From: Sasha Levin Date: Wed, 25 Oct 2023 11:48:00 +0000 (-0400) Subject: Fixes for 6.1 X-Git-Tag: v6.1.61~83 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a9be4b3ff9f3b2b173eb2f483558a0af238b953a;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/asoc-codecs-wcd938x-convert-to-platform-remove-callb.patch b/queue-6.1/asoc-codecs-wcd938x-convert-to-platform-remove-callb.patch new file mode 100644 index 00000000000..3c7fc044e5e --- /dev/null +++ b/queue-6.1/asoc-codecs-wcd938x-convert-to-platform-remove-callb.patch @@ -0,0 +1,64 @@ +From 90f8f346f34c85214646d24556b3ada0eb04fffa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 16:05:48 +0100 +Subject: ASoC: codecs: wcd938x: Convert to platform remove callback returning + void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 7cd686a59b36860511965882dad1f76df2c25766 ] + +The .remove() callback for a platform driver returns an int which makes +many driver authors wrongly assume it's possible to do error handling by +returning an error code. However the value returned is (mostly) ignored +and this typically results in resource leaks. To improve here there is a +quest to make the remove callback return void. In the first step of this +quest all drivers are converted to .remove_new() which already returns +void. + +Trivially convert this driver from always returning zero in the remove +callback to the void returning variant. + +Signed-off-by: Uwe Kleine-König +Acked-by: Takashi Iwai +Acked-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20230315150745.67084-57-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Stable-dep-of: 69a026a2357e ("ASoC: codecs: wcd938x: fix regulator leaks on probe errors") +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wcd938x.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/codecs/wcd938x.c b/sound/soc/codecs/wcd938x.c +index c3964aa00b288..73d7c92e87242 100644 +--- a/sound/soc/codecs/wcd938x.c ++++ b/sound/soc/codecs/wcd938x.c +@@ -3616,11 +3616,9 @@ static int wcd938x_probe(struct platform_device *pdev) + return 0; + } + +-static int wcd938x_remove(struct platform_device *pdev) ++static void wcd938x_remove(struct platform_device *pdev) + { + component_master_del(&pdev->dev, &wcd938x_comp_ops); +- +- return 0; + } + + #if defined(CONFIG_OF) +@@ -3634,7 +3632,7 @@ MODULE_DEVICE_TABLE(of, wcd938x_dt_match); + + static struct platform_driver wcd938x_codec_driver = { + .probe = wcd938x_probe, +- .remove = wcd938x_remove, ++ .remove_new = wcd938x_remove, + .driver = { + .name = "wcd938x_codec", + .of_match_table = of_match_ptr(wcd938x_dt_match), +-- +2.42.0 + diff --git a/queue-6.1/asoc-codecs-wcd938x-fix-regulator-leaks-on-probe-err.patch b/queue-6.1/asoc-codecs-wcd938x-fix-regulator-leaks-on-probe-err.patch new file mode 100644 index 00000000000..5edf42fe5e0 --- /dev/null +++ b/queue-6.1/asoc-codecs-wcd938x-fix-regulator-leaks-on-probe-err.patch @@ -0,0 +1,80 @@ +From 740d265b7166d7f65520e0a68e9bdb7b7939b79a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Oct 2023 17:55:55 +0200 +Subject: ASoC: codecs: wcd938x: fix regulator leaks on probe errors + +From: Johan Hovold + +[ Upstream commit 69a026a2357ee69983690d07976de44ef26ee38a ] + +Make sure to disable and free the regulators on probe errors and on +driver unbind. + +Fixes: 16572522aece ("ASoC: codecs: wcd938x-sdw: add SoundWire driver") +Cc: stable@vger.kernel.org # 5.14 +Cc: Srinivas Kandagatla +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20231003155558.27079-5-johan+linaro@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wcd938x.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/wcd938x.c b/sound/soc/codecs/wcd938x.c +index f0aa44198f4c5..7181176feb73c 100644 +--- a/sound/soc/codecs/wcd938x.c ++++ b/sound/soc/codecs/wcd938x.c +@@ -3324,8 +3324,10 @@ static int wcd938x_populate_dt_data(struct wcd938x_priv *wcd938x, struct device + return dev_err_probe(dev, ret, "Failed to get supplies\n"); + + ret = regulator_bulk_enable(WCD938X_MAX_SUPPLY, wcd938x->supplies); +- if (ret) ++ if (ret) { ++ regulator_bulk_free(WCD938X_MAX_SUPPLY, wcd938x->supplies); + return dev_err_probe(dev, ret, "Failed to enable supplies\n"); ++ } + + wcd938x_dt_parse_micbias_info(dev, wcd938x); + +@@ -3591,13 +3593,13 @@ static int wcd938x_probe(struct platform_device *pdev) + + ret = wcd938x_add_slave_components(wcd938x, dev, &match); + if (ret) +- return ret; ++ goto err_disable_regulators; + + wcd938x_reset(wcd938x); + + ret = component_master_add_with_match(dev, &wcd938x_comp_ops, match); + if (ret) +- return ret; ++ goto err_disable_regulators; + + pm_runtime_set_autosuspend_delay(dev, 1000); + pm_runtime_use_autosuspend(dev); +@@ -3607,11 +3609,21 @@ static int wcd938x_probe(struct platform_device *pdev) + pm_runtime_idle(dev); + + return 0; ++ ++err_disable_regulators: ++ regulator_bulk_disable(WCD938X_MAX_SUPPLY, wcd938x->supplies); ++ regulator_bulk_free(WCD938X_MAX_SUPPLY, wcd938x->supplies); ++ ++ return ret; + } + + static void wcd938x_remove(struct platform_device *pdev) + { ++ struct wcd938x_priv *wcd938x = dev_get_drvdata(&pdev->dev); ++ + component_master_del(&pdev->dev, &wcd938x_comp_ops); ++ regulator_bulk_disable(WCD938X_MAX_SUPPLY, wcd938x->supplies); ++ regulator_bulk_free(WCD938X_MAX_SUPPLY, wcd938x->supplies); + } + + #if defined(CONFIG_OF) +-- +2.42.0 + diff --git a/queue-6.1/asoc-codecs-wcd938x-fix-runtime-pm-imbalance-on-remo.patch b/queue-6.1/asoc-codecs-wcd938x-fix-runtime-pm-imbalance-on-remo.patch new file mode 100644 index 00000000000..6ecb57c6b5a --- /dev/null +++ b/queue-6.1/asoc-codecs-wcd938x-fix-runtime-pm-imbalance-on-remo.patch @@ -0,0 +1,48 @@ +From 48854878fd6970171c6fbe7826eb8fc8fa4fb5b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Oct 2023 17:55:56 +0200 +Subject: ASoC: codecs: wcd938x: fix runtime PM imbalance on remove + +From: Johan Hovold + +[ Upstream commit 3ebebb2c1eca92a15107b2d7aeff34196fd9e217 ] + +Make sure to balance the runtime PM operations, including the disable +count, on driver unbind. + +Fixes: 16572522aece ("ASoC: codecs: wcd938x-sdw: add SoundWire driver") +Cc: stable@vger.kernel.org # 5.14 +Cc: Srinivas Kandagatla +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20231003155558.27079-6-johan+linaro@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wcd938x.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wcd938x.c b/sound/soc/codecs/wcd938x.c +index 7181176feb73c..a2abd1a111612 100644 +--- a/sound/soc/codecs/wcd938x.c ++++ b/sound/soc/codecs/wcd938x.c +@@ -3619,9 +3619,15 @@ static int wcd938x_probe(struct platform_device *pdev) + + static void wcd938x_remove(struct platform_device *pdev) + { +- struct wcd938x_priv *wcd938x = dev_get_drvdata(&pdev->dev); ++ struct device *dev = &pdev->dev; ++ struct wcd938x_priv *wcd938x = dev_get_drvdata(dev); ++ ++ component_master_del(dev, &wcd938x_comp_ops); ++ ++ pm_runtime_disable(dev); ++ pm_runtime_set_suspended(dev); ++ pm_runtime_dont_use_autosuspend(dev); + +- component_master_del(&pdev->dev, &wcd938x_comp_ops); + regulator_bulk_disable(WCD938X_MAX_SUPPLY, wcd938x->supplies); + regulator_bulk_free(WCD938X_MAX_SUPPLY, wcd938x->supplies); + } +-- +2.42.0 + diff --git a/queue-6.1/asoc-codecs-wcd938x-simplify-with-dev_err_probe.patch b/queue-6.1/asoc-codecs-wcd938x-simplify-with-dev_err_probe.patch new file mode 100644 index 00000000000..45ccff2ec91 --- /dev/null +++ b/queue-6.1/asoc-codecs-wcd938x-simplify-with-dev_err_probe.patch @@ -0,0 +1,75 @@ +From 55407f68cd39f41466fb8d2279fbf870d9819e17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 09:46:30 +0200 +Subject: ASoC: codecs: wcd938x: Simplify with dev_err_probe + +From: Krzysztof Kozlowski + +[ Upstream commit 60ba2fda5280528e70fa26b44e36d1530f6d1d7e ] + +Replace dev_err() in probe() path with dev_err_probe() to: +1. Make code a bit simpler and easier to read, +2. Do not print messages on deferred probe. + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230418074630.8681-4-krzysztof.kozlowski@linaro.org +Signed-off-by: Mark Brown +Stable-dep-of: 69a026a2357e ("ASoC: codecs: wcd938x: fix regulator leaks on probe errors") +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wcd938x.c | 27 ++++++++++----------------- + 1 file changed, 10 insertions(+), 17 deletions(-) + +diff --git a/sound/soc/codecs/wcd938x.c b/sound/soc/codecs/wcd938x.c +index 73d7c92e87242..f0aa44198f4c5 100644 +--- a/sound/soc/codecs/wcd938x.c ++++ b/sound/soc/codecs/wcd938x.c +@@ -3302,18 +3302,15 @@ static int wcd938x_populate_dt_data(struct wcd938x_priv *wcd938x, struct device + int ret; + + wcd938x->reset_gpio = of_get_named_gpio(dev->of_node, "reset-gpios", 0); +- if (wcd938x->reset_gpio < 0) { +- dev_err(dev, "Failed to get reset gpio: err = %d\n", +- wcd938x->reset_gpio); +- return wcd938x->reset_gpio; +- } ++ if (wcd938x->reset_gpio < 0) ++ return dev_err_probe(dev, wcd938x->reset_gpio, ++ "Failed to get reset gpio\n"); + + wcd938x->us_euro_gpio = devm_gpiod_get_optional(dev, "us-euro", + GPIOD_OUT_LOW); +- if (IS_ERR(wcd938x->us_euro_gpio)) { +- dev_err(dev, "us-euro swap Control GPIO not found\n"); +- return PTR_ERR(wcd938x->us_euro_gpio); +- } ++ if (IS_ERR(wcd938x->us_euro_gpio)) ++ return dev_err_probe(dev, PTR_ERR(wcd938x->us_euro_gpio), ++ "us-euro swap Control GPIO not found\n"); + + cfg->swap_gnd_mic = wcd938x_swap_gnd_mic; + +@@ -3323,16 +3320,12 @@ static int wcd938x_populate_dt_data(struct wcd938x_priv *wcd938x, struct device + wcd938x->supplies[3].supply = "vdd-mic-bias"; + + ret = regulator_bulk_get(dev, WCD938X_MAX_SUPPLY, wcd938x->supplies); +- if (ret) { +- dev_err(dev, "Failed to get supplies: err = %d\n", ret); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to get supplies\n"); + + ret = regulator_bulk_enable(WCD938X_MAX_SUPPLY, wcd938x->supplies); +- if (ret) { +- dev_err(dev, "Failed to enable supplies: err = %d\n", ret); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to enable supplies\n"); + + wcd938x_dt_parse_micbias_info(dev, wcd938x); + +-- +2.42.0 + diff --git a/queue-6.1/kvm-x86-pmu-truncate-counter-value-to-allowed-width-.patch b/queue-6.1/kvm-x86-pmu-truncate-counter-value-to-allowed-width-.patch new file mode 100644 index 00000000000..46dd94a5716 --- /dev/null +++ b/queue-6.1/kvm-x86-pmu-truncate-counter-value-to-allowed-width-.patch @@ -0,0 +1,101 @@ +From 76da8887abaa6aa6d00484823d5b4e2a13b3c89d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 14:00:42 +0200 +Subject: KVM: x86/pmu: Truncate counter value to allowed width on write + +From: Roman Kagan + +[ Upstream commit b29a2acd36dd7a33c63f260df738fb96baa3d4f8 ] + +Performance counters are defined to have width less than 64 bits. The +vPMU code maintains the counters in u64 variables but assumes the value +to fit within the defined width. However, for Intel non-full-width +counters (MSR_IA32_PERFCTRx) the value receieved from the guest is +truncated to 32 bits and then sign-extended to full 64 bits. If a +negative value is set, it's sign-extended to 64 bits, but then in +kvm_pmu_incr_counter() it's incremented, truncated, and compared to the +previous value for overflow detection. + +That previous value is not truncated, so it always evaluates bigger than +the truncated new one, and a PMI is injected. If the PMI handler writes +a negative counter value itself, the vCPU never quits the PMI loop. + +Turns out that Linux PMI handler actually does write the counter with +the value just read with RDPMC, so when no full-width support is exposed +via MSR_IA32_PERF_CAPABILITIES, and the guest initializes the counter to +a negative value, it locks up. + +This has been observed in the field, for example, when the guest configures +atop to use perfevents and runs two instances of it simultaneously. + +To address the problem, maintain the invariant that the counter value +always fits in the defined bit width, by truncating the received value +in the respective set_msr methods. For better readability, factor the +out into a helper function, pmc_write_counter(), shared by vmx and svm +parts. + +Fixes: 9cd803d496e7 ("KVM: x86: Update vPMCs when retiring instructions") +Cc: stable@vger.kernel.org +Signed-off-by: Roman Kagan +Link: https://lore.kernel.org/all/20230504120042.785651-1-rkagan@amazon.de +Tested-by: Like Xu +[sean: tweak changelog, s/set/write in the helper] +Signed-off-by: Sean Christopherson +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/pmu.h | 6 ++++++ + arch/x86/kvm/svm/pmu.c | 2 +- + arch/x86/kvm/vmx/pmu_intel.c | 4 ++-- + 3 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kvm/pmu.h b/arch/x86/kvm/pmu.h +index c976490b75568..3666578b88a00 100644 +--- a/arch/x86/kvm/pmu.h ++++ b/arch/x86/kvm/pmu.h +@@ -63,6 +63,12 @@ static inline u64 pmc_read_counter(struct kvm_pmc *pmc) + return counter & pmc_bitmask(pmc); + } + ++static inline void pmc_write_counter(struct kvm_pmc *pmc, u64 val) ++{ ++ pmc->counter += val - pmc_read_counter(pmc); ++ pmc->counter &= pmc_bitmask(pmc); ++} ++ + static inline void