From: Sasha Levin Date: Sun, 1 Dec 2024 12:06:17 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v4.19.325~120 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ad9df8842840f310683b1ba883265610ca8d0dbe;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/acpi-arm64-adjust-error-handling-procedure-in-gtdt_p.patch b/queue-5.4/acpi-arm64-adjust-error-handling-procedure-in-gtdt_p.patch new file mode 100644 index 00000000000..5533f6beafe --- /dev/null +++ b/queue-5.4/acpi-arm64-adjust-error-handling-procedure-in-gtdt_p.patch @@ -0,0 +1,46 @@ +From 0c176595141e6ad46e65318794a75b22eacc084f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2024 13:12:39 +0300 +Subject: acpi/arm64: Adjust error handling procedure in + gtdt_parse_timer_block() + +From: Aleksandr Mishin + +[ Upstream commit 1a9de2f6fda69d5f105dd8af776856a66abdaa64 ] + +In case of error in gtdt_parse_timer_block() invalid 'gtdt_frame' +will be used in 'do {} while (i-- >= 0 && gtdt_frame--);' statement block +because do{} block will be executed even if 'i == 0'. + +Adjust error handling procedure by replacing 'i-- >= 0' with 'i-- > 0'. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: a712c3ed9b8a ("acpi/arm64: Add memory-mapped timer support in GTDT driver") +Signed-off-by: Aleksandr Mishin +Acked-by: Hanjun Guo +Acked-by: Sudeep Holla +Acked-by: Aleksandr Mishin +Link: https://lore.kernel.org/r/20240827101239.22020-1-amishin@t-argos.ru +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + drivers/acpi/arm64/gtdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/arm64/gtdt.c b/drivers/acpi/arm64/gtdt.c +index 311419d1d6b05..b00724700f552 100644 +--- a/drivers/acpi/arm64/gtdt.c ++++ b/drivers/acpi/arm64/gtdt.c +@@ -283,7 +283,7 @@ static int __init gtdt_parse_timer_block(struct acpi_gtdt_timer_block *block, + if (frame->virt_irq > 0) + acpi_unregister_gsi(gtdt_frame->virtual_timer_interrupt); + frame->virt_irq = 0; +- } while (i-- >= 0 && gtdt_frame--); ++ } while (i-- > 0 && gtdt_frame--); + + return -EINVAL; + } +-- +2.43.0 + diff --git a/queue-5.4/alsa-6fire-release-resources-at-card-release.patch b/queue-5.4/alsa-6fire-release-resources-at-card-release.patch new file mode 100644 index 00000000000..2bf0dc89f3d --- /dev/null +++ b/queue-5.4/alsa-6fire-release-resources-at-card-release.patch @@ -0,0 +1,78 @@ +From 081b5a04e02e0a353ff1d24df48427d15f524fb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2024 12:10:39 +0100 +Subject: ALSA: 6fire: Release resources at card release + +From: Takashi Iwai + +[ Upstream commit a0810c3d6dd2d29a9b92604d682eacd2902ce947 ] + +The current 6fire code tries to release the resources right after the +call of usb6fire_chip_abort(). But at this moment, the card object +might be still in use (as we're calling snd_card_free_when_closed()). + +For avoid potential UAFs, move the release of resources to the card's +private_free instead of the manual call of usb6fire_chip_destroy() at +the USB disconnect callback. + +Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB") +Signed-off-by: Takashi Iwai +Link: https://patch.msgid.link/20241113111042.15058-6-tiwai@suse.de +Signed-off-by: Sasha Levin +--- + sound/usb/6fire/chip.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c +index 08c6e6a52eb98..ad6f89845a5c2 100644 +--- a/sound/usb/6fire/chip.c ++++ b/sound/usb/6fire/chip.c +@@ -62,8 +62,10 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) + } + } + +-static void usb6fire_chip_destroy(struct sfire_chip *chip) ++static void usb6fire_card_free(struct snd_card *card) + { ++ struct sfire_chip *chip = card->private_data; ++ + if (chip) { + if (chip->pcm) + usb6fire_pcm_destroy(chip); +@@ -73,8 +75,6 @@ static void usb6fire_chip_destroy(struct sfire_chip *chip) + usb6fire_comm_destroy(chip); + if (chip->control) + usb6fire_control_destroy(chip); +- if (chip->card) +- snd_card_free(chip->card); + } + } + +@@ -137,6 +137,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, + chip->regidx = regidx; + chip->intf_count = 1; + chip->card = card; ++ card->private_free = usb6fire_card_free; + + ret = usb6fire_comm_init(chip); + if (ret < 0) +@@ -163,7 +164,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, + return 0; + + destroy_chip: +- usb6fire_chip_destroy(chip); ++ snd_card_free(card); + return ret; + } + +@@ -182,7 +183,6 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf) + + chip->shutdown = true; + usb6fire_chip_abort(chip); +- usb6fire_chip_destroy(chip); + } + } + } +-- +2.43.0 + diff --git a/queue-5.4/alsa-caiaq-use-snd_card_free_when_closed-at-disconne.patch b/queue-5.4/alsa-caiaq-use-snd_card_free_when_closed-at-disconne.patch new file mode 100644 index 00000000000..d7287d3a9ae --- /dev/null +++ b/queue-5.4/alsa-caiaq-use-snd_card_free_when_closed-at-disconne.patch @@ -0,0 +1,168 @@ +From fb22c29633dfc4c6d1553e3106b3d8375053938f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2024 12:10:38 +0100 +Subject: ALSA: caiaq: Use snd_card_free_when_closed() at disconnection + +From: Takashi Iwai + +[ Upstream commit b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c ] + +The USB disconnect callback is supposed to be short and not too-long +waiting. OTOH, the current code uses snd_card_free() at +disconnection, but this waits for the close of all used fds, hence it +can take long. It eventually blocks the upper layer USB ioctls, which +may trigger a soft lockup. + +An easy workaround is to replace snd_card_free() with +snd_card_free_when_closed(). This variant returns immediately while +the release of resources is done asynchronously by the card device +release at the last close. + +This patch also splits the code to the disconnect and the free phases; +the former is called immediately at the USB disconnect callback while +the latter is called from the card destructor. + +Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support") +Signed-off-by: Takashi Iwai +Link: https://patch.msgid.link/20241113111042.15058-5-tiwai@suse.de +Signed-off-by: Sasha Levin +--- + sound/usb/caiaq/audio.c | 10 ++++++++-- + sound/usb/caiaq/audio.h | 1 + + sound/usb/caiaq/device.c | 19 +++++++++++++++---- + sound/usb/caiaq/input.c | 12 +++++++++--- + sound/usb/caiaq/input.h | 1 + + 5 files changed, 34 insertions(+), 9 deletions(-) + +diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c +index 444bb637ce13c..890fc5a34f645 100644 +--- a/sound/usb/caiaq/audio.c ++++ b/sound/usb/caiaq/audio.c +@@ -877,14 +877,20 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev) + return 0; + } + +-void snd_usb_caiaq_audio_free(struct snd_usb_caiaqdev *cdev) ++void snd_usb_caiaq_audio_disconnect(struct snd_usb_caiaqdev *cdev) + { + struct device *dev = caiaqdev_to_dev(cdev); + + dev_dbg(dev, "%s(%p)\n", __func__, cdev); + stream_stop(cdev); ++} ++ ++void snd_usb_caiaq_audio_free(struct snd_usb_caiaqdev *cdev) ++{ ++ struct device *dev = caiaqdev_to_dev(cdev); ++ ++ dev_dbg(dev, "%s(%p)\n", __func__, cdev); + free_urbs(cdev->data_urbs_in); + free_urbs(cdev->data_urbs_out); + kfree(cdev->data_cb_info); + } +- +diff --git a/sound/usb/caiaq/audio.h b/sound/usb/caiaq/audio.h +index 869bf6264d6a0..07f5d064456cf 100644 +--- a/sound/usb/caiaq/audio.h ++++ b/sound/usb/caiaq/audio.h +@@ -3,6 +3,7 @@ + #define CAIAQ_AUDIO_H + + int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev); ++void snd_usb_caiaq_audio_disconnect(struct snd_usb_caiaqdev *cdev); + void snd_usb_caiaq_audio_free(struct snd_usb_caiaqdev *cdev); + + #endif /* CAIAQ_AUDIO_H */ +diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c +index b669e119f6546..13b57fbb6c6a7 100644 +--- a/sound/usb/caiaq/device.c ++++ b/sound/usb/caiaq/device.c +@@ -390,6 +390,17 @@ static void setup_card(struct snd_usb_caiaqdev *cdev) + dev_err(dev, "Unable to set up control system (ret=%d)\n", ret); + } + ++static void card_free(struct snd_card *card) ++{ ++ struct snd_usb_caiaqdev *cdev = caiaqdev(card); ++ ++#ifdef CONFIG_SND_USB_CAIAQ_INPUT ++ snd_usb_caiaq_input_free(cdev); ++#endif ++ snd_usb_caiaq_audio_free(cdev); ++ usb_reset_device(cdev->chip.dev); ++} ++ + static int create_card(struct usb_device *usb_dev, + struct usb_interface *intf, + struct snd_card **cardp) +@@ -503,6 +514,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) + cdev->vendor_name, cdev->product_name, usbpath); + + setup_card(cdev); ++ card->private_free = card_free; + return 0; + + err_kill_urb: +@@ -548,15 +560,14 @@ static void snd_disconnect(struct usb_interface *intf) + snd_card_disconnect(card); + + #ifdef CONFIG_SND_USB_CAIAQ_INPUT +- snd_usb_caiaq_input_free(cdev); ++ snd_usb_caiaq_input_disconnect(cdev); + #endif +- snd_usb_caiaq_audio_free(cdev); ++ snd_usb_caiaq_audio_disconnect(cdev); + + usb_kill_urb(&cdev->ep1_in_urb); + usb_kill_urb(&cdev->midi_out_urb); + +- snd_card_free(card); +- usb_reset_device(interface_to_usbdev(intf)); ++ snd_card_free_when_closed(card); + } + + +diff --git a/sound/usb/caiaq/input.c b/sound/usb/caiaq/input.c +index cd5a8584dbe32..d22dc5553c2cd 100644 +--- a/sound/usb/caiaq/input.c ++++ b/sound/usb/caiaq/input.c +@@ -829,15 +829,21 @@ int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev) + return ret; + } + +-void snd_usb_caiaq_input_free(struct snd_usb_caiaqdev *cdev) ++void snd_usb_caiaq_input_disconnect(struct snd_usb_caiaqdev *cdev) + { + if (!cdev || !cdev->input_dev) + return; + + usb_kill_urb(cdev->ep4_in_urb); ++ input_unregister_device(cdev->input_dev); ++} ++ ++void snd_usb_caiaq_input_free(struct snd_usb_caiaqdev *cdev) ++{ ++ if (!cdev || !cdev->input_dev) ++ return; ++ + usb_free_urb(cdev->ep4_in_urb); + cdev->ep4_in_urb = NULL; +- +- input_unregister_device(cdev->input_dev); + cdev->input_dev = NULL; + } +diff --git a/sound/usb/caiaq/input.h b/sound/usb/caiaq/input.h +index c42891e7be884..fbe267f85d025 100644 +--- a/sound/usb/caiaq/input.h ++++ b/sound/usb/caiaq/input.h +@@ -4,6 +4,7 @@ + + void snd_usb_caiaq_input_dispatch(struct snd_usb_caiaqdev *cdev, char *buf, unsigned int len); + int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev); ++void snd_usb_caiaq_input_disconnect(struct snd_usb_caiaqdev *cdev); + void snd_usb_caiaq_input_free(struct snd_usb_caiaqdev *cdev); + + #endif +-- +2.43.0 + diff --git a/queue-5.4/alsa-us122l-use-snd_card_free_when_closed-at-disconn.patch b/queue-5.4/alsa-us122l-use-snd_card_free_when_closed-at-disconn.patch new file mode 100644 index 00000000000..1abc3c3ecae --- /dev/null +++ b/queue-5.4/alsa-us122l-use-snd_card_free_when_closed-at-disconn.patch @@ -0,0 +1,50 @@ +From e6f33f77c2721e46581b159e70707f16fb08983a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2024 12:10:36 +0100 +Subject: ALSA: us122l: Use snd_card_free_when_closed() at disconnection + +From: Takashi Iwai + +[ Upstream commit b7df09bb348016943f56b09dcaafe221e3f73947 ] + +The USB disconnect callback is supposed to be short and not too-long +waiting. OTOH, the current code uses snd_card_free() at +disconnection, but this waits for the close of all used fds, hence it +can take long. It eventually blocks the upper layer USB ioctls, which +may trigger a soft lockup. + +An easy workaround is to replace snd_card_free() with +snd_card_free_when_closed(). This variant returns immediately while +the release of resources is done asynchronously by the card device +release at the last close. + +The loop of us122l->mmap_count check is dropped as well. The check is +useless for the asynchronous operation with *_when_closed(). + +Fixes: 030a07e44129 ("ALSA: Add USB US122L driver") +Signed-off-by: Takashi Iwai +Link: https://patch.msgid.link/20241113111042.15058-3-tiwai@suse.de +Signed-off-by: Sasha Levin +--- + sound/usb/usx2y/us122l.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c +index e82c5236482df..eb7e57c4a7fdb 100644 +--- a/sound/usb/usx2y/us122l.c ++++ b/sound/usb/usx2y/us122l.c +@@ -636,10 +636,7 @@ static void snd_us122l_disconnect(struct usb_interface *intf) + usb_put_intf(usb_ifnum_to_if(us122l->dev, 1)); + usb_put_dev(us122l->dev); + +- while (atomic_read(&us122l->mmap_count)) +- msleep(500); +- +- snd_card_free(card); ++ snd_card_free_when_closed(card); + } + + static int snd_us122l_suspend(struct usb_interface *intf, pm_message_t message) +-- +2.43.0 + diff --git a/queue-5.4/apparmor-fix-do-simple-duplicate-message-elimination.patch b/queue-5.4/apparmor-fix-do-simple-duplicate-message-elimination.patch new file mode 100644 index 00000000000..ffcf1521079 --- /dev/null +++ b/queue-5.4/apparmor-fix-do-simple-duplicate-message-elimination.patch @@ -0,0 +1,35 @@ +From 03ef24666955547f8747ab48b763b15eca5eec62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 10:03:16 +0800 +Subject: apparmor: fix 'Do simple duplicate message elimination' + +From: chao liu + +[ Upstream commit 9b897132424fe76bf6c61f22f9cf12af7f1d1e6a ] + +Multiple profiles shared 'ent->caps', so some logs missed. + +Fixes: 0ed3b28ab8bf ("AppArmor: mediation of non file objects") +Signed-off-by: chao liu +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/capability.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/security/apparmor/capability.c b/security/apparmor/capability.c +index deccea8654ad8..1b13fd89d5a9f 100644 +--- a/security/apparmor/capability.c ++++ b/security/apparmor/capability.c +@@ -94,6 +94,8 @@ static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile, + return error; + } else { + aa_put_profile(ent->profile); ++ if (profile != ent->profile) ++ cap_clear(ent->caps); + ent->profile = aa_get_profile(profile); + cap_raise(ent->caps, cap); + } +-- +2.43.0 + diff --git a/queue-5.4/arm-dts-cubieboard4-fix-dcdc5-regulator-constraints.patch b/queue-5.4/arm-dts-cubieboard4-fix-dcdc5-regulator-constraints.patch new file mode 100644 index 00000000000..38fd2920cfa --- /dev/null +++ b/queue-5.4/arm-dts-cubieboard4-fix-dcdc5-regulator-constraints.patch @@ -0,0 +1,56 @@ +From 6ba1695c91ae7dd8485fe0d68dbb0696996013d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 23:29:16 +0100 +Subject: ARM: dts: cubieboard4: Fix DCDC5 regulator constraints + +From: Andre Przywara + +[ Upstream commit dd36ad71ad65968f97630808bc8d605c929b128e ] + +The DCDC5 voltage rail in the X-Powers AXP809 PMIC has a resolution of +50mV, so the currently enforced limits of 1.475 and 1.525 volts cannot +be set, when the existing regulator value is beyond this range. + +This will lead to the whole regulator driver to give up and fail +probing, which in turn will hang the system, as essential devices depend +on the PMIC. +In this case a bug in U-Boot set the voltage to 1.75V (meant for DCDC4), +and the AXP driver's attempt to correct this lead to this error: +================== +[ 4.447653] axp20x-rsb sunxi-rsb-3a3: AXP20X driver loaded +[ 4.450066] vcc-dram: Bringing 1750000uV into 1575000-1575000uV +[ 4.460272] vcc-dram: failed to apply 1575000-1575000uV constraint: -EINVAL +[ 4.474788] axp20x-regulator axp20x-regulator.0: Failed to register dcdc5 +[ 4.482276] axp20x-regulator axp20x-regulator.0: probe with driver axp20x-regulator failed with error -22 +================== + +Set the limits to values that can be programmed, so any correction will +be successful. + +Signed-off-by: Andre Przywara +Fixes: 1e1dea72651b ("ARM: dts: sun9i: cubieboard4: Add AXP809 PMIC device node and regulators") +Link: https://patch.msgid.link/20241007222916.19013-1-andre.przywara@arm.com +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun9i-a80-cubieboard4.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts b/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts +index 484b93df20cb6..c7a3bf3cc3407 100644 +--- a/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts ++++ b/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts +@@ -280,8 +280,8 @@ reg_dcdc4: dcdc4 { + + reg_dcdc5: dcdc5 { + regulator-always-on; +- regulator-min-microvolt = <1425000>; +- regulator-max-microvolt = <1575000>; ++ regulator-min-microvolt = <1450000>; ++ regulator-max-microvolt = <1550000>; + regulator-name = "vcc-dram"; + }; + +-- +2.43.0 + diff --git a/queue-5.4/asoc-fsl_micfil-do-not-define-shift-mask-for-single-.patch b/queue-5.4/asoc-fsl_micfil-do-not-define-shift-mask-for-single-.patch new file mode 100644 index 00000000000..8d923d9ea3d --- /dev/null +++ b/queue-5.4/asoc-fsl_micfil-do-not-define-shift-mask-for-single-.patch @@ -0,0 +1,275 @@ +From cf364cc7fceb3ad1f75b29406736add6b26f9782 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 18:22:32 +0200 +Subject: ASoC: fsl_micfil: do not define SHIFT/MASK for single bits + +From: Sascha Hauer + +[ Upstream commit bd2cffd10d79eb9280cb8f5b7cb441f206c1e6ac ] + +No need to have defines for the mask of single bits. Also shift is +unused. Drop all these unnecessary defines. + +Signed-off-by: Sascha Hauer +Acked-by: Shengjiu Wang +Link: https://lore.kernel.org/r/20220414162249.3934543-5-s.hauer@pengutronix.de +Signed-off-by: Mark Brown +Stable-dep-of: 06df673d2023 ("ASoC: fsl_micfil: fix regmap_write_bits usage") +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_micfil.c | 18 +++--- + sound/soc/fsl/fsl_micfil.h | 125 +++++++++---------------------------- + 2 files changed, 40 insertions(+), 103 deletions(-) + +diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c +index a69237b7f564a..d9e52ff51c4a0 100644 +--- a/sound/soc/fsl/fsl_micfil.c ++++ b/sound/soc/fsl/fsl_micfil.c +@@ -172,7 +172,7 @@ static int fsl_micfil_reset(struct device *dev) + + ret = regmap_update_bits(micfil->regmap, + REG_MICFIL_CTRL1, +- MICFIL_CTRL1_MDIS_MASK, ++ MICFIL_CTRL1_MDIS, + 0); + if (ret) { + dev_err(dev, "failed to clear MDIS bit %d\n", ret); +@@ -181,7 +181,7 @@ static int fsl_micfil_reset(struct device *dev) + + ret = regmap_update_bits(micfil->regmap, + REG_MICFIL_CTRL1, +- MICFIL_CTRL1_SRES_MASK, ++ MICFIL_CTRL1_SRES, + MICFIL_CTRL1_SRES); + if (ret) { + dev_err(dev, "failed to reset MICFIL: %d\n", ret); +@@ -256,7 +256,7 @@ static int fsl_micfil_trigger(struct snd_pcm_substream *substream, int cmd, + + /* Enable the module */ + ret = regmap_update_bits(micfil->regmap, REG_MICFIL_CTRL1, +- MICFIL_CTRL1_PDMIEN_MASK, ++ MICFIL_CTRL1_PDMIEN, + MICFIL_CTRL1_PDMIEN); + if (ret) { + dev_err(dev, "failed to enable the module\n"); +@@ -269,7 +269,7 @@ static int fsl_micfil_trigger(struct snd_pcm_substream *substream, int cmd, + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: + /* Disable the module */ + ret = regmap_update_bits(micfil->regmap, REG_MICFIL_CTRL1, +- MICFIL_CTRL1_PDMIEN_MASK, ++ MICFIL_CTRL1_PDMIEN, + 0); + if (ret) { + dev_err(dev, "failed to enable the module\n"); +@@ -335,7 +335,7 @@ static int fsl_micfil_hw_params(struct snd_pcm_substream *substream, + + /* 1. Disable the module */ + ret = regmap_update_bits(micfil->regmap, REG_MICFIL_CTRL1, +- MICFIL_CTRL1_PDMIEN_MASK, 0); ++ MICFIL_CTRL1_PDMIEN, 0); + if (ret) { + dev_err(dev, "failed to disable the module\n"); + return ret; +@@ -618,16 +618,16 @@ static irqreturn_t micfil_err_isr(int irq, void *devid) + + regmap_read(micfil->regmap, REG_MICFIL_STAT, &stat_reg); + +- if (stat_reg & MICFIL_STAT_BSY_FIL_MASK) ++ if (stat_reg & MICFIL_STAT_BSY_FIL) + dev_dbg(&pdev->dev, "isr: Decimation Filter is running\n"); + +- if (stat_reg & MICFIL_STAT_FIR_RDY_MASK) ++ if (stat_reg & MICFIL_STAT_FIR_RDY) + dev_dbg(&pdev->dev, "isr: FIR Filter Data ready\n"); + +- if (stat_reg & MICFIL_STAT_LOWFREQF_MASK) { ++ if (stat_reg & MICFIL_STAT_LOWFREQF) { + dev_dbg(&pdev->dev, "isr: ipg_clk_app is too low\n"); + regmap_write_bits(micfil->regmap, REG_MICFIL_STAT, +- MICFIL_STAT_LOWFREQF_MASK, 1); ++ MICFIL_STAT_LOWFREQF, 1); + } + + return IRQ_HANDLED; +diff --git a/sound/soc/fsl/fsl_micfil.h b/sound/soc/fsl/fsl_micfil.h +index bac825c3135a0..11ccc08523b2e 100644 +--- a/sound/soc/fsl/fsl_micfil.h ++++ b/sound/soc/fsl/fsl_micfil.h +@@ -33,33 +33,17 @@ + #define REG_MICFIL_VAD0_ZCD 0xA8 + + /* MICFIL Control Register 1 -- REG_MICFILL_CTRL1 0x00 */ +-#define MICFIL_CTRL1_MDIS_SHIFT 31 +-#define MICFIL_CTRL1_MDIS_MASK BIT(MICFIL_CTRL1_MDIS_SHIFT) +-#define MICFIL_CTRL1_MDIS BIT(MICFIL_CTRL1_MDIS_SHIFT) +-#define MICFIL_CTRL1_DOZEN_SHIFT 30 +-#define MICFIL_CTRL1_DOZEN_MASK BIT(MICFIL_CTRL1_DOZEN_SHIFT) +-#define MICFIL_CTRL1_DOZEN BIT(MICFIL_CTRL1_DOZEN_SHIFT) +-#define MICFIL_CTRL1_PDMIEN_SHIFT 29 +-#define MICFIL_CTRL1_PDMIEN_MASK BIT(MICFIL_CTRL1_PDMIEN_SHIFT) +-#define MICFIL_CTRL1_PDMIEN BIT(MICFIL_CTRL1_PDMIEN_SHIFT) +-#define MICFIL_CTRL1_DBG_SHIFT 28 +-#define MICFIL_CTRL1_DBG_MASK BIT(MICFIL_CTRL1_DBG_SHIFT) +-#define MICFIL_CTRL1_DBG BIT(MICFIL_CTRL1_DBG_SHIFT) +-#define MICFIL_CTRL1_SRES_SHIFT 27 +-#define MICFIL_CTRL1_SRES_MASK BIT(MICFIL_CTRL1_SRES_SHIFT) +-#define MICFIL_CTRL1_SRES BIT(MICFIL_CTRL1_SRES_SHIFT) +-#define MICFIL_CTRL1_DBGE_SHIFT 26 +-#define MICFIL_CTRL1_DBGE_MASK BIT(MICFIL_CTRL1_DBGE_SHIFT) +-#define MICFIL_CTRL1_DBGE BIT(MICFIL_CTRL1_DBGE_SHIFT) ++#define MICFIL_CTRL1_MDIS BIT(31) ++#define MICFIL_CTRL1_DOZEN BIT(30) ++#define MICFIL_CTRL1_PDMIEN BIT(29) ++#define MICFIL_CTRL1_DBG BIT(28) ++#define MICFIL_CTRL1_SRES BIT(27) ++#define MICFIL_CTRL1_DBGE BIT(26) + #define MICFIL_CTRL1_DISEL_SHIFT 24 + #define MICFIL_CTRL1_DISEL_WIDTH 2 + #define MICFIL_CTRL1_DISEL_MASK ((BIT(MICFIL_CTRL1_DISEL_WIDTH) - 1) \ + << MICFIL_CTRL1_DISEL_SHIFT) +-#define MICFIL_CTRL1_DISEL(v) (((v) << MICFIL_CTRL1_DISEL_SHIFT) \ +- & MICFIL_CTRL1_DISEL_MASK) +-#define MICFIL_CTRL1_ERREN_SHIFT 23 +-#define MICFIL_CTRL1_ERREN_MASK BIT(MICFIL_CTRL1_ERREN_SHIFT) +-#define MICFIL_CTRL1_ERREN BIT(MICFIL_CTRL1_ERREN_SHIFT) ++#define MICFIL_CTRL1_ERREN BIT(23) + #define MICFIL_CTRL1_CHEN_SHIFT 0 + #define MICFIL_CTRL1_CHEN_WIDTH 8 + #define MICFIL_CTRL1_CHEN_MASK(x) (BIT(x) << MICFIL_CTRL1_CHEN_SHIFT) +@@ -91,15 +75,9 @@ + & MICFIL_CTRL2_CLKDIV_MASK) + + /* MICFIL Status Register -- REG_MICFIL_STAT 0x08 */ +-#define MICFIL_STAT_BSY_FIL_SHIFT 31 +-#define MICFIL_STAT_BSY_FIL_MASK BIT(MICFIL_STAT_BSY_FIL_SHIFT) +-#define MICFIL_STAT_BSY_FIL BIT(MICFIL_STAT_BSY_FIL_SHIFT) +-#define MICFIL_STAT_FIR_RDY_SHIFT 30 +-#define MICFIL_STAT_FIR_RDY_MASK BIT(MICFIL_STAT_FIR_RDY_SHIFT) +-#define MICFIL_STAT_FIR_RDY BIT(MICFIL_STAT_FIR_RDY_SHIFT) +-#define MICFIL_STAT_LOWFREQF_SHIFT 29 +-#define MICFIL_STAT_LOWFREQF_MASK BIT(MICFIL_STAT_LOWFREQF_SHIFT) +-#define MICFIL_STAT_LOWFREQF BIT(MICFIL_STAT_LOWFREQF_SHIFT) ++#define MICFIL_STAT_BSY_FIL BIT(31) ++#define MICFIL_STAT_FIR_RDY BIT(30) ++#define MICFIL_STAT_LOWFREQF BIT(29) + #define MICFIL_STAT_CHXF_SHIFT(v) (v) + #define MICFIL_STAT_CHXF_MASK(v) BIT(MICFIL_STAT_CHXF_SHIFT(v)) + #define MICFIL_STAT_CHXF(v) BIT(MICFIL_STAT_CHXF_SHIFT(v)) +@@ -137,32 +115,16 @@ + << MICFIL_VAD0_CTRL1_INITT_SHIFT) + #define MICFIL_VAD0_CTRL1_INITT(v) (((v) << MICFIL_VAD0_CTRL1_INITT_SHIFT) \ + & MICFIL_VAD0_CTRL1_INITT_MASK) +-#define MICFIL_VAD0_CTRL1_ST10_SHIFT 4 +-#define MICFIL_VAD0_CTRL1_ST10_MASK BIT(MICFIL_VAD0_CTRL1_ST10_SHIFT) +-#define MICFIL_VAD0_CTRL1_ST10 BIT(MICFIL_VAD0_CTRL1_ST10_SHIFT) +-#define MICFIL_VAD0_CTRL1_ERIE_SHIFT 3 +-#define MICFIL_VAD0_CTRL1_ERIE_MASK BIT(MICFIL_VAD0_CTRL1_ERIE_SHIFT) +-#define MICFIL_VAD0_CTRL1_ERIE BIT(MICFIL_VAD0_CTRL1_ERIE_SHIFT) +-#define MICFIL_VAD0_CTRL1_IE_SHIFT 2 +-#define MICFIL_VAD0_CTRL1_IE_MASK BIT(MICFIL_VAD0_CTRL1_IE_SHIFT) +-#define MICFIL_VAD0_CTRL1_IE BIT(MICFIL_VAD0_CTRL1_IE_SHIFT) +-#define MICFIL_VAD0_CTRL1_RST_SHIFT 1 +-#define MICFIL_VAD0_CTRL1_RST_MASK BIT(MICFIL_VAD0_CTRL1_RST_SHIFT) +-#define MICFIL_VAD0_CTRL1_RST BIT(MICFIL_VAD0_CTRL1_RST_SHIFT) +-#define MICFIL_VAD0_CTRL1_EN_SHIFT 0 +-#define MICFIL_VAD0_CTRL1_EN_MASK BIT(MICFIL_VAD0_CTRL1_EN_SHIFT) +-#define MICFIL_VAD0_CTRL1_EN BIT(MICFIL_VAD0_CTRL1_EN_SHIFT) ++#define MICFIL_VAD0_CTRL1_ST10 BIT(4) ++#define MICFIL_VAD0_CTRL1_ERIE BIT(3) ++#define MICFIL_VAD0_CTRL1_IE BIT(2) ++#define MICFIL_VAD0_CTRL1_RST BIT(1) ++#define MICFIL_VAD0_CTRL1_EN BIT(0) + + /* MICFIL HWVAD0 Control 2 Register -- REG_MICFIL_VAD0_CTRL2*/ +-#define MICFIL_VAD0_CTRL2_FRENDIS_SHIFT 31 +-#define MICFIL_VAD0_CTRL2_FRENDIS_MASK BIT(MICFIL_VAD0_CTRL2_FRENDIS_SHIFT) +-#define MICFIL_VAD0_CTRL2_FRENDIS BIT(MICFIL_VAD0_CTRL2_FRENDIS_SHIFT) +-#define MICFIL_VAD0_CTRL2_PREFEN_SHIFT 30 +-#define MICFIL_VAD0_CTRL2_PREFEN_MASK BIT(MICFIL_VAD0_CTRL2_PREFEN_SHIFT) +-#define MICFIL_VAD0_CTRL2_PREFEN BIT(MICFIL_VAD0_CTRL2_PREFEN_SHIFT) +-#define MICFIL_VAD0_CTRL2_FOUTDIS_SHIFT 28 +-#define MICFIL_VAD0_CTRL2_FOUTDIS_MASK BIT(MICFIL_VAD0_CTRL2_FOUTDIS_SHIFT) +-#define MICFIL_VAD0_CTRL2_FOUTDIS BIT(MICFIL_VAD0_CTRL2_FOUTDIS_SHIFT) ++#define MICFIL_VAD0_CTRL2_FRENDIS BIT(31) ++#define MICFIL_VAD0_CTRL2_PREFEN BIT(30) ++#define MICFIL_VAD0_CTRL2_FOUTDIS BIT(28) + #define MICFIL_VAD0_CTRL2_FRAMET_SHIFT 16 + #define MICFIL_VAD0_CTRL2_FRAMET_WIDTH 6 + #define MICFIL_VAD0_CTRL2_FRAMET_MASK ((BIT(MICFIL_VAD0_CTRL2_FRAMET_WIDTH) - 1) \ +@@ -183,12 +145,8 @@ + & MICFIL_VAD0_CTRL2_HPF_MASK) + + /* MICFIL HWVAD0 Signal CONFIG Register -- REG_MICFIL_VAD0_SCONFIG */ +-#define MICFIL_VAD0_SCONFIG_SFILEN_SHIFT 31 +-#define MICFIL_VAD0_SCONFIG_SFILEN_MASK BIT(MICFIL_VAD0_SCONFIG_SFILEN_SHIFT) +-#define MICFIL_VAD0_SCONFIG_SFILEN BIT(MICFIL_VAD0_SCONFIG_SFILEN_SHIFT) +-#define MICFIL_VAD0_SCONFIG_SMAXEN_SHIFT 30 +-#define MICFIL_VAD0_SCONFIG_SMAXEN_MASK BIT(MICFIL_VAD0_SCONFIG_SMAXEN_SHIFT) +-#define MICFIL_VAD0_SCONFIG_SMAXEN BIT(MICFIL_VAD0_SCONFIG_SMAXEN_SHIFT) ++#define MICFIL_VAD0_SCONFIG_SFILEN BIT(31) ++#define MICFIL_VAD0_SCONFIG_SMAXEN BIT(30) + #define MICFIL_VAD0_SCONFIG_SGAIN_SHIFT 0 + #define MICFIL_VAD0_SCONFIG_SGAIN_WIDTH 4 + #define MICFIL_VAD0_SCONFIG_SGAIN_MASK ((BIT(MICFIL_VAD0_SCONFIG_SGAIN_WIDTH) - 1) \ +@@ -197,17 +155,10 @@ + & MICFIL_VAD0_SCONFIG_SGAIN_MASK) + + /* MICFIL HWVAD0 Noise CONFIG Register -- REG_MICFIL_VAD0_NCONFIG */ +-#define MICFIL_VAD0_NCONFIG_NFILAUT_SHIFT 31 +-#define MICFIL_VAD0_NCONFIG_NFILAUT_MASK BIT(MICFIL_VAD0_NCONFIG_NFILAUT_SHIFT) +-#define MICFIL_VAD0_NCONFIG_NFILAUT BIT(MICFIL_VAD0_NCONFIG_NFILAUT_SHIFT) +-#define MICFIL_VAD0_NCONFIG_NMINEN_SHIFT 30 +-#define MICFIL_VAD0_NCONFIG_NMINEN_MASK BIT(MICFIL_VAD0_NCONFIG_NMINEN_SHIFT) +-#define MICFIL_VAD0_NCONFIG_NMINEN BIT(MICFIL_VAD0_NCONFIG_NMINEN_SHIFT) +-#define MICFIL_VAD0_NCONFIG_NDECEN_SHIFT 29 +-#define MICFIL_VAD0_NCONFIG_NDECEN_MASK BIT(MICFIL_VAD0_NCONFIG_NDECEN_SHIFT) +-#define MICFIL_VAD0_NCONFIG_NDECEN BIT(MICFIL_VAD0_NCONFIG_NDECEN_SHIFT) +-#define MICFIL_VAD0_NCONFIG_NOREN_SHIFT 28 +-#define MICFIL_VAD0_NCONFIG_NOREN BIT(MICFIL_VAD0_NCONFIG_NOREN_SHIFT) ++#define MICFIL_VAD0_NCONFIG_NFILAUT BIT(31) ++#define MICFIL_VAD0_NCONFIG_NMINEN BIT(30) ++#define MICFIL_VAD0_NCONFIG_NDECEN BIT(29) ++#define MICFIL_VAD0_NCONFIG_NOREN BIT(28) + #define MICFIL_VAD0_NCONFIG_NFILADJ_SHIFT 8 + #define MICFIL_VAD0_NCONFIG_NFILADJ_WIDTH 5 + #define MICFIL_VAD0_NCONFIG_NFILADJ_MASK ((BIT(MICFIL_VAD0_NCONFIG_NFILADJ_WIDTH) - 1) \ +@@ -234,29 +185,15 @@ + << MICFIL_VAD0_ZCD_ZCDADJ_SHIFT) + #define MICFIL_VAD0_ZCD_ZCDADJ(v) (((v) << MICFIL_VAD0_ZCD_ZCDADJ_SHIFT)\ + & MICFIL_VAD0_ZCD_ZCDADJ_MASK) +-#define MICFIL_VAD0_ZCD_ZCDAND_SHIFT 4 +-#define MICFIL_VAD0_ZCD_ZCDAND_MASK BIT(MICFIL_VAD0_ZCD_ZCDAND_SHIFT) +-#define MICFIL_VAD0_ZCD_ZCDAND BIT(MICFIL_VAD0_ZCD_ZCDAND_SHIFT) +-#define MICFIL_VAD0_ZCD_ZCDAUT_SHIFT 2 +-#define MICFIL_VAD0_ZCD_ZCDAUT_MASK BIT(MICFIL_VAD0_ZCD_ZCDAUT_SHIFT) +-#define MICFIL_VAD0_ZCD_ZCDAUT BIT(MICFIL_VAD0_ZCD_ZCDAUT_SHIFT) +-#define MICFIL_VAD0_ZCD_ZCDEN_SHIFT 0 +-#define MICFIL_VAD0_ZCD_ZCDEN_MASK BIT(MICFIL_VAD0_ZCD_ZCDEN_SHIFT) +-#define MICFIL_VAD0_ZCD_ZCDEN BIT(MICFIL_VAD0_ZCD_ZCDEN_SHIFT) ++#define MICFIL_VAD0_ZCD_ZCDAND BIT(4) ++#define MICFIL_VAD0_ZCD_ZCDAUT BIT(2) ++#define MICFIL_VAD0_ZCD_ZCDEN BIT(0) + + /* MICFIL HWVAD0 Status Register - REG_MICFIL_VAD0_STAT */ +-#define MICFIL_VAD0_STAT_INITF_SHIFT 31 +-#define MICFIL_VAD0_STAT_INITF_MASK BIT(MICFIL_VAD0_STAT_INITF_SHIFT) +-#define MICFIL_VAD0_STAT_INITF BIT(MICFIL_VAD0_STAT_INITF_SHIFT) +-#define MICFIL_VAD0_STAT_INSATF_SHIFT 16 +-#define MICFIL_VAD0_STAT_INSATF_MASK BIT(MICFIL_VAD0_STAT_INSATF_SHIFT) +-#define MICFIL_VAD0_STAT_INSATF BIT(MICFIL_VAD0_STAT_INSATF_SHIFT) +-#define MICFIL_VAD0_STAT_EF_SHIFT 15 +-#define MICFIL_VAD0_STAT_EF_MASK BIT(MICFIL_VAD0_STAT_EF_SHIFT) +-#define MICFIL_VAD0_STAT_EF BIT(MICFIL_VAD0_STAT_EF_SHIFT) +-#define MICFIL_VAD0_STAT_IF_SHIFT 0 +-#define MICFIL_VAD0_STAT_IF_MASK BIT(MICFIL_VAD0_STAT_IF_SHIFT) +-#define MICFIL_VAD0_STAT_IF BIT(MICFIL_VAD0_STAT_IF_SHIFT) ++#define MICFIL_VAD0_STAT_INITF BIT(31) ++#define MICFIL_VAD0_STAT_INSATF BIT(16) ++#define MICFIL_VAD0_STAT_EF BIT(15) ++#define MICFIL_VAD0_STAT_IF BIT(0) + + /* MICFIL Output Control Register */ + #define MICFIL_OUTGAIN_CHX_SHIFT(v) (4 * (v)) +-- +2.43.0 + diff --git a/queue-5.4/asoc-fsl_micfil-drop-unnecessary-register-read.patch b/queue-5.4/asoc-fsl_micfil-drop-unnecessary-register-read.patch new file mode 100644 index 00000000000..bcd06e3ed04 --- /dev/null +++ b/queue-5.4/asoc-fsl_micfil-drop-unnecessary-register-read.patch @@ -0,0 +1,37 @@ +From 40c9956d9e43bfbd00ada41fdadd47889d0f9ece Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 18:22:29 +0200 +Subject: ASoC: fsl_micfil: Drop unnecessary register read + +From: Sascha Hauer + +[ Upstream commit c808e277bcdfce37aed80a443be305ac1aec1623 ] + +in get_pdm_clk() REG_MICFIL_CTRL2 is read twice. Drop second read. + +Signed-off-by: Sascha Hauer +Acked-by: Shengjiu Wang +Link: https://lore.kernel.org/r/20220414162249.3934543-2-s.hauer@pengutronix.de +Signed-off-by: Mark Brown +Stable-dep-of: 06df673d2023 ("ASoC: fsl_micfil: fix regmap_write_bits usage") +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_micfil.