMUX_IPSR_GPSR(IP0SR1_19_16, SCK3_B), + + PINMUX_IPSR_GPSR(IP0SR1_23_20, MSIOF1_RXD), + +@@ -858,25 +858,25 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP2SR1_31_28, IRQ3_B), + + /* IP3SR1 */ +- PINMUX_IPSR_GPSR(IP3SR1_3_0, HRX3), ++ PINMUX_IPSR_GPSR(IP3SR1_3_0, HRX3_A), + PINMUX_IPSR_GPSR(IP3SR1_3_0, SCK3_A), + PINMUX_IPSR_GPSR(IP3SR1_3_0, MSIOF4_SS2), + +- PINMUX_IPSR_GPSR(IP3SR1_7_4, HSCK3), ++ PINMUX_IPSR_GPSR(IP3SR1_7_4, HSCK3_A), + PINMUX_IPSR_GPSR(IP3SR1_7_4, CTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_7_4, MSIOF4_SCK), + PINMUX_IPSR_GPSR(IP3SR1_7_4, TPU0TO0_A), + +- PINMUX_IPSR_GPSR(IP3SR1_11_8, HRTS3_N), ++ PINMUX_IPSR_GPSR(IP3SR1_11_8, HRTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_11_8, RTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_11_8, MSIOF4_TXD), + PINMUX_IPSR_GPSR(IP3SR1_11_8, TPU0TO1_A), + +- PINMUX_IPSR_GPSR(IP3SR1_15_12, HCTS3_N), ++ PINMUX_IPSR_GPSR(IP3SR1_15_12, HCTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_15_12, RX3_A), + PINMUX_IPSR_GPSR(IP3SR1_15_12, MSIOF4_RXD), + +- PINMUX_IPSR_GPSR(IP3SR1_19_16, HTX3), ++ PINMUX_IPSR_GPSR(IP3SR1_19_16, HTX3_A), + PINMUX_IPSR_GPSR(IP3SR1_19_16, TX3_A), + PINMUX_IPSR_GPSR(IP3SR1_19_16, MSIOF4_SYNC), + +@@ -1642,49 +1642,48 @@ static const unsigned int hscif2_ctrl_mux[] = { + }; + + /* - HSCIF3 ----------------------------------------------------------------- */ +-static const unsigned int hscif3_data_pins[] = { +- /* HRX3, HTX3 */ ++static const unsigned int hscif3_data_a_pins[] = { ++ /* HRX3_A, HTX3_A */ + RCAR_GP_PIN(1, 24), RCAR_GP_PIN(1, 28), + }; +-static const unsigned int hscif3_data_mux[] = { +- HRX3_MARK, HTX3_MARK, ++static const unsigned int hscif3_data_a_mux[] = { ++ HRX3_A_MARK, HTX3_A_MARK, + }; +-static const unsigned int hscif3_clk_pins[] = { +- /* HSCK3 */ ++static const unsigned int hscif3_clk_a_pins[] = { ++ /* HSCK3_A */ + RCAR_GP_PIN(1, 25), + }; +-static const unsigned int hscif3_clk_mux[] = { +- HSCK3_MARK, ++static const unsigned int hscif3_clk_a_mux[] = { ++ HSCK3_A_MARK, + }; +-static const unsigned int hscif3_ctrl_pins[] = { +- /* HRTS3_N, HCTS3_N */ ++static const unsigned int hscif3_ctrl_a_pins[] = { ++ /* HRTS3_N_A, HCTS3_N_A */ + RCAR_GP_PIN(1, 26), RCAR_GP_PIN(1, 27), + }; +-static const unsigned int hscif3_ctrl_mux[] = { +- HRTS3_N_MARK, HCTS3_N_MARK, ++static const unsigned int hscif3_ctrl_a_mux[] = { ++ HRTS3_N_A_MARK, HCTS3_N_A_MARK, + }; + +-/* - HSCIF3_A ----------------------------------------------------------------- */ +-static const unsigned int hscif3_data_a_pins[] = { +- /* HRX3_A, HTX3_A */ ++static const unsigned int hscif3_data_b_pins[] = { ++ /* HRX3_B, HTX3_B */ + RCAR_GP_PIN(1, 4), RCAR_GP_PIN(1, 0), + }; +-static const unsigned int hscif3_data_a_mux[] = { +- HRX3_A_MARK, HTX3_A_MARK, ++static const unsigned int hscif3_data_b_mux[] = { ++ HRX3_B_MARK, HTX3_B_MARK, + }; +-static const unsigned int hscif3_clk_a_pins[] = { +- /* HSCK3_A */ ++static const unsigned int hscif3_clk_b_pins[] = { ++ /* HSCK3_B */ + RCAR_GP_PIN(1, 3), + }; +-static const unsigned int hscif3_clk_a_mux[] = { +- HSCK3_A_MARK, ++static const unsigned int hscif3_clk_b_mux[] = { ++ HSCK3_B_MARK, + }; +-static const unsigned int hscif3_ctrl_a_pins[] = { +- /* HRTS3_N_A, HCTS3_N_A */ ++static const unsigned int hscif3_ctrl_b_pins[] = { ++ /* HRTS3_N_B, HCTS3_N_B */ + RCAR_GP_PIN(1, 2), RCAR_GP_PIN(1, 1), + }; +-static const unsigned int hscif3_ctrl_a_mux[] = { +- HRTS3_N_A_MARK, HCTS3_N_A_MARK, ++static const unsigned int hscif3_ctrl_b_mux[] = { ++ HRTS3_N_B_MARK, HCTS3_N_B_MARK, + }; + + /* - I2C0 ------------------------------------------------------------------- */ +@@ -2280,29 +2279,6 @@ static const unsigned int scif1_ctrl_b_mux[] = { + }; + + /* - SCIF3 ------------------------------------------------------------------ */ +-static const unsigned int scif3_data_pins[] = { +- /* RX3, TX3 */ +- RCAR_GP_PIN(1, 1), RCAR_GP_PIN(1, 0), +-}; +-static const unsigned int scif3_data_mux[] = { +- RX3_MARK, TX3_MARK, +-}; +-static const unsigned int scif3_clk_pins[] = { +- /* SCK3 */ +- RCAR_GP_PIN(1, 4), +-}; +-static const unsigned int scif3_clk_mux[] = { +- SCK3_MARK, +-}; +-static const unsigned int scif3_ctrl_pins[] = { +- /* RTS3_N, CTS3_N */ +- RCAR_GP_PIN(1, 2), RCAR_GP_PIN(1, 3), +-}; +-static const unsigned int scif3_ctrl_mux[] = { +- RTS3_N_MARK, CTS3_N_MARK, +-}; +- +-/* - SCIF3_A ------------------------------------------------------------------ */ + static const unsigned int scif3_data_a_pins[] = { + /* RX3_A, TX3_A */ + RCAR_GP_PIN(1, 27), RCAR_GP_PIN(1, 28), +@@ -2325,6 +2301,28 @@ static const unsigned int scif3_ctrl_a_mux[] = { + RTS3_N_A_MARK, CTS3_N_A_MARK, + }; + ++static const unsigned int scif3_data_b_pins[] = { ++ /* RX3_B, TX3_B */ ++ RCAR_GP_PIN(1, 1), RCAR_GP_PIN(1, 0), ++}; ++static const unsigned int scif3_data_b_mux[] = { ++ RX3_B_MARK, TX3_B_MARK, ++}; ++static const unsigned int scif3_clk_b_pins[] = { ++ /* SCK3_B */ ++ RCAR_GP_PIN(1, 4), ++}; ++static const unsigned int scif3_clk_b_mux[] = { ++ SCK3_B_MARK, ++}; ++static const unsigned int scif3_ctrl_b_pins[] = { ++ /* RTS3_N_B, CTS3_N_B */ ++ RCAR_GP_PIN(1, 2), RCAR_GP_PIN(1, 3), ++}; ++static const unsigned int scif3_ctrl_b_mux[] = { ++ RTS3_N_B_MARK, CTS3_N_B_MARK, ++}; ++ + /* - SCIF4 ------------------------------------------------------------------ */ + static const unsigned int scif4_data_pins[] = { + /* RX4, TX4 */ +@@ -2566,12 +2564,12 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(hscif2_data), + SH_PFC_PIN_GROUP(hscif2_clk), + SH_PFC_PIN_GROUP(hscif2_ctrl), +- SH_PFC_PIN_GROUP(hscif3_data), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif3_clk), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif3_ctrl), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif3_data_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif3_clk_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif3_ctrl_a), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(hscif3_data_a), ++ SH_PFC_PIN_GROUP(hscif3_clk_a), ++ SH_PFC_PIN_GROUP(hscif3_ctrl_a), ++ SH_PFC_PIN_GROUP(hscif3_data_b), ++ SH_PFC_PIN_GROUP(hscif3_clk_b), ++ SH_PFC_PIN_GROUP(hscif3_ctrl_b), + + SH_PFC_PIN_GROUP(i2c0), + SH_PFC_PIN_GROUP(i2c1), +@@ -2662,12 +2660,12 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(scif1_data_b), + SH_PFC_PIN_GROUP(scif1_clk_b), + SH_PFC_PIN_GROUP(scif1_ctrl_b), +- SH_PFC_PIN_GROUP(scif3_data), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif3_clk), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif3_ctrl), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif3_data_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif3_clk_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif3_ctrl_a), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(scif3_data_a), ++ SH_PFC_PIN_GROUP(scif3_clk_a), ++ SH_PFC_PIN_GROUP(scif3_ctrl_a), ++ SH_PFC_PIN_GROUP(scif3_data_b), ++ SH_PFC_PIN_GROUP(scif3_clk_b), ++ SH_PFC_PIN_GROUP(scif3_ctrl_b), + SH_PFC_PIN_GROUP(scif4_data), + SH_PFC_PIN_GROUP(scif4_clk), + SH_PFC_PIN_GROUP(scif4_ctrl), +@@ -2791,13 +2789,12 @@ static const char * const hscif2_groups[] = { + }; + + static const char * const hscif3_groups[] = { +- /* suffix might be updated */ +- "hscif3_data", +- "hscif3_clk", +- "hscif3_ctrl", + "hscif3_data_a", + "hscif3_clk_a", + "hscif3_ctrl_a", ++ "hscif3_data_b", ++ "hscif3_clk_b", ++ "hscif3_ctrl_b", + }; + + static const char * const i2c0_groups[] = { +@@ -2967,13 +2964,12 @@ static const char * const scif1_groups[] = { + }; + + static const char * const scif3_groups[] = { +- /* suffix might be updated */ +- "scif3_data", +- "scif3_clk", +- "scif3_ctrl", + "scif3_data_a", + "scif3_clk_a", + "scif3_ctrl_a", ++ "scif3_data_b", ++ "scif3_clk_b", ++ "scif3_ctrl_b", + }; + + static const char * const scif4_groups[] = { +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-renesas-r8a779g0-fix-irq-suffixes.patch b/queue-6.1/pinctrl-renesas-r8a779g0-fix-irq-suffixes.patch new file mode 100644 index 00000000000..5e5f5984261 --- /dev/null +++ b/queue-6.1/pinctrl-renesas-r8a779g0-fix-irq-suffixes.patch @@ -0,0 +1,133 @@ +From d6dea373efefad980a36c7e5018e833c5d818b85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:52 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix IRQ suffixes + +From: Geert Uytterhoeven + +[ Upstream commit c391dcde3884dbbea37f57dd2625225d8661da97 ] + +The suffixes of the IRQ identifiers for external interrupts 0-3 +are inconsistent: + - "IRQ0" and "IRQ0_A", + - "IRQ1" and "IRQ1_A", + - "IRQ2" and "IRQ2_A", + - "IRQ3" and "IRQ3_B". +The suffixes for external interrupts 4 and 5 do follow conventional +naming: + - "IRQ4A" and IRQ4_B", + - "IRQ5". + +Fix this by adopting R-Car V4M naming: + - Rename "IRQ[0-2]_A" to "IRQ[0-2]_B", + - Rename "IRQ[0-3]" to "IRQ[0-3]_A". + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 1b23d8a478bea9d1 ("pinctrl: renesas: r8a779g0: Add missing IRQx_A/IRQx_B") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/8ce9baf0a0f9346544a3ac801fd962c7c12fd247.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 36 +++++++++++++------------- + 1 file changed, 18 insertions(+), 18 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index b295b367f9b7f..c4086f301cfc6 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -62,10 +62,10 @@ + #define GPSR0_9 F_(MSIOF5_SYNC, IP1SR0_7_4) + #define GPSR0_8 F_(MSIOF5_SS1, IP1SR0_3_0) + #define GPSR0_7 F_(MSIOF5_SS2, IP0SR0_31_28) +-#define GPSR0_6 F_(IRQ0, IP0SR0_27_24) +-#define GPSR0_5 F_(IRQ1, IP0SR0_23_20) +-#define GPSR0_4 F_(IRQ2, IP0SR0_19_16) +-#define GPSR0_3 F_(IRQ3, IP0SR0_15_12) ++#define GPSR0_6 F_(IRQ0_A, IP0SR0_27_24) ++#define GPSR0_5 F_(IRQ1_A, IP0SR0_23_20) ++#define GPSR0_4 F_(IRQ2_A, IP0SR0_19_16) ++#define GPSR0_3 F_(IRQ3_A, IP0SR0_15_12) + #define GPSR0_2 F_(GP0_02, IP0SR0_11_8) + #define GPSR0_1 F_(GP0_01, IP0SR0_7_4) + #define GPSR0_0 F_(GP0_00, IP0SR0_3_0) +@@ -272,10 +272,10 @@ + #define IP0SR0_3_0 F_(0, 0) FM(ERROROUTC_N_B) FM(TCLK2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR0_7_4 F_(0, 0) FM(MSIOF3_SS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR0_11_8 F_(0, 0) FM(MSIOF3_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_15_12 FM(IRQ3) FM(MSIOF3_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_19_16 FM(IRQ2) FM(MSIOF3_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_23_20 FM(IRQ1) FM(MSIOF3_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_27_24 FM(IRQ0) FM(MSIOF3_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_15_12 FM(IRQ3_A) FM(MSIOF3_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_19_16 FM(IRQ2_A) FM(MSIOF3_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_23_20 FM(IRQ1_A) FM(MSIOF3_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_27_24 FM(IRQ0_A) FM(MSIOF3_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR0_31_28 FM(MSIOF5_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP1SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +@@ -284,7 +284,7 @@ + #define IP1SR0_11_8 FM(MSIOF5_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_15_12 FM(MSIOF5_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_19_16 FM(MSIOF5_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1) FM(IRQ2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1) FM(IRQ2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_27_24 FM(MSIOF2_SS1) FM(HTX1_A) FM(TX1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_31_28 FM(MSIOF2_SYNC) FM(HRX1_A) FM(RX1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + +@@ -319,8 +319,8 @@ + #define IP2SR1_7_4 FM(SCIF_CLK) FM(IRQ4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_11_8 FM(SSI_SCK) FM(TCLK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_15_12 FM(SSI_WS) FM(TCLK4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_19_16 FM(SSI_SD) FM(IRQ0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_23_20 FM(AUDIO_CLKOUT) FM(IRQ1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_19_16 FM(SSI_SD) FM(IRQ0_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_23_20 FM(AUDIO_CLKOUT) FM(IRQ1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_27_24 FM(AUDIO_CLKIN) FM(PWM3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_31_28 F_(0, 0) FM(TCLK2) FM(MSIOF4_SS1) FM(IRQ3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + +@@ -718,16 +718,16 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP0SR0_11_8, MSIOF3_SS2), + +- PINMUX_IPSR_GPSR(IP0SR0_15_12, IRQ3), ++ PINMUX_IPSR_GPSR(IP0SR0_15_12, IRQ3_A), + PINMUX_IPSR_GPSR(IP0SR0_15_12, MSIOF3_SCK), + +- PINMUX_IPSR_GPSR(IP0SR0_19_16, IRQ2), ++ PINMUX_IPSR_GPSR(IP0SR0_19_16, IRQ2_A), + PINMUX_IPSR_GPSR(IP0SR0_19_16, MSIOF3_TXD), + +- PINMUX_IPSR_GPSR(IP0SR0_23_20, IRQ1), ++ PINMUX_IPSR_GPSR(IP0SR0_23_20, IRQ1_A), + PINMUX_IPSR_GPSR(IP0SR0_23_20, MSIOF3_RXD), + +- PINMUX_IPSR_GPSR(IP0SR0_27_24, IRQ0), ++ PINMUX_IPSR_GPSR(IP0SR0_27_24, IRQ0_A), + PINMUX_IPSR_GPSR(IP0SR0_27_24, MSIOF3_SYNC), + + PINMUX_IPSR_GPSR(IP0SR0_31_28, MSIOF5_SS2), +@@ -745,7 +745,7 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP1SR0_23_20, MSIOF2_SS2), + PINMUX_IPSR_GPSR(IP1SR0_23_20, TCLK1), +- PINMUX_IPSR_GPSR(IP1SR0_23_20, IRQ2_A), ++ PINMUX_IPSR_GPSR(IP1SR0_23_20, IRQ2_B), + + PINMUX_IPSR_GPSR(IP1SR0_27_24, MSIOF2_SS1), + PINMUX_IPSR_GPSR(IP1SR0_27_24, HTX1_A), +@@ -845,10 +845,10 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP2SR1_15_12, TCLK4), + + PINMUX_IPSR_GPSR(IP2SR1_19_16, SSI_SD), +- PINMUX_IPSR_GPSR(IP2SR1_19_16, IRQ0_A), ++ PINMUX_IPSR_GPSR(IP2SR1_19_16, IRQ0_B), + + PINMUX_IPSR_GPSR(IP2SR1_23_20, AUDIO_CLKOUT), +- PINMUX_IPSR_GPSR(IP2SR1_23_20, IRQ1_A), ++ PINMUX_IPSR_GPSR(IP2SR1_23_20, IRQ1_B), + + PINMUX_IPSR_GPSR(IP2SR1_27_24, AUDIO_CLKIN), + PINMUX_IPSR_GPSR(IP2SR1_27_24, PWM3_A), +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-renesas-r8a779g0-fix-pwm-suffixes.patch b/queue-6.1/pinctrl-renesas-r8a779g0-fix-pwm-suffixes.patch new file mode 100644 index 00000000000..8dfd4006c5e --- /dev/null +++ b/queue-6.1/pinctrl-renesas-r8a779g0-fix-pwm-suffixes.patch @@ -0,0 +1,207 @@ +From bb0d67fc3914b09aba7875c69b29dec512351c7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:53 +0200 +Subject: pinctrl: renesas: r8a779g0: FIX PWM suffixes + +From: Geert Uytterhoeven + +[ Upstream commit 0aabdc9a4d3644fd57d804b283b2ab0f9c28dc6c ] + +PWM channels 0, 2, 8, and 9 do not have alternate pins. +Remove their "_a" or "_b" suffixes to increase uniformity. + +Fixes: c606c2fde2330547 ("pinctrl: renesas: r8a779g0: Add missing PWM") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/abb748e6e1e4e7d78beac7d96e7a0a3481b32e75.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 76 ++++++++++++-------------- + 1 file changed, 36 insertions(+), 40 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index c4086f301cfc6..f0c85192c5db5 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -310,9 +310,9 @@ + #define IP1SR1_11_8 FM(MSIOF0_SCK) FM(HSCK1_B) FM(SCK1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR1_15_12 FM(MSIOF0_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR1_19_16 FM(HTX0) FM(TX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_23_20 FM(HCTS0_N) FM(CTS0_N) FM(PWM8_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_27_24 FM(HRTS0_N) FM(RTS0_N) FM(PWM9_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_31_28 FM(HSCK0) FM(SCK0) FM(PWM0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_23_20 FM(HCTS0_N) FM(CTS0_N) FM(PWM8) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_27_24 FM(HRTS0_N) FM(RTS0_N) FM(PWM9) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_31_28 FM(HSCK0) FM(SCK0) FM(PWM0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP2SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP2SR1_3_0 FM(HRX0) FM(RX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -349,7 +349,7 @@ + #define IP1SR2_15_12 FM(CANFD0_RX) FM(STPWT_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_27_24 FM(CANFD3_TX) F_(0, 0) FM(PWM2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_27_24 FM(CANFD3_TX) F_(0, 0) FM(PWM2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_31_28 FM(CANFD3_RX) F_(0, 0) FM(PWM3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP2SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +@@ -821,15 +821,15 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP1SR1_23_20, HCTS0_N), + PINMUX_IPSR_GPSR(IP1SR1_23_20, CTS0_N), +- PINMUX_IPSR_GPSR(IP1SR1_23_20, PWM8_A), ++ PINMUX_IPSR_GPSR(IP1SR1_23_20, PWM8), + + PINMUX_IPSR_GPSR(IP1SR1_27_24, HRTS0_N), + PINMUX_IPSR_GPSR(IP1SR1_27_24, RTS0_N), +- PINMUX_IPSR_GPSR(IP1SR1_27_24, PWM9_A), ++ PINMUX_IPSR_GPSR(IP1SR1_27_24, PWM9), + + PINMUX_IPSR_GPSR(IP1SR1_31_28, HSCK0), + PINMUX_IPSR_GPSR(IP1SR1_31_28, SCK0), +- PINMUX_IPSR_GPSR(IP1SR1_31_28, PWM0_A), ++ PINMUX_IPSR_GPSR(IP1SR1_31_28, PWM0), + + /* IP2SR1 */ + PINMUX_IPSR_GPSR(IP2SR1_3_0, HRX0), +@@ -931,7 +931,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR2_23_20, TCLK4_A), + + PINMUX_IPSR_GPSR(IP1SR2_27_24, CANFD3_TX), +- PINMUX_IPSR_GPSR(IP1SR2_27_24, PWM2_B), ++ PINMUX_IPSR_GPSR(IP1SR2_27_24, PWM2), + + PINMUX_IPSR_GPSR(IP1SR2_31_28, CANFD3_RX), + PINMUX_IPSR_GPSR(IP1SR2_31_28, PWM3_B), +@@ -2066,13 +2066,13 @@ static const unsigned int pcie1_clkreq_n_mux[] = { + PCIE1_CLKREQ_N_MARK, + }; + +-/* - PWM0_A ------------------------------------------------------------------- */ +-static const unsigned int pwm0_a_pins[] = { +- /* PWM0_A */ ++/* - PWM0 ------------------------------------------------------------------- */ ++static const unsigned int pwm0_pins[] = { ++ /* PWM0 */ + RCAR_GP_PIN(1, 15), + }; +-static const unsigned int pwm0_a_mux[] = { +- PWM0_A_MARK, ++static const unsigned int pwm0_mux[] = { ++ PWM0_MARK, + }; + + /* - PWM1_A ------------------------------------------------------------------- */ +@@ -2093,13 +2093,13 @@ static const unsigned int pwm1_b_mux[] = { + PWM1_B_MARK, + }; + +-/* - PWM2_B ------------------------------------------------------------------- */ +-static const unsigned int pwm2_b_pins[] = { +- /* PWM2_B */ ++/* - PWM2 ------------------------------------------------------------------- */ ++static const unsigned int pwm2_pins[] = { ++ /* PWM2 */ + RCAR_GP_PIN(2, 14), + }; +-static const unsigned int pwm2_b_mux[] = { +- PWM2_B_MARK, ++static const unsigned int pwm2_mux[] = { ++ PWM2_MARK, + }; + + /* - PWM3_A ------------------------------------------------------------------- */ +@@ -2156,22 +2156,22 @@ static const unsigned int pwm7_mux[] = { + PWM7_MARK, + }; + +-/* - PWM8_A ------------------------------------------------------------------- */ +-static const unsigned int pwm8_a_pins[] = { +- /* PWM8_A */ ++/* - PWM8 ------------------------------------------------------------------- */ ++static const unsigned int pwm8_pins[] = { ++ /* PWM8 */ + RCAR_GP_PIN(1, 13), + }; +-static const unsigned int pwm8_a_mux[] = { +- PWM8_A_MARK, ++static const unsigned int pwm8_mux[] = { ++ PWM8_MARK, + }; + +-/* - PWM9_A ------------------------------------------------------------------- */ +-static const unsigned int pwm9_a_pins[] = { +- /* PWM9_A */ ++/* - PWM9 ------------------------------------------------------------------- */ ++static const unsigned int pwm9_pins[] = { ++ /* PWM9 */ + RCAR_GP_PIN(1, 14), + }; +-static const unsigned int pwm9_a_mux[] = { +- PWM9_A_MARK, ++static const unsigned int pwm9_mux[] = { ++ PWM9_MARK, + }; + + /* - QSPI0 ------------------------------------------------------------------ */ +@@ -2631,18 +2631,18 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(pcie0_clkreq_n), + SH_PFC_PIN_GROUP(pcie1_clkreq_n), + +- SH_PFC_PIN_GROUP(pwm0_a), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(pwm0), + SH_PFC_PIN_GROUP(pwm1_a), + SH_PFC_PIN_GROUP(pwm1_b), +- SH_PFC_PIN_GROUP(pwm2_b), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(pwm2), + SH_PFC_PIN_GROUP(pwm3_a), + SH_PFC_PIN_GROUP(pwm3_b), + SH_PFC_PIN_GROUP(pwm4), + SH_PFC_PIN_GROUP(pwm5), + SH_PFC_PIN_GROUP(pwm6), + SH_PFC_PIN_GROUP(pwm7), +- SH_PFC_PIN_GROUP(pwm8_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(pwm9_a), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(pwm8), ++ SH_PFC_PIN_GROUP(pwm9), + + SH_PFC_PIN_GROUP(qspi0_ctrl), + BUS_DATA_PIN_GROUP(qspi0_data, 2), +@@ -2891,8 +2891,7 @@ static const char * const pcie_groups[] = { + }; + + static const char * const pwm0_groups[] = { +- /* suffix might be updated */ +- "pwm0_a", ++ "pwm0", + }; + + static const char * const pwm1_groups[] = { +@@ -2901,8 +2900,7 @@ static const char * const pwm1_groups[] = { + }; + + static const char * const pwm2_groups[] = { +- /* suffix might be updated */ +- "pwm2_b", ++ "pwm2", + }; + + static const char * const pwm3_groups[] = { +@@ -2927,13 +2925,11 @@ static const char * const pwm7_groups[] = { + }; + + static const char * const pwm8_groups[] = { +- /* suffix might be updated */ +- "pwm8_a", ++ "pwm8", + }; + + static const char * const pwm9_groups[] = { +- /* suffix might be updated */ +- "pwm9_a", ++ "pwm9", + }; + + static const char * const qspi0_groups[] = { +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-renesas-r8a779g0-fix-tclk-suffixes.patch b/queue-6.1/pinctrl-renesas-r8a779g0-fix-tclk-suffixes.patch new file mode 100644 index 00000000000..c95cb7b3ec6 --- /dev/null +++ b/queue-6.1/pinctrl-renesas-r8a779g0-fix-tclk-suffixes.patch @@ -0,0 +1,189 @@ +From 8fa5ca8a92b30f3dab57542081e07b0aa3364ccb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:54 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix TCLK suffixes + +From: Geert Uytterhoeven + +[ Upstream commit bfd2428f3a80647af681df4793e473258aa755da ] + +The Pin Multiplex attachment in Rev.1.10 of the R-Car V4H Series +Hardware User's Manual still has two alternate pins named both TCLK3 +and TCLK4. To differentiate, the pin control driver uses "TCLK[34]" and +"TCLK[34]_X". In addition, there are alternate pins without suffix, and +with an "_A" or "_B" suffix. + +Increase uniformity by adopting R-Car V4M naming: + - Rename "TCLK2_B" to "TCLK2_C", + - Rename "TCLK[12]_A" to "TCLK[12]_B", + - Rename "TCLK[12]" to "TCLK[12]_A", + - Rename "TCLK[34]_A" to "TCLK[34]_C", + - Rename "TCLK[34]_X" to "TCLK[34]_A", + - Rename "TCLK[34]" to "TCLK[34]_B". + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 0df46188a58895e1 ("pinctrl: renesas: r8a779g0: Add missing TCLKx_A/TCLKx_B/TCLKx_X") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/2845ff1f8fe1fd8d23d2f307ad5e8eb8243da608.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 44 +++++++++++++------------- + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index f0c85192c5db5..27a2db38aa69c 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -269,7 +269,7 @@ + + /* SR0 */ + /* IP0SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR0_3_0 F_(0, 0) FM(ERROROUTC_N_B) FM(TCLK2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_3_0 F_(0, 0) FM(ERROROUTC_N_B) FM(TCLK2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR0_7_4 F_(0, 0) FM(MSIOF3_SS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR0_11_8 F_(0, 0) FM(MSIOF3_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR0_15_12 FM(IRQ3_A) FM(MSIOF3_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -284,7 +284,7 @@ + #define IP1SR0_11_8 FM(MSIOF5_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_15_12 FM(MSIOF5_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_19_16 FM(MSIOF5_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1) FM(IRQ2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1_A) FM(IRQ2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_27_24 FM(MSIOF2_SS1) FM(HTX1_A) FM(TX1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_31_28 FM(MSIOF2_SYNC) FM(HRX1_A) FM(RX1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + +@@ -317,12 +317,12 @@ + /* IP2SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP2SR1_3_0 FM(HRX0) FM(RX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_7_4 FM(SCIF_CLK) FM(IRQ4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_11_8 FM(SSI_SCK) FM(TCLK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_15_12 FM(SSI_WS) FM(TCLK4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_11_8 FM(SSI_SCK) FM(TCLK3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_15_12 FM(SSI_WS) FM(TCLK4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_19_16 FM(SSI_SD) FM(IRQ0_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_23_20 FM(AUDIO_CLKOUT) FM(IRQ1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_27_24 FM(AUDIO_CLKIN) FM(PWM3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_31_28 F_(0, 0) FM(TCLK2) FM(MSIOF4_SS1) FM(IRQ3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_31_28 F_(0, 0) FM(TCLK2_A) FM(MSIOF4_SS1) FM(IRQ3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP3SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP3SR1_3_0 FM(HRX3_A) FM(SCK3_A) FM(MSIOF4_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -340,15 +340,15 @@ + #define IP0SR2_19_16 FM(RXDB_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_23_20 FM(FXR_TXENB_N_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_27_24 FM(FXR_TXDB) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_31_28 FM(TPU0TO1) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_31_28 FM(TPU0TO1) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP1SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR2_3_0 FM(TPU0TO0) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_3_0 FM(TPU0TO0) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_7_4 FM(CAN_CLK) FM(FXR_TXENA_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_11_8 FM(CANFD0_TX) FM(FXR_TXENB_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_15_12 FM(CANFD0_RX) FM(STPWT_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_27_24 FM(CANFD3_TX) F_(0, 0) FM(PWM2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_31_28 FM(CANFD3_RX) F_(0, 0) FM(PWM3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + +@@ -375,8 +375,8 @@ + #define IP1SR3_11_8 FM(MMC_SD_CMD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR3_15_12 FM(SD_CD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR3_19_16 FM(SD_WP) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR3_23_20 FM(IPC_CLKIN) FM(IPC_CLKEN_IN) FM(PWM1_A) FM(TCLK3_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR3_27_24 FM(IPC_CLKOUT) FM(IPC_CLKEN_OUT) FM(ERROROUTC_N_A) FM(TCLK4_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR3_23_20 FM(IPC_CLKIN) FM(IPC_CLKEN_IN) FM(PWM1_A) FM(TCLK3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR3_27_24 FM(IPC_CLKOUT) FM(IPC_CLKEN_OUT) FM(ERROROUTC_N_A) FM(TCLK4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR3_31_28 FM(QSPI0_SSL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP2SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +@@ -712,7 +712,7 @@ static const u16 pinmux_data[] = { + + /* IP0SR0 */ + PINMUX_IPSR_GPSR(IP0SR0_3_0, ERROROUTC_N_B), +- PINMUX_IPSR_GPSR(IP0SR0_3_0, TCLK2_A), ++ PINMUX_IPSR_GPSR(IP0SR0_3_0, TCLK2_B), + + PINMUX_IPSR_GPSR(IP0SR0_7_4, MSIOF3_SS1), + +@@ -744,7 +744,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR0_19_16, MSIOF5_RXD), + + PINMUX_IPSR_GPSR(IP1SR0_23_20, MSIOF2_SS2), +- PINMUX_IPSR_GPSR(IP1SR0_23_20, TCLK1), ++ PINMUX_IPSR_GPSR(IP1SR0_23_20, TCLK1_A), + PINMUX_IPSR_GPSR(IP1SR0_23_20, IRQ2_B), + + PINMUX_IPSR_GPSR(IP1SR0_27_24, MSIOF2_SS1), +@@ -839,10 +839,10 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP2SR1_7_4, IRQ4_A), + + PINMUX_IPSR_GPSR(IP2SR1_11_8, SSI_SCK), +- PINMUX_IPSR_GPSR(IP2SR1_11_8, TCLK3), ++ PINMUX_IPSR_GPSR(IP2SR1_11_8, TCLK3_B), + + PINMUX_IPSR_GPSR(IP2SR1_15_12, SSI_WS), +- PINMUX_IPSR_GPSR(IP2SR1_15_12, TCLK4), ++ PINMUX_IPSR_GPSR(IP2SR1_15_12, TCLK4_B), + + PINMUX_IPSR_GPSR(IP2SR1_19_16, SSI_SD), + PINMUX_IPSR_GPSR(IP2SR1_19_16, IRQ0_B), +@@ -853,7 +853,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP2SR1_27_24, AUDIO_CLKIN), + PINMUX_IPSR_GPSR(IP2SR1_27_24, PWM3_A), + +- PINMUX_IPSR_GPSR(IP2SR1_31_28, TCLK2), ++ PINMUX_IPSR_GPSR(IP2SR1_31_28, TCLK2_A), + PINMUX_IPSR_GPSR(IP2SR1_31_28, MSIOF4_SS1), + PINMUX_IPSR_GPSR(IP2SR1_31_28, IRQ3_B), + +@@ -905,12 +905,12 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP0SR2_31_28, TPU0TO1), + PINMUX_IPSR_GPSR(IP0SR2_31_28, CANFD6_TX), +- PINMUX_IPSR_GPSR(IP0SR2_31_28, TCLK2_B), ++ PINMUX_IPSR_GPSR(IP0SR2_31_28, TCLK2_C), + + /* IP1SR2 */ + PINMUX_IPSR_GPSR(IP1SR2_3_0, TPU0TO0), + PINMUX_IPSR_GPSR(IP1SR2_3_0, CANFD6_RX), +- PINMUX_IPSR_GPSR(IP1SR2_3_0, TCLK1_A), ++ PINMUX_IPSR_GPSR(IP1SR2_3_0, TCLK1_B), + + PINMUX_IPSR_GPSR(IP1SR2_7_4, CAN_CLK), + PINMUX_IPSR_GPSR(IP1SR2_7_4, FXR_TXENA_N_B), +@@ -923,12 +923,12 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP1SR2_19_16, CANFD2_TX), + PINMUX_IPSR_GPSR(IP1SR2_19_16, TPU0TO2), +- PINMUX_IPSR_GPSR(IP1SR2_19_16, TCLK3_A), ++ PINMUX_IPSR_GPSR(IP1SR2_19_16, TCLK3_C), + + PINMUX_IPSR_GPSR(IP1SR2_23_20, CANFD2_RX), + PINMUX_IPSR_GPSR(IP1SR2_23_20, TPU0TO3), + PINMUX_IPSR_GPSR(IP1SR2_23_20, PWM1_B), +- PINMUX_IPSR_GPSR(IP1SR2_23_20, TCLK4_A), ++ PINMUX_IPSR_GPSR(IP1SR2_23_20, TCLK4_C), + + PINMUX_IPSR_GPSR(IP1SR2_27_24, CANFD3_TX), + PINMUX_IPSR_GPSR(IP1SR2_27_24, PWM2), +@@ -973,12 +973,12 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR3_23_20, IPC_CLKIN), + PINMUX_IPSR_GPSR(IP1SR3_23_20, IPC_CLKEN_IN), + PINMUX_IPSR_GPSR(IP1SR3_23_20, PWM1_A), +- PINMUX_IPSR_GPSR(IP1SR3_23_20, TCLK3_X), ++ PINMUX_IPSR_GPSR(IP1SR3_23_20, TCLK3_A), + + PINMUX_IPSR_GPSR(IP1SR3_27_24, IPC_CLKOUT), + PINMUX_IPSR_GPSR(IP1SR3_27_24, IPC_CLKEN_OUT), + PINMUX_IPSR_GPSR(IP1SR3_27_24, ERROROUTC_N_A), +- PINMUX_IPSR_GPSR(IP1SR3_27_24, TCLK4_X), ++ PINMUX_IPSR_GPSR(IP1SR3_27_24, TCLK4_A), + + PINMUX_IPSR_GPSR(IP1SR3_31_28, QSPI0_SSL), + +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-renesas-r8a779g0-fix-tpu-suffixes.patch b/queue-6.1/pinctrl-renesas-r8a779g0-fix-tpu-suffixes.patch new file mode 100644 index 00000000000..77e9922b323 --- /dev/null +++ b/queue-6.1/pinctrl-renesas-r8a779g0-fix-tpu-suffixes.patch @@ -0,0 +1,281 @@ +From 2d3e48a57e6ce668914cc56b13438e182fabd90f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:55 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix TPU suffixes + +From: Geert Uytterhoeven + +[ Upstream commit 3d144ef10a448f89065dcff39c40d90ac18e035e ] + +The Timer Pulse Unit channels have two alternate pin groups: +"tpu_to[0-3]" and "tpu_to[0-3]_a". + +Increase uniformity by adopting R-Car V4M naming: + - Rename "tpu_to[0-3]_a" to "tpu_to[0-3]_b", + - Rename "tpu_to[0-3]" to "tpu_to[0-3]_a", + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 050442ae4c74f830 ("pinctrl: renesas: r8a779g0: Add pins, groups and functions") +Fixes: 85a9cbe4c57bb958 ("pinctrl: renesas: r8a779g0: Add missing TPU0TOx_A") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/0dd9428bc24e97e1001ed3976b1cb98966f5e7e3.