pmc_release_perf_event(struct kvm_pmc *pmc) + { + if (pmc->perf_event) { +diff --git a/arch/x86/kvm/svm/pmu.c b/arch/x86/kvm/svm/pmu.c +index 9d65cd095691b..1cb2bf9808f57 100644 +--- a/arch/x86/kvm/svm/pmu.c ++++ b/arch/x86/kvm/svm/pmu.c +@@ -149,7 +149,7 @@ static int amd_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + /* MSR_PERFCTRn */ + pmc = get_gp_pmc_amd(pmu, msr, PMU_TYPE_COUNTER); + if (pmc) { +- pmc->counter += data - pmc_read_counter(pmc); ++ pmc_write_counter(pmc, data); + pmc_update_sample_period(pmc); + return 0; + } +diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c +index 9fabfe71fd879..9a75a0d5deae1 100644 +--- a/arch/x86/kvm/vmx/pmu_intel.c ++++ b/arch/x86/kvm/vmx/pmu_intel.c +@@ -461,11 +461,11 @@ static int intel_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + if (!msr_info->host_initiated && + !(msr & MSR_PMC_FULL_WIDTH_BIT)) + data = (s64)(s32)data; +- pmc->counter += data - pmc_read_counter(pmc); ++ pmc_write_counter(pmc, data); + pmc_update_sample_period(pmc); + return 0; + } else if ((pmc = get_fixed_pmc(pmu, msr))) { +- pmc->counter += data - pmc_read_counter(pmc); ++ pmc_write_counter(pmc, data); + pmc_update_sample_period(pmc); + return 0; + } else if ((pmc = get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0))) { +-- +2.42.0 + diff --git a/queue-6.1/mcb-lpc-reallocate-memory-region-to-avoid-memory-ove.patch b/queue-6.1/mcb-lpc-reallocate-memory-region-to-avoid-memory-ove.patch new file mode 100644 index 00000000000..b189b04d770 --- /dev/null +++ b/queue-6.1/mcb-lpc-reallocate-memory-region-to-avoid-memory-ove.patch @@ -0,0 +1,93 @@ +From 35acc668dd4fc2534fcc2d5450d38390d9b3a5de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 10:33:29 +0200 +Subject: mcb-lpc: Reallocate memory region to avoid memory overlapping +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rodríguez Barbarin, José Javier + +[ Upstream commit 2025b2ca8004c04861903d076c67a73a0ec6dfca ] + +mcb-lpc requests a fixed-size memory region to parse the chameleon +table, however, if the chameleon table is smaller that the allocated +region, it could overlap with the IP Cores' memory regions. + +After parsing the chameleon table, drop/reallocate the memory region +with the actual chameleon table size. + +Co-developed-by: Jorge Sanjuan Garcia +Signed-off-by: Jorge Sanjuan Garcia +Signed-off-by: Javier Rodriguez +Signed-off-by: Johannes Thumshirn +Link: https://lore.kernel.org/r/20230411083329.4506-4-jth@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/mcb/mcb-lpc.c | 35 +++++++++++++++++++++++++++++++---- + 1 file changed, 31 insertions(+), 4 deletions(-) + +diff --git a/drivers/mcb/mcb-lpc.c b/drivers/mcb/mcb-lpc.c +index 53decd89876ee..a851e02364642 100644 +--- a/drivers/mcb/mcb-lpc.c ++++ b/drivers/mcb/mcb-lpc.c +@@ -23,7 +23,7 @@ static int mcb_lpc_probe(struct platform_device *pdev) + { + struct resource *res; + struct priv *priv; +- int ret = 0; ++ int ret = 0, table_size; + + priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL); + if (!priv) +@@ -58,16 +58,43 @@ static int mcb_lpc_probe(struct platform_device *pdev) + + ret = chameleon_parse_cells(priv->bus, priv->mem->start, priv->base); + if (ret < 0) { +- mcb_release_bus(priv->bus); +- return ret; ++ goto out_mcb_bus; + } + +- dev_dbg(&pdev->dev, "Found %d cells\n", ret); ++ table_size = ret; ++ ++ if (table_size < CHAM_HEADER_SIZE) { ++ /* Release the previous resources */ ++ devm_iounmap(&pdev->dev, priv->base); ++ devm_release_mem_region(&pdev->dev, priv->mem->start, resource_size(priv->mem)); ++ ++ /* Then, allocate it again with the actual chameleon table size */ ++ res = devm_request_mem_region(&pdev->dev, priv->mem->start, ++ table_size, ++ KBUILD_MODNAME); ++ if (!res) { ++ dev_err(&pdev->dev, "Failed to request PCI memory\n"); ++ ret = -EBUSY; ++ goto out_mcb_bus; ++ } ++ ++ priv->base = devm_ioremap(&pdev->dev, priv->mem->start, table_size); ++ if (!priv->base) { ++ dev_err(&pdev->dev, "Cannot ioremap\n"); ++ ret = -ENOMEM; ++ goto out_mcb_bus; ++ } ++ ++ platform_set_drvdata(pdev, priv); ++ } + + mcb_bus_add_devices(priv->bus); + + return 0; + ++out_mcb_bus: ++ mcb_release_bus(priv->bus); ++ return ret; + } + + static int mcb_lpc_remove(struct platform_device *pdev) +-- +2.42.0 + diff --git a/queue-6.1/mcb-return-actual-parsed-size-when-reading-chameleon.patch