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c +index 6285ee8f829e5..a69237b7f564a 100644 +--- a/sound/soc/fsl/fsl_micfil.c ++++ b/sound/soc/fsl/fsl_micfil.c +@@ -117,8 +117,6 @@ static inline int get_pdm_clk(struct fsl_micfil *micfil, + regmap_read(micfil->regmap, REG_MICFIL_CTRL2, &ctrl2_reg); + osr = 16 - ((ctrl2_reg & MICFIL_CTRL2_CICOSR_MASK) + >> MICFIL_CTRL2_CICOSR_SHIFT); +- +- regmap_read(micfil->regmap, REG_MICFIL_CTRL2, &ctrl2_reg); + qsel = ctrl2_reg & MICFIL_CTRL2_QSEL_MASK; + + switch (qsel) { +-- +2.43.0 + diff --git a/queue-5.4/asoc-fsl_micfil-fix-regmap_write_bits-usage.patch b/queue-5.4/asoc-fsl_micfil-fix-regmap_write_bits-usage.patch new file mode 100644 index 00000000000..201a09f03ad --- /dev/null +++ b/queue-5.4/asoc-fsl_micfil-fix-regmap_write_bits-usage.patch @@ -0,0 +1,47 @@ +From 63d55ef276c4c176ef17b97f9481e346f042f37b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Sep 2024 16:00:29 +0800 +Subject: ASoC: fsl_micfil: fix regmap_write_bits usage + +From: Shengjiu Wang + +[ Upstream commit 06df673d20230afb0e383e39235a4fa8b9a62464 ] + +The last parameter 1 means BIT(0), which should be the +correct BIT(X). + +Fixes: 47a70e6fc9a8 ("ASoC: Add MICFIL SoC Digital Audio Interface driver.") +Signed-off-by: Shengjiu Wang +Reviewed-by: Daniel Baluta +Link: https://patch.msgid.link/1727424031-19551-2-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_micfil.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c +index 108063610f2f4..b5b7a341a0b63 100644 +--- a/sound/soc/fsl/fsl_micfil.c ++++ b/sound/soc/fsl/fsl_micfil.c +@@ -592,7 +592,7 @@ static irqreturn_t micfil_isr(int irq, void *devid) + regmap_write_bits(micfil->regmap, + REG_MICFIL_STAT, + MICFIL_STAT_CHXF(i), +- 1); ++ MICFIL_STAT_CHXF(i)); + } + + for (i = 0; i < MICFIL_FIFO_NUM; i++) { +@@ -627,7 +627,7 @@ static irqreturn_t micfil_err_isr(int irq, void *devid) + if (stat_reg & MICFIL_STAT_LOWFREQF) { + dev_dbg(&pdev->dev, "isr: ipg_clk_app is too low\n"); + regmap_write_bits(micfil->regmap, REG_MICFIL_STAT, +- MICFIL_STAT_LOWFREQF, 1); ++ MICFIL_STAT_LOWFREQF, MICFIL_STAT_LOWFREQF); + } + + return IRQ_HANDLED; +-- +2.43.0 + diff --git a/queue-5.4/asoc-fsl_micfil-use-genmask-to-define-register-bit-f.patch b/queue-5.4/asoc-fsl_micfil-use-genmask-to-define-register-bit-f.patch new file mode 100644 index 00000000000..e62e207d989 --- /dev/null +++ b/queue-5.4/asoc-fsl_micfil-use-genmask-to-define-register-bit-f.patch @@ -0,0 +1,382 @@ +From bbc9011432c41651292ce31ce026c94320003061 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 18:22:33 +0200 +Subject: ASoC: fsl_micfil: use GENMASK to define register bit fields + +From: Sascha Hauer + +[ Upstream commit 17f2142bae4b6f2e27f19ce57d79fc42ba5ef659 ] + +Use GENMASK along with FIELD_PREP and FIELD_GET to access bitfields in +registers to straighten register access and to drop a lot of defines. + +Signed-off-by: Sascha Hauer +Acked-by: Shengjiu Wang +Link: https://lore.kernel.org/r/20220414162249.3934543-6-s.hauer@pengutronix.de +Signed-off-by: Mark Brown +Stable-dep-of: 06df673d2023 ("ASoC: fsl_micfil: fix regmap_write_bits usage") +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_micfil.c | 52 ++++++------- + sound/soc/fsl/fsl_micfil.h | 147 ++++++++----------------------------- + 2 files changed, 58 insertions(+), 141 deletions(-) + +diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c +index d9e52ff51c4a0..108063610f2f4 100644 +--- a/sound/soc/fsl/fsl_micfil.c ++++ b/sound/soc/fsl/fsl_micfil.c +@@ -1,6 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 + // Copyright 2018 NXP + ++#include + #include + #include + #include +@@ -115,23 +116,22 @@ static inline int get_pdm_clk(struct fsl_micfil *micfil, + int bclk; + + regmap_read(micfil->regmap, REG_MICFIL_CTRL2, &ctrl2_reg); +- osr = 16 - ((ctrl2_reg & MICFIL_CTRL2_CICOSR_MASK) +- >> MICFIL_CTRL2_CICOSR_SHIFT); +- qsel = ctrl2_reg & MICFIL_CTRL2_QSEL_MASK; ++ osr = 16 - FIELD_GET(MICFIL_CTRL2_CICOSR, ctrl2_reg); ++ qsel = FIELD_GET(MICFIL_CTRL2_QSEL, ctrl2_reg); + + switch (qsel) { +- case MICFIL_HIGH_QUALITY: ++ case MICFIL_QSEL_HIGH_QUALITY: + bclk = rate * 8 * osr / 2; /* kfactor = 0.5 */ + break; +- case MICFIL_MEDIUM_QUALITY: +- case MICFIL_VLOW0_QUALITY: ++ case MICFIL_QSEL_MEDIUM_QUALITY: ++ case MICFIL_QSEL_VLOW0_QUALITY: + bclk = rate * 4 * osr * 1; /* kfactor = 1 */ + break; +- case MICFIL_LOW_QUALITY: +- case MICFIL_VLOW1_QUALITY: ++ case MICFIL_QSEL_LOW_QUALITY: ++ case MICFIL_QSEL_VLOW1_QUALITY: + bclk = rate * 2 * osr * 2; /* kfactor = 2 */ + break; +- case MICFIL_VLOW2_QUALITY: ++ case MICFIL_QSEL_VLOW2_QUALITY: + bclk = rate * osr * 4; /* kfactor = 4 */ + break; + default: +@@ -247,8 +247,8 @@ static int fsl_micfil_trigger(struct snd_pcm_substream *substream, int cmd, + * 11 - reserved + */ + ret = regmap_update_bits(micfil->regmap, REG_MICFIL_CTRL1, +- MICFIL_CTRL1_DISEL_MASK, +- (1 << MICFIL_CTRL1_DISEL_SHIFT)); ++ MICFIL_CTRL1_DISEL, ++ FIELD_PREP(MICFIL_CTRL1_DISEL, MICFIL_CTRL1_DISEL_DMA)); + if (ret) { + dev_err(dev, "failed to update DISEL bits\n"); + return ret; +@@ -277,8 +277,8 @@ static int fsl_micfil_trigger(struct snd_pcm_substream *substream, int cmd, + } + + ret = regmap_update_bits(micfil->regmap, REG_MICFIL_CTRL1, +- MICFIL_CTRL1_DISEL_MASK, +- (0 << MICFIL_CTRL1_DISEL_SHIFT)); ++ MICFIL_CTRL1_DISEL, ++ FIELD_PREP(MICFIL_CTRL1_DISEL, MICFIL_CTRL1_DISEL_DISABLE)); + if (ret) { + dev_err(dev, "failed to update DISEL bits\n"); + return ret; +@@ -303,8 +303,8 @@ static int fsl_set_clock_params(struct device *dev, unsigned int rate) + + /* set CICOSR */ + ret |= regmap_update_bits(micfil->regmap, REG_MICFIL_CTRL2, +- MICFIL_CTRL2_CICOSR_MASK, +- MICFIL_CTRL2_OSR_DEFAULT); ++ MICFIL_CTRL2_CICOSR, ++ FIELD_PREP(MICFIL_CTRL2_CICOSR, MICFIL_CTRL2_CICOSR_DEFAULT)); + if (ret) + dev_err(dev, "failed to set CICOSR in reg 0x%X\n", + REG_MICFIL_CTRL2); +@@ -315,7 +315,8 @@ static int fsl_set_clock_params(struct device *dev, unsigned int rate) + ret = -EINVAL; + + ret |= regmap_update_bits(micfil->regmap, REG_MICFIL_CTRL2, +- MICFIL_CTRL2_CLKDIV_MASK, clk_div); ++ MICFIL_CTRL2_CLKDIV, ++ FIELD_PREP(MICFIL_CTRL2_CLKDIV, clk_div)); + if (ret) + dev_err(dev, "failed to set CLKDIV in reg 0x%X\n", + REG_MICFIL_CTRL2); +@@ -391,13 +392,13 @@ static int fsl_micfil_dai_probe(struct snd_soc_dai *cpu_dai) + { + struct fsl_micfil *micfil = dev_get_drvdata(cpu_dai->dev); + struct device *dev = cpu_dai->dev; +- unsigned int val; + int ret; + int i; + + /* set qsel to medium */ + ret = regmap_update_bits(micfil->regmap, REG_MICFIL_CTRL2, +- MICFIL_CTRL2_QSEL_MASK, MICFIL_MEDIUM_QUALITY); ++ MICFIL_CTRL2_QSEL, ++ FIELD_PREP(MICFIL_CTRL2_QSEL, MICFIL_QSEL_MEDIUM_QUALITY)); + if (ret) { + dev_err(dev, "failed to set quality mode bits, reg 0x%X\n", + REG_MICFIL_CTRL2); +@@ -413,10 +414,9 @@ static int fsl_micfil_dai_probe(struct snd_soc_dai *cpu_dai) + &micfil->dma_params_rx); + + /* FIFO Watermark Control - FIFOWMK*/ +- val = MICFIL_FIFO_CTRL_FIFOWMK(micfil->soc->fifo_depth) - 1; + ret = regmap_update_bits(micfil->regmap, REG_MICFIL_FIFO_CTRL, +- MICFIL_FIFO_CTRL_FIFOWMK_MASK, +- val); ++ MICFIL_FIFO_CTRL_FIFOWMK, ++ FIELD_PREP(MICFIL_FIFO_CTRL_FIFOWMK, micfil->soc->fifo_depth - 1)); + if (ret) { + dev_err(dev, "failed to set FIFOWMK\n"); + return ret; +@@ -578,11 +578,11 @@ static irqreturn_t micfil_isr(int irq, void *devid) + regmap_read(micfil->regmap, REG_MICFIL_CTRL1, &ctrl1_reg); + regmap_read(micfil->regmap, REG_MICFIL_FIFO_STAT, &fifo_stat_reg); + +- dma_enabled = MICFIL_DMA_ENABLED(ctrl1_reg); ++ dma_enabled = FIELD_GET(MICFIL_CTRL1_DISEL, ctrl1_reg) == MICFIL_CTRL1_DISEL_DMA; + + /* Channel 0-7 Output Data Flags */ + for (i = 0; i < MICFIL_OUTPUT_CHANNELS; i++) { +- if (stat_reg & MICFIL_STAT_CHXF_MASK(i)) ++ if (stat_reg & MICFIL_STAT_CHXF(i)) + dev_dbg(&pdev->dev, + "Data available in Data Channel %d\n", i); + /* if DMA is not enabled, field must be written with 1 +@@ -591,17 +591,17 @@ static irqreturn_t micfil_isr(int irq, void *devid) + if (!dma_enabled) + regmap_write_bits(micfil->regmap, + REG_MICFIL_STAT, +- MICFIL_STAT_CHXF_MASK(i), ++ MICFIL_STAT_CHXF(i), + 1); + } + + for (i = 0; i < MICFIL_FIFO_NUM; i++) { +- if (fifo_stat_reg & MICFIL_FIFO_STAT_FIFOX_OVER_MASK(i)) ++ if (fifo_stat_reg & MICFIL_FIFO_STAT_FIFOX_OVER(i)) + dev_dbg(&pdev->dev, + "FIFO Overflow Exception flag for channel %d\n", + i); + +- if (fifo_stat_reg & MICFIL_FIFO_STAT_FIFOX_UNDER_MASK(i)) ++ if (fifo_stat_reg & MICFIL_FIFO_STAT_FIFOX_UNDER(i)) + dev_dbg(&pdev->dev, + "FIFO Underflow Exception flag for channel %d\n", + i); +diff --git a/sound/soc/fsl/fsl_micfil.h b/sound/soc/fsl/fsl_micfil.h +index 11ccc08523b2e..5cecae2519795 100644 +--- a/sound/soc/fsl/fsl_micfil.h ++++ b/sound/soc/fsl/fsl_micfil.h +@@ -39,82 +39,45 @@ + #define MICFIL_CTRL1_DBG BIT(28) + #define MICFIL_CTRL1_SRES BIT(27) + #define MICFIL_CTRL1_DBGE BIT(26) +-#define MICFIL_CTRL1_DISEL_SHIFT 24 +-#define MICFIL_CTRL1_DISEL_WIDTH 2 +-#define MICFIL_CTRL1_DISEL_MASK ((BIT(MICFIL_CTRL1_DISEL_WIDTH) - 1) \ +- << MICFIL_CTRL1_DISEL_SHIFT) ++ ++#define MICFIL_CTRL1_DISEL_DISABLE 0 ++#define MICFIL_CTRL1_DISEL_DMA 1 ++#define MICFIL_CTRL1_DISEL_IRQ 2 ++#define MICFIL_CTRL1_DISEL GENMASK(25, 24) + #define MICFIL_CTRL1_ERREN BIT(23) +-#define MICFIL_CTRL1_CHEN_SHIFT 0 +-#define MICFIL_CTRL1_CHEN_WIDTH 8 +-#define MICFIL_CTRL1_CHEN_MASK(x) (BIT(x) << MICFIL_CTRL1_CHEN_SHIFT) +-#define MICFIL_CTRL1_CHEN(x) (MICFIL_CTRL1_CHEN_MASK(x)) ++#define MICFIL_CTRL1_CHEN(ch) BIT(ch) + + /* MICFIL Control Register 2 -- REG_MICFILL_CTRL2 0x04 */ + #define MICFIL_CTRL2_QSEL_SHIFT 25 +-#define MICFIL_CTRL2_QSEL_WIDTH 3 +-#define MICFIL_CTRL2_QSEL_MASK ((BIT(MICFIL_CTRL2_QSEL_WIDTH) - 1) \ +- << MICFIL_CTRL2_QSEL_SHIFT) +-#define MICFIL_HIGH_QUALITY BIT(MICFIL_CTRL2_QSEL_SHIFT) +-#define MICFIL_MEDIUM_QUALITY (0 << MICFIL_CTRL2_QSEL_SHIFT) +-#define MICFIL_LOW_QUALITY (7 << MICFIL_CTRL2_QSEL_SHIFT) +-#define MICFIL_VLOW0_QUALITY (6 << MICFIL_CTRL2_QSEL_SHIFT) +-#define MICFIL_VLOW1_QUALITY (5 << MICFIL_CTRL2_QSEL_SHIFT) +-#define MICFIL_VLOW2_QUALITY (4 << MICFIL_CTRL2_QSEL_SHIFT) +- +-#define MICFIL_CTRL2_CICOSR_SHIFT 16 +-#define MICFIL_CTRL2_CICOSR_WIDTH 4 +-#define MICFIL_CTRL2_CICOSR_MASK ((BIT(MICFIL_CTRL2_CICOSR_WIDTH) - 1) \ +- << MICFIL_CTRL2_CICOSR_SHIFT) +-#define MICFIL_CTRL2_CICOSR(v) (((v) << MICFIL_CTRL2_CICOSR_SHIFT) \ +- & MICFIL_CTRL2_CICOSR_MASK) +-#define MICFIL_CTRL2_CLKDIV_SHIFT 0 +-#define MICFIL_CTRL2_CLKDIV_WIDTH 8 +-#define MICFIL_CTRL2_CLKDIV_MASK ((BIT(MICFIL_CTRL2_CLKDIV_WIDTH) - 1) \ +- << MICFIL_CTRL2_CLKDIV_SHIFT) +-#define MICFIL_CTRL2_CLKDIV(v) (((v) << MICFIL_CTRL2_CLKDIV_SHIFT) \ +- & MICFIL_CTRL2_CLKDIV_MASK) ++#define MICFIL_CTRL2_QSEL GENMASK(27, 25) ++#define MICFIL_QSEL_MEDIUM_QUALITY 0 ++#define MICFIL_QSEL_HIGH_QUALITY 1 ++#define MICFIL_QSEL_LOW_QUALITY 7 ++#define MICFIL_QSEL_VLOW0_QUALITY 6 ++#define MICFIL_QSEL_VLOW1_QUALITY 5 ++#define MICFIL_QSEL_VLOW2_QUALITY 4 ++ ++#define MICFIL_CTRL2_CICOSR GENMASK(19, 16) ++#define MICFIL_CTRL2_CICOSR_DEFAULT 0 ++#define MICFIL_CTRL2_CLKDIV GENMASK(7, 0) + + /* MICFIL Status Register -- REG_MICFIL_STAT 0x08 */ + #define MICFIL_STAT_BSY_FIL BIT(31) + #define MICFIL_STAT_FIR_RDY BIT(30) + #define MICFIL_STAT_LOWFREQF BIT(29) +-#define MICFIL_STAT_CHXF_SHIFT(v) (v) +-#define MICFIL_STAT_CHXF_MASK(v) BIT(MICFIL_STAT_CHXF_SHIFT(v)) +-#define MICFIL_STAT_CHXF(v) BIT(MICFIL_STAT_CHXF_SHIFT(v)) ++#define MICFIL_STAT_CHXF(ch) BIT(ch) + + /* MICFIL FIFO Control Register -- REG_MICFIL_FIFO_CTRL 0x10 */ +-#define MICFIL_FIFO_CTRL_FIFOWMK_SHIFT 0 +-#define MICFIL_FIFO_CTRL_FIFOWMK_WIDTH 3 +-#define MICFIL_FIFO_CTRL_FIFOWMK_MASK ((BIT(MICFIL_FIFO_CTRL_FIFOWMK_WIDTH) - 1) \ +- << MICFIL_FIFO_CTRL_FIFOWMK_SHIFT) +-#define MICFIL_FIFO_CTRL_FIFOWMK(v) (((v) << MICFIL_FIFO_CTRL_FIFOWMK_SHIFT) \ +- & MICFIL_FIFO_CTRL_FIFOWMK_MASK) ++#define MICFIL_FIFO_CTRL_FIFOWMK GENMASK(2, 0) + + /* MICFIL FIFO Status Register -- REG_MICFIL_FIFO_STAT 0x14 */ +-#define MICFIL_FIFO_STAT_FIFOX_OVER_SHIFT(v) (v) +-#define MICFIL_FIFO_STAT_FIFOX_OVER_MASK(v) BIT(MICFIL_FIFO_STAT_FIFOX_OVER_SHIFT(v)) +-#define MICFIL_FIFO_STAT_FIFOX_UNDER_SHIFT(v) ((v) + 8) +-#define MICFIL_FIFO_STAT_FIFOX_UNDER_MASK(v) BIT(MICFIL_FIFO_STAT_FIFOX_UNDER_SHIFT(v)) ++#define MICFIL_FIFO_STAT_FIFOX_OVER(ch) BIT(ch) ++#define MICFIL_FIFO_STAT_FIFOX_UNDER(ch) BIT((ch) + 8) + + /* MICFIL HWVAD0 Control 1 Register -- REG_MICFIL_VAD0_CTRL1*/ +-#define MICFIL_VAD0_CTRL1_CHSEL_SHIFT 24 +-#define MICFIL_VAD0_CTRL1_CHSEL_WIDTH 3 +-#define MICFIL_VAD0_CTRL1_CHSEL_MASK ((BIT(MICFIL_VAD0_CTRL1_CHSEL_WIDTH) - 1) \ +- << MICFIL_VAD0_CTRL1_CHSEL_SHIFT) +-#define MICFIL_VAD0_CTRL1_CHSEL(v) (((v) << MICFIL_VAD0_CTRL1_CHSEL_SHIFT) \ +- & MICFIL_VAD0_CTRL1_CHSEL_MASK) +-#define MICFIL_VAD0_CTRL1_CICOSR_SHIFT 16 +-#define MICFIL_VAD0_CTRL1_CICOSR_WIDTH 4 +-#define MICFIL_VAD0_CTRL1_CICOSR_MASK ((BIT(MICFIL_VAD0_CTRL1_CICOSR_WIDTH) - 1) \ +- << MICFIL_VAD0_CTRL1_CICOSR_SHIFT) +-#define MICFIL_VAD0_CTRL1_CICOSR(v) (((v) << MICFIL_VAD0_CTRL1_CICOSR_SHIFT) \ +- & MICFIL_VAD0_CTRL1_CICOSR_MASK) +-#define MICFIL_VAD0_CTRL1_INITT_SHIFT 8 +-#define MICFIL_VAD0_CTRL1_INITT_WIDTH 5 +-#define MICFIL_VAD0_CTRL1_INITT_MASK ((BIT(MICFIL_VAD0_CTRL1_INITT_WIDTH) - 1) \ +- << MICFIL_VAD0_CTRL1_INITT_SHIFT) +-#define MICFIL_VAD0_CTRL1_INITT(v) (((v) << MICFIL_VAD0_CTRL1_INITT_SHIFT) \ +- & MICFIL_VAD0_CTRL1_INITT_MASK) ++#define MICFIL_VAD0_CTRL1_CHSEL_SHIFT GENMASK(26, 24) ++#define MICFIL_VAD0_CTRL1_CICOSR_SHIFT GENMASK(19, 16) ++#define MICFIL_VAD0_CTRL1_INITT_SHIFT GENMASK(12, 8) + #define MICFIL_VAD0_CTRL1_ST10 BIT(4) + #define MICFIL_VAD0_CTRL1_ERIE BIT(3) + #define MICFIL_VAD0_CTRL1_IE BIT(2) +@@ -125,66 +88,26 @@ + #define MICFIL_VAD0_CTRL2_FRENDIS BIT(31) + #define MICFIL_VAD0_CTRL2_PREFEN BIT(30) + #define MICFIL_VAD0_CTRL2_FOUTDIS BIT(28) +-#define MICFIL_VAD0_CTRL2_FRAMET_SHIFT 16 +-#define MICFIL_VAD0_CTRL2_FRAMET_WIDTH 6 +-#define MICFIL_VAD0_CTRL2_FRAMET_MASK ((BIT(MICFIL_VAD0_CTRL2_FRAMET_WIDTH) - 1) \ +- << MICFIL_VAD0_CTRL2_FRAMET_SHIFT) +-#define MICFIL_VAD0_CTRL2_FRAMET(v) (((v) << MICFIL_VAD0_CTRL2_FRAMET_SHIFT) \ +- & MICFIL_VAD0_CTRL2_FRAMET_MASK) +-#define MICFIL_VAD0_CTRL2_INPGAIN_SHIFT 8 +-#define MICFIL_VAD0_CTRL2_INPGAIN_WIDTH 4 +-#define MICFIL_VAD0_CTRL2_INPGAIN_MASK ((BIT(MICFIL_VAD0_CTRL2_INPGAIN_WIDTH) - 1) \ +- << MICFIL_VAD0_CTRL2_INPGAIN_SHIFT) +-#define MICFIL_VAD0_CTRL2_INPGAIN(v) (((v) << MICFIL_VAD0_CTRL2_INPGAIN_SHIFT) \ +- & MICFIL_VAD0_CTRL2_INPGAIN_MASK) +-#define MICFIL_VAD0_CTRL2_HPF_SHIFT 0 +-#define MICFIL_VAD0_CTRL2_HPF_WIDTH 2 +-#define MICFIL_VAD0_CTRL2_HPF_MASK ((BIT(MICFIL_VAD0_CTRL2_HPF_WIDTH) - 1) \ +- << MICFIL_VAD0_CTRL2_HPF_SHIFT) +-#define MICFIL_VAD0_CTRL2_HPF(v) (((v) << MICFIL_VAD0_CTRL2_HPF_SHIFT) \ +- & MICFIL_VAD0_CTRL2_HPF_MASK) ++#define MICFIL_VAD0_CTRL2_FRAMET GENMASK(21, 16) ++#define MICFIL_VAD0_CTRL2_INPGAIN GENMASK(11, 8) ++#define MICFIL_VAD0_CTRL2_HPF GENMASK(1, 0) + + /* MICFIL HWVAD0 Signal CONFIG Register -- REG_MICFIL_VAD0_SCONFIG */ + #define MICFIL_VAD0_SCONFIG_SFILEN BIT(31) + #define MICFIL_VAD0_SCONFIG_SMAXEN BIT(30) +-#define MICFIL_VAD0_SCONFIG_SGAIN_SHIFT 0 +-#define MICFIL_VAD0_SCONFIG_SGAIN_WIDTH 4 +-#define MICFIL_VAD0_SCONFIG_SGAIN_MASK ((BIT(MICFIL_VAD0_SCONFIG_SGAIN_WIDTH) - 1) \ +- << MICFIL_VAD0_SCONFIG_SGAIN_SHIFT) +-#define MICFIL_VAD0_SCONFIG_SGAIN(v) (((v) << MICFIL_VAD0_SCONFIG_SGAIN_SHIFT) \ +- & MICFIL_VAD0_SCONFIG_SGAIN_MASK) ++#define MICFIL_VAD0_SCONFIG_SGAIN GENMASK(3, 0) + + /* MICFIL HWVAD0 Noise CONFIG Register -- REG_MICFIL_VAD0_NCONFIG */ + #define MICFIL_VAD0_NCONFIG_NFILAUT BIT(31) + #define MICFIL_VAD0_NCONFIG_NMINEN BIT(30) + #define MICFIL_VAD0_NCONFIG_NDECEN BIT(29) + #define MICFIL_VAD0_NCONFIG_NOREN BIT(28) +-#define MICFIL_VAD0_NCONFIG_NFILADJ_SHIFT 8 +-#define MICFIL_VAD0_NCONFIG_NFILADJ_WIDTH 5 +-#define MICFIL_VAD0_NCONFIG_NFILADJ_MASK ((BIT(MICFIL_VAD0_NCONFIG_NFILADJ_WIDTH) - 1) \ +- << MICFIL_VAD0_NCONFIG_NFILADJ_SHIFT) +-#define MICFIL_VAD0_NCONFIG_NFILADJ(v) (((v) << MICFIL_VAD0_NCONFIG_NFILADJ_SHIFT) \ +- & MICFIL_VAD0_NCONFIG_NFILADJ_MASK) +-#define MICFIL_VAD0_NCONFIG_NGAIN_SHIFT 0 +-#define MICFIL_VAD0_NCONFIG_NGAIN_WIDTH 4 +-#define MICFIL_VAD0_NCONFIG_NGAIN_MASK ((BIT(MICFIL_VAD0_NCONFIG_NGAIN_WIDTH) - 1) \ +- << MICFIL_VAD0_NCONFIG_NGAIN_SHIFT) +-#define MICFIL_VAD0_NCONFIG_NGAIN(v) (((v) << MICFIL_VAD0_NCONFIG_NGAIN_SHIFT) \ +- & MICFIL_VAD0_NCONFIG_NGAIN_MASK) ++#define MICFIL_VAD0_NCONFIG_NFILADJ GENMASK(12, 8) ++#define MICFIL_VAD0_NCONFIG_NGAIN GENMASK(3, 0) + + /* MICFIL HWVAD0 Zero-Crossing Detector - REG_MICFIL_VAD0_ZCD */ +-#define MICFIL_VAD0_ZCD_ZCDTH_SHIFT 16 +-#define MICFIL_VAD0_ZCD_ZCDTH_WIDTH 10 +-#define MICFIL_VAD0_ZCD_ZCDTH_MASK ((BIT(MICFIL_VAD0_ZCD_ZCDTH_WIDTH) - 1) \ +- << MICFIL_VAD0_ZCD_ZCDTH_SHIFT) +-#define MICFIL_VAD0_ZCD_ZCDTH(v) (((v) << MICFIL_VAD0_ZCD_ZCDTH_SHIFT)\ +- & MICFIL_VAD0_ZCD_ZCDTH_MASK) +-#define MICFIL_VAD0_ZCD_ZCDADJ_SHIFT 8 +-#define MICFIL_VAD0_ZCD_ZCDADJ_WIDTH 4 +-#define MICFIL_VAD0_ZCD_ZCDADJ_MASK ((BIT(MICFIL_VAD0_ZCD_ZCDADJ_WIDTH) - 1)\ +- << MICFIL_VAD0_ZCD_ZCDADJ_SHIFT) +-#define MICFIL_VAD0_ZCD_ZCDADJ(v) (((v) << MICFIL_VAD0_ZCD_ZCDADJ_SHIFT)\ +- & MICFIL_VAD0_ZCD_ZCDADJ_MASK) ++#define MICFIL_VAD0_ZCD_ZCDTH GENMASK(25, 16) ++#define MICFIL_VAD0_ZCD_ZCDADJ_SHIFT GENMASK(11, 8) + #define MICFIL_VAD0_ZCD_ZCDAND BIT(4) + #define MICFIL_VAD0_ZCD_ZCDAUT BIT(2) + #define MICFIL_VAD0_ZCD_ZCDEN BIT(0) +@@ -199,11 +122,6 @@ + #define MICFIL_OUTGAIN_CHX_SHIFT(v) (4 * (v)) + + /* Constants */ +-#define MICFIL_DMA_IRQ_DISABLED(v) ((v) & MICFIL_CTRL1_DISEL_MASK) +-#define MICFIL_DMA_ENABLED(v) ((0x1 << MICFIL_CTRL1_DISEL_SHIFT) \ +- == ((v) & MICFIL_CTRL1_DISEL_MASK)) +-#define MICFIL_IRQ_ENABLED(v) ((0x2 << MICFIL_CTRL1_DISEL_SHIFT) \ +- == ((v) & MICFIL_CTRL1_DISEL_MASK)) + #define MICFIL_OUTPUT_CHANNELS 8 + #define MICFIL_FIFO_NUM 8 + +@@ -215,6 +133,5 @@ + #define MICFIL_SLEEP_MIN 90000 /* in us */ + #define MICFIL_SLEEP_MAX 100000 /* in us */ + #define MICFIL_DMA_MAXBURST_RX 6 +-#define MICFIL_CTRL2_OSR_DEFAULT (0 << MICFIL_CTRL2_CICOSR_SHIFT) + + #endif /* _FSL_MICFIL_H */ +-- +2.43.0 + diff --git a/queue-5.4/bpf-fix-the-xdp_adjust_tail-sample-prog-issue.patch b/queue-5.4/bpf-fix-the-xdp_adjust_tail-sample-prog-issue.patch new file mode 100644 index 00000000000..4d52488d761 --- /dev/null +++ b/queue-5.4/bpf-fix-the-xdp_adjust_tail-sample-prog-issue.patch @@ -0,0 +1,41 @@ +From 095df589744e0521603d7ee9687cea86fb4f09ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2024 10:41:15 +0800 +Subject: bpf: Fix the xdp_adjust_tail sample prog issue + +From: Yuan Chen + +[ Upstream commit 4236f114a3ffbbfd217436c08852e94cae372f57 ] + +During the xdp_adjust_tail test, probabilistic failure occurs and SKB package +is discarded by the kernel. After checking the issues by tracking SKB package, +it is identified that they were caused by checksum errors. Refer to checksum +of the arch/arm64/include/asm/checksum.h for fixing. + +v2: Based on Alexei Starovoitov's suggestions, it is necessary to keep the code + implementation consistent. + +Fixes: c6ffd1ff7856 (bpf: add bpf_xdp_adjust_tail sample prog) +Signed-off-by: Yuan Chen +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20240930024115.52841-1-chenyuan_fl@163.com +Signed-off-by: Sasha Levin +--- + samples/bpf/xdp_adjust_tail_kern.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/samples/bpf/xdp_adjust_tail_kern.c b/samples/bpf/xdp_adjust_tail_kern.c +index cd9ff2a40a398..d9c409190c2c2 100644 +--- a/samples/bpf/xdp_adjust_tail_kern.c ++++ b/samples/bpf/xdp_adjust_tail_kern.c +@@ -54,6 +54,7 @@ static __always_inline void swap_mac(void *data, struct ethhdr *orig_eth) + + static __always_inline __u16 csum_fold_helper(__u32 csum) + { ++ csum = (csum & 0xffff) + (csum >> 16); + return ~((csum & 0xffff) + (csum >> 16)); + } + +-- +2.43.0 + diff --git a/queue-5.4/bpf-sockmap-fix-sk_msg_reset_curr.patch b/queue-5.4/bpf-sockmap-fix-sk_msg_reset_curr.patch new file mode 100644 index 00000000000..67638f805ce --- /dev/null +++ b/queue-5.4/bpf-sockmap-fix-sk_msg_reset_curr.patch @@ -0,0 +1,70 @@ +From 1020e57f25906a132fd076534467dc52c828d503 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 22:25:20 +0000 +Subject: bpf, sockmap: Fix sk_msg_reset_curr + +From: Zijian Zhang + +[ Upstream commit 955afd57dc4bf7e8c620a0a9e3af3c881c2c6dff ] + +Found in the test_txmsg_pull in test_sockmap, +``` +txmsg_cork = 512; // corking is importrant here +opt->iov_length = 3; +opt->iov_count = 1; +opt->rate = 512; // sendmsg will be invoked 512 times +``` +The first sendmsg will send an sk_msg with size 3, and bpf_msg_pull_data +will be invoked the first time. sk_msg_reset_curr will reset the copybreak +from 3 to 0. In the second sendmsg, since we are in the stage of corking, +psock->cork will be reused in func sk_msg_alloc. msg->sg.copybreak is 0 +now, the second msg will overwrite the first msg. As a result, we could +not pass the data integrity test. + +The same problem happens in push and pop test. Thus, fix sk_msg_reset_curr +to restore the correct copybreak. + +Fixes: bb9aefde5bba ("bpf: sockmap, updating the sg structure should also update curr") +Signed-off-by: Zijian Zhang +Link: https://lore.kernel.org/r/20241106222520.527076-9-zijianzhang@bytedance.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 20 +++++++++----------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 5c9b7c270739f..9f67d9f20ae09 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2221,18 +2221,16 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg, u32, bytes) + + static void sk_msg_reset_curr(struct sk_msg *msg) + { +- u32 i = msg->sg.start; +- u32 len = 0; +- +- do { +- len += sk_msg_elem(msg, i)->length; +- sk_msg_iter_var_next(i); +- if (len >= msg->sg.size) +- break; +- } while (i != msg->sg.end); ++ if (!msg->sg.size) { ++ msg->sg.curr = msg->sg.start; ++ msg->sg.copybreak = 0; ++ } else { ++ u32 i = msg->sg.end; + +- msg->sg.curr = i; +- msg->sg.copybreak = 0; ++ sk_msg_iter_var_prev(i); ++ msg->sg.curr = i; ++ msg->sg.copybreak = msg->sg.data[i].length; ++ } + } + + static const struct bpf_func_proto bpf_msg_cork_bytes_proto = { +-- +2.43.0 + diff --git a/queue-5.4/bpf-sockmap-several-fixes-to-bpf_msg_pop_data.patch b/queue-5.4/bpf-sockmap-several-fixes-to-bpf_msg_pop_data.patch new file mode 100644 index 00000000000..b5b58ce9331 --- /dev/null +++ b/queue-5.4/bpf-sockmap-several-fixes-to-bpf_msg_pop_data.patch @@ -0,0 +1,94 @@ +From 1346b131b154f3048efa2fe073b6030ed634e033 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 22:25:19 +0000 +Subject: bpf, sockmap: Several fixes to bpf_msg_pop_data + +From: Zijian Zhang + +[ Upstream commit 5d609ba262475db450ba69b8e8a557bd768ac07a ] + +Several fixes to bpf_msg_pop_data, +1. In sk_msg_shift_left, we should put_page +2. if (len == 0), return early is better +3. pop the entire sk_msg (last == msg->sg.size) should be supported +4. Fix for the value of variable "a" +5. In sk_msg_shift_left, after shifting, i has already pointed to the next +element. Addtional sk_msg_iter_var_next may result in BUG. + +Fixes: 7246d8ed4dcc ("bpf: helper to pop data from messages") +Signed-off-by: Zijian Zhang +Reviewed-by: John Fastabend +Link: https://lore.kernel.org/r/20241106222520.527076-8-zijianzhang@bytedance.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 1fe76d49d7f2c..5c9b7c270739f 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2518,8 +2518,10 @@ static const struct bpf_func_proto bpf_msg_push_data_proto = { + + static void sk_msg_shift_left(struct sk_msg *msg, int i) + { ++ struct scatterlist *sge = sk_msg_elem(msg, i); + int prev; + ++ put_page(sg_page(sge)); + do { + prev = i; + sk_msg_iter_var_next(i); +@@ -2571,7 +2573,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, + } while (i != msg->sg.end); + + /* Bounds checks: start and pop must be inside message */ +- if (start >= offset + l || last >= msg->sg.size) ++ if (start >= offset + l || last > msg->sg.size) + return -EINVAL; + + space = MAX_MSG_FRAGS - sk_msg_elem_used(msg); +@@ -2600,12 +2602,12 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, + */ + if (start != offset) { + struct scatterlist *nsge, *sge = sk_msg_elem(msg, i); +- int a = start; ++ int a = start - offset; + int b = sge->length - pop - a; + + sk_msg_iter_var_next(i); + +- if (pop < sge->length - a) { ++ if (b > 0) { + if (space) { + sge->length = a; + sk_msg_shift_right(msg, i); +@@ -2624,7 +2626,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, + if (unlikely(!page)) + return -ENOMEM; + +- sge->length = a; + orig = sg_page(sge); + from = sg_virt(sge); + to = page_address(page); +@@ -2634,7 +2635,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, + put_page(orig); + } + pop = 0; +- } else if (pop >= sge->length - a) { ++ } else { + pop -= (sge->length - a); + sge->length = a; + } +@@ -2668,7 +2669,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, + pop -= sge->length; + sk_msg_shift_left(msg, i); + } +- sk_msg_iter_var_next(i); + } + + sk_mem_uncharge(msg->sk, len - pop); +-- +2.43.0 + diff --git a/queue-5.4/bpf-sockmap-several-fixes-to-bpf_msg_push_data.patch b/queue-5.4/bpf-sockmap-several-fixes-to-bpf_msg_push_data.patch new file mode 100644 index 00000000000..bf484e15977 --- /dev/null +++ b/queue-5.4/bpf-sockmap-several-fixes-to-bpf_msg_push_data.patch @@ -0,0 +1,132 @@ +From d2f39ff9e878635c5e93cecd2be82138d673e2ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 22:25:18 +0000 +Subject: bpf, sockmap: Several fixes to bpf_msg_push_data + +From: Zijian Zhang + +[ Upstream commit 15ab0548e3107665c34579ae523b2b6e7c22082a ] + +Several fixes to bpf_msg_push_data, +1. test_sockmap has tests where bpf_msg_push_data is invoked to push some +data at the end of a message, but -EINVAL is returned. In this case, in +bpf_msg_push_data, after the first loop, i will be set to msg->sg.end, add +the logic to handle it. +2. In the code block of "if (start - offset)", it's possible that "i" +points to the last of sk_msg_elem. In this case, "sk_msg_iter_next(msg, +end)" might still be called twice, another invoking is in "if (!copy)" +code block, but actually only one is needed. Add the logic to handle it, +and reconstruct the code to make the logic more clear. + +Fixes: 6fff607e2f14 ("bpf: sk_msg program helper bpf_msg_push_data") +Signed-off-by: Zijian Zhang +Link: https://lore.kernel.org/r/20241106222520.527076-7-zijianzhang@bytedance.