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 128 ++++++++++++------------- + 1 file changed, 63 insertions(+), 65 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index 27a2db38aa69c..595a5a4b02ecb 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -113,8 +113,8 @@ + #define GPSR2_11 F_(CANFD0_RX, IP1SR2_15_12) + #define GPSR2_10 F_(CANFD0_TX, IP1SR2_11_8) + #define GPSR2_9 F_(CAN_CLK, IP1SR2_7_4) +-#define GPSR2_8 F_(TPU0TO0, IP1SR2_3_0) +-#define GPSR2_7 F_(TPU0TO1, IP0SR2_31_28) ++#define GPSR2_8 F_(TPU0TO0_A, IP1SR2_3_0) ++#define GPSR2_7 F_(TPU0TO1_A, IP0SR2_31_28) + #define GPSR2_6 F_(FXR_TXDB, IP0SR2_27_24) + #define GPSR2_5 F_(FXR_TXENB_N_A, IP0SR2_23_20) + #define GPSR2_4 F_(RXDB_EXTFXR, IP0SR2_19_16) +@@ -326,29 +326,29 @@ + + /* IP3SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP3SR1_3_0 FM(HRX3_A) FM(SCK3_A) FM(MSIOF4_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_7_4 FM(HSCK3_A) FM(CTS3_N_A) FM(MSIOF4_SCK) FM(TPU0TO0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_11_8 FM(HRTS3_N_A) FM(RTS3_N_A) FM(MSIOF4_TXD) FM(TPU0TO1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_7_4 FM(HSCK3_A) FM(CTS3_N_A) FM(MSIOF4_SCK) FM(TPU0TO0_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_11_8 FM(HRTS3_N_A) FM(RTS3_N_A) FM(MSIOF4_TXD) FM(TPU0TO1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP3SR1_15_12 FM(HCTS3_N_A) FM(RX3_A) FM(MSIOF4_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP3SR1_19_16 FM(HTX3_A) FM(TX3_A) FM(MSIOF4_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR2 */ + /* IP0SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR2_3_0 FM(FXR_TXDA) FM(CANFD1_TX) FM(TPU0TO2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_7_4 FM(FXR_TXENA_N_A) FM(CANFD1_RX) FM(TPU0TO3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_3_0 FM(FXR_TXDA) FM(CANFD1_TX) FM(TPU0TO2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_7_4 FM(FXR_TXENA_N_A) FM(CANFD1_RX) FM(TPU0TO3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_11_8 FM(RXDA_EXTFXR) FM(CANFD5_TX_A) FM(IRQ5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_15_12 FM(CLK_EXTFXR) FM(CANFD5_RX_A) FM(IRQ4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_19_16 FM(RXDB_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_23_20 FM(FXR_TXENB_N_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_27_24 FM(FXR_TXDB) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_31_28 FM(TPU0TO1) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_31_28 FM(TPU0TO1_A) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP1SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR2_3_0 FM(TPU0TO0) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_3_0 FM(TPU0TO0_A) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_7_4 FM(CAN_CLK) FM(FXR_TXENA_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_11_8 FM(CANFD0_TX) FM(FXR_TXENB_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_15_12 FM(CANFD0_RX) FM(STPWT_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2_A) F_(0, 0) FM(TCLK3_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3_A) FM(PWM1_B) FM(TCLK4_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_27_24 FM(CANFD3_TX) F_(0, 0) FM(PWM2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_31_28 FM(CANFD3_RX) F_(0, 0) FM(PWM3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + +@@ -865,12 +865,12 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP3SR1_7_4, HSCK3_A), + PINMUX_IPSR_GPSR(IP3SR1_7_4, CTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_7_4, MSIOF4_SCK), +- PINMUX_IPSR_GPSR(IP3SR1_7_4, TPU0TO0_A), ++ PINMUX_IPSR_GPSR(IP3SR1_7_4, TPU0TO0_B), + + PINMUX_IPSR_GPSR(IP3SR1_11_8, HRTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_11_8, RTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_11_8, MSIOF4_TXD), +- PINMUX_IPSR_GPSR(IP3SR1_11_8, TPU0TO1_A), ++ PINMUX_IPSR_GPSR(IP3SR1_11_8, TPU0TO1_B), + + PINMUX_IPSR_GPSR(IP3SR1_15_12, HCTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_15_12, RX3_A), +@@ -883,11 +883,11 @@ static const u16 pinmux_data[] = { + /* IP0SR2 */ + PINMUX_IPSR_GPSR(IP0SR2_3_0, FXR_TXDA), + PINMUX_IPSR_GPSR(IP0SR2_3_0, CANFD1_TX), +- PINMUX_IPSR_GPSR(IP0SR2_3_0, TPU0TO2_A), ++ PINMUX_IPSR_GPSR(IP0SR2_3_0, TPU0TO2_B), + + PINMUX_IPSR_GPSR(IP0SR2_7_4, FXR_TXENA_N_A), + PINMUX_IPSR_GPSR(IP0SR2_7_4, CANFD1_RX), +- PINMUX_IPSR_GPSR(IP0SR2_7_4, TPU0TO3_A), ++ PINMUX_IPSR_GPSR(IP0SR2_7_4, TPU0TO3_B), + + PINMUX_IPSR_GPSR(IP0SR2_11_8, RXDA_EXTFXR), + PINMUX_IPSR_GPSR(IP0SR2_11_8, CANFD5_TX_A), +@@ -903,12 +903,12 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP0SR2_27_24, FXR_TXDB), + +- PINMUX_IPSR_GPSR(IP0SR2_31_28, TPU0TO1), ++ PINMUX_IPSR_GPSR(IP0SR2_31_28, TPU0TO1_A), + PINMUX_IPSR_GPSR(IP0SR2_31_28, CANFD6_TX), + PINMUX_IPSR_GPSR(IP0SR2_31_28, TCLK2_C), + + /* IP1SR2 */ +- PINMUX_IPSR_GPSR(IP1SR2_3_0, TPU0TO0), ++ PINMUX_IPSR_GPSR(IP1SR2_3_0, TPU0TO0_A), + PINMUX_IPSR_GPSR(IP1SR2_3_0, CANFD6_RX), + PINMUX_IPSR_GPSR(IP1SR2_3_0, TCLK1_B), + +@@ -922,11 +922,11 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR2_15_12, STPWT_EXTFXR), + + PINMUX_IPSR_GPSR(IP1SR2_19_16, CANFD2_TX), +- PINMUX_IPSR_GPSR(IP1SR2_19_16, TPU0TO2), ++ PINMUX_IPSR_GPSR(IP1SR2_19_16, TPU0TO2_A), + PINMUX_IPSR_GPSR(IP1SR2_19_16, TCLK3_C), + + PINMUX_IPSR_GPSR(IP1SR2_23_20, CANFD2_RX), +- PINMUX_IPSR_GPSR(IP1SR2_23_20, TPU0TO3), ++ PINMUX_IPSR_GPSR(IP1SR2_23_20, TPU0TO3_A), + PINMUX_IPSR_GPSR(IP1SR2_23_20, PWM1_B), + PINMUX_IPSR_GPSR(IP1SR2_23_20, TCLK4_C), + +@@ -2379,64 +2379,63 @@ static const unsigned int ssi_ctrl_mux[] = { + SSI_SCK_MARK, SSI_WS_MARK, + }; + +-/* - TPU ------------------------------------------------------------------- */ +-static const unsigned int tpu_to0_pins[] = { +- /* TPU0TO0 */ ++/* - TPU -------------------------------------------------------------------- */ ++static const unsigned int tpu_to0_a_pins[] = { ++ /* TPU0TO0_A */ + RCAR_GP_PIN(2, 8), + }; +-static const unsigned int tpu_to0_mux[] = { +- TPU0TO0_MARK, ++static const unsigned int tpu_to0_a_mux[] = { ++ TPU0TO0_A_MARK, + }; +-static const unsigned int tpu_to1_pins[] = { +- /* TPU0TO1 */ ++static const unsigned int tpu_to1_a_pins[] = { ++ /* TPU0TO1_A */ + RCAR_GP_PIN(2, 7), + }; +-static const unsigned int tpu_to1_mux[] = { +- TPU0TO1_MARK, ++static const unsigned int tpu_to1_a_mux[] = { ++ TPU0TO1_A_MARK, + }; +-static const unsigned int tpu_to2_pins[] = { +- /* TPU0TO2 */ ++static const unsigned int tpu_to2_a_pins[] = { ++ /* TPU0TO2_A */ + RCAR_GP_PIN(2, 12), + }; +-static const unsigned int tpu_to2_mux[] = { +- TPU0TO2_MARK, ++static const unsigned int tpu_to2_a_mux[] = { ++ TPU0TO2_A_MARK, + }; +-static const unsigned int tpu_to3_pins[] = { +- /* TPU0TO3 */ ++static const unsigned int tpu_to3_a_pins[] = { ++ /* TPU0TO3_A */ + RCAR_GP_PIN(2, 13), + }; +-static const unsigned int tpu_to3_mux[] = { +- TPU0TO3_MARK, ++static const unsigned int tpu_to3_a_mux[] = { ++ TPU0TO3_A_MARK, + }; + +-/* - TPU_A ------------------------------------------------------------------- */ +-static const unsigned int tpu_to0_a_pins[] = { +- /* TPU0TO0_A */ ++static const unsigned int tpu_to0_b_pins[] = { ++ /* TPU0TO0_B */ + RCAR_GP_PIN(1, 25), + }; +-static const unsigned int tpu_to0_a_mux[] = { +- TPU0TO0_A_MARK, ++static const unsigned int tpu_to0_b_mux[] = { ++ TPU0TO0_B_MARK, + }; +-static const unsigned int tpu_to1_a_pins[] = { +- /* TPU0TO1_A */ ++static const unsigned int tpu_to1_b_pins[] = { ++ /* TPU0TO1_B */ + RCAR_GP_PIN(1, 26), + }; +-static const unsigned int tpu_to1_a_mux[] = { +- TPU0TO1_A_MARK, ++static const unsigned int tpu_to1_b_mux[] = { ++ TPU0TO1_B_MARK, + }; +-static const unsigned int tpu_to2_a_pins[] = { +- /* TPU0TO2_A */ ++static const unsigned int tpu_to2_b_pins[] = { ++ /* TPU0TO2_B */ + RCAR_GP_PIN(2, 0), + }; +-static const unsigned int tpu_to2_a_mux[] = { +- TPU0TO2_A_MARK, ++static const unsigned int tpu_to2_b_mux[] = { ++ TPU0TO2_B_MARK, + }; +-static const unsigned int tpu_to3_a_pins[] = { +- /* TPU0TO3_A */ ++static const unsigned int tpu_to3_b_pins[] = { ++ /* TPU0TO3_B */ + RCAR_GP_PIN(2, 1), + }; +-static const unsigned int tpu_to3_a_mux[] = { +- TPU0TO3_A_MARK, ++static const unsigned int tpu_to3_b_mux[] = { ++ TPU0TO3_B_MARK, + }; + + /* - TSN0 ------------------------------------------------ */ +@@ -2675,14 +2674,14 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(ssi_data), + SH_PFC_PIN_GROUP(ssi_ctrl), + +- SH_PFC_PIN_GROUP(tpu_to0), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to0_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to1), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to1_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to2), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to2_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to3), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to3_a), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(tpu_to0_a), ++ SH_PFC_PIN_GROUP(tpu_to0_b), ++ SH_PFC_PIN_GROUP(tpu_to1_a), ++ SH_PFC_PIN_GROUP(tpu_to1_b), ++ SH_PFC_PIN_GROUP(tpu_to2_a), ++ SH_PFC_PIN_GROUP(tpu_to2_b), ++ SH_PFC_PIN_GROUP(tpu_to3_a), ++ SH_PFC_PIN_GROUP(tpu_to3_b), + + SH_PFC_PIN_GROUP(tsn0_link), + SH_PFC_PIN_GROUP(tsn0_phy_int), +@@ -2988,15 +2987,14 @@ static const char * const ssi_groups[] = { + }; + + static const char * const tpu_groups[] = { +- /* suffix might be updated */ +- "tpu_to0", + "tpu_to0_a", +- "tpu_to1", ++ "tpu_to0_b", + "tpu_to1_a", +- "tpu_to2", ++ "tpu_to1_b", + "tpu_to2_a", +- "tpu_to3", ++ "tpu_to2_b", + "tpu_to3_a", ++ "tpu_to3_b", + }; + + static const char * const tsn0_groups[] = { +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-rockchip-update-rk3308-iomux-routes.patch b/queue-6.1/pinctrl-rockchip-update-rk3308-iomux-routes.patch new file mode 100644 index 00000000000..2a06b81d9e2 --- /dev/null +++ b/queue-6.1/pinctrl-rockchip-update-rk3308-iomux-routes.patch @@ -0,0 +1,60 @@ +From 37e98f719262545b13bbc99a02534874915f8c44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 17:16:32 +0500 +Subject: pinctrl: rockchip: update rk3308 iomux routes + +From: Dmitry Yashin + +[ Upstream commit a8f2548548584549ea29d43431781d67c4afa42b ] + +Some of the rk3308 iomux routes in rk3308_mux_route_data belong to +the rk3308b SoC. Remove them and correct i2c3 routes. + +Fixes: 7825aeb7b208 ("pinctrl: rockchip: add rk3308 SoC support") +Signed-off-by: Dmitry Yashin +Reviewed-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20240515121634.23945-2-dmt.yashin@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-rockchip.c | 17 ++--------------- + 1 file changed, 2 insertions(+), 15 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index d26682f21ad1e..6d140a60888c2 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -916,9 +916,8 @@ static struct rockchip_mux_route_data rk3308_mux_route_data[] = { + RK_MUXROUTE_SAME(0, RK_PC3, 1, 0x314, BIT(16 + 0) | BIT(0)), /* rtc_clk */ + RK_MUXROUTE_SAME(1, RK_PC6, 2, 0x314, BIT(16 + 2) | BIT(16 + 3)), /* uart2_rxm0 */ + RK_MUXROUTE_SAME(4, RK_PD2, 2, 0x314, BIT(16 + 2) | BIT(16 + 3) | BIT(2)), /* uart2_rxm1 */ +- RK_MUXROUTE_SAME(0, RK_PB7, 2, 0x608, BIT(16 + 8) | BIT(16 + 9)), /* i2c3_sdam0 */ +- RK_MUXROUTE_SAME(3, RK_PB4, 2, 0x608, BIT(16 + 8) | BIT(16 + 9) | BIT(8)), /* i2c3_sdam1 */ +- RK_MUXROUTE_SAME(2, RK_PA0, 3, 0x608, BIT(16 + 8) | BIT(16 + 9) | BIT(9)), /* i2c3_sdam2 */ ++ RK_MUXROUTE_SAME(0, RK_PB7, 2, 0x314, BIT(16 + 4)), /* i2c3_sdam0 */ ++ RK_MUXROUTE_SAME(3, RK_PB4, 2, 0x314, BIT(16 + 4) | BIT(4)), /* i2c3_sdam1 */ + RK_MUXROUTE_SAME(1, RK_PA3, 2, 0x308, BIT(16 + 3)), /* i2s-8ch-1-sclktxm0 */ + RK_MUXROUTE_SAME(1, RK_PA4, 2, 0x308, BIT(16 + 3)), /* i2s-8ch-1-sclkrxm0 */ + RK_MUXROUTE_SAME(1, RK_PB5, 2, 0x308, BIT(16 + 3) | BIT(3)), /* i2s-8ch-1-sclktxm1 */ +@@ -927,18 +926,6 @@ static struct rockchip_mux_route_data rk3308_mux_route_data[] = { + RK_MUXROUTE_SAME(1, RK_PB6, 4, 0x308, BIT(16 + 12) | BIT(16 + 13) | BIT(12)), /* pdm-clkm1 */ + RK_MUXROUTE_SAME(2, RK_PA6, 2, 0x308, BIT(16 + 12) | BIT(16 + 13) | BIT(13)), /* pdm-clkm2 */ + RK_MUXROUTE_SAME(2, RK_PA4, 3, 0x600, BIT(16 + 2) | BIT(2)), /* pdm-clkm-m2 */ +- RK_MUXROUTE_SAME(3, RK_PB2, 3, 0x314, BIT(16 + 9)), /* spi1_miso */ +- RK_MUXROUTE_SAME(2, RK_PA4, 2, 0x314, BIT(16 + 9) | BIT(9)), /* spi1_miso_m1 */ +- RK_MUXROUTE_SAME(0, RK_PB3, 3, 0x314, BIT(16 + 10) | BIT(16 + 11)), /* owire_m0 */ +- RK_MUXROUTE_SAME(1, RK_PC6, 7, 0x314, BIT(16 + 10) | BIT(16 + 11) | BIT(10)), /* owire_m1 */ +- RK_MUXROUTE_SAME(2, RK_PA2, 5, 0x314, BIT(16 + 10) | BIT(16 + 11) | BIT(11)), /* owire_m2 */ +- RK_MUXROUTE_SAME(0, RK_PB3, 2, 0x314, BIT(16 + 12) | BIT(16 + 13)), /* can_rxd_m0 */ +- RK_MUXROUTE_SAME(1, RK_PC6, 5, 0x314, BIT(16 + 12) | BIT(16 + 13) | BIT(12)), /* can_rxd_m1 */ +- RK_MUXROUTE_SAME(2, RK_PA2, 4, 0x314, BIT(16 + 12) | BIT(16 + 13) | BIT(13)), /* can_rxd_m2 */ +- RK_MUXROUTE_SAME(1, RK_PC4, 3, 0x314, BIT(16 + 14)), /* mac_rxd0_m0 */ +- RK_MUXROUTE_SAME(4, RK_PA2, 2, 0x314, BIT(16 + 14) | BIT(14)), /* mac_rxd0_m1 */ +- RK_MUXROUTE_SAME(3, RK_PB4, 4, 0x314, BIT(16 + 15)), /* uart3_rx */ +- RK_MUXROUTE_SAME(0, RK_PC1, 3, 0x314, BIT(16 + 15) | BIT(15)), /* uart3_rx_m1 */ + }; + + static struct rockchip_mux_route_data rk3328_mux_route_data[] = { +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-single-fix-possible-memory-leak-when-pinctrl.patch b/queue-6.1/pinctrl-single-fix-possible-memory-leak-when-pinctrl.patch new file mode 100644 index 00000000000..43e7fa7e800 --- /dev/null +++ b/queue-6.1/pinctrl-single-fix-possible-memory-leak-when-pinctrl.patch @@ -0,0 +1,60 @@ +From e89faee8029bc85385b530418e65f69f2cbb2a8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:37:03 +0800 +Subject: pinctrl: single: fix possible memory leak when pinctrl_enable() fails + +From: Yang Yingliang + +[ Upstream commit 8f773bfbdd428819328a2d185976cfc6ae811cd3 ] + +This driver calls pinctrl_register_and_init() which is not +devm_ managed, it will leads memory leak if pinctrl_enable() +fails. Replace it with devm_pinctrl_register_and_init(). +And call pcs_free_resources() if pinctrl_enable() fails. + +Fixes: 5038a66dad01 ("pinctrl: core: delete incorrect free in pinctrl_enable()") +Signed-off-by: Yang Yingliang +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20240606023704.3931561-3-yangyingliang@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-single.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c +index 9ad8f70206142..cd23479f352a2 100644 +--- a/drivers/pinctrl/pinctrl-single.c ++++ b/drivers/pinctrl/pinctrl-single.c +@@ -1328,7 +1328,6 @@ static void pcs_irq_free(struct pcs_device *pcs) + static void pcs_free_resources(struct pcs_device *pcs) + { + pcs_irq_free(pcs); +- pinctrl_unregister(pcs->pctl); + + #if IS_BUILTIN(CONFIG_PINCTRL_SINGLE) + if (pcs->missing_nr_pinctrl_cells) +@@ -1885,7 +1884,7 @@ static int pcs_probe(struct platform_device *pdev) + if (ret < 0) + goto free; + +- ret = pinctrl_register_and_init(&pcs->desc, pcs->dev, pcs, &pcs->pctl); ++ ret = devm_pinctrl_register_and_init(pcs->dev, &pcs->desc, pcs, &pcs->pctl); + if (ret) { + dev_err(pcs->dev, "could not register single pinctrl driver\n"); + goto free; +@@ -1918,8 +1917,10 @@ static int pcs_probe(struct platform_device *pdev) + + dev_info(pcs->dev, "%i pins, size %u\n", pcs->desc.npins, pcs->size); + +- return pinctrl_enable(pcs->pctl); ++ if (pinctrl_enable(pcs->pctl)) ++ goto free; + ++ return 0; + free: + pcs_free_resources(pcs); + +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-ti-ti-iodelay-drop-if-block-with-always-fals.patch b/queue-6.1/pinctrl-ti-ti-iodelay-drop-if-block-with-always-fals.patch new file mode 100644 index 00000000000..db73b413d2d --- /dev/null +++ b/queue-6.1/pinctrl-ti-ti-iodelay-drop-if-block-with-always-fals.patch @@ -0,0 +1,44 @@ +From 802d39cc2d94e1b7e15b80ae70f35782dedad3e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Oct 2023 10:38:39 +0200 +Subject: pinctrl: ti: ti-iodelay: Drop if block with always false condition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 88b3f108502bc45e6ebd005702add46759f3f45a ] + +ti_iodelay_remove() is only called after ti_iodelay_probe() completed +successfully. In this case platform_set_drvdata() was called with a +non-NULL argument and so platform_get_drvdata() won't return NULL. + +Simplify by removing the if block with the always false condition. + +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20231009083856.222030-4-u.kleine-koenig@pengutronix.de +Signed-off-by: Linus Walleij +Stable-dep-of: 9b401f4a7170 ("pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails") +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c +index 4e2382778d38f..75a2243ee87cc 100644 +--- a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c ++++ b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c +@@ -908,9 +908,6 @@ static int ti_iodelay_remove(struct platform_device *pdev) + { + struct ti_iodelay_device *iod = platform_get_drvdata(pdev); + +- if (!iod) +- return 0; +- + if (iod->pctl) + pinctrl_unregister(iod->pctl); + +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-ti-ti-iodelay-fix-possible-memory-leak-when-.patch b/queue-6.1/pinctrl-ti-ti-iodelay-fix-possible-memory-leak-when-.patch new file mode 100644 index 00000000000..fcdfdfe9735 --- /dev/null +++ b/queue-6.1/pinctrl-ti-ti-iodelay-fix-possible-memory-leak-when-.patch @@ -0,0 +1,64 @@ +From beb6888ea516d99552babcac46019c425fbc395d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:37:04 +0800 +Subject: pinctrl: ti: ti-iodelay: fix possible memory leak when + pinctrl_enable() fails + +From: Yang Yingliang + +[ Upstream commit 9b401f4a7170125365160c9af267a41ff6b39001 ] + +This driver calls pinctrl_register_and_init() which is not +devm_ managed, it will leads memory leak if pinctrl_enable() +fails. Replace it with devm_pinctrl_register_and_init(). +And add missing of_node_put() in the error path. + +Fixes: 5038a66dad01 ("pinctrl: core: delete incorrect free in pinctrl_enable()") +Signed-off-by: Yang Yingliang +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20240606023704.3931561-4-yangyingliang@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c +index 75a2243ee87cc..f3411e3eaf2ea 100644 +--- a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c ++++ b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c +@@ -883,7 +883,7 @@ static int ti_iodelay_probe(struct platform_device *pdev) + iod->desc.name = dev_name(dev); + iod->desc.owner = THIS_MODULE; + +- ret = pinctrl_register_and_init(&iod->desc, dev, iod, &iod->pctl); ++ ret = devm_pinctrl_register_and_init(dev, &iod->desc, iod, &iod->pctl); + if (ret) { + dev_err(dev, "Failed to register pinctrl\n"); + goto exit_out; +@@ -891,7 +891,11 @@ static int ti_iodelay_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, iod); + +- return pinctrl_enable(iod->pctl); ++ ret = pinctrl_enable(iod->pctl); ++ if (ret) ++ goto exit_out; ++ ++ return 0; + + exit_out: + of_node_put(np); +@@ -908,9 +912,6 @@ static int ti_iodelay_remove(struct platform_device *pdev) + { + struct ti_iodelay_device *iod = platform_get_drvdata(pdev); + +- if (iod->pctl) +- pinctrl_unregister(iod->pctl); +- + ti_iodelay_pinconf_deinit_dev(iod); + + /* Expect other allocations to be freed by devm */ +-- +2.43.0 + diff --git a/queue-6.1/platform-chrome-cros_ec_debugfs-fix-wrong-ec-message.patch b/queue-6.1/platform-chrome-cros_ec_debugfs-fix-wrong-ec-message.patch new file mode 100644 index 00000000000..bd790c73b9e --- /dev/null +++ b/queue-6.1/platform-chrome-cros_ec_debugfs-fix-wrong-ec-message.patch @@ -0,0 +1,38 @@ +From f9d0bf71c907a84550412654d0ae0295827b6196 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 11:31:10 +0000 +Subject: platform/chrome: cros_ec_debugfs: fix wrong EC message version + +From: Tzung-Bi Shih + +[ Upstream commit c2a28647bbb4e0894e8824362410f72b06ac57a4 ] + +ec_read_version_supported() uses ec_params_get_cmd_versions_v1 but it +wrongly uses message version 0. + +Fix it. + +Fixes: e86264595225 ("mfd: cros_ec: add debugfs, console log file") +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20240611113110.16955-1-tzungbi@kernel.org +Signed-off-by: Tzung-Bi Shih +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_ec_debugfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/chrome/cros_ec_debugfs.c b/drivers/platform/chrome/cros_ec_debugfs.c +index 4e63adf083ea1..b19207f3aecfe 100644 +--- a/drivers/platform/chrome/cros_ec_debugfs.c ++++ b/drivers/platform/chrome/cros_ec_debugfs.c +@@ -326,6 +326,7 @@ static int ec_read_version_supported(struct cros_ec_dev *ec) + if (!msg) + return 0; + ++ msg->version = 1; + msg->command = EC_CMD_GET_CMD_VERSIONS + ec->cmd_offset; + msg->outsize = sizeof(*params); + msg->insize = sizeof(*response); +-- +2.43.0 + diff --git a/queue-6.1/powerpc-kexec-make-the-update_cpus_node-function-pub.patch b/queue-6.1/powerpc-kexec-make-the-update_cpus_node-function-pub.patch new file mode 100644 index 00000000000..1c32582fb1e --- /dev/null +++ b/queue-6.1/powerpc-kexec-make-the-update_cpus_node-function-pub.patch @@ -0,0 +1,259 @@ +From 60ae9450396dedcd8f79f2e662a7c0c1cea5f003 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 11:24:11 +0530 +Subject: powerpc/kexec: make the update_cpus_node() function public + +From: Sourabh Jain + +[ Upstream commit 0857beff9c1ec8bb421a8b7a721da0f34cc886c0 ] + +Move the update_cpus_node() from kexec/{file_load_64.c => core_64.c} +to allow other kexec components to use it. + +Later in the series, this function is used for in-kernel updates +to the kdump image during CPU/memory hotplug or online/offline events for +both kexec_load and kexec_file_load syscalls. + +No functional changes are intended. + +Signed-off-by: Sourabh Jain +Acked-by: Hari Bathini +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240326055413.186534-5-sourabhjain@linux.ibm.com +Stable-dep-of: 932bed412170 ("powerpc/kexec_file: fix cpus node update to FDT") +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/kexec.h | 4 ++ + arch/powerpc/kexec/core_64.c | 91 +++++++++++++++++++++++++++++++ + arch/powerpc/kexec/file_load_64.c | 87 ----------------------------- + 3 files changed, 95 insertions(+), 87 deletions(-) + +diff --git a/arch/powerpc/include/asm/kexec.h b/arch/powerpc/include/asm/kexec.h +index a1ddba01e7d13..f2db1b443920e 100644 +--- a/arch/powerpc/include/asm/kexec.h ++++ b/arch/powerpc/include/asm/kexec.h +@@ -181,6 +181,10 @@ static inline void crash_send_ipi(void (*crash_ipi_callback)(struct pt_regs *)) + + #endif /* CONFIG_KEXEC_CORE */ + ++#if defined(CONFIG_KEXEC_FILE) || defined(CONFIG_CRASH_DUMP) ++int update_cpus_node(void *fdt); ++#endif ++ + #ifdef CONFIG_PPC_BOOK3S_64 + #include + #endif +diff --git a/arch/powerpc/kexec/core_64.c b/arch/powerpc/kexec/core_64.c +index e465e44877376..8a33de499316e 100644 +--- a/arch/powerpc/kexec/core_64.c ++++ b/arch/powerpc/kexec/core_64.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -31,6 +32,7 @@ + #include + #include + #include ++#include + + int machine_kexec_prepare(struct kimage *image) + { +@@ -431,3 +433,92 @@ static int __init export_htab_values(void) + } + late_initcall(export_htab_values); + #endif /* CONFIG_PPC_64S_HASH_MMU */ ++ ++#if defined(CONFIG_KEXEC_FILE) || defined(CONFIG_CRASH_DUMP) ++/** ++ * add_node_props - Reads node properties from device node structure and add ++ * them to fdt. ++ * @fdt: Flattened device tree of the kernel ++ * @node_offset: offset of the node to add a property at ++ * @dn: device node pointer ++ * ++ * Returns 0 on success, negative errno on error. ++ */ ++static int add_node_props(void *fdt, int node_offset, const struct device_node *dn) ++{ ++ int ret = 0; ++ struct property *pp; ++ ++ if (!dn) ++ return -EINVAL; ++ ++ for_each_property_of_node(dn, pp) { ++ ret = fdt_setprop(fdt, node_offset, pp->name, pp->value, pp->length); ++ if (ret < 0) { ++ pr_err("Unable to add %s property: %s\n", pp->name, fdt_strerror(ret)); ++ return ret; ++ } ++ } ++ return ret; ++} ++ ++/** ++ * update_cpus_node - Update cpus node of flattened device tree using of_root ++ * device node. ++ * @fdt: Flattened device tree of the kernel. ++ * ++ * Returns 0 on success, negative errno on error. ++ */ ++int update_cpus_node(void *fdt) ++{ ++ struct device_node *cpus_node, *dn; ++ int cpus_offset, cpus_subnode_offset, ret = 0; ++ ++ cpus_offset = fdt_path_offset(fdt, "/cpus"); ++ if (cpus_offset < 0 && cpus_offset != -FDT_ERR_NOTFOUND) { ++ pr_err("Malformed device tree: error reading /cpus node: %s\n", ++ fdt_strerror(cpus_offset)); ++ return cpus_offset; ++ } ++ ++ if (cpus_offset > 0) { ++ ret = fdt_del_node(fdt, cpus_offset); ++ if (ret < 0) { ++ pr_err("Error deleting /cpus node: %s\n", fdt_strerror(ret)); ++ return -EINVAL; ++ } ++ } ++ ++ /* Add cpus node to fdt */ ++ cpus_offset = fdt_add_subnode(fdt, fdt_path_offset(fdt, "/"), "cpus"); ++ if (cpus_offset < 0) { ++ pr_err("Error creating /cpus node: %s\n", fdt_strerror(cpus_offset)); ++ return -EINVAL; ++ } ++ ++ /* Add cpus node properties */ ++ cpus_node = of_find_node_by_path("/cpus"); ++ ret = add_node_props(fdt, cpus_offset, cpus_node); ++ of_node_put(cpus_node); ++ if (ret < 0) ++ return ret; ++ ++ /* Loop through all subnodes of cpus and add them to fdt */ ++ for_each_node_by_type(dn, "cpu") { ++ cpus_subnode_offset = fdt_add_subnode(fdt, cpus_offset, dn->full_name); ++ if (cpus_subnode_offset < 0) { ++ pr_err("Unable to add %s subnode: %s\n", dn->full_name, ++ fdt_strerror(cpus_subnode_offset)); ++ ret = cpus_subnode_offset; ++ goto out; ++ } ++ ++ ret = add_node_props(fdt, cpus_subnode_offset, dn); ++ if (ret < 0) ++ goto out; ++ } ++out: ++ of_node_put(dn); ++ return ret; ++} ++#endif /* CONFIG_KEXEC_FILE || CONFIG_CRASH_DUMP */ +diff --git a/arch/powerpc/kexec/file_load_64.c b/arch/powerpc/kexec/file_load_64.c +index 349a781cea0b3..180c1dfe4aa77 100644 +--- a/arch/powerpc/kexec/file_load_64.c ++++ b/arch/powerpc/kexec/file_load_64.c +@@ -952,93 +952,6 @@ unsigned int kexec_extra_fdt_size_ppc64(struct kimage *image) + return (unsigned int)(usm_entries * sizeof(u64)); + } + +-/** +- * add_node_props - Reads node properties from device node structure and add +- * them to fdt. +- * @fdt: Flattened device tree of the kernel +- * @node_offset: offset of the node to add a property at +- * @dn: device node pointer +- * +- * Returns 0 on success, negative errno on error. +- */ +-static int add_node_props(void *fdt, int node_offset, const struct device_node *dn) +-{ +- int ret = 0; +- struct property *pp; +- +- if (!dn) +- return -EINVAL; +- +- for_each_property_of_node(dn, pp) { +- ret = fdt_setprop(fdt, node_offset, pp->name, pp->value, pp->length); +- if (ret < 0) { +- pr_err("Unable to add %s property: %s\n", pp->name, fdt_strerror(ret)); +- return ret; +- } +- } +- return ret; +-} +- +-/** +- * update_cpus_node - Update cpus node of flattened device tree using of_root +- * device node. +- * @fdt: Flattened device tree of the kernel. +- * +- * Returns 0 on success, negative errno on error. +- */ +-static int update_cpus_node(void *fdt) +-{ +- struct device_node *cpus_node, *dn; +- int cpus_offset, cpus_subnode_offset, ret = 0; +- +- cpus_offset = fdt_path_offset(fdt, "/cpus"); +- if (cpus_offset < 0 && cpus_offset != -FDT_ERR_NOTFOUND) { +- pr_err("Malformed device tree: error reading /cpus node: %s\n", +- fdt_strerror(cpus_offset)); +- return cpus_offset; +- } +- +- if (cpus_offset > 0) { +- ret = fdt_del_node(fdt, cpus_offset); +- if (ret < 0) { +- pr_err("Error deleting /cpus node: %s\n", fdt_strerror(ret)); +- return -EINVAL; +- } +- } +- +- /* Add cpus node to fdt */ +- cpus_offset = fdt_add_subnode(fdt, fdt_path_offset(fdt, "/"), "cpus"); +- if (cpus_offset < 0) { +- pr_err("Error creating /cpus node: %s\n", fdt_strerror(cpus_offset)); +- return -EINVAL; +- } +- +- /* Add cpus node properties */ +- cpus_node = of_find_node_by_path("/cpus"); +- ret = add_node_props(fdt, cpus_offset, cpus_node); +- of_node_put(cpus_node); +- if (ret < 0) +- return ret; +- +- /* Loop through all subnodes of cpus and add them to fdt */ +- for_each_node_by_type(dn, "cpu") { +- cpus_subnode_offset = fdt_add_subnode(fdt, cpus_offset, dn->full_name); +- if (cpus_subnode_offset < 0) { +- pr_err("Unable to add %s subnode: %s\n", dn->full_name, +- fdt_strerror(cpus_subnode_offset)); +- ret = cpus_subnode_offset; +- goto out; +- } +- +- ret = add_node_props(fdt, cpus_subnode_offset, dn); +- if (ret < 0) +- goto out; +- } +-out: +- of_node_put(dn); +- return ret; +-} +- + static int copy_property(void *fdt, int node_offset, const struct device_node *dn, + const char *propname) + { +-- +2.43.0 + diff --git a/queue-6.1/powerpc-kexec_file-fix-cpus-node-update-to-fdt.patch b/queue-6.1/powerpc-kexec_file-fix-cpus-node-update-to-fdt.patch new file mode 100644 index 00000000000..2c3d9646cd9 --- /dev/null +++ b/queue-6.1/powerpc-kexec_file-fix-cpus-node-update-to-fdt.patch @@ -0,0 +1,119 @@ +From 383f31654bdad933173a7b183dbc8596a7fef422 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 15:52:35 +0530 +Subject: powerpc/kexec_file: fix cpus node update to FDT + +From: Sourabh Jain + +[ Upstream commit 932bed41217059638c78a75411b7893b121d2162 ] + +While updating the cpus node, commit 40c753993e3a ("powerpc/kexec_file: + Use current CPU info while setting up FDT") first deletes all subnodes +under the /cpus node. However, while adding sub-nodes back, it missed +adding cpus subnodes whose device_type != "cpu", such as l2-cache*, +l3-cache*, ibm,powerpc-cpu-features. + +Fix this by only deleting cpus sub-nodes of device_type == "cpus" and +then adding all available nodes with device_type == "cpu". + +Fixes: 40c753993e3a ("powerpc/kexec_file: Use current CPU info while setting up FDT") +Signed-off-by: Sourabh Jain +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240510102235.2269496-3-sourabhjain@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kexec/core_64.c | 53 +++++++++++++++++++++++++----------- + 1 file changed, 37 insertions(+), 16 deletions(-) + +diff --git a/arch/powerpc/kexec/core_64.c b/arch/powerpc/kexec/core_64.c +index 8a33de499316e..653b3c8c6a530 100644 +--- a/arch/powerpc/kexec/core_64.c ++++ b/arch/powerpc/kexec/core_64.c +@@ -468,9 +468,15 @@ static int add_node_props(void *fdt, int node_offset, const struct device_node * + * @fdt: Flattened device tree of the kernel. + * + * Returns 0 on success, negative errno on error. ++ * ++ * Note: expecting no subnodes under /cpus/ with device_type == "cpu". ++ * If this changes, update this function to include them. + */ + int update_cpus_node(void *fdt) + { ++ int prev_node_offset; ++ const char *device_type; ++ const struct fdt_property *prop; + struct device_node *cpus_node, *dn; + int cpus_offset, cpus_subnode_offset, ret = 0; + +@@ -481,30 +487,44 @@ int update_cpus_node(void *fdt) + return cpus_offset; + } + +- if (cpus_offset > 0) { +- ret = fdt_del_node(fdt, cpus_offset); ++ prev_node_offset = cpus_offset; ++ /* Delete sub-nodes of /cpus node with device_type == "cpu" */ ++ for (cpus_subnode_offset = fdt_first_subnode(fdt, cpus_offset); cpus_subnode_offset >= 0;) { ++ /* Ignore nodes that do not have a device_type property or device_type != "cpu" */ ++ prop = fdt_get_property(fdt, cpus_subnode_offset, "device_type", NULL); ++ if (!prop || strcmp(prop->data, "cpu")) { ++ prev_node_offset = cpus_subnode_offset; ++ goto next_node; ++ } ++ ++ ret = fdt_del_node(fdt, cpus_subnode_offset); + if (ret < 0) { +- pr_err("Error deleting /cpus node: %s\n", fdt_strerror(ret)); +- return -EINVAL; ++ pr_err("Failed to delete a cpus sub-node: %s\n", fdt_strerror(ret)); ++ return ret; + } ++next_node: ++ if (prev_node_offset == cpus_offset) ++ cpus_subnode_offset = fdt_first_subnode(fdt, cpus_offset); ++ else ++ cpus_subnode_offset = fdt_next_subnode(fdt, prev_node_offset); + } + +- /* Add cpus node to fdt */ +- cpus_offset = fdt_add_subnode(fdt, fdt_path_offset(fdt, "/"), "cpus"); +- if (cpus_offset < 0) { +- pr_err("Error creating /cpus node: %s\n", fdt_strerror(cpus_offset)); ++ cpus_node = of_find_node_by_path("/cpus"); ++ /* Fail here to avoid kexec/kdump kernel boot hung */ ++ if (!cpus_node) { ++ pr_err("No /cpus node found\n"); + return -EINVAL; + } + +- /* Add cpus node properties */ +- cpus_node = of_find_node_by_path("/cpus"); +- ret = add_node_props(fdt, cpus_offset, cpus_node); +- of_node_put(cpus_node); +- if (ret < 0) +- return ret; ++ /* Add all /cpus sub-nodes of device_type == "cpu" to FDT */ ++ for_each_child_of_node(cpus_node, dn) { ++ /* Ignore device nodes that do not have a device_type property ++ * or device_type != "cpu". ++ */ ++ device_type = of_get_property(dn, "device_type", NULL); ++ if (!device_type || strcmp(device_type, "cpu")) ++ continue; + +- /* Loop through all subnodes of cpus and add them to fdt */ +- for_each_node_by_type(dn, "cpu") { + cpus_subnode_offset = fdt_add_subnode(fdt, cpus_offset, dn->full_name); + if (cpus_subnode_offset < 0) { + pr_err("Unable to add %s subnode: %s\n", dn->full_name, +@@ -518,6 +538,7 @@ int update_cpus_node(void *fdt) + goto out; + } + out: ++ of_node_put(cpus_node); + of_node_put(dn); + return ret; + } +-- +2.43.0 + diff --git a/queue-6.1/powerpc-prom-add-cpu-info-to-hardware-description-st.patch b/queue-6.1/powerpc-prom-add-cpu-info-to-hardware-description-st.patch new file mode 100644 index 00000000000..cd3d9d8cf4f --- /dev/null +++ b/queue-6.1/powerpc-prom-add-cpu-info-to-hardware-description-st.patch @@ -0,0 +1,86 @@ +From cd7519d63a61d845c2a826f5238b6a82df733ed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 07:36:55 -0500 +Subject: powerpc/prom: Add CPU info to hardware description string later + +From: Nathan Lynch + +[ Upstream commit 7bdd1c6c87de758750d419eedab7285b95b66417 ] + +cur_cpu_spec->cpu_name is appended to ppc_hw_desc before cur_cpu_spec +has taken on its final value. This is illustrated on pseries by +comparing the CPU name as reported at boot ("POWER8E (raw)") to the +contents of /proc/cpuinfo ("POWER8 (architected)"): + + $ dmesg | grep Hardware + Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 \ + of:IBM,FW860.50 (SV860_146) hv:phyp pSeries + + $ grep -m 1 ^cpu /proc/cpuinfo + cpu : POWER8 (architected), altivec supported + +Some 44x models would appear to be affected as well; see +identical_pvr_fixup(). + +This results in incorrect CPU information in stack dumps -- +ppc_hw_desc is an input to dump_stack_set_arch_desc(). + +Delay gathering the CPU name until after all potential calls to +identify_cpu(). + +Signed-off-by: Nathan Lynch +Fixes: bd649d40e0f2 ("powerpc: Add PVR & CPU name to hardware description") +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240603-fix-cpu-hwdesc-v1-1-945f2850fcaa@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index 9531ab90feb8a..e5b90d67cd536 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -324,6 +324,7 @@ static int __init early_init_dt_scan_cpus(unsigned long node, + void *data) + { + const char *type = of_get_flat_dt_prop(node, "device_type", NULL); ++ const __be32 *cpu_version = NULL; + const __be32 *prop; + const __be32 *intserv; + int i, nthreads; +@@ -404,7 +405,7 @@ static int __init early_init_dt_scan_cpus(unsigned long node, + prop = of_get_flat_dt_prop(node, "cpu-version", NULL); + if (prop && (be32_to_cpup(prop) & 0xff000000) == 0x0f000000) { + identify_cpu(0, be32_to_cpup(prop)); +- seq_buf_printf(&ppc_hw_desc, "0x%04x ", be32_to_cpup(prop)); ++ cpu_version = prop; + } + + check_cpu_feature_properties(node); +@@ -415,6 +416,12 @@ static int __init early_init_dt_scan_cpus(unsigned long node, + } + + identical_pvr_fixup(node); ++ ++ // We can now add the CPU name & PVR to the hardware description ++ seq_buf_printf(&ppc_hw_desc, "%s 0x%04lx ", cur_cpu_spec->cpu_name, mfspr(SPRN_PVR)); ++ if (cpu_version) ++ seq_buf_printf(&ppc_hw_desc, "0x%04x ", be32_to_cpup(cpu_version)); ++ + init_mmu_slb_size(node); + + #ifdef CONFIG_PPC64 +@@ -852,9 +859,6 @@ void __init early_init_devtree(void *params) + + dt_cpu_ftrs_scan(); + +- // We can now add the CPU name & PVR to the hardware description +- seq_buf_printf(&ppc_hw_desc, "%s 0x%04lx ", cur_cpu_spec->cpu_name, mfspr(SPRN_PVR)); +- + /* Retrieve CPU related informations from the flat tree + * (altivec support, boot CPU ID, ...) + */ +-- +2.43.0 + diff --git a/queue-6.1/powerpc-pseries-add-helper-to-get-plpks-password-len.patch b/queue-6.1/powerpc-pseries-add-helper-to-get-plpks-password-len.patch new file mode 100644 index 00000000000..56085baa41e --- /dev/null +++ b/queue-6.1/powerpc-pseries-add-helper-to-get-plpks-password-len.patch @@ -0,0 +1,60 @@ +From 3a563ec250c7083aa7b51b249fc64642bde1d0d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Feb 2023 19:03:57 +1100 +Subject: powerpc/pseries: Add helper to get PLPKS password length + +From: Russell Currey + +[ Upstream commit 9ee76bd5c7e39b622660cc14833ead1967f2038d ] + +Add helper function to get the PLPKS password length. This will be used +in a later patch to support passing the password between kernels over +kexec. + +Signed-off-by: Russell Currey +Signed-off-by: Andrew Donnellan +Reviewed-by: Stefan Berger +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20230210080401.345462-23-ajd@linux.ibm.com +Stable-dep-of: 932bed412170 ("powerpc/kexec_file: fix cpus node update to FDT") +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/plpks.h | 5 +++++ + arch/powerpc/platforms/pseries/plpks.c | 5 +++++ + 2 files changed, 10 insertions(+) + +diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h +index 8dab5c26c1e41..9e2219b0202db 100644 +--- a/arch/powerpc/include/asm/plpks.h ++++ b/arch/powerpc/include/asm/plpks.h +@@ -153,6 +153,11 @@ u32 plpks_get_maxlargeobjectsize(void); + */ + u64 plpks_get_signedupdatealgorithms(void); + ++/** ++ * Returns the length of the PLPKS password in bytes. ++ */ ++u16 plpks_get_passwordlen(void); ++ + #endif // CONFIG_PSERIES_PLPKS + + #endif // _ASM_POWERPC_PLPKS_H +diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c +index 2b659f2b01214..eea251105e394 100644 +--- a/arch/powerpc/platforms/pseries/plpks.c ++++ b/arch/powerpc/platforms/pseries/plpks.c +@@ -348,6 +348,11 @@ u64 plpks_get_signedupdatealgorithms(void) + return signedupdatealgorithms; + } + ++u16 plpks_get_passwordlen(void) ++{ ++ return ospasswordlength; ++} ++ + bool plpks_is_available(void) + { + int rc; +-- +2.43.0 + diff --git a/queue-6.1/powerpc-pseries-expose-plpks-config-values-support-a.patch b/queue-6.1/powerpc-pseries-expose-plpks-config-values-support-a.patch new file mode 100644 index 00000000000..e425d115107 --- /dev/null +++ b/queue-6.1/powerpc-pseries-expose-plpks-config-values-support-a.patch @@ -0,0 +1,291 @@ +From 31188952536df1be20c807846de99439fc849252 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Feb 2023 19:03:51 +1100 +Subject: powerpc/pseries: Expose PLPKS config values, support additional + fields + +From: Nayna Jain + +[ Upstream commit 119da30d037dced29118fb90afe683ff50313386 ] + +The plpks driver uses the H_PKS_GET_CONFIG hcall to retrieve configuration +and status information about the PKS from the hypervisor. + +Update _plpks_get_config() to handle some additional fields. Add getter +functions to allow the PKS configuration information to be accessed from +other files. Validate that the values we're getting comply with the spec. + +While we're here, move the config struct in _plpks_get_config() off the +stack - it's getting large and we also need to make sure it doesn't cross +a page boundary. + +Signed-off-by: Nayna Jain +[ajd: split patch, extend to support additional v3 API fields, minor fixes] +Co-developed-by: Andrew Donnellan +Signed-off-by: Andrew Donnellan +Signed-off-by: Russell Currey +Reviewed-by: Stefan Berger +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20230210080401.345462-17-ajd@linux.ibm.com +Stable-dep-of: 932bed412170 ("powerpc/kexec_file: fix cpus node update to FDT") +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/plpks.h | 58 ++++++++++ + arch/powerpc/platforms/pseries/plpks.c | 149 +++++++++++++++++++++++-- + 2 files changed, 195 insertions(+), 12 deletions(-) + +diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h +index 44c3d93fb5e7d..8dab5c26c1e41 100644 +--- a/arch/powerpc/include/asm/plpks.h ++++ b/arch/powerpc/include/asm/plpks.h +@@ -95,6 +95,64 @@ int plpks_read_fw_var(struct plpks_var *var); + */ + int plpks_read_bootloader_var(struct plpks_var *var); + ++/** ++ * Returns if PKS is available on this LPAR. ++ */ ++bool plpks_is_available(void); ++ ++/** ++ * Returns version of the Platform KeyStore. ++ */ ++u8 plpks_get_version(void); ++ ++/** ++ * Returns hypervisor storage overhead per object, not including the size of ++ * the object or label. Only valid for config version >= 2 ++ */ ++u16 plpks_get_objoverhead(void); ++ ++/** ++ * Returns maximum password size. Must be >= 32 bytes ++ */ ++u16 plpks_get_maxpwsize(void); ++ ++/** ++ * Returns maximum object size supported by Platform KeyStore. ++ */ ++u16 plpks_get_maxobjectsize(void); ++ ++/** ++ * Returns maximum object label size supported by Platform KeyStore. ++ */ ++u16 plpks_get_maxobjectlabelsize(void); ++ ++/** ++ * Returns total size of the configured Platform KeyStore. ++ */ ++u32 plpks_get_totalsize(void); ++ ++/** ++ * Returns used space from the total size of the Platform KeyStore. ++ */ ++u32 plpks_get_usedspace(void); ++ ++/** ++ * Returns bitmask of policies supported by the hypervisor. ++ */ ++u32 plpks_get_supportedpolicies(void); ++ ++/** ++ * Returns maximum byte size of a single object supported by the hypervisor. ++ * Only valid for config version >= 3 ++ */ ++u32 plpks_get_maxlargeobjectsize(void); ++ ++/** ++ * Returns bitmask of signature algorithms supported for signed updates. ++ * Only valid for config version >= 3 ++ */ ++u64 plpks_get_signedupdatealgorithms(void); ++ + #endif // CONFIG_PSERIES_PLPKS + + #endif // _ASM_POWERPC_PLPKS_H +diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c +index 1c43c4febd3da..2b659f2b01214 100644 +--- a/arch/powerpc/platforms/pseries/plpks.c ++++ b/arch/powerpc/platforms/pseries/plpks.c +@@ -24,8 +24,16 @@ static u8 *ospassword; + static u16 ospasswordlength; + + // Retrieved with H_PKS_GET_CONFIG ++static u8 version; ++static u16 objoverhead; + static u16 maxpwsize; + static u16 maxobjsize; ++static s16 maxobjlabelsize; ++static u32 totalsize; ++static u32 usedspace; ++static u32 supportedpolicies; ++static u32 maxlargeobjectsize; ++static u64 signedupdatealgorithms; + + struct plpks_auth { + u8 version; +@@ -206,32 +214,149 @@ static struct label *construct_label(char *component, u8 varos, u8 *name, + static int _plpks_get_config(void) + { + unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 }; +- struct { ++ struct config { + u8 version; + u8 flags; +- __be32 rsvd0; ++ __be16 rsvd0; ++ __be16 objoverhead; + __be16 maxpwsize; + __be16 maxobjlabelsize; + __be16 maxobjsize; + __be32 totalsize; + __be32 usedspace; + __be32 supportedpolicies; +- __be64 rsvd1; +- } __packed config; ++ __be32 maxlargeobjectsize; ++ __be64 signedupdatealgorithms; ++ u8 rsvd1[476]; ++ } __packed * config; + size_t size; +- int rc; ++ int rc = 0; ++ ++ size = sizeof(*config); ++ ++ // Config struct must not cross a page boundary. So long as the struct ++ // size is a power of 2, this should be fine as alignment is guaranteed ++ config = kzalloc(size, GFP_KERNEL); ++ if (!config) { ++ rc = -ENOMEM; ++ goto err; ++ } ++ ++ rc = plpar_hcall(H_PKS_GET_CONFIG, retbuf, virt_to_phys(config), size); ++ ++ if (rc != H_SUCCESS) { ++ rc = pseries_status_to_err(rc); ++ goto err; ++ } ++ ++ version = config->version; ++ objoverhead = be16_to_cpu(config->objoverhead); ++ maxpwsize = be16_to_cpu(config->maxpwsize); ++ maxobjsize = be16_to_cpu(config->maxobjsize); ++ maxobjlabelsize = be16_to_cpu(config->maxobjlabelsize); ++ totalsize = be32_to_cpu(config->totalsize); ++ usedspace = be32_to_cpu(config->usedspace); ++ supportedpolicies = be32_to_cpu(config->supportedpolicies); ++ maxlargeobjectsize = be32_to_cpu(config->maxlargeobjectsize); ++ signedupdatealgorithms = be64_to_cpu(config->signedupdatealgorithms); ++ ++ // Validate that the numbers we get back match the requirements of the spec ++ if (maxpwsize < 32) { ++ pr_err("Invalid Max Password Size received from hypervisor (%d < 32)\n", maxpwsize); ++ rc = -EIO; ++ goto err; ++ } ++ ++ if (maxobjlabelsize < 255) { ++ pr_err("Invalid Max Object Label Size received from hypervisor (%d < 255)\n", ++ maxobjlabelsize); ++ rc = -EIO; ++ goto err; ++ } + +- size = sizeof(config); ++ if (totalsize < 4096) { ++ pr_err("Invalid Total Size received from hypervisor (%d < 4096)\n", totalsize); ++ rc = -EIO; ++ goto err; ++ } ++ ++ if (version >= 3 && maxlargeobjectsize >= 65536 && maxobjsize != 0xFFFF) { ++ pr_err("Invalid Max Object Size (0x%x != 0xFFFF)\n", maxobjsize); ++ rc = -EIO; ++ goto err; ++ } ++ ++err: ++ kfree(config); ++ return rc; ++} ++ ++u8 plpks_get_version(void) ++{ ++ return version; ++} + +- rc = plpar_hcall(H_PKS_GET_CONFIG, retbuf, virt_to_phys(&config), size); ++u16 plpks_get_objoverhead(void) ++{ ++ return objoverhead; ++} + +- if (rc != H_SUCCESS) +- return pseries_status_to_err(rc); ++u16 plpks_get_maxpwsize(void) ++{ ++ return maxpwsize; ++} + +- maxpwsize = be16_to_cpu(config.maxpwsize); +- maxobjsize = be16_to_cpu(config.maxobjsize); ++u16 plpks_get_maxobjectsize(void) ++{ ++ return maxobjsize; ++} ++ ++u16 plpks_get_maxobjectlabelsize(void) ++{ ++ return maxobjlabelsize; ++} ++ ++u32 plpks_get_totalsize(void) ++{ ++ return totalsize; ++} ++ ++u32 plpks_get_usedspace(void) ++{ ++ // Unlike other config values, usedspace regularly changes as objects ++ // are updated, so we need to refresh. ++ int rc = _plpks_get_config(); ++ if (rc) { ++ pr_err("Couldn't get config, rc: %d\n", rc); ++ return 0; ++ } ++ return usedspace; ++} ++ ++u32 plpks_get_supportedpolicies(void) ++{ ++ return supportedpolicies; ++} ++ ++u32 plpks_get_maxlargeobjectsize(void) ++{ ++ return maxlargeobjectsize; ++} ++ ++u64 plpks_get_signedupdatealgorithms(void) ++{ ++ return signedupdatealgorithms; ++} ++ ++bool plpks_is_available(void) ++{ ++ int rc; ++ ++ rc = _plpks_get_config(); ++ if (rc) ++ return false; + +- return 0; ++ return true; + } + + static int plpks_confirm_object_flushed(struct label *label, +-- +2.43.0 + diff --git a/queue-6.1/powerpc-pseries-fix-alignment-of-plpks-structures-an.patch b/queue-6.1/powerpc-pseries-fix-alignment-of-plpks-structures-an.patch new file mode 100644 index 00000000000..5dd08b6bf92 --- /dev/null +++ b/queue-6.1/powerpc-pseries-fix-alignment-of-plpks-structures-an.patch @@ -0,0 +1,75 @@ +From f58516ccf6583693733f37d30b066ea5bccb39e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Feb 2023 19:03:37 +1100 +Subject: powerpc/pseries: Fix alignment of PLPKS structures and buffers + +From: Andrew Donnellan + +[ Upstream commit fcf63d6b8ab9b12c2ce1b4bde12a3c391029c998 ] + +A number of structures and buffers passed to PKS hcalls have alignment +requirements, which could on occasion cause problems: + +- Authorisation structures must be 16-byte aligned and must not cross a + page boundary + +- Label structures must not cross page boundaries + +- Password output buffers must not cross page boundaries + +To ensure correct alignment, we adjust the allocation size of each of +these structures/buffers to be the closest power of 2 that is at least the +size of the structure/buffer (since kmalloc() guarantees that an +allocation of a power of 2 size will be aligned to at least that size). + +Reported-by: Benjamin Gray +Fixes: 2454a7af0f2a ("powerpc/pseries: define driver for Platform KeyStore") +Signed-off-by: Andrew Donnellan +Reviewed-by: Russell Currey +Signed-off-by: Russell Currey +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20230210080401.345462-3-ajd@linux.ibm.com +Stable-dep-of: 932bed412170 ("powerpc/kexec_file: fix cpus node update to FDT") +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/plpks.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c +index 25f95440a773b..d54188a355c9c 100644 +--- a/arch/powerpc/platforms/pseries/plpks.c ++++ b/arch/powerpc/platforms/pseries/plpks.c +@@ -113,7 +113,8 @@ static int plpks_gen_password(void) + u8 *password, consumer = PLPKS_OS_OWNER; + int rc; + +- password = kzalloc(maxpwsize, GFP_KERNEL); ++ // The password must not cross a page boundary, so we align to the next power of 2 ++ password = kzalloc(roundup_pow_of_two(maxpwsize), GFP_KERNEL); + if (!password) + return -ENOMEM; + +@@ -149,7 +150,9 @@ static struct plpks_auth *construct_auth(u8 consumer) + if (consumer > PLPKS_OS_OWNER) + return ERR_PTR(-EINVAL); + +- auth = kzalloc(struct_size(auth, password, maxpwsize), GFP_KERNEL); ++ // The auth structure must not cross a page boundary and must be ++ // 16 byte aligned. We align to the next largest power of 2 ++ auth = kzalloc(roundup_pow_of_two(struct_size(auth, password, maxpwsize)), GFP_KERNEL); + if (!auth) + return ERR_PTR(-ENOMEM); + +@@ -183,7 +186,8 @@ static struct label *construct_label(char *component, u8 varos, u8 *name, + if (component && slen > sizeof(label->attr.prefix)) + return ERR_PTR(-EINVAL); + +- label = kzalloc(sizeof(*label), GFP_KERNEL); ++ // The label structure must not cross a page boundary, so we align to the next power of 2 ++ label = kzalloc(roundup_pow_of_two(sizeof(*label)), GFP_KERNEL); + if (!label) + return ERR_PTR(-ENOMEM); + +-- +2.43.0 + diff --git a/queue-6.1/powerpc-pseries-move-plpks.h-to-include-directory.patch b/queue-6.1/powerpc-pseries-move-plpks.h-to-include-directory.patch new file mode 100644 index 00000000000..47696e965cf --- /dev/null +++ b/queue-6.1/powerpc-pseries-move-plpks.h-to-include-directory.patch @@ -0,0 +1,70 @@ +From 122018a215f9e6c6a265d19f4fbbe41a304a9092 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Feb 2023 19:03:49 +1100 +Subject: powerpc/pseries: Move plpks.h to include directory + +From: Russell Currey + +[ Upstream commit 90b74e305d6b5a444b1283dd7ad1caf6acaa0340 ] + +Move plpks.h from platforms/pseries/ to include/asm/. This is necessary +for later patches to make use of the PLPKS from code in other subsystems. + +Signed-off-by: Russell Currey +Signed-off-by: Andrew Donnellan +Reviewed-by: Stefan Berger +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20230210080401.345462-15-ajd@linux.ibm.com +Stable-dep-of: 932bed412170 ("powerpc/kexec_file: fix cpus node update to FDT") +Signed-off-by: Sasha Levin +--- + .../powerpc/{platforms/pseries => include/asm}/plpks.h | 10 +++++++--- + arch/powerpc/platforms/pseries/plpks.c | 3 +-- + 2 files changed, 8 insertions(+), 5 deletions(-) + rename arch/powerpc/{platforms/pseries => include/asm}/plpks.h (94%) + +diff --git a/arch/powerpc/platforms/pseries/plpks.h b/arch/powerpc/include/asm/plpks.h +similarity index 94% +rename from arch/powerpc/platforms/pseries/plpks.h +rename to arch/powerpc/include/asm/plpks.h +index 07278a990c2df..44c3d93fb5e7d 100644 +--- a/arch/powerpc/platforms/pseries/plpks.h ++++ b/arch/powerpc/include/asm/plpks.h +@@ -6,8 +6,10 @@ + * Platform keystore for pseries LPAR(PLPKS). + */ + +-#ifndef _PSERIES_PLPKS_H +-#define _PSERIES_PLPKS_H ++#ifndef _ASM_POWERPC_PLPKS_H ++#define _ASM_POWERPC_PLPKS_H ++ ++#ifdef CONFIG_PSERIES_PLPKS + + #include + #include +@@ -93,4 +95,6 @@ int plpks_read_fw_var(struct plpks_var *var); + */ + int plpks_read_bootloader_var(struct plpks_var *var); + +-#endif ++#endif // CONFIG_PSERIES_PLPKS ++ ++#endif // _ASM_POWERPC_PLPKS_H +diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c +index d54188a355c9c..1c43c4febd3da 100644 +--- a/arch/powerpc/platforms/pseries/plpks.c ++++ b/arch/powerpc/platforms/pseries/plpks.c +@@ -18,8 +18,7 @@ + #include + #include + #include +- +-#include "plpks.h" ++#include + + static u8 *ospassword; + static u16 ospasswordlength; +-- +2.43.0 + diff --git a/queue-6.1/powerpc-xmon-fix-disassembly-cpu-feature-checks.patch b/queue-6.1/powerpc-xmon-fix-disassembly-cpu-feature-checks.patch new file mode 100644 index 00000000000..38b27eab967 --- /dev/null +++ b/queue-6.1/powerpc-xmon-fix-disassembly-cpu-feature-checks.patch @@ -0,0 +1,99 @@ +From a0990ff6c0f0adac6e082e675e9c9accc04ddcad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 22:12:47 +1000 +Subject: powerpc/xmon: Fix disassembly CPU feature checks + +From: Michael Ellerman + +[ Upstream commit 14196e47c5ffe32af7ed5a51c9e421c5ea5bccce ] + +In the xmon disassembly code there are several CPU feature checks to +determine what dialects should be passed to the disassembler. The +dialect controls which instructions the disassembler will recognise. + +Unfortunately the checks are incorrect, because instead of passing a +single CPU feature they are passing a mask of feature bits. + +For example the code: + + if (cpu_has_feature(CPU_FTRS_POWER5)) + dialect |= PPC_OPCODE_POWER5; + +Is trying to check if the system is running on a Power5 CPU. But +CPU_FTRS_POWER5 is a mask of *all* the feature bits that are enabled on +a Power5. + +In practice the test will always return true for any 64-bit CPU, because +at least one bit in the mask will be present in the CPU_FTRS_ALWAYS +mask. + +Similarly for all the other checks against CPU_FTRS_xx masks. + +Rather than trying to match the disassembly behaviour exactly to the +current CPU, just differentiate between 32-bit and 64-bit, and Altivec, +VSX and HTM. + +That will cause some instructions to be shown in disassembly even +on a CPU that doesn't support them, but that's OK, objdump -d output +has the same behaviour, and if anything it's less confusing than some +instructions not being disassembled. + +Fixes: 897f112bb42e ("[POWERPC] Import updated version of ppc disassembly code for xmon") +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240509121248.270878-2-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/xmon/ppc-dis.c | 33 +++++++++++---------------------- + 1 file changed, 11 insertions(+), 22 deletions(-) + +diff --git a/arch/powerpc/xmon/ppc-dis.c b/arch/powerpc/xmon/ppc-dis.c +index 75fa98221d485..af105e1bc3fca 100644 +--- a/arch/powerpc/xmon/ppc-dis.c ++++ b/arch/powerpc/xmon/ppc-dis.c +@@ -122,32 +122,21 @@ int print_insn_powerpc (unsigned long insn, unsigned long memaddr) + bool insn_is_short; + ppc_cpu_t dialect; + +- dialect = PPC_OPCODE_PPC | PPC_OPCODE_COMMON +- | PPC_OPCODE_64 | PPC_OPCODE_POWER4 | PPC_OPCODE_ALTIVEC; ++ dialect = PPC_OPCODE_PPC | PPC_OPCODE_COMMON; + +- if (cpu_has_feature(CPU_FTRS_POWER5)) +- dialect |= PPC_OPCODE_POWER5; ++ if (IS_ENABLED(CONFIG_PPC64)) ++ dialect |= PPC_OPCODE_64 | PPC_OPCODE_POWER4 | PPC_OPCODE_CELL | ++ PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 | PPC_OPCODE_POWER8 | ++ PPC_OPCODE_POWER9; + +- if (cpu_has_feature(CPU_FTRS_CELL)) +- dialect |= (PPC_OPCODE_CELL | PPC_OPCODE_ALTIVEC); ++ if (cpu_has_feature(CPU_FTR_TM)) ++ dialect |= PPC_OPCODE_HTM; + +- if (cpu_has_feature(CPU_FTRS_POWER6)) +- dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_ALTIVEC); ++ if (cpu_has_feature(CPU_FTR_ALTIVEC)) ++ dialect |= PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2; + +- if (cpu_has_feature(CPU_FTRS_POWER7)) +- dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 +- | PPC_OPCODE_ALTIVEC | PPC_OPCODE_VSX); +- +- if (cpu_has_feature(CPU_FTRS_POWER8)) +- dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 +- | PPC_OPCODE_POWER8 | PPC_OPCODE_HTM +- | PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2 | PPC_OPCODE_VSX); +- +- if (cpu_has_feature(CPU_FTRS_POWER9)) +- dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 +- | PPC_OPCODE_POWER8 | PPC_OPCODE_POWER9 | PPC_OPCODE_HTM +- | PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2 +- | PPC_OPCODE_VSX | PPC_OPCODE_VSX3); ++ if (cpu_has_feature(CPU_FTR_VSX)) ++ dialect |= PPC_OPCODE_VSX | PPC_OPCODE_VSX3; + + /* Get the major opcode of the insn. */ + opcode = NULL; +-- +2.43.0 + diff --git a/queue-6.1/pwm-atmel-tcb-don-t-track-polarity-in-driver-data.patch b/queue-6.1/pwm-atmel-tcb-don-t-track-polarity-in-driver-data.patch new file mode 100644 index 00000000000..70d546b9750 --- /dev/null +++ b/queue-6.1/pwm-atmel-tcb-don-t-track-polarity-in-driver-data.patch @@ -0,0 +1,106 @@ +From b5c05ecea08f1d63be30c04f7cc24d3b715ed1e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:20:13 +0200 +Subject: pwm: atmel-tcb: Don't track polarity in driver data +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 28a1dadc49e2902d0a7a2e8c699a15f93b1b6f40 ] + +struct atmel_tcb_pwm_device::polarity is only used in atmel_tcb_pwm_enable +and atmel_tcb_pwm_disable(). These functions are only called by +atmel_tcb_pwm_apply() after the member variable was assigned to +state->polarity. So the value assigned in atmel_tcb_pwm_request() is +never used and the member can be dropped from struct atmel_tcb_pwm_device. + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Claudiu Beznea +Signed-off-by: Thierry Reding +Stable-dep-of: 37f7707077f5 ("pwm: atmel-tcb: Fix race condition and convert to guards") +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-atmel-tcb.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/drivers/pwm/pwm-atmel-tcb.c b/drivers/pwm/pwm-atmel-tcb.c +index 32a60d7f8ed2e..30c966238e41c 100644 +--- a/drivers/pwm/pwm-atmel-tcb.c ++++ b/drivers/pwm/pwm-atmel-tcb.c +@@ -34,7 +34,6 @@ + ATMEL_TC_BEEVT | ATMEL_TC_BSWTRG) + + struct atmel_tcb_pwm_device { +- enum pwm_polarity polarity; /* PWM polarity */ + unsigned div; /* PWM clock divider */ + unsigned duty; /* PWM duty expressed in clk cycles */ + unsigned period; /* PWM period expressed in clk cycles */ +@@ -80,7 +79,6 @@ static int atmel_tcb_pwm_request(struct pwm_chip *chip, + if (ret) + return ret; + +- tcbpwm->polarity = PWM_POLARITY_NORMAL; + tcbpwm->duty = 0; + tcbpwm->period = 0; + tcbpwm->div = 0; +@@ -123,12 +121,12 @@ static void atmel_tcb_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) + clk_disable_unprepare(tcbpwmc->clk); + } + +-static void atmel_tcb_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm) ++static void atmel_tcb_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm, ++ enum pwm_polarity polarity) + { + struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip); + struct atmel_tcb_pwm_device *tcbpwm = &tcbpwmc->pwms[pwm->hwpwm]; + unsigned cmr; +- enum pwm_polarity polarity = tcbpwm->polarity; + + /* + * If duty is 0 the timer will be stopped and we have to +@@ -180,12 +178,12 @@ static void atmel_tcb_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm) + spin_unlock(&tcbpwmc->lock); + } + +-static int atmel_tcb_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm) ++static int atmel_tcb_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm, ++ enum pwm_polarity polarity) + { + struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip); + struct atmel_tcb_pwm_device *tcbpwm = &tcbpwmc->pwms[pwm->hwpwm]; + u32 cmr; +- enum pwm_polarity polarity = tcbpwm->polarity; + + /* + * If duty is 0 the timer will be stopped and we have to +@@ -345,15 +343,11 @@ static int atmel_tcb_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + static int atmel_tcb_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + const struct pwm_state *state) + { +- struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip); +- struct atmel_tcb_pwm_device *tcbpwm = &tcbpwmc->pwms[pwm->hwpwm]; + int duty_cycle, period; + int ret; + +- tcbpwm->polarity = state->polarity; +- + if (!state->enabled) { +- atmel_tcb_pwm_disable(chip, pwm); ++ atmel_tcb_pwm_disable(chip, pwm, state->polarity); + return 0; + } + +@@ -364,7 +358,7 @@ static int atmel_tcb_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + if (ret) + return ret; + +- return atmel_tcb_pwm_enable(chip, pwm); ++ return atmel_tcb_pwm_enable(chip, pwm, state->polarity); + } + + static const struct pwm_ops atmel_tcb_pwm_ops = { +-- +2.43.0 + diff --git a/queue-6.1/pwm-atmel-tcb-fix-race-condition-and-convert-to-guar.patch b/queue-6.1/pwm-atmel-tcb-fix-race-condition-and-convert-to-guar.patch new file mode 100644 index 00000000000..f10d1fad576 --- /dev/null +++ b/queue-6.1/pwm-atmel-tcb-fix-race-condition-and-convert-to-guar.patch @@ -0,0 +1,105 @@ +From 4d5509fc95c25a7a8e824bb5139fe2690ba50a2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jul 2024 12:18:05 +0200 +Subject: pwm: atmel-tcb: Fix race condition and convert to guards +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 37f7707077f5ea2515bf4b1dc7fad43f8e12993e ] + +The hardware only supports a single period length for both PWM outputs. So +atmel_tcb_pwm_config() checks the configuration of the other output if it's +compatible with the currently requested setting. The register values are +then actually updated in atmel_tcb_pwm_enable(). To make this race free +the lock must be held during the whole process, so grab the lock in +.apply() instead of individually in atmel_tcb_pwm_disable() and +atmel_tcb_pwm_enable() which then also covers atmel_tcb_pwm_config(). + +To simplify handling, use the guard helper to let the compiler care for +unlocking. Otherwise unlocking would be more difficult as there is more +than one exit path in atmel_tcb_pwm_apply(). + +Fixes: 9421bade0765 ("pwm: atmel: add Timer Counter Block PWM driver") +Signed-off-by: Uwe Kleine-König +Acked-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20240709101806.52394-3-u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-atmel-tcb.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/pwm/pwm-atmel-tcb.c b/drivers/pwm/pwm-atmel-tcb.c +index 30c966238e41c..e74b45f00a9ac 100644 +--- a/drivers/pwm/pwm-atmel-tcb.c ++++ b/drivers/pwm/pwm-atmel-tcb.c +@@ -83,7 +83,8 @@ static int atmel_tcb_pwm_request(struct pwm_chip *chip, + tcbpwm->period = 0; + tcbpwm->div = 0; + +- spin_lock(&tcbpwmc->lock); ++ guard(spinlock)(&tcbpwmc->lock); ++ + regmap_read(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CMR), &cmr); + /* + * Get init config from Timer Counter registers if +@@ -109,7 +110,6 @@ static int atmel_tcb_pwm_request(struct pwm_chip *chip, + + cmr |= ATMEL_TC_WAVE | ATMEL_TC_WAVESEL_UP_AUTO | ATMEL_TC_EEVT_XC0; + regmap_write(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CMR), cmr); +- spin_unlock(&tcbpwmc->lock); + + return 0; + } +@@ -139,7 +139,6 @@ static void atmel_tcb_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm, + if (tcbpwm->duty == 0) + polarity = !polarity; + +- spin_lock(&tcbpwmc->lock); + regmap_read(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CMR), &cmr); + + /* flush old setting and set the new one */ +@@ -174,8 +173,6 @@ static void atmel_tcb_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm, + ATMEL_TC_SWTRG); + tcbpwmc->bkup.enabled = 0; + } +- +- spin_unlock(&tcbpwmc->lock); + } + + static int atmel_tcb_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm, +@@ -196,7 +193,6 @@ static int atmel_tcb_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm, + if (tcbpwm->duty == 0) + polarity = !polarity; + +- spin_lock(&tcbpwmc->lock); + regmap_read(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CMR), &cmr); + + /* flush old setting and set the new one */ +@@ -258,7 +254,6 @@ static int atmel_tcb_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm, + regmap_write(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CCR), + ATMEL_TC_SWTRG | ATMEL_TC_CLKEN); + tcbpwmc->bkup.enabled = 1; +- spin_unlock(&tcbpwmc->lock); + return 0; + } + +@@ -343,9 +338,12 @@ static int atmel_tcb_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + static int atmel_tcb_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + const struct pwm_state *state) + { ++ struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip); + int duty_cycle, period; + int ret; + ++ guard(spinlock)(&tcbpwmc->lock); ++ + if (!state->enabled) { + atmel_tcb_pwm_disable(chip, pwm, state->polarity); + return 0; +-- +2.43.0 + diff --git a/queue-6.1/pwm-atmel-tcb-put-per-channel-data-into-driver-data.patch b/queue-6.1/pwm-atmel-tcb-put-per-channel-data-into-driver-data.patch new file mode 100644 index 00000000000..fe0e699f151 --- /dev/null +++ b/queue-6.1/pwm-atmel-tcb-put-per-channel-data-into-driver-data.patch @@ -0,0 +1,128 @@ +From f279e5c85301bf665818507944e93ff728321bd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:20:11 +0200 +Subject: pwm: atmel-tcb: Put per-channel data into driver data +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 78dca23bd6706dd6a3cdb5c0052f48794b4d2bed ] + +This simplifies the code, reduces the number of memory allocations and +pointer dereferences. + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Claudiu Beznea +Signed-off-by: Thierry Reding +Stable-dep-of: 37f7707077f5 ("pwm: atmel-tcb: Fix race condition and convert to guards") +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-atmel-tcb.c | 29 +++++++++-------------------- + 1 file changed, 9 insertions(+), 20 deletions(-) + +diff --git a/drivers/pwm/pwm-atmel-tcb.c b/drivers/pwm/pwm-atmel-tcb.c +index 2826fc216d291..ae274bd7907dd 100644 +--- a/drivers/pwm/pwm-atmel-tcb.c ++++ b/drivers/pwm/pwm-atmel-tcb.c +@@ -57,7 +57,7 @@ struct atmel_tcb_pwm_chip { + struct clk *clk; + struct clk *gclk; + struct clk *slow_clk; +- struct atmel_tcb_pwm_device *pwms[NPWM]; ++ struct atmel_tcb_pwm_device pwms[NPWM]; + struct atmel_tcb_channel bkup; + }; + +@@ -73,7 +73,7 @@ static int atmel_tcb_pwm_set_polarity(struct pwm_chip *chip, + enum pwm_polarity polarity) + { + struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip); +- struct atmel_tcb_pwm_device *tcbpwm = tcbpwmc->pwms[pwm->hwpwm]; ++ struct atmel_tcb_pwm_device *tcbpwm = &tcbpwmc->pwms[pwm->hwpwm]; + + tcbpwm->polarity = polarity; + +@@ -84,19 +84,13 @@ static int atmel_tcb_pwm_request(struct pwm_chip *chip, + struct pwm_device *pwm) + { + struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip); +- struct atmel_tcb_pwm_device *tcbpwm; ++ struct atmel_tcb_pwm_device *tcbpwm = &tcbpwmc->pwms[pwm->hwpwm]; + unsigned cmr; + int ret; + +- tcbpwm = devm_kzalloc(chip->dev, sizeof(*tcbpwm), GFP_KERNEL); +- if (!tcbpwm) +- return -ENOMEM; +- + ret = clk_prepare_enable(tcbpwmc->clk); +- if (ret) { +- devm_kfree(chip->dev, tcbpwm); ++ if (ret) + return ret; +- } + + tcbpwm->polarity = PWM_POLARITY_NORMAL; + tcbpwm->duty = 0; +@@ -131,25 +125,20 @@ static int atmel_tcb_pwm_request(struct pwm_chip *chip, + regmap_write(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CMR), cmr); + spin_unlock(&tcbpwmc->lock); + +- tcbpwmc->pwms[pwm->hwpwm] = tcbpwm; +- + return 0; + } + + static void atmel_tcb_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) + { + struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip); +- struct atmel_tcb_pwm_device *tcbpwm = tcbpwmc->pwms[pwm->hwpwm]; + + clk_disable_unprepare(tcbpwmc->clk); +- tcbpwmc->pwms[pwm->hwpwm] = NULL; +- devm_kfree(chip->dev, tcbpwm); + } + + static void atmel_tcb_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm) + { + struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip); +- struct atmel_tcb_pwm_device *tcbpwm = tcbpwmc->pwms[pwm->hwpwm]; ++ struct atmel_tcb_pwm_device *tcbpwm = &tcbpwmc->pwms[pwm->hwpwm]; + unsigned cmr; + enum pwm_polarity polarity = tcbpwm->polarity; + +@@ -206,7 +195,7 @@ static void atmel_tcb_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm) + static int atmel_tcb_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm) + { + struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip); +- struct atmel_tcb_pwm_device *tcbpwm = tcbpwmc->pwms[pwm->hwpwm]; ++ struct atmel_tcb_pwm_device *tcbpwm = &tcbpwmc->pwms[pwm->hwpwm]; + u32 cmr; + enum pwm_polarity polarity = tcbpwm->polarity; + +@@ -291,7 +280,7 @@ static int atmel_tcb_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + int duty_ns, int period_ns) + { + struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip); +- struct atmel_tcb_pwm_device *tcbpwm = tcbpwmc->pwms[pwm->hwpwm]; ++ struct atmel_tcb_pwm_device *tcbpwm = &tcbpwmc->pwms[pwm->hwpwm]; + struct atmel_tcb_pwm_device *atcbpwm = NULL; + int i = 0; + int slowclk = 0; +@@ -338,9 +327,9 @@ static int atmel_tcb_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + period = div_u64(period_ns, min); + + if (pwm->hwpwm == 0) +- atcbpwm = tcbpwmc->pwms[1]; ++ atcbpwm = &tcbpwmc->pwms[1]; + else +- atcbpwm = tcbpwmc->pwms[0]; ++ atcbpwm = &tcbpwmc->pwms[0]; + + /* + * PWM devices provided by the TCB driver are grouped by 2. +-- +2.43.0 + diff --git a/queue-6.1/pwm-atmel-tcb-unroll-atmel_tcb_pwm_set_polarity-into.patch b/queue-6.1/pwm-atmel-tcb-unroll-atmel_tcb_pwm_set_polarity-into.patch new file mode 100644 index 00000000000..50cbdd619f0 --- /dev/null +++ b/queue-6.1/pwm-atmel-tcb-unroll-atmel_tcb_pwm_set_polarity-into.patch @@ -0,0 +1,66 @@ +From b2675c7e34631d461b0a06c0604fe7887e09a239 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:20:12 +0200 +Subject: pwm: atmel-tcb: Unroll atmel_tcb_pwm_set_polarity() into only caller +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 9a6ac822a2153d583b0da95b8693e954b5f4203a ] + +atmel_tcb_pwm_set_polarity() is only called once and effectively wraps +an assignment only. Replace the function call by the respective +assignment. + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Claudiu Beznea +Signed-off-by: Thierry Reding +Stable-dep-of: 37f7707077f5 ("pwm: atmel-tcb: Fix race condition and convert to guards") +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-atmel-tcb.c | 17 +++-------------- + 1 file changed, 3 insertions(+), 14 deletions(-) + +diff --git a/drivers/pwm/pwm-atmel-tcb.c b/drivers/pwm/pwm-atmel-tcb.c +index ae274bd7907dd..32a60d7f8ed2e 100644 +--- a/drivers/pwm/pwm-atmel-tcb.c ++++ b/drivers/pwm/pwm-atmel-tcb.c +@@ -68,18 +68,6 @@ static inline struct atmel_tcb_pwm_chip *to_tcb_chip(struct pwm_chip *chip) + return container_of(chip, struct atmel_tcb_pwm_chip, chip); + } + +-static int atmel_tcb_pwm_set_polarity(struct pwm_chip *chip, +- struct pwm_device *pwm, +- enum pwm_polarity polarity) +-{ +- struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip); +- struct atmel_tcb_pwm_device *tcbpwm = &tcbpwmc->pwms[pwm->hwpwm]; +- +- tcbpwm->polarity = polarity; +- +- return 0; +-} +- + static int atmel_tcb_pwm_request(struct pwm_chip *chip, + struct pwm_device *pwm) + { +@@ -357,11 +345,12 @@ static int atmel_tcb_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + static int atmel_tcb_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + const struct pwm_state *state) + { ++ struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip); ++ struct atmel_tcb_pwm_device *tcbpwm = &tcbpwmc->pwms[pwm->hwpwm]; + int duty_cycle, period; + int ret; + +- /* This function only sets a flag in driver data */ +- atmel_tcb_pwm_set_polarity(chip, pwm, state->polarity); ++ tcbpwm->polarity = state->polarity; + + if (!state->enabled) { + atmel_tcb_pwm_disable(chip, pwm); +-- +2.43.0 + diff --git a/queue-6.1/pwm-stm32-always-do-lazy-disabling.patch b/queue-6.1/pwm-stm32-always-do-lazy-disabling.patch new file mode 100644 index 00000000000..127e947deb1 --- /dev/null +++ b/queue-6.1/pwm-stm32-always-do-lazy-disabling.patch @@ -0,0 +1,56 @@ +From cf3ca46a8afdbdebcedf82f7429768e1782aa8bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 13:00:06 +0200 +Subject: pwm: stm32: Always do lazy disabling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 7346e7a058a2c9aa9ff1cc699c7bf18a402d9f84 ] + +When the state changes from enabled to disabled, polarity, duty_cycle +and period are not configured in hardware and TIM_CCER_CCxE is just +cleared. However if the state changes from one disabled state to +another, all parameters are written to hardware because the early exit +from stm32_pwm_apply() is only taken if the pwm is currently enabled. + +This yields surprises like: Applying + + { .period = 1, .duty_cycle = 0, .enabled = false } + +succeeds if the pwm is initially on, but fails if it's already off +because 1 is a too small period. + +Update the check for lazy disable to always exit early if the target +state is disabled, no matter what is currently configured. + +Fixes: 7edf7369205b ("pwm: Add driver for STM32 plaftorm") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20240703110010.672654-2-u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-stm32.