b/queue-6.1/mcb-return-actual-parsed-size-when-reading-chameleon.patch new file mode 100644 index 00000000000..6635e4e17d2 --- /dev/null +++ b/queue-6.1/mcb-return-actual-parsed-size-when-reading-chameleon.patch @@ -0,0 +1,81 @@ +From b17b1e5855b8df645480de9b45c86e8942bb7660 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 10:33:27 +0200 +Subject: mcb: Return actual parsed size when reading chameleon table +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rodríguez Barbarin, José Javier + +[ Upstream commit a889c276d33d333ae96697510f33533f6e9d9591 ] + +The function chameleon_parse_cells() returns the number of cells +parsed which has an undetermined size. This return value is only +used for error checking but the number of cells is never used. + +Change return value to be number of bytes parsed to allow for +memory management improvements. + +Co-developed-by: Jorge Sanjuan Garcia +Signed-off-by: Jorge Sanjuan Garcia +Signed-off-by: Javier Rodriguez +Signed-off-by: Johannes Thumshirn +Link: https://lore.kernel.org/r/20230411083329.4506-2-jth@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/mcb/mcb-parse.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c +index c41cbacc75a2c..656b6b71c7682 100644 +--- a/drivers/mcb/mcb-parse.c ++++ b/drivers/mcb/mcb-parse.c +@@ -128,7 +128,7 @@ static void chameleon_parse_bar(void __iomem *base, + } + } + +-static int chameleon_get_bar(char __iomem **base, phys_addr_t mapbase, ++static int chameleon_get_bar(void __iomem **base, phys_addr_t mapbase, + struct chameleon_bar **cb) + { + struct chameleon_bar *c; +@@ -177,12 +177,13 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase, + { + struct chameleon_fpga_header *header; + struct chameleon_bar *cb; +- char __iomem *p = base; ++ void __iomem *p = base; + int num_cells = 0; + uint32_t dtype; + int bar_count; + int ret; + u32 hsize; ++ u32 table_size; + + hsize = sizeof(struct chameleon_fpga_header); + +@@ -237,12 +238,16 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase, + num_cells++; + } + +- if (num_cells == 0) +- num_cells = -EINVAL; ++ if (num_cells == 0) { ++ ret = -EINVAL; ++ goto free_bar; ++ } + ++ table_size = p - base; ++ pr_debug("%d cell(s) found. Chameleon table size: 0x%04x bytes\n", num_cells, table_size); + kfree(cb); + kfree(header); +- return num_cells; ++ return table_size; + + free_bar: + kfree(cb); +-- +2.42.0 + diff --git a/queue-6.1/mmc-block-ioctl-do-write-error-check-for-spi.patch b/queue-6.1/mmc-block-ioctl-do-write-error-check-for-spi.patch new file mode 100644 index 00000000000..fd739f6b441 --- /dev/null +++ b/queue-6.1/mmc-block-ioctl-do-write-error-check-for-spi.patch @@ -0,0 +1,52 @@ +From 7ca0ffedfd777cdf271a683ebeae69fc20c8a9c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 09:56:04 +0000 +Subject: mmc: block: ioctl: do write error check for spi + +From: Christian Loehle + +[ Upstream commit 568898cbc8b570311b3b94a3202b8233f4168144 ] + +SPI doesn't have the usual PROG path we can check for error bits +after moving back to TRAN. Instead it holds the line LOW until +completion. We can then check if the card shows any errors or +is in IDLE state, indicating the line is no longer LOW because +the card was reset. + +Signed-off-by: Christian Loehle +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/55920f880c9742f486f64aa44e25508e@hyperstone.com +Signed-off-by: Ulf Hansson +Stable-dep-of: f19c5a73e6f7 ("mmc: core: Fix error propagation for some ioctl commands") +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/block.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index baefe2886f0b2..1aab4f47eab98 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -180,6 +180,7 @@ static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq, + int recovery_mode, + struct mmc_queue *mq); + static void mmc_blk_hsq_req_done(struct mmc_request *mrq); ++static int mmc_spi_err_check(struct mmc_card *card); + + static struct mmc_blk_data *mmc_blk_get(struct gendisk *disk) + { +@@ -623,6 +624,11 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, + if ((card->host->caps & MMC_CAP_WAIT_WHILE_BUSY) && use_r1b_resp) + return 0; + ++ if (mmc_host_is_spi(card->host)) { ++ if (idata->ic.write_flag || r1b_resp || cmd.flags & MMC_RSP_SPI_BUSY) ++ return mmc_spi_err_check(card); ++ return