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 53 +++++++++++++++++++++++++++++------------------ + 1 file changed, 33 insertions(+), 20 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index f82c27668623c..1fe76d49d7f2c 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2392,7 +2392,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, + sk_msg_iter_var_next(i); + } while (i != msg->sg.end); + +- if (start >= offset + l) ++ if (start > offset + l) + return -EINVAL; + + space = MAX_MSG_FRAGS - sk_msg_elem_used(msg); +@@ -2417,6 +2417,8 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, + + raw = page_address(page); + ++ if (i == msg->sg.end) ++ sk_msg_iter_var_prev(i); + psge = sk_msg_elem(msg, i); + front = start - offset; + back = psge->length - front; +@@ -2433,7 +2435,13 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, + } + + put_page(sg_page(psge)); +- } else if (start - offset) { ++ new = i; ++ goto place_new; ++ } ++ ++ if (start - offset) { ++ if (i == msg->sg.end) ++ sk_msg_iter_var_prev(i); + psge = sk_msg_elem(msg, i); + rsge = sk_msg_elem_cpy(msg, i); + +@@ -2444,39 +2452,44 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, + sk_msg_iter_var_next(i); + sg_unmark_end(psge); + sg_unmark_end(&rsge); +- sk_msg_iter_next(msg, end); + } + + /* Slot(s) to place newly allocated data */ ++ sk_msg_iter_next(msg, end); + new = i; ++ sk_msg_iter_var_next(i); ++ ++ if (i == msg->sg.end) { ++ if (!rsge.length) ++ goto place_new; ++ sk_msg_iter_next(msg, end); ++ goto place_new; ++ } + + /* Shift one or two slots as needed */ +- if (!copy) { +- sge = sk_msg_elem_cpy(msg, i); ++ sge = sk_msg_elem_cpy(msg, new); ++ sg_unmark_end(&sge); + ++ nsge = sk_msg_elem_cpy(msg, i); ++ if (rsge.length) { + sk_msg_iter_var_next(i); +- sg_unmark_end(&sge); ++ nnsge = sk_msg_elem_cpy(msg, i); + sk_msg_iter_next(msg, end); ++ } + +- nsge = sk_msg_elem_cpy(msg, i); ++ while (i != msg->sg.end) { ++ msg->sg.data[i] = sge; ++ sge = nsge; ++ sk_msg_iter_var_next(i); + if (rsge.length) { +- sk_msg_iter_var_next(i); ++ nsge = nnsge; + nnsge = sk_msg_elem_cpy(msg, i); +- } +- +- while (i != msg->sg.end) { +- msg->sg.data[i] = sge; +- sge = nsge; +- sk_msg_iter_var_next(i); +- if (rsge.length) { +- nsge = nnsge; +- nnsge = sk_msg_elem_cpy(msg, i); +- } else { +- nsge = sk_msg_elem_cpy(msg, i); +- } ++ } else { ++ nsge = sk_msg_elem_cpy(msg, i); + } + } + ++place_new: + /* Place newly allocated data buffer */ + sk_mem_charge(msg->sk, len); + msg->sg.size += len; +-- +2.43.0 + diff --git a/queue-5.4/clk-axi-clkgen-use-devm_platform_ioremap_resource-sh.patch b/queue-5.4/clk-axi-clkgen-use-devm_platform_ioremap_resource-sh.patch new file mode 100644 index 00000000000..b1698d709cd --- /dev/null +++ b/queue-5.4/clk-axi-clkgen-use-devm_platform_ioremap_resource-sh.patch @@ -0,0 +1,47 @@ +From b8f74f1f2ad0dbd065e2cd430719c22df6ae6075 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Feb 2021 17:12:45 +0200 +Subject: clk: axi-clkgen: use devm_platform_ioremap_resource() short-hand + +From: Alexandru Ardelean + +[ Upstream commit 6ba7ea7630fb03c1ce01508bdf89f5bb39b38e54 ] + +No major functional change. Noticed while checking the driver code that +this could be used. +Saves two lines. + +Signed-off-by: Alexandru Ardelean +Link: https://lore.kernel.org/r/20210201151245.21845-5-alexandru.ardelean@analog.com +Signed-off-by: Stephen Boyd +Stable-dep-of: c64ef7e4851d ("clk: clk-axi-clkgen: make sure to enable the AXI bus clock") +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-axi-clkgen.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/clk/clk-axi-clkgen.c b/drivers/clk/clk-axi-clkgen.c +index 96f351785b41b..8d0c32e81e787 100644 +--- a/drivers/clk/clk-axi-clkgen.c ++++ b/drivers/clk/clk-axi-clkgen.c +@@ -412,7 +412,6 @@ static int axi_clkgen_probe(struct platform_device *pdev) + struct clk_init_data init; + const char *parent_names[2]; + const char *clk_name; +- struct resource *mem; + unsigned int i; + int ret; + +@@ -427,8 +426,7 @@ static int axi_clkgen_probe(struct platform_device *pdev) + if (!axi_clkgen) + return -ENOMEM; + +- mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- axi_clkgen->base = devm_ioremap_resource(&pdev->dev, mem); ++ axi_clkgen->base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(axi_clkgen->base)) + return PTR_ERR(axi_clkgen->base); + +-- +2.43.0 + diff --git a/queue-5.4/clk-clk-axi-clkgen-make-sure-to-enable-the-axi-bus-c.patch b/queue-5.4/clk-clk-axi-clkgen-make-sure-to-enable-the-axi-bus-c.patch new file mode 100644 index 00000000000..e2db1456fcb --- /dev/null +++ b/queue-5.4/clk-clk-axi-clkgen-make-sure-to-enable-the-axi-bus-c.patch @@ -0,0 +1,82 @@ +From 12d0b67eecf4c617af27df4078867a8bc1747b5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2024 14:59:42 +0100 +Subject: clk: clk-axi-clkgen: make sure to enable the AXI bus clock + +From: Nuno Sa + +[ Upstream commit c64ef7e4851d1a9abbb7f7833e4936973ac5ba79 ] + +In order to access the registers of the HW, we need to make sure that +the AXI bus clock is enabled. Hence let's increase the number of clocks +by one. + +In order to keep backward compatibility and make sure old DTs still work +we check if clock-names is available or not. If it is, then we can +disambiguate between really having the AXI clock or a parent clock and +so we can enable the bus clock. If not, we fallback to what was done +before and don't explicitly enable the AXI bus clock. + +Note that if clock-names is given, the axi clock must be the last one in +the phandle array (also enforced in the DT bindings) so that we can reuse +as much code as possible. + +Fixes: 0e646c52cf0e ("clk: Add axi-clkgen driver") +Signed-off-by: Nuno Sa +Link: https://lore.kernel.org/r/20241029-axi-clkgen-fix-axiclk-v2-2-bc5e0733ad76@analog.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-axi-clkgen.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/clk-axi-clkgen.c b/drivers/clk/clk-axi-clkgen.c +index 8d0c32e81e787..73f3bfeb44dc5 100644 +--- a/drivers/clk/clk-axi-clkgen.c ++++ b/drivers/clk/clk-axi-clkgen.c +@@ -7,6 +7,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -412,6 +413,7 @@ static int axi_clkgen_probe(struct platform_device *pdev) + struct clk_init_data init; + const char *parent_names[2]; + const char *clk_name; ++ struct clk *axi_clk; + unsigned int i; + int ret; + +@@ -431,8 +433,24 @@ static int axi_clkgen_probe(struct platform_device *pdev) + return PTR_ERR(axi_clkgen->base); + + init.num_parents = of_clk_get_parent_count(pdev->dev.of_node); +- if (init.num_parents < 1 || init.num_parents > 2) +- return -EINVAL; ++ ++ axi_clk = devm_clk_get_enabled(&pdev->dev, "s_axi_aclk"); ++ if (!IS_ERR(axi_clk)) { ++ if (init.num_parents < 2 || init.num_parents > 3) ++ return -EINVAL; ++ ++ init.num_parents -= 1; ++ } else { ++ /* ++ * Legacy... So that old DTs which do not have clock-names still ++ * work. In this case we don't explicitly enable the AXI bus ++ * clock. ++ */ ++ if (PTR_ERR(axi_clk) != -ENOENT) ++ return PTR_ERR(axi_clk); ++ if (init.num_parents < 1 || init.num_parents > 2) ++ return -EINVAL; ++ } + + for (i = 0; i < init.num_parents; i++) { + parent_names[i] = of_clk_get_parent_name(pdev->dev.of_node, i); +-- +2.43.0 + diff --git a/queue-5.4/cpufreq-loongson2-unregister-platform_driver-on-fail.patch b/queue-5.4/cpufreq-loongson2-unregister-platform_driver-on-fail.patch new file mode 100644 index 00000000000..98e0a57586a --- /dev/null +++ b/queue-5.4/cpufreq-loongson2-unregister-platform_driver-on-fail.patch @@ -0,0 +1,39 @@ +From b63a4b8da43b7fdd425e5d2b3cc4311912980875 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 17:06:15 +0800 +Subject: cpufreq: loongson2: Unregister platform_driver on failure + +From: Yuan Can + +[ Upstream commit 5f856d71ccdf89b4bac0ff70ebb0bb582e7f7f18 ] + +When cpufreq_register_driver() returns error, the cpufreq_init() returns +without unregister platform_driver, fix by add missing +platform_driver_unregister() when cpufreq_register_driver() failed. + +Fixes: f8ede0f700f5 ("MIPS: Loongson 2F: Add CPU frequency scaling support") +Signed-off-by: Yuan Can +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/loongson2_cpufreq.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/loongson2_cpufreq.c b/drivers/cpufreq/loongson2_cpufreq.c +index 890813e0bb768..9685c35c0cfad 100644 +--- a/drivers/cpufreq/loongson2_cpufreq.c ++++ b/drivers/cpufreq/loongson2_cpufreq.c +@@ -167,7 +167,9 @@ static int __init cpufreq_init(void) + + ret = cpufreq_register_driver(&loongson2_cpufreq_driver); + +- if (!ret && !nowait) { ++ if (ret) { ++ platform_driver_unregister(&platform_driver); ++ } else if (!nowait) { + saved_cpu_wait = cpu_wait; + cpu_wait = loongson2_cpu_wait; + } +-- +2.43.0 + diff --git a/queue-5.4/crypto-bcm-add-error-check-in-the-ahash_hmac_init-fu.patch b/queue-5.4/crypto-bcm-add-error-check-in-the-ahash_hmac_init-fu.patch new file mode 100644 index 00000000000..8870477ce29 --- /dev/null +++ b/queue-5.4/crypto-bcm-add-error-check-in-the-ahash_hmac_init-fu.patch @@ -0,0 +1,47 @@ +From 6d3cd16fe2c10f550868147f169cec6cb4817c61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 12:17:45 +0000 +Subject: crypto: bcm - add error check in the ahash_hmac_init function + +From: Chen Ridong + +[ Upstream commit 19630cf57233e845b6ac57c9c969a4888925467b ] + +The ahash_init functions may return fails. The ahash_hmac_init should +not return ok when ahash_init returns error. For an example, ahash_init +will return -ENOMEM when allocation memory is error. + +Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver") +Signed-off-by: Chen Ridong +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/bcm/cipher.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c +index 98b8483577ce2..75fdaa311c4a6 100644 +--- a/drivers/crypto/bcm/cipher.c ++++ b/drivers/crypto/bcm/cipher.c +@@ -2478,6 +2478,7 @@ static int ahash_hmac_setkey(struct crypto_ahash *ahash, const u8 *key, + + static int ahash_hmac_init(struct ahash_request *req) + { ++ int ret; + struct iproc_reqctx_s *rctx = ahash_request_ctx(req); + struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); + struct iproc_ctx_s *ctx = crypto_ahash_ctx(tfm); +@@ -2487,7 +2488,9 @@ static int ahash_hmac_init(struct ahash_request *req) + flow_log("ahash_hmac_init()\n"); + + /* init the context as a hash */ +- ahash_init(req); ++ ret = ahash_init(req); ++ if (ret) ++ return ret; + + if (!spu_no_incr_hash(ctx)) { + /* SPU-M can do incr hashing but needs sw for outer HMAC */ +-- +2.43.0 + diff --git a/queue-5.4/crypto-cavium-fix-an-error-handling-path-in-cpt_ucod.patch b/queue-5.4/crypto-cavium-fix-an-error-handling-path-in-cpt_ucod.patch new file mode 100644 index 00000000000..f667a0deba9 --- /dev/null +++ b/queue-5.4/crypto-cavium-fix-an-error-handling-path-in-cpt_ucod.patch @@ -0,0 +1,38 @@ +From 698d1fcb20f71220da5eabce88a4108de2272420 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2024 18:22:27 +0100 +Subject: crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() + +From: Christophe JAILLET + +[ Upstream commit 572b7cf08403b6c67dfe0dc3e0f2efb42443254f ] + +If do_cpt_init() fails, a previous dma_alloc_coherent() call needs to be +undone. + +Add the needed dma_free_coherent() before returning. + +Fixes: 9e2c7d99941d ("crypto: cavium - Add Support for Octeon-tx CPT Engine") +Signed-off-by: Christophe JAILLET +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/cavium/cpt/cptpf_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/crypto/cavium/cpt/cptpf_main.c b/drivers/crypto/cavium/cpt/cptpf_main.c +index b3db27b142afb..52101755d0ddf 100644 +--- a/drivers/crypto/cavium/cpt/cptpf_main.c ++++ b/drivers/crypto/cavium/cpt/cptpf_main.c +@@ -303,6 +303,8 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) + + ret = do_cpt_init(cpt, mcode); + if (ret) { ++ dma_free_coherent(&cpt->pdev->dev, mcode->code_size, ++ mcode->code, mcode->phys_base); + dev_err(dev, "do_cpt_init failed with ret: %d\n", ret); + goto fw_release; + } +-- +2.43.0 + diff --git a/queue-5.4/crypto-cavium-fix-the-if-condition-to-exit-loop-afte.patch b/queue-5.4/crypto-cavium-fix-the-if-condition-to-exit-loop-afte.patch new file mode 100644 index 00000000000..5ea98138326 --- /dev/null +++ b/queue-5.4/crypto-cavium-fix-the-if-condition-to-exit-loop-afte.patch @@ -0,0 +1,53 @@ +From 96d8df63dd1d7718828729321af864d84c5008e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Oct 2024 10:23:10 -0600 +Subject: crypto: cavium - Fix the if condition to exit loop after timeout + +From: Everest K.C + +[ Upstream commit 53d91ca76b6c426c546542a44c78507b42008c9e ] + +The while loop breaks in the first run because of incorrect +if condition. It also causes the statements after the if to +appear dead. +Fix this by changing the condition from if(timeout--) to +if(!timeout--). + +This bug was reported by Coverity Scan. +Report: +CID 1600859: (#1 of 1): Logically dead code (DEADCODE) +dead_error_line: Execution cannot reach this statement: udelay(30UL); + +Fixes: 9e2c7d99941d ("crypto: cavium - Add Support for Octeon-tx CPT Engine") +Signed-off-by: Everest K.C. +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/cavium/cpt/cptpf_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/cavium/cpt/cptpf_main.c b/drivers/crypto/cavium/cpt/cptpf_main.c +index d9362199423f2..b3db27b142afb 100644 +--- a/drivers/crypto/cavium/cpt/cptpf_main.c ++++ b/drivers/crypto/cavium/cpt/cptpf_main.c +@@ -45,7 +45,7 @@ static void cpt_disable_cores(struct cpt_device *cpt, u64 coremask, + dev_err(dev, "Cores still busy %llx", coremask); + grp = cpt_read_csr64(cpt->reg_base, + CPTX_PF_EXEC_BUSY(0)); +- if (timeout--) ++ if (!timeout--) + break; + + udelay(CSR_DELAY); +@@ -395,7 +395,7 @@ static void cpt_disable_all_cores(struct cpt_device *cpt) + dev_err(dev, "Cores still busy"); + grp = cpt_read_csr64(cpt->reg_base, + CPTX_PF_EXEC_BUSY(0)); +- if (timeout--) ++ if (!timeout--) + break; + + udelay(CSR_DELAY); +-- +2.43.0 + diff --git a/queue-5.4/crypto-pcrypt-call-crypto-layer-directly-when-padata.patch b/queue-5.4/crypto-pcrypt-call-crypto-layer-directly-when-padata.patch new file mode 100644 index 00000000000..32748fe4c20 --- /dev/null +++ b/queue-5.4/crypto-pcrypt-call-crypto-layer-directly-when-padata.patch @@ -0,0 +1,59 @@ +From af719af5b6cfc45c77b467c33f95bf7af4756211 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Oct 2024 02:09:35 +0000 +Subject: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() + return -EBUSY + +From: Yi Yang + +[ Upstream commit 662f2f13e66d3883b9238b0b96b17886179e60e2 ] + +Since commit 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for +PADATA_RESET"), the pcrypt encryption and decryption operations return +-EAGAIN when the CPU goes online or offline. In alg_test(), a WARN is +generated when pcrypt_aead_decrypt() or pcrypt_aead_encrypt() returns +-EAGAIN, the unnecessary panic will occur when panic_on_warn set 1. +Fix this issue by calling crypto layer directly without parallelization +in that case. + +Fixes: 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for PADATA_RESET") +Signed-off-by: Yi Yang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/pcrypt.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c +index 63e64164900e8..9e4179f5717e6 100644 +--- a/crypto/pcrypt.c ++++ b/crypto/pcrypt.c +@@ -118,8 +118,10 @@ static int pcrypt_aead_encrypt(struct aead_request *req) + err = padata_do_parallel(ictx->psenc, padata, &ctx->cb_cpu); + if (!err) + return -EINPROGRESS; +- if (err == -EBUSY) +- return -EAGAIN; ++ if (err == -EBUSY) { ++ /* try non-parallel mode */ ++ return crypto_aead_encrypt(creq); ++ } + + return err; + } +@@ -167,8 +169,10 @@ static int pcrypt_aead_decrypt(struct aead_request *req) + err = padata_do_parallel(ictx->psdec, padata, &ctx->cb_cpu); + if (!err) + return -EINPROGRESS; +- if (err == -EBUSY) +- return -EAGAIN; ++ if (err == -EBUSY) { ++ /* try non-parallel mode */ ++ return crypto_aead_decrypt(creq); ++ } + + return err; + } +-- +2.43.0 + diff --git a/queue-5.4/drm-etnaviv-dump-fix-sparse-warnings.patch b/queue-5.4/drm-etnaviv-dump-fix-sparse-warnings.patch new file mode 100644 index 00000000000..2d5558a8453 --- /dev/null +++ b/queue-5.4/drm-etnaviv-dump-fix-sparse-warnings.patch @@ -0,0 +1,67 @@ +From 465e4477f62c2e9bdceca6c75cb05e235badaff7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Dec 2020 20:51:10 +0100 +Subject: drm/etnaviv: dump: fix sparse warnings + +From: Marc Kleine-Budde + +[ Upstream commit 03a2753936e85beb8239fd20ae3fb2ce90209212 ] + +This patch fixes the following sparse warnings, by adding the missing endianess +conversion functions. + +| etnaviv/etnaviv_dump.c:78:26: warning: restricted __le32 degrades to integer +| etnaviv/etnaviv_dump.c:88:26: warning: incorrect type in assignment (different base types) +| etnaviv/etnaviv_dump.c:88:26: expected restricted __le32 [usertype] reg +| etnaviv/etnaviv_dump.c:88:26: got unsigned short const +| etnaviv/etnaviv_dump.c:89:28: warning: incorrect type in assignment (different base types) +| etnaviv/etnaviv_dump.c:89:28: expected restricted __le32 [usertype] value +| etnaviv/etnaviv_dump.c:89:28: got unsigned int +| etnaviv/etnaviv_dump.c:210:43: warning: incorrect type in assignment (different base types) +| etnaviv/etnaviv_dump.c:210:43: expected restricted __le32 +| etnaviv/etnaviv_dump.c:210:43: got long + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Lucas Stach +Stable-dep-of: 37dc4737447a ("drm/etnaviv: hold GPU lock across perfmon sampling") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_dump.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c +index 67901f4586a3f..827aed62027a2 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c +@@ -75,7 +75,7 @@ static void etnaviv_core_dump_header(struct core_dump_iterator *iter, + hdr->file_size = cpu_to_le32(data_end - iter->data); + + iter->hdr++; +- iter->data += hdr->file_size; ++ iter->data += le32_to_cpu(hdr->file_size); + } + + static void etnaviv_core_dump_registers(struct core_dump_iterator *iter, +@@ -85,8 +85,8 @@ static void etnaviv_core_dump_registers(struct core_dump_iterator *iter, + unsigned int i; + + for (i = 0; i < ARRAY_SIZE(etnaviv_dump_registers); i++, reg++) { +- reg->reg = etnaviv_dump_registers[i]; +- reg->value = gpu_read(gpu, etnaviv_dump_registers[i]); ++ reg->reg = cpu_to_le32(etnaviv_dump_registers[i]); ++ reg->value = cpu_to_le32(gpu_read(gpu, etnaviv_dump_registers[i])); + } + + etnaviv_core_dump_header(iter, ETDUMP_BUF_REG, reg); +@@ -207,7 +207,7 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit) + if (!IS_ERR(pages)) { + int j; + +- iter.hdr->data[0] = bomap - bomap_start; ++ iter.hdr->data[0] = cpu_to_le32((bomap - bomap_start)); + + for (j = 0; j < obj->base.size >> PAGE_SHIFT; j++) + *bomap++ = cpu_to_le64(page_to_phys(*pages++)); +-- +2.43.0 + diff --git a/queue-5.4/drm-etnaviv-fix-power-register-offset-on-gc300.patch b/queue-5.4/drm-etnaviv-fix-power-register-offset-on-gc300.patch new file mode 100644 index 00000000000..84a7e2273e2 --- /dev/null +++ b/queue-5.4/drm-etnaviv-fix-power-register-offset-on-gc300.patch @@ -0,0 +1,158 @@ +From a9654cedd8e1b0bd8461adcd1c91f9bcbe57611f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Sep 2022 13:29:39 -0700 +Subject: drm/etnaviv: fix power register offset on GC300 + +From: Doug Brown + +[ Upstream commit 61a6920bb604df3a0e389a2a9479e1e233e4461d ] + +Older GC300 revisions have their power registers at an offset of 0x200 +rather than 0x100. Add new gpu_read_power and gpu_write_power functions +to encapsulate accesses to the power addresses and fix the addresses. + +Signed-off-by: Doug Brown +Signed-off-by: Lucas Stach +Stable-dep-of: 37dc4737447a ("drm/etnaviv: hold GPU lock across perfmon sampling") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_dump.c | 7 ++++++- + drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 20 ++++++++++---------- + drivers/gpu/drm/etnaviv/etnaviv_gpu.h | 21 +++++++++++++++++++++ + 3 files changed, 37 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c +index 827aed62027a2..8e86cbe52ef83 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c +@@ -83,10 +83,15 @@ static void etnaviv_core_dump_registers(struct core_dump_iterator *iter, + { + struct etnaviv_dump_registers *reg = iter->data; + unsigned int i; ++ u32 read_addr; + + for (i = 0; i < ARRAY_SIZE(etnaviv_dump_registers); i++, reg++) { ++ read_addr = etnaviv_dump_registers[i]; ++ if (read_addr >= VIVS_PM_POWER_CONTROLS && ++ read_addr <= VIVS_PM_PULSE_EATER) ++ read_addr = gpu_fix_power_address(gpu, read_addr); + reg->reg = cpu_to_le32(etnaviv_dump_registers[i]); +- reg->value = cpu_to_le32(gpu_read(gpu, etnaviv_dump_registers[i])); ++ reg->value = cpu_to_le32(gpu_read(gpu, read_addr)); + } + + etnaviv_core_dump_header(iter, ETDUMP_BUF_REG, reg); +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c +index 8c6f9752692df..7b49d3b0840fe 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c +@@ -566,7 +566,7 @@ static void etnaviv_gpu_enable_mlcg(struct etnaviv_gpu *gpu) + u32 pmc, ppc; + + /* enable clock gating */ +- ppc = gpu_read(gpu, VIVS_PM_POWER_CONTROLS); ++ ppc = gpu_read_power(gpu, VIVS_PM_POWER_CONTROLS); + ppc |= VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING; + + /* Disable stall module clock gating for 4.3.0.1 and 4.3.0.2 revs */ +@@ -574,9 +574,9 @@ static void etnaviv_gpu_enable_mlcg(struct etnaviv_gpu *gpu) + gpu->identity.revision == 0x4302) + ppc |= VIVS_PM_POWER_CONTROLS_DISABLE_STALL_MODULE_CLOCK_GATING; + +- gpu_write(gpu, VIVS_PM_POWER_CONTROLS, ppc); ++ gpu_write_power(gpu, VIVS_PM_POWER_CONTROLS, ppc); + +- pmc = gpu_read(gpu, VIVS_PM_MODULE_CONTROLS); ++ pmc = gpu_read_power(gpu, VIVS_PM_MODULE_CONTROLS); + + /* Disable PA clock gating for GC400+ without bugfix except for GC420 */ + if (gpu->identity.model >= chipModel_GC400 && +@@ -605,7 +605,7 @@ static void etnaviv_gpu_enable_mlcg(struct etnaviv_gpu *gpu) + pmc |= VIVS_PM_MODULE_CONTROLS_DISABLE_MODULE_CLOCK_GATING_RA_HZ; + pmc |= VIVS_PM_MODULE_CONTROLS_DISABLE_MODULE_CLOCK_GATING_RA_EZ; + +- gpu_write(gpu, VIVS_PM_MODULE_CONTROLS, pmc); ++ gpu_write_power(gpu, VIVS_PM_MODULE_CONTROLS, pmc); + } + + void etnaviv_gpu_start_fe(struct etnaviv_gpu *gpu, u32 address, u16 prefetch) +@@ -665,11 +665,11 @@ static void etnaviv_gpu_setup_pulse_eater(struct etnaviv_gpu *gpu) + (gpu->identity.features & chipFeatures_PIPE_3D)) + { + /* Performance fix: disable internal DFS */ +- pulse_eater = gpu_read(gpu, VIVS_PM_PULSE_EATER); ++ pulse_eater = gpu_read_power(gpu, VIVS_PM_PULSE_EATER); + pulse_eater |= BIT(18); + } + +- gpu_write(gpu, VIVS_PM_PULSE_EATER, pulse_eater); ++ gpu_write_power(gpu, VIVS_PM_PULSE_EATER, pulse_eater); + } + + static void etnaviv_gpu_hw_init(struct etnaviv_gpu *gpu) +@@ -1237,9 +1237,9 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu, + u32 val; + + /* disable clock gating */ +- val = gpu_read(gpu, VIVS_PM_POWER_CONTROLS); ++ val = gpu_read_power(gpu, VIVS_PM_POWER_CONTROLS); + val &= ~VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING; +- gpu_write(gpu, VIVS_PM_POWER_CONTROLS, val); ++ gpu_write_power(gpu, VIVS_PM_POWER_CONTROLS, val); + + /* enable debug register */ + val = gpu_read(gpu, VIVS_HI_CLOCK_CONTROL); +@@ -1270,9 +1270,9 @@ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu, + gpu_write(gpu, VIVS_HI_CLOCK_CONTROL, val); + + /* enable clock gating */ +- val = gpu_read(gpu, VIVS_PM_POWER_CONTROLS); ++ val = gpu_read_power(gpu, VIVS_PM_POWER_CONTROLS); + val |= VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING; +- gpu_write(gpu, VIVS_PM_POWER_CONTROLS, val); ++ gpu_write_power(gpu, VIVS_PM_POWER_CONTROLS, val); + } + + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.h b/drivers/gpu/drm/etnaviv/etnaviv_gpu.h +index 02478c75f8968..4beb7b2f3eddd 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.h ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.h +@@ -10,6 +10,7 @@ + #include "etnaviv_gem.h" + #include "etnaviv_mmu.h" + #include "etnaviv_drv.h" ++#include "common.xml.h" + + struct etnaviv_gem_submit; + struct etnaviv_vram_mapping; +@@ -158,6 +159,26 @@ static inline u32 gpu_read(struct etnaviv_gpu *gpu, u32 reg) + return readl(gpu->mmio + reg); + } + ++static inline u32 gpu_fix_power_address(struct etnaviv_gpu *gpu, u32 reg) ++{ ++ /* Power registers in GC300 < 2.0 are offset by 0x100 */ ++ if (gpu->identity.model == chipModel_GC300 && ++ gpu->identity.revision < 0x2000) ++ reg += 0x100; ++ ++ return reg; ++} ++ ++static inline void gpu_write_power(struct etnaviv_gpu *gpu, u32 reg, u32 data) ++{ ++ writel(data, gpu->mmio + gpu_fix_power_address(gpu, reg)); ++} ++ ++static inline u32 gpu_read_power(struct etnaviv_gpu *gpu, u32 reg) ++{ ++ return readl(gpu->mmio + gpu_fix_power_address(gpu, reg)); ++} ++ + int etnaviv_gpu_get_param(struct etnaviv_gpu *gpu, u32 param, u64 *value); + + int etnaviv_gpu_init(struct etnaviv_gpu *gpu); +-- +2.43.0 + diff --git a/queue-5.4/drm-etnaviv-hold-gpu-lock-across-perfmon-sampling.patch b/queue-5.4/drm-etnaviv-hold-gpu-lock-across-perfmon-sampling.patch new file mode 100644 index 00000000000..cf9b24164c0 --- /dev/null +++ b/queue-5.4/drm-etnaviv-hold-gpu-lock-across-perfmon-sampling.patch @@ -0,0 +1,78 @@ +From ca4c556fc201868e5fd01dc2597f8ef871ab8f3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jul 2024 22:00:09 +0200 +Subject: drm/etnaviv: hold GPU lock across perfmon sampling + +From: Lucas Stach + +[ Upstream commit 37dc4737447a7667f8e9ec790dac251da057eb27 ] + +The perfmon sampling mutates shared GPU state (e.g. VIVS_HI_CLOCK_CONTROL +to select the pipe for the perf counter reads). To avoid clashing with +other functions mutating the same state (e.g. etnaviv_gpu_update_clock) +the perfmon sampling needs to hold the GPU lock. + +Fixes: 68dc0b295dcb ("drm/etnaviv: use 'sync points' for performance monitor requests") +Reviewed-by: Christian Gmeiner +Signed-off-by: Lucas Stach +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c +index 7b49d3b0840fe..f8e5994bf8161 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c +@@ -1236,6 +1236,8 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu, + { + u32 val; + ++ mutex_lock(&gpu->lock); ++ + /* disable clock gating */ + val = gpu_read_power(gpu, VIVS_PM_POWER_CONTROLS); + val &= ~VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING; +@@ -1247,6 +1249,8 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu, + gpu_write(gpu, VIVS_HI_CLOCK_CONTROL, val); + + sync_point_perfmon_sample(gpu, event, ETNA_PM_PROCESS_PRE); ++ ++ mutex_unlock(&gpu->lock); + } + + static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu, +@@ -1256,13 +1260,9 @@ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu, + unsigned int i; + u32 val; + +- sync_point_perfmon_sample(gpu, event, ETNA_PM_PROCESS_POST); +- +- for (i = 0; i < submit->nr_pmrs; i++) { +- const struct etnaviv_perfmon_request *pmr = submit->pmrs + i; ++ mutex_lock(&gpu->lock); + +- *pmr->bo_vma = pmr->sequence; +- } ++ sync_point_perfmon_sample(gpu, event, ETNA_PM_PROCESS_POST); + + /* disable debug register */ + val = gpu_read(gpu, VIVS_HI_CLOCK_CONTROL); +@@ -1273,6 +1273,14 @@ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu, + val = gpu_read_power(gpu, VIVS_PM_POWER_CONTROLS); + val |= VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING; + gpu_write_power(gpu, VIVS_PM_POWER_CONTROLS, val); ++ ++ mutex_unlock(&gpu->lock); ++ ++ for (i = 0; i < submit->nr_pmrs; i++) { ++ const struct etnaviv_perfmon_request *pmr = submit->pmrs + i; ++ ++ *pmr->bo_vma = pmr->sequence; ++ } + } + + +-- +2.43.0 + diff --git a/queue-5.4/drm-fsl-dcu-convert-to-linux-irq-interfaces.patch b/queue-5.4/drm-fsl-dcu-convert-to-linux-irq-interfaces.patch new file mode 100644 index 00000000000..bcc0f78d45a --- /dev/null +++ b/queue-5.4/drm-fsl-dcu-convert-to-linux-irq-interfaces.patch @@ -0,0 +1,167 @@ +From 75388df24d42977379132c72fd904480f44f1690 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Aug 2021 11:06:54 +0200 +Subject: drm/fsl-dcu: Convert to Linux IRQ interfaces + +From: Thomas Zimmermann + +[ Upstream commit 03ac16e584e496230903ba20f2b4bbfd942a16b4 ] + +Drop the DRM IRQ midlayer in favor of Linux IRQ interfaces. DRM's +IRQ helpers are mostly useful for UMS drivers. Modern KMS drivers +don't benefit from using it. DRM IRQ callbacks are now being called +directly or inlined. + +Signed-off-by: Thomas Zimmermann +Acked-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20210803090704.32152-5-tzimmermann@suse.de +Stable-dep-of: ffcde9e44d3e ("drm: fsl-dcu: enable PIXCLK on LS1021A") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 78 +++++++++++++---------- + 1 file changed, 46 insertions(+), 32 deletions(-) + +diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +index abbc1ddbf27f0..11b4a81bacc68 100644 +--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c ++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +@@ -23,7 +23,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -51,7 +50,7 @@ static const struct regmap_config fsl_dcu_regmap_config = { + .volatile_reg = fsl_dcu_drm_is_volatile_reg, + }; + +-static void fsl_dcu_irq_uninstall(struct drm_device *dev) ++static void fsl_dcu_irq_reset(struct drm_device *dev) + { + struct fsl_dcu_drm_device *fsl_dev = dev->dev_private; + +@@ -59,6 +58,45 @@ static void fsl_dcu_irq_uninstall(struct drm_device *dev) + regmap_write(fsl_dev->regmap, DCU_INT_MASK, ~0); + } + ++static irqreturn_t fsl_dcu_drm_irq(int irq, void *arg) ++{ ++ struct drm_device *dev = arg; ++ struct fsl_dcu_drm_device *fsl_dev = dev->dev_private; ++ unsigned int int_status; ++ int ret; ++ ++ ret = regmap_read(fsl_dev->regmap, DCU_INT_STATUS, &int_status); ++ if (ret) { ++ dev_err(dev->dev, "read DCU_INT_STATUS failed\n"); ++ return IRQ_NONE; ++ } ++ ++ if (int_status & DCU_INT_STATUS_VBLANK) ++ drm_handle_vblank(dev, 0); ++ ++ regmap_write(fsl_dev->regmap, DCU_INT_STATUS, int_status); ++ ++ return IRQ_HANDLED; ++} ++ ++static int fsl_dcu_irq_install(struct drm_device *dev, unsigned int irq) ++{ ++ if (irq == IRQ_NOTCONNECTED) ++ return -ENOTCONN; ++ ++ fsl_dcu_irq_reset(dev); ++ ++ return request_irq(irq, fsl_dcu_drm_irq, 0, dev->driver->name, dev); ++} ++ ++static void fsl_dcu_irq_uninstall(struct drm_device *dev) ++{ ++ struct fsl_dcu_drm_device *fsl_dev = dev->dev_private; ++ ++ fsl_dcu_irq_reset(dev); ++ free_irq(fsl_dev->irq, dev); ++} ++ + static int fsl_dcu_load(struct drm_device *dev, unsigned long flags) + { + struct fsl_dcu_drm_device *fsl_dev = dev->dev_private; +@@ -73,13 +111,13 @@ static int fsl_dcu_load(struct drm_device *dev, unsigned long flags) + ret = drm_vblank_init(dev, dev->mode_config.num_crtc); + if (ret < 0) { + dev_err(dev->dev, "failed to initialize vblank\n"); +- goto done; ++ goto done_vblank; + } + +- ret = drm_irq_install(dev, fsl_dev->irq); ++ ret = fsl_dcu_irq_install(dev, fsl_dev->irq); + if (ret < 0) { + dev_err(dev->dev, "failed to install IRQ handler\n"); +- goto done; ++ goto done_irq; + } + + if (legacyfb_depth != 16 && legacyfb_depth != 24 && +@@ -90,11 +128,11 @@ static int fsl_dcu_load(struct drm_device *dev, unsigned long flags) + } + + return 0; +-done: ++done_irq: + drm_kms_helper_poll_fini(dev); + + drm_mode_config_cleanup(dev); +- drm_irq_uninstall(dev); ++done_vblank: + dev->dev_private = NULL; + + return ret; +@@ -106,41 +144,17 @@ static void fsl_dcu_unload(struct drm_device *dev) + drm_kms_helper_poll_fini(dev); + + drm_mode_config_cleanup(dev); +- drm_irq_uninstall(dev); ++ fsl_dcu_irq_uninstall(dev); + + dev->dev_private = NULL; + } + +-static irqreturn_t fsl_dcu_drm_irq(int irq, void *arg) +-{ +- struct drm_device *dev = arg; +- struct fsl_dcu_drm_device *fsl_dev = dev->dev_private; +- unsigned int int_status; +- int ret; +- +- ret = regmap_read(fsl_dev->regmap, DCU_INT_STATUS, &int_status); +- if (ret) { +- dev_err(dev->dev, "read DCU_INT_STATUS failed\n"); +- return IRQ_NONE; +- } +- +- if (int_status & DCU_INT_STATUS_VBLANK) +- drm_handle_vblank(dev, 0); +- +- regmap_write(fsl_dev->regmap, DCU_INT_STATUS, int_status); +- +- return IRQ_HANDLED; +-} +- + DEFINE_DRM_GEM_CMA_FOPS(fsl_dcu_drm_fops); + + static struct drm_driver fsl_dcu_drm_driver = { + .driver_features = DRIVER_GEM | DRIVER_MODESET | DRIVER_ATOMIC, + .load = fsl_dcu_load, + .unload = fsl_dcu_unload, +- .irq_handler = fsl_dcu_drm_irq, +- .irq_preinstall = fsl_dcu_irq_uninstall, +- .irq_uninstall = fsl_dcu_irq_uninstall, + DRM_GEM_CMA_DRIVER_OPS, + .fops = &fsl_dcu_drm_fops, + .name = "fsl-dcu-drm", +-- +2.43.0 + diff --git a/queue-5.4/drm-fsl-dcu-enable-pixclk-on-ls1021a.patch b/queue-5.4/drm-fsl-dcu-enable-pixclk-on-ls1021a.patch new file mode 100644 index 00000000000..f6a0277c63c --- /dev/null +++ b/queue-5.4/drm-fsl-dcu-enable-pixclk-on-ls1021a.patch @@ -0,0 +1,88 @@ +From 3f5e17e7289a97dfb3542bf9d920346434ef1ece Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2024 07:55:51 +0200 +Subject: drm: fsl-dcu: enable PIXCLK on LS1021A + +From: Matthias Schiffer + +[ Upstream commit ffcde9e44d3e18fde3d18bfff8d9318935413bfd ] + +The PIXCLK needs to be enabled in SCFG before accessing certain DCU +registers, or the access will hang. For simplicity, the PIXCLK is enabled +unconditionally, resulting in increased power consumption. + +Signed-off-by: Matthias Schiffer +Signed-off-by: Alexander Stein +Fixes: 109eee2f2a18 ("drm/layerscape: Add Freescale DCU DRM driver") +Acked-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20240926055552.1632448-2-alexander.stein@ew.tq-group.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/fsl-dcu/Kconfig | 1 + + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 15 +++++++++++++++ + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h | 3 +++ + 3 files changed, 19 insertions(+) + +diff --git a/drivers/gpu/drm/fsl-dcu/Kconfig b/drivers/gpu/drm/fsl-dcu/Kconfig +index d7dd8ba90e3af..9e5a35e7c00cc 100644 +--- a/drivers/gpu/drm/fsl-dcu/Kconfig ++++ b/drivers/gpu/drm/fsl-dcu/Kconfig +@@ -8,6 +8,7 @@ config DRM_FSL_DCU + select DRM_PANEL + select REGMAP_MMIO + select VIDEOMODE_HELPERS ++ select MFD_SYSCON if SOC_LS1021A + help + Choose this option if you have an Freescale DCU chipset. + If M is selected the module will be called fsl-dcu-drm. +diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +index 11b4a81bacc68..1065249807323 100644 +--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c ++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +@@ -100,6 +100,7 @@ static void fsl_dcu_irq_uninstall(struct drm_device *dev) + static int fsl_dcu_load(struct drm_device *dev, unsigned long flags) + { + struct fsl_dcu_drm_device *fsl_dev = dev->dev_private; ++ struct regmap *scfg; + int ret; + + ret = fsl_dcu_drm_modeset_init(fsl_dev); +@@ -108,6 +109,20 @@ static int fsl_dcu_load(struct drm_device *dev, unsigned long flags) + return ret; + } + ++ scfg = syscon_regmap_lookup_by_compatible("fsl,ls1021a-scfg"); ++ if (PTR_ERR(scfg) != -ENODEV) { ++ /* ++ * For simplicity, enable the PIXCLK unconditionally, ++ * resulting in increased power consumption. Disabling ++ * the clock in PM or on unload could be implemented as ++ * a future improvement. ++ */ ++ ret = regmap_update_bits(scfg, SCFG_PIXCLKCR, SCFG_PIXCLKCR_PXCEN, ++ SCFG_PIXCLKCR_PXCEN); ++ if (ret < 0) ++ return dev_err_probe(dev->dev, ret, "failed to enable pixclk\n"); ++ } ++ + ret = drm_vblank_init(dev, dev->mode_config.num_crtc); + if (ret < 0) { + dev_err(dev->dev, "failed to initialize vblank\n"); +diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h +index e2049a0e8a92a..566396013c04a 100644 +--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h ++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h +@@ -160,6 +160,9 @@ + #define FSL_DCU_ARGB4444 12 + #define FSL_DCU_YUV422 14 + ++#define SCFG_PIXCLKCR 0x28 ++#define SCFG_PIXCLKCR_PXCEN BIT(31) ++ + #define VF610_LAYER_REG_NUM 9 + #define LS1021A_LAYER_REG_NUM 10 + +-- +2.43.0 + diff --git a/queue-5.4/drm-fsl-dcu-set-gem-cma-functions-with-drm_gem_cma_d.patch b/queue-5.4/drm-fsl-dcu-set-gem-cma-functions-with-drm_gem_cma_d.patch new file mode 100644 index 00000000000..e9bb0483d18 --- /dev/null +++ b/queue-5.4/drm-fsl-dcu-set-gem-cma-functions-with-drm_gem_cma_d.patch @@ -0,0 +1,42 @@ +From ee7adc74f8e5cf669ef85f7cc517a1b6473c6099 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jun 2020 09:32:15 +0200 +Subject: drm/fsl-dcu: Set GEM CMA functions with DRM_GEM_CMA_DRIVER_OPS + +From: Thomas Zimmermann + +[ Upstream commit 6a32e55d18b34a787f7beaacc912b30b58022646 ] + +DRM_GEM_CMA_DRIVER_OPS sets the functions in struct drm_driver +to their defaults. No functional changes are made. + +Signed-off-by: Thomas Zimmermann +Reviewed-by: Emil Velikov +Link: https://patchwork.freedesktop.org/patch/msgid/20200605073247.4057-12-tzimmermann@suse.de +Stable-dep-of: ffcde9e44d3e ("drm: fsl-dcu: enable PIXCLK on LS1021A") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +index 113d2e30cf952..abbc1ddbf27f0 100644 +--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c ++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +@@ -141,12 +141,7 @@ static struct drm_driver fsl_dcu_drm_driver = { + .irq_handler = fsl_dcu_drm_irq, + .irq_preinstall = fsl_dcu_irq_uninstall, + .irq_uninstall = fsl_dcu_irq_uninstall, +- .gem_create_object = drm_gem_cma_create_object_default_funcs, +- .prime_handle_to_fd = drm_gem_prime_handle_to_fd, +- .prime_fd_to_handle = drm_gem_prime_fd_to_handle, +- .gem_prime_import_sg_table = drm_gem_cma_prime_import_sg_table, +- .gem_prime_mmap = drm_gem_cma_prime_mmap, +- .dumb_create = drm_gem_cma_dumb_create, ++ DRM_GEM_CMA_DRIVER_OPS, + .fops = &fsl_dcu_drm_fops, + .name = "fsl-dcu-drm", + .desc = "Freescale DCU DRM", +-- +2.43.0 + diff --git a/queue-5.4/drm-fsl-dcu-use-gem-cma-object-functions.patch b/queue-5.4/drm-fsl-dcu-use-gem-cma-object-functions.patch new file mode 100644 index 00000000000..3c47b208243 --- /dev/null +++ b/queue-5.4/drm-fsl-dcu-use-gem-cma-object-functions.patch @@ -0,0 +1,52 @@ +From 73437846418b6f526094a7add1159ad5ac2dfda0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jun 2020 09:32:14 +0200 +Subject: drm/fsl-dcu: Use GEM CMA object functions + +From: Thomas Zimmermann + +[ Upstream commit 929027087f527ef1d9e906e4ebeca7eb3a36042e ] + +Create GEM objects with drm_gem_cma_create_object_default_funcs(), which +allocates the object and sets CMA's default object functions. Corresponding +callbacks in struct drm_driver are cleared. No functional changes are made. + +Driver and object-function instances use the same callback functions, with +the exception of vunmap. The implementation of vunmap is empty and left out +in CMA's default object functions. + +v3: + * convert to DRIVER_OPS macro in a separate patch + +Signed-off-by: Thomas Zimmermann +Reviewed-by: Emil Velikov +Link: https://patchwork.freedesktop.org/patch/msgid/20200605073247.4057-11-tzimmermann@suse.de +Stable-dep-of: ffcde9e44d3e ("drm: fsl-dcu: enable PIXCLK on LS1021A") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +index f15d2e7967a3e..113d2e30cf952 100644 +--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c ++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +@@ -141,14 +141,10 @@ static struct drm_driver fsl_dcu_drm_driver = { + .irq_handler = fsl_dcu_drm_irq, + .irq_preinstall = fsl_dcu_irq_uninstall, + .irq_uninstall = fsl_dcu_irq_uninstall, +- .gem_free_object_unlocked = drm_gem_cma_free_object, +- .gem_vm_ops = &drm_gem_cma_vm_ops, ++ .gem_create_object = drm_gem_cma_create_object_default_funcs, + .prime_handle_to_fd = drm_gem_prime_handle_to_fd, + .prime_fd_to_handle = drm_gem_prime_fd_to_handle, +- .gem_prime_get_sg_table = drm_gem_cma_prime_get_sg_table, + .gem_prime_import_sg_table = drm_gem_cma_prime_import_sg_table, +- .gem_prime_vmap = drm_gem_cma_prime_vmap, +- .gem_prime_vunmap = drm_gem_cma_prime_vunmap, + .gem_prime_mmap = drm_gem_cma_prime_mmap, + .dumb_create = drm_gem_cma_dumb_create, + .fops = &fsl_dcu_drm_fops, +-- +2.43.0 + diff --git a/queue-5.4/drm-imx-ipuv3-use-irqf_no_autoen-flag-in-request_irq.patch b/queue-5.4/drm-imx-ipuv3-use-irqf_no_autoen-flag-in-request_irq.patch new file mode 100644 index 00000000000..e9dcfd57d34 --- /dev/null +++ b/queue-5.4/drm-imx-ipuv3-use-irqf_no_autoen-flag-in-request_irq.patch @@ -0,0 +1,48 @@ +From c115f93d8dafdc91344fb379cf1c2e0d616bb3e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2024 16:30:18 +0800 +Subject: drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq() + +From: Jinjie Ruan + +[ Upstream commit 40004709a3d3b07041a473a163ca911ef04ab8bd ] + +disable_irq() after request_irq() still has a time gap in which +interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will +disable IRQ auto-enable when request IRQ. + +Fixes: 47b1be5c0f4e ("staging: imx/drm: request irq only after adding the crtc") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Jinjie Ruan +Reviewed-by: Philipp Zabel +Link: https://patchwork.freedesktop.org/patch/msgid/20240912083020.3720233-4-ruanjinjie@huawei.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/imx/ipuv3-crtc.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c +index f19264e91d4db..49a71ee5c583c 100644 +--- a/drivers/gpu/drm/imx/ipuv3-crtc.c ++++ b/drivers/gpu/drm/imx/ipuv3-crtc.c +@@ -411,14 +411,12 @@ static int ipu_crtc_init(struct ipu_crtc *ipu_crtc, + } + + ipu_crtc->irq = ipu_plane_irq(ipu_crtc->plane[0]); +- ret = devm_request_irq(ipu_crtc->dev, ipu_crtc->irq, ipu_irq_handler, 0, +- "imx_drm", ipu_crtc); ++ ret = devm_request_irq(ipu_crtc->dev, ipu_crtc->irq, ipu_irq_handler, ++ IRQF_NO_AUTOEN, "imx_drm", ipu_crtc); + if (ret < 0) { + dev_err(ipu_crtc->dev, "irq request failed with %d.\n", ret); + goto err_put_plane1_res; + } +- /* Only enable IRQ when we actually need it to trigger work. */ +- disable_irq(ipu_crtc->irq); + + return 0; + +-- +2.43.0 + diff --git a/queue-5.4/drm-mm-mark-drm_mm_interval_tree-functions-with-__ma.patch b/queue-5.4/drm-mm-mark-drm_mm_interval_tree-functions-with-__ma.patch new file mode 100644 index 00000000000..f4a989a6981 --- /dev/null +++ b/queue-5.4/drm-mm-mark-drm_mm_interval_tree-functions-with-__ma.patch @@ -0,0 +1,52 @@ +From 83ce0a39d573508c44867d5291f265c104400bb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2024 18:46:40 +0300 +Subject: drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused + +From: Andy Shevchenko + +[ Upstream commit 53bd7c1c0077db533472ae32799157758302ef48 ] + +The INTERVAL_TREE_DEFINE() uncoditionally provides a bunch of helper +functions which in some cases may be not used. This, in particular, +prevents kernel builds with clang, `make W=1` and CONFIG_WERROR=y: + +.../drm/drm_mm.c:152:1: error: unused function 'drm_mm_interval_tree_insert' [-Werror,-Wunused-function] + 152 | INTERVAL_TREE_DEFINE(struct drm_mm_node, rb, + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 153 | u64, __subtree_last, + | ~~~~~~~~~~~~~~~~~~~~ + 154 | START, LAST, static inline, drm_mm_interval_tree) + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Fix this by marking drm_mm_interval_tree*() functions with __maybe_unused. + +See also commit 6863f5643dd7 ("kbuild: allow Clang to find unused static +inline functions for W=1 build"). + +Fixes: 202b52b7fbf7 ("drm: Track drm_mm nodes with an interval tree") +Signed-off-by: Andy Shevchenko +Reviewed-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20240829154640.1120050-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_mm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c +index 4581c53873722..d00ffa51f544a 100644 +--- a/drivers/gpu/drm/drm_mm.c ++++ b/drivers/gpu/drm/drm_mm.c +@@ -154,7 +154,7 @@ static void show_leaks(struct drm_mm *mm) { } + + INTERVAL_TREE_DEFINE(struct drm_mm_node, rb, + u64, __subtree_last, +- START, LAST, static inline, drm_mm_interval_tree) ++ START, LAST, static inline __maybe_unused, drm_mm_interval_tree) + + struct drm_mm_node * + __drm_mm_interval_first(const struct drm_mm *mm, u64 start, u64 last) +-- +2.43.0 + diff --git a/queue-5.4/drm-msm-adreno-use-irqf_no_autoen-flag-in-request_ir.patch b/queue-5.4/drm-msm-adreno-use-irqf_no_autoen-flag-in-request_ir.patch new file mode 100644 index 00000000000..5eca33aace9 --- /dev/null +++ b/queue-5.4/drm-msm-adreno-use-irqf_no_autoen-flag-in-request_ir.patch @@ -0,0 +1,47 @@ +From b37e85045991c8dcd710c98edc684af5e0576a8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2024 16:30:20 +0800 +Subject: drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq() + +From: Jinjie Ruan + +[ Upstream commit 394679f322649d06fea3c646ba65f5a0887f52c3 ] + +disable_irq() after request_irq() still has a time gap in which +interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will +disable IRQ auto-enable when request IRQ. + +Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Jinjie Ruan +Patchwork: https://patchwork.freedesktop.org/patch/614075/ +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +index 40431a09dc97c..55ff242292f3d 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +@@ -1233,15 +1233,13 @@ static int a6xx_gmu_get_irq(struct a6xx_gmu *gmu, struct platform_device *pdev, + + irq = platform_get_irq_byname(pdev, name); + +- ret = request_irq(irq, handler, IRQF_TRIGGER_HIGH, name, gmu); ++ ret = request_irq(irq, handler, IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN, name, gmu); + if (ret) { + DRM_DEV_ERROR(&pdev->dev, "Unable to get interrupt %s %d\n", + name, ret); + return ret; + } + +- disable_irq(irq); +- + return irq; + } + +-- +2.43.0 + diff --git a/queue-5.4/drm-omap-fix-locking-in-omap_gem_new_dmabuf.patch b/queue-5.4/drm-omap-fix-locking-in-omap_gem_new_dmabuf.patch new file mode 100644 index 00000000000..5ac0a36a894 --- /dev/null +++ b/queue-5.4/drm-omap-fix-locking-in-omap_gem_new_dmabuf.patch @@ -0,0 +1,76 @@ +From a763acc77ff04da3530c02eaece51f9c75629dc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2024 16:50:29 +0300 +Subject: drm/omap: Fix locking in omap_gem_new_dmabuf() + +From: Tomi Valkeinen + +[ Upstream commit e6a1c4037227539373c8cf484ace83833e2ad6a2 ] + +omap_gem_new_dmabuf() creates the new gem object, and then takes and +holds the omap_obj->lock for the rest of the function. This has two +issues: + +- omap_gem_free_object(), which is called in the error paths, also takes + the same lock, leading to deadlock +- Even if the above wouldn't happen, in the error cases + omap_gem_new_dmabuf() still unlocks omap_obj->lock, even after the + omap_obj has already been freed. + +Furthermore, I don't think there's any reason to take the lock at all, +as the object was just created and not yet shared with anyone else. + +To fix all this, drop taking the lock. + +Fixes: 3cbd0c587b12 ("drm/omap: gem: Replace struct_mutex usage with omap_obj private lock") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/all/511b99d7-aade-4f92-bd3e-63163a13d617@stanley.mountain/ +Reviewed-by: Sebastian Reichel +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20240806-omapdrm-misc-fixes-v1-3-15d31aea0831@ideasonboard.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/omapdrm/omap_gem.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/omapdrm/omap_gem.c b/drivers/gpu/drm/omapdrm/omap_gem.c +index 08f539efddfb1..b5c6cf84835c1 100644 +--- a/drivers/gpu/drm/omapdrm/omap_gem.c ++++ b/drivers/gpu/drm/omapdrm/omap_gem.c +@@ -1244,8 +1244,6 @@ struct drm_gem_object *omap_gem_new_dmabuf(struct drm_device *dev, size_t size, + + omap_obj = to_omap_bo(obj); + +- mutex_lock(&omap_obj->lock); +- + omap_obj->sgt = sgt; + + if (sgt->orig_nents == 1) { +@@ -1261,8 +1259,7 @@ struct drm_gem_object *omap_gem_new_dmabuf(struct drm_device *dev, size_t size, + pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL); + if (!pages) { + omap_gem_free_object(obj); +- obj = ERR_PTR(-ENOMEM); +- goto done; ++ return ERR_PTR(-ENOMEM); + } + + omap_obj->pages = pages; +@@ -1275,13 +1272,10 @@ struct drm_gem_object *omap_gem_new_dmabuf(struct drm_device *dev, size_t size, + + if (WARN_ON(i != npages)) { + omap_gem_free_object(obj); +- obj = ERR_PTR(-ENOMEM); +- goto done; ++ return ERR_PTR(-ENOMEM); + } + } + +-done: +- mutex_unlock(&omap_obj->lock); + return obj; + } + +-- +2.43.0 + diff --git a/queue-5.4/drm-panfrost-remove-unused-id_mask-from-struct-panfr.patch b/queue-5.4/drm-panfrost-remove-unused-id_mask-from-struct-panfr.patch new file mode 100644 index 00000000000..8c67dd2629f --- /dev/null +++ b/queue-5.4/drm-panfrost-remove-unused-id_mask-from-struct-panfr.patch @@ -0,0 +1,35 @@ +From c270d2639a88033a58ee37ab9c2c87a99819cfcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 15:00:07 +0100 +Subject: drm/panfrost: Remove unused id_mask from struct panfrost_model + +From: Steven Price + +[ Upstream commit 581d1f8248550f2b67847e6d84f29fbe3751ea0a ] + +The id_mask field of struct panfrost_model has never been used. + +Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver") +Signed-off-by: Steven Price +Reviewed-by: Boris Brezillon +Link: https://patchwork.freedesktop.org/patch/msgid/20241025140008.385081-1-steven.price@arm.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panfrost/panfrost_gpu.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c +index 0d39a201c7591..c0260a14639a0 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c +@@ -153,7 +153,6 @@ static void panfrost_gpu_init_quirks(struct panfrost_device *pfdev) + struct panfrost_model { + const char *name; + u32 id; +- u32 id_mask; + u64 features; + u64 issues; + struct { +-- +2.43.0 + diff --git a/queue-5.4/dt-bindings-clock-adi-axi-clkgen-convert-old-binding.patch b/queue-5.4/dt-bindings-clock-adi-axi-clkgen-convert-old-binding.patch new file mode 100644 index 00000000000..5c1ab3e6f35 --- /dev/null +++ b/queue-5.4/dt-bindings-clock-adi-axi-clkgen-convert-old-binding.patch @@ -0,0 +1,127 @@ +From d53e38bac055b07bd296d6758476be65a2748d7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 17:34:20 +0300 +Subject: dt-bindings: clock: adi,axi-clkgen: convert old binding to yaml + format + +From: Alexandru Ardelean + +[ Upstream commit bd91abb218e0ac4a7402d6c25d383e2a706bb511 ] + +This change converts the old binding for the AXI clkgen driver to a yaml +format. + +As maintainers, added: + - Lars-Peter Clausen - as original author of driver & + binding + - Michael Hennerich - as supporter of + Analog Devices drivers + +Acked-by: Michael Hennerich +Acked-by: Lars-Peter Clausen +Signed-off-by: Alexandru Ardelean +Link: https://lore.kernel.org/r/20201013143421.84188-1-alexandru.ardelean@analog.com +Reviewed-by: Rob Herring +Signed-off-by: Stephen Boyd +Stable-dep-of: 47f3f5a82a31 ("dt-bindings: clock: axi-clkgen: include AXI clk") +Signed-off-by: Sasha Levin +--- + .../bindings/clock/adi,axi-clkgen.yaml | 53 +++++++++++++++++++ + .../devicetree/bindings/clock/axi-clkgen.txt | 25 --------- + 2 files changed, 53 insertions(+), 25 deletions(-) + create mode 100644 Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml + delete mode 100644 Documentation/devicetree/bindings/clock/axi-clkgen.txt + +diff --git a/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml b/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml +new file mode 100644 +index 0000000000000..0d06387184d68 +--- /dev/null ++++ b/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml +@@ -0,0 +1,53 @@ ++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) ++%YAML 1.2 ++--- ++$id: http://devicetree.org/schemas/clock/adi,axi-clkgen.yaml# ++$schema: http://devicetree.org/meta-schemas/core.yaml# ++ ++title: Binding for Analog Devices AXI clkgen pcore clock generator ++ ++maintainers: ++ - Lars-Peter Clausen ++ - Michael Hennerich ++ ++description: | ++ The axi_clkgen IP core is a software programmable clock generator, ++ that can be synthesized on various FPGA platforms. ++ ++ Link: https://wiki.analog.com/resources/fpga/docs/axi_clkgen ++ ++properties: ++ compatible: ++ enum: ++ - adi,axi-clkgen-2.00.a ++ ++ clocks: ++ description: ++ Specifies the reference clock(s) from which the output frequency is ++ derived. This must either reference one clock if only the first clock ++ input is connected or two if both clock inputs are connected. ++ minItems: 1 ++ maxItems: 2 ++ ++ '#clock-cells': ++ const: 0 ++ ++ reg: ++ maxItems: 1 ++ ++required: ++ - compatible ++ - reg ++ - clocks ++ - '#clock-cells' ++ ++additionalProperties: false ++ ++examples: ++ - | ++ clock-controller@ff000000 { ++ compatible = "adi,axi-clkgen-2.00.a"; ++ #clock-cells = <0>; ++ reg = <0xff000000 0x1000>; ++ clocks = <&osc 1>; ++ }; +diff --git a/Documentation/devicetree/bindings/clock/axi-clkgen.txt b/Documentation/devicetree/bindings/clock/axi-clkgen.txt +deleted file mode 100644 +index aca94fe9416f0..0000000000000 +--- a/Documentation/devicetree/bindings/clock/axi-clkgen.txt ++++ /dev/null +@@ -1,25 +0,0 @@ +-Binding for the axi-clkgen clock generator +- +-This binding uses the common clock binding[1]. +- +-[1] Documentation/devicetree/bindings/clock/clock-bindings.txt +- +-Required properties: +-- compatible : shall be "adi,axi-clkgen-1.00.a" or "adi,axi-clkgen-2.00.a". +-- #clock-cells : from common clock binding; Should always be set to 0. +-- reg : Address and length of the axi-clkgen register set. +-- clocks : Phandle and clock specifier for the parent clock(s). This must +- either reference one clock if only the first clock input is connected or two +- if both clock inputs are connected. For the later case the clock connected +- to the first input must be specified first. +- +-Optional properties: +-- clock-output-names : From common clock binding. +- +-Example: +- clock@ff000000 { +- compatible = "adi,axi-clkgen"; +- #clock-cells = <0>; +- reg = <0xff000000 0x1000>; +- clocks = <&osc 1>; +- }; +-- +2.43.0 + diff --git a/queue-5.4/dt-bindings-clock-axi-clkgen-include-axi-clk.patch b/queue-5.4/dt-bindings-clock-axi-clkgen-include-axi-clk.patch new file mode 100644 index 00000000000..7d09a41499f --- /dev/null +++ b/queue-5.4/dt-bindings-clock-axi-clkgen-include-axi-clk.patch @@ -0,0 +1,72 @@ +From e2b9381f4020618314b41a4967a9700a9547d3ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2024 14:59:41 +0100 +Subject: dt-bindings: clock: axi-clkgen: include AXI clk + +From: Nuno Sa + +[ Upstream commit 47f3f5a82a31527e027929c5cec3dd1ef5ef30f5 ] + +In order to access the registers of the HW, we need to make sure that +the AXI bus clock is enabled. Hence let's increase the number of clocks +by one and add clock-names to differentiate between parent clocks and +the bus clock. + +Fixes: 0e646c52cf0e ("clk: Add axi-clkgen driver") +Signed-off-by: Nuno Sa +Link: https://lore.kernel.org/r/20241029-axi-clkgen-fix-axiclk-v2-1-bc5e0733ad76@analog.com +Reviewed-by: Conor Dooley +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + .../bindings/clock/adi,axi-clkgen.yaml | 22 +++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml b/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml +index 0d06387184d68..bb2eec3021a09 100644 +--- a/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml ++++ b/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml +@@ -25,9 +25,21 @@ properties: + description: + Specifies the reference clock(s) from which the output frequency is + derived. This must either reference one clock if only the first clock +- input is connected or two if both clock inputs are connected. +- minItems: 1 +- maxItems: 2 ++ input is connected or two if both clock inputs are connected. The last ++ clock is the AXI bus clock that needs to be enabled so we can access the ++ core registers. ++ minItems: 2 ++ maxItems: 3 ++ ++ clock-names: ++ oneOf: ++ - items: ++ - const: clkin1 ++ - const: s_axi_aclk ++ - items: ++ - const: clkin1 ++ - const: clkin2 ++ - const: s_axi_aclk + + '#clock-cells': + const: 0 +@@ -39,6 +51,7 @@ required: + - compatible + - reg + - clocks ++ - clock-names + - '#clock-cells' + + additionalProperties: false +@@ -49,5 +62,6 @@ examples: + compatible = "adi,axi-clkgen-2.00.a"; + #clock-cells = <0>; + reg = <0xff000000 0x1000>; +- clocks = <&osc 1>; ++ clocks = <&osc 1>, <&clkc 15>; ++ clock-names = "clkin1", "s_axi_aclk"; + }; +-- +2.43.0 + diff --git a/queue-5.4/dt-bindings-vendor-prefixes-add-neofidelity-inc.patch b/queue-5.4/dt-bindings-vendor-prefixes-add-neofidelity-inc.patch new file mode 100644 index 00000000000..4f700d053c1 --- /dev/null +++ b/queue-5.4/dt-bindings-vendor-prefixes-add-neofidelity-inc.patch @@ -0,0 +1,36 @@ +From c73c8e4531faf2650b76e7582345d6924cc93c90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2024 17:52:39 +0300 +Subject: dt-bindings: vendor-prefixes: Add NeoFidelity, Inc + +From: Igor Prusov + +[ Upstream commit 5d9e6d6fc1b98c8c22d110ee931b3b233d43cd13 ] + +Add vendor prefix for NeoFidelity, Inc + +Signed-off-by: Igor Prusov +Acked-by: Krzysztof Kozlowski +Link: https://patch.msgid.link/20240925-ntp-amps-8918-8835-v3-1-e2459a8191a6@salutedevices.