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c +index c40a6548ce7d4..2070d107c6328 100644 +--- a/drivers/pwm/pwm-stm32.c ++++ b/drivers/pwm/pwm-stm32.c +@@ -452,8 +452,9 @@ static int stm32_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + + enabled = pwm->state.enabled; + +- if (enabled && !state->enabled) { +- stm32_pwm_disable(priv, pwm->hwpwm); ++ if (!state->enabled) { ++ if (enabled) ++ stm32_pwm_disable(priv, pwm->hwpwm); + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.1/rcu-tasks-fix-stale-task-snaphot-for-tasks-trace.patch b/queue-6.1/rcu-tasks-fix-stale-task-snaphot-for-tasks-trace.patch new file mode 100644 index 00000000000..1081a63c645 --- /dev/null +++ b/queue-6.1/rcu-tasks-fix-stale-task-snaphot-for-tasks-trace.patch @@ -0,0 +1,111 @@ +From 38634b17c01da5020a37a49b59f21bce3ec8c347 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 17:23:02 +0200 +Subject: rcu/tasks: Fix stale task snaphot for Tasks Trace + +From: Frederic Weisbecker + +[ Upstream commit 399ced9594dfab51b782798efe60a2376cd5b724 ] + +When RCU-TASKS-TRACE pre-gp takes a snapshot of the current task running +on all online CPUs, no explicit ordering synchronizes properly with a +context switch. This lack of ordering can permit the new task to miss +pre-grace-period update-side accesses. The following diagram, courtesy +of Paul, shows the possible bad scenario: + + CPU 0 CPU 1 + ----- ----- + + // Pre-GP update side access + WRITE_ONCE(*X, 1); + smp_mb(); + r0 = rq->curr; + RCU_INIT_POINTER(rq->curr, TASK_B) + spin_unlock(rq) + rcu_read_lock_trace() + r1 = X; + /* ignore TASK_B */ + +Either r0==TASK_B or r1==1 is needed but neither is guaranteed. + +One possible solution to solve this is to wait for an RCU grace period +at the beginning of the RCU-tasks-trace grace period before taking the +current tasks snaphot. However this would introduce large additional +latencies to RCU-tasks-trace grace periods. + +Another solution is to lock the target runqueue while taking the current +task snapshot. This ensures that the update side sees the latest context +switch and subsequent context switches will see the pre-grace-period +update side accesses. + +This commit therefore adds runqueue locking to cpu_curr_snapshot(). + +Fixes: e386b6725798 ("rcu-tasks: Eliminate RCU Tasks Trace IPIs to online CPUs") +Signed-off-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tasks.h | 10 ++++++++++ + kernel/sched/core.c | 14 +++++++------- + 2 files changed, 17 insertions(+), 7 deletions(-) + +diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h +index 6f48f565e3acb..456c956f481ef 100644 +--- a/kernel/rcu/tasks.h ++++ b/kernel/rcu/tasks.h +@@ -1531,6 +1531,16 @@ static void rcu_tasks_trace_pregp_step(struct list_head *hop) + // allow safe access to the hop list. + for_each_online_cpu(cpu) { + rcu_read_lock(); ++ // Note that cpu_curr_snapshot() picks up the target ++ // CPU's current task while its runqueue is locked with ++ // an smp_mb__after_spinlock(). This ensures that either ++ // the grace-period kthread will see that task's read-side ++ // critical section or the task will see the updater's pre-GP ++ // accesses. The trailing smp_mb() in cpu_curr_snapshot() ++ // does not currently play a role other than simplify ++ // that function's ordering semantics. If these simplified ++ // ordering semantics continue to be redundant, that smp_mb() ++ // might be removed. + t = cpu_curr_snapshot(cpu); + if (rcu_tasks_trace_pertask_prep(t, true)) + trc_add_holdout(t, hop); +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index cac41c49bd2f5..753d7208123bb 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -4318,12 +4318,7 @@ int task_call_func(struct task_struct *p, task_call_f func, void *arg) + * @cpu: The CPU on which to snapshot the task. + * + * Returns the task_struct pointer of the task "currently" running on +- * the specified CPU. If the same task is running on that CPU throughout, +- * the return value will be a pointer to that task's task_struct structure. +- * If the CPU did any context switches even vaguely concurrently with the +- * execution of this function, the return value will be a pointer to the +- * task_struct structure of a randomly chosen task that was running on +- * that CPU somewhere around the time that this function was executing. ++ * the specified CPU. + * + * If the specified CPU was offline, the return value is whatever it + * is, perhaps a pointer to the task_struct structure of that CPU's idle +@@ -4337,11 +4332,16 @@ int task_call_func(struct task_struct *p, task_call_f func, void *arg) + */ + struct task_struct *cpu_curr_snapshot(int cpu) + { ++ struct rq *rq = cpu_rq(cpu); + struct task_struct *t; ++ struct rq_flags rf; + +- smp_mb(); /* Pairing determined by caller's synchronization design. */ ++ rq_lock_irqsave(rq, &rf); ++ smp_mb__after_spinlock(); /* Pairing determined by caller's synchronization design. */ + t = rcu_dereference(cpu_curr(cpu)); ++ rq_unlock_irqrestore(rq, &rf); + smp_mb(); /* Pairing determined by caller's synchronization design. */ ++ + return t; + } + +-- +2.43.0 + diff --git a/queue-6.1/rdma-cache-release-gid-table-even-if-leak-is-detecte.patch b/queue-6.1/rdma-cache-release-gid-table-even-if-leak-is-detecte.patch new file mode 100644 index 00000000000..36ece37243a --- /dev/null +++ b/queue-6.1/rdma-cache-release-gid-table-even-if-leak-is-detecte.patch @@ -0,0 +1,58 @@ +From 08d4c5ef250d9c7e7ef25744130a0e8260cb4aa7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 15:52:51 +0300 +Subject: RDMA/cache: Release GID table even if leak is detected + +From: Leon Romanovsky + +[ Upstream commit a92fbeac7e94a420b55570c10fe1b90e64da4025 ] + +When the table is released, we nullify pointer to GID table, it means +that in case GID entry leak is detected, we will leak table too. + +Delete code that prevents table destruction. + +Fixes: b150c3862d21 ("IB/core: Introduce GID entry reference counts") +Link: https://lore.kernel.org/r/a62560af06ba82c88ef9194982bfa63d14768ff9.1716900410.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cache.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c +index 4084d05a45102..c319664ca74b3 100644 +--- a/drivers/infiniband/core/cache.c ++++ b/drivers/infiniband/core/cache.c +@@ -794,7 +794,6 @@ static struct ib_gid_table *alloc_gid_table(int sz) + static void release_gid_table(struct ib_device *device, + struct ib_gid_table *table) + { +- bool leak = false; + int i; + + if (!table) +@@ -803,15 +802,12 @@ static void release_gid_table(struct ib_device *device, + for (i = 0; i < table->sz; i++) { + if (is_gid_entry_free(table->data_vec[i])) + continue; +- if (kref_read(&table->data_vec[i]->kref) > 1) { +- dev_err(&device->dev, +- "GID entry ref leak for index %d ref=%u\n", i, +- kref_read(&table->data_vec[i]->kref)); +- leak = true; +- } ++ ++ WARN_ONCE(true, ++ "GID entry ref leak for dev %s index %d ref=%u\n", ++ dev_name(&device->dev), i, ++ kref_read(&table->data_vec[i]->kref)); + } +- if (leak) +- return; + + mutex_destroy(&table->lock); + kfree(table->data_vec); +-- +2.43.0 + diff --git a/queue-6.1/rdma-device-return-error-earlier-if-port-in-not-vali.patch b/queue-6.1/rdma-device-return-error-earlier-if-port-in-not-vali.patch new file mode 100644 index 00000000000..c6d902d8959 --- /dev/null +++ b/queue-6.1/rdma-device-return-error-earlier-if-port-in-not-vali.patch @@ -0,0 +1,46 @@ +From cc8e69f9e6846682e587712d4d615e341b1d5552 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 16:24:32 +0300 +Subject: RDMA/device: Return error earlier if port in not valid + +From: Leon Romanovsky + +[ Upstream commit 917918f57a7b139c043e78c502876f2c286f4f0a ] + +There is no need to allocate port data if port provided is not valid. + +Fixes: c2261dd76b54 ("RDMA/device: Add ib_device_set_netdev() as an alternative to get_netdev") +Link: https://lore.kernel.org/r/022047a8b16988fc88d4426da50bf60a4833311b.1719235449.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/device.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c +index 453188db39d83..291ded20934c8 100644 +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -2146,6 +2146,9 @@ int ib_device_set_netdev(struct ib_device *ib_dev, struct net_device *ndev, + unsigned long flags; + int ret; + ++ if (!rdma_is_port_valid(ib_dev, port)) ++ return -EINVAL; ++ + /* + * Drivers wish to call this before ib_register_driver, so we have to + * setup the port data early. +@@ -2154,9 +2157,6 @@ int ib_device_set_netdev(struct ib_device *ib_dev, struct net_device *ndev, + if (ret) + return ret; + +- if (!rdma_is_port_valid(ib_dev, port)) +- return -EINVAL; +- + pdata = &ib_dev->port_data[port]; + spin_lock_irqsave(&pdata->netdev_lock, flags); + old_ndev = rcu_dereference_protected( +-- +2.43.0 + diff --git a/queue-6.1/rdma-hns-check-atomic-wr-length.patch b/queue-6.1/rdma-hns-check-atomic-wr-length.patch new file mode 100644 index 00000000000..f52dfb62d19 --- /dev/null +++ b/queue-6.1/rdma-hns-check-atomic-wr-length.patch @@ -0,0 +1,62 @@ +From bb58a2f45d01e356a3675bbf829a5498e46e45fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:36:58 +0800 +Subject: RDMA/hns: Check atomic wr length + +From: Junxian Huang + +[ Upstream commit 6afa2c0bfb8ef69f65715ae059e5bd5f9bbaf03b ] + +8 bytes is the only supported length of atomic. Add this check in +set_rc_wqe(). Besides, stop processing WQEs and return from +set_rc_wqe() if there is any error. + +Fixes: 384f88185112 ("RDMA/hns: Add atomic support") +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-2-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_device.h | 2 ++ + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 9 +++++++-- + 2 files changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h +index 8748b65c87ea7..0a4c046cdfac4 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_device.h ++++ b/drivers/infiniband/hw/hns/hns_roce_device.h +@@ -90,6 +90,8 @@ + /* Configure to HW for PAGE_SIZE larger than 4KB */ + #define PG_SHIFT_OFFSET (PAGE_SHIFT - 12) + ++#define ATOMIC_WR_LEN 8 ++ + #define HNS_ROCE_IDX_QUE_ENTRY_SZ 4 + #define SRQ_DB_REG 0x230 + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index c931cce50d50d..176d75f2514eb 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -602,11 +602,16 @@ static inline int set_rc_wqe(struct hns_roce_qp *qp, + (wr->send_flags & IB_SEND_SIGNALED) ? 1 : 0); + + if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP || +- wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ++ wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD) { ++ if (msg_len != ATOMIC_WR_LEN) ++ return -EINVAL; + set_atomic_seg(wr, rc_sq_wqe, valid_num_sge); +- else if (wr->opcode != IB_WR_REG_MR) ++ } else if (wr->opcode != IB_WR_REG_MR) { + ret = set_rwqe_data_seg(&qp->ibqp, wr, rc_sq_wqe, + &curr_idx, valid_num_sge); ++ if (ret) ++ return ret; ++ } + + /* + * The pipeline can sequentially post all valid WQEs into WQ buffer, +-- +2.43.0 + diff --git a/queue-6.1/rdma-hns-fix-insufficient-extend-db-for-vfs.patch b/queue-6.1/rdma-hns-fix-insufficient-extend-db-for-vfs.patch new file mode 100644 index 00000000000..9a9c84678de --- /dev/null +++ b/queue-6.1/rdma-hns-fix-insufficient-extend-db-for-vfs.patch @@ -0,0 +1,50 @@ +From 4ce90f4241d1f6c81cb2ee2496496746d1b274c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:37:04 +0800 +Subject: RDMA/hns: Fix insufficient extend DB for VFs. + +From: Chengchang Tang + +[ Upstream commit 0b8e658f70ffd5dc7cda3872fd524d657d4796b7 ] + +VFs and its PF will share the memory of the extend DB. Currently, +the number of extend DB allocated by driver is only enough for PF. +This leads to a probability of DB loss and some other problems in +scenarios where both PF and VFs use a large number of QPs. + +Fixes: 6b63597d3540 ("RDMA/hns: Add TSQ link table support") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-8-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index b592f1c1e2f5b..c4521ab66ee45 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -2574,14 +2574,16 @@ static int set_llm_cfg_to_hw(struct hns_roce_dev *hr_dev, + static struct hns_roce_link_table * + alloc_link_table_buf(struct hns_roce_dev *hr_dev) + { ++ u16 total_sl = hr_dev->caps.sl_num * hr_dev->func_num; + struct hns_roce_v2_priv *priv = hr_dev->priv; + struct hns_roce_link_table *link_tbl; + u32 pg_shift, size, min_size; + + link_tbl = &priv->ext_llm; + pg_shift = hr_dev->caps.llm_buf_pg_sz + PAGE_SHIFT; +- size = hr_dev->caps.num_qps * HNS_ROCE_V2_EXT_LLM_ENTRY_SZ; +- min_size = HNS_ROCE_EXT_LLM_MIN_PAGES(hr_dev->caps.sl_num) << pg_shift; ++ size = hr_dev->caps.num_qps * hr_dev->func_num * ++ HNS_ROCE_V2_EXT_LLM_ENTRY_SZ; ++ min_size = HNS_ROCE_EXT_LLM_MIN_PAGES(total_sl) << pg_shift; + + /* Alloc data table */ + size = max(size, min_size); +-- +2.43.0 + diff --git a/queue-6.1/rdma-hns-fix-missing-pagesize-and-alignment-check-in.patch b/queue-6.1/rdma-hns-fix-missing-pagesize-and-alignment-check-in.patch new file mode 100644 index 00000000000..c458c62892a --- /dev/null +++ b/queue-6.1/rdma-hns-fix-missing-pagesize-and-alignment-check-in.patch @@ -0,0 +1,64 @@ +From 759883906a72b23d1a3b54e101e52e1bda72b4ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:37:01 +0800 +Subject: RDMA/hns: Fix missing pagesize and alignment check in FRMR + +From: Chengchang Tang + +[ Upstream commit d387d4b54eb84208bd4ca13572e106851d0a0819 ] + +The offset requires 128B alignment and the page size ranges from +4K to 128M. + +Fixes: 68a997c5d28c ("RDMA/hns: Add FRMR support for hip08") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-5-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_device.h | 4 ++++ + drivers/infiniband/hw/hns/hns_roce_mr.c | 5 +++++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h +index 0a4c046cdfac4..a2bdfa026c560 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_device.h ++++ b/drivers/infiniband/hw/hns/hns_roce_device.h +@@ -82,6 +82,7 @@ + #define MR_TYPE_DMA 0x03 + + #define HNS_ROCE_FRMR_MAX_PA 512 ++#define HNS_ROCE_FRMR_ALIGN_SIZE 128 + + #define PKEY_ID 0xffff + #define NODE_DESC_SIZE 64 +@@ -182,6 +183,9 @@ enum { + #define HNS_HW_PAGE_SHIFT 12 + #define HNS_HW_PAGE_SIZE (1 << HNS_HW_PAGE_SHIFT) + ++#define HNS_HW_MAX_PAGE_SHIFT 27 ++#define HNS_HW_MAX_PAGE_SIZE (1 << HNS_HW_MAX_PAGE_SHIFT) ++ + struct hns_roce_uar { + u64 pfn; + unsigned long index; +diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c +index 190e62da98e4b..980261969b0c0 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_mr.c ++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c +@@ -423,6 +423,11 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents, + struct hns_roce_mtr *mtr = &mr->pbl_mtr; + int ret, sg_num = 0; + ++ if (!IS_ALIGNED(*sg_offset, HNS_ROCE_FRMR_ALIGN_SIZE) || ++ ibmr->page_size < HNS_HW_PAGE_SIZE || ++ ibmr->page_size > HNS_HW_MAX_PAGE_SIZE) ++ return sg_num; ++ + mr->npages = 0; + mr->page_list = kvcalloc(mr->pbl_mtr.hem_cfg.buf_pg_count, + sizeof(dma_addr_t), GFP_KERNEL); +-- +2.43.0 + diff --git a/queue-6.1/rdma-hns-fix-shift-out-bounds-when-max_inline_data-i.patch b/queue-6.1/rdma-hns-fix-shift-out-bounds-when-max_inline_data-i.patch new file mode 100644 index 00000000000..c64e2cd4ae1 --- /dev/null +++ b/queue-6.1/rdma-hns-fix-shift-out-bounds-when-max_inline_data-i.patch @@ -0,0 +1,83 @@ +From b00ea5828251afa37c3a2c9f7bbad80fcd8ab009 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:37:02 +0800 +Subject: RDMA/hns: Fix shift-out-bounds when max_inline_data is 0 + +From: Chengchang Tang + +[ Upstream commit 24c6291346d98c7ece4f4bfeb5733bec1d6c7b4f ] + +A shift-out-bounds may occur, if the max_inline_data has not been set. + +The related log: +UBSAN: shift-out-of-bounds in kernel/include/linux/log2.h:57:13 +shift exponent 64 is too large for 64-bit type 'long unsigned int' +Call trace: + dump_backtrace+0xb0/0x118 + show_stack+0x20/0x38 + dump_stack_lvl+0xbc/0x120 + dump_stack+0x1c/0x28 + __ubsan_handle_shift_out_of_bounds+0x104/0x240 + set_ext_sge_param+0x40c/0x420 [hns_roce_hw_v2] + hns_roce_create_qp+0xf48/0x1c40 [hns_roce_hw_v2] + create_qp.part.0+0x294/0x3c0 + ib_create_qp_kernel+0x7c/0x150 + create_mad_qp+0x11c/0x1e0 + ib_mad_init_device+0x834/0xc88 + add_client_context+0x248/0x318 + enable_device_and_get+0x158/0x280 + ib_register_device+0x4ac/0x610 + hns_roce_init+0x890/0xf98 [hns_roce_hw_v2] + __hns_roce_hw_v2_init_instance+0x398/0x720 [hns_roce_hw_v2] + hns_roce_hw_v2_init_instance+0x108/0x1e0 [hns_roce_hw_v2] + hclge_init_roce_client_instance+0x1a0/0x358 [hclge] + hclge_init_client_instance+0xa0/0x508 [hclge] + hnae3_register_client+0x18c/0x210 [hnae3] + hns_roce_hw_v2_init+0x28/0xff8 [hns_roce_hw_v2] + do_one_initcall+0xe0/0x510 + do_init_module+0x110/0x370 + load_module+0x2c6c/0x2f20 + init_module_from_file+0xe0/0x140 + idempotent_init_module+0x24c/0x350 + __arm64_sys_finit_module+0x88/0xf8 + invoke_syscall+0x68/0x1a0 + el0_svc_common.constprop.0+0x11c/0x150 + do_el0_svc+0x38/0x50 + el0_svc+0x50/0xa0 + el0t_64_sync_handler+0xc0/0xc8 + el0t_64_sync+0x1a4/0x1a8 + +Fixes: 0c5e259b06a8 ("RDMA/hns: Fix incorrect sge nums calculation") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-6-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_qp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index 7b79e6b3f3baa..c97b5dba17728 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -538,13 +538,15 @@ static unsigned int get_sge_num_from_max_inl_data(bool is_ud_or_gsi, + { + unsigned int inline_sge; + +- inline_sge = roundup_pow_of_two(max_inline_data) / HNS_ROCE_SGE_SIZE; ++ if (!max_inline_data) ++ return 0; + + /* + * if max_inline_data less than + * HNS_ROCE_SGE_IN_WQE * HNS_ROCE_SGE_SIZE, + * In addition to ud's mode, no need to extend sge. + */ ++ inline_sge = roundup_pow_of_two(max_inline_data) / HNS_ROCE_SGE_SIZE; + if (!is_ud_or_gsi && inline_sge <= HNS_ROCE_SGE_IN_WQE) + inline_sge = 0; + +-- +2.43.0 + diff --git a/queue-6.1/rdma-hns-fix-undifined-behavior-caused-by-invalid-ma.patch b/queue-6.1/rdma-hns-fix-undifined-behavior-caused-by-invalid-ma.patch new file mode 100644 index 00000000000..0c8be003d1b --- /dev/null +++ b/queue-6.1/rdma-hns-fix-undifined-behavior-caused-by-invalid-ma.patch @@ -0,0 +1,38 @@ +From 207d80c4450566e65a3111114509d455602b3557 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:37:03 +0800 +Subject: RDMA/hns: Fix undifined behavior caused by invalid max_sge + +From: Chengchang Tang + +[ Upstream commit 36397b907355e2fdb5a25a02a7921a937fd8ef4c ] + +If max_sge has been set to 0, roundup_pow_of_two() in +set_srq_basic_param() may have undefined behavior. + +Fixes: 9dd052474a26 ("RDMA/hns: Allocate one more recv SGE for HIP08") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-7-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_srq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c +index 6a4923c21cbc6..727f926500712 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_srq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c +@@ -296,7 +296,7 @@ static int set_srq_basic_param(struct hns_roce_srq *srq, + + max_sge = proc_srq_sge(hr_dev, srq, !!udata); + if (attr->max_wr > hr_dev->caps.max_srq_wrs || +- attr->max_sge > max_sge) { ++ attr->max_sge > max_sge || !attr->max_sge) { + ibdev_err(&hr_dev->ib_dev, + "invalid SRQ attr, depth = %u, sge = %u.\n", + attr->max_wr, attr->max_sge); +-- +2.43.0 + diff --git a/queue-6.1/rdma-hns-fix-unmatch-exception-handling-when-init-eq.patch b/queue-6.1/rdma-hns-fix-unmatch-exception-handling-when-init-eq.patch new file mode 100644 index 00000000000..bd0a6c07d37 --- /dev/null +++ b/queue-6.1/rdma-hns-fix-unmatch-exception-handling-when-init-eq.patch @@ -0,0 +1,83 @@ +From b148543e7743419c2b707584cbd8237661399811 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:37:00 +0800 +Subject: RDMA/hns: Fix unmatch exception handling when init eq table fails + +From: Junxian Huang + +[ Upstream commit 543fb987bd63ed27409b5dea3d3eec27b9c1eac9 ] + +The hw ctx should be destroyed when init eq table fails. + +Fixes: a5073d6054f7 ("RDMA/hns: Add eq support of hip08") +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-4-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 25 +++++++++++----------- + 1 file changed, 13 insertions(+), 12 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 176d75f2514eb..b592f1c1e2f5b 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -6418,9 +6418,16 @@ static void hns_roce_v2_int_mask_enable(struct hns_roce_dev *hr_dev, + roce_write(hr_dev, ROCEE_VF_ABN_INT_CFG_REG, enable_flag); + } + +-static void hns_roce_v2_destroy_eqc(struct hns_roce_dev *hr_dev, u32 eqn) ++static void free_eq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq) ++{ ++ hns_roce_mtr_destroy(hr_dev, &eq->mtr); ++} ++ ++static void hns_roce_v2_destroy_eqc(struct hns_roce_dev *hr_dev, ++ struct hns_roce_eq *eq) + { + struct device *dev = hr_dev->dev; ++ int eqn = eq->eqn; + int ret; + u8 cmd; + +@@ -6431,12 +6438,9 @@ static void hns_roce_v2_destroy_eqc(struct hns_roce_dev *hr_dev, u32 eqn) + + ret = hns_roce_destroy_hw_ctx(hr_dev, cmd, eqn & HNS_ROCE_V2_EQN_M); + if (ret) +- dev_err(dev, "[mailbox cmd] destroy eqc(%u) failed.\n", eqn); +-} ++ dev_err(dev, "[mailbox cmd] destroy eqc(%d) failed.\n", eqn); + +-static void free_eq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq) +-{ +- hns_roce_mtr_destroy(hr_dev, &eq->mtr); ++ free_eq_buf(hr_dev, eq); + } + + static void init_eq_config(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq) +@@ -6742,7 +6746,7 @@ static int hns_roce_v2_init_eq_table(struct hns_roce_dev *hr_dev) + + err_create_eq_fail: + for (i -= 1; i >= 0; i--) +- free_eq_buf(hr_dev, &eq_table->eq[i]); ++ hns_roce_v2_destroy_eqc(hr_dev, &eq_table->eq[i]); + kfree(eq_table->eq); + + return ret; +@@ -6762,11 +6766,8 @@ static void hns_roce_v2_cleanup_eq_table(struct hns_roce_dev *hr_dev) + __hns_roce_free_irq(hr_dev); + destroy_workqueue(hr_dev->irq_workq); + +- for (i = 0; i < eq_num; i++) { +- hns_roce_v2_destroy_eqc(hr_dev, i); +- +- free_eq_buf(hr_dev, &eq_table->eq[i]); +- } ++ for (i = 0; i < eq_num; i++) ++ hns_roce_v2_destroy_eqc(hr_dev, &eq_table->eq[i]); + + kfree(eq_table->eq); + } +-- +2.43.0 + diff --git a/queue-6.1/rdma-mlx4-fix-truncated-output-warning-in-alias_guid.patch b/queue-6.1/rdma-mlx4-fix-truncated-output-warning-in-alias_guid.patch new file mode 100644 index 00000000000..381e85d6f23 --- /dev/null +++ b/queue-6.1/rdma-mlx4-fix-truncated-output-warning-in-alias_guid.patch @@ -0,0 +1,52 @@ +From e1ca86f39820f0d7e016d4dbb6a06ea0a339300d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jun 2024 19:17:30 +0300 +Subject: RDMA/mlx4: Fix truncated output warning in alias_GUID.c +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leon Romanovsky + +[ Upstream commit 5953e0647cec703ef436ead37fed48943507b433 ] + +drivers/infiniband/hw/mlx4/alias_GUID.c: In function ‘mlx4_ib_init_alias_guid_service’: +drivers/infiniband/hw/mlx4/alias_GUID.c:878:74: error: ‘%d’ directive +output may be truncated writing between 1 and 11 bytes into a region of +size 5 [-Werror=format-truncation=] + 878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i); + | ^~ +drivers/infiniband/hw/mlx4/alias_GUID.c:878:63: note: directive argument in the range [-2147483641, 2147483646] + 878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i); + | ^~~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/alias_GUID.c:878:17: note: ‘snprintf’ output +between 12 and 22 bytes into a destination of size 15 + 878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors + +Fixes: a0c64a17aba8 ("mlx4: Add alias_guid mechanism") +Link: https://lore.kernel.org/r/1951c9500109ca7e36dcd523f8a5f2d0d2a608d1.1718554641.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/alias_GUID.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx4/alias_GUID.c b/drivers/infiniband/hw/mlx4/alias_GUID.c +index 111fa88a3be44..9a439569ffcf3 100644 +--- a/drivers/infiniband/hw/mlx4/alias_GUID.c ++++ b/drivers/infiniband/hw/mlx4/alias_GUID.c +@@ -829,7 +829,7 @@ void mlx4_ib_destroy_alias_guid_service(struct mlx4_ib_dev *dev) + + int mlx4_ib_init_alias_guid_service(struct mlx4_ib_dev *dev) + { +- char alias_wq_name[15]; ++ char alias_wq_name[22]; + int ret = 0; + int i, j; + union ib_gid gid; +-- +2.43.0 + diff --git a/queue-6.1/rdma-mlx4-fix-truncated-output-warning-in-mad.c.patch b/queue-6.1/rdma-mlx4-fix-truncated-output-warning-in-mad.c.patch new file mode 100644 index 00000000000..4dd7c191a7b --- /dev/null +++ b/queue-6.1/rdma-mlx4-fix-truncated-output-warning-in-mad.c.patch @@ -0,0 +1,82 @@ +From 65c5bcdd519195b13fe987a9b774ab49adfa6be5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jun 2024 19:16:33 +0300 +Subject: RDMA/mlx4: Fix truncated output warning in mad.c +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leon Romanovsky + +[ Upstream commit 0d2e6992fc956e3308cd5376c18567def4cb3967 ] + +Increase size of the name array to avoid truncated output warning. + +drivers/infiniband/hw/mlx4/mad.c: In function ‘mlx4_ib_alloc_demux_ctx’: +drivers/infiniband/hw/mlx4/mad.c:2197:47: error: ‘%d’ directive output +may be truncated writing between 1 and 11 bytes into a region of size 4 +[-Werror=format-truncation=] + 2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port); + | ^~ +drivers/infiniband/hw/mlx4/mad.c:2197:38: note: directive argument in +the range [-2147483645, 2147483647] + 2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port); + | ^~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2197:9: note: ‘snprintf’ output between +10 and 20 bytes into a destination of size 12 + 2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2205:48: error: ‘%d’ directive output +may be truncated writing between 1 and 11 bytes into a region of size 3 +[-Werror=format-truncation=] + 2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port); + | ^~ +drivers/infiniband/hw/mlx4/mad.c:2205:38: note: directive argument in +the range [-2147483645, 2147483647] + 2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port); + | ^~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2205:9: note: ‘snprintf’ output between +11 and 21 bytes into a destination of size 12 + 2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2213:48: error: ‘%d’ directive output +may be truncated writing between 1 and 11 bytes into a region of size 3 +[-Werror=format-truncation=] + 2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port); + | ^~ +drivers/infiniband/hw/mlx4/mad.c:2213:38: note: directive argument in +the range [-2147483645, 2147483647] + 2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port); + | ^~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2213:9: note: ‘snprintf’ output between +11 and 21 bytes into a destination of size 12 + 2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors +make[6]: *** [scripts/Makefile.build:244: drivers/infiniband/hw/mlx4/mad.o] Error 1 + +Fixes: fc06573dfaf8 ("IB/mlx4: Initialize SR-IOV IB support for slaves in master context") +Link: https://lore.kernel.org/r/f3798b3ce9a410257d7e1ec7c9e285f1352e256a.1718554569.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/mad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c +index a37cfac5e23f9..dc9cf45d2d320 100644 +--- a/drivers/infiniband/hw/mlx4/mad.c ++++ b/drivers/infiniband/hw/mlx4/mad.c +@@ -2158,7 +2158,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, + struct mlx4_ib_demux_ctx *ctx, + int port) + { +- char name[12]; ++ char name[21]; + int ret = 0; + int i; + +-- +2.43.0 + diff --git a/queue-6.1/rdma-mlx5-set-mkeys-for-dmabuf-at-page_size.patch b/queue-6.1/rdma-mlx5-set-mkeys-for-dmabuf-at-page_size.patch new file mode 100644 index 00000000000..f022c73f10d --- /dev/null +++ b/queue-6.1/rdma-mlx5-set-mkeys-for-dmabuf-at-page_size.patch @@ -0,0 +1,70 @@ +From 641595f03a0bf6e3135b31979b4f881ea42b7b6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 21:01:42 +0300 +Subject: RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE + +From: Chiara Meiohas + +[ Upstream commit a4e540119be565f47c305f295ed43f8e0bc3f5c3 ] + +Set the mkey for dmabuf at PAGE_SIZE to support any SGL +after a move operation. + +ib_umem_find_best_pgsz returns 0 on error, so it is +incorrect to check the returned page_size against PAGE_SIZE + +Fixes: 90da7dc8206a ("RDMA/mlx5: Support dma-buf based userspace memory region") +Signed-off-by: Chiara Meiohas +Reviewed-by: Michael Guralnik +Link: https://lore.kernel.org/r/1e2289b9133e89f273a4e68d459057d032cbc2ce.1718301631.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/mlx5_ib.h | 13 +++++++++++++ + drivers/infiniband/hw/mlx5/odp.c | 6 ++---- + 2 files changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h +index 8d94e6834e01b..0ef347e91ffeb 100644 +--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h ++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h +@@ -109,6 +109,19 @@ unsigned long __mlx5_umem_find_best_quantized_pgoff( + __mlx5_bit_sz(typ, page_offset_fld), 0, scale, \ + page_offset_quantized) + ++static inline unsigned long ++mlx5_umem_dmabuf_find_best_pgsz(struct ib_umem_dmabuf *umem_dmabuf) ++{ ++ /* ++ * mkeys used for dmabuf are fixed at PAGE_SIZE because we must be able ++ * to hold any sgl after a move operation. Ideally the mkc page size ++ * could be changed at runtime to be optimal, but right now the driver ++ * cannot do that. ++ */ ++ return ib_umem_find_best_pgsz(&umem_dmabuf->umem, PAGE_SIZE, ++ umem_dmabuf->umem.iova); ++} ++ + enum { + MLX5_IB_MMAP_OFFSET_START = 9, + MLX5_IB_MMAP_OFFSET_END = 255, +diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c +index bc97958818bb5..af73c5ebe6ac5 100644 +--- a/drivers/infiniband/hw/mlx5/odp.c ++++ b/drivers/infiniband/hw/mlx5/odp.c +@@ -706,10 +706,8 @@ static int pagefault_dmabuf_mr(struct mlx5_ib_mr *mr, size_t bcnt, + return err; + } + +- page_size = mlx5_umem_find_best_pgsz(&umem_dmabuf->umem, mkc, +- log_page_size, 0, +- umem_dmabuf->umem.iova); +- if (unlikely(page_size < PAGE_SIZE)) { ++ page_size = mlx5_umem_dmabuf_find_best_pgsz(umem_dmabuf); ++ if (!page_size) { + ib_umem_dmabuf_unmap_pages(umem_dmabuf); + err = -EINVAL; + } else { +-- +2.43.0 + diff --git a/queue-6.1/rdma-mlx5-use-sq-timestamp-as-qp-timestamp-when-roce.patch b/queue-6.1/rdma-mlx5-use-sq-timestamp-as-qp-timestamp-when-roce.patch new file mode 100644 index 00000000000..520eb2fe781 --- /dev/null +++ b/queue-6.1/rdma-mlx5-use-sq-timestamp-as-qp-timestamp-when-roce.patch @@ -0,0 +1,62 @@ +From edb73f1dcf9dd0237bf17731a2e95498ee9d348c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jun 2024 19:10:36 +0300 +Subject: RDMA/mlx5: Use sq timestamp as QP timestamp when RoCE is disabled + +From: Or Har-Toov + +[ Upstream commit 0c5275bf75ec3708d95654195ae4ed80d946d088 ] + +When creating a QP, one of the attributes is TS format (timestamp). +In some devices, we have a limitation that all QPs should have the same +ts_format. The ts_format is chosen based on the device's capability. +The qp_ts_format cap resides under the RoCE caps table, and the +cap will be 0 when RoCE is disabled. So when RoCE is disabled, the +value that should be queried is sq_ts_format under HCA caps. + +Consider the case when the system supports REAL_TIME_TS format (0x2), +some QPs are created with REAL_TIME_TS as ts_format, and afterwards +RoCE gets disabled. When trying to construct a new QP, we can't use +the qp_ts_format, that is queried from the RoCE caps table, Since it +leads to passing 0x0 (FREE_RUNNING_TS) as the value of the qp_ts_format, +which is different than the ts_format of the previously allocated +QPs REAL_TIME_TS format (0x2). + +Thus, to resolve this, read the sq_ts_format, which also reflect +the supported ts format for the QP when RoCE is disabled. + +Fixes: 4806f1e2fee8 ("net/mlx5: Set QP timestamp mode to default") +Signed-off-by: Maher Sanalla +Signed-off-by: Or Har-Toov +Link: https://lore.kernel.org/r/32801966eb767c7fd62b8dea3b63991d5fbfe213.1718554199.git.leon@kernel.org +Reviewed-by: Simon Horman +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + include/linux/mlx5/qp.h | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h +index ca0eee571ad7b..15e8d7fd3879f 100644 +--- a/include/linux/mlx5/qp.h ++++ b/include/linux/mlx5/qp.h +@@ -566,9 +566,12 @@ static inline const char *mlx5_qp_state_str(int state) + + static inline int mlx5_get_qp_default_ts(struct mlx5_core_dev *dev) + { +- return !MLX5_CAP_ROCE(dev, qp_ts_format) ? +- MLX5_TIMESTAMP_FORMAT_FREE_RUNNING : +- MLX5_TIMESTAMP_FORMAT_DEFAULT; ++ u8 supported_ts_cap = mlx5_get_roce_state(dev) ? ++ MLX5_CAP_ROCE(dev, qp_ts_format) : ++ MLX5_CAP_GEN(dev, sq_ts_format); ++ ++ return supported_ts_cap ? MLX5_TIMESTAMP_FORMAT_DEFAULT : ++ MLX5_TIMESTAMP_FORMAT_FREE_RUNNING; + } + + #endif /* MLX5_QP_H */ +-- +2.43.0 + diff --git a/queue-6.1/rdma-rxe-don-t-set-bth_ack_mask-for-uc-or-ud-qps.patch b/queue-6.1/rdma-rxe-don-t-set-bth_ack_mask-for-uc-or-ud-qps.patch new file mode 100644 index 00000000000..1bf08927a0d --- /dev/null +++ b/queue-6.1/rdma-rxe-don-t-set-bth_ack_mask-for-uc-or-ud-qps.patch @@ -0,0 +1,53 @@ +From fbd8b14f64775ce88d2433eb32a624accb71a424 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 10:03:48 +0800 +Subject: RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs + +From: Honggang LI + +[ Upstream commit 4adcaf969d77d3d3aa3871bbadc196258a38aec6 ] + +BTH_ACK_MASK bit is used to indicate that an acknowledge +(for this packet) should be scheduled by the responder. +Both UC and UD QPs are unacknowledged, so don't set +BTH_ACK_MASK for UC or UD QPs. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Signed-off-by: Honggang LI +Link: https://lore.kernel.org/r/20240624020348.494338-1-honggangli@163.com +Reviewed-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_req.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index 2ace1007a4195..35768fdbd5b74 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -390,7 +390,7 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp, + int paylen; + int solicited; + u32 qp_num; +- int ack_req; ++ int ack_req = 0; + + /* length from start of bth to end of icrc */ + paylen = rxe_opcode[opcode].length + payload + pad + RXE_ICRC_SIZE; +@@ -411,8 +411,9 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp, + qp_num = (pkt->mask & RXE_DETH_MASK) ? ibwr->wr.ud.remote_qpn : + qp->attr.dest_qp_num; + +- ack_req = ((pkt->mask & RXE_END_MASK) || +- (qp->req.noack_pkts++ > RXE_MAX_PKT_PER_ACK)); ++ if (qp_type(qp) != IB_QPT_UD && qp_type(qp) != IB_QPT_UC) ++ ack_req = ((pkt->mask & RXE_END_MASK) || ++ (qp->req.noack_pkts++ > RXE_MAX_PKT_PER_ACK)); + if (ack_req) + qp->req.noack_pkts = 0; + +-- +2.43.0 + diff --git a/queue-6.1/revert-leds-led-core-fix-refcount-leak-in-of_led_get.patch b/queue-6.1/revert-leds-led-core-fix-refcount-leak-in-of_led_get.patch new file mode 100644 index 00000000000..550cd2e8cf8 --- /dev/null +++ b/queue-6.1/revert-leds-led-core-fix-refcount-leak-in-of_led_get.patch @@ -0,0 +1,84 @@ +From ffaa94fb21572b09d825fdb918e13829113515bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 10:34:38 +0200 +Subject: Revert "leds: led-core: Fix refcount leak in of_led_get()" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luca Ceresoli + +[ Upstream commit 940b27161afc6ec53fc66245a4fb3518394cdc92 ] + +This reverts commit da1afe8e6099980fe1e2fd7436dca284af9d3f29. + +Commit 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()"), introduced in +5.5, added of_led_get() and led_put() but missed a put_device() in +led_put(), thus creating a leak in case the consumer device is removed. + +Arguably device removal was not very popular, so this went apparently +unnoticed until 2022. In January 2023 two different patches got merged to +fix the same bug: + + - commit da1afe8e6099 ("leds: led-core: Fix refcount leak in of_led_get()") + - commit 445110941eb9 ("leds: led-class: Add missing put_device() to led_put()") + +They fix the bug in two different ways, which creates no patch conflicts, +and both were merged in v6.2. The result is that now there is one more +put_device() than get_device()s, instead of one less. + +Arguably device removal is not very popular yet, so this apparently hasn't +been noticed as well up to now. But it blew up here while I'm working with +device tree overlay insertion and removal. The symptom is an apparently +unrelated list of oopses on device removal, with reasons: + + kernfs: can not remove 'uevent', no directory + kernfs: can not remove 'brightness', no directory + kernfs: can not remove 'max_brightness', no directory + ... + +Here sysfs fails removing attribute files, which is because the device name +changed and so the sysfs path. This is because the device name string got +corrupted, which is because it got freed too early and its memory reused. + +Different symptoms could appear in different use cases. + +Fix by removing one of the two fixes. + +The choice was to remove commit da1afe8e6099 because: + + * it is calling put_device() inside of_led_get() just after getting the + device, thus it is basically not refcounting the LED device at all + during its entire lifetime + * it does not add a corresponding put_device() in led_get(), so it fixes + only the OF case + +The other fix (445110941eb9) is adding the put_device() in led_put() so it +covers the entire lifetime, and it works even in the non-DT case. + +Fixes: da1afe8e6099 ("leds: led-core: Fix refcount leak in of_led_get()") +Co-developed-by: Hervé Codina +Signed-off-by: Hervé Codina +Signed-off-by: Luca Ceresoli +Link: https://lore.kernel.org/r/20240625-led-class-device-leak-v2-1-75fdccf47421@bootlin.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/led-class.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index aa39b2a48fdff..7391d2cf1370a 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -235,7 +235,6 @@ struct led_classdev *of_led_get(struct device_node *np, int index) + + led_dev = class_find_device_by_of_node(leds_class, led_node); + of_node_put(led_node); +- put_device(led_dev); + + if (!led_dev) + return ERR_PTR(-EPROBE_DEFER); +-- +2.43.0 + diff --git a/queue-6.1/rtc-interface-add-rtc-offset-to-alarm-after-fix-up.patch b/queue-6.1/rtc-interface-add-rtc-offset-to-alarm-after-fix-up.patch new file mode 100644 index 00000000000..add64c14c68 --- /dev/null +++ b/queue-6.1/rtc-interface-add-rtc-offset-to-alarm-after-fix-up.patch @@ -0,0 +1,60 @@ +From 25c70273beeb0b7c4eaf0bd4d497ef2a2411eef7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 16:04:52 +0200 +Subject: rtc: interface: Add RTC offset to alarm after fix-up +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Csókás, Bence + +[ Upstream commit 463927a8902a9f22c3633960119410f57d4c8920 ] + +`rtc_add_offset()` is called by `__rtc_read_time()` +and `__rtc_read_alarm()` to add the RTC's offset to +the raw read-outs from the device drivers. However, +in the latter case, a fix-up algorithm is run if +the RTC device does not report a full `struct rtc_time` +alarm value. In that case, the offset was forgot to be +added. + +Fixes: fd6792bb022e ("rtc: fix alarm read and set offset") + +Signed-off-by: Csókás, Bence +Link: https://lore.kernel.org/r/20240619140451.2800578-1-csokas.bence@prolan.hu +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/interface.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index 3d0fbc644f578..c928037bf6f3a 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -274,10 +274,9 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + return err; + + /* full-function RTCs won't have such missing fields */ +- if (rtc_valid_tm(&alarm->time) == 0) { +- rtc_add_offset(rtc, &alarm->time); +- return 0; +- } ++ err = rtc_valid_tm(&alarm->time); ++ if (!err) ++ goto done; + + /* get the "after" timestamp, to detect wrapped fields */ + err = rtc_read_time(rtc, &now); +@@ -379,6 +378,8 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + if (err) + dev_warn(&rtc->dev, "invalid alarm value: %ptR\n", + &alarm->time); ++ else ++ rtc_add_offset(rtc, &alarm->time); + + return err; + } +-- +2.43.0 + diff --git a/queue-6.1/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch b/queue-6.1/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch new file mode 100644 index 00000000000..3bc28a0d2c1 --- /dev/null +++ b/queue-6.1/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch @@ -0,0 +1,57 @@ +From bbf5e443827efd70205a377aa9a3f196e5ace325 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 13:24:34 +0200 +Subject: s390/dasd: fix error checks in dasd_copy_pair_store() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Carlos López + +[ Upstream commit 8e64d2356cbc800b4cd0e3e614797f76bcf0cdb8 ] + +dasd_add_busid() can return an error via ERR_PTR() if an allocation +fails. However, two callsites in dasd_copy_pair_store() do not check +the result, potentially resulting in a NULL pointer dereference. Fix +this by checking the result with IS_ERR() and returning the error up +the stack. + +Fixes: a91ff09d39f9b ("s390/dasd: add copy pair setup") +Signed-off-by: Carlos López +Signed-off-by: Stefan Haberland +Link: https://lore.kernel.org/r/20240715112434.2111291-3-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/s390/block/dasd_devmap.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c +index b2a4c34330573..1129f6ae98b57 100644 +--- a/drivers/s390/block/dasd_devmap.c ++++ b/drivers/s390/block/dasd_devmap.c +@@ -2135,13 +2135,19 @@ static ssize_t dasd_copy_pair_store(struct device *dev, + + /* allocate primary devmap if needed */ + prim_devmap = dasd_find_busid(prim_busid); +- if (IS_ERR(prim_devmap)) ++ if (IS_ERR(prim_devmap)) { + prim_devmap = dasd_add_busid(prim_busid, DASD_FEATURE_DEFAULT); ++ if (IS_ERR(prim_devmap)) ++ return PTR_ERR(prim_devmap); ++ } + + /* allocate secondary devmap if needed */ + sec_devmap = dasd_find_busid(sec_busid); +- if (IS_ERR(sec_devmap)) ++ if (IS_ERR(sec_devmap)) { + sec_devmap = dasd_add_busid(sec_busid, DASD_FEATURE_DEFAULT); ++ if (IS_ERR(sec_devmap)) ++ return PTR_ERR(sec_devmap); ++ } + + /* setting copy relation is only allowed for offline secondary */ + if (sec_devmap->device) +-- +2.43.0 + diff --git a/queue-6.1/s390-mm-convert-gmap_make_secure-to-use-a-folio.patch b/queue-6.1/s390-mm-convert-gmap_make_secure-to-use-a-folio.patch new file mode 100644 index 00000000000..ea3f16036de --- /dev/null +++ b/queue-6.1/s390-mm-convert-gmap_make_secure-to-use-a-folio.patch @@ -0,0 +1,102 @@ +From ebd676ff559e9022823902c329dd4df13e3e3e67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 16:11:47 +0000 +Subject: s390/mm: Convert gmap_make_secure to use a folio + +From: Matthew Wilcox (Oracle) + +[ Upstream commit d35c34bb32f2cc4ec0b52e91ad7a8fcab55d7856 ] + +Remove uses of deprecated page APIs, and move the check for large +folios to here to avoid taking the folio lock if the folio is too large. +We could do better here by attempting to split the large folio, but I'll +leave that improvement for someone who can test it. + +Acked-by: Claudio Imbrenda +Signed-off-by: Matthew Wilcox (Oracle) +Link: https://lore.kernel.org/r/20240322161149.2327518-3-willy@infradead.org +Signed-off-by: Alexander Gordeev +Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference") +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/uv.c | 27 ++++++++++++++------------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c +index 97567fb8936c7..6f661add0a5d6 100644 +--- a/arch/s390/kernel/uv.c ++++ b/arch/s390/kernel/uv.c +@@ -192,13 +192,10 @@ static int expected_folio_refs(struct folio *folio) + return res; + } + +-static int make_page_secure(struct page *page, struct uv_cb_header *uvcb) ++static int make_folio_secure(struct folio *folio, struct uv_cb_header *uvcb) + { +- struct folio *folio = page_folio(page); + int expected, cc = 0; + +- if (folio_test_large(folio)) +- return -EINVAL; + if (folio_test_writeback(folio)) + return -EAGAIN; + expected = expected_folio_refs(folio); +@@ -264,7 +261,7 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) + bool local_drain = false; + spinlock_t *ptelock; + unsigned long uaddr; +- struct page *page; ++ struct folio *folio; + pte_t *ptep; + int rc; + +@@ -291,15 +288,19 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) + rc = -ENXIO; + ptep = get_locked_pte(gmap->mm, uaddr, &ptelock); + if (pte_present(*ptep) && !(pte_val(*ptep) & _PAGE_INVALID) && pte_write(*ptep)) { +- page = pte_page(*ptep); ++ folio = page_folio(pte_page(*ptep)); ++ rc = -EINVAL; ++ if (folio_test_large(folio)) ++ goto unlock; + rc = -EAGAIN; +- if (trylock_page(page)) { ++ if (folio_trylock(folio)) { + if (should_export_before_import(uvcb, gmap->mm)) +- uv_convert_from_secure(page_to_phys(page)); +- rc = make_page_secure(page, uvcb); +- unlock_page(page); ++ uv_convert_from_secure(PFN_PHYS(folio_pfn(folio))); ++ rc = make_folio_secure(folio, uvcb); ++ folio_unlock(folio); + } + } ++unlock: + pte_unmap_unlock(ptep, ptelock); + out: + mmap_read_unlock(gmap->mm); +@@ -309,10 +310,10 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) + * If we are here because the UVC returned busy or partial + * completion, this is just a useless check, but it is safe. + */ +- wait_on_page_writeback(page); ++ folio_wait_writeback(folio); + } else if (rc == -EBUSY) { + /* +- * If we have tried a local drain and the page refcount ++ * If we have tried a local drain and the folio refcount + * still does not match our expected safe value, try with a + * system wide drain. This is needed if the pagevecs holding + * the page are on a different CPU. +@@ -323,7 +324,7 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) + return -EAGAIN; + } + /* +- * We are here if the page refcount does not match the ++ * We are here if the folio refcount does not match the + * expected safe value. The main culprits are usually + * pagevecs. With lru_add_drain() we drain the pagevecs + * on the local CPU so that hopefully the refcount will +-- +2.43.0 + diff --git a/queue-6.1/s390-mm-convert-make_page_secure-to-use-a-folio.patch b/queue-6.1/s390-mm-convert-make_page_secure-to-use-a-folio.patch new file mode 100644 index 00000000000..ad32c7a0642 --- /dev/null +++ b/queue-6.1/s390-mm-convert-make_page_secure-to-use-a-folio.patch @@ -0,0 +1,93 @@ +From 392c2aea5992b0101c6416a4f90167fa399f16e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 16:11:46 +0000 +Subject: s390/mm: Convert make_page_secure to use a folio + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 259e660d91d0e7261ae0ee37bb37266d6006a546 ] + +These page APIs are deprecated, so convert the incoming page to a folio +and use the folio APIs instead. The ultravisor API cannot handle large +folios, so return -EINVAL if one has slipped through. + +Acked-by: Claudio Imbrenda +Signed-off-by: Matthew Wilcox (Oracle) +Link: https://lore.kernel.org/r/20240322161149.2327518-2-willy@infradead.org +Signed-off-by: Alexander Gordeev +Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference") +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/uv.c | 29 ++++++++++++++++------------- + 1 file changed, 16 insertions(+), 13 deletions(-) + +diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c +index 5caa0ed2b594a..97567fb8936c7 100644 +--- a/arch/s390/kernel/uv.c ++++ b/arch/s390/kernel/uv.c +@@ -172,21 +172,21 @@ int uv_convert_owned_from_secure(unsigned long paddr) + } + + /* +- * Calculate the expected ref_count for a page that would otherwise have no ++ * Calculate the expected ref_count for a folio that would otherwise have no + * further pins. This was cribbed from similar functions in other places in + * the kernel, but with some slight modifications. We know that a secure +- * page can not be a huge page for example. ++ * folio can not be a large folio, for example. + */ +-static int expected_page_refs(struct page *page) ++static int expected_folio_refs(struct folio *folio) + { + int res; + +- res = page_mapcount(page); +- if (PageSwapCache(page)) { ++ res = folio_mapcount(folio); ++ if (folio_test_swapcache(folio)) { + res++; +- } else if (page_mapping(page)) { ++ } else if (folio_mapping(folio)) { + res++; +- if (page_has_private(page)) ++ if (folio->private) + res++; + } + return res; +@@ -194,14 +194,17 @@ static int expected_page_refs(struct page *page) + + static int make_page_secure(struct page *page, struct uv_cb_header *uvcb) + { ++ struct folio *folio = page_folio(page); + int expected, cc = 0; + +- if (PageWriteback(page)) ++ if (folio_test_large(folio)) ++ return -EINVAL; ++ if (folio_test_writeback(folio)) + return -EAGAIN; +- expected = expected_page_refs(page); +- if (!page_ref_freeze(page, expected)) ++ expected = expected_folio_refs(folio); ++ if (!folio_ref_freeze(folio, expected)) + return -EBUSY; +- set_bit(PG_arch_1, &page->flags); ++ set_bit(PG_arch_1, &folio->flags); + /* + * If the UVC does not succeed or fail immediately, we don't want to + * loop for long, or we might get stall notifications. +@@ -211,9 +214,9 @@ static int make_page_secure(struct page *page, struct uv_cb_header *uvcb) + * -EAGAIN and we let the callers deal with it. + */ + cc = __uv_call(0, (u64)uvcb); +- page_ref_unfreeze(page, expected); ++ folio_ref_unfreeze(folio, expected); + /* +- * Return -ENXIO if the page was not mapped, -EINVAL for other errors. ++ * Return -ENXIO if the folio was not mapped, -EINVAL for other errors. + * If busy or partially completed, return -EAGAIN. + */ + if (cc == UVC_CC_OK) +-- +2.43.0 + diff --git a/queue-6.1/s390-uv-don-t-call-folio_wait_writeback-without-a-fo.patch b/queue-6.1/s390-uv-don-t-call-folio_wait_writeback-without-a-fo.patch new file mode 100644 index 00000000000..4a4d8ee42f6 --- /dev/null +++ b/queue-6.1/s390-uv-don-t-call-folio_wait_writeback-without-a-fo.patch @@ -0,0 +1,53 @@ +From df82c53b61cfa03c69aef7ce7d1e2f2467d783c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 20:29:46 +0200 +Subject: s390/uv: Don't call folio_wait_writeback() without a folio reference + +From: David Hildenbrand + +[ Upstream commit 3f29f6537f54d74e64bac0a390fb2e26da25800d ] + +folio_wait_writeback() requires that no spinlocks are held and that +a folio reference is held, as documented. After we dropped the PTL, the +folio could get freed concurrently. So grab a temporary reference. + +Fixes: 214d9bbcd3a6 ("s390/mm: provide memory management functions for protected KVM guests") +Reviewed-by: Claudio Imbrenda +Signed-off-by: David Hildenbrand +Link: https://lore.kernel.org/r/20240508182955.358628-2-david@redhat.com +Signed-off-by: Heiko Carstens +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/uv.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c +index 6f661add0a5d6..1ae7a04038049 100644 +--- a/arch/s390/kernel/uv.c ++++ b/arch/s390/kernel/uv.c +@@ -299,6 +299,13 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) + rc = make_folio_secure(folio, uvcb); + folio_unlock(folio); + } ++ ++ /* ++ * Once we drop the PTL, the folio may get unmapped and ++ * freed immediately. We need a temporary reference. ++ */ ++ if (rc == -EAGAIN) ++ folio_get(folio); + } + unlock: + pte_unmap_unlock(ptep, ptelock); +@@ -311,6 +318,7 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) + * completion, this is just a useless check, but it is safe. + */ + folio_wait_writeback(folio); ++ folio_put(folio); + } else if (rc == -EBUSY) { + /* + * If we have tried a local drain and the folio refcount +-- +2.43.0 + diff --git a/queue-6.1/saa7134-unchecked-i2c_transfer-function-result-fixed.patch b/queue-6.1/saa7134-unchecked-i2c_transfer-function-result-fixed.patch new file mode 100644 index 00000000000..4cdfc7280c9 --- /dev/null +++ b/queue-6.1/saa7134-unchecked-i2c_transfer-function-result-fixed.patch @@ -0,0 +1,51 @@ +From ae09265eaa2a5840b878d13d3abb30d983581083 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 15:40:06 +0300 +Subject: saa7134: Unchecked i2c_transfer function result fixed + +From: Aleksandr Burakov + +[ Upstream commit 9d8683b3fd93f0e378f24dc3d9604e5d7d3e0a17 ] + +Return value of function 'i2c_transfer' is not checked that +may cause undefined behaviour. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 2cf36ac44730 ("[PATCH] v4l: 656: added support for the following cards") +Signed-off-by: Aleksandr Burakov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-dvb.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/pci/saa7134/saa7134-dvb.c b/drivers/media/pci/saa7134/saa7134-dvb.c +index 9c6cfef03331d..a66df6adfaad8 100644 +--- a/drivers/media/pci/saa7134/saa7134-dvb.c ++++ b/drivers/media/pci/saa7134/saa7134-dvb.c +@@ -466,7 +466,9 @@ static int philips_europa_tuner_sleep(struct dvb_frontend *fe) + /* switch the board to analog mode */ + if (fe->ops.i2c_gate_ctrl) + fe->ops.i2c_gate_ctrl(fe, 1); +- i2c_transfer(&dev->i2c_adap, &analog_msg, 1); ++ if (i2c_transfer(&dev->i2c_adap, &analog_msg, 1) != 1) ++ return -EIO; ++ + return 0; + } + +@@ -1018,7 +1020,9 @@ static int md8800_set_voltage2(struct dvb_frontend *fe, + else + wbuf[1] = rbuf & 0xef; + msg[0].len = 2; +- i2c_transfer(&dev->i2c_adap, msg, 1); ++ if (i2c_transfer(&dev->i2c_adap, msg, 1) != 1) ++ return -EIO; ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.1/sbitmap-fix-io-hung-due-to-race-on-sbitmap_word-clea.patch b/queue-6.1/sbitmap-fix-io-hung-due-to-race-on-sbitmap_word-clea.patch new file mode 100644 index 00000000000..e4e413946f9 --- /dev/null +++ b/queue-6.1/sbitmap-fix-io-hung-due-to-race-on-sbitmap_word-clea.patch @@ -0,0 +1,162 @@ +From aa7e09ef9cf16e2ae3fb470979fda5b041cbb2e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jul 2024 16:26:27 +0800 +Subject: sbitmap: fix io hung due to race on sbitmap_word::cleared + +From: Yang Yang + +[ Upstream commit 72d04bdcf3f7d7e07d82f9757946f68802a7270a ] + +Configuration for sbq: + depth=64, wake_batch=6, shift=6, map_nr=1 + +1. There are 64 requests in progress: + map->word = 0xFFFFFFFFFFFFFFFF +2. After all the 64 requests complete, and no more requests come: + map->word = 0xFFFFFFFFFFFFFFFF, map->cleared = 0xFFFFFFFFFFFFFFFF +3. Now two tasks try to allocate requests: + T1: T2: + __blk_mq_get_tag . + __sbitmap_queue_get . + sbitmap_get . + sbitmap_find_bit . + sbitmap_find_bit_in_word . + __sbitmap_get_word -> nr=-1 __blk_mq_get_tag + sbitmap_deferred_clear __sbitmap_queue_get + /* map->cleared=0xFFFFFFFFFFFFFFFF */ sbitmap_find_bit + if (!READ_ONCE(map->cleared)) sbitmap_find_bit_in_word + return false; __sbitmap_get_word -> nr=-1 + mask = xchg(&map->cleared, 0) sbitmap_deferred_clear + atomic_long_andnot() /* map->cleared=0 */ + if (!(map->cleared)) + return false; + /* + * map->cleared is cleared by T1 + * T2 fail to acquire the tag + */ + +4. T2 is the sole tag waiter. When T1 puts the tag, T2 cannot be woken +up due to the wake_batch being set at 6. If no more requests come, T1 +will wait here indefinitely. + +This patch achieves two purposes: +1. Check on ->cleared and update on both ->cleared and ->word need to +be done atomically, and using spinlock could be the simplest solution. +2. Add extra check in sbitmap_deferred_clear(), to identify whether +->word has free bits. + +Fixes: ea86ea2cdced ("sbitmap: ammortize cost of clearing bits") +Signed-off-by: Yang Yang +Reviewed-by: Ming Lei +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20240716082644.659566-1-yang.yang@vivo.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/linux/sbitmap.h | 5 +++++ + lib/sbitmap.c | 36 +++++++++++++++++++++++++++++------- + 2 files changed, 34 insertions(+), 7 deletions(-) + +diff --git a/include/linux/sbitmap.h b/include/linux/sbitmap.h +index d662cf136021d..c09cdcc99471e 100644 +--- a/include/linux/sbitmap.h ++++ b/include/linux/sbitmap.h +@@ -36,6 +36,11 @@ struct sbitmap_word { + * @cleared: word holding cleared bits + */ + unsigned long cleared ____cacheline_aligned_in_smp; ++ ++ /** ++ * @swap_lock: serializes simultaneous updates of ->word and ->cleared ++ */ ++ spinlock_t swap_lock; + } ____cacheline_aligned_in_smp; + + /** +diff --git a/lib/sbitmap.c b/lib/sbitmap.c +index a727d0b12763a..61075535a8073 100644 +--- a/lib/sbitmap.c ++++ b/lib/sbitmap.c +@@ -60,12 +60,30 @@ static inline void update_alloc_hint_after_get(struct sbitmap *sb, + /* + * See if we have deferred clears that we can batch move + */ +-static inline bool sbitmap_deferred_clear(struct sbitmap_word *map) ++static inline bool sbitmap_deferred_clear(struct sbitmap_word *map, ++ unsigned int depth, unsigned int alloc_hint, bool wrap) + { +- unsigned long mask; ++ unsigned long mask, word_mask; + +- if (!READ_ONCE(map->cleared)) +- return false; ++ guard(spinlock_irqsave)(&map->swap_lock); ++ ++ if (!map->cleared) { ++ if (depth == 0) ++ return false; ++ ++ word_mask = (~0UL) >> (BITS_PER_LONG - depth); ++ /* ++ * The current behavior is to always retry after moving ++ * ->cleared to word, and we change it to retry in case ++ * of any free bits. To avoid an infinite loop, we need ++ * to take wrap & alloc_hint into account, otherwise a ++ * soft lockup may occur. ++ */ ++ if (!wrap && alloc_hint) ++ word_mask &= ~((1UL << alloc_hint) - 1); ++ ++ return (READ_ONCE(map->word) & word_mask) != word_mask; ++ } + + /* + * First get a stable cleared mask, setting the old mask to 0. +@@ -85,6 +103,7 @@ int sbitmap_init_node(struct sbitmap *sb, unsigned int depth, int shift, + bool alloc_hint) + { + unsigned int bits_per_word; ++ int i; + + if (shift < 0) + shift = sbitmap_calculate_shift(depth); +@@ -116,6 +135,9 @@ int sbitmap_init_node(struct sbitmap *sb, unsigned int depth, int shift, + return -ENOMEM; + } + ++ for (i = 0; i < sb->map_nr; i++) ++ spin_lock_init(&sb->map[i].swap_lock); ++ + return 0; + } + EXPORT_SYMBOL_GPL(sbitmap_init_node); +@@ -126,7 +148,7 @@ void sbitmap_resize(struct sbitmap *sb, unsigned int depth) + unsigned int i; + + for (i = 0; i < sb->map_nr; i++) +- sbitmap_deferred_clear(&sb->map[i]); ++ sbitmap_deferred_clear(&sb->map[i], 0, 0, 0); + + sb->depth = depth; + sb->map_nr = DIV_ROUND_UP(sb->depth, bits_per_word); +@@ -179,7 +201,7 @@ static int sbitmap_find_bit_in_word(struct sbitmap_word *map, + alloc_hint, wrap); + if (nr != -1) + break; +- if (!sbitmap_deferred_clear(map)) ++ if (!sbitmap_deferred_clear(map, depth, alloc_hint, wrap)) + break; + } while (1); + +@@ -505,7 +527,7 @@ unsigned long __sbitmap_queue_get_batch(struct sbitmap_queue *sbq, int nr_tags, + unsigned int map_depth = __map_depth(sb, index); + unsigned long val; + +- sbitmap_deferred_clear(map); ++ sbitmap_deferred_clear(map, 0, 0, 0); + val = READ_ONCE(map->word); + if (val == (1UL << (map_depth - 1)) - 1) + goto next; +-- +2.43.0 + diff --git a/queue-6.1/sbitmap-remove-unnecessary-calculation-of-alloc_hint.patch b/queue-6.1/sbitmap-remove-unnecessary-calculation-of-alloc_hint.patch new file mode 100644 index 00000000000..eb436f57a54 --- /dev/null +++ b/queue-6.1/sbitmap-remove-unnecessary-calculation-of-alloc_hint.patch @@ -0,0 +1,65 @@ +From 6538f7505eb85f6a39127f3decc66b3b072058a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 04:50:55 +0800 +Subject: sbitmap: remove unnecessary calculation of alloc_hint in + __sbitmap_get_shallow + +From: Kemeng Shi + +[ Upstream commit f1591a8bb3e02713f4ee2efe20df0d84ed80da48 ] + +Updates to alloc_hint in the loop in __sbitmap_get_shallow() are mostly +pointless and equivalent to setting alloc_hint to zero (because +SB_NR_TO_BIT() considers only low sb->shift bits from alloc_hint). So +simplify the logic. + +Reviewed-by: Jan Kara +Signed-off-by: Kemeng Shi +Link: https://lore.kernel.org/r/20230116205059.3821738-2-shikemeng@huaweicloud.com +Signed-off-by: Jens Axboe +Stable-dep-of: 72d04bdcf3f7 ("sbitmap: fix io hung due to race on sbitmap_word::cleared") +Signed-off-by: Sasha Levin +--- + lib/sbitmap.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/lib/sbitmap.c b/lib/sbitmap.c +index c515072eca296..b9dd0a0a28f89 100644 +--- a/lib/sbitmap.c ++++ b/lib/sbitmap.c +@@ -243,6 +243,7 @@ static int __sbitmap_get_shallow(struct sbitmap *sb, + int nr = -1; + + index = SB_NR_TO_INDEX(sb, alloc_hint); ++ alloc_hint = SB_NR_TO_BIT(sb, alloc_hint); + + for (i = 0; i < sb->map_nr; i++) { + again: +@@ -250,7 +251,7 @@ static int __sbitmap_get_shallow(struct sbitmap *sb, + min_t(unsigned int, + __map_depth(sb, index), + shallow_depth), +- SB_NR_TO_BIT(sb, alloc_hint), true); ++ alloc_hint, true); + if (nr != -1) { + nr += index << sb->shift; + break; +@@ -260,13 +261,9 @@ static int __sbitmap_get_shallow(struct sbitmap *sb, + goto again; + + /* Jump to next index. */ +- index++; +- alloc_hint = index << sb->shift; +- +- if (index >= sb->map_nr) { ++ alloc_hint = 0; ++ if (++index >= sb->map_nr) + index = 0; +- alloc_hint = 0; +- } + } + + return nr; +-- +2.43.0 + diff --git a/queue-6.1/sbitmap-rewrite-sbitmap_find_bit_in_index-to-reduce-.patch b/queue-6.1/sbitmap-rewrite-sbitmap_find_bit_in_index-to-reduce-.patch new file mode 100644 index 00000000000..223f074d0a9 --- /dev/null +++ b/queue-6.1/sbitmap-rewrite-sbitmap_find_bit_in_index-to-reduce-.patch @@ -0,0 +1,96 @@ +From c1a5baba184e0b87dbdf4ca2c9cbd091b9cb42db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 04:50:57 +0800 +Subject: sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code + +From: Kemeng Shi + +[ Upstream commit 08470a98a7d7e32c787b23b87353f13b03c23195 ] + +Rewrite sbitmap_find_bit_in_index as following: +1. Rename sbitmap_find_bit_in_index to sbitmap_find_bit_in_word +2. Accept "struct sbitmap_word *" directly instead of accepting +"struct sbitmap *" and "int index" to get "struct sbitmap_word *". +3. Accept depth/shallow_depth and wrap for __sbitmap_get_word from caller +to support need of both __sbitmap_get_shallow and __sbitmap_get. + +With helper function sbitmap_find_bit_in_word, we can remove repeat +code in __sbitmap_get_shallow to find bit considring deferred clear. + +Reviewed-by: Jan Kara +Signed-off-by: Kemeng Shi +Link: https://lore.kernel.org/r/20230116205059.3821738-4-shikemeng@huaweicloud.com +Signed-off-by: Jens Axboe +Stable-dep-of: 72d04bdcf3f7 ("sbitmap: fix io hung due to race on sbitmap_word::cleared") +Signed-off-by: Sasha Levin +--- + lib/sbitmap.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/lib/sbitmap.c b/lib/sbitmap.c +index b9dd0a0a28f89..b942f2ba9a415 100644 +--- a/lib/sbitmap.c ++++ b/lib/sbitmap.c +@@ -167,15 +167,16 @@ static int __sbitmap_get_word(unsigned long *word, unsigned long depth, + return nr; + } + +-static int sbitmap_find_bit_in_index(struct sbitmap *sb, int index, +- unsigned int alloc_hint) ++static int sbitmap_find_bit_in_word(struct sbitmap_word *map, ++ unsigned int depth, ++ unsigned int alloc_hint, ++ bool wrap) + { +- struct sbitmap_word *map = &sb->map[index]; + int nr; + + do { +- nr = __sbitmap_get_word(&map->word, __map_depth(sb, index), +- alloc_hint, !sb->round_robin); ++ nr = __sbitmap_get_word(&map->word, depth, ++ alloc_hint, wrap); + if (nr != -1) + break; + if (!sbitmap_deferred_clear(map)) +@@ -203,7 +204,9 @@ static int __sbitmap_get(struct sbitmap *sb, unsigned int alloc_hint) + alloc_hint = 0; + + for (i = 0; i < sb->map_nr; i++) { +- nr = sbitmap_find_bit_in_index(sb, index, alloc_hint); ++ nr = sbitmap_find_bit_in_word(&sb->map[index], ++ __map_depth(sb, index), ++ alloc_hint, !sb->round_robin); + if (nr != -1) { + nr += index << sb->shift; + break; +@@ -246,20 +249,17 @@ static int __sbitmap_get_shallow(struct sbitmap *sb, + alloc_hint = SB_NR_TO_BIT(sb, alloc_hint); + + for (i = 0; i < sb->map_nr; i++) { +-again: +- nr = __sbitmap_get_word(&sb->map[index].word, +- min_t(unsigned int, +- __map_depth(sb, index), +- shallow_depth), +- alloc_hint, true); ++ nr = sbitmap_find_bit_in_word(&sb->map[index], ++ min_t(unsigned int, ++ __map_depth(sb, index), ++ shallow_depth), ++ alloc_hint, true); ++ + if (nr != -1) { + nr += index << sb->shift; + break; + } + +- if (sbitmap_deferred_clear(&sb->map[index])) +- goto again; +- + /* Jump to next index. */ + alloc_hint = 0; + if (++index >= sb->map_nr) +-- +2.43.0 + diff --git a/queue-6.1/sbitmap-use-read_once-to-access-map-word.patch b/queue-6.1/sbitmap-use-read_once-to-access-map-word.patch new file mode 100644 index 00000000000..97a35855d73 --- /dev/null +++ b/queue-6.1/sbitmap-use-read_once-to-access-map-word.patch @@ -0,0 +1,57 @@ +From d9467d923cb0bd7b6e1e9ff47ddcb2b9947355c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 18:34:44 +0800 +Subject: sbitmap: use READ_ONCE to access map->word + +From: linke li + +[ Upstream commit 6ad0d7e0f4b68f87a98ea2b239123b7d865df86b ] + +In __sbitmap_queue_get_batch(), map->word is read several times, and +update atomically using atomic_long_try_cmpxchg(). But the first two read +of map->word is not protected. + +This patch moves the statement val = READ_ONCE(map->word) forward, +eliminating unprotected accesses to map->word within the function. +It is aimed at reducing the number of benign races reported by KCSAN in +order to focus future debugging effort on harmful races. + +Signed-off-by: linke li +Link: https://lore.kernel.org/r/tencent_0B517C25E519D3D002194E8445E86C04AD0A@qq.com +Signed-off-by: Jens Axboe +Stable-dep-of: 72d04bdcf3f7 ("sbitmap: fix io hung due to race on sbitmap_word::cleared") +Signed-off-by: Sasha Levin +--- + lib/sbitmap.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/lib/sbitmap.c b/lib/sbitmap.c +index b942f2ba9a415..a727d0b12763a 100644 +--- a/lib/sbitmap.c ++++ b/lib/sbitmap.c +@@ -503,18 +503,18 @@ unsigned long __sbitmap_queue_get_batch(struct sbitmap_queue *sbq, int nr_tags, + struct sbitmap_word *map = &sb->map[index]; + unsigned long get_mask; + unsigned int map_depth = __map_depth(sb, index); ++ unsigned long val; + + sbitmap_deferred_clear(map); +- if (map->word == (1UL << (map_depth - 1)) - 1) ++ val = READ_ONCE(map->word); ++ if (val == (1UL << (map_depth - 1)) - 1) + goto next; + +- nr = find_first_zero_bit(&map->word, map_depth); ++ nr = find_first_zero_bit(&val, map_depth); + if (nr + nr_tags <= map_depth) { + atomic_long_t *ptr = (atomic_long_t *) &map->word; +- unsigned long val; + + get_mask = ((1UL << nr_tags) - 1) << nr; +- val = READ_ONCE(map->word); + while (!atomic_long_try_cmpxchg(ptr, &val, + get_mask | val)) + ; +-- +2.43.0 + diff --git a/queue-6.1/selftests-bpf-check-length-of-recv-in-test_sockmap.patch b/queue-6.1/selftests-bpf-check-length-of-recv-in-test_sockmap.patch new file mode 100644 index 00000000000..cd0356fdb5c --- /dev/null +++ b/queue-6.1/selftests-bpf-check-length-of-recv-in-test_sockmap.patch @@ -0,0 +1,40 @@ +From 3f27ec579e017357d5011faa8f9fe619bdcf3aec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 14:50:03 +0800 +Subject: selftests/bpf: Check length of recv in test_sockmap + +From: Geliang Tang + +[ Upstream commit de1b5ea789dc28066cc8dc634b6825bd6148f38b ] + +The value of recv in msg_loop may be negative, like EWOULDBLOCK, so it's +necessary to check if it is positive before accumulating it to bytes_recvd. + +Fixes: 16962b2404ac ("bpf: sockmap, add selftests") +Signed-off-by: Geliang Tang +Signed-off-by: Daniel Borkmann +Tested-by: Jakub Sitnicki +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/5172563f7c7b2a2e953cef02e89fc34664a7b190.1716446893.git.tanggeliang@kylinos.cn +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_sockmap.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c +index 2417300abf36c..25da05cad8f61 100644 +--- a/tools/testing/selftests/bpf/test_sockmap.c ++++ b/tools/testing/selftests/bpf/test_sockmap.c +@@ -680,7 +680,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, + } + } + +- s->bytes_recvd += recv; ++ if (recv > 0) ++ s->bytes_recvd += recv; + + if (opt->check_recved_len && s->bytes_recvd > total_bytes) { + errno = EMSGSIZE; +-- +2.43.0 + diff --git a/queue-6.1/selftests-bpf-close-fd-in-error-path-in-drop_on_reus.patch b/queue-6.1/selftests-bpf-close-fd-in-error-path-in-drop_on_reus.patch new file mode 100644 index 00000000000..ce20786f2a7 --- /dev/null +++ b/queue-6.1/selftests-bpf-close-fd-in-error-path-in-drop_on_reus.patch @@ -0,0 +1,40 @@ +From 7f23c8010d38c2d8be0880501fd9eb9a15f0635e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jul 2024 17:16:19 +0800 +Subject: selftests/bpf: Close fd in error path in drop_on_reuseport + +From: Geliang Tang + +[ Upstream commit adae187ebedcd95d02f045bc37dfecfd5b29434b ] + +In the error path when update_lookup_map() fails in drop_on_reuseport in +prog_tests/sk_lookup.c, "server1", the fd of server 1, should be closed. +This patch fixes this by using "goto close_srv1" lable instead of "detach" +to close "server1" in this case. + +Fixes: 0ab5539f8584 ("selftests/bpf: Tests for BPF_SK_LOOKUP attach point") +Acked-by: Eduard Zingerman +Signed-off-by: Geliang Tang +Link: https://lore.kernel.org/r/86aed33b4b0ea3f04497c757845cff7e8e621a2d.1720515893.git.tanggeliang@kylinos.cn +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/sk_lookup.c b/tools/testing/selftests/bpf/prog_tests/sk_lookup.c +index 597d0467a9267..de2466547efe0 100644 +--- a/tools/testing/selftests/bpf/prog_tests/sk_lookup.c ++++ b/tools/testing/selftests/bpf/prog_tests/sk_lookup.c +@@ -994,7 +994,7 @@ static void drop_on_reuseport(const struct test *t) + + err = update_lookup_map(t->sock_map, SERVER_A, server1); + if (err) +- goto detach; ++ goto close_srv1; + + /* second server on destination address we should never reach */ + server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port, +-- +2.43.0 + diff --git a/queue-6.1/selftests-bpf-close-obj-in-error-path-in-xdp_adjust_.patch b/queue-6.1/selftests-bpf-close-obj-in-error-path-in-xdp_adjust_.patch new file mode 100644 index 00000000000..5f5ae3a98a4 --- /dev/null +++ b/queue-6.1/selftests-bpf-close-obj-in-error-path-in-xdp_adjust_.patch @@ -0,0 +1,38 @@ +From 4ed93e05c060610f081009584ab7696de22fd60f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:10:17 +0800 +Subject: selftests/bpf: Close obj in error path in xdp_adjust_tail + +From: Geliang Tang + +[ Upstream commit 52b49ec1b2c78deb258596c3b231201445ef5380 ] + +If bpf_object__load() fails in test_xdp_adjust_frags_tail_grow(), "obj" +opened before this should be closed. So use "goto out" to close it instead +of using "return" here. + +Fixes: 110221081aac ("bpf: selftests: update xdp_adjust_tail selftest to include xdp frags") +Signed-off-by: Geliang Tang +Link: https://lore.kernel.org/r/f282a1ed2d0e3fb38cceefec8e81cabb69cab260.1720615848.git.tanggeliang@kylinos.cn +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/xdp_adjust_tail.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_adjust_tail.c b/tools/testing/selftests/bpf/prog_tests/xdp_adjust_tail.c +index 39973ea1ce433..89366913a251c 100644 +--- a/tools/testing/selftests/bpf/prog_tests/xdp_adjust_tail.c ++++ b/tools/testing/selftests/bpf/prog_tests/xdp_adjust_tail.c +@@ -217,7 +217,7 @@ static void test_xdp_adjust_frags_tail_grow(void) + + prog = bpf_object__next_program(obj, NULL); + if (bpf_object__load(obj)) +- return; ++ goto out; + + prog_fd = bpf_program__fd(prog); + +-- +2.43.0 + diff --git a/queue-6.1/selftests-bpf-fix-prog-numbers-in-test_sockmap.patch b/queue-6.1/selftests-bpf-fix-prog-numbers-in-test_sockmap.patch new file mode 100644 index 00000000000..f3e82e2026d --- /dev/null +++ b/queue-6.1/selftests-bpf-fix-prog-numbers-in-test_sockmap.patch @@ -0,0 +1,78 @@ +From ad715e59d2c7fb6b9b2c363030441bf8b084255b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 14:21:46 +0800 +Subject: selftests/bpf: Fix prog numbers in test_sockmap + +From: Geliang Tang + +[ Upstream commit 6c8d7598dfed759bf1d9d0322b4c2b42eb7252d8 ] + +bpf_prog5 and bpf_prog7 are removed from progs/test_sockmap_kern.h in +commit d79a32129b21 ("bpf: Selftests, remove prints from sockmap tests"), +now there are only 9 progs in it, not 11: + + SEC("sk_skb1") + int bpf_prog1(struct __sk_buff *skb) + SEC("sk_skb2") + int bpf_prog2(struct __sk_buff *skb) + SEC("sk_skb3") + int bpf_prog3(struct __sk_buff *skb) + SEC("sockops") + int bpf_sockmap(struct bpf_sock_ops *skops) + SEC("sk_msg1") + int bpf_prog4(struct sk_msg_md *msg) + SEC("sk_msg2") + int bpf_prog6(struct sk_msg_md *msg) + SEC("sk_msg3") + int bpf_prog8(struct sk_msg_md *msg) + SEC("sk_msg4") + int bpf_prog9(struct sk_msg_md *msg) + SEC("sk_msg5") + int bpf_prog10(struct sk_msg_md *msg) + +This patch updates the array sizes of prog_fd[], prog_attach_type[] and +prog_type[] from 11 to 9 accordingly. + +Fixes: d79a32129b21 ("bpf: Selftests, remove prints from sockmap tests") +Signed-off-by: Geliang Tang +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/9c10d9f974f07fcb354a43a8eca67acb2fafc587.1715926605.git.tanggeliang@kylinos.cn +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_sockmap.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c +index d56f521b8aaa2..2417300abf36c 100644 +--- a/tools/testing/selftests/bpf/test_sockmap.c ++++ b/tools/testing/selftests/bpf/test_sockmap.c +@@ -63,7 +63,7 @@ int passed; + int failed; + int map_fd[9]; + struct bpf_map *maps[9]; +-int prog_fd[11]; ++int prog_fd[9]; + + int txmsg_pass; + int txmsg_redir; +@@ -1775,8 +1775,6 @@ int prog_attach_type[] = { + BPF_SK_MSG_VERDICT, + BPF_SK_MSG_VERDICT, + BPF_SK_MSG_VERDICT, +- BPF_SK_MSG_VERDICT, +- BPF_SK_MSG_VERDICT, + }; + + int prog_type[] = { +@@ -1789,8 +1787,6 @@ int prog_type[] = { + BPF_PROG_TYPE_SK_MSG, + BPF_PROG_TYPE_SK_MSG, + BPF_PROG_TYPE_SK_MSG, +- BPF_PROG_TYPE_SK_MSG, +- BPF_PROG_TYPE_SK_MSG, + }; + + static int populate_progs(char *bpf_file) +-- +2.43.0 + diff --git a/queue-6.1/selftests-forwarding-devlink_lib-wait-for-udev-event.patch b/queue-6.1/selftests-forwarding-devlink_lib-wait-for-udev-event.patch new file mode 100644 index 00000000000..96cb4466668 --- /dev/null +++ b/queue-6.1/selftests-forwarding-devlink_lib-wait-for-udev-event.patch @@ -0,0 +1,77 @@ +From 4895ae54d8fdbcaf7bb077d6a37d754a6b135342 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 17:27:02 +0200 +Subject: selftests: forwarding: devlink_lib: Wait for udev events after + reloading + +From: Amit Cohen + +[ Upstream commit f67a90a0c8f5b3d0acc18f10650d90fec44775f9 ] + +Lately, an additional locking was added by commit c0a40097f0bc +("drivers: core: synchronize really_probe() and dev_uevent()"). The +locking protects dev_uevent() calling. This function is used to send +messages from the kernel to user space. Uevent messages notify user space +about changes in device states, such as when a device is added, removed, +or changed. These messages are used by udev (or other similar user-space +tools) to apply device-specific rules. + +After reloading devlink instance, udev events should be processed. This +locking causes a short delay of udev events handling. + +One example for useful udev rule is renaming ports. 'forwading.config' +can be configured to use names after udev rules are applied. Some tests run +devlink_reload() and immediately use the updated names. This worked before +the above mentioned commit was pushed, but now the delay of uevent messages +causes that devlink_reload() returns before udev events are handled and +tests fail. + +Adjust devlink_reload() to not assume that udev events are already +processed when devlink reload is done, instead, wait for udev events to +ensure they are processed before returning from the function. + +Without this patch: +TESTS='rif_mac_profile' ./resource_scale.sh +TEST: 'rif_mac_profile' 4 [ OK ] +sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory +sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory +sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory +sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory +Cannot find device "swp1" +Cannot find device "swp2" +TEST: setup_wait_dev (: Interface swp1 does not come up.) [FAIL] + +With this patch: +$ TESTS='rif_mac_profile' ./resource_scale.sh +TEST: 'rif_mac_profile' 4 [ OK ] +TEST: 'rif_mac_profile' overflow 5 [ OK ] + +This is relevant not only for this test. + +Fixes: bc7cbb1e9f4c ("selftests: forwarding: Add devlink_lib.sh") +Signed-off-by: Amit Cohen +Reviewed-by: Ido Schimmel +Signed-off-by: Petr Machata +Link: https://patch.msgid.link/89367666e04b38a8993027f1526801ca327ab96a.1720709333.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/devlink_lib.sh | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/net/forwarding/devlink_lib.sh b/tools/testing/selftests/net/forwarding/devlink_lib.sh +index 601990c6881bf..4c555fab9e755 100644 +--- a/tools/testing/selftests/net/forwarding/devlink_lib.sh ++++ b/tools/testing/selftests/net/forwarding/devlink_lib.sh +@@ -122,6 +122,8 @@ devlink_reload() + still_pending=$(devlink resource show "$DEVLINK_DEV" | \ + grep -c "size_new") + check_err $still_pending "Failed reload - There are still unset sizes" ++ ++ udevadm settle + } + + declare -A DEVLINK_ORIG +-- +2.43.0 + diff --git a/queue-6.1/series b/queue-6.1/series new file mode 100644 index 00000000000..ad95be7a227 --- /dev/null +++ b/queue-6.1/series @@ -0,0 +1,270 @@ +spi-spi-microchip-core-fix-the-number-of-chip-select.patch +spi-atmel-quadspi-add-missing-check-for-clk_prepare.patch +edac-i10nm-make-skx_common.o-a-separate-module.patch +rcu-tasks-fix-stale-task-snaphot-for-tasks-trace.patch +md-fix-deadlock-between-mddev_suspend-and-flush-bio.patch +platform-chrome-cros_ec_debugfs-fix-wrong-ec-message.patch +ubd-refactor-the-interrupt-handler.patch +ubd-untagle-discard-vs-write-zeroes-not-support-hand.patch +block-refactor-to-use-helper.patch +block-cleanup-bio_integrity_prep.patch +block-initialize-integrity-buffer-to-zero-before-wri.patch +hfsplus-fix-to-avoid-false-alarm-of-circular-locking.patch +x86-of-return-consistent-error-type-from-x86_of_pci_.patch +x86-pci-intel_mid_pci-fix-pcibios_-return-code-handl.patch +x86-pci-xen-fix-pcibios_-return-code-handling.patch +x86-platform-iosf_mbi-convert-pcibios_-return-codes-.patch +kernfs-fix-all-kernel-doc-warnings-and-multiple-typo.patch +kernfs-convert-kernfs_path_from_node_locked-from-str.patch +cgroup-cpuset-prevent-uaf-in-proc_cpuset_show.patch +hwmon-adt7475-fix-default-duty-on-fan-is-disabled.patch +block-mq-deadline-fix-the-tag-reservation-code.patch +pwm-stm32-always-do-lazy-disabling.patch +nvmet-auth-fix-nvmet_auth-hash-error-handling.patch +drm-meson-fix-canvas-release-in-bind-function.patch +pwm-atmel-tcb-put-per-channel-data-into-driver-data.patch +pwm-atmel-tcb-unroll-atmel_tcb_pwm_set_polarity-into.patch +pwm-atmel-tcb-don-t-track-polarity-in-driver-data.patch +pwm-atmel-tcb-fix-race-condition-and-convert-to-guar.patch +hwmon-max6697-fix-underflow-when-writing-limit-attri.patch +hwmon-max6697-fix-swapped-temp-1-8-critical-alarms.patch +arm64-dts-qcom-sdm845-add-power-domain-to-ufs-phy.patch +arm64-dts-qcom-sm6350-add-power-domain-to-ufs-phy.patch +arm64-dts-qcom-sm8250-switch-ufs-qmp-phy-to-new-styl.patch +arm64-dts-qcom-sm8250-add-power-domain-to-ufs-phy.patch +arm64-dts-qcom-sm8450-add-power-domain-to-ufs-phy.patch +arm64-dts-qcom-msm8996-xiaomi-common-drop-excton-fro.patch +arm64-dts-qcom-msm8998-enable-adreno_smmu-by-default.patch +soc-qcom-rpmh-rsc-ensure-irqs-aren-t-disabled-by-rpm.patch +arm64-dts-rockchip-add-sdmmc-related-properties-on-r.patch +arm64-dts-rockchip-add-pinctrl-for-uart0-to-rk3308-r.patch +arm64-dts-rockchip-add-mdio-and-ethernet-phy-nodes-t.patch +arm64-dts-rockchip-update-wifi-bt-related-nodes-on-r.patch +arm64-dts-qcom-msm8996-specify-ufs-core_clk-frequenc.patch +soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch +cpufreq-ti-cpufreq-handle-deferred-probe-with-dev_er.patch +opp-ti-fix-ti_opp_supply_probe-wrong-return-values.patch +memory-fsl_ifc-make-fsl_ifc-config-visible-and-selec.patch +soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch +soc-qcom-pdr-fix-parsing-of-domains-lists.patch +arm64-dts-rockchip-increase-vop-clk-rate-on-rk3328.patch +arm64-dts-amlogic-sm1-fix-spdif-compatibles.patch +arm-dts-imx6qdl-kontron-samx6i-fix-phy-mode.patch +arm-dts-imx6qdl-kontron-samx6i-fix-phy-reset.patch +arm-dts-imx6qdl-kontron-samx6i-fix-board-reset.patch +arm-dts-imx6qdl-kontron-samx6i-fix-spi0-chip-selects.patch +arm-dts-imx6qdl-kontron-samx6i-fix-pcie-reset-polari.patch +arm64-dts-mediatek-mt8183-kukui-drop-bogus-output-en.patch +arm64-dts-mediatek-mt7622-fix-emmc-pinctrl-mux.patch +arm64-dts-mediatek-mt8183-kukui-jacuzzi-add-ports-no.patch +arm64-dts-amlogic-gx-correct-hdmi-clocks.patch +arm64-dts-rockchip-drop-invalid-mic-in-differential-.patch +arm64-dts-rockchip-fix-mic-in-differential-usage-on-.patch +arm64-dts-renesas-r8a779g0-add-l3-cache-controller.patch +arm64-dts-renesas-r8a779g0-add-secondary-ca76-cpu-co.patch +arm64-dts-renesas-drop-specifying-the-gic_cpu_mask_s.patch +arm64-dts-renesas-r8a779a0-add-missing-hypervisor-vi.patch +arm64-dts-renesas-r8a779f0-add-missing-hypervisor-vi.patch +arm64-dts-renesas-r8a779g0-add-missing-hypervisor-vi.patch +arm64-dts-renesas-r9a07g043u-add-missing-hypervisor-.patch +arm64-dts-renesas-r9a07g044-add-missing-hypervisor-v.patch +arm64-dts-renesas-r9a07g054-add-missing-hypervisor-v.patch +m68k-atari-fix-tt-bootup-freeze-unexpected-scu-inter.patch +x86-xen-convert-comma-to-semicolon.patch +arm64-dts-rockchip-add-missing-power-domains-for-rk3.patch +arm64-dts-qcom-sm6350-add-missing-qcom-non-secure-do.patch +cpufreq-amd-pstate-ut-convert-nominal_freq-to-khz-du.patch +m68k-cmpxchg-fix-return-value-for-default-case-in-__.patch +arm-spitz-fix-gpio-assignment-for-backlight.patch +vmlinux.lds.h-catch-.bss.l-sections-into-bss.patch +firmware-turris-mox-rwtm-do-not-complete-if-there-ar.patch +firmware-turris-mox-rwtm-fix-checking-return-value-o.patch +firmware-turris-mox-rwtm-initialize-completion-befor.patch +wifi-brcmsmac-lcn-phy-code-is-used-for-bcm4313-2g-on.patch +bpftool-un-const-bpf_func_info-to-fix-it-for-llvm-17.patch +selftests-bpf-fix-prog-numbers-in-test_sockmap.patch +net-esp-cleanup-esp_output_tail_tcp-in-case-of-unsup.patch +tcp-annotate-lockless-accesses-to-sk-sk_err_soft.patch +tcp-annotate-lockless-access-to-sk-sk_err.patch +tcp-add-tcp_done_with_error-helper.patch +tcp-fix-race-in-tcp_write_err.patch +tcp-fix-races-in-tcp_v-46-_err.patch +net-smc-set-rmb-s-sg_max_single_alloc-limitation-onl.patch +selftests-bpf-check-length-of-recv-in-test_sockmap.patch +lib-objagg-fix-general-protection-fault.patch +mlxsw-spectrum_acl_erp-fix-object-nesting-warning.patch +mlxsw-spectrum_acl-fix-acl-scale-regression-and-firm.patch +perf-x86-serialize-set_attr_rdpmc.patch +jump_label-use-atomic_try_cmpxchg-in-static_key_slow.patch +jump_label-prevent-key-enabled-int-overflow.patch +jump_label-fix-concurrency-issues-in-static_key_slow.patch +wifi-ath11k-fix-wrong-handling-of-ccmp256-and-gcmp-c.patch +wifi-cfg80211-fix-typo-in-cfg80211_calculate_bitrate.patch +wifi-cfg80211-handle-2x996-ru-allocation-in-cfg80211.patch +net-fec-refactor-define-magic-constants.patch +net-fec-fix-fec_ecr_en1588-being-cleared-on-link-dow.patch +libbpf-checking-the-btf_type-kind-when-fixing-variab.patch +ipvs-avoid-unnecessary-calls-to-skb_is_gso_sctp.patch +netfilter-nf_tables-rise-cap-on-selinux-secmark-cont.patch +bpftool-mount-bpffs-when-pinmaps-path-not-under-the-.patch +perf-x86-intel-pt-fix-pt_topa_entry_for_page-address.patch +perf-fix-perf_aux_size-for-greater-than-32-bit-size.patch +perf-prevent-passing-zero-nr_pages-to-rb_alloc_aux.patch +perf-fix-default-aux_watermark-calculation.patch +perf-x86-intel-cstate-fix-alderlake-raptorlake-meteo.patch +wifi-rtw89-fix-array-index-mistake-in-rtw89_sta_info.patch +wifi-virt_wifi-avoid-reporting-connection-success-wi.patch +gss_krb5-fix-the-error-handling-path-for-crypto_sync.patch +wifi-virt_wifi-don-t-use-strlen-in-const-context.patch +locking-rwsem-add-__always_inline-annotation-to-__do.patch +selftests-bpf-close-fd-in-error-path-in-drop_on_reus.patch +selftests-bpf-close-obj-in-error-path-in-xdp_adjust_.patch +bpf-annotate-btf-show-functions-with-__printf.patch +bna-adjust-name-buf-size-of-bna_tcb-and-bna_ccb-stru.patch +bpf-eliminate-remaining-make-w-1-warnings-in-kernel-.patch +bpf-fix-null-pointer-dereference-in-resolve_prog_typ.patch +selftests-forwarding-devlink_lib-wait-for-udev-event.patch +xdp-fix-invalid-wait-context-of-page_pool_destroy.patch +net-bridge-mst-check-vlan-state-for-egress-decision.patch +drm-rockchip-vop2-fix-the-port-mux-of-vp2.patch +drm-mipi-dsi-fix-mipi_dsi_dcs_write_seq-macro-defini.patch +drm-mipi-dsi-fix-theoretical-int-overflow-in-mipi_ds.patch +drm-amd-pm-fix-aldebaran-pcie-speed-reporting.patch +drm-amdgpu-check-if-nbio-funcs-are-null-in-amdgpu_de.patch +drm-amdgpu-remove-gc-hw-ip-9.3.0-from-noretry-1.patch +drm-panel-boe-tv101wum-nl6-if-prepare-fails-disable-.patch +drm-panel-boe-tv101wum-nl6-check-for-errors-on-the-n.patch +media-pci-ivtv-add-check-for-dma-map-result.patch +media-dvb-usb-fix-unexpected-infinite-loop-in-dvb_us.patch +media-imon-fix-race-getting-ictx-lock.patch +media-i2c-fix-imx412-exposure-control.patch +media-v4l-async-fix-null-pointer-dereference-in-addi.patch +s390-mm-convert-make_page_secure-to-use-a-folio.patch +s390-mm-convert-gmap_make_secure-to-use-a-folio.patch +s390-uv-don-t-call-folio_wait_writeback-without-a-fo.patch +saa7134-unchecked-i2c_transfer-function-result-fixed.patch +media-uvcvideo-override-default-flags.patch +media-rcar-vin-fix-yuyv8_1x16-handling-for-csi-2.patch +media-rcar-csi2-disable-runtime_pm-in-probe-error.patch +media-rcar-csi2-cleanup-subdevice-in-remove.patch +media-renesas-vsp1-fix-_irqsave-and-_irq-mix.patch +media-renesas-vsp1-store-rpf-partition-configuration.patch +drm-mediatek-add-missing-plane-settings-when-async-u.patch +drm-mediatek-add-ovl-compatible-name-for-mt8195.patch +leds-trigger-unregister-sysfs-attributes-before-call.patch +drm-msm-dsi-set-video_compression_mode_ctrl_wc.patch +drm-msm-dpu-drop-validity-checks-for-clear_pending_f.patch +perf-test-replace-arm-callgraph-fp-test-workload-wit.patch +perf-tests-arm_callgraph_fp-address-shellcheck-warni.patch +perf-tests-fix-test_arm_callgraph_fp-variable-expans.patch +perf-test-make-test_arm_callgraph_fp.sh-more-robust.patch +perf-report-fix-condition-in-sort__sym_cmp.patch +drm-etnaviv-fix-dma-direction-handling-for-cached-rw.patch +drm-qxl-add-check-for-drm_cvt_mode.patch +revert-leds-led-core-fix-refcount-leak-in-of_led_get.patch +ext4-fix-infinite-loop-when-replaying-fast_commit.patch +media-venus-flush-all-buffers-in-output-plane-stream.patch +perf-intel-pt-fix-aux_watermark-calculation-for-64-b.patch +perf-intel-pt-fix-exclude_guest-setting.patch +mfd-rsmu-split-core-code-into-separate-module.patch +mfd-omap-usb-tll-use-struct_size-to-allocate-tll.patch +xprtrdma-fix-rpcrdma_reqs_reset.patch +sunrpc-avoid-soft-lockup-when-transmitting-udp-to-re.patch +nfsv4.1-another-fix-for-exchgid4_flag_use_pnfs_ds-fo.patch +ext4-don-t-track-ranges-in-fast_commit-if-inode-has-.patch +ext4-avoid-writing-unitialized-memory-to-disk-in-ea-.patch +sparc64-fix-incorrect-function-signature-and-add-pro.patch +sunrpc-fixup-gss_status-tracepoint-error-output.patch +pci-fix-resource-double-counting-on-remove-rescan.patch +pci-keystone-relocate-ks_pcie_set-clear_dbi_mode.patch +pci-keystone-don-t-enable-bar-0-for-am654x.patch +pci-keystone-fix-null-pointer-dereference-in-case-of.patch +pci-rcar-demote-warn-to-dev_warn_ratelimited-in-rcar.patch +clk-qcom-branch-add-helper-functions-for-setting-ret.patch +clk-qcom-gcc-sc7280-update-force-mem-core-bit-for-uf.patch +clk-qcom-camcc-sc7280-add-parent-dependency-to-all-c.patch +iio-frequency-adrf6780-rm-clk-provider-include.patch +coresight-fix-ref-leak-when-of_coresight_parse_endpo.patch +rdma-mlx5-set-mkeys-for-dmabuf-at-page_size.patch +powerpc-pseries-fix-alignment-of-plpks-structures-an.patch +powerpc-pseries-move-plpks.h-to-include-directory.patch +powerpc-pseries-expose-plpks-config-values-support-a.patch +powerpc-pseries-add-helper-to-get-plpks-password-len.patch +powerpc-kexec-make-the-update_cpus_node-function-pub.patch +powerpc-kexec_file-fix-cpus-node-update-to-fdt.patch +rdma-cache-release-gid-table-even-if-leak-is-detecte.patch +clk-qcom-gpucc-sm8350-park-rcg-s-clk-source-at-xo-du.patch +interconnect-qcom-qcm2290-fix-mas_snoc_bimc-rpm-mast.patch +input-qt1050-handle-chip_id-reading-error.patch +rdma-mlx4-fix-truncated-output-warning-in-mad.c.patch +rdma-mlx4-fix-truncated-output-warning-in-alias_guid.patch +rdma-mlx5-use-sq-timestamp-as-qp-timestamp-when-roce.patch +rdma-rxe-don-t-set-bth_ack_mask-for-uc-or-ud-qps.patch +asoc-qcom-adjust-issues-in-case-of-dt-error-in-asoc_.patch +powerpc-prom-add-cpu-info-to-hardware-description-st.patch +asoc-max98088-check-for-clk_prepare_enable-error.patch +mtd-make-mtd_test.c-a-separate-module.patch +rdma-device-return-error-earlier-if-port-in-not-vali.patch +input-elan_i2c-do-not-leave-interrupt-disabled-on-su.patch +asoc-amd-adjust-error-handling-in-case-of-absent-cod.patch +pci-endpoint-clean-up-error-handling-in-vpci_scan_bu.patch +pci-endpoint-fix-error-handling-in-epf_ntb_epc_clean.patch +vhost-vsock-always-initialize-seqpacket_allow.patch +net-missing-check-virtio.patch +crypto-qat-extend-scope-of-lock-in-adf_cfg_add_key_v.patch +clk-qcom-park-shared-rcgs-upon-registration.patch +clk-en7523-fix-rate-divider-for-slic-and-spi-clocks.patch +mips-octeron-remove-source-file-executable-bit.patch +pci-qcom-ep-disable-resources-unconditionally-during.patch +pci-dwc-fix-index-0-incorrectly-being-interpreted-as.patch +powerpc-xmon-fix-disassembly-cpu-feature-checks.patch +macintosh-therm_windtunnel-fix-module-unload.patch +rdma-hns-check-atomic-wr-length.patch +rdma-hns-fix-unmatch-exception-handling-when-init-eq.patch +rdma-hns-fix-missing-pagesize-and-alignment-check-in.patch +rdma-hns-fix-shift-out-bounds-when-max_inline_data-i.patch +rdma-hns-fix-undifined-behavior-caused-by-invalid-ma.patch +rdma-hns-fix-insufficient-extend-db-for-vfs.patch +iommu-vt-d-fix-to-convert-mm-pfn-to-dma-pfn.patch +iommu-vt-d-fix-identity-map-bounds-in-si_domain_init.patch +bnxt_re-fix-imm_data-endianness.patch +netfilter-ctnetlink-use-helper-function-to-calculate.patch +netfilter-nft_set_pipapo-constify-lookup-fn-args-whe.patch +netfilter-nf_set_pipapo-fix-initial-map-fill.patch +net-flow_dissector-use-debug_net_warn_on_once.patch +ipv4-fix-incorrect-tos-in-route-get-reply.patch +ipv4-fix-incorrect-tos-in-fibmatch-route-get-reply.patch +net-dsa-mv88e6xxx-limit-chip-wide-frame-size-config-.patch +net-dsa-b53-limit-chip-wide-jumbo-frame-config-to-cp.patch +fs-ntfs3-use-align-kernel-macro.patch +fs-ntfs3-merge-synonym-compression_unit-and-ntfs_lzn.patch +fs-ntfs3-fix-transform-resident-to-nonresident-for-c.patch +fs-ntfs3-missed-ni_flag_update_parent-setting.patch +fs-ntfs3-fix-getting-file-type.patch +fs-ntfs3-add-missing-.dirty_folio-in-address_space_o.patch +pinctrl-rockchip-update-rk3308-iomux-routes.patch +pinctrl-core-fix-possible-memory-leak-when-pinctrl_e.patch +pinctrl-single-fix-possible-memory-leak-when-pinctrl.patch +pinctrl-ti-ti-iodelay-drop-if-block-with-always-fals.patch +pinctrl-ti-ti-iodelay-fix-possible-memory-leak-when-.patch +pinctrl-freescale-mxs-fix-refcount-of-child.patch +fs-ntfs3-replace-inode_trylock-with-inode_lock.patch +fs-ntfs3-fix-field-spanning-write-in-index_hdr.patch +pinctrl-renesas-r8a779g0-fix-canfd5-suffix.patch +pinctrl-renesas-r8a779g0-fix-fxr_txen-ab-suffixes.patch +pinctrl-renesas-r8a779g0-fix-h-scif1-suffixes.patch +pinctrl-renesas-r8a779g0-fix-h-scif3-suffixes.patch +pinctrl-renesas-r8a779g0-fix-irq-suffixes.patch +pinctrl-renesas-r8a779g0-fix-pwm-suffixes.patch +pinctrl-renesas-r8a779g0-fix-tclk-suffixes.patch +pinctrl-renesas-r8a779g0-fix-tpu-suffixes.patch +fs-proc-task_mmu-indicate-pm_file-for-pmd-mapped-fil.patch +nilfs2-avoid-undefined-behavior-in-nilfs_cnt32_ge-ma.patch +rtc-interface-add-rtc-offset-to-alarm-after-fix-up.patch +fs-ntfs3-missed-error-return.patch +fs-ntfs3-keep-runs-for-mft-attr_data-and-mft-attr_bi.patch +s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch +sbitmap-remove-unnecessary-calculation-of-alloc_hint.patch +sbitmap-rewrite-sbitmap_find_bit_in_index-to-reduce-.patch +sbitmap-use-read_once-to-access-map-word.patch +sbitmap-fix-io-hung-due-to-race-on-sbitmap_word-clea.patch diff --git a/queue-6.1/soc-qcom-pdr-fix-parsing-of-domains-lists.patch b/queue-6.1/soc-qcom-pdr-fix-parsing-of-domains-lists.patch new file mode 100644 index 00000000000..5c24e1300d1 --- /dev/null +++ b/queue-6.1/soc-qcom-pdr-fix-parsing-of-domains-lists.patch @@ -0,0 +1,43 @@ +From 5cc05da269a3627dcbed578687a5a159ba547b6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jun 2024 01:03:41 +0300 +Subject: soc: qcom: pdr: fix parsing of domains lists + +From: Dmitry Baryshkov + +[ Upstream commit 57f20d51f35780f240ecf39d81cda23612800a92 ] + +While parsing the domains list, start offsets from 0 rather than from +domains_read. The domains_read is equal to the total count of the +domains we have seen, while the domains list in the message starts from +offset 0. + +Fixes: fbe639b44a82 ("soc: qcom: Introduce Protection Domain Restart helpers") +Tested-by: Steev Klimaszewski +Tested-by: Alexey Minnekhanov +Reviewed-by: Chris Lew +Tested-by: Neil Armstrong # on SM8550-QRD +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240622-qcom-pd-mapper-v9-2-a84ee3591c8e@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/pdr_interface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/pdr_interface.c b/drivers/soc/qcom/pdr_interface.c +index fbf91d7904482..c7cd4daa10b0f 100644 +--- a/drivers/soc/qcom/pdr_interface.c ++++ b/drivers/soc/qcom/pdr_interface.c +@@ -417,7 +417,7 @@ static int pdr_locate_service(struct pdr_handle *pdr, struct pdr_service *pds) + if (ret < 0) + goto out; + +- for (i = domains_read; i < resp->domain_list_len; i++) { ++ for (i = 0; i < resp->domain_list_len; i++) { + entry = &resp->domain_list[i]; + + if (strnlen(entry->name, sizeof(entry->name)) == sizeof(entry->name)) +-- +2.43.0 + diff --git a/queue-6.1/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch b/queue-6.1/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch new file mode 100644 index 00000000000..1509fd8b33b --- /dev/null +++ b/queue-6.1/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch @@ -0,0 +1,73 @@ +From f916364fe8bc722a57e26b11b3a4de0f14fffe40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jun 2024 01:03:40 +0300 +Subject: soc: qcom: pdr: protect locator_addr with the main mutex + +From: Dmitry Baryshkov + +[ Upstream commit 107924c14e3ddd85119ca43c26a4ee1056fa9b84 ] + +If the service locator server is restarted fast enough, the PDR can +rewrite locator_addr fields concurrently. Protect them by placing +modification of those fields under the main pdr->lock. + +Fixes: fbe639b44a82 ("soc: qcom: Introduce Protection Domain Restart helpers") +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Steev Klimaszewski +Tested-by: Alexey Minnekhanov +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240622-qcom-pd-mapper-v9-1-a84ee3591c8e@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/pdr_interface.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/qcom/pdr_interface.c b/drivers/soc/qcom/pdr_interface.c +index 0034af927b488..fbf91d7904482 100644 +--- a/drivers/soc/qcom/pdr_interface.c ++++ b/drivers/soc/qcom/pdr_interface.c +@@ -76,12 +76,12 @@ static int pdr_locator_new_server(struct qmi_handle *qmi, + locator_hdl); + struct pdr_service *pds; + ++ mutex_lock(&pdr->lock); + /* Create a local client port for QMI communication */ + pdr->locator_addr.sq_family = AF_QIPCRTR; + pdr->locator_addr.sq_node = svc->node; + pdr->locator_addr.sq_port = svc->port; + +- mutex_lock(&pdr->lock); + pdr->locator_init_complete = true; + mutex_unlock(&pdr->lock); + +@@ -104,10 +104,10 @@ static void pdr_locator_del_server(struct qmi_handle *qmi, + + mutex_lock(&pdr->lock); + pdr->locator_init_complete = false; +- mutex_unlock(&pdr->lock); + + pdr->locator_addr.sq_node = 0; + pdr->locator_addr.sq_port = 0; ++ mutex_unlock(&pdr->lock); + } + + static const struct qmi_ops pdr_locator_ops = { +@@ -365,12 +365,14 @@ static int pdr_get_domain_list(struct servreg_get_domain_list_req *req, + if (ret < 0) + return ret; + ++ mutex_lock(&pdr->lock); + ret = qmi_send_request(&pdr->locator_hdl, + &pdr->locator_addr, + &txn, SERVREG_GET_DOMAIN_LIST_REQ, + SERVREG_GET_DOMAIN_LIST_REQ_MAX_LEN, + servreg_get_domain_list_req_ei, + req); ++ mutex_unlock(&pdr->lock); + if (ret < 0) { + qmi_txn_cancel(&txn); + return ret; +-- +2.43.0 + diff --git a/queue-6.1/soc-qcom-rpmh-rsc-ensure-irqs-aren-t-disabled-by-rpm.patch b/queue-6.1/soc-qcom-rpmh-rsc-ensure-irqs-aren-t-disabled-by-rpm.patch new file mode 100644 index 00000000000..b4bb058e6a3 --- /dev/null +++ b/queue-6.1/soc-qcom-rpmh-rsc-ensure-irqs-aren-t-disabled-by-rpm.patch @@ -0,0 +1,84 @@ +From 5e4031c986183ec12f51d4b53480152b9f5f3853 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 11:41:28 -0700 +Subject: soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by + rpmh_rsc_send_data() callers + +From: Stephen Boyd + +[ Upstream commit e43111f52b9ec5c2d700f89a1d61c8d10dc2d9e9 ] + +Dan pointed out that Smatch is concerned about this code because it uses +spin_lock_irqsave() and then calls wait_event_lock_irq() which enables +irqs before going to sleep. The comment above the function says it +should be called with interrupts enabled, but we simply hope that's true +without really confirming that. Let's add a might_sleep() here to +confirm that interrupts and preemption aren't disabled. Once we do that, +we can change the lock to be non-saving, spin_lock_irq(), to clarify +that we don't expect irqs to be disabled. If irqs are disabled by +callers they're going to be enabled anyway in the wait_event_lock_irq() +call which would be bad. + +This should make Smatch happier and find bad callers faster with the +might_sleep(). We can drop the WARN_ON() in the caller because we have +the might_sleep() now, simplifying the code. + +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/911181ed-c430-4592-ad26-4dc948834e08@moroto.mountain +Fixes: 2bc20f3c8487 ("soc: qcom: rpmh-rsc: Sleep waiting for tcs slots to be free") +Cc: Douglas Anderson +Signed-off-by: Stephen Boyd +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20240509184129.3924422-1-swboyd@chromium.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rpmh-rsc.c | 7 ++++--- + drivers/soc/qcom/rpmh.c | 1 - + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index 5e7bb6338707d..ff2b9eb9f669f 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -608,13 +608,14 @@ int rpmh_rsc_send_data(struct rsc_drv *drv, const struct tcs_request *msg) + { + struct tcs_group *tcs; + int tcs_id; +- unsigned long flags; ++ ++ might_sleep(); + + tcs = get_tcs_for_msg(drv, msg); + if (IS_ERR(tcs)) + return PTR_ERR(tcs); + +- spin_lock_irqsave(&drv->lock, flags); ++ spin_lock_irq(&drv->lock); + + /* Wait forever for a free tcs. It better be there eventually! */ + wait_event_lock_irq(drv->tcs_wait, +@@ -632,7 +633,7 @@ int rpmh_rsc_send_data(struct rsc_drv *drv, const struct tcs_request *msg) + write_tcs_reg_sync(drv, RSC_DRV_CMD_ENABLE, tcs_id, 0); + enable_tcs_irq(drv, tcs_id, true); + } +- spin_unlock_irqrestore(&drv->lock, flags); ++ spin_unlock_irq(&drv->lock); + + /* + * These two can be done after the lock is released because: +diff --git a/drivers/soc/qcom/rpmh.c b/drivers/soc/qcom/rpmh.c +index 01765ee9cdfb8..c6df7ac0afebc 100644 +--- a/drivers/soc/qcom/rpmh.c ++++ b/drivers/soc/qcom/rpmh.c +@@ -189,7 +189,6 @@ static int __rpmh_write(const struct device *dev, enum rpmh_state state, + } + + if (state == RPMH_ACTIVE_ONLY_STATE) { +- WARN_ON(irqs_disabled()); + ret = rpmh_rsc_send_data(ctrlr_to_drv(ctrlr), &rpm_msg->msg); + } else { + /* Clean up our call by spoofing tx_done */ +-- +2.43.0 + diff --git a/queue-6.1/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch b/queue-6.1/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch new file mode 100644 index 00000000000..e891f3b58fc --- /dev/null +++ b/queue-6.1/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch @@ -0,0 +1,105 @@ +From 06a61141ff646fa77e31777272ed94c9ff5fd20b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 04:06:10 -0700 +Subject: soc: xilinx: rename cpu_number1 to dummy_cpu_number + +From: Jay Buddhabhatti + +[ Upstream commit 4a95449dd975e2ea6629a034f3e74b46c9634916 ] + +The per cpu variable cpu_number1 is passed to xlnx_event_handler as +argument "dev_id", but it is not used in this function. So drop the +initialization of this variable and rename it to dummy_cpu_number. +This patch is to fix the following call trace when the kernel option +CONFIG_DEBUG_ATOMIC_SLEEP is enabled: + +BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 + in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0 + preempt_count: 1, expected: 0 + CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0 #53 + Hardware name: Xilinx Versal vmk180 Eval board rev1.1 (QSPI) (DT) + Call trace: + dump_backtrace+0xd0/0xe0 + show_stack+0x18/0x40 + dump_stack_lvl+0x7c/0xa0 + dump_stack+0x18/0x34 + __might_resched+0x10c/0x140 + __might_sleep+0x4c/0xa0 + __kmem_cache_alloc_node+0xf4/0x168 + kmalloc_trace+0x28/0x38 + __request_percpu_irq+0x74/0x138 + xlnx_event_manager_probe+0xf8/0x298 + platform_probe+0x68/0xd8 + +Fixes: daed80ed0758 ("soc: xilinx: Fix for call trace due to the usage of smp_processor_id()") +Signed-off-by: Jay Buddhabhatti +Link: https://lore.kernel.org/r/20240408110610.15676-1-jay.buddhabhatti@amd.com +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +--- + drivers/soc/xilinx/xlnx_event_manager.c | 15 ++++----------- + 1 file changed, 4 insertions(+), 11 deletions(-) + +diff --git a/drivers/soc/xilinx/xlnx_event_manager.c b/drivers/soc/xilinx/xlnx_event_manager.c +index 8293cc40047fa..82e3174740238 100644 +--- a/drivers/soc/xilinx/xlnx_event_manager.c ++++ b/drivers/soc/xilinx/xlnx_event_manager.c +@@ -3,6 +3,7 @@ + * Xilinx Event Management Driver + * + * Copyright (C) 2021 Xilinx, Inc. ++ * Copyright (C) 2024 Advanced Micro Devices, Inc. + * + * Abhyuday Godhasara + */ +@@ -19,7 +20,7 @@ + #include + #include + +-static DEFINE_PER_CPU_READ_MOSTLY(int, cpu_number1); ++static DEFINE_PER_CPU_READ_MOSTLY(int, dummy_cpu_number); + + static int virq_sgi; + static int event_manager_availability = -EACCES; +@@ -555,7 +556,6 @@ static void xlnx_disable_percpu_irq(void *data) + static int xlnx_event_init_sgi(struct platform_device *pdev) + { + int ret = 0; +- int cpu; + /* + * IRQ related structures are used for the following: + * for each SGI interrupt ensure its mapped by GIC IRQ domain +@@ -592,11 +592,8 @@ static int xlnx_event_init_sgi(struct platform_device *pdev) + sgi_fwspec.param[0] = sgi_num; + virq_sgi = irq_create_fwspec_mapping(&sgi_fwspec); + +- cpu = get_cpu(); +- per_cpu(cpu_number1, cpu) = cpu; + ret = request_percpu_irq(virq_sgi, xlnx_event_handler, "xlnx_event_mgmt", +- &cpu_number1); +- put_cpu(); ++ &dummy_cpu_number); + + WARN_ON(ret); + if (ret) { +@@ -612,16 +609,12 @@ static int xlnx_event_init_sgi(struct platform_device *pdev) + + static void xlnx_event_cleanup_sgi(struct platform_device *pdev) + { +- int cpu = smp_processor_id(); +- +- per_cpu(cpu_number1, cpu) = cpu; +- + cpuhp_remove_state(CPUHP_AP_ONLINE_DYN); + + on_each_cpu(xlnx_disable_percpu_irq, NULL, 1); + + irq_clear_status_flags(virq_sgi, IRQ_PER_CPU); +- free_percpu_irq(virq_sgi, &cpu_number1); ++ free_percpu_irq(virq_sgi, &dummy_cpu_number); + irq_dispose_mapping(virq_sgi); + } + +-- +2.43.0 + diff --git a/queue-6.1/sparc64-fix-incorrect-function-signature-and-add-pro.patch b/queue-6.1/sparc64-fix-incorrect-function-signature-and-add-pro.patch new file mode 100644 index 00000000000..b2e8e78a477 --- /dev/null +++ b/queue-6.1/sparc64-fix-incorrect-function-signature-and-add-pro.patch @@ -0,0 +1,75 @@ +From fb670cb6a9e3bf8abc446cff5953a175daf23d1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 11:41:53 +0200 +Subject: sparc64: Fix incorrect function signature and add prototype for + prom_cif_init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andreas Larsson + +[ Upstream commit a6c3ea1ec96307dbfbb2f16d96c674c5cc80f445 ] + +Remove the unused cif_stack argument and add a protype in oplib_64.h +Commit ef3e035c3a9b ("sparc64: Fix register corruption in top-most +kernel stack frame during boot.") removed the cif_stack argument to +prom_cif init in the declaration at the caller site and the usage of it +within prom_cif_init, but not in the function signature of the function +itself. + +This also fixes the following warning: +arch/sparc/prom/p1275.c:52:6: warning: no previous prototype for ‘prom_cif_init’ + +Fixes: ef3e035c3a9b ("sparc64: Fix register corruption in top-most kernel stack frame during boot.") +Link: https://lore.kernel.org/r/20240710094155.458731-3-andreas@gaisler.com +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/include/asm/oplib_64.h | 1 + + arch/sparc/prom/init_64.c | 3 --- + arch/sparc/prom/p1275.c | 2 +- + 3 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/sparc/include/asm/oplib_64.h b/arch/sparc/include/asm/oplib_64.h +index a67abebd43592..1b86d02a84556 100644 +--- a/arch/sparc/include/asm/oplib_64.h ++++ b/arch/sparc/include/asm/oplib_64.h +@@ -247,6 +247,7 @@ void prom_sun4v_guest_soft_state(void); + int prom_ihandle2path(int handle, char *buffer, int bufsize); + + /* Client interface level routines. */ ++void prom_cif_init(void *cif_handler); + void p1275_cmd_direct(unsigned long *); + + #endif /* !(__SPARC64_OPLIB_H) */ +diff --git a/arch/sparc/prom/init_64.c b/arch/sparc/prom/init_64.c +index 103aa91043185..f7b8a1a865b8f 100644 +--- a/arch/sparc/prom/init_64.c ++++ b/arch/sparc/prom/init_64.c +@@ -26,9 +26,6 @@ phandle prom_chosen_node; + * routines in the prom library. + * It gets passed the pointer to the PROM vector. + */ +- +-extern void prom_cif_init(void *); +- + void __init prom_init(void *cif_handler) + { + phandle node; +diff --git a/arch/sparc/prom/p1275.c b/arch/sparc/prom/p1275.c +index 889aa602f8d86..51c3f984bbf72 100644 +--- a/arch/sparc/prom/p1275.c ++++ b/arch/sparc/prom/p1275.c +@@ -49,7 +49,7 @@ void p1275_cmd_direct(unsigned long *args) + local_irq_restore(flags); + } + +-void prom_cif_init(void *cif_handler, void *cif_stack) ++void prom_cif_init(void *cif_handler) + { + p1275buf.prom_cif_handler = (void (*)(long *))cif_handler; + } +-- +2.43.0 + diff --git a/queue-6.1/spi-atmel-quadspi-add-missing-check-for-clk_prepare.patch b/queue-6.1/spi-atmel-quadspi-add-missing-check-for-clk_prepare.patch new file mode 100644 index 00000000000..af04a13a648 --- /dev/null +++ b/queue-6.1/spi-atmel-quadspi-add-missing-check-for-clk_prepare.patch @@ -0,0 +1,46 @@ +From 0ad564465569a5ae7b91e19ff0397c9a2aff6c65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 16:40:28 +0800 +Subject: spi: atmel-quadspi: Add missing check for clk_prepare + +From: Chen Ni + +[ Upstream commit ef901b38d3a4610c4067cd306c1a209f32e7ca31 ] + +Add check for the return value of clk_prepare() and return the error if +it fails in order to catch the error. + +Fixes: 4a2f83b7f780 ("spi: atmel-quadspi: add runtime pm support") +Signed-off-by: Chen Ni +Link: https://msgid.link/r/20240515084028.3210406-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/atmel-quadspi.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/atmel-quadspi.c b/drivers/spi/atmel-quadspi.c +index 7e05b48dbd71c..1f1aee28b1f79 100644 +--- a/drivers/spi/atmel-quadspi.c ++++ b/drivers/spi/atmel-quadspi.c +@@ -724,8 +724,15 @@ static int __maybe_unused atmel_qspi_resume(struct device *dev) + struct atmel_qspi *aq = spi_controller_get_devdata(ctrl); + int ret; + +- clk_prepare(aq->pclk); +- clk_prepare(aq->qspick); ++ ret = clk_prepare(aq->pclk); ++ if (ret) ++ return ret; ++ ++ ret = clk_prepare(aq->qspick); ++ if (ret) { ++ clk_unprepare(aq->pclk); ++ return ret; ++ } + + ret = pm_runtime_force_resume(dev); + if (ret < 0) +-- +2.43.0 + diff --git a/queue-6.1/spi-spi-microchip-core-fix-the-number-of-chip-select.patch b/queue-6.1/spi-spi-microchip-core-fix-the-number-of-chip-select.patch new file mode 100644 index 00000000000..f080c09342a --- /dev/null +++ b/queue-6.1/spi-spi-microchip-core-fix-the-number-of-chip-select.patch @@ -0,0 +1,42 @@ +From 85f9d0564a12042b1ea10c4b9ae7a8e6c9bc3ec9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 11:45:07 +0100 +Subject: spi: spi-microchip-core: Fix the number of chip selects supported + +From: Prajna Rajendra Kumar + +[ Upstream commit a7ed3a11202d90939a3d00ffcc8cf50703cb7b35 ] + +The SPI "hard" controller in PolarFire SoC has eight CS lines, but only +one CS line is wired. When the 'num-cs' property is not specified in +the device tree, the driver defaults to the MAX_CS value, which has +been fixed to 1 to match the hardware configuration; however, when the +'num-cs' property is explicitly defined in the device tree, it +overrides the default value. + +Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers") +Signed-off-by: Prajna Rajendra Kumar +Reviewed-by: Conor Dooley +Link: https://msgid.link/r/20240514104508.938448-3-prajna.rajendrakumar@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-microchip-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-microchip-core.c b/drivers/spi/spi-microchip-core.c +index d352844c798c9..d4c08d3668741 100644 +--- a/drivers/spi/spi-microchip-core.c ++++ b/drivers/spi/spi-microchip-core.c +@@ -21,7 +21,7 @@ + #include + + #define MAX_LEN (0xffff) +-#define MAX_CS (8) ++#define MAX_CS (1) + #define DEFAULT_FRAMESIZE (8) + #define FIFO_DEPTH (32) + #define CLK_GEN_MODE1_MAX (255) +-- +2.43.0 + diff --git a/queue-6.1/sunrpc-avoid-soft-lockup-when-transmitting-udp-to-re.patch b/queue-6.1/sunrpc-avoid-soft-lockup-when-transmitting-udp-to-re.patch new file mode 100644 index 00000000000..b0ac1abf894 --- /dev/null +++ b/queue-6.1/sunrpc-avoid-soft-lockup-when-transmitting-udp-to-re.patch @@ -0,0 +1,57 @@ +From 2e2aa22e94a886e3da083db65586fb1e3450d4f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 11:05:13 +1000 +Subject: SUNRPC: avoid soft lockup when transmitting UDP to reachable server. + +From: NeilBrown + +[ Upstream commit 6258cf25d5e3155c3219ab5a79b970eef7996356 ] + +Prior to the commit identified below, call_transmit_status() would +handle -EPERM and other errors related to an unreachable server by +falling through to call_status() which added a 3-second delay and +handled the failure as a timeout. + +Since that commit, call_transmit_status() falls through to +handle_bind(). For UDP this moves straight on to handle_connect() and +handle_transmit() so we immediately retransmit - and likely get the same +error. + +This results in an indefinite loop in __rpc_execute() which triggers a +soft-lockup warning. + +For the errors that indicate an unreachable server, +call_transmit_status() should fall back to call_status() as it did +before. This cannot cause the thundering herd that the previous patch +was avoiding, as the call_status() will insert a delay. + +Fixes: ed7dc973bd91 ("SUNRPC: Prevent thundering herd when the socket is not connected") +Signed-off-by: NeilBrown +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/clnt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index 1dbad41c46145..b6529a9d37d37 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -2296,12 +2296,13 @@ call_transmit_status(struct rpc_task *task) + task->tk_action = call_transmit; + task->tk_status = 0; + break; +- case -ECONNREFUSED: + case -EHOSTDOWN: + case -ENETDOWN: + case -EHOSTUNREACH: + case -ENETUNREACH: + case -EPERM: ++ break; ++ case -ECONNREFUSED: + if (RPC_IS_SOFTCONN(task)) { + if (!task->tk_msg.rpc_proc->p_proc) + trace_xprt_ping(task->tk_xprt, +-- +2.43.0 + diff --git a/queue-6.1/sunrpc-fixup-gss_status-tracepoint-error-output.patch b/queue-6.1/sunrpc-fixup-gss_status-tracepoint-error-output.patch new file mode 100644 index 00000000000..137aa302354 --- /dev/null +++ b/queue-6.1/sunrpc-fixup-gss_status-tracepoint-error-output.patch @@ -0,0 +1,36 @@ +From 6a24fbb9edc66b9c637bd32e6cb61e66b6c3ff3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 13:21:00 -0400 +Subject: SUNRPC: Fixup gss_status tracepoint error output + +From: Benjamin Coddington + +[ Upstream commit b9fae9f06d84ffab0f3f9118f3a96bbcdc528bf6 ] + +The GSS routine errors are values, not flags. + +Fixes: 0c77668ddb4e ("SUNRPC: Introduce trace points in rpc_auth_gss.ko") +Signed-off-by: Benjamin Coddington +Reviewed-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + include/trace/events/rpcgss.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/trace/events/rpcgss.h b/include/trace/events/rpcgss.h +index 894d9fc8bd94a..e228a44af2915 100644 +--- a/include/trace/events/rpcgss.h ++++ b/include/trace/events/rpcgss.h +@@ -54,7 +54,7 @@ TRACE_DEFINE_ENUM(GSS_S_UNSEQ_TOKEN); + TRACE_DEFINE_ENUM(GSS_S_GAP_TOKEN); + + #define show_gss_status(x) \ +- __print_flags(x, "|", \ ++ __print_symbolic(x, \ + { GSS_S_BAD_MECH, "GSS_S_BAD_MECH" }, \ + { GSS_S_BAD_NAME, "GSS_S_BAD_NAME" }, \ + { GSS_S_BAD_NAMETYPE, "GSS_S_BAD_NAMETYPE" }, \ +-- +2.43.0 + diff --git a/queue-6.1/tcp-add-tcp_done_with_error-helper.patch b/queue-6.1/tcp-add-tcp_done_with_error-helper.patch new file mode 100644 index 00000000000..453306cb963 --- /dev/null +++ b/queue-6.1/tcp-add-tcp_done_with_error-helper.patch @@ -0,0 +1,115 @@ +From bf5f734e4dcad4318d47637c0438b03eed44ed4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 12:52:50 +0000 +Subject: tcp: add tcp_done_with_error() helper + +From: Eric Dumazet + +[ Upstream commit 5e514f1cba090e1c8fff03e92a175eccfe46305f ] + +tcp_reset() ends with a sequence that is carefuly ordered. + +We need to fix [e]poll bugs in the following patches, +it makes sense to use a common helper. + +Suggested-by: Neal Cardwell +Signed-off-by: Eric Dumazet +Acked-by: Neal Cardwell +Link: https://lore.kernel.org/r/20240528125253.1966136-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 853c3bd7b791 ("tcp: fix race in tcp_write_err()") +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 1 + + net/ipv4/tcp.c | 2 +- + net/ipv4/tcp_input.c | 32 +++++++++++++++++++++----------- + 3 files changed, 23 insertions(+), 12 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 8ea1fba84eff9..cc314c383c532 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -633,6 +633,7 @@ void tcp_skb_collapse_tstamp(struct sk_buff *skb, + /* tcp_input.c */ + void tcp_rearm_rto(struct sock *sk); + void tcp_synack_rtt_meas(struct sock *sk, struct request_sock *req); ++void tcp_done_with_error(struct sock *sk, int err); + void tcp_reset(struct sock *sk, struct sk_buff *skb); + void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp, struct sk_buff *skb); + void tcp_fin(struct sock *sk); +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 7e162a34baec2..cb79919323a62 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -589,7 +589,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait) + */ + mask |= EPOLLOUT | EPOLLWRNORM; + } +- /* This barrier is coupled with smp_wmb() in tcp_reset() */ ++ /* This barrier is coupled with smp_wmb() in tcp_done_with_error() */ + smp_rmb(); + if (READ_ONCE(sk->sk_err) || + !skb_queue_empty_lockless(&sk->sk_error_queue)) +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index d72255e5262b3..b1b4f44d21370 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -4356,9 +4356,26 @@ static inline bool tcp_sequence(const struct tcp_sock *tp, u32 seq, u32 end_seq) + !after(seq, tp->rcv_nxt + tcp_receive_window(tp)); + } + ++ ++void tcp_done_with_error(struct sock *sk, int err) ++{ ++ /* This barrier is coupled with smp_rmb() in tcp_poll() */ ++ WRITE_ONCE(sk->sk_err, err); ++ smp_wmb(); ++ ++ tcp_write_queue_purge(sk); ++ tcp_done(sk); ++ ++ if (!sock_flag(sk, SOCK_DEAD)) ++ sk_error_report(sk); ++} ++EXPORT_SYMBOL(tcp_done_with_error); ++ + /* When we get a reset we do this. */ + void tcp_reset(struct sock *sk, struct sk_buff *skb) + { ++ int err; ++ + trace_tcp_receive_reset(sk); + + /* mptcp can't tell us to ignore reset pkts, +@@ -4370,24 +4387,17 @@ void tcp_reset(struct sock *sk, struct sk_buff *skb) + /* We want the right error as BSD sees it (and indeed as we do). */ + switch (sk->sk_state) { + case TCP_SYN_SENT: +- WRITE_ONCE(sk->sk_err, ECONNREFUSED); ++ err = ECONNREFUSED; + break; + case TCP_CLOSE_WAIT: +- WRITE_ONCE(sk->sk_err, EPIPE); ++ err = EPIPE; + break; + case TCP_CLOSE: + return; + default: +- WRITE_ONCE(sk->sk_err, ECONNRESET); ++ err = ECONNRESET; + } +- /* This barrier is coupled with smp_rmb() in tcp_poll() */ +- smp_wmb(); +- +- tcp_write_queue_purge(sk); +- tcp_done(sk); +- +- if (!sock_flag(sk, SOCK_DEAD)) +- sk_error_report(sk); ++ tcp_done_with_error(sk, err); + } + + /* +-- +2.43.0 + diff --git a/queue-6.1/tcp-annotate-lockless-access-to-sk-sk_err.patch b/queue-6.1/tcp-annotate-lockless-access-to-sk-sk_err.patch new file mode 100644 index 00000000000..35e62642651 --- /dev/null +++ b/queue-6.1/tcp-annotate-lockless-access-to-sk-sk_err.patch @@ -0,0 +1,167 @@ +From 465413ac31f0593d6aeeb26a69d666e824901ce5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 20:57:44 +0000 +Subject: tcp: annotate lockless access to sk->sk_err + +From: Eric Dumazet + +[ Upstream commit e13ec3da05d130f0d10da8e1fbe1be26dcdb0e27 ] + +tcp_poll() reads sk->sk_err without socket lock held/owned. + +We should used READ_ONCE() here, and update writers +to use WRITE_ONCE(). + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Stable-dep-of: 853c3bd7b791 ("tcp: fix race in tcp_write_err()") +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 11 ++++++----- + net/ipv4/tcp_input.c | 6 +++--- + net/ipv4/tcp_ipv4.c | 4 ++-- + net/ipv4/tcp_output.c | 2 +- + net/ipv4/tcp_timer.c | 2 +- + net/ipv6/tcp_ipv6.c | 4 ++-- + 6 files changed, 15 insertions(+), 14 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 2d4f697d338f5..7e162a34baec2 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -591,7 +591,8 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait) + } + /* This barrier is coupled with smp_wmb() in tcp_reset() */ + smp_rmb(); +- if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue)) ++ if (READ_ONCE(sk->sk_err) || ++ !skb_queue_empty_lockless(&sk->sk_error_queue)) + mask |= EPOLLERR; + + return mask; +@@ -3119,7 +3120,7 @@ int tcp_disconnect(struct sock *sk, int flags) + if (old_state == TCP_LISTEN) { + inet_csk_listen_stop(sk); + } else if (unlikely(tp->repair)) { +- sk->sk_err = ECONNABORTED; ++ WRITE_ONCE(sk->sk_err, ECONNABORTED); + } else if (tcp_need_reset(old_state) || + (tp->snd_nxt != tp->write_seq && + (1 << old_state) & (TCPF_CLOSING | TCPF_LAST_ACK))) { +@@ -3127,9 +3128,9 @@ int tcp_disconnect(struct sock *sk, int flags) + * states + */ + tcp_send_active_reset(sk, gfp_any()); +- sk->sk_err = ECONNRESET; ++ WRITE_ONCE(sk->sk_err, ECONNRESET); + } else if (old_state == TCP_SYN_SENT) +- sk->sk_err = ECONNRESET; ++ WRITE_ONCE(sk->sk_err, ECONNRESET); + + tcp_clear_xmit_timers(sk); + __skb_queue_purge(&sk->sk_receive_queue); +@@ -4735,7 +4736,7 @@ int tcp_abort(struct sock *sk, int err) + bh_lock_sock(sk); + + if (!sock_flag(sk, SOCK_DEAD)) { +- sk->sk_err = err; ++ WRITE_ONCE(sk->sk_err, err); + /* This barrier is coupled with smp_rmb() in tcp_poll() */ + smp_wmb(); + sk_error_report(sk); +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index fa15c6951cd78..d72255e5262b3 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -4370,15 +4370,15 @@ void tcp_reset(struct sock *sk, struct sk_buff *skb) + /* We want the right error as BSD sees it (and indeed as we do). */ + switch (sk->sk_state) { + case TCP_SYN_SENT: +- sk->sk_err = ECONNREFUSED; ++ WRITE_ONCE(sk->sk_err, ECONNREFUSED); + break; + case TCP_CLOSE_WAIT: +- sk->sk_err = EPIPE; ++ WRITE_ONCE(sk->sk_err, EPIPE); + break; + case TCP_CLOSE: + return; + default: +- sk->sk_err = ECONNRESET; ++ WRITE_ONCE(sk->sk_err, ECONNRESET); + } + /* This barrier is coupled with smp_rmb() in tcp_poll() */ + smp_wmb(); +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 8fbb6deed3216..16098fcafde2b 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -603,7 +603,7 @@ int tcp_v4_err(struct sk_buff *skb, u32 info) + ip_icmp_error(sk, skb, err, th->dest, info, (u8 *)th); + + if (!sock_owned_by_user(sk)) { +- sk->sk_err = err; ++ WRITE_ONCE(sk->sk_err, err); + + sk_error_report(sk); + +@@ -632,7 +632,7 @@ int tcp_v4_err(struct sk_buff *skb, u32 info) + + inet = inet_sk(sk); + if (!sock_owned_by_user(sk) && inet->recverr) { +- sk->sk_err = err; ++ WRITE_ONCE(sk->sk_err, err); + sk_error_report(sk); + } else { /* Only an error on timeout */ + WRITE_ONCE(sk->sk_err_soft, err); +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 15f814c1e1693..19b5a6179c061 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3764,7 +3764,7 @@ static void tcp_connect_init(struct sock *sk) + tp->rx_opt.rcv_wscale = rcv_wscale; + tp->rcv_ssthresh = tp->rcv_wnd; + +- sk->sk_err = 0; ++ WRITE_ONCE(sk->sk_err, 0); + sock_reset_flag(sk, SOCK_DONE); + tp->snd_wnd = 0; + tcp_init_wl(tp, 0); +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index fe23a427f6a9d..117fc7031bc10 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -67,7 +67,7 @@ u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when) + + static void tcp_write_err(struct sock *sk) + { +- sk->sk_err = READ_ONCE(sk->sk_err_soft) ? : ETIMEDOUT; ++ WRITE_ONCE(sk->sk_err, READ_ONCE(sk->sk_err_soft) ? : ETIMEDOUT); + sk_error_report(sk); + + tcp_write_queue_purge(sk); +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 848175e0be081..35bfca93af6ad 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -493,7 +493,7 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + ipv6_icmp_error(sk, skb, err, th->dest, ntohl(info), (u8 *)th); + + if (!sock_owned_by_user(sk)) { +- sk->sk_err = err; ++ WRITE_ONCE(sk->sk_err, err); + sk_error_report(sk); /* Wake people up to see the error (see connect in sock.c) */ + + tcp_done(sk); +@@ -513,7 +513,7 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + } + + if (!sock_owned_by_user(sk) && np->recverr) { +- sk->sk_err = err; ++ WRITE_ONCE(sk->sk_err, err); + sk_error_report(sk); + } else { + WRITE_ONCE(sk->sk_err_soft, err); +-- +2.43.0 + diff --git a/queue-6.1/tcp-annotate-lockless-accesses-to-sk-sk_err_soft.patch b/queue-6.1/tcp-annotate-lockless-accesses-to-sk-sk_err_soft.patch new file mode 100644 index 00000000000..e046cd3a4e8 --- /dev/null +++ b/queue-6.1/tcp-annotate-lockless-accesses-to-sk-sk_err_soft.patch @@ -0,0 +1,129 @@ +From c3d39a190f56489c5f786c2b2c225efe22a68519 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 20:57:41 +0000 +Subject: tcp: annotate lockless accesses to sk->sk_err_soft + +From: Eric Dumazet + +[ Upstream commit cee1af825d65b8122627fc2efbc36c1bd51ee103 ] + +This field can be read/written without lock synchronization. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Stable-dep-of: 853c3bd7b791 ("tcp: fix race in tcp_write_err()") +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 2 +- + net/ipv4/tcp_ipv4.c | 6 +++--- + net/ipv4/tcp_timer.c | 6 +++--- + net/ipv6/tcp_ipv6.c | 11 ++++++----- + 4 files changed, 13 insertions(+), 12 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 359ffda9b736b..fa15c6951cd78 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3922,7 +3922,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) + /* We passed data and got it acked, remove any soft error + * log. Something worked... + */ +- sk->sk_err_soft = 0; ++ WRITE_ONCE(sk->sk_err_soft, 0); + icsk->icsk_probes_out = 0; + tp->rcv_tstamp = tcp_jiffies32; + if (!prior_packets) +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index befa848fb820c..8fbb6deed3216 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -368,7 +368,7 @@ void tcp_v4_mtu_reduced(struct sock *sk) + * for the case, if this connection will not able to recover. + */ + if (mtu < dst_mtu(dst) && ip_dont_fragment(sk, dst)) +- sk->sk_err_soft = EMSGSIZE; ++ WRITE_ONCE(sk->sk_err_soft, EMSGSIZE); + + mtu = dst_mtu(dst); + +@@ -609,7 +609,7 @@ int tcp_v4_err(struct sk_buff *skb, u32 info) + + tcp_done(sk); + } else { +- sk->sk_err_soft = err; ++ WRITE_ONCE(sk->sk_err_soft, err); + } + goto out; + } +@@ -635,7 +635,7 @@ int tcp_v4_err(struct sk_buff *skb, u32 info) + sk->sk_err = err; + sk_error_report(sk); + } else { /* Only an error on timeout */ +- sk->sk_err_soft = err; ++ WRITE_ONCE(sk->sk_err_soft, err); + } + + out: +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 016f9eff49b40..fe23a427f6a9d 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -67,7 +67,7 @@ u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when) + + static void tcp_write_err(struct sock *sk) + { +- sk->sk_err = sk->sk_err_soft ? : ETIMEDOUT; ++ sk->sk_err = READ_ONCE(sk->sk_err_soft) ? : ETIMEDOUT; + sk_error_report(sk); + + tcp_write_queue_purge(sk); +@@ -110,7 +110,7 @@ static int tcp_out_of_resources(struct sock *sk, bool do_reset) + shift++; + + /* If some dubious ICMP arrived, penalize even more. */ +- if (sk->sk_err_soft) ++ if (READ_ONCE(sk->sk_err_soft)) + shift++; + + if (tcp_check_oom(sk, shift)) { +@@ -146,7 +146,7 @@ static int tcp_orphan_retries(struct sock *sk, bool alive) + int retries = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_orphan_retries); /* May be zero. */ + + /* We know from an ICMP that something is wrong. */ +- if (sk->sk_err_soft && !alive) ++ if (READ_ONCE(sk->sk_err_soft) && !alive) + retries = 0; + + /* However, if socket sent something recently, select some safe +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 4b0e05349862d..848175e0be081 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -497,8 +497,9 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + sk_error_report(sk); /* Wake people up to see the error (see connect in sock.c) */ + + tcp_done(sk); +- } else +- sk->sk_err_soft = err; ++ } else { ++ WRITE_ONCE(sk->sk_err_soft, err); ++ } + goto out; + case TCP_LISTEN: + break; +@@ -514,9 +515,9 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + if (!sock_owned_by_user(sk) && np->recverr) { + sk->sk_err = err; + sk_error_report(sk); +- } else +- sk->sk_err_soft = err; +- ++ } else { ++ WRITE_ONCE(sk->sk_err_soft, err); ++ } + out: + bh_unlock_sock(sk); + sock_put(sk); +-- +2.43.0 + diff --git a/queue-6.1/tcp-fix-race-in-tcp_write_err.patch b/queue-6.1/tcp-fix-race-in-tcp_write_err.patch new file mode 100644 index 00000000000..a4be44c7d4d --- /dev/null +++ b/queue-6.1/tcp-fix-race-in-tcp_write_err.patch @@ -0,0 +1,64 @@ +From b68d786d6d3e1c0e3d68b17e08fe249d5807dbed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 12:52:51 +0000 +Subject: tcp: fix race in tcp_write_err() + +From: Eric Dumazet + +[ Upstream commit 853c3bd7b7917670224c9fe5245bd045cac411dd ] + +I noticed flakes in a packetdrill test, expecting an epoll_wait() +to return EPOLLERR | EPOLLHUP on a failed connect() attempt, +after multiple SYN retransmits. It sometimes return EPOLLERR only. + +The issue is that tcp_write_err(): + 1) writes an error in sk->sk_err, + 2) calls sk_error_report(), + 3) then calls tcp_done(). + +tcp_done() is writing SHUTDOWN_MASK into sk->sk_shutdown, +among other things. + +Problem is that the awaken user thread (from 2) sk_error_report()) +might call tcp_poll() before tcp_done() has written sk->sk_shutdown. + +tcp_poll() only sees a non zero sk->sk_err and returns EPOLLERR. + +This patch fixes the issue by making sure to call sk_error_report() +after tcp_done(). + +tcp_write_err() also lacks an smp_wmb(). + +We can reuse tcp_done_with_error() to factor out the details, +as Neal suggested. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Acked-by: Neal Cardwell +Link: https://lore.kernel.org/r/20240528125253.1966136-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_timer.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 117fc7031bc10..3662b49ce71ae 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -67,11 +67,7 @@ u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when) + + static void tcp_write_err(struct sock *sk) + { +- WRITE_ONCE(sk->sk_err, READ_ONCE(sk->sk_err_soft) ? : ETIMEDOUT); +- sk_error_report(sk); +- +- tcp_write_queue_purge(sk); +- tcp_done(sk); ++ tcp_done_with_error(sk, READ_ONCE(sk->sk_err_soft) ? : ETIMEDOUT); + __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONTIMEOUT); + } + +-- +2.43.0 + diff --git a/queue-6.1/tcp-fix-races-in-tcp_v-46-_err.patch b/queue-6.1/tcp-fix-races-in-tcp_v-46-_err.patch new file mode 100644 index 00000000000..ae0b352c86e --- /dev/null +++ b/queue-6.1/tcp-fix-races-in-tcp_v-46-_err.patch @@ -0,0 +1,83 @@ +From 609338789647ef35e087754f8a64a722941ae9be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 12:52:53 +0000 +Subject: tcp: fix races in tcp_v[46]_err() + +From: Eric Dumazet + +[ Upstream commit fde6f897f2a184546bf5516ac736523ef24dc6a7 ] + +These functions have races when they: + +1) Write sk->sk_err +2) call sk_error_report(sk) +3) call tcp_done(sk) + +As described in prior patches in this series: + +An smp_wmb() is missing. +We should call tcp_done() before sk_error_report(sk) +to have consistent tcp_poll() results on SMP hosts. + +Use tcp_done_with_error() where we centralized the +correct sequence. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Acked-by: Neal Cardwell +Link: https://lore.kernel.org/r/20240528125253.1966136-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_ipv4.c | 11 +++-------- + net/ipv6/tcp_ipv6.c | 10 +++------- + 2 files changed, 6 insertions(+), 15 deletions(-) + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 16098fcafde2b..c64ba4f8ddaa9 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -602,15 +602,10 @@ int tcp_v4_err(struct sk_buff *skb, u32 info) + + ip_icmp_error(sk, skb, err, th->dest, info, (u8 *)th); + +- if (!sock_owned_by_user(sk)) { +- WRITE_ONCE(sk->sk_err, err); +- +- sk_error_report(sk); +- +- tcp_done(sk); +- } else { ++ if (!sock_owned_by_user(sk)) ++ tcp_done_with_error(sk, err); ++ else + WRITE_ONCE(sk->sk_err_soft, err); +- } + goto out; + } + +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 35bfca93af6ad..eb6fc0e2a4533 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -492,14 +492,10 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + + ipv6_icmp_error(sk, skb, err, th->dest, ntohl(info), (u8 *)th); + +- if (!sock_owned_by_user(sk)) { +- WRITE_ONCE(sk->sk_err, err); +- sk_error_report(sk); /* Wake people up to see the error (see connect in sock.c) */ +- +- tcp_done(sk); +- } else { ++ if (!sock_owned_by_user(sk)) ++ tcp_done_with_error(sk, err); ++ else + WRITE_ONCE(sk->sk_err_soft, err); +- } + goto out; + case TCP_LISTEN: + break; +-- +2.43.0 + diff --git a/queue-6.1/ubd-refactor-the-interrupt-handler.patch b/queue-6.1/ubd-refactor-the-interrupt-handler.patch new file mode 100644 index 00000000000..3237a6fea43 --- /dev/null +++ b/queue-6.1/ubd-refactor-the-interrupt-handler.patch @@ -0,0 +1,93 @@ +From a3d2324dcba39c8d12272601eec77e83cc8f0f18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 09:47:56 +0200 +Subject: ubd: refactor the interrupt handler + +From: Christoph Hellwig + +[ Upstream commit 5db755fbb1a0de4a4cfd5d5edfaa19853b9c56e6 ] + +Instead of a separate handler function that leaves no work in the +interrupt hanler itself, split out a per-request end I/O helper and +clean up the coding style and variable naming while we're at it. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Martin K. Petersen +Acked-By: Anton Ivanov +Link: https://lore.kernel.org/r/20240531074837.1648501-2-hch@lst.de +Signed-off-by: Jens Axboe +Stable-dep-of: 31ade7d4fdcf ("ubd: untagle discard vs write zeroes not support handling") +Signed-off-by: Sasha Levin +--- + arch/um/drivers/ubd_kern.c | 49 ++++++++++++++------------------------ + 1 file changed, 18 insertions(+), 31 deletions(-) + +diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c +index 13a22a4613051..2670f951732c1 100644 +--- a/arch/um/drivers/ubd_kern.c ++++ b/arch/um/drivers/ubd_kern.c +@@ -456,43 +456,30 @@ static int bulk_req_safe_read( + return n; + } + +-/* Called without dev->lock held, and only in interrupt context. */ +-static void ubd_handler(void) ++static void ubd_end_request(struct io_thread_req *io_req) + { +- int n; +- int count; +- +- while(1){ +- n = bulk_req_safe_read( +- thread_fd, +- irq_req_buffer, +- &irq_remainder, +- &irq_remainder_size, +- UBD_REQ_BUFFER_SIZE +- ); +- if (n < 0) { +- if(n == -EAGAIN) +- break; +- printk(KERN_ERR "spurious interrupt in ubd_handler, " +- "err = %d\n", -n); +- return; +- } +- for (count = 0; count < n/sizeof(struct io_thread_req *); count++) { +- struct io_thread_req *io_req = (*irq_req_buffer)[count]; +- +- if ((io_req->error == BLK_STS_NOTSUPP) && (req_op(io_req->req) == REQ_OP_DISCARD)) { +- blk_queue_max_discard_sectors(io_req->req->q, 0); +- blk_queue_max_write_zeroes_sectors(io_req->req->q, 0); +- } +- blk_mq_end_request(io_req->req, io_req->error); +- kfree(io_req); +- } ++ if (io_req->error == BLK_STS_NOTSUPP && ++ req_op(io_req->req) == REQ_OP_DISCARD) { ++ blk_queue_max_discard_sectors(io_req->req->q, 0); ++ blk_queue_max_write_zeroes_sectors(io_req->req->q, 0); + } ++ blk_mq_end_request(io_req->req, io_req->error); ++ kfree(io_req); + } + + static irqreturn_t ubd_intr(int irq, void *dev) + { +- ubd_handler(); ++ int len, i; ++ ++ while ((len = bulk_req_safe_read(thread_fd, irq_req_buffer, ++ &irq_remainder, &irq_remainder_size, ++ UBD_REQ_BUFFER_SIZE)) >= 0) { ++ for (i = 0; i < len / sizeof(struct io_thread_req *); i++) ++ ubd_end_request((*irq_req_buffer)[i]); ++ } ++ ++ if (len < 0 && len != -EAGAIN) ++ pr_err("spurious interrupt in %s, err = %d\n", __func__, len); + return IRQ_HANDLED; + } + +-- +2.43.0 + diff --git a/queue-6.1/ubd-untagle-discard-vs-write-zeroes-not-support-hand.patch b/queue-6.1/ubd-untagle-discard-vs-write-zeroes-not-support-hand.patch new file mode 100644 index 00000000000..fe1d5649bbf --- /dev/null +++ b/queue-6.1/ubd-untagle-discard-vs-write-zeroes-not-support-hand.patch @@ -0,0 +1,52 @@ +From 567a33d00b4b87debeff46cff79cd5927637742e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 09:47:57 +0200 +Subject: ubd: untagle discard vs write zeroes not support handling + +From: Christoph Hellwig + +[ Upstream commit 31ade7d4fdcf382beb8cb229a1f5d77e0f239672 ] + +Discard and Write Zeroes are different operation and implemented +by different fallocate opcodes for ubd. If one fails the other one +can work and vice versa. + +Split the code to disable the operations in ubd_handler to only +disable the operation that actually failed. + +Fixes: 50109b5a03b4 ("um: Add support for DISCARD in the UBD Driver") +Signed-off-by: Christoph Hellwig +Reviewed-by: Bart Van Assche +Reviewed-by: Damien Le Moal +Reviewed-by: Martin K. Petersen +Acked-By: Anton Ivanov +Link: https://lore.kernel.org/r/20240531074837.1648501-3-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + arch/um/drivers/ubd_kern.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c +index 2670f951732c1..1203f5078cb57 100644 +--- a/arch/um/drivers/ubd_kern.c ++++ b/arch/um/drivers/ubd_kern.c +@@ -458,10 +458,11 @@ static int bulk_req_safe_read( + + static void ubd_end_request(struct io_thread_req *io_req) + { +- if (io_req->error == BLK_STS_NOTSUPP && +- req_op(io_req->req) == REQ_OP_DISCARD) { +- blk_queue_max_discard_sectors(io_req->req->q, 0); +- blk_queue_max_write_zeroes_sectors(io_req->req->q, 0); ++ if (io_req->error == BLK_STS_NOTSUPP) { ++ if (req_op(io_req->req) == REQ_OP_DISCARD) ++ blk_queue_max_discard_sectors(io_req->req->q, 0); ++ else if (req_op(io_req->req) == REQ_OP_WRITE_ZEROES) ++ blk_queue_max_write_zeroes_sectors(io_req->req->q, 0); + } + blk_mq_end_request(io_req->req, io_req->error); + kfree(io_req); +-- +2.43.0 + diff --git a/queue-6.1/vhost-vsock-always-initialize-seqpacket_allow.patch b/queue-6.1/vhost-vsock-always-initialize-seqpacket_allow.patch new file mode 100644 index 00000000000..ac8bc7e658a --- /dev/null +++ b/queue-6.1/vhost-vsock-always-initialize-seqpacket_allow.patch @@ -0,0 +1,68 @@ +From d065afe1399b916d0d520a40039d0ff34729ac17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 10:03:13 -0400 +Subject: vhost/vsock: always initialize seqpacket_allow +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael S. Tsirkin + +[ Upstream commit 1e1fdcbdde3b7663e5d8faeb2245b9b151417d22 ] + +There are two issues around seqpacket_allow: +1. seqpacket_allow is not initialized when socket is + created. Thus if features are never set, it will be + read uninitialized. +2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared, + then seqpacket_allow will not be cleared appropriately + (existing apps I know about don't usually do this but + it's legal and there's no way to be sure no one relies + on this). + +To fix: + - initialize seqpacket_allow after allocation + - set it unconditionally in set_features + +Reported-by: syzbot+6c21aeb59d0e82eb2782@syzkaller.appspotmail.com +Reported-by: Jeongjun Park +Fixes: ced7b713711f ("vhost/vsock: support SEQPACKET for transport"). +Tested-by: Arseny Krasnov +Cc: David S. Miller +Cc: Stefan Hajnoczi +Message-ID: <20240422100010-mutt-send-email-mst@kernel.org> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Reviewed-by: Stefano Garzarella +Reviewed-by: Eugenio Pérez +Acked-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/vhost/vsock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c +index 1f3b89c885cca..c00f5821d6ecb 100644 +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -654,6 +654,7 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file) + } + + vsock->guest_cid = 0; /* no CID assigned yet */ ++ vsock->seqpacket_allow = false; + + atomic_set(&vsock->queued_replies, 0); + +@@ -797,8 +798,7 @@ static int vhost_vsock_set_features(struct vhost_vsock *vsock, u64 features) + goto err; + } + +- if (features & (1ULL << VIRTIO_VSOCK_F_SEQPACKET)) +- vsock->seqpacket_allow = true; ++ vsock->seqpacket_allow = features & (1ULL << VIRTIO_VSOCK_F_SEQPACKET); + + for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { + vq = &vsock->vqs[i]; +-- +2.43.0 + diff --git a/queue-6.1/vmlinux.lds.h-catch-.bss.l-sections-into-bss.patch b/queue-6.1/vmlinux.lds.h-catch-.bss.l-sections-into-bss.patch new file mode 100644 index 00000000000..85ad1264fa0 --- /dev/null +++ b/queue-6.1/vmlinux.lds.h-catch-.bss.l-sections-into-bss.patch @@ -0,0 +1,57 @@ +From 1da3900ac65f04795565e1c3d0e87cb01c292546 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 07:51:58 +0200 +Subject: vmlinux.lds.h: catch .bss..L* sections into BSS") + +From: Christophe Leroy + +[ Upstream commit 1a7b7326d587c9a5e8ff067e70d6aaf0333f4bb3 ] + +Commit 9a427556fb8e ("vmlinux.lds.h: catch compound literals into +data and BSS") added catches for .data..L* and .rodata..L* but missed +.bss..L* + +Since commit 5431fdd2c181 ("ptrace: Convert ptrace_attach() to use +lock guards") the following appears at build: + + LD .tmp_vmlinux.kallsyms1 +powerpc64-linux-ld: warning: orphan section `.bss..Lubsan_data33' from `kernel/ptrace.o' being placed in section `.bss..Lubsan_data33' + NM .tmp_vmlinux.kallsyms1.syms + KSYMS .tmp_vmlinux.kallsyms1.S + AS .tmp_vmlinux.kallsyms1.S + LD .tmp_vmlinux.kallsyms2 +powerpc64-linux-ld: warning: orphan section `.bss..Lubsan_data33' from `kernel/ptrace.o' being placed in section `.bss..Lubsan_data33' + NM .tmp_vmlinux.kallsyms2.syms + KSYMS .tmp_vmlinux.kallsyms2.S + AS .tmp_vmlinux.kallsyms2.S + LD vmlinux +powerpc64-linux-ld: warning: orphan section `.bss..Lubsan_data33' from `kernel/ptrace.o' being placed in section `.bss..Lubsan_data33' + +Lets add .bss..L* to BSS_MAIN macro to catch those sections into BSS. + +Fixes: 9a427556fb8e ("vmlinux.lds.h: catch compound literals into data and BSS") +Signed-off-by: Christophe Leroy +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202404031349.nmKhyuUG-lkp@intel.com/ +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + include/asm-generic/vmlinux.lds.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index 1d1f480a5e9e4..e7539dc024981 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -101,7 +101,7 @@ + #define DATA_MAIN .data .data.[0-9a-zA-Z_]* .data..L* .data..compoundliteral* .data.$__unnamed_* .data.$L* + #define SDATA_MAIN .sdata .sdata.[0-9a-zA-Z_]* + #define RODATA_MAIN .rodata .rodata.[0-9a-zA-Z_]* .rodata..L* +-#define BSS_MAIN .bss .bss.[0-9a-zA-Z_]* .bss..compoundliteral* ++#define BSS_MAIN .bss .bss.[0-9a-zA-Z_]* .bss..L* .bss..compoundliteral* + #define SBSS_MAIN .sbss .sbss.[0-9a-zA-Z_]* + #else + #define TEXT_MAIN .text +-- +2.43.0 + diff --git a/queue-6.1/wifi-ath11k-fix-wrong-handling-of-ccmp256-and-gcmp-c.patch b/queue-6.1/wifi-ath11k-fix-wrong-handling-of-ccmp256-and-gcmp-c.patch new file mode 100644 index 00000000000..24749df344f --- /dev/null +++ b/queue-6.1/wifi-ath11k-fix-wrong-handling-of-ccmp256-and-gcmp-c.patch @@ -0,0 +1,133 @@ +From 42ad97b2b8dfb840fbbb67e460deb7e42f601e57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 09:42:34 +0300 +Subject: wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers + +From: Baochen Qiang + +[ Upstream commit d2b0ca38d362ebf16ca79cd7f309d5bb8b581deb ] + +Currently for CCMP256, GCMP128 and GCMP256 ciphers, in ath11k_install_key() +IEEE80211_KEY_FLAG_GENERATE_IV_MGMT is not set. And in ath11k_mac_mgmt_tx_wmi() +a length of IEEE80211_CCMP_MIC_LEN is reserved for all ciphers. + +This results in unexpected management frame drop in case either of above 3 ciphers +is used. The reason is, without IEEE80211_KEY_FLAG_GENERATE_IV_MGMT set, mac80211 +will not generate CCMP/GCMP headers in frame for ath11k. Also MIC length reserved +is wrong. Such frame is dropped later by hardware: + +ath11k_pci 0000:5a:00.0: mac tx mgmt frame, buf id 0 +ath11k_pci 0000:5a:00.0: mgmt tx compl ev pdev_id 1, desc_id 0, status 1 + +From user point of view, we have observed very low throughput due to this issue: +action frames are all dropped so ADDBA response from DUT never reaches AP. AP +can not use aggregation thus throughput is low. + +Fix this by setting IEEE80211_KEY_FLAG_GENERATE_IV_MGMT flag and by reserving proper +MIC length for those ciphers. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 +Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 + +Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") +Reported-by: Yaroslav Isakov +Tested-by: Yaroslav Isakov +Closes: https://lore.kernel.org/all/CADS+iDX5=JtJr0apAtAQ02WWBxgOFEv8G063vuGYwDTC8AVZaw@mail.gmail.com +Signed-off-by: Baochen Qiang +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240605014826.22498-1-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +-- + drivers/net/wireless/ath/ath11k/dp_rx.h | 3 +++ + drivers/net/wireless/ath/ath11k/mac.c | 15 +++++++++++---- + 3 files changed, 15 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c +index b1067bcdf88a5..3746f9c956969 100644 +--- a/drivers/net/wireless/ath/ath11k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c +@@ -1879,8 +1879,7 @@ static void ath11k_dp_rx_h_csum_offload(struct ath11k *ar, struct sk_buff *msdu) + CHECKSUM_NONE : CHECKSUM_UNNECESSARY; + } + +-static int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar, +- enum hal_encrypt_type enctype) ++int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar, enum hal_encrypt_type enctype) + { + switch (enctype) { + case HAL_ENCRYPT_TYPE_OPEN: +diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.h b/drivers/net/wireless/ath/ath11k/dp_rx.h +index 623da3bf9dc81..c322e30caa968 100644 +--- a/drivers/net/wireless/ath/ath11k/dp_rx.h ++++ b/drivers/net/wireless/ath/ath11k/dp_rx.h +@@ -1,6 +1,7 @@ + /* SPDX-License-Identifier: BSD-3-Clause-Clear */ + /* + * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. ++ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved. + */ + #ifndef ATH11K_DP_RX_H + #define ATH11K_DP_RX_H +@@ -95,4 +96,6 @@ int ath11k_peer_rx_frag_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id + int ath11k_dp_rx_pktlog_start(struct ath11k_base *ab); + int ath11k_dp_rx_pktlog_stop(struct ath11k_base *ab, bool stop_timer); + ++int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar, enum hal_encrypt_type enctype); ++ + #endif /* ATH11K_DP_RX_H */ +diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c +index b863ead198bda..8234e34269ed8 100644 +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -3748,6 +3748,7 @@ static int ath11k_install_key(struct ath11k_vif *arvif, + + switch (key->cipher) { + case WLAN_CIPHER_SUITE_CCMP: ++ case WLAN_CIPHER_SUITE_CCMP_256: + arg.key_cipher = WMI_CIPHER_AES_CCM; + /* TODO: Re-check if flag is valid */ + key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV_MGMT; +@@ -3757,12 +3758,10 @@ static int ath11k_install_key(struct ath11k_vif *arvif, + arg.key_txmic_len = 8; + arg.key_rxmic_len = 8; + break; +- case WLAN_CIPHER_SUITE_CCMP_256: +- arg.key_cipher = WMI_CIPHER_AES_CCM; +- break; + case WLAN_CIPHER_SUITE_GCMP: + case WLAN_CIPHER_SUITE_GCMP_256: + arg.key_cipher = WMI_CIPHER_AES_GCM; ++ key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV_MGMT; + break; + default: + ath11k_warn(ar->ab, "cipher %d is not supported\n", key->cipher); +@@ -5542,7 +5541,10 @@ static int ath11k_mac_mgmt_tx_wmi(struct ath11k *ar, struct ath11k_vif *arvif, + { + struct ath11k_base *ab = ar->ab; + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; ++ struct ath11k_skb_cb *skb_cb = ATH11K_SKB_CB(skb); + struct ieee80211_tx_info *info; ++ enum hal_encrypt_type enctype; ++ unsigned int mic_len; + dma_addr_t paddr; + int buf_id; + int ret; +@@ -5566,7 +5568,12 @@ static int ath11k_mac_mgmt_tx_wmi(struct ath11k *ar, struct ath11k_vif *arvif, + ieee80211_is_deauth(hdr->frame_control) || + ieee80211_is_disassoc(hdr->frame_control)) && + ieee80211_has_protected(hdr->frame_control)) { +- skb_put(skb, IEEE80211_CCMP_MIC_LEN); ++ if (!(skb_cb->flags & ATH11K_SKB_CIPHER_SET)) ++ ath11k_warn(ab, "WMI management tx frame without ATH11K_SKB_CIPHER_SET"); ++ ++ enctype = ath11k_dp_tx_get_encrypt_type(skb_cb->cipher); ++ mic_len = ath11k_dp_rx_crypto_mic_len(ar, enctype); ++ skb_put(skb, mic_len); + } + } + +-- +2.43.0 + diff --git a/queue-6.1/wifi-brcmsmac-lcn-phy-code-is-used-for-bcm4313-2g-on.patch b/queue-6.1/wifi-brcmsmac-lcn-phy-code-is-used-for-bcm4313-2g-on.patch new file mode 100644 index 00000000000..c7686bb5ae4 --- /dev/null +++ b/queue-6.1/wifi-brcmsmac-lcn-phy-code-is-used-for-bcm4313-2g-on.patch @@ -0,0 +1,75 @@ +From 222ff8b92cec42d6152d4b74731fae3552d1657f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 16:10:37 -0700 +Subject: wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device + +From: Samasth Norway Ananda + +[ Upstream commit c636fa85feb450ca414a10010ed05361a73c93a6 ] + +The band_idx variable in the function wlc_lcnphy_tx_iqlo_cal() will +never be set to 1 as BCM4313 is the only device for which the LCN PHY +code is used. This is a 2G-only device. + +Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers") +Signed-off-by: Samasth Norway Ananda +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240509231037.2014109-1-samasth.norway.ananda@oracle.com +Signed-off-by: Sasha Levin +--- + .../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +index 7717eb85a1db6..47c0e8e429e54 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +@@ -2567,7 +2567,6 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi, + + struct lcnphy_txgains cal_gains, temp_gains; + u16 hash; +- u8 band_idx; + int j; + u16 ncorr_override[5]; + u16 syst_coeffs[] = { 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, +@@ -2599,6 +2598,9 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi, + u16 *values_to_save; + struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy; + ++ if (WARN_ON(CHSPEC_IS5G(pi->radio_chanspec))) ++ return; ++ + values_to_save = kmalloc_array(20, sizeof(u16), GFP_ATOMIC); + if (NULL == values_to_save) + return; +@@ -2662,20 +2664,18 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi, + hash = (target_gains->gm_gain << 8) | + (target_gains->pga_gain << 4) | (target_gains->pad_gain); + +- band_idx = (CHSPEC_IS5G(pi->radio_chanspec) ? 1 : 0); +- + cal_gains = *target_gains; + memset(ncorr_override, 0, sizeof(ncorr_override)); +- for (j = 0; j < iqcal_gainparams_numgains_lcnphy[band_idx]; j++) { +- if (hash == tbl_iqcal_gainparams_lcnphy[band_idx][j][0]) { ++ for (j = 0; j < iqcal_gainparams_numgains_lcnphy[0]; j++) { ++ if (hash == tbl_iqcal_gainparams_lcnphy[0][j][0]) { + cal_gains.gm_gain = +- tbl_iqcal_gainparams_lcnphy[band_idx][j][1]; ++ tbl_iqcal_gainparams_lcnphy[0][j][1]; + cal_gains.pga_gain = +- tbl_iqcal_gainparams_lcnphy[band_idx][j][2]; ++ tbl_iqcal_gainparams_lcnphy[0][j][2]; + cal_gains.pad_gain = +- tbl_iqcal_gainparams_lcnphy[band_idx][j][3]; ++ tbl_iqcal_gainparams_lcnphy[0][j][3]; + memcpy(ncorr_override, +- &tbl_iqcal_gainparams_lcnphy[band_idx][j][3], ++ &tbl_iqcal_gainparams_lcnphy[0][j][3], + sizeof(ncorr_override)); + break; + } +-- +2.43.0 + diff --git a/queue-6.1/wifi-cfg80211-fix-typo-in-cfg80211_calculate_bitrate.patch b/queue-6.1/wifi-cfg80211-fix-typo-in-cfg80211_calculate_bitrate.patch new file mode 100644 index 00000000000..4d452abd4ea --- /dev/null +++ b/queue-6.1/wifi-cfg80211-fix-typo-in-cfg80211_calculate_bitrate.patch @@ -0,0 +1,45 @@ +From b3cd32d7df3c5c5e1f7b069181df522c0a88e27f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:06:52 +0800 +Subject: wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he() + +From: Baochen Qiang + +[ Upstream commit 9ee0d44f055276fe2802b2f65058e920853f4f99 ] + +rates_996 is mistakenly written as rates_969, fix it. + +Fixes: c4cbaf7973a7 ("cfg80211: Add support for HE") +Signed-off-by: Baochen Qiang +Link: https://msgid.link/20240606020653.33205-2-quic_bqiang@quicinc.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/util.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index 73b3648e1b4c3..37ea62f83cb56 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -1373,7 +1373,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) + 5120, /* 0.833333... */ + }; + u32 rates_160M[3] = { 960777777, 907400000, 816666666 }; +- u32 rates_969[3] = { 480388888, 453700000, 408333333 }; ++ u32 rates_996[3] = { 480388888, 453700000, 408333333 }; + u32 rates_484[3] = { 229411111, 216666666, 195000000 }; + u32 rates_242[3] = { 114711111, 108333333, 97500000 }; + u32 rates_106[3] = { 40000000, 37777777, 34000000 }; +@@ -1398,7 +1398,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) + else if (rate->bw == RATE_INFO_BW_80 || + (rate->bw == RATE_INFO_BW_HE_RU && + rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_996)) +- result = rates_969[rate->he_gi]; ++ result = rates_996[rate->he_gi]; + else if (rate->bw == RATE_INFO_BW_40 || + (rate->bw == RATE_INFO_BW_HE_RU && + rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_484)) +-- +2.43.0 + diff --git a/queue-6.1/wifi-cfg80211-handle-2x996-ru-allocation-in-cfg80211.patch b/queue-6.1/wifi-cfg80211-handle-2x996-ru-allocation-in-cfg80211.patch new file mode 100644 index 00000000000..958cd9e4c55 --- /dev/null +++ b/queue-6.1/wifi-cfg80211-handle-2x996-ru-allocation-in-cfg80211.patch @@ -0,0 +1,45 @@ +From 8bf036b3b7f2ea2ade675a49773ae999a211ee00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:06:53 +0800 +Subject: wifi: cfg80211: handle 2x996 RU allocation in + cfg80211_calculate_bitrate_he() + +From: Baochen Qiang + +[ Upstream commit bcbd771cd5d68c0c52567556097d75f9fc4e7cd6 ] + +Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in +cfg80211_calculate_bitrate_he(), leading to below warning: + +kernel: invalid HE MCS: bw:6, ru:6 +kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211] + +Fix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth. + +Fixes: c4cbaf7973a7 ("cfg80211: Add support for HE") +Signed-off-by: Baochen Qiang +Link: https://msgid.link/20240606020653.33205-3-quic_bqiang@quicinc.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/util.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index 37ea62f83cb56..1665320d22146 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -1393,7 +1393,9 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) + if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8)) + return 0; + +- if (rate->bw == RATE_INFO_BW_160) ++ if (rate->bw == RATE_INFO_BW_160 || ++ (rate->bw == RATE_INFO_BW_HE_RU && ++ rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_2x996)) + result = rates_160M[rate->he_gi]; + else if (rate->bw == RATE_INFO_BW_80 || + (rate->bw == RATE_INFO_BW_HE_RU && +-- +2.43.0 + diff --git a/queue-6.1/wifi-rtw89-fix-array-index-mistake-in-rtw89_sta_info.patch b/queue-6.1/wifi-rtw89-fix-array-index-mistake-in-rtw89_sta_info.patch new file mode 100644 index 00000000000..9017e2ba8f6 --- /dev/null +++ b/queue-6.1/wifi-rtw89-fix-array-index-mistake-in-rtw89_sta_info.patch @@ -0,0 +1,44 @@ +From 522a70810be9ea523c8cb08bebf493f97e509011 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jul 2024 00:05:10 +0300 +Subject: wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() + +From: Aleksandr Mishin + +[ Upstream commit 85099c7ce4f9e64c66aa397cd9a37473637ab891 ] + +In rtw89_sta_info_get_iter() 'status->he_gi' is compared to array size. +But then 'rate->he_gi' is used as array index instead of 'status->he_gi'. +This can lead to go beyond array boundaries in case of 'rate->he_gi' is +not equal to 'status->he_gi' and is bigger than array size. Looks like +"copy-paste" mistake. + +Fix this mistake by replacing 'rate->he_gi' with 'status->he_gi'. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver") +Signed-off-by: Aleksandr Mishin +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20240703210510.11089-1-amishin@t-argos.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c +index 3a8fe60d0bb7b..0e014d6afb842 100644 +--- a/drivers/net/wireless/realtek/rtw89/debug.c ++++ b/drivers/net/wireless/realtek/rtw89/debug.c +@@ -2386,7 +2386,7 @@ static void rtw89_sta_info_get_iter(void *data, struct ieee80211_sta *sta) + case RX_ENC_HE: + seq_printf(m, "HE %dSS MCS-%d GI:%s", status->nss, status->rate_idx, + status->he_gi <= NL80211_RATE_INFO_HE_GI_3_2 ? +- he_gi_str[rate->he_gi] : "N/A"); ++ he_gi_str[status->he_gi] : "N/A"); + break; + } + seq_printf(m, "\t(hw_rate=0x%x)\n", rtwsta->rx_hw_rate); +-- +2.43.0 + diff --git a/queue-6.1/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch b/queue-6.1/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch new file mode 100644 index 00000000000..5b224f3f77a --- /dev/null +++ b/queue-6.1/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch @@ -0,0 +1,98 @@ +From 3e74476ea71dd8415f3b1e366fc15ba332d0537a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jul 2024 10:37:56 +0800 +Subject: wifi: virt_wifi: avoid reporting connection success with wrong SSID + +From: En-Wei Wu + +[ Upstream commit b5d14b0c6716fad7f0c94ac6e1d6f60a49f985c7 ] + +When user issues a connection with a different SSID than the one +virt_wifi has advertised, the __cfg80211_connect_result() will +trigger the warning: WARN_ON(bss_not_found). + +The issue is because the connection code in virt_wifi does not +check the SSID from user space (it only checks the BSSID), and +virt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS +even if the SSID is different from the one virt_wifi has advertised. +Eventually cfg80211 won't be able to find the cfg80211_bss and generate +the warning. + +Fixed it by checking the SSID (from user space) in the connection code. + +Fixes: c7cdba31ed8b ("mac80211-next: rtnetlink wifi simulation device") +Reported-by: syzbot+d6eb9cee2885ec06f5e3@syzkaller.appspotmail.com +Signed-off-by: En-Wei Wu +Link: https://patch.msgid.link/20240705023756.10954-1-en-wei.wu@canonical.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/virt_wifi.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/virt_wifi.c b/drivers/net/wireless/virt_wifi.c +index ba14d83353a4b..cf1eb41e282a9 100644 +--- a/drivers/net/wireless/virt_wifi.c ++++ b/drivers/net/wireless/virt_wifi.c +@@ -136,6 +136,8 @@ static struct ieee80211_supported_band band_5ghz = { + /* Assigned at module init. Guaranteed locally-administered and unicast. */ + static u8 fake_router_bssid[ETH_ALEN] __ro_after_init = {}; + ++#define VIRT_WIFI_SSID "VirtWifi" ++ + static void virt_wifi_inform_bss(struct wiphy *wiphy) + { + u64 tsf = div_u64(ktime_get_boottime_ns(), 1000); +@@ -146,8 +148,8 @@ static void virt_wifi_inform_bss(struct wiphy *wiphy) + u8 ssid[8]; + } __packed ssid = { + .tag = WLAN_EID_SSID, +- .len = 8, +- .ssid = "VirtWifi", ++ .len = strlen(VIRT_WIFI_SSID), ++ .ssid = VIRT_WIFI_SSID, + }; + + informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz, +@@ -213,6 +215,8 @@ struct virt_wifi_netdev_priv { + struct net_device *upperdev; + u32 tx_packets; + u32 tx_failed; ++ u32 connect_requested_ssid_len; ++ u8 connect_requested_ssid[IEEE80211_MAX_SSID_LEN]; + u8 connect_requested_bss[ETH_ALEN]; + bool is_up; + bool is_connected; +@@ -229,6 +233,12 @@ static int virt_wifi_connect(struct wiphy *wiphy, struct net_device *netdev, + if (priv->being_deleted || !priv->is_up) + return -EBUSY; + ++ if (!sme->ssid) ++ return -EINVAL; ++ ++ priv->connect_requested_ssid_len = sme->ssid_len; ++ memcpy(priv->connect_requested_ssid, sme->ssid, sme->ssid_len); ++ + could_schedule = schedule_delayed_work(&priv->connect, HZ * 2); + if (!could_schedule) + return -EBUSY; +@@ -252,12 +262,15 @@ static void virt_wifi_connect_complete(struct work_struct *work) + container_of(work, struct virt_wifi_netdev_priv, connect.work); + u8 *requested_bss = priv->connect_requested_bss; + bool right_addr = ether_addr_equal(requested_bss, fake_router_bssid); ++ bool right_ssid = priv->connect_requested_ssid_len == strlen(VIRT_WIFI_SSID) && ++ !memcmp(priv->connect_requested_ssid, VIRT_WIFI_SSID, ++ priv->connect_requested_ssid_len); + u16 status = WLAN_STATUS_SUCCESS; + + if (is_zero_ether_addr(requested_bss)) + requested_bss = NULL; + +- if (!priv->is_up || (requested_bss && !right_addr)) ++ if (!priv->is_up || (requested_bss && !right_addr) || !right_ssid) + status = WLAN_STATUS_UNSPECIFIED_FAILURE; + else + priv->is_connected = true; +-- +2.43.0 + diff --git a/queue-6.1/wifi-virt_wifi-don-t-use-strlen-in-const-context.patch b/queue-6.1/wifi-virt_wifi-don-t-use-strlen-in-const-context.patch new file mode 100644 index 00000000000..7ce7c089327 --- /dev/null +++ b/queue-6.1/wifi-virt_wifi-don-t-use-strlen-in-const-context.patch @@ -0,0 +1,56 @@ +From 65b4a21de5efb0142cf2ee6b55493fe5c5926d1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jul 2024 08:34:09 +0200 +Subject: wifi: virt_wifi: don't use strlen() in const context + +From: Johannes Berg + +[ Upstream commit 6e909f489191b365364e9d636dec33b5dfd4e5eb ] + +Looks like not all compilers allow strlen(constant) as +a constant, so don't do that. Instead, revert back to +defining the length as the first submission had it. + +Fixes: b5d14b0c6716 ("wifi: virt_wifi: avoid reporting connection success with wrong SSID") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202407090934.NnR1TUbW-lkp@intel.com/ +Closes: https://lore.kernel.org/oe-kbuild-all/202407090944.mpwLHGt9-lkp@intel.com/ +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/virt_wifi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/virt_wifi.c b/drivers/net/wireless/virt_wifi.c +index cf1eb41e282a9..fb4d95a027fef 100644 +--- a/drivers/net/wireless/virt_wifi.c ++++ b/drivers/net/wireless/virt_wifi.c +@@ -137,6 +137,7 @@ static struct ieee80211_supported_band band_5ghz = { + static u8 fake_router_bssid[ETH_ALEN] __ro_after_init = {}; + + #define VIRT_WIFI_SSID "VirtWifi" ++#define VIRT_WIFI_SSID_LEN 8 + + static void virt_wifi_inform_bss(struct wiphy *wiphy) + { +@@ -148,7 +149,7 @@ static void virt_wifi_inform_bss(struct wiphy *wiphy) + u8 ssid[8]; + } __packed ssid = { + .tag = WLAN_EID_SSID, +- .len = strlen(VIRT_WIFI_SSID), ++ .len = VIRT_WIFI_SSID_LEN, + .ssid = VIRT_WIFI_SSID, + }; + +@@ -262,7 +263,7 @@ static void virt_wifi_connect_complete(struct work_struct *work) + container_of(work, struct virt_wifi_netdev_priv, connect.work); + u8 *requested_bss = priv->connect_requested_bss; + bool right_addr = ether_addr_equal(requested_bss, fake_router_bssid); +- bool right_ssid = priv->connect_requested_ssid_len == strlen(VIRT_WIFI_SSID) && ++ bool right_ssid = priv->connect_requested_ssid_len == VIRT_WIFI_SSID_LEN && + !memcmp(priv->connect_requested_ssid, VIRT_WIFI_SSID, + priv->connect_requested_ssid_len); + u16 status = WLAN_STATUS_SUCCESS; +-- +2.43.0 + diff --git a/queue-6.1/x86-of-return-consistent-error-type-from-x86_of_pci_.patch b/queue-6.1/x86-of-return-consistent-error-type-from-x86_of_pci_.patch new file mode 100644 index 00000000000..3f391d97842 --- /dev/null +++ b/queue-6.1/x86-of-return-consistent-error-type-from-x86_of_pci_.patch @@ -0,0 +1,45 @@ +From 0b9330c715a26de4f76a6b105eea969ebd64cb07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 15:55:35 +0300 +Subject: x86/of: Return consistent error type from x86_of_pci_irq_enable() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit ec0b4c4d45cf7cf9a6c9626a494a89cb1ae7c645 ] + +x86_of_pci_irq_enable() returns PCIBIOS_* code received from +pci_read_config_byte() directly and also -EINVAL which are not +compatible error types. x86_of_pci_irq_enable() is used as +(*pcibios_enable_irq) function which should not return PCIBIOS_* codes. + +Convert the PCIBIOS_* return code from pci_read_config_byte() into +normal errno using pcibios_err_to_errno(). + +Fixes: 96e0a0797eba ("x86: dtb: Add support for PCI devices backed by dtb nodes") +Signed-off-by: Ilpo Järvinen +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20240527125538.13620-1-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/devicetree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c +index 5cd51f25f4461..c77297fa2dad5 100644 +--- a/arch/x86/kernel/devicetree.c ++++ b/arch/x86/kernel/devicetree.c +@@ -87,7 +87,7 @@ static int x86_of_pci_irq_enable(struct pci_dev *dev) + + ret = pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin); + if (ret) +- return ret; ++ return pcibios_err_to_errno(ret); + if (!pin) + return 0; + +-- +2.43.0 + diff --git a/queue-6.1/x86-pci-intel_mid_pci-fix-pcibios_-return-code-handl.patch b/queue-6.1/x86-pci-intel_mid_pci-fix-pcibios_-return-code-handl.patch new file mode 100644 index 00000000000..bd80c30b6d1 --- /dev/null +++ b/queue-6.1/x86-pci-intel_mid_pci-fix-pcibios_-return-code-handl.patch @@ -0,0 +1,53 @@ +From 87ab05709a7b8f4b169386ed2ef290bd3fbb3031 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 15:55:36 +0300 +Subject: x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 724852059e97c48557151b3aa4af424614819752 ] + +intel_mid_pci_irq_enable() uses pci_read_config_byte() that returns +PCIBIOS_* codes. The error handling, however, assumes the codes are +normal errnos because it checks for < 0. + +intel_mid_pci_irq_enable() also returns the PCIBIOS_* code back to the +caller but the function is used as the (*pcibios_enable_irq) function +which should return normal errnos. + +Convert the error check to plain non-zero check which works for +PCIBIOS_* return codes and convert the PCIBIOS_* return code using +pcibios_err_to_errno() into normal errno before returning it. + +Fixes: 5b395e2be6c4 ("x86/platform/intel-mid: Make IRQ allocation a bit more flexible") +Signed-off-by: Ilpo Järvinen +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240527125538.13620-2-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/pci/intel_mid_pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c +index 8edd622066044..722a33be08a18 100644 +--- a/arch/x86/pci/intel_mid_pci.c ++++ b/arch/x86/pci/intel_mid_pci.c +@@ -233,9 +233,9 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev) + return 0; + + ret = pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &gsi); +- if (ret < 0) { ++ if (ret) { + dev_warn(&dev->dev, "Failed to read interrupt line: %d\n", ret); +- return ret; ++ return pcibios_err_to_errno(ret); + } + + id = x86_match_cpu(intel_mid_cpu_ids); +-- +2.43.0 + diff --git a/queue-6.1/x86-pci-xen-fix-pcibios_-return-code-handling.patch b/queue-6.1/x86-pci-xen-fix-pcibios_-return-code-handling.patch new file mode 100644 index 00000000000..3044dc8e88f --- /dev/null +++ b/queue-6.1/x86-pci-xen-fix-pcibios_-return-code-handling.patch @@ -0,0 +1,54 @@ +From ce2325b85682ce16dabdadd598c48fbf7798bc84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 15:55:37 +0300 +Subject: x86/pci/xen: Fix PCIBIOS_* return code handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit e9d7b435dfaec58432f4106aaa632bf39f52ce9f ] + +xen_pcifront_enable_irq() uses pci_read_config_byte() that returns +PCIBIOS_* codes. The error handling, however, assumes the codes are +normal errnos because it checks for < 0. + +xen_pcifront_enable_irq() also returns the PCIBIOS_* code back to the +caller but the function is used as the (*pcibios_enable_irq) function +which should return normal errnos. + +Convert the error check to plain non-zero check which works for +PCIBIOS_* return codes and convert the PCIBIOS_* return code using +pcibios_err_to_errno() into normal errno before returning it. + +Fixes: 3f2a230caf21 ("xen: handled remapped IRQs when enabling a pcifront PCI device.") +Signed-off-by: Ilpo Järvinen +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20240527125538.13620-3-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/pci/xen.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c +index 5a4ecf0c2ac4d..b4621cc95e1fd 100644 +--- a/arch/x86/pci/xen.c ++++ b/arch/x86/pci/xen.c +@@ -38,10 +38,10 @@ static int xen_pcifront_enable_irq(struct pci_dev *dev) + u8 gsi; + + rc = pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &gsi); +- if (rc < 0) { ++ if (rc) { + dev_warn(&dev->dev, "Xen PCI: failed to read interrupt line: %d\n", + rc); +- return rc; ++ return pcibios_err_to_errno(rc); + } + /* In PV DomU the Xen PCI backend puts the PIRQ in the interrupt line.*/ + pirq = gsi; +-- +2.43.0 + diff --git a/queue-6.1/x86-platform-iosf_mbi-convert-pcibios_-return-codes-.patch b/queue-6.1/x86-platform-iosf_mbi-convert-pcibios_-return-codes-.patch new file mode 100644 index 00000000000..af79bdb4f45 --- /dev/null +++ b/queue-6.1/x86-platform-iosf_mbi-convert-pcibios_-return-codes-.patch @@ -0,0 +1,54 @@ +From 6d8ff116d67968b470105ea3a17c6df92db06ce4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 15:55:38 +0300 +Subject: x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 7821fa101eab529521aa4b724bf708149d70820c ] + +iosf_mbi_pci_{read,write}_mdr() use pci_{read,write}_config_dword() +that return PCIBIOS_* codes but functions also return -ENODEV which are +not compatible error codes. As neither of the functions are related to +PCI read/write functions, they should return normal errnos. + +Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal +errno before returning it. + +Fixes: 46184415368a ("arch: x86: New MailBox support driver for Intel SOC's") +Signed-off-by: Ilpo Järvinen +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20240527125538.13620-4-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/platform/intel/iosf_mbi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/platform/intel/iosf_mbi.c b/arch/x86/platform/intel/iosf_mbi.c +index fdd49d70b4373..c81cea208c2c4 100644 +--- a/arch/x86/platform/intel/iosf_mbi.c ++++ b/arch/x86/platform/intel/iosf_mbi.c +@@ -62,7 +62,7 @@ static int iosf_mbi_pci_read_mdr(u32 mcrx, u32 mcr, u32 *mdr) + + fail_read: + dev_err(&mbi_pdev->dev, "PCI config access failed with %d\n", result); +- return result; ++ return pcibios_err_to_errno(result); + } + + static int iosf_mbi_pci_write_mdr(u32 mcrx, u32 mcr, u32 mdr) +@@ -91,7 +91,7 @@ static int iosf_mbi_pci_write_mdr(u32 mcrx, u32 mcr, u32 mdr) + + fail_write: + dev_err(&mbi_pdev->dev, "PCI config access failed with %d\n", result); +- return result; ++ return pcibios_err_to_errno(result); + } + + int iosf_mbi_read(u8 port, u8 opcode, u32 offset, u32 *mdr) +-- +2.43.0 + diff --git a/queue-6.1/x86-xen-convert-comma-to-semicolon.patch b/queue-6.1/x86-xen-convert-comma-to-semicolon.patch new file mode 100644 index 00000000000..a2c7c6796b8 --- /dev/null +++ b/queue-6.1/x86-xen-convert-comma-to-semicolon.patch @@ -0,0 +1,46 @@ +From 1561b317497d72c1a41f9e78f6d5171aeaa07fde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 11:10:10 +0800 +Subject: x86/xen: Convert comma to semicolon + +From: Chen Ni + +[ Upstream commit 349d271416c61f82b853336509b1d0dc04c1fcbb ] + +Replace a comma between expression statements by a semicolon. + +Fixes: 8310b77b48c5 ("Xen/gnttab: handle p2m update errors on a per-slot basis") +Signed-off-by: Chen Ni +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20240702031010.1411875-1-nichen@iscas.ac.cn +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/x86/xen/p2m.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c +index 58db86f7b3846..a02cc54338897 100644 +--- a/arch/x86/xen/p2m.c ++++ b/arch/x86/xen/p2m.c +@@ -736,7 +736,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops, + * immediate unmapping. + */ + map_ops[i].status = GNTST_general_error; +- unmap[0].host_addr = map_ops[i].host_addr, ++ unmap[0].host_addr = map_ops[i].host_addr; + unmap[0].handle = map_ops[i].handle; + map_ops[i].handle = INVALID_GRANT_HANDLE; + if (map_ops[i].flags & GNTMAP_device_map) +@@ -746,7 +746,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops, + + if (kmap_ops) { + kmap_ops[i].status = GNTST_general_error; +- unmap[1].host_addr = kmap_ops[i].host_addr, ++ unmap[1].host_addr = kmap_ops[i].host_addr; + unmap[1].handle = kmap_ops[i].handle; + kmap_ops[i].handle = INVALID_GRANT_HANDLE; + if (kmap_ops[i].flags & GNTMAP_device_map) +-- +2.43.0 + diff --git a/queue-6.1/xdp-fix-invalid-wait-context-of-page_pool_destroy.patch b/queue-6.1/xdp-fix-invalid-wait-context-of-page_pool_destroy.patch new file mode 100644 index 00000000000..5c91f171f75 --- /dev/null +++ b/queue-6.1/xdp-fix-invalid-wait-context-of-page_pool_destroy.patch @@ -0,0 +1,142 @@ +From a33d8c6a47f10a54fa547438cea23a355edfbf3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 09:51:16 +0000 +Subject: xdp: fix invalid wait context of page_pool_destroy() + +From: Taehee Yoo + +[ Upstream commit 59a931c5b732ca5fc2ca727f5a72aeabaafa85ec ] + +If the driver uses a page pool, it creates a page pool with +page_pool_create(). +The reference count of page pool is 1 as default. +A page pool will be destroyed only when a reference count reaches 0. +page_pool_destroy() is used to destroy page pool, it decreases a +reference count. +When a page pool is destroyed, ->disconnect() is called, which is +mem_allocator_disconnect(). +This function internally acquires mutex_lock(). + +If the driver uses XDP, it registers a memory model with +xdp_rxq_info_reg_mem_model(). +The xdp_rxq_info_reg_mem_model() internally increases a page pool +reference count if a memory model is a page pool. +Now the reference count is 2. + +To destroy a page pool, the driver should call both page_pool_destroy() +and xdp_unreg_mem_model(). +The xdp_unreg_mem_model() internally calls page_pool_destroy(). +Only page_pool_destroy() decreases a reference count. + +If a driver calls page_pool_destroy() then xdp_unreg_mem_model(), we +will face an invalid wait context warning. +Because xdp_unreg_mem_model() calls page_pool_destroy() with +rcu_read_lock(). +The page_pool_destroy() internally acquires mutex_lock(). + +Splat looks like: +============================= +[ BUG: Invalid wait context ] +6.10.0-rc6+ #4 Tainted: G W +----------------------------- +ethtool/1806 is trying to lock: +ffffffff90387b90 (mem_id_lock){+.+.}-{4:4}, at: mem_allocator_disconnect+0x73/0x150 +other info that might help us debug this: +context-{5:5} +3 locks held by ethtool/1806: +stack backtrace: +CPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed +Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 +Call Trace: + +dump_stack_lvl+0x7e/0xc0 +__lock_acquire+0x1681/0x4de0 +? _printk+0x64/0xe0 +? __pfx_mark_lock.part.0+0x10/0x10 +? __pfx___lock_acquire+0x10/0x10 +lock_acquire+0x1b3/0x580 +? mem_allocator_disconnect+0x73/0x150 +? __wake_up_klogd.part.0+0x16/0xc0 +? __pfx_lock_acquire+0x10/0x10 +? dump_stack_lvl+0x91/0xc0 +__mutex_lock+0x15c/0x1690 +? mem_allocator_disconnect+0x73/0x150 +? __pfx_prb_read_valid+0x10/0x10 +? mem_allocator_disconnect+0x73/0x150 +? __pfx_llist_add_batch+0x10/0x10 +? console_unlock+0x193/0x1b0 +? lockdep_hardirqs_on+0xbe/0x140 +? __pfx___mutex_lock+0x10/0x10 +? tick_nohz_tick_stopped+0x16/0x90 +? __irq_work_queue_local+0x1e5/0x330 +? irq_work_queue+0x39/0x50 +? __wake_up_klogd.part.0+0x79/0xc0 +? mem_allocator_disconnect+0x73/0x150 +mem_allocator_disconnect+0x73/0x150 +? __pfx_mem_allocator_disconnect+0x10/0x10 +? mark_held_locks+0xa5/0xf0 +? rcu_is_watching+0x11/0xb0 +page_pool_release+0x36e/0x6d0 +page_pool_destroy+0xd7/0x440 +xdp_unreg_mem_model+0x1a7/0x2a0 +? __pfx_xdp_unreg_mem_model+0x10/0x10 +? kfree+0x125/0x370 +? bnxt_free_ring.isra.0+0x2eb/0x500 +? bnxt_free_mem+0x5ac/0x2500 +xdp_rxq_info_unreg+0x4a/0xd0 +bnxt_free_mem+0x1356/0x2500 +bnxt_close_nic+0xf0/0x3b0 +? __pfx_bnxt_close_nic+0x10/0x10 +? ethnl_parse_bit+0x2c6/0x6d0 +? __pfx___nla_validate_parse+0x10/0x10 +? __pfx_ethnl_parse_bit+0x10/0x10 +bnxt_set_features+0x2a8/0x3e0 +__netdev_update_features+0x4dc/0x1370 +? ethnl_parse_bitset+0x4ff/0x750 +? __pfx_ethnl_parse_bitset+0x10/0x10 +? __pfx___netdev_update_features+0x10/0x10 +? mark_held_locks+0xa5/0xf0 +? _raw_spin_unlock_irqrestore+0x42/0x70 +? __pm_runtime_resume+0x7d/0x110 +ethnl_set_features+0x32d/0xa20 + +To fix this problem, it uses rhashtable_lookup_fast() instead of +rhashtable_lookup() with rcu_read_lock(). +Using xa without rcu_read_lock() here is safe. +xa is freed by __xdp_mem_allocator_rcu_free() and this is called by +call_rcu() of mem_xa_remove(). +The mem_xa_remove() is called by page_pool_destroy() if a reference +count reaches 0. +The xa is already protected by the reference count mechanism well in the +control plane. +So removing rcu_read_lock() for page_pool_destroy() is safe. + +Fixes: c3f812cea0d7 ("page_pool: do not release pool until inflight == 0.") +Signed-off-by: Taehee Yoo +Reviewed-by: Jakub Kicinski +Link: https://patch.msgid.link/20240712095116.3801586-1-ap420073@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/xdp.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/net/core/xdp.c b/net/core/xdp.c +index c3f6653b42742..90de33b7c9ce3 100644 +--- a/net/core/xdp.c ++++ b/net/core/xdp.c +@@ -124,10 +124,8 @@ void xdp_unreg_mem_model(struct xdp_mem_info *mem) + return; + + if (type == MEM_TYPE_PAGE_POOL) { +- rcu_read_lock(); +- xa = rhashtable_lookup(mem_id_ht, &id, mem_id_rht_params); ++ xa = rhashtable_lookup_fast(mem_id_ht, &id, mem_id_rht_params); + page_pool_destroy(xa->page_pool); +- rcu_read_unlock(); + } + } + EXPORT_SYMBOL_GPL(xdp_unreg_mem_model); +-- +2.43.0 + diff --git a/queue-6.1/xprtrdma-fix-rpcrdma_reqs_reset.patch b/queue-6.1/xprtrdma-fix-rpcrdma_reqs_reset.patch new file mode 100644 index 00000000000..cf00ee9277e --- /dev/null +++ b/queue-6.1/xprtrdma-fix-rpcrdma_reqs_reset.patch @@ -0,0 +1,85 @@ +From e3dcf2b9fc98b738d9cb3b0dcce81fcd77717e43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 15:45:23 -0400 +Subject: xprtrdma: Fix rpcrdma_reqs_reset() + +From: Chuck Lever + +[ Upstream commit acd9f2dd23c632568156217aac7a05f5a0313152 ] + +Avoid FastReg operations getting MW_BIND_ERR after a reconnect. + +rpcrdma_reqs_reset() is called on transport tear-down to get each +rpcrdma_req back into a clean state. + +MRs on req->rl_registered are waiting for a FastReg, are already +registered, or are waiting for invalidation. If the transport is +being torn down when reqs_reset() is called, the matching LocalInv +might never be posted. That leaves these MR registered /and/ on +req->rl_free_mrs, where they can be re-used for the next +connection. + +Since xprtrdma does not keep specific track of the MR state, it's +not possible to know what state these MRs are in, so the only safe +thing to do is release them immediately. + +Fixes: 5de55ce951a1 ("xprtrdma: Release in-flight MRs on disconnect") +Signed-off-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtrdma/frwr_ops.c | 3 ++- + net/sunrpc/xprtrdma/verbs.c | 16 +++++++++++++++- + 2 files changed, 17 insertions(+), 2 deletions(-) + +diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c +index ffbf99894970e..47f33bb7bff81 100644 +--- a/net/sunrpc/xprtrdma/frwr_ops.c ++++ b/net/sunrpc/xprtrdma/frwr_ops.c +@@ -92,7 +92,8 @@ static void frwr_mr_put(struct rpcrdma_mr *mr) + rpcrdma_mr_push(mr, &mr->mr_req->rl_free_mrs); + } + +-/* frwr_reset - Place MRs back on the free list ++/** ++ * frwr_reset - Place MRs back on @req's free list + * @req: request to reset + * + * Used after a failed marshal. For FRWR, this means the MRs +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 4f71627ba39ce..cb909329a5039 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -897,6 +897,8 @@ static int rpcrdma_reqs_setup(struct rpcrdma_xprt *r_xprt) + + static void rpcrdma_req_reset(struct rpcrdma_req *req) + { ++ struct rpcrdma_mr *mr; ++ + /* Credits are valid for only one connection */ + req->rl_slot.rq_cong = 0; + +@@ -906,7 +908,19 @@ static void rpcrdma_req_reset(struct rpcrdma_req *req) + rpcrdma_regbuf_dma_unmap(req->rl_sendbuf); + rpcrdma_regbuf_dma_unmap(req->rl_recvbuf); + +- frwr_reset(req); ++ /* The verbs consumer can't know the state of an MR on the ++ * req->rl_registered list unless a successful completion ++ * has occurred, so they cannot be re-used. ++ */ ++ while ((mr = rpcrdma_mr_pop(&req->rl_registered))) { ++ struct rpcrdma_buffer *buf = &mr->mr_xprt->rx_buf; ++ ++ spin_lock(&buf->rb_lock); ++ list_del(&mr->mr_all); ++ spin_unlock(&buf->rb_lock); ++ ++ frwr_mr_release(mr); ++ } + } + + /* ASSUMPTION: the rb_allreqs list is stable for the duration, +-- +2.43.0 +