err; ++ } + /* Ensure RPMB/R1B command has completed by polling with CMD13. */ + if (idata->rpmb || r1b_resp) + err = mmc_poll_for_busy(card, busy_timeout_ms, false, +-- +2.42.0 + diff --git a/queue-6.1/mmc-core-align-to-common-busy-polling-behaviour-for-.patch b/queue-6.1/mmc-core-align-to-common-busy-polling-behaviour-for-.patch new file mode 100644 index 00000000000..babd2abad87 --- /dev/null +++ b/queue-6.1/mmc-core-align-to-common-busy-polling-behaviour-for-.patch @@ -0,0 +1,95 @@ +From 12b8930ad2355a26e9f45dcced16a928858427b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 14:37:07 +0100 +Subject: mmc: core: Align to common busy polling behaviour for mmc ioctls + +From: Ulf Hansson + +[ Upstream commit 51f5b3056790bc0518e49587996f1e6f3058cca9 ] + +Let's align to the common busy polling behaviour for mmc ioctls, by +updating the below two corresponding parts, that comes into play when using +an R1B response for a command. + +*) A command with an R1B response should be prepared by calling +mmc_prepare_busy_cmd(), which make us respects the host's busy timeout +constraints. +**) When an R1B response is being used and the host also supports HW busy +detection, we should skip to poll for busy completion. + +Suggested-by: Christian Loehle +Signed-off-by: Ulf Hansson +Reviewed-by: Christian Loehle +Link: https://lore.kernel.org/r/20230213133707.27857-1-ulf.hansson@linaro.org +Stable-dep-of: f19c5a73e6f7 ("mmc: core: Fix error propagation for some ioctl commands") +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/block.c | 25 +++++++++++++++++-------- + drivers/mmc/core/mmc_ops.c | 1 + + 2 files changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index cdd7f126d4aea..baefe2886f0b2 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -471,6 +471,8 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, + struct mmc_data data = {}; + struct mmc_request mrq = {}; + struct scatterlist sg; ++ bool r1b_resp, use_r1b_resp = false; ++ unsigned int busy_timeout_ms; + int err; + unsigned int target_part; + +@@ -559,6 +561,13 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, + (cmd.opcode == MMC_SWITCH)) + return mmc_sanitize(card, idata->ic.cmd_timeout_ms); + ++ /* If it's an R1B response we need some more preparations. */ ++ busy_timeout_ms = idata->ic.cmd_timeout_ms ? : MMC_BLK_TIMEOUT_MS; ++ r1b_resp = (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B; ++ if (r1b_resp) ++ use_r1b_resp = mmc_prepare_busy_cmd(card->host, &cmd, ++ busy_timeout_ms); ++ + mmc_wait_for_req(card->host, &mrq); + memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp)); + +@@ -610,14 +619,14 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, + if (idata->ic.postsleep_min_us) + usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us); + +- if (idata->rpmb || (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B) { +- /* +- * Ensure RPMB/R1B command has completed by polling CMD13 "Send Status". Here we +- * allow to override the default timeout value if a custom timeout is specified. +- */ +- err = mmc_poll_for_busy(card, idata->ic.cmd_timeout_ms ? : MMC_BLK_TIMEOUT_MS, +- false, MMC_BUSY_IO); +- } ++ /* No need to poll when using HW busy detection. */ ++ if ((card->host->caps & MMC_CAP_WAIT_WHILE_BUSY) && use_r1b_resp) ++ return 0; ++ ++ /* Ensure RPMB/R1B command has completed by polling with CMD13. */ ++ if (idata->rpmb || r1b_resp) ++ err = mmc_poll_for_busy(card, busy_timeout_ms, false, ++ MMC_BUSY_IO); + + return err; + } +diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c +index 81c55bfd6e0c2..3b3adbddf6641 100644 +--- a/drivers/mmc/core/mmc_ops.c ++++ b/drivers/mmc/core/mmc_ops.c +@@ -575,6 +575,7 @@ bool mmc_prepare_busy_cmd(struct mmc_host *host, struct mmc_command *cmd, + cmd->busy_timeout = timeout_ms; + return true; + } ++EXPORT_SYMBOL_GPL(mmc_prepare_busy_cmd); + + /** + * __mmc_switch - modify EXT_CSD register +-- +2.42.0 + diff --git a/queue-6.1/mmc-core-fix-error-propagation-for-some-ioctl-comman.patch b/queue-6.1/mmc-core-fix-error-propagation-for-some-ioctl-comman.patch new file mode 100644 index 00000000000..59227a1edf5 --- /dev/null +++ b/queue-6.1/mmc-core-fix-error-propagation-for-some-ioctl-comman.patch @@ -0,0 +1,100 @@ +From 7fa091612306a00052153f69a1b8d42476050c0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Sep 2023 13:29:21 +0200 +Subject: mmc: core: Fix error propagation for some ioctl commands + +From: Ulf Hansson + +[ Upstream commit f19c5a73e6f78d69efce66cfdce31148c76a61a6 ] + +Userspace has currently no way of checking the internal R1 response error +bits for some commands. This is a problem for some commands, like RPMB for +example. Typically, we may detect that the busy completion has successfully +ended, while in fact the card did not complete the requested operation. + +To fix the problem, let's always poll with CMD13 for these commands and +during the polling, let's also aggregate the R1 response bits. Before +completing the ioctl request, let's propagate the R1 response bits too. + +Reviewed-by: Avri Altman +Co-developed-by: Christian Loehle +Signed-off-by: Christian Loehle +Signed-off-by: Ulf Hansson +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230913112921.553019-1-ulf.hansson@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/block.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 1aab4f47eab98..1fc6767f18782 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -181,6 +181,7 @@ static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq, + struct mmc_queue *mq); + static void mmc_blk_hsq_req_done(struct mmc_request *mrq); + static int mmc_spi_err_check(struct mmc_card *card); ++static int mmc_blk_busy_cb(void *cb_data, bool *busy); + + static struct mmc_blk_data *mmc_blk_get(struct gendisk *disk) + { +@@ -472,7 +473,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, + struct mmc_data data = {}; + struct mmc_request mrq = {}; + struct scatterlist sg; +- bool r1b_resp, use_r1b_resp = false; ++ bool r1b_resp; + unsigned int busy_timeout_ms; + int err; + unsigned int target_part; +@@ -566,8 +567,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, + busy_timeout_ms = idata->ic.cmd_timeout_ms ? : MMC_BLK_TIMEOUT_MS; + r1b_resp = (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B; + if (r1b_resp) +- use_r1b_resp = mmc_prepare_busy_cmd(card->host, &cmd, +- busy_timeout_ms); ++ mmc_prepare_busy_cmd(card->host, &cmd, busy_timeout_ms); + + mmc_wait_for_req(card->host, &mrq); + memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp)); +@@ -620,19 +620,28 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, + if (idata->ic.postsleep_min_us) + usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us); + +- /* No need to poll when using HW busy detection. */ +- if ((card->host->caps & MMC_CAP_WAIT_WHILE_BUSY) && use_r1b_resp) +- return 0; +- + if (mmc_host_is_spi(card->host)) { + if (idata->ic.write_flag || r1b_resp || cmd.flags & MMC_RSP_SPI_BUSY) + return mmc_spi_err_check(card); + return err; + } +- /* Ensure RPMB/R1B command has completed by polling with CMD13. */ +- if (idata->rpmb || r1b_resp) +- err = mmc_poll_for_busy(card, busy_timeout_ms, false, +- MMC_BUSY_IO); ++ ++ /* ++ * Ensure RPMB, writes and R1B responses are completed by polling with ++ * CMD13. Note that, usually we don't need to poll when using HW busy ++ * detection, but here it's needed since some commands may indicate the ++ * error through the R1 status bits. ++ */ ++ if (idata->rpmb || idata->ic.write_flag || r1b_resp) { ++ struct mmc_blk_busy_data cb_data = { ++ .card = card, ++ }; ++ ++ err = __mmc_poll_for_busy(card->host, 0, busy_timeout_ms, ++ &mmc_blk_busy_cb, &cb_data); ++ ++ idata->ic.response[0] = cb_data.status; ++ } + + return err; + } +-- +2.42.0 + diff --git a/queue-6.1/pinctrl-qcom-lpass-lpi-fix-concurrent-register-updat.patch b/queue-6.1/pinctrl-qcom-lpass-lpi-fix-concurrent-register-updat.patch new file mode 100644 index 00000000000..baf8275d416 --- /dev/null +++ b/queue-6.1/pinctrl-qcom-lpass-lpi-fix-concurrent-register-updat.patch @@ -0,0 +1,124 @@ +From 56c073d6670278d3fe9cd941dfce6507d5ba1f8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Oct 2023 16:57:05 +0200 +Subject: pinctrl: qcom: lpass-lpi: fix concurrent register updates + +From: Krzysztof Kozlowski + +[ Upstream commit c8befdc411e5fd1bf95a13e8744c8ca79b412bee ] + +The Qualcomm LPASS LPI pin controller driver uses one lock for guarding +Read-Modify-Write code for slew rate registers. However the pin +configuration and muxing registers have exactly the same RMW code but +are not protected. + +Pin controller framework does not provide locking here, thus it is +possible to trigger simultaneous change of pin configuration registers +resulting in non-atomic changes. + +Protect from concurrent access by re-using the same lock used to cover +the slew rate register. Using the same lock instead of adding second +one will make more sense, once we add support for newer Qualcomm SoC, +where slew rate is configured in the same register as pin +configuration/muxing. + +Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver") +Cc: stable@vger.kernel.org +Reviewed-by: Linus Walleij +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20231013145705.219954-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c +index a55998ae29fa4..bfcc5c45b8fa5 100644 +--- a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c ++++ b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c +@@ -24,7 +24,8 @@ struct lpi_pinctrl { + char __iomem *tlmm_base; + char __iomem *slew_base; + struct clk_bulk_data clks[MAX_LPI_NUM_CLKS]; +- struct mutex slew_access_lock; ++ /* Protects from concurrent register updates */ ++ struct mutex lock; + const struct lpi_pinctrl_variant_data *data; + }; + +@@ -94,9 +95,11 @@ static int lpi_gpio_set_mux(struct pinctrl_dev *pctldev, unsigned int function, + if (WARN_ON(i == g->nfuncs)) + return -EINVAL; + ++ mutex_lock(&pctrl->lock); + val = lpi_gpio_read(pctrl, pin, LPI_GPIO_CFG_REG); + u32p_replace_bits(&val, i, LPI_GPIO_FUNCTION_MASK); + lpi_gpio_write(pctrl, pin, LPI_GPIO_CFG_REG, val); ++ mutex_unlock(&pctrl->lock); + + return 0; + } +@@ -202,14 +205,14 @@ static int lpi_config_set(struct pinctrl_dev *pctldev, unsigned int group, + if (slew_offset == LPI_NO_SLEW) + break; + +- mutex_lock(&pctrl->slew_access_lock); ++ mutex_lock(&pctrl->lock); + + sval = ioread32(pctrl->slew_base + LPI_SLEW_RATE_CTL_REG); + sval &= ~(LPI_SLEW_RATE_MASK << slew_offset); + sval |= arg << slew_offset; + iowrite32(sval, pctrl->slew_base + LPI_SLEW_RATE_CTL_REG); + +- mutex_unlock(&pctrl->slew_access_lock); ++ mutex_unlock(&pctrl->lock); + break; + default: + return -EINVAL; +@@ -225,6 +228,7 @@ static int lpi_config_set(struct pinctrl_dev *pctldev, unsigned int group, + lpi_gpio_write(pctrl, group, LPI_GPIO_VALUE_REG, val); + } + ++ mutex_lock(&pctrl->lock); + val = lpi_gpio_read(pctrl, group, LPI_GPIO_CFG_REG); + + u32p_replace_bits(&val, pullup, LPI_GPIO_PULL_MASK); +@@ -233,6 +237,7 @@ static int lpi_config_set(struct pinctrl_dev *pctldev, unsigned int group, + u32p_replace_bits(&val, output_enabled, LPI_GPIO_OE_MASK); + + lpi_gpio_write(pctrl, group, LPI_GPIO_CFG_REG, val); ++ mutex_unlock(&pctrl->lock); + + return 0; + } +@@ -432,7 +437,7 @@ int lpi_pinctrl_probe(struct platform_device *pdev) + pctrl->chip.of_gpio_n_cells = 2; + pctrl->chip.can_sleep = false; + +- mutex_init(&pctrl->slew_access_lock); ++ mutex_init(&pctrl->lock); + + pctrl->ctrl = devm_pinctrl_register(dev, &pctrl->desc, pctrl); + if (IS_ERR(pctrl->ctrl)) { +@@ -454,7 +459,7 @@ int lpi_pinctrl_probe(struct platform_device *pdev) + return 0; + + err_pinctrl: +- mutex_destroy(&pctrl->slew_access_lock); ++ mutex_destroy(&pctrl->lock); + clk_bulk_disable_unprepare(MAX_LPI_NUM_CLKS, pctrl->clks); + + return ret; +@@ -466,7 +471,7 @@ int lpi_pinctrl_remove(struct platform_device *pdev) + struct lpi_pinctrl *pctrl = platform_get_drvdata(pdev); + int i; + +- mutex_destroy(&pctrl->slew_access_lock); ++ mutex_destroy(&pctrl->lock); + clk_bulk_disable_unprepare(MAX_LPI_NUM_CLKS, pctrl->clks); + + for (i = 0; i < pctrl->data->npins; i++) +-- +2.42.0 + diff --git a/queue-6.1/series b/queue-6.1/series new file mode 100644 index 00000000000..0e95d4ef744 --- /dev/null +++ b/queue-6.1/series @@ -0,0 +1,11 @@ +kvm-x86-pmu-truncate-counter-value-to-allowed-width-.patch +mmc-core-align-to-common-busy-polling-behaviour-for-.patch +mmc-block-ioctl-do-write-error-check-for-spi.patch +mmc-core-fix-error-propagation-for-some-ioctl-comman.patch +asoc-codecs-wcd938x-convert-to-platform-remove-callb.patch +asoc-codecs-wcd938x-simplify-with-dev_err_probe.patch +asoc-codecs-wcd938x-fix-regulator-leaks-on-probe-err.patch +asoc-codecs-wcd938x-fix-runtime-pm-imbalance-on-remo.patch +pinctrl-qcom-lpass-lpi-fix-concurrent-register-updat.patch +mcb-return-actual-parsed-size-when-reading-chameleon.patch +mcb-lpc-reallocate-memory-region-to-avoid-memory-ove.patch