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml +index 967e78c5ec0a1..e4d25efe49b8c 100644 +--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml ++++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml +@@ -633,6 +633,8 @@ patternProperties: + description: National Semiconductor + "^nec,.*": + description: NEC LCD Technologies, Ltd. ++ "^neofidelity,.*": ++ description: Neofidelity Inc. + "^neonode,.*": + description: Neonode Inc. + "^netgear,.*": +-- +2.43.0 + diff --git a/queue-5.4/edac-bluefield-fix-potential-integer-overflow.patch b/queue-5.4/edac-bluefield-fix-potential-integer-overflow.patch new file mode 100644 index 00000000000..841b84a5048 --- /dev/null +++ b/queue-5.4/edac-bluefield-fix-potential-integer-overflow.patch @@ -0,0 +1,43 @@ +From 73faf74f0fd36de34cfc2e75555e736c315cf1a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2024 11:10:56 -0400 +Subject: EDAC/bluefield: Fix potential integer overflow + +From: David Thompson + +[ Upstream commit 1fe774a93b46bb029b8f6fa9d1f25affa53f06c6 ] + +The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx +left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as +32-bits wide the left-shift operation truncates the upper 16 bits of +information during the calculation of the SMC argument. + +The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any +potential integer overflow, i.e. loss of data from upper 16 bits. + +Fixes: 82413e562ea6 ("EDAC, mellanox: Add ECC support for BlueField DDR4") +Signed-off-by: David Thompson +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Shravan Kumar Ramani +Link: https://lore.kernel.org/r/20240930151056.10158-1-davthompson@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/edac/bluefield_edac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/edac/bluefield_edac.c b/drivers/edac/bluefield_edac.c +index e4736eb37bfb3..0ef0489827682 100644 +--- a/drivers/edac/bluefield_edac.c ++++ b/drivers/edac/bluefield_edac.c +@@ -180,7 +180,7 @@ static void bluefield_edac_check(struct mem_ctl_info *mci) + static void bluefield_edac_init_dimms(struct mem_ctl_info *mci) + { + struct bluefield_edac_priv *priv = mci->pvt_info; +- int mem_ctrl_idx = mci->mc_idx; ++ u64 mem_ctrl_idx = mci->mc_idx; + struct dimm_info *dimm; + u64 smc_info, smc_arg; + int is_empty = 1, i; +-- +2.43.0 + diff --git a/queue-5.4/edac-fsl_ddr-fix-bad-bit-shift-operations.patch b/queue-5.4/edac-fsl_ddr-fix-bad-bit-shift-operations.patch new file mode 100644 index 00000000000..5ed0fc7dce9 --- /dev/null +++ b/queue-5.4/edac-fsl_ddr-fix-bad-bit-shift-operations.patch @@ -0,0 +1,75 @@ +From fc61dae43725639422b2151ad1ef5608b7ac9566 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 16:31:11 -0400 +Subject: EDAC/fsl_ddr: Fix bad bit shift operations + +From: Priyanka Singh + +[ Upstream commit 9ec22ac4fe766c6abba845290d5139a3fbe0153b ] + +Fix undefined behavior caused by left-shifting a negative value in the +expression: + + cap_high ^ (1 << (bad_data_bit - 32)) + +The variable bad_data_bit ranges from 0 to 63. When it is less than 32, +bad_data_bit - 32 becomes negative, and left-shifting by a negative +value in C is undefined behavior. + +Fix this by combining cap_high and cap_low into a 64-bit variable. + + [ bp: Massage commit message, simplify error bits handling. ] + +Fixes: ea2eb9a8b620 ("EDAC, fsl-ddr: Separate FSL DDR driver from MPC85xx") +Signed-off-by: Priyanka Singh +Signed-off-by: Li Yang +Signed-off-by: Frank Li +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20241016-imx95_edac-v3-3-86ae6fc2756a@nxp.com +Signed-off-by: Sasha Levin +--- + drivers/edac/fsl_ddr_edac.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/edac/fsl_ddr_edac.c b/drivers/edac/fsl_ddr_edac.c +index 6d8ea226010d2..61e59341a41f9 100644 +--- a/drivers/edac/fsl_ddr_edac.c ++++ b/drivers/edac/fsl_ddr_edac.c +@@ -331,21 +331,25 @@ static void fsl_mc_check(struct mem_ctl_info *mci) + * TODO: Add support for 32-bit wide buses + */ + if ((err_detect & DDR_EDE_SBE) && (bus_width == 64)) { ++ u64 cap = (u64)cap_high << 32 | cap_low; ++ u32 s = syndrome; ++ + sbe_ecc_decode(cap_high, cap_low, syndrome, + &bad_data_bit, &bad_ecc_bit); + +- if (bad_data_bit != -1) +- fsl_mc_printk(mci, KERN_ERR, +- "Faulty Data bit: %d\n", bad_data_bit); +- if (bad_ecc_bit != -1) +- fsl_mc_printk(mci, KERN_ERR, +- "Faulty ECC bit: %d\n", bad_ecc_bit); ++ if (bad_data_bit >= 0) { ++ fsl_mc_printk(mci, KERN_ERR, "Faulty Data bit: %d\n", bad_data_bit); ++ cap ^= 1ULL << bad_data_bit; ++ } ++ ++ if (bad_ecc_bit >= 0) { ++ fsl_mc_printk(mci, KERN_ERR, "Faulty ECC bit: %d\n", bad_ecc_bit); ++ s ^= 1 << bad_ecc_bit; ++ } + + fsl_mc_printk(mci, KERN_ERR, + "Expected Data / ECC:\t%#8.8x_%08x / %#2.2x\n", +- cap_high ^ (1 << (bad_data_bit - 32)), +- cap_low ^ (1 << bad_data_bit), +- syndrome ^ (1 << bad_ecc_bit)); ++ upper_32_bits(cap), lower_32_bits(cap), s); + } + + fsl_mc_printk(mci, KERN_ERR, +-- +2.43.0 + diff --git a/queue-5.4/efi-tpm-pass-correct-address-to-memblock_reserve.patch b/queue-5.4/efi-tpm-pass-correct-address-to-memblock_reserve.patch new file mode 100644 index 00000000000..d759448a00f --- /dev/null +++ b/queue-5.4/efi-tpm-pass-correct-address-to-memblock_reserve.patch @@ -0,0 +1,47 @@ +From b3c1bfc3596f46a428d00d40e63029bfb61d5eab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Oct 2022 08:23:52 -0700 +Subject: efi/tpm: Pass correct address to memblock_reserve + +From: Jerry Snitselaar + +[ Upstream commit f4cd18c5b2000df0c382f6530eeca9141ea41faf ] + +memblock_reserve() expects a physical address, but the address being +passed for the TPM final events log is what was returned from +early_memremap(). This results in something like the following: + +[ 0.000000] memblock_reserve: [0xffffffffff2c0000-0xffffffffff2c00e4] efi_tpm_eventlog_init+0x324/0x370 + +Pass the address from efi like what is done for the TPM events log. + +Fixes: c46f3405692d ("tpm: Reserve the TPM final events table") +Cc: Matthew Garrett +Cc: Jarkko Sakkinen +Cc: Bartosz Szczepanek +Cc: Ard Biesheuvel +Signed-off-by: Jerry Snitselaar +Acked-by: Jarkko Sakkinen +Signed-off-by: Ard Biesheuvel +Stable-dep-of: e6d654e9f5a9 ("tpm: fix signed/unsigned bug when checking event logs") +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/tpm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c +index 8f665678e9e39..e8d69bd548f3f 100644 +--- a/drivers/firmware/efi/tpm.c ++++ b/drivers/firmware/efi/tpm.c +@@ -97,7 +97,7 @@ int __init efi_tpm_eventlog_init(void) + goto out_calc; + } + +- memblock_reserve((unsigned long)final_tbl, ++ memblock_reserve(efi.tpm_final_log, + tbl_size + sizeof(*final_tbl)); + efi_tpm_final_log_size = tbl_size; + +-- +2.43.0 + diff --git a/queue-5.4/fbdev-sh7760fb-alloc-dma-memory-from-hardware-device.patch b/queue-5.4/fbdev-sh7760fb-alloc-dma-memory-from-hardware-device.patch new file mode 100644 index 00000000000..ac75b1f6414 --- /dev/null +++ b/queue-5.4/fbdev-sh7760fb-alloc-dma-memory-from-hardware-device.patch @@ -0,0 +1,65 @@ +From 9185ff48bcbf04fccafdee7e7a1bae85c1c27316 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 13:07:02 +0200 +Subject: fbdev/sh7760fb: Alloc DMA memory from hardware device + +From: Thomas Zimmermann + +[ Upstream commit 8404e56f4bc1d1a65bfc98450ba3dae5e653dda1 ] + +Pass the hardware device to the DMA helpers dma_alloc_coherent() and +dma_free_coherent(). The fbdev device that is currently being used is +a software device and does not provide DMA memory. Also update the +related dev_*() output statements similarly. + +Signed-off-by: Thomas Zimmermann +Reviewed-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20230613110953.24176-28-tzimmermann@suse.de +Stable-dep-of: f89d17ae2ac4 ("fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()") +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/sh7760fb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/video/fbdev/sh7760fb.c b/drivers/video/fbdev/sh7760fb.c +index ab8fe838c7763..ac65163f40325 100644 +--- a/drivers/video/fbdev/sh7760fb.c ++++ b/drivers/video/fbdev/sh7760fb.c +@@ -359,7 +359,7 @@ static void sh7760fb_free_mem(struct fb_info *info) + if (!info->screen_base) + return; + +- dma_free_coherent(info->dev, info->screen_size, ++ dma_free_coherent(info->device, info->screen_size, + info->screen_base, par->fbdma); + + par->fbdma = 0; +@@ -408,14 +408,14 @@ static int sh7760fb_alloc_mem(struct fb_info *info) + if (vram < PAGE_SIZE) + vram = PAGE_SIZE; + +- fbmem = dma_alloc_coherent(info->dev, vram, &par->fbdma, GFP_KERNEL); ++ fbmem = dma_alloc_coherent(info->device, vram, &par->fbdma, GFP_KERNEL); + + if (!fbmem) + return -ENOMEM; + + if ((par->fbdma & SH7760FB_DMA_MASK) != SH7760FB_DMA_MASK) { + sh7760fb_free_mem(info); +- dev_err(info->dev, "kernel gave me memory at 0x%08lx, which is" ++ dev_err(info->device, "kernel gave me memory at 0x%08lx, which is" + "unusable for the LCDC\n", (unsigned long)par->fbdma); + return -ENOMEM; + } +@@ -486,7 +486,7 @@ static int sh7760fb_probe(struct platform_device *pdev) + + ret = sh7760fb_alloc_mem(info); + if (ret) { +- dev_dbg(info->dev, "framebuffer memory allocation failed!\n"); ++ dev_dbg(info->device, "framebuffer memory allocation failed!\n"); + goto out_unmap; + } + +-- +2.43.0 + diff --git a/queue-5.4/fbdev-sh7760fb-fix-a-possible-memory-leak-in-sh7760f.patch b/queue-5.4/fbdev-sh7760fb-fix-a-possible-memory-leak-in-sh7760f.patch new file mode 100644 index 00000000000..3e72d0798ed --- /dev/null +++ b/queue-5.4/fbdev-sh7760fb-fix-a-possible-memory-leak-in-sh7760f.patch @@ -0,0 +1,43 @@ +From 98bd8b430e90c376223c760fbb63639bd14d8ef0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Oct 2024 11:56:34 +0800 +Subject: fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() + +From: Zhen Lei + +[ Upstream commit f89d17ae2ac42931be2a0153fecbf8533280c927 ] + +When information such as info->screen_base is not ready, calling +sh7760fb_free_mem() does not release memory correctly. Call +dma_free_coherent() instead. + +Fixes: 4a25e41831ee ("video: sh7760fb: SH7760/SH7763 LCDC framebuffer driver") +Signed-off-by: Zhen Lei +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/sh7760fb.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/sh7760fb.c b/drivers/video/fbdev/sh7760fb.c +index ac65163f40325..e83232bbd7ff8 100644 +--- a/drivers/video/fbdev/sh7760fb.c ++++ b/drivers/video/fbdev/sh7760fb.c +@@ -409,12 +409,11 @@ static int sh7760fb_alloc_mem(struct fb_info *info) + vram = PAGE_SIZE; + + fbmem = dma_alloc_coherent(info->device, vram, &par->fbdma, GFP_KERNEL); +- + if (!fbmem) + return -ENOMEM; + + if ((par->fbdma & SH7760FB_DMA_MASK) != SH7760FB_DMA_MASK) { +- sh7760fb_free_mem(info); ++ dma_free_coherent(info->device, vram, fbmem, par->fbdma); + dev_err(info->device, "kernel gave me memory at 0x%08lx, which is" + "unusable for the LCDC\n", (unsigned long)par->fbdma); + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-5.4/firmware-arm_scpi-check-the-dvfs-opp-count-returned-.patch b/queue-5.4/firmware-arm_scpi-check-the-dvfs-opp-count-returned-.patch new file mode 100644 index 00000000000..fd01046b358 --- /dev/null +++ b/queue-5.4/firmware-arm_scpi-check-the-dvfs-opp-count-returned-.patch @@ -0,0 +1,93 @@ +From d714db80266f4f38e6e5fcd80cea68194355d751 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2024 11:21:15 +0800 +Subject: firmware: arm_scpi: Check the DVFS OPP count returned by the firmware + +From: Luo Qiu + +[ Upstream commit 109aa654f85c5141e813b2cd1bd36d90be678407 ] + +Fix a kernel crash with the below call trace when the SCPI firmware +returns OPP count of zero. + +dvfs_info.opp_count may be zero on some platforms during the reboot +test, and the kernel will crash after dereferencing the pointer to +kcalloc(info->count, sizeof(*opp), GFP_KERNEL). + + | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 + | Mem abort info: + | ESR = 0x96000004 + | Exception class = DABT (current EL), IL = 32 bits + | SET = 0, FnV = 0 + | EA = 0, S1PTW = 0 + | Data abort info: + | ISV = 0, ISS = 0x00000004 + | CM = 0, WnR = 0 + | user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c + | [0000000000000028] pgd=0000000000000000 + | Internal error: Oops: 96000004 [#1] SMP + | scpi-hwmon: probe of PHYT000D:00 failed with error -110 + | Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c) + | CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1 + | Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS + | pstate: 60000005 (nZCv daif -PAN -UAO) + | pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] + | lr : clk_register+0x438/0x720 + | Call trace: + | scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] + | devm_clk_hw_register+0x50/0xa0 + | scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi] + | scpi_clocks_probe+0x528/0x70c [clk_scpi] + | platform_drv_probe+0x58/0xa8 + | really_probe+0x260/0x3d0 + | driver_probe_device+0x12c/0x148 + | device_driver_attach+0x74/0x98 + | __driver_attach+0xb4/0xe8 + | bus_for_each_dev+0x88/0xe0 + | driver_attach+0x30/0x40 + | bus_add_driver+0x178/0x2b0 + | driver_register+0x64/0x118 + | __platform_driver_register+0x54/0x60 + | scpi_clocks_driver_init+0x24/0x1000 [clk_scpi] + | do_one_initcall+0x54/0x220 + | do_init_module+0x54/0x1c8 + | load_module+0x14a4/0x1668 + | __se_sys_finit_module+0xf8/0x110 + | __arm64_sys_finit_module+0x24/0x30 + | el0_svc_common+0x78/0x170 + | el0_svc_handler+0x38/0x78 + | el0_svc+0x8/0x340 + | Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820) + | ---[ end trace 06feb22469d89fa8 ]--- + | Kernel panic - not syncing: Fatal exception + | SMP: stopping secondary CPUs + | Kernel Offset: disabled + | CPU features: 0x10,a0002008 + | Memory Limit: none + +Fixes: 8cb7cf56c9fe ("firmware: add support for ARM System Control and Power Interface(SCPI) protocol") +Signed-off-by: Luo Qiu +Message-Id: <55A2F7A784391686+20241101032115.275977-1-luoqiu@kylinsec.com.cn> +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scpi.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c +index 72634e9d81169..131b22bd713f3 100644 +--- a/drivers/firmware/arm_scpi.c ++++ b/drivers/firmware/arm_scpi.c +@@ -627,6 +627,9 @@ static struct scpi_dvfs_info *scpi_dvfs_get_info(u8 domain) + if (ret) + return ERR_PTR(ret); + ++ if (!buf.opp_count) ++ return ERR_PTR(-ENOENT); ++ + info = kmalloc(sizeof(*info), GFP_KERNEL); + if (!info) + return ERR_PTR(-ENOMEM); +-- +2.43.0 + diff --git a/queue-5.4/firmware-google-unregister-driver_info-on-failure-an.patch b/queue-5.4/firmware-google-unregister-driver_info-on-failure-an.patch new file mode 100644 index 00000000000..069ec516f3d --- /dev/null +++ b/queue-5.4/firmware-google-unregister-driver_info-on-failure-an.patch @@ -0,0 +1,49 @@ +From f3e815d756132391a6d17b773b42639b87516668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2019 11:19:30 +0100 +Subject: firmware: google: Unregister driver_info on failure and exit in gsmi + +From: Arthur Heymans + +[ Upstream commit c6e7af0515daca800d84b9cfa1bf19e53c4f5bc3 ] + +Fix a bug where the kernel module couldn't be loaded after unloading, +as the platform driver wasn't released on exit. + +Signed-off-by: Arthur Heymans +Signed-off-by: Patrick Rudolph +Link: https://lore.kernel.org/r/20191118101934.22526-3-patrick.rudolph@9elements.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 32b0901e141f ("firmware: google: Unregister driver_info on failure") +Signed-off-by: Sasha Levin +--- + drivers/firmware/google/gsmi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c +index 94753ad18ca63..633997af4b09e 100644 +--- a/drivers/firmware/google/gsmi.c ++++ b/drivers/firmware/google/gsmi.c +@@ -1026,6 +1026,9 @@ static __init int gsmi_init(void) + dma_pool_destroy(gsmi_dev.dma_pool); + platform_device_unregister(gsmi_dev.pdev); + pr_info("gsmi: failed to load: %d\n", ret); ++#ifdef CONFIG_PM ++ platform_driver_unregister(&gsmi_driver_info); ++#endif + return ret; + } + +@@ -1047,6 +1050,9 @@ static void __exit gsmi_exit(void) + gsmi_buf_free(gsmi_dev.name_buf); + dma_pool_destroy(gsmi_dev.dma_pool); + platform_device_unregister(gsmi_dev.pdev); ++#ifdef CONFIG_PM ++ platform_driver_unregister(&gsmi_driver_info); ++#endif + } + + module_init(gsmi_init); +-- +2.43.0 + diff --git a/queue-5.4/firmware-google-unregister-driver_info-on-failure.patch b/queue-5.4/firmware-google-unregister-driver_info-on-failure.patch new file mode 100644 index 00000000000..e3f56f3817b --- /dev/null +++ b/queue-5.4/firmware-google-unregister-driver_info-on-failure.patch @@ -0,0 +1,53 @@ +From 9b7995317fa0a283052edf473a375cfc3ab859f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Oct 2024 21:13:44 +0800 +Subject: firmware: google: Unregister driver_info on failure + +From: Yuan Can + +[ Upstream commit 32b0901e141f6d4cf49d820b53eb09b88b1f72f7 ] + +When platform_device_register_full() returns error, the gsmi_init() returns +without unregister gsmi_driver_info, fix by add missing +platform_driver_unregister() when platform_device_register_full() failed. + +Fixes: 8942b2d5094b ("gsmi: Add GSMI commands to log S0ix info") +Signed-off-by: Yuan Can +Acked-by: Brian Norris +Link: https://lore.kernel.org/r/20241015131344.20272-1-yuancan@huawei.com +Signed-off-by: Tzung-Bi Shih +Signed-off-by: Sasha Levin +--- + drivers/firmware/google/gsmi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c +index 633997af4b09e..b25a05c56f537 100644 +--- a/drivers/firmware/google/gsmi.c ++++ b/drivers/firmware/google/gsmi.c +@@ -898,7 +898,8 @@ static __init int gsmi_init(void) + gsmi_dev.pdev = platform_device_register_full(&gsmi_dev_info); + if (IS_ERR(gsmi_dev.pdev)) { + printk(KERN_ERR "gsmi: unable to register platform device\n"); +- return PTR_ERR(gsmi_dev.pdev); ++ ret = PTR_ERR(gsmi_dev.pdev); ++ goto out_unregister; + } + + /* SMI access needs to be serialized */ +@@ -1025,10 +1026,11 @@ static __init int gsmi_init(void) + gsmi_buf_free(gsmi_dev.name_buf); + dma_pool_destroy(gsmi_dev.dma_pool); + platform_device_unregister(gsmi_dev.pdev); +- pr_info("gsmi: failed to load: %d\n", ret); ++out_unregister: + #ifdef CONFIG_PM + platform_driver_unregister(&gsmi_driver_info); + #endif ++ pr_info("gsmi: failed to load: %d\n", ret); + return ret; + } + +-- +2.43.0 + diff --git a/queue-5.4/hfsplus-don-t-query-the-device-logical-block-size-mu.patch b/queue-5.4/hfsplus-don-t-query-the-device-logical-block-size-mu.patch new file mode 100644 index 00000000000..01d5d1c3fca --- /dev/null +++ b/queue-5.4/hfsplus-don-t-query-the-device-logical-block-size-mu.patch @@ -0,0 +1,139 @@ +From 1d4e863241a4341bcba766494a1e4da459a3f79f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 08:41:09 -0300 +Subject: hfsplus: don't query the device logical block size multiple times + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ] + +Devices block sizes may change. One of these cases is a loop device by +using ioctl LOOP_SET_BLOCK_SIZE. + +While this may cause other issues like IO being rejected, in the case of +hfsplus, it will allocate a block by using that size and potentially write +out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the +latter function reads a different io_size. + +Using a new min_io_size initally set to sb_min_blocksize works for the +purposes of the original fix, since it will be set to the max between +HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the +max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not +initialized. + +Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 +and 4096. + +The produced KASAN report before the fix looks like this: + +[ 419.944641] ================================================================== +[ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a +[ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 +[ 419.947612] +[ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 +[ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 +[ 419.950035] Call Trace: +[ 419.950384] +[ 419.950676] dump_stack_lvl+0x57/0x78 +[ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a +[ 419.951830] print_report+0x14c/0x49e +[ 419.952361] ? __virt_addr_valid+0x267/0x278 +[ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d +[ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a +[ 419.954231] kasan_report+0x89/0xb0 +[ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a +[ 419.955367] hfsplus_read_wrapper+0x659/0xa0a +[ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 +[ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 +[ 419.957214] ? _raw_spin_unlock+0x1a/0x2e +[ 419.957772] hfsplus_fill_super+0x348/0x1590 +[ 419.958355] ? hlock_class+0x4c/0x109 +[ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 +[ 419.959499] ? __pfx_string+0x10/0x10 +[ 419.960006] ? lock_acquire+0x3e2/0x454 +[ 419.960532] ? bdev_name.constprop.0+0xce/0x243 +[ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 +[ 419.961799] ? pointer+0x3f0/0x62f +[ 419.962277] ? __pfx_pointer+0x10/0x10 +[ 419.962761] ? vsnprintf+0x6c4/0xfba +[ 419.963178] ? __pfx_vsnprintf+0x10/0x10 +[ 419.963621] ? setup_bdev_super+0x376/0x3b3 +[ 419.964029] ? snprintf+0x9d/0xd2 +[ 419.964344] ? __pfx_snprintf+0x10/0x10 +[ 419.964675] ? lock_acquired+0x45c/0x5e9 +[ 419.965016] ? set_blocksize+0x139/0x1c1 +[ 419.965381] ? sb_set_blocksize+0x6d/0xae +[ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 +[ 419.966179] mount_bdev+0x12f/0x1bf +[ 419.966512] ? __pfx_mount_bdev+0x10/0x10 +[ 419.966886] ? vfs_parse_fs_string+0xce/0x111 +[ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 +[ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 +[ 419.968073] legacy_get_tree+0x104/0x178 +[ 419.968414] vfs_get_tree+0x86/0x296 +[ 419.968751] path_mount+0xba3/0xd0b +[ 419.969157] ? __pfx_path_mount+0x10/0x10 +[ 419.969594] ? kmem_cache_free+0x1e2/0x260 +[ 419.970311] do_mount+0x99/0xe0 +[ 419.970630] ? __pfx_do_mount+0x10/0x10 +[ 419.971008] __do_sys_mount+0x199/0x1c9 +[ 419.971397] do_syscall_64+0xd0/0x135 +[ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[ 419.972233] RIP: 0033:0x7c3cb812972e +[ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 +[ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 +[ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e +[ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0 +[ 419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000 +[ 419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000 +[ 419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000 +[ 419.978375] +[ 419.978589] + +Fixes: 6596528e391a ("hfsplus: ensure bio requests are not smaller than the hardware sectors") +Signed-off-by: Thadeu Lima de Souza Cascardo +Link: https://lore.kernel.org/r/20241107114109.839253-1-cascardo@igalia.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/hfsplus/hfsplus_fs.h | 3 ++- + fs/hfsplus/wrapper.c | 2 ++ + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h +index 909e03956c3f2..86cfc147bf3d1 100644 +--- a/fs/hfsplus/hfsplus_fs.h ++++ b/fs/hfsplus/hfsplus_fs.h +@@ -156,6 +156,7 @@ struct hfsplus_sb_info { + + /* Runtime variables */ + u32 blockoffset; ++ u32 min_io_size; + sector_t part_start; + sector_t sect_count; + int fs_shift; +@@ -306,7 +307,7 @@ struct hfsplus_readdir_data { + */ + static inline unsigned short hfsplus_min_io_size(struct super_block *sb) + { +- return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev), ++ return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size, + HFSPLUS_SECTOR_SIZE); + } + +diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c +index 08c1580bdf7ad..eb76ba8e8fec0 100644 +--- a/fs/hfsplus/wrapper.c ++++ b/fs/hfsplus/wrapper.c +@@ -170,6 +170,8 @@ int hfsplus_read_wrapper(struct super_block *sb) + if (!blocksize) + goto out; + ++ sbi->min_io_size = blocksize; ++ + if (hfsplus_get_last_session(sb, &part_start, &part_size)) + goto out; + +-- +2.43.0 + diff --git a/queue-5.4/initramfs-avoid-filename-buffer-overrun.patch b/queue-5.4/initramfs-avoid-filename-buffer-overrun.patch new file mode 100644 index 00000000000..93d61ca1bfd --- /dev/null +++ b/queue-5.4/initramfs-avoid-filename-buffer-overrun.patch @@ -0,0 +1,118 @@ +From b57d7206e75389b13c20b216d0497601d9294d88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2024 03:55:10 +0000 +Subject: initramfs: avoid filename buffer overrun + +From: David Disseldorp + +[ Upstream commit e017671f534dd3f568db9e47b0583e853d2da9b5 ] + +The initramfs filename field is defined in +Documentation/driver-api/early-userspace/buffer-format.rst as: + + 37 cpio_file := ALGN(4) + cpio_header + filename + "\0" + ALGN(4) + data +... + 55 ============= ================== ========================= + 56 Field name Field size Meaning + 57 ============= ================== ========================= +... + 70 c_namesize 8 bytes Length of filename, including final \0 + +When extracting an initramfs cpio archive, the kernel's do_name() path +handler assumes a zero-terminated path at @collected, passing it +directly to filp_open() / init_mkdir() / init_mknod(). + +If a specially crafted cpio entry carries a non-zero-terminated filename +and is followed by uninitialized memory, then a file may be created with +trailing characters that represent the uninitialized memory. The ability +to create an initramfs entry would imply already having full control of +the system, so the buffer overrun shouldn't be considered a security +vulnerability. + +Append the output of the following bash script to an existing initramfs +and observe any created /initramfs_test_fname_overrunAA* path. E.g. + ./reproducer.sh | gzip >> /myinitramfs + +It's easiest to observe non-zero uninitialized memory when the output is +gzipped, as it'll overflow the heap allocated @out_buf in __gunzip(), +rather than the initrd_start+initrd_size block. + +---- reproducer.sh ---- +nilchar="A" # change to "\0" to properly zero terminate / pad +magic="070701" +ino=1 +mode=$(( 0100777 )) +uid=0 +gid=0 +nlink=1 +mtime=1 +filesize=0 +devmajor=0 +devminor=1 +rdevmajor=0 +rdevminor=0 +csum=0 +fname="initramfs_test_fname_overrun" +namelen=$(( ${#fname} + 1 )) # plus one to account for terminator + +printf "%s%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%s" \ + $magic $ino $mode $uid $gid $nlink $mtime $filesize \ + $devmajor $devminor $rdevmajor $rdevminor $namelen $csum $fname + +termpadlen=$(( 1 + ((4 - ((110 + $namelen) & 3)) % 4) )) +printf "%.s${nilchar}" $(seq 1 $termpadlen) +---- reproducer.sh ---- + +Symlink filename fields handled in do_symlink() won't overrun past the +data segment, due to the explicit zero-termination of the symlink +target. + +Fix filename buffer overrun by aborting the initramfs FSM if any cpio +entry doesn't carry a zero-terminator at the expected (name_len - 1) +offset. + +Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") +Signed-off-by: David Disseldorp +Link: https://lore.kernel.org/r/20241030035509.20194-2-ddiss@suse.de +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + init/initramfs.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/init/initramfs.c b/init/initramfs.c +index b362b57c047d5..71ca68f403993 100644 +--- a/init/initramfs.c ++++ b/init/initramfs.c +@@ -323,6 +323,15 @@ static int __init do_name(void) + { + state = SkipIt; + next_state = Reset; ++ ++ /* name_len > 0 && name_len <= PATH_MAX checked in do_header */ ++ if (collected[name_len - 1] != '\0') { ++ pr_err("initramfs name without nulterm: %.*s\n", ++ (int)name_len, collected); ++ error("malformed archive"); ++ return 1; ++ } ++ + if (strcmp(collected, "TRAILER!!!") == 0) { + free_hash(); + return 0; +@@ -385,6 +394,12 @@ static int __init do_copy(void) + + static int __init do_symlink(void) + { ++ if (collected[name_len - 1] != '\0') { ++ pr_err("initramfs symlink without nulterm: %.*s\n", ++ (int)name_len, collected); ++ error("malformed archive"); ++ return 1; ++ } + collected[N_ALIGN(name_len) + body_len] = '\0'; + clean_path(collected, 0); + ksys_symlink(collected + N_ALIGN(name_len), collected); +-- +2.43.0 + diff --git a/queue-5.4/ipmr-convert-proc-handlers-to-rcu_read_lock.patch b/queue-5.4/ipmr-convert-proc-handlers-to-rcu_read_lock.patch new file mode 100644 index 00000000000..cabd289f896 --- /dev/null +++ b/queue-5.4/ipmr-convert-proc-handlers-to-rcu_read_lock.patch @@ -0,0 +1,86 @@ +From 8d8bd83481af2a3df60c09de0be527457c0db52b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jun 2022 04:34:47 +0000 +Subject: ipmr: convert /proc handlers to rcu_read_lock() + +From: Eric Dumazet + +[ Upstream commit b96ef16d2f837870daaea51c38cd50458b95ad5c ] + +We can use standard rcu_read_lock(), to get rid +of last read_lock(&mrt_lock) call points. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Stable-dep-of: fc9c273d6daa ("ipmr: fix tables suspicious RCU usage") +Signed-off-by: Sasha Levin +--- + net/ipv4/ipmr.c | 8 ++++---- + net/ipv6/ip6mr.c | 8 ++++---- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c +index 2da6896080363..11f916646d34d 100644 +--- a/net/ipv4/ipmr.c ++++ b/net/ipv4/ipmr.c +@@ -2916,7 +2916,7 @@ static int ipmr_rtm_dumplink(struct sk_buff *skb, struct netlink_callback *cb) + */ + + static void *ipmr_vif_seq_start(struct seq_file *seq, loff_t *pos) +- __acquires(mrt_lock) ++ __acquires(RCU) + { + struct mr_vif_iter *iter = seq->private; + struct net *net = seq_file_net(seq); +@@ -2928,14 +2928,14 @@ static void *ipmr_vif_seq_start(struct seq_file *seq, loff_t *pos) + + iter->mrt = mrt; + +- read_lock(&mrt_lock); ++ rcu_read_lock(); + return mr_vif_seq_start(seq, pos); + } + + static void ipmr_vif_seq_stop(struct seq_file *seq, void *v) +- __releases(mrt_lock) ++ __releases(RCU) + { +- read_unlock(&mrt_lock); ++ rcu_read_unlock(); + } + + static int ipmr_vif_seq_show(struct seq_file *seq, void *v) +diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c +index 6642bc7b9870f..33c5974d467dd 100644 +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -401,7 +401,7 @@ static void ip6mr_free_table(struct mr_table *mrt) + */ + + static void *ip6mr_vif_seq_start(struct seq_file *seq, loff_t *pos) +- __acquires(mrt_lock) ++ __acquires(RCU) + { + struct mr_vif_iter *iter = seq->private; + struct net *net = seq_file_net(seq); +@@ -413,14 +413,14 @@ static void *ip6mr_vif_seq_start(struct seq_file *seq, loff_t *pos) + + iter->mrt = mrt; + +- read_lock(&mrt_lock); ++ rcu_read_lock(); + return mr_vif_seq_start(seq, pos); + } + + static void ip6mr_vif_seq_stop(struct seq_file *seq, void *v) +- __releases(mrt_lock) ++ __releases(RCU) + { +- read_unlock(&mrt_lock); ++ rcu_read_unlock(); + } + + static int ip6mr_vif_seq_show(struct seq_file *seq, void *v) +-- +2.43.0 + diff --git a/queue-5.4/ipmr-fix-tables-suspicious-rcu-usage.patch b/queue-5.4/ipmr-fix-tables-suspicious-rcu-usage.patch new file mode 100644 index 00000000000..07e19d5dbeb --- /dev/null +++ b/queue-5.4/ipmr-fix-tables-suspicious-rcu-usage.patch @@ -0,0 +1,154 @@ +From 408f892e4b2deac5f612349d4ed7b91a94754887 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Nov 2024 16:40:58 +0100 +Subject: ipmr: fix tables suspicious RCU usage + +From: Paolo Abeni + +[ Upstream commit fc9c273d6daaa9866f349bbe8cae25c67764c456 ] + +Similar to the previous patch, plumb the RCU lock inside +the ipmr_get_table(), provided a lockless variant and apply +the latter in the few spots were the lock is already held. + +Fixes: 709b46e8d90b ("net: Add compat ioctl support for the ipv4 multicast ioctl SIOCGETSGCNT") +Fixes: f0ad0860d01e ("ipv4: ipmr: support multiple tables") +Reviewed-by: David Ahern +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/ipmr.c | 42 +++++++++++++++++++++++++++++------------- + 1 file changed, 29 insertions(+), 13 deletions(-) + +diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c +index 11f916646d34d..8e31c277fe465 100644 +--- a/net/ipv4/ipmr.c ++++ b/net/ipv4/ipmr.c +@@ -129,7 +129,7 @@ static struct mr_table *ipmr_mr_table_iter(struct net *net, + return ret; + } + +-static struct mr_table *ipmr_get_table(struct net *net, u32 id) ++static struct mr_table *__ipmr_get_table(struct net *net, u32 id) + { + struct mr_table *mrt; + +@@ -140,6 +140,16 @@ static struct mr_table *ipmr_get_table(struct net *net, u32 id) + return NULL; + } + ++static struct mr_table *ipmr_get_table(struct net *net, u32 id) ++{ ++ struct mr_table *mrt; ++ ++ rcu_read_lock(); ++ mrt = __ipmr_get_table(net, id); ++ rcu_read_unlock(); ++ return mrt; ++} ++ + static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4, + struct mr_table **mrt) + { +@@ -181,7 +191,7 @@ static int ipmr_rule_action(struct fib_rule *rule, struct flowi *flp, + + arg->table = fib_rule_get_table(rule, arg); + +- mrt = ipmr_get_table(rule->fr_net, arg->table); ++ mrt = __ipmr_get_table(rule->fr_net, arg->table); + if (!mrt) + return -EAGAIN; + res->mrt = mrt; +@@ -312,6 +322,8 @@ static struct mr_table *ipmr_get_table(struct net *net, u32 id) + return net->ipv4.mrt; + } + ++#define __ipmr_get_table ipmr_get_table ++ + static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4, + struct mr_table **mrt) + { +@@ -400,7 +412,7 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id) + if (id != RT_TABLE_DEFAULT && id >= 1000000000) + return ERR_PTR(-EINVAL); + +- mrt = ipmr_get_table(net, id); ++ mrt = __ipmr_get_table(net, id); + if (mrt) + return mrt; + +@@ -1391,7 +1403,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, + goto out_unlock; + } + +- mrt = ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT); ++ mrt = __ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT); + if (!mrt) { + ret = -ENOENT; + goto out_unlock; +@@ -2264,11 +2276,13 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb, + struct mr_table *mrt; + int err; + +- mrt = ipmr_get_table(net, RT_TABLE_DEFAULT); +- if (!mrt) ++ rcu_read_lock(); ++ mrt = __ipmr_get_table(net, RT_TABLE_DEFAULT); ++ if (!mrt) { ++ rcu_read_unlock(); + return -ENOENT; ++ } + +- rcu_read_lock(); + cache = ipmr_cache_find(mrt, saddr, daddr); + if (!cache && skb->dev) { + int vif = ipmr_find_vif(mrt, skb->dev); +@@ -2557,7 +2571,7 @@ static int ipmr_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, + grp = tb[RTA_DST] ? nla_get_in_addr(tb[RTA_DST]) : 0; + tableid = tb[RTA_TABLE] ? nla_get_u32(tb[RTA_TABLE]) : 0; + +- mrt = ipmr_get_table(net, tableid ? tableid : RT_TABLE_DEFAULT); ++ mrt = __ipmr_get_table(net, tableid ? tableid : RT_TABLE_DEFAULT); + if (!mrt) { + err = -ENOENT; + goto errout_free; +@@ -2609,7 +2623,7 @@ static int ipmr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb) + if (filter.table_id) { + struct mr_table *mrt; + +- mrt = ipmr_get_table(sock_net(skb->sk), filter.table_id); ++ mrt = __ipmr_get_table(sock_net(skb->sk), filter.table_id); + if (!mrt) { + if (rtnl_msg_family(cb->nlh) != RTNL_FAMILY_IPMR) + return skb->len; +@@ -2717,7 +2731,7 @@ static int rtm_to_ipmr_mfcc(struct net *net, struct nlmsghdr *nlh, + break; + } + } +- mrt = ipmr_get_table(net, tblid); ++ mrt = __ipmr_get_table(net, tblid); + if (!mrt) { + ret = -ENOENT; + goto out; +@@ -2922,13 +2936,15 @@ static void *ipmr_vif_seq_start(struct seq_file *seq, loff_t *pos) + struct net *net = seq_file_net(seq); + struct mr_table *mrt; + +- mrt = ipmr_get_table(net, RT_TABLE_DEFAULT); +- if (!mrt) ++ rcu_read_lock(); ++ mrt = __ipmr_get_table(net, RT_TABLE_DEFAULT); ++ if (!mrt) { ++ rcu_read_unlock(); + return ERR_PTR(-ENOENT); ++ } + + iter->mrt = mrt; + +- rcu_read_lock(); + return mr_vif_seq_start(seq, pos); + } + +-- +2.43.0 + diff --git a/queue-5.4/m68k-coldfire-device.c-only-build-fec-when-hw-macros.patch b/queue-5.4/m68k-coldfire-device.c-only-build-fec-when-hw-macros.patch new file mode 100644 index 00000000000..96c3735ac5c --- /dev/null +++ b/queue-5.4/m68k-coldfire-device.c-only-build-fec-when-hw-macros.patch @@ -0,0 +1,77 @@ +From 8ea85a143c242108fcca4eb24aeed20fd91fa758 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2024 22:43:15 +0100 +Subject: m68k: coldfire/device.c: only build FEC when HW macros are defined + +From: Antonio Quartulli + +[ Upstream commit 63a24cf8cc330e5a68ebd2e20ae200096974c475 ] + +When CONFIG_FEC is set (due to COMPILE_TEST) along with +CONFIG_M54xx, coldfire/device.c has compile errors due to +missing MCFEC_* and MCF_IRQ_FEC_* symbols. + +Make the whole FEC blocks dependent on having the HW macros +defined, rather than on CONFIG_FEC itself. + +This fix is very similar to commit e6e1e7b19fa1 ("m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined") + +Fixes: b7ce7f0d0efc ("m68knommu: merge common ColdFire FEC platform setup code") +To: Greg Ungerer +To: Geert Uytterhoeven +Cc: linux-m68k@lists.linux-m68k.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Antonio Quartulli +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +--- + arch/m68k/coldfire/device.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/m68k/coldfire/device.c b/arch/m68k/coldfire/device.c +index b4103b6bfdeb6..6b676965495fa 100644 +--- a/arch/m68k/coldfire/device.c ++++ b/arch/m68k/coldfire/device.c +@@ -92,7 +92,7 @@ static struct platform_device mcf_uart = { + .dev.platform_data = mcf_uart_platform_data, + }; + +-#if IS_ENABLED(CONFIG_FEC) ++#ifdef MCFFEC_BASE0 + + #ifdef CONFIG_M5441x + #define FEC_NAME "enet-fec" +@@ -144,6 +144,7 @@ static struct platform_device mcf_fec0 = { + .platform_data = FEC_PDATA, + } + }; ++#endif /* MCFFEC_BASE0 */ + + #ifdef MCFFEC_BASE1 + static struct resource mcf_fec1_resources[] = { +@@ -181,7 +182,6 @@ static struct platform_device mcf_fec1 = { + } + }; + #endif /* MCFFEC_BASE1 */ +-#endif /* CONFIG_FEC */ + + #if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI) + /* +@@ -556,12 +556,12 @@ static struct platform_device mcf_edma = { + + static struct platform_device *mcf_devices[] __initdata = { + &mcf_uart, +-#if IS_ENABLED(CONFIG_FEC) ++#ifdef MCFFEC_BASE0 + &mcf_fec0, ++#endif + #ifdef MCFFEC_BASE1 + &mcf_fec1, + #endif +-#endif + #if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI) + &mcf_qspi, + #endif +-- +2.43.0 + diff --git a/queue-5.4/m68k-mcfgpio-fix-incorrect-register-offset-for-confi.patch b/queue-5.4/m68k-mcfgpio-fix-incorrect-register-offset-for-confi.patch new file mode 100644 index 00000000000..2b6520c1ec2 --- /dev/null +++ b/queue-5.4/m68k-mcfgpio-fix-incorrect-register-offset-for-confi.patch @@ -0,0 +1,37 @@ +From 68b414aa6237da69deee77d481eb5ddfe43e75c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 09:24:35 +0200 +Subject: m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x + +From: Jean-Michel Hautbois + +[ Upstream commit f212140962c93cd5da43283a18e31681540fc23d ] + +Fix a typo in the CONFIG_M5441x preprocessor condition, where the GPIO +register offset was incorrectly set to 8 instead of 0. This prevented +proper GPIO configuration for m5441x targets. + +Fixes: bea8bcb12da0 ("m68knommu: Add support for the Coldfire m5441x.") +Signed-off-by: Jean-Michel Hautbois +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +--- + arch/m68k/include/asm/mcfgpio.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/m68k/include/asm/mcfgpio.h b/arch/m68k/include/asm/mcfgpio.h +index 27f32cc81da6b..02049568198c9 100644 +--- a/arch/m68k/include/asm/mcfgpio.h ++++ b/arch/m68k/include/asm/mcfgpio.h +@@ -144,7 +144,7 @@ static inline void gpio_free(unsigned gpio) + * read-modify-write as well as those controlled by the EPORT and GPIO modules. + */ + #define MCFGPIO_SCR_START 40 +-#elif defined(CONFIGM5441x) ++#elif defined(CONFIG_M5441x) + /* The m5441x EPORT doesn't have its own GPIO port, uses PORT C */ + #define MCFGPIO_SCR_START 0 + #else +-- +2.43.0 + diff --git a/queue-5.4/m68k-mvme147-fix-scsi-controller-irq-numbers.patch b/queue-5.4/m68k-mvme147-fix-scsi-controller-irq-numbers.patch new file mode 100644 index 00000000000..0a7345cb4af --- /dev/null +++ b/queue-5.4/m68k-mvme147-fix-scsi-controller-irq-numbers.patch @@ -0,0 +1,46 @@ +From bb4c26dc568b2895aac5728d893bdad8b4cf16fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2024 13:29:47 +1000 +Subject: m68k: mvme147: Fix SCSI controller IRQ numbers + +From: Daniel Palmer + +[ Upstream commit 47bc874427382018fa2e3e982480e156271eee70 ] + +Sometime long ago the m68k IRQ code was refactored and the interrupt +numbers for SCSI controller on this board ended up wrong, and it hasn't +worked since. + +The PCC adds 0x40 to the vector for its interrupts so they end up in +the user interrupt range. Hence, the kernel number should be the kernel +offset for user interrupt range + the PCC interrupt number. + +Fixes: 200a3d352cd5 ("[PATCH] m68k: convert VME irq code") +Signed-off-by: Daniel Palmer +Reviewed-by: Finn Thain +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/0e7636a21a0274eea35bfd5d874459d5078e97cc.1727926187.git.fthain@linux-m68k.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/include/asm/mvme147hw.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/m68k/include/asm/mvme147hw.h b/arch/m68k/include/asm/mvme147hw.h +index e28eb1c0e0bfb..dbf88059e47a4 100644 +--- a/arch/m68k/include/asm/mvme147hw.h ++++ b/arch/m68k/include/asm/mvme147hw.h +@@ -93,8 +93,8 @@ struct pcc_regs { + #define M147_SCC_B_ADDR 0xfffe3000 + #define M147_SCC_PCLK 5000000 + +-#define MVME147_IRQ_SCSI_PORT (IRQ_USER+0x45) +-#define MVME147_IRQ_SCSI_DMA (IRQ_USER+0x46) ++#define MVME147_IRQ_SCSI_PORT (IRQ_USER + 5) ++#define MVME147_IRQ_SCSI_DMA (IRQ_USER + 6) + + /* SCC interrupts, for MVME147 */ + +-- +2.43.0 + diff --git a/queue-5.4/m68k-mvme147-reinstate-early-console.patch b/queue-5.4/m68k-mvme147-reinstate-early-console.patch new file mode 100644 index 00000000000..e7b68401f53 --- /dev/null +++ b/queue-5.4/m68k-mvme147-reinstate-early-console.patch @@ -0,0 +1,113 @@ +From 2de9f4c935c9f279109fbda93f5986a08cbc96e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 10:51:24 +1100 +Subject: m68k: mvme147: Reinstate early console + +From: Daniel Palmer + +[ Upstream commit 077b33b9e2833ff25050d986178a2c4c4036cbac ] + +Commit a38eaa07a0ce ("m68k/mvme147: config.c - Remove unused +functions"), removed the console functionality for the mvme147 instead +of wiring it up to an early console. Put the console write function +back and wire it up like mvme16x does so it's possible to see Linux boot +on this fine hardware once more. + +Fixes: a38eaa07a0ce ("m68k/mvme147: config.c - Remove unused functions") +Signed-off-by: Daniel Palmer +Co-developed-by: Finn Thain +Signed-off-by: Finn Thain +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/a82e8f0068a8722996a0ccfe666abb5e0a5c120d.1730850684.git.fthain@linux-m68k.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/kernel/early_printk.c | 5 ++++- + arch/m68k/mvme147/config.c | 30 ++++++++++++++++++++++++++++++ + arch/m68k/mvme147/mvme147.h | 6 ++++++ + 3 files changed, 40 insertions(+), 1 deletion(-) + create mode 100644 arch/m68k/mvme147/mvme147.h + +diff --git a/arch/m68k/kernel/early_printk.c b/arch/m68k/kernel/early_printk.c +index 3cc944df04f65..f11ef9f1f56fc 100644 +--- a/arch/m68k/kernel/early_printk.c ++++ b/arch/m68k/kernel/early_printk.c +@@ -13,6 +13,7 @@ + #include + + ++#include "../mvme147/mvme147.h" + #include "../mvme16x/mvme16x.h" + + asmlinkage void __init debug_cons_nputs(const char *s, unsigned n); +@@ -22,7 +23,9 @@ static void __ref debug_cons_write(struct console *c, + { + #if !(defined(CONFIG_SUN3) || defined(CONFIG_M68000) || \ + defined(CONFIG_COLDFIRE)) +- if (MACH_IS_MVME16x) ++ if (MACH_IS_MVME147) ++ mvme147_scc_write(c, s, n); ++ else if (MACH_IS_MVME16x) + mvme16x_cons_write(c, s, n); + else + debug_cons_nputs(s, n); +diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c +index 245376630c3de..8829ad3d25e0f 100644 +--- a/arch/m68k/mvme147/config.c ++++ b/arch/m68k/mvme147/config.c +@@ -36,6 +36,7 @@ + #include + #include + ++#include "mvme147.h" + + static void mvme147_get_model(char *model); + extern void mvme147_sched_init(irq_handler_t handler); +@@ -189,3 +190,32 @@ int mvme147_hwclk(int op, struct rtc_time *t) + } + return 0; + } ++ ++static void scc_delay(void) ++{ ++ __asm__ __volatile__ ("nop; nop;"); ++} ++ ++static void scc_write(char ch) ++{ ++ do { ++ scc_delay(); ++ } while (!(in_8(M147_SCC_A_ADDR) & BIT(2))); ++ scc_delay(); ++ out_8(M147_SCC_A_ADDR, 8); ++ scc_delay(); ++ out_8(M147_SCC_A_ADDR, ch); ++} ++ ++void mvme147_scc_write(struct console *co, const char *str, unsigned int count) ++{ ++ unsigned long flags; ++ ++ local_irq_save(flags); ++ while (count--) { ++ if (*str == '\n') ++ scc_write('\r'); ++ scc_write(*str++); ++ } ++ local_irq_restore(flags); ++} +diff --git a/arch/m68k/mvme147/mvme147.h b/arch/m68k/mvme147/mvme147.h +new file mode 100644 +index 0000000000000..140bc98b0102a +--- /dev/null ++++ b/arch/m68k/mvme147/mvme147.h +@@ -0,0 +1,6 @@ ++/* SPDX-License-Identifier: GPL-2.0-only */ ++ ++struct console; ++ ++/* config.c */ ++void mvme147_scc_write(struct console *co, const char *str, unsigned int count); +-- +2.43.0 + diff --git a/queue-5.4/m68k-mvme16x-add-and-use-mvme16x.h.patch b/queue-5.4/m68k-mvme16x-add-and-use-mvme16x.h.patch new file mode 100644 index 00000000000..42282a68a3a --- /dev/null +++ b/queue-5.4/m68k-mvme16x-add-and-use-mvme16x.h.patch @@ -0,0 +1,76 @@ +From 0d3e21987f8774471b3844e6e50430514395c522 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Sep 2023 16:08:25 +0200 +Subject: m68k: mvme16x: Add and use "mvme16x.h" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit dcec33c1fc4ab63983d93ffb0d82b68fc5775b88 ] + +When building with W=1: + + arch/m68k/mvme16x/config.c:208:6: warning: no previous prototype for ‘mvme16x_cons_write’ [-Wmissing-prototypes] + 208 | void mvme16x_cons_write(struct console *co, const char *str, unsigned count) + | ^~~~~~~~~~~~~~~~~~ + +Fix this by introducing a new header file "mvme16x.h" for holding the +prototypes of functions implemented in arch/m68k/mvme16x/. + +Signed-off-by: Geert Uytterhoeven +Acked-by: Arnd Bergmann +Link: https://lore.kernel.org/r/6200cc3b26fad215c4524748af04692e38c5ecd2.1694613528.git.geert@linux-m68k.org +Stable-dep-of: 077b33b9e283 ("m68k: mvme147: Reinstate early console") +Signed-off-by: Sasha Levin +--- + arch/m68k/kernel/early_printk.c | 4 ++-- + arch/m68k/mvme16x/config.c | 2 ++ + arch/m68k/mvme16x/mvme16x.h | 6 ++++++ + 3 files changed, 10 insertions(+), 2 deletions(-) + create mode 100644 arch/m68k/mvme16x/mvme16x.h + +diff --git a/arch/m68k/kernel/early_printk.c b/arch/m68k/kernel/early_printk.c +index 7d3fe08a48eb0..3cc944df04f65 100644 +--- a/arch/m68k/kernel/early_printk.c ++++ b/arch/m68k/kernel/early_printk.c +@@ -12,8 +12,8 @@ + #include + #include + +-extern void mvme16x_cons_write(struct console *co, +- const char *str, unsigned count); ++ ++#include "../mvme16x/mvme16x.h" + + asmlinkage void __init debug_cons_nputs(const char *s, unsigned n); + +diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c +index 2f2c2d172b24e..6ad5c8e2bd9ad 100644 +--- a/arch/m68k/mvme16x/config.c ++++ b/arch/m68k/mvme16x/config.c +@@ -39,6 +39,8 @@ + #include + #include + ++#include "mvme16x.h" ++ + extern t_bdid mvme_bdid; + + static MK48T08ptr_t volatile rtc = (MK48T08ptr_t)MVME_RTC_BASE; +diff --git a/arch/m68k/mvme16x/mvme16x.h b/arch/m68k/mvme16x/mvme16x.h +new file mode 100644 +index 0000000000000..159c34b700394 +--- /dev/null ++++ b/arch/m68k/mvme16x/mvme16x.h +@@ -0,0 +1,6 @@ ++/* SPDX-License-Identifier: GPL-2.0-only */ ++ ++struct console; ++ ++/* config.c */ ++void mvme16x_cons_write(struct console *co, const char *str, unsigned count); +-- +2.43.0 + diff --git a/queue-5.4/marvell-pxa168_eth-fix-call-balance-of-pep-clk-handl.patch b/queue-5.4/marvell-pxa168_eth-fix-call-balance-of-pep-clk-handl.patch new file mode 100644 index 00000000000..88bc8b493cc --- /dev/null +++ b/queue-5.4/marvell-pxa168_eth-fix-call-balance-of-pep-clk-handl.patch @@ -0,0 +1,68 @@ +From a95e46f2a339428859bb683d23189190ec1108b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Nov 2024 23:06:58 +0300 +Subject: marvell: pxa168_eth: fix call balance of pep->clk handling routines + +From: Vitalii Mordan + +[ Upstream commit b032ae57d4fe2b2445e3bc190db6fcaa8c102f68 ] + +If the clock pep->clk was not enabled in pxa168_eth_probe, +it should not be disabled in any path. + +Conversely, if it was enabled in pxa168_eth_probe, it must be disabled +in all error paths to ensure proper cleanup. + +Use the devm_clk_get_enabled helper function to ensure proper call balance +for pep->clk. + +Found by Linux Verification Center (linuxtesting.org) with Klever. + +Fixes: a49f37eed22b ("net: add Fast Ethernet driver for PXA168.") +Signed-off-by: Vitalii Mordan +Link: https://patch.msgid.link/20241121200658.2203871-1-mordan@ispras.ru +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/pxa168_eth.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c +index 235bbb2940a88..0df507686b569 100644 +--- a/drivers/net/ethernet/marvell/pxa168_eth.c ++++ b/drivers/net/ethernet/marvell/pxa168_eth.c +@@ -1407,18 +1407,15 @@ static int pxa168_eth_probe(struct platform_device *pdev) + + printk(KERN_NOTICE "PXA168 10/100 Ethernet Driver\n"); + +- clk = devm_clk_get(&pdev->dev, NULL); ++ clk = devm_clk_get_enabled(&pdev->dev, NULL); + if (IS_ERR(clk)) { +- dev_err(&pdev->dev, "Fast Ethernet failed to get clock\n"); ++ dev_err(&pdev->dev, "Fast Ethernet failed to get and enable clock\n"); + return -ENODEV; + } +- clk_prepare_enable(clk); + + dev = alloc_etherdev(sizeof(struct pxa168_eth_private)); +- if (!dev) { +- err = -ENOMEM; +- goto err_clk; +- } ++ if (!dev) ++ return -ENOMEM; + + platform_set_drvdata(pdev, dev); + pep = netdev_priv(dev); +@@ -1531,8 +1528,6 @@ static int pxa168_eth_probe(struct platform_device *pdev) + mdiobus_free(pep->smi_bus); + err_netdev: + free_netdev(dev); +-err_clk: +- clk_disable_unprepare(clk); + return err; + } + +-- +2.43.0 + diff --git a/queue-5.4/mfd-da9052-spi-change-read-mask-to-write-mask.patch b/queue-5.4/mfd-da9052-spi-change-read-mask-to-write-mask.patch new file mode 100644 index 00000000000..30d0ce93178 --- /dev/null +++ b/queue-5.4/mfd-da9052-spi-change-read-mask-to-write-mask.patch @@ -0,0 +1,38 @@ +From c2b229f2e125b4f288404eb5ca42011ee8b09f18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2024 12:19:53 +0200 +Subject: mfd: da9052-spi: Change read-mask to write-mask + +From: Marcus Folkesson + +[ Upstream commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed ] + +Driver has mixed up the R/W bit. +The LSB bit is set on write rather than read. +Change it to avoid nasty things to happen. + +Fixes: e9e9d3973594 ("mfd: da9052: Avoid setting read_flag_mask for da9052-i2c driver") +Signed-off-by: Marcus Folkesson +Link: https://lore.kernel.org/r/20240925-da9052-v2-1-f243e4505b07@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/da9052-spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c +index 5faf3766a5e20..06c500bf4d57e 100644 +--- a/drivers/mfd/da9052-spi.c ++++ b/drivers/mfd/da9052-spi.c +@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi) + spi_set_drvdata(spi, da9052); + + config = da9052_regmap_config; +- config.read_flag_mask = 1; ++ config.write_flag_mask = 1; + config.reg_bits = 7; + config.pad_bits = 1; + config.val_bits = 8; +-- +2.43.0 + diff --git a/queue-5.4/mfd-intel_soc_pmic_bxtwc-use-dev_err_probe.patch b/queue-5.4/mfd-intel_soc_pmic_bxtwc-use-dev_err_probe.patch new file mode 100644 index 00000000000..55acd2d40ae --- /dev/null +++ b/queue-5.4/mfd-intel_soc_pmic_bxtwc-use-dev_err_probe.patch @@ -0,0 +1,189 @@ +From 267966b097ed12f2d1161a110029edde7ef1a557 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jun 2022 01:17:40 +0300 +Subject: mfd: intel_soc_pmic_bxtwc: Use dev_err_probe() + +From: Andy Shevchenko + +[ Upstream commit d30e2c30a43de950cfd3690f24342a39034221c4 ] + +Simplify the mux error path a bit by using dev_err_probe(). + +Signed-off-by: Andy Shevchenko +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20220628221747.33956-4-andriy.shevchenko@linux.intel.com +Stable-dep-of: 686fb77712a4 ("mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device") +Signed-off-by: Sasha Levin +--- + drivers/mfd/intel_soc_pmic_bxtwc.c | 86 +++++++++--------------------- + 1 file changed, 26 insertions(+), 60 deletions(-) + +diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c +index 739cfb5b69fe7..072ed3226a83f 100644 +--- a/drivers/mfd/intel_soc_pmic_bxtwc.c ++++ b/drivers/mfd/intel_soc_pmic_bxtwc.c +@@ -414,12 +414,9 @@ static int bxtwc_add_chained_irq_chip(struct intel_soc_pmic *pmic, + int irq; + + irq = regmap_irq_get_virq(pdata, pirq); +- if (irq < 0) { +- dev_err(pmic->dev, +- "Failed to get parent vIRQ(%d) for chip %s, ret:%d\n", +- pirq, chip->name, irq); +- return irq; +- } ++ if (irq < 0) ++ return dev_err_probe(pmic->dev, irq, "Failed to get parent vIRQ(%d) for chip %s\n", ++ pirq, chip->name); + + return devm_regmap_add_irq_chip(pmic->dev, pmic->regmap, irq, irq_flags, + 0, chip, data); +@@ -427,6 +424,7 @@ static int bxtwc_add_chained_irq_chip(struct intel_soc_pmic *pmic, + + static int bxtwc_probe(struct platform_device *pdev) + { ++ struct device *dev = &pdev->dev; + int ret; + acpi_handle handle; + acpi_status status; +@@ -435,15 +433,10 @@ static int bxtwc_probe(struct platform_device *pdev) + + handle = ACPI_HANDLE(&pdev->dev); + status = acpi_evaluate_integer(handle, "_HRV", NULL, &hrv); +- if (ACPI_FAILURE(status)) { +- dev_err(&pdev->dev, "Failed to get PMIC hardware revision\n"); +- return -ENODEV; +- } +- if (hrv != BROXTON_PMIC_WC_HRV) { +- dev_err(&pdev->dev, "Invalid PMIC hardware revision: %llu\n", +- hrv); +- return -ENODEV; +- } ++ if (ACPI_FAILURE(status)) ++ return dev_err_probe(dev, -ENODEV, "Failed to get PMIC hardware revision\n"); ++ if (hrv != BROXTON_PMIC_WC_HRV) ++ return dev_err_probe(dev, -ENODEV, "Invalid PMIC hardware revision: %llu\n", hrv); + + pmic = devm_kzalloc(&pdev->dev, sizeof(*pmic), GFP_KERNEL); + if (!pmic) +@@ -459,40 +452,31 @@ static int bxtwc_probe(struct platform_device *pdev) + + pmic->regmap = devm_regmap_init(&pdev->dev, NULL, pmic, + &bxtwc_regmap_config); +- if (IS_ERR(pmic->regmap)) { +- ret = PTR_ERR(pmic->regmap); +- dev_err(&pdev->dev, "Failed to initialise regmap: %d\n", ret); +- return ret; +- } ++ if (IS_ERR(pmic->regmap)) ++ return dev_err_probe(dev, PTR_ERR(pmic->regmap), "Failed to initialise regmap\n"); + + ret = devm_regmap_add_irq_chip(&pdev->dev, pmic->regmap, pmic->irq, + IRQF_ONESHOT | IRQF_SHARED, + 0, &bxtwc_regmap_irq_chip, + &pmic->irq_chip_data); +- if (ret) { +- dev_err(&pdev->dev, "Failed to add IRQ chip\n"); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to add IRQ chip\n"); + + ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, + BXTWC_PWRBTN_LVL1_IRQ, + IRQF_ONESHOT, + &bxtwc_regmap_irq_chip_pwrbtn, + &pmic->irq_chip_data_pwrbtn); +- if (ret) { +- dev_err(&pdev->dev, "Failed to add PWRBTN IRQ chip\n"); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to add PWRBTN IRQ chip\n"); + + ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, + BXTWC_TMU_LVL1_IRQ, + IRQF_ONESHOT, + &bxtwc_regmap_irq_chip_tmu, + &pmic->irq_chip_data_tmu); +- if (ret) { +- dev_err(&pdev->dev, "Failed to add TMU IRQ chip\n"); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to add TMU IRQ chip\n"); + + /* Add chained IRQ handler for BCU IRQs */ + ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, +@@ -500,12 +484,8 @@ static int bxtwc_probe(struct platform_device *pdev) + IRQF_ONESHOT, + &bxtwc_regmap_irq_chip_bcu, + &pmic->irq_chip_data_bcu); +- +- +- if (ret) { +- dev_err(&pdev->dev, "Failed to add BUC IRQ chip\n"); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to add BUC IRQ chip\n"); + + /* Add chained IRQ handler for ADC IRQs */ + ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, +@@ -513,12 +493,8 @@ static int bxtwc_probe(struct platform_device *pdev) + IRQF_ONESHOT, + &bxtwc_regmap_irq_chip_adc, + &pmic->irq_chip_data_adc); +- +- +- if (ret) { +- dev_err(&pdev->dev, "Failed to add ADC IRQ chip\n"); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to add ADC IRQ chip\n"); + + /* Add chained IRQ handler for CHGR IRQs */ + ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, +@@ -526,12 +502,8 @@ static int bxtwc_probe(struct platform_device *pdev) + IRQF_ONESHOT, + &bxtwc_regmap_irq_chip_chgr, + &pmic->irq_chip_data_chgr); +- +- +- if (ret) { +- dev_err(&pdev->dev, "Failed to add CHGR IRQ chip\n"); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to add CHGR IRQ chip\n"); + + /* Add chained IRQ handler for CRIT IRQs */ + ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, +@@ -539,19 +511,13 @@ static int bxtwc_probe(struct platform_device *pdev) + IRQF_ONESHOT, + &bxtwc_regmap_irq_chip_crit, + &pmic->irq_chip_data_crit); +- +- +- if (ret) { +- dev_err(&pdev->dev, "Failed to add CRIT IRQ chip\n"); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to add CRIT IRQ chip\n"); + + ret = devm_mfd_add_devices(&pdev->dev, PLATFORM_DEVID_NONE, bxt_wc_dev, + ARRAY_SIZE(bxt_wc_dev), NULL, 0, NULL); +- if (ret) { +- dev_err(&pdev->dev, "Failed to add devices\n"); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to add devices\n"); + + ret = sysfs_create_group(&pdev->dev.kobj, &bxtwc_group); + if (ret) { +-- +2.43.0 + diff --git a/queue-5.4/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-pmic-dev.patch b/queue-5.4/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-pmic-dev.patch new file mode 100644 index 00000000000..c82c5bb4c26 --- /dev/null +++ b/queue-5.4/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-pmic-dev.patch @@ -0,0 +1,118 @@ +From a362bae0606549647ea9aa6b59bca5df4d457925 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Oct 2024 22:27:06 +0300 +Subject: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices + +From: Andy Shevchenko + +[ Upstream commit 0350d783ab888cb1cb48ced36cc28b372723f1a4 ] + +While design wise the idea of converting the driver to use +the hierarchy of the IRQ chips is correct, the implementation +has (inherited) flaws. This was unveiled when platform_get_irq() +had started WARN() on IRQ 0 that is supposed to be a Linux +IRQ number (also known as vIRQ). + +Rework the driver to respect IRQ domain when creating each MFD +device separately, as the domain is not the same for all of them. + +Fixes: 57129044f504 ("mfd: intel_soc_pmic_bxtwc: Use chained IRQs for second level IRQ chips") +Tested-by: Zhang Ning +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20241005193029.1929139-4-andriy.shevchenko@linux.intel.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/intel_soc_pmic_bxtwc.c | 54 +++++++++++++++++------------- + 1 file changed, 30 insertions(+), 24 deletions(-) + +diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c +index ba441fd9c4ed4..9f44f793ca456 100644 +--- a/drivers/mfd/intel_soc_pmic_bxtwc.c ++++ b/drivers/mfd/intel_soc_pmic_bxtwc.c +@@ -226,21 +226,11 @@ static struct resource tmu_resources[] = { + }; + + static struct mfd_cell bxt_wc_dev[] = { +- { +- .name = "bxt_wcove_gpadc", +- .num_resources = ARRAY_SIZE(adc_resources), +- .resources = adc_resources, +- }, + { + .name = "bxt_wcove_thermal", + .num_resources = ARRAY_SIZE(thermal_resources), + .resources = thermal_resources, + }, +- { +- .name = "bxt_wcove_bcu", +- .num_resources = ARRAY_SIZE(bcu_resources), +- .resources = bcu_resources, +- }, + { + .name = "bxt_wcove_gpio", + .num_resources = ARRAY_SIZE(gpio_resources), +@@ -259,6 +249,22 @@ static const struct mfd_cell bxt_wc_tmu_dev[] = { + }, + }; + ++static const struct mfd_cell bxt_wc_bcu_dev[] = { ++ { ++ .name = "bxt_wcove_bcu", ++ .num_resources = ARRAY_SIZE(bcu_resources), ++ .resources = bcu_resources, ++ }, ++}; ++ ++static const struct mfd_cell bxt_wc_adc_dev[] = { ++ { ++ .name = "bxt_wcove_gpadc", ++ .num_resources = ARRAY_SIZE(adc_resources), ++ .resources = adc_resources, ++ }, ++}; ++ + static struct mfd_cell bxt_wc_chgr_dev[] = { + { + .name = "bxt_wcove_usbc", +@@ -504,23 +510,23 @@ static int bxtwc_probe(struct platform_device *pdev) + if (ret) + return dev_err_probe(dev, ret, "Failed to add PWRBTN IRQ chip\n"); + +- /* Add chained IRQ handler for BCU IRQs */ +- ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, +- BXTWC_BCU_LVL1_IRQ, +- IRQF_ONESHOT, +- &bxtwc_regmap_irq_chip_bcu, +- &pmic->irq_chip_data_bcu); ++ ret = bxtwc_add_chained_devices(pmic, bxt_wc_bcu_dev, ARRAY_SIZE(bxt_wc_bcu_dev), ++ pmic->irq_chip_data, ++ BXTWC_BCU_LVL1_IRQ, ++ IRQF_ONESHOT, ++ &bxtwc_regmap_irq_chip_bcu, ++ &pmic->irq_chip_data_bcu); + if (ret) +- return dev_err_probe(dev, ret, "Failed to add BUC IRQ chip\n"); ++ return ret; + +- /* Add chained IRQ handler for ADC IRQs */ +- ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, +- BXTWC_ADC_LVL1_IRQ, +- IRQF_ONESHOT, +- &bxtwc_regmap_irq_chip_adc, +- &pmic->irq_chip_data_adc); ++ ret = bxtwc_add_chained_devices(pmic, bxt_wc_adc_dev, ARRAY_SIZE(bxt_wc_adc_dev), ++ pmic->irq_chip_data, ++ BXTWC_ADC_LVL1_IRQ, ++ IRQF_ONESHOT, ++ &bxtwc_regmap_irq_chip_adc, ++ &pmic->irq_chip_data_adc); + if (ret) +- return dev_err_probe(dev, ret, "Failed to add ADC IRQ chip\n"); ++ return ret; + + ret = bxtwc_add_chained_devices(pmic, bxt_wc_chgr_dev, ARRAY_SIZE(bxt_wc_chgr_dev), + pmic->irq_chip_data, +-- +2.43.0 + diff --git a/queue-5.4/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-tmu-devi.patch b/queue-5.4/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-tmu-devi.patch new file mode 100644 index 00000000000..38eb90e5586 --- /dev/null +++ b/queue-5.4/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-tmu-devi.patch @@ -0,0 +1,147 @@ +From 916dd7977ffc989da498f4b146fdcb712527a434 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Oct 2024 22:27:05 +0300 +Subject: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device + +From: Andy Shevchenko + +[ Upstream commit 9b79d59e6b2b515eb9a22bc469ef7b8f0904fc73 ] + +While design wise the idea of converting the driver to use +the hierarchy of the IRQ chips is correct, the implementation +has (inherited) flaws. This was unveiled when platform_get_irq() +had started WARN() on IRQ 0 that is supposed to be a Linux +IRQ number (also known as vIRQ). + +Rework the driver to respect IRQ domain when creating each MFD +device separately, as the domain is not the same for all of them. + +Fixes: 957ae5098185 ("platform/x86: Add Whiskey Cove PMIC TMU support") +Fixes: 57129044f504 ("mfd: intel_soc_pmic_bxtwc: Use chained IRQs for second level IRQ chips") +Reported-by: Zhang Ning +Closes: https://lore.kernel.org/r/TY2PR01MB3322FEDCDC048B7D3794F922CDBA2@TY2PR01MB3322.jpnprd01.prod.outlook.com +Tested-by: Zhang Ning +Acked-by: Hans de Goede +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20241005193029.1929139-3-andriy.shevchenko@linux.intel.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/intel_soc_pmic_bxtwc.c | 31 ++++++++++++++------------ + drivers/platform/x86/intel_bxtwc_tmu.c | 22 +++++------------- + 2 files changed, 23 insertions(+), 30 deletions(-) + +diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c +index 9b5edc1b47d89..ba441fd9c4ed4 100644 +--- a/drivers/mfd/intel_soc_pmic_bxtwc.c ++++ b/drivers/mfd/intel_soc_pmic_bxtwc.c +@@ -241,12 +241,6 @@ static struct mfd_cell bxt_wc_dev[] = { + .num_resources = ARRAY_SIZE(bcu_resources), + .resources = bcu_resources, + }, +- { +- .name = "bxt_wcove_tmu", +- .num_resources = ARRAY_SIZE(tmu_resources), +- .resources = tmu_resources, +- }, +- + { + .name = "bxt_wcove_gpio", + .num_resources = ARRAY_SIZE(gpio_resources), +@@ -257,6 +251,14 @@ static struct mfd_cell bxt_wc_dev[] = { + }, + }; + ++static const struct mfd_cell bxt_wc_tmu_dev[] = { ++ { ++ .name = "bxt_wcove_tmu", ++ .num_resources = ARRAY_SIZE(tmu_resources), ++ .resources = tmu_resources, ++ }, ++}; ++ + static struct mfd_cell bxt_wc_chgr_dev[] = { + { + .name = "bxt_wcove_usbc", +@@ -485,6 +487,15 @@ static int bxtwc_probe(struct platform_device *pdev) + if (ret) + return dev_err_probe(dev, ret, "Failed to add IRQ chip\n"); + ++ ret = bxtwc_add_chained_devices(pmic, bxt_wc_tmu_dev, ARRAY_SIZE(bxt_wc_tmu_dev), ++ pmic->irq_chip_data, ++ BXTWC_TMU_LVL1_IRQ, ++ IRQF_ONESHOT, ++ &bxtwc_regmap_irq_chip_tmu, ++ &pmic->irq_chip_data_tmu); ++ if (ret) ++ return ret; ++ + ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, + BXTWC_PWRBTN_LVL1_IRQ, + IRQF_ONESHOT, +@@ -493,14 +504,6 @@ static int bxtwc_probe(struct platform_device *pdev) + if (ret) + return dev_err_probe(dev, ret, "Failed to add PWRBTN IRQ chip\n"); + +- ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, +- BXTWC_TMU_LVL1_IRQ, +- IRQF_ONESHOT, +- &bxtwc_regmap_irq_chip_tmu, +- &pmic->irq_chip_data_tmu); +- if (ret) +- return dev_err_probe(dev, ret, "Failed to add TMU IRQ chip\n"); +- + /* Add chained IRQ handler for BCU IRQs */ + ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, + BXTWC_BCU_LVL1_IRQ, +diff --git a/drivers/platform/x86/intel_bxtwc_tmu.c b/drivers/platform/x86/intel_bxtwc_tmu.c +index 7ccf583649e6b..3c9778366d930 100644 +--- a/drivers/platform/x86/intel_bxtwc_tmu.c ++++ b/drivers/platform/x86/intel_bxtwc_tmu.c +@@ -48,9 +48,8 @@ static irqreturn_t bxt_wcove_tmu_irq_handler(int irq, void *data) + static int bxt_wcove_tmu_probe(struct platform_device *pdev) + { + struct intel_soc_pmic *pmic = dev_get_drvdata(pdev->dev.parent); +- struct regmap_irq_chip_data *regmap_irq_chip; + struct wcove_tmu *wctmu; +- int ret, virq, irq; ++ int ret; + + wctmu = devm_kzalloc(&pdev->dev, sizeof(*wctmu), GFP_KERNEL); + if (!wctmu) +@@ -59,27 +58,18 @@ static int bxt_wcove_tmu_probe(struct platform_device *pdev) + wctmu->dev = &pdev->dev; + wctmu->regmap = pmic->regmap; + +- irq = platform_get_irq(pdev, 0); +- if (irq < 0) +- return irq; ++ wctmu->irq = platform_get_irq(pdev, 0); ++ if (wctmu->irq < 0) ++ return wctmu->irq; + +- regmap_irq_chip = pmic->irq_chip_data_tmu; +- virq = regmap_irq_get_virq(regmap_irq_chip, irq); +- if (virq < 0) { +- dev_err(&pdev->dev, +- "failed to get virtual interrupt=%d\n", irq); +- return virq; +- } +- +- ret = devm_request_threaded_irq(&pdev->dev, virq, ++ ret = devm_request_threaded_irq(&pdev->dev, wctmu->irq, + NULL, bxt_wcove_tmu_irq_handler, + IRQF_ONESHOT, "bxt_wcove_tmu", wctmu); + if (ret) { + dev_err(&pdev->dev, "request irq failed: %d,virq: %d\n", +- ret, virq); ++ ret, wctmu->irq); + return ret; + } +- wctmu->irq = virq; + + /* Unmask TMU second level Wake & System alarm */ + regmap_update_bits(wctmu->regmap, BXTWC_MTMUIRQ_REG, +-- +2.43.0 + diff --git a/queue-5.4/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-usb-type.patch b/queue-5.4/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-usb-type.patch new file mode 100644 index 00000000000..a5b4b9b8780 --- /dev/null +++ b/queue-5.4/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-usb-type.patch @@ -0,0 +1,142 @@ +From ec915c9426591224ace6af3b66f1d24027c8e228 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Oct 2024 22:27:04 +0300 +Subject: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device + +From: Andy Shevchenko + +[ Upstream commit 686fb77712a4bc94b76a0c5ae74c60118b7a0d79 ] + +While design wise the idea of converting the driver to use +the hierarchy of the IRQ chips is correct, the implementation +has (inherited) flaws. This was unveiled when platform_get_irq() +had started WARN() on IRQ 0 that is supposed to be a Linux +IRQ number (also known as vIRQ). + +Rework the driver to respect IRQ domain when creating each MFD +device separately, as the domain is not the same for all of them. + +Fixes: 9c6235c86332 ("mfd: intel_soc_pmic_bxtwc: Add bxt_wcove_usbc device") +Fixes: d2061f9cc32d ("usb: typec: add driver for Intel Whiskey Cove PMIC USB Type-C PHY") +Fixes: 57129044f504 ("mfd: intel_soc_pmic_bxtwc: Use chained IRQs for second level IRQ chips") +Reported-by: Zhang Ning +Closes: https://lore.kernel.org/r/TY2PR01MB3322FEDCDC048B7D3794F922CDBA2@TY2PR01MB3322.jpnprd01.prod.outlook.com +Tested-by: Zhang Ning +Signed-off-by: Andy Shevchenko +Acked-by: Greg Kroah-Hartman +Link: https://lore.kernel.org/r/20241005193029.1929139-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/intel_soc_pmic_bxtwc.c | 57 +++++++++++++++++++++--------- + drivers/usb/typec/tcpm/wcove.c | 4 --- + 2 files changed, 40 insertions(+), 21 deletions(-) + +diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c +index 072ed3226a83f..9b5edc1b47d89 100644 +--- a/drivers/mfd/intel_soc_pmic_bxtwc.c ++++ b/drivers/mfd/intel_soc_pmic_bxtwc.c +@@ -236,16 +236,6 @@ static struct mfd_cell bxt_wc_dev[] = { + .num_resources = ARRAY_SIZE(thermal_resources), + .resources = thermal_resources, + }, +- { +- .name = "bxt_wcove_usbc", +- .num_resources = ARRAY_SIZE(usbc_resources), +- .resources = usbc_resources, +- }, +- { +- .name = "bxt_wcove_ext_charger", +- .num_resources = ARRAY_SIZE(charger_resources), +- .resources = charger_resources, +- }, + { + .name = "bxt_wcove_bcu", + .num_resources = ARRAY_SIZE(bcu_resources), +@@ -267,6 +257,19 @@ static struct mfd_cell bxt_wc_dev[] = { + }, + }; + ++static struct mfd_cell bxt_wc_chgr_dev[] = { ++ { ++ .name = "bxt_wcove_usbc", ++ .num_resources = ARRAY_SIZE(usbc_resources), ++ .resources = usbc_resources, ++ }, ++ { ++ .name = "bxt_wcove_ext_charger", ++ .num_resources = ARRAY_SIZE(charger_resources), ++ .resources = charger_resources, ++ }, ++}; ++ + static int regmap_ipc_byte_reg_read(void *context, unsigned int reg, + unsigned int *val) + { +@@ -422,6 +425,26 @@ static int bxtwc_add_chained_irq_chip(struct intel_soc_pmic *pmic, + 0, chip, data); + } + ++static int bxtwc_add_chained_devices(struct intel_soc_pmic *pmic, ++ const struct mfd_cell *cells, int n_devs, ++ struct regmap_irq_chip_data *pdata, ++ int pirq, int irq_flags, ++ const struct regmap_irq_chip *chip, ++ struct regmap_irq_chip_data **data) ++{ ++ struct device *dev = pmic->dev; ++ struct irq_domain *domain; ++ int ret; ++ ++ ret = bxtwc_add_chained_irq_chip(pmic, pdata, pirq, irq_flags, chip, data); ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to add %s IRQ chip\n", chip->name); ++ ++ domain = regmap_irq_get_domain(*data); ++ ++ return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, cells, n_devs, NULL, 0, domain); ++} ++ + static int bxtwc_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -496,14 +519,14 @@ static int bxtwc_probe(struct platform_device *pdev) + if (ret) + return dev_err_probe(dev, ret, "Failed to add ADC IRQ chip\n"); + +- /* Add chained IRQ handler for CHGR IRQs */ +- ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, +- BXTWC_CHGR_LVL1_IRQ, +- IRQF_ONESHOT, +- &bxtwc_regmap_irq_chip_chgr, +- &pmic->irq_chip_data_chgr); ++ ret = bxtwc_add_chained_devices(pmic, bxt_wc_chgr_dev, ARRAY_SIZE(bxt_wc_chgr_dev), ++ pmic->irq_chip_data, ++ BXTWC_CHGR_LVL1_IRQ, ++ IRQF_ONESHOT, ++ &bxtwc_regmap_irq_chip_chgr, ++ &pmic->irq_chip_data_chgr); + if (ret) +- return dev_err_probe(dev, ret, "Failed to add CHGR IRQ chip\n"); ++ return ret; + + /* Add chained IRQ handler for CRIT IRQs */ + ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, +diff --git a/drivers/usb/typec/tcpm/wcove.c b/drivers/usb/typec/tcpm/wcove.c +index 7e9c279bf49df..22fe8d60fe368 100644 +--- a/drivers/usb/typec/tcpm/wcove.c ++++ b/drivers/usb/typec/tcpm/wcove.c +@@ -620,10 +620,6 @@ static int wcove_typec_probe(struct platform_device *pdev) + if (irq < 0) + return irq; + +- irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr, irq); +- if (irq < 0) +- return irq; +- + ret = guid_parse(WCOVE_DSM_UUID, &wcove->guid); + if (ret) + return ret; +-- +2.43.0 + diff --git a/queue-5.4/mfd-rt5033-fix-missing-regmap_del_irq_chip.patch b/queue-5.4/mfd-rt5033-fix-missing-regmap_del_irq_chip.patch new file mode 100644 index 00000000000..0c3accc049e --- /dev/null +++ b/queue-5.4/mfd-rt5033-fix-missing-regmap_del_irq_chip.patch @@ -0,0 +1,39 @@ +From de662a6235e5fb33f695f335d4b755bf37bcee1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2024 23:41:06 +0800 +Subject: mfd: rt5033: Fix missing regmap_del_irq_chip() + +From: Zhang Changzhong + +[ Upstream commit d256d612f47529ed0b332298e2d5ea981a4dd5b8 ] + +Fix missing call to regmap_del_irq_chip() in error handling path by +using devm_regmap_add_irq_chip(). + +Fixes: 0b271258544b ("mfd: rt5033: Add Richtek RT5033 driver core.") +Signed-off-by: Zhang Changzhong +Link: https://lore.kernel.org/r/1730302867-8391-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/rt5033.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/rt5033.c b/drivers/mfd/rt5033.c +index 302115dabff4b..9afb8d2b35476 100644 +--- a/drivers/mfd/rt5033.c ++++ b/drivers/mfd/rt5033.c +@@ -82,8 +82,8 @@ static int rt5033_i2c_probe(struct i2c_client *i2c, + } + dev_info(&i2c->dev, "Device found Device ID: %04x\n", dev_id); + +- ret = regmap_add_irq_chip(rt5033->regmap, rt5033->irq, +- IRQF_TRIGGER_FALLING | IRQF_ONESHOT, ++ ret = devm_regmap_add_irq_chip(rt5033->dev, rt5033->regmap, ++ rt5033->irq, IRQF_TRIGGER_FALLING | IRQF_ONESHOT, + 0, &rt5033_irq_chip, &rt5033->irq_data); + if (ret) { + dev_err(&i2c->dev, "Failed to request IRQ %d: %d\n", +-- +2.43.0 + diff --git a/queue-5.4/mfd-tps65010-use-irqf_no_autoen-flag-in-request_irq-.patch b/queue-5.4/mfd-tps65010-use-irqf_no_autoen-flag-in-request_irq-.patch new file mode 100644 index 00000000000..bc7e9181bbf --- /dev/null +++ b/queue-5.4/mfd-tps65010-use-irqf_no_autoen-flag-in-request_irq-.patch @@ -0,0 +1,49 @@ +From c605778504b9a07c95ad835719efceab2b593f20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2024 11:15:30 +0800 +Subject: mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race + +From: Jinjie Ruan + +[ Upstream commit 2174f9a8c9db50f74df769edd5a4ab822c73b6d2 ] + +As the comment said, disable_irq() after request_irq() still has a +time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN +flag will disable IRQ auto-enable when request IRQ. + +Fixes: 72cd799544f2 ("[PATCH] I2C: add i2c driver for TPS6501x") +Signed-off-by: Jinjie Ruan +Link: https://lore.kernel.org/r/20240912031530.2211654-1-ruanjinjie@huawei.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/tps65010.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/mfd/tps65010.c b/drivers/mfd/tps65010.c +index 65fcc58c02da8..412662f7b9ede 100644 +--- a/drivers/mfd/tps65010.c ++++ b/drivers/mfd/tps65010.c +@@ -550,17 +550,13 @@ static int tps65010_probe(struct i2c_client *client, + */ + if (client->irq > 0) { + status = request_irq(client->irq, tps65010_irq, +- IRQF_TRIGGER_FALLING, DRIVER_NAME, tps); ++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN, ++ DRIVER_NAME, tps); + if (status < 0) { + dev_dbg(&client->dev, "can't get IRQ %d, err %d\n", + client->irq, status); + return status; + } +- /* annoying race here, ideally we'd have an option +- * to claim the irq now and enable it later. +- * FIXME genirq IRQF_NOAUTOEN now solves that ... +- */ +- disable_irq(client->irq); + set_bit(FLAG_IRQ_ENABLE, &tps->flags); + } else + dev_warn(&client->dev, "IRQ not configured!\n"); +-- +2.43.0 + diff --git a/queue-5.4/mips-asm-fix-warning-when-disabling-mips_fp_support.patch b/queue-5.4/mips-asm-fix-warning-when-disabling-mips_fp_support.patch new file mode 100644 index 00000000000..315e76ed259 --- /dev/null +++ b/queue-5.4/mips-asm-fix-warning-when-disabling-mips_fp_support.patch @@ -0,0 +1,49 @@ +From ca981b5121b61d9eadef821099efcfac76758102 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Oct 2024 12:12:14 +0200 +Subject: mips: asm: fix warning when disabling MIPS_FP_SUPPORT + +From: Jonas Gorski + +[ Upstream commit da09935975c8f8c90d6f57be2422dee5557206cd ] + +When MIPS_FP_SUPPORT is disabled, __sanitize_fcr31() is defined as +nothing, which triggers a gcc warning: + + In file included from kernel/sched/core.c:79: + kernel/sched/core.c: In function 'context_switch': + ./arch/mips/include/asm/switch_to.h:114:39: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] + 114 | __sanitize_fcr31(next); \ + | ^ + kernel/sched/core.c:5316:9: note: in expansion of macro 'switch_to' + 5316 | switch_to(prev, next, prev); + | ^~~~~~~~~ + +Fix this by providing an empty body for __sanitize_fcr31() like one is +defined for __mips_mt_fpaff_switch_to(). + +Fixes: 36a498035bd2 ("MIPS: Avoid FCSR sanitization when CONFIG_MIPS_FP_SUPPORT=n") +Signed-off-by: Jonas Gorski +Reviewed-by: Maciej W. Rozycki +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/switch_to.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/asm/switch_to.h b/arch/mips/include/asm/switch_to.h +index 09cbe9042828f..531eb245fc575 100644 +--- a/arch/mips/include/asm/switch_to.h ++++ b/arch/mips/include/asm/switch_to.h +@@ -97,7 +97,7 @@ do { \ + } \ + } while (0) + #else +-# define __sanitize_fcr31(next) ++# define __sanitize_fcr31(next) do { (void) (next); } while (0) + #endif + + /* +-- +2.43.0 + diff --git a/queue-5.4/misc-apds990x-fix-missing-pm_runtime_disable.patch b/queue-5.4/misc-apds990x-fix-missing-pm_runtime_disable.patch new file mode 100644 index 00000000000..564271fd57d --- /dev/null +++ b/queue-5.4/misc-apds990x-fix-missing-pm_runtime_disable.patch @@ -0,0 +1,67 @@ +From 032c863e80f24b3a4a038a40019a41135ecf9cea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Sep 2024 11:55:56 +0800 +Subject: misc: apds990x: Fix missing pm_runtime_disable() + +From: Jinjie Ruan + +[ Upstream commit 3c5d8b819d27012264edd17e6ae7fffda382fe44 ] + +The pm_runtime_disable() is missing in probe error path, +so add it to fix it. + +Fixes: 92b1f84d46b2 ("drivers/misc: driver for APDS990X ALS and proximity sensors") +Signed-off-by: Jinjie Ruan +Link: https://lore.kernel.org/r/20240923035556.3009105-1-ruanjinjie@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/apds990x.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/misc/apds990x.c b/drivers/misc/apds990x.c +index 45f5b997a0e10..5b17288ecc2f0 100644 +--- a/drivers/misc/apds990x.c ++++ b/drivers/misc/apds990x.c +@@ -1148,7 +1148,7 @@ static int apds990x_probe(struct i2c_client *client, + err = chip->pdata->setup_resources(); + if (err) { + err = -EINVAL; +- goto fail3; ++ goto fail4; + } + } + +@@ -1156,7 +1156,7 @@ static int apds990x_probe(struct i2c_client *client, + apds990x_attribute_group); + if (err < 0) { + dev_err(&chip->client->dev, "Sysfs registration failed\n"); +- goto fail4; ++ goto fail5; + } + + err = request_threaded_irq(client->irq, NULL, +@@ -1167,15 +1167,17 @@ static int apds990x_probe(struct i2c_client *client, + if (err) { + dev_err(&client->dev, "could not get IRQ %d\n", + client->irq); +- goto fail5; ++ goto fail6; + } + return err; +-fail5: ++fail6: + sysfs_remove_group(&chip->client->dev.kobj, + &apds990x_attribute_group[0]); +-fail4: ++fail5: + if (chip->pdata && chip->pdata->release_resources) + chip->pdata->release_resources(); ++fail4: ++ pm_runtime_disable(&client->dev); + fail3: + regulator_bulk_disable(ARRAY_SIZE(chip->regs), chip->regs); + fail2: +-- +2.43.0 + diff --git a/queue-5.4/mmc-mmc_spi-drop-buggy-snprintf.patch b/queue-5.4/mmc-mmc_spi-drop-buggy-snprintf.patch new file mode 100644 index 00000000000..a3ba3524fa9 --- /dev/null +++ b/queue-5.4/mmc-mmc_spi-drop-buggy-snprintf.patch @@ -0,0 +1,66 @@ +From 3b03fa1590d4669c5d56de74ee695a2e561beb2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 18:01:34 +0200 +Subject: mmc: mmc_spi: drop buggy snprintf() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bartosz Golaszewski + +[ Upstream commit 328bda09cc91b3d93bc64f4a4dadc44313dd8140 ] + +GCC 13 complains about the truncated output of snprintf(): + +drivers/mmc/host/mmc_spi.c: In function ‘mmc_spi_response_get’: +drivers/mmc/host/mmc_spi.c:227:64: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=] + 227 | snprintf(tag, sizeof(tag), " ... CMD%d response SPI_%s", + | ^ +drivers/mmc/host/mmc_spi.c:227:9: note: ‘snprintf’ output between 26 and 43 bytes into a destination of size 32 + 227 | snprintf(tag, sizeof(tag), " ... CMD%d response SPI_%s", + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 228 | cmd->opcode, maptype(cmd)); + +Drop it and fold the string it generates into the only place where it's +emitted - the dev_dbg() call at the end of the function. + +Fixes: 15a0580ced08 ("mmc_spi host driver") +Suggested-by: Christophe JAILLET +Signed-off-by: Bartosz Golaszewski +Link: https://lore.kernel.org/r/20241008160134.69934-1-brgl@bgdev.pl +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/mmc_spi.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c +index 7874b266a4448..e8937d8166fb4 100644 +--- a/drivers/mmc/host/mmc_spi.c ++++ b/drivers/mmc/host/mmc_spi.c +@@ -255,10 +255,6 @@ static int mmc_spi_response_get(struct mmc_spi_host *host, + u8 leftover = 0; + unsigned short rotator; + int i; +- char tag[32]; +- +- snprintf(tag, sizeof(tag), " ... CMD%d response SPI_%s", +- cmd->opcode, maptype(cmd)); + + /* Except for data block reads, the whole response will already + * be stored in the scratch buffer. It's somewhere after the +@@ -408,8 +404,9 @@ static int mmc_spi_response_get(struct mmc_spi_host *host, + } + + if (value < 0) +- dev_dbg(&host->spi->dev, "%s: resp %04x %08x\n", +- tag, cmd->resp[0], cmd->resp[1]); ++ dev_dbg(&host->spi->dev, ++ " ... CMD%d response SPI_%s: resp %04x %08x\n", ++ cmd->opcode, maptype(cmd), cmd->resp[0], cmd->resp[1]); + + /* disable chipselect on errors and some success cases */ + if (value >= 0 && cs_on) +-- +2.43.0 + diff --git a/queue-5.4/mtd-rawnand-atmel-fix-possible-memory-leak.patch b/queue-5.4/mtd-rawnand-atmel-fix-possible-memory-leak.patch new file mode 100644 index 00000000000..d47d81ac97a --- /dev/null +++ b/queue-5.4/mtd-rawnand-atmel-fix-possible-memory-leak.patch @@ -0,0 +1,70 @@ +From e9bdb1abc342045b656a160e83b37e107e1a4043 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 22:31:49 +0200 +Subject: mtd: rawnand: atmel: Fix possible memory leak + +From: Miquel Raynal + +[ Upstream commit 6d734f1bfc336aaea91313a5632f2f197608fadd ] + +The pmecc "user" structure is allocated in atmel_pmecc_create_user() and +was supposed to be freed with atmel_pmecc_destroy_user(), but this other +helper is never called. One solution would be to find the proper +location to call the destructor, but the trend today is to switch to +device managed allocations, which in this case fits pretty well. + +Replace kzalloc() by devm_kzalloc() and drop the destructor entirely. + +Reported-by: "Dr. David Alan Gilbert" +Closes: https://lore.kernel.org/all/ZvmIvRJCf6VhHvpo@gallifrey/ +Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20241001203149.387655-1-miquel.raynal@bootlin.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/atmel/pmecc.c | 8 +------- + drivers/mtd/nand/raw/atmel/pmecc.h | 2 -- + 2 files changed, 1 insertion(+), 9 deletions(-) + +diff --git a/drivers/mtd/nand/raw/atmel/pmecc.c b/drivers/mtd/nand/raw/atmel/pmecc.c +index cbb023bf00f72..09848d13802d8 100644 +--- a/drivers/mtd/nand/raw/atmel/pmecc.c ++++ b/drivers/mtd/nand/raw/atmel/pmecc.c +@@ -362,7 +362,7 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc, + size = ALIGN(size, sizeof(s32)); + size += (req->ecc.strength + 1) * sizeof(s32) * 3; + +- user = kzalloc(size, GFP_KERNEL); ++ user = devm_kzalloc(pmecc->dev, size, GFP_KERNEL); + if (!user) + return ERR_PTR(-ENOMEM); + +@@ -408,12 +408,6 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc, + } + EXPORT_SYMBOL_GPL(atmel_pmecc_create_user); + +-void atmel_pmecc_destroy_user(struct atmel_pmecc_user *user) +-{ +- kfree(user); +-} +-EXPORT_SYMBOL_GPL(atmel_pmecc_destroy_user); +- + static int get_strength(struct atmel_pmecc_user *user) + { + const int *strengths = user->pmecc->caps->strengths; +diff --git a/drivers/mtd/nand/raw/atmel/pmecc.h b/drivers/mtd/nand/raw/atmel/pmecc.h +index 7851c05126cf1..cc0c5af1f4f1a 100644 +--- a/drivers/mtd/nand/raw/atmel/pmecc.h ++++ b/drivers/mtd/nand/raw/atmel/pmecc.h +@@ -55,8 +55,6 @@ struct atmel_pmecc *devm_atmel_pmecc_get(struct device *dev); + struct atmel_pmecc_user * + atmel_pmecc_create_user(struct atmel_pmecc *pmecc, + struct atmel_pmecc_user_req *req); +-void atmel_pmecc_destroy_user(struct atmel_pmecc_user *user); +- + void atmel_pmecc_reset(struct atmel_pmecc *pmecc); + int atmel_pmecc_enable(struct atmel_pmecc_user *user, int op); + void atmel_pmecc_disable(struct atmel_pmecc_user *user); +-- +2.43.0 + diff --git a/queue-5.4/net-rfkill-gpio-add-check-for-clk_enable.patch b/queue-5.4/net-rfkill-gpio-add-check-for-clk_enable.patch new file mode 100644 index 00000000000..dee7d3c5c3f --- /dev/null +++ b/queue-5.4/net-rfkill-gpio-add-check-for-clk_enable.patch @@ -0,0 +1,44 @@ +From fb96339571375110fcf3a7e3281c850a1663dc31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2024 14:53:41 -0500 +Subject: net: rfkill: gpio: Add check for clk_enable() + +From: Mingwei Zheng + +[ Upstream commit 8251e7621b25ccdb689f1dd9553b8789e3745ea1 ] + +Add check for the return value of clk_enable() to catch the potential +error. + +Fixes: 7176ba23f8b5 ("net: rfkill: add generic gpio rfkill driver") +Signed-off-by: Mingwei Zheng +Signed-off-by: Jiasheng Jiang +Link: https://patch.msgid.link/20241108195341.1853080-1-zmw12306@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/rfkill/rfkill-gpio.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c +index f74baefd855d3..2df5bf240b64a 100644 +--- a/net/rfkill/rfkill-gpio.c ++++ b/net/rfkill/rfkill-gpio.c +@@ -30,8 +30,12 @@ static int rfkill_gpio_set_power(void *data, bool blocked) + { + struct rfkill_gpio_data *rfkill = data; + +- if (!blocked && !IS_ERR(rfkill->clk) && !rfkill->clk_enabled) +- clk_enable(rfkill->clk); ++ if (!blocked && !IS_ERR(rfkill->clk) && !rfkill->clk_enabled) { ++ int ret = clk_enable(rfkill->clk); ++ ++ if (ret) ++ return ret; ++ } + + gpiod_set_value_cansleep(rfkill->shutdown_gpio, !blocked); + gpiod_set_value_cansleep(rfkill->reset_gpio, !blocked); +-- +2.43.0 + diff --git a/queue-5.4/net-stmmac-dwmac-socfpga-set-rx-watchdog-interrupt-a.patch b/queue-5.4/net-stmmac-dwmac-socfpga-set-rx-watchdog-interrupt-a.patch new file mode 100644 index 00000000000..e1f96e61348 --- /dev/null +++ b/queue-5.4/net-stmmac-dwmac-socfpga-set-rx-watchdog-interrupt-a.patch @@ -0,0 +1,50 @@ +From 710c548637dccb50b17b3c29ef1d853ff3c8c189 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Nov 2024 15:12:55 +0100 +Subject: net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken + +From: Maxime Chevallier + +[ Upstream commit 407618d66dba55e7db1278872e8be106808bbe91 ] + +On DWMAC3 and later, there's a RX Watchdog interrupt that's used for +interrupt coalescing. It's known to be buggy on some platforms, and +dwmac-socfpga appears to be one of them. Changing the interrupt +coalescing from ethtool doesn't appear to have any effect here. + +Without disabling RIWT (Received Interrupt Watchdog Timer, I +believe...), we observe latencies while receiving traffic that amount to +around ~0.4ms. This was discovered with NTP but can be easily reproduced +with a simple ping. Without this patch : + +64 bytes from 192.168.5.2: icmp_seq=1 ttl=64 time=0.657 ms + +With this patch : + +64 bytes from 192.168.5.2: icmp_seq=1 ttl=64 time=0.254 ms + +Fixes: 801d233b7302 ("net: stmmac: Add SOCFPGA glue driver") +Signed-off-by: Maxime Chevallier +Link: https://patch.msgid.link/20241122141256.764578-1-maxime.chevallier@bootlin.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +index 934c34e98d55f..0333c97c2b995 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +@@ -426,6 +426,8 @@ static int socfpga_dwmac_probe(struct platform_device *pdev) + plat_dat->bsp_priv = dwmac; + plat_dat->fix_mac_speed = socfpga_dwmac_fix_mac_speed; + ++ plat_dat->riwt_off = 1; ++ + ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); + if (ret) + goto err_remove_config_dt; +-- +2.43.0 + diff --git a/queue-5.4/net-usb-lan78xx-fix-memory-leak-on-device-unplug-by-.patch b/queue-5.4/net-usb-lan78xx-fix-memory-leak-on-device-unplug-by-.patch new file mode 100644 index 00000000000..ce55b491256 --- /dev/null +++ b/queue-5.4/net-usb-lan78xx-fix-memory-leak-on-device-unplug-by-.patch @@ -0,0 +1,51 @@ +From 2fb7134545e58bd27f76664898c78be7a99710b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Nov 2024 14:05:58 +0100 +Subject: net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY + device + +From: Oleksij Rempel + +[ Upstream commit ae7370e61c5d8f5bcefc2d4fca724bd4e9bbf789 ] + +Add calls to `phy_device_free` after `fixed_phy_unregister` to fix a +memory leak that occurs when the device is unplugged. This ensures +proper cleanup of pseudo fixed-link PHYs. + +Fixes: 89b36fb5e532 ("lan78xx: Lan7801 Support for Fixed PHY") +Cc: Raghuram Chary J +Signed-off-by: Oleksij Rempel +Link: https://patch.msgid.link/20241116130558.1352230-2-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index b0efaf56d78f3..0ca3ffeb4983c 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -2165,6 +2165,7 @@ static int lan78xx_phy_init(struct lan78xx_net *dev) + if (dev->chipid == ID_REV_CHIP_ID_7801_) { + if (phy_is_pseudo_fixed_link(phydev)) { + fixed_phy_unregister(phydev); ++ phy_device_free(phydev); + } else { + phy_unregister_fixup_for_uid(PHY_KSZ9031RNX, + 0xfffffff0); +@@ -3843,8 +3844,10 @@ static void lan78xx_disconnect(struct usb_interface *intf) + + phy_disconnect(net->phydev); + +- if (phy_is_pseudo_fixed_link(phydev)) ++ if (phy_is_pseudo_fixed_link(phydev)) { + fixed_phy_unregister(phydev); ++ phy_device_free(phydev); ++ } + + unregister_netdev(net); + +-- +2.43.0 + diff --git a/queue-5.4/net-usb-lan78xx-fix-refcounting-and-autosuspend-on-i.patch b/queue-5.4/net-usb-lan78xx-fix-refcounting-and-autosuspend-on-i.patch new file mode 100644 index 00000000000..69dcdf48103 --- /dev/null +++ b/queue-5.4/net-usb-lan78xx-fix-refcounting-and-autosuspend-on-i.patch @@ -0,0 +1,49 @@ +From 63346c592d4725c5813d6f80fae52be1f954331e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2024 15:03:51 +0100 +Subject: net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL + configuration + +From: Oleksij Rempel + +[ Upstream commit e863ff806f72098bccaf8fa89c80d9ad6187c3b0 ] + +Validate Wake-on-LAN (WoL) options in `lan78xx_set_wol` before calling +`usb_autopm_get_interface`. This prevents USB autopm refcounting issues +and ensures the adapter can properly enter autosuspend when invalid WoL +options are provided. + +Fixes: eb9ad088f966 ("lan78xx: Check for supported Wake-on-LAN modes") +Signed-off-by: Oleksij Rempel +Acked-by: Florian Fainelli +Link: https://patch.msgid.link/20241118140351.2398166-1-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 0ca3ffeb4983c..219a11e8f8d5d 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1428,13 +1428,13 @@ static int lan78xx_set_wol(struct net_device *netdev, + struct lan78xx_priv *pdata = (struct lan78xx_priv *)(dev->data[0]); + int ret; + ++ if (wol->wolopts & ~WAKE_ALL) ++ return -EINVAL; ++ + ret = usb_autopm_get_interface(dev->intf); + if (ret < 0) + return ret; + +- if (wol->wolopts & ~WAKE_ALL) +- return -EINVAL; +- + pdata->wol = wol->wolopts; + + device_set_wakeup_enable(&dev->udev->dev, (bool)wol->wolopts); +-- +2.43.0 + diff --git a/queue-5.4/netpoll-use-rcu_access_pointer-in-netpoll_poll_lock.patch b/queue-5.4/netpoll-use-rcu_access_pointer-in-netpoll_poll_lock.patch new file mode 100644 index 00000000000..3f40c5b099b --- /dev/null +++ b/queue-5.4/netpoll-use-rcu_access_pointer-in-netpoll_poll_lock.patch @@ -0,0 +1,45 @@ +From d22eeec3670ba5f7adf20479527eb87e1b10b9b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2024 03:15:18 -0800 +Subject: netpoll: Use rcu_access_pointer() in netpoll_poll_lock + +From: Breno Leitao + +[ Upstream commit a57d5a72f8dec7db8a79d0016fb0a3bdecc82b56 ] + +The ndev->npinfo pointer in netpoll_poll_lock() is RCU-protected but is +being accessed directly for a NULL check. While no RCU read lock is held +in this context, we should still use proper RCU primitives for +consistency and correctness. + +Replace the direct NULL check with rcu_access_pointer(), which is the +appropriate primitive when only checking for NULL without dereferencing +the pointer. This function provides the necessary ordering guarantees +without requiring RCU read-side protection. + +Fixes: bea3348eef27 ("[NET]: Make NAPI polling independent of struct net_device objects.") +Signed-off-by: Breno Leitao +Reviewed-by: Michal Kubiak +Link: https://patch.msgid.link/20241118-netpoll_rcu-v1-2-a1888dcb4a02@debian.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/netpoll.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h +index 676f1ff161a98..3ff0303672842 100644 +--- a/include/linux/netpoll.h ++++ b/include/linux/netpoll.h +@@ -78,7 +78,7 @@ static inline void *netpoll_poll_lock(struct napi_struct *napi) + { + struct net_device *dev = napi->dev; + +- if (dev && dev->npinfo) { ++ if (dev && rcu_access_pointer(dev->npinfo)) { + int owner = smp_processor_id(); + + while (cmpxchg(&napi->poll_owner, -1, owner) != -1) +-- +2.43.0 + diff --git a/queue-5.4/nfsd-cap-the-number-of-bytes-copied-by-nfs4_reset_re.patch b/queue-5.4/nfsd-cap-the-number-of-bytes-copied-by-nfs4_reset_re.patch new file mode 100644 index 00000000000..8fd02e0bf5f --- /dev/null +++ b/queue-5.4/nfsd-cap-the-number-of-bytes-copied-by-nfs4_reset_re.patch @@ -0,0 +1,37 @@ +From 4d56305757075193fb1c6e9c0da9be2e62641309 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 11:03:56 -0400 +Subject: NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() + +From: Chuck Lever + +[ Upstream commit f64ea4af43161bb86ffc77e6aeb5bcf5c3229df0 ] + +It's only current caller already length-checks the string, but let's +be safe. + +Fixes: 0964a3d3f1aa ("[PATCH] knfsd: nfsd4 reboot dirname fix") +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4recover.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c +index 1abddad2b7ae7..594db9085b24a 100644 +--- a/fs/nfsd/nfs4recover.c ++++ b/fs/nfsd/nfs4recover.c +@@ -666,7 +666,8 @@ nfs4_reset_recoverydir(char *recdir) + return status; + status = -ENOTDIR; + if (d_is_dir(path.dentry)) { +- strcpy(user_recovery_dirname, recdir); ++ strscpy(user_recovery_dirname, recdir, ++ sizeof(user_recovery_dirname)); + status = 0; + } + path_put(&path); +-- +2.43.0 + diff --git a/queue-5.4/nfsd-fix-nfsd4_shutdown_copy.patch b/queue-5.4/nfsd-fix-nfsd4_shutdown_copy.patch new file mode 100644 index 00000000000..9afc7240266 --- /dev/null +++ b/queue-5.4/nfsd-fix-nfsd4_shutdown_copy.patch @@ -0,0 +1,73 @@ +From 9bc13d0afc211ae0e6926f38a7235a5ad08adddb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2024 09:40:03 -0400 +Subject: NFSD: Fix nfsd4_shutdown_copy() + +From: Chuck Lever + +[ Upstream commit 62a8642ba00aa8ceb0a02ade942f5ec52e877c95 ] + +nfsd4_shutdown_copy() is just this: + + while ((copy = nfsd4_get_copy(clp)) != NULL) + nfsd4_stop_copy(copy); + +nfsd4_get_copy() bumps @copy's reference count, preventing +nfsd4_stop_copy() from releasing @copy. + +A while loop like this usually works by removing the first element +of the list, but neither nfsd4_get_copy() nor nfsd4_stop_copy() +alters the async_copies list. + +Best I can tell, then, is that nfsd4_shutdown_copy() continues to +loop until other threads manage to remove all the items from this +list. The spinning loop blocks shutdown until these items are gone. + +Possibly the reason we haven't seen this issue in the field is +because client_has_state() prevents __destroy_client() from calling +nfsd4_shutdown_copy() if there are any items on this list. In a +subsequent patch I plan to remove that restriction. + +Fixes: e0639dc5805a ("NFSD introduce async copy feature") +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4proc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 27e9754ad3b9d..3bae364048f6f 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1117,7 +1117,7 @@ static void nfsd4_stop_copy(struct nfsd4_copy *copy) + nfs4_put_copy(copy); + } + +-static struct nfsd4_copy *nfsd4_get_copy(struct nfs4_client *clp) ++static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp) + { + struct nfsd4_copy *copy = NULL; + +@@ -1126,6 +1126,9 @@ static struct nfsd4_copy *nfsd4_get_copy(struct nfs4_client *clp) + copy = list_first_entry(&clp->async_copies, struct nfsd4_copy, + copies); + refcount_inc(©->refcount); ++ copy->cp_clp = NULL; ++ if (!list_empty(©->copies)) ++ list_del_init(©->copies); + } + spin_unlock(&clp->async_lock); + return copy; +@@ -1135,7 +1138,7 @@ void nfsd4_shutdown_copy(struct nfs4_client *clp) + { + struct nfsd4_copy *copy; + +- while ((copy = nfsd4_get_copy(clp)) != NULL) ++ while ((copy = nfsd4_unhash_copy(clp)) != NULL) + nfsd4_stop_copy(copy); + } + +-- +2.43.0 + diff --git a/queue-5.4/nfsd-prevent-null-dereference-in-nfsd4_process_cb_up.patch b/queue-5.4/nfsd-prevent-null-dereference-in-nfsd4_process_cb_up.patch new file mode 100644 index 00000000000..437752844dd --- /dev/null +++ b/queue-5.4/nfsd-prevent-null-dereference-in-nfsd4_process_cb_up.patch @@ -0,0 +1,37 @@ +From e026ee5b5a2afb317d9de8fa5c409724c1139120 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 11:03:53 -0400 +Subject: NFSD: Prevent NULL dereference in nfsd4_process_cb_update() + +From: Chuck Lever + +[ Upstream commit 1e02c641c3a43c88cecc08402000418e15578d38 ] + +@ses is initialized to NULL. If __nfsd4_find_backchannel() finds no +available backchannel session, setup_callback_client() will try to +dereference @ses and segfault. + +Fixes: dcbeaa68dbbd ("nfsd4: allow backchannel recovery") +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4callback.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c +index 771733396eab2..51462f7958b3c 100644 +--- a/fs/nfsd/nfs4callback.c ++++ b/fs/nfsd/nfs4callback.c +@@ -1229,6 +1229,8 @@ static void nfsd4_process_cb_update(struct nfsd4_callback *cb) + ses = c->cn_session; + } + spin_unlock(&clp->cl_lock); ++ if (!c) ++ return; + + err = setup_callback_client(clp, &conn, ses); + if (err) { +-- +2.43.0 + diff --git a/queue-5.4/nvme-pci-fix-freeing-of-the-hmb-descriptor-table.patch b/queue-5.4/nvme-pci-fix-freeing-of-the-hmb-descriptor-table.patch new file mode 100644 index 00000000000..ff33e8c4886 --- /dev/null +++ b/queue-5.4/nvme-pci-fix-freeing-of-the-hmb-descriptor-table.patch @@ -0,0 +1,94 @@ +From 44260eccb7b1178c47556dc8291358a19e4c1fb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2024 05:40:04 +0100 +Subject: nvme-pci: fix freeing of the HMB descriptor table + +From: Christoph Hellwig + +[ Upstream commit 3c2fb1ca8086eb139b2a551358137525ae8e0d7a ] + +The HMB descriptor table is sized to the maximum number of descriptors +that could be used for a given device, but __nvme_alloc_host_mem could +break out of the loop earlier on memory allocation failure and end up +using less descriptors than planned for, which leads to an incorrect +size passed to dma_free_coherent. + +In practice this was not showing up because the number of descriptors +tends to be low and the dma coherent allocator always allocates and +frees at least a page. + +Fixes: 87ad72a59a38 ("nvme-pci: implement host memory buffer support") +Signed-off-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 20f5616fd5182..11df63d214900 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -125,6 +125,7 @@ struct nvme_dev { + /* host memory buffer support: */ + u64 host_mem_size; + u32 nr_host_mem_descs; ++ u32 host_mem_descs_size; + dma_addr_t host_mem_descs_dma; + struct nvme_host_mem_buf_desc *host_mem_descs; + void **host_mem_desc_bufs; +@@ -1924,10 +1925,10 @@ static void nvme_free_host_mem(struct nvme_dev *dev) + + kfree(dev->host_mem_desc_bufs); + dev->host_mem_desc_bufs = NULL; +- dma_free_coherent(dev->dev, +- dev->nr_host_mem_descs * sizeof(*dev->host_mem_descs), ++ dma_free_coherent(dev->dev, dev->host_mem_descs_size, + dev->host_mem_descs, dev->host_mem_descs_dma); + dev->host_mem_descs = NULL; ++ dev->host_mem_descs_size = 0; + dev->nr_host_mem_descs = 0; + } + +@@ -1935,7 +1936,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, + u32 chunk_size) + { + struct nvme_host_mem_buf_desc *descs; +- u32 max_entries, len; ++ u32 max_entries, len, descs_size; + dma_addr_t descs_dma; + int i = 0; + void **bufs; +@@ -1948,8 +1949,9 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, + if (dev->ctrl.hmmaxd && dev->ctrl.hmmaxd < max_entries) + max_entries = dev->ctrl.hmmaxd; + +- descs = dma_alloc_coherent(dev->dev, max_entries * sizeof(*descs), +- &descs_dma, GFP_KERNEL); ++ descs_size = max_entries * sizeof(*descs); ++ descs = dma_alloc_coherent(dev->dev, descs_size, &descs_dma, ++ GFP_KERNEL); + if (!descs) + goto out; + +@@ -1978,6 +1980,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, + dev->host_mem_size = size; + dev->host_mem_descs = descs; + dev->host_mem_descs_dma = descs_dma; ++ dev->host_mem_descs_size = descs_size; + dev->host_mem_desc_bufs = bufs; + return 0; + +@@ -1992,8 +1995,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, + + kfree(bufs); + out_free_descs: +- dma_free_coherent(dev->dev, max_entries * sizeof(*descs), descs, +- descs_dma); ++ dma_free_coherent(dev->dev, descs_size, descs, descs_dma); + out: + dev->host_mem_descs = NULL; + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-5.4/ocfs2-fix-uninitialized-value-in-ocfs2_file_read_ite.patch b/queue-5.4/ocfs2-fix-uninitialized-value-in-ocfs2_file_read_ite.patch new file mode 100644 index 00000000000..05f122e910e --- /dev/null +++ b/queue-5.4/ocfs2-fix-uninitialized-value-in-ocfs2_file_read_ite.patch @@ -0,0 +1,98 @@ +From 8f8383d66ea58b340b7b02582e0e2d9823f889fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2024 12:17:36 +0300 +Subject: ocfs2: fix uninitialized value in ocfs2_file_read_iter() + +From: Dmitry Antipov + +[ Upstream commit adc77b19f62d7e80f98400b2fca9d700d2afdd6f ] + +Syzbot has reported the following KMSAN splat: + +BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80 + ocfs2_file_read_iter+0x9a4/0xf80 + __io_read+0x8d4/0x20f0 + io_read+0x3e/0xf0 + io_issue_sqe+0x42b/0x22c0 + io_wq_submit_work+0xaf9/0xdc0 + io_worker_handle_work+0xd13/0x2110 + io_wq_worker+0x447/0x1410 + ret_from_fork+0x6f/0x90 + ret_from_fork_asm+0x1a/0x30 + +Uninit was created at: + __alloc_pages_noprof+0x9a7/0xe00 + alloc_pages_mpol_noprof+0x299/0x990 + alloc_pages_noprof+0x1bf/0x1e0 + allocate_slab+0x33a/0x1250 + ___slab_alloc+0x12ef/0x35e0 + kmem_cache_alloc_bulk_noprof+0x486/0x1330 + __io_alloc_req_refill+0x84/0x560 + io_submit_sqes+0x172f/0x2f30 + __se_sys_io_uring_enter+0x406/0x41c0 + __x64_sys_io_uring_enter+0x11f/0x1a0 + x64_sys_call+0x2b54/0x3ba0 + do_syscall_64+0xcd/0x1e0 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Since an instance of 'struct kiocb' may be passed from the block layer +with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()' +and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in +'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'. + +Link: https://lkml.kernel.org/r/20241029091736.1501946-1-dmantipov@yandex.ru +Fixes: 7cdfc3a1c397 ("ocfs2: Remember rw lock level during direct io") +Signed-off-by: Dmitry Antipov +Reported-by: syzbot+a73e253cca4f0230a5a5@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=a73e253cca4f0230a5a5 +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Joseph Qi +Cc: Changwei Ge +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/aops.h | 2 ++ + fs/ocfs2/file.c | 4 ++++ + 2 files changed, 6 insertions(+) + +diff --git a/fs/ocfs2/aops.h b/fs/ocfs2/aops.h +index 70ed4382750d5..5b129ae9c3d22 100644 +--- a/fs/ocfs2/aops.h ++++ b/fs/ocfs2/aops.h +@@ -72,6 +72,8 @@ enum ocfs2_iocb_lock_bits { + OCFS2_IOCB_NUM_LOCKS + }; + ++#define ocfs2_iocb_init_rw_locked(iocb) \ ++ (iocb->private = NULL) + #define ocfs2_iocb_clear_rw_locked(iocb) \ + clear_bit(OCFS2_IOCB_RW_LOCK, (unsigned long *)&iocb->private) + #define ocfs2_iocb_rw_locked_level(iocb) \ +diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c +index 3bbeea2e60f70..54b843f5b73f5 100644 +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -2401,6 +2401,8 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb, + } else + inode_lock(inode); + ++ ocfs2_iocb_init_rw_locked(iocb); ++ + /* + * Concurrent O_DIRECT writes are allowed with + * mount_option "coherency=buffered". +@@ -2547,6 +2549,8 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb, + if (!direct_io && nowait) + return -EOPNOTSUPP; + ++ ocfs2_iocb_init_rw_locked(iocb); ++ + /* + * buffered reads protect themselves in ->readpage(). O_DIRECT reads + * need locks to protect pending reads from racing with truncate. +-- +2.43.0 + diff --git a/queue-5.4/pci-cpqphp-fix-pcibios_-return-value-confusion.patch b/queue-5.4/pci-cpqphp-fix-pcibios_-return-value-confusion.patch new file mode 100644 index 00000000000..173d504f205 --- /dev/null +++ b/queue-5.4/pci-cpqphp-fix-pcibios_-return-value-confusion.patch @@ -0,0 +1,85 @@ +From e73b847f6edcaba0ffd7f008a7f99eb69ca0741e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2024 12:11:37 +0300 +Subject: PCI: cpqphp: Fix PCIBIOS_* return value confusion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit e2226dbc4a4919d9c8bd9293299b532090bdf020 ] + +Code in and related to PCI_RefinedAccessConfig() has three types of return +type confusion: + + - PCI_RefinedAccessConfig() tests pci_bus_read_config_dword() return value + against -1. + + - PCI_RefinedAccessConfig() returns both -1 and PCIBIOS_* return codes. + + - Callers of PCI_RefinedAccessConfig() only test for -1. + +Make PCI_RefinedAccessConfig() return PCIBIOS_* codes consistently and +adapt callers accordingly. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Link: https://lore.kernel.org/r/20241022091140.3504-2-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/hotplug/cpqphp_pci.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/hotplug/cpqphp_pci.c b/drivers/pci/hotplug/cpqphp_pci.c +index a20875da4ec70..ce6eb71a63599 100644 +--- a/drivers/pci/hotplug/cpqphp_pci.c ++++ b/drivers/pci/hotplug/cpqphp_pci.c +@@ -135,11 +135,13 @@ int cpqhp_unconfigure_device(struct pci_func *func) + static int PCI_RefinedAccessConfig(struct pci_bus *bus, unsigned int devfn, u8 offset, u32 *value) + { + u32 vendID = 0; ++ int ret; + +- if (pci_bus_read_config_dword(bus, devfn, PCI_VENDOR_ID, &vendID) == -1) +- return -1; ++ ret = pci_bus_read_config_dword(bus, devfn, PCI_VENDOR_ID, &vendID); ++ if (ret != PCIBIOS_SUCCESSFUL) ++ return PCIBIOS_DEVICE_NOT_FOUND; + if (PCI_POSSIBLE_ERROR(vendID)) +- return -1; ++ return PCIBIOS_DEVICE_NOT_FOUND; + return pci_bus_read_config_dword(bus, devfn, offset, value); + } + +@@ -200,13 +202,15 @@ static int PCI_ScanBusForNonBridge(struct controller *ctrl, u8 bus_num, u8 *dev_ + { + u16 tdevice; + u32 work; ++ int ret; + u8 tbus; + + ctrl->pci_bus->number = bus_num; + + for (tdevice = 0; tdevice < 0xFF; tdevice++) { + /* Scan for access first */ +- if (PCI_RefinedAccessConfig(ctrl->pci_bus, tdevice, 0x08, &work) == -1) ++ ret = PCI_RefinedAccessConfig(ctrl->pci_bus, tdevice, 0x08, &work); ++ if (ret) + continue; + dbg("Looking for nonbridge bus_num %d dev_num %d\n", bus_num, tdevice); + /* Yep we got one. Not a bridge ? */ +@@ -218,7 +222,8 @@ static int PCI_ScanBusForNonBridge(struct controller *ctrl, u8 bus_num, u8 *dev_ + } + for (tdevice = 0; tdevice < 0xFF; tdevice++) { + /* Scan for access first */ +- if (PCI_RefinedAccessConfig(ctrl->pci_bus, tdevice, 0x08, &work) == -1) ++ ret = PCI_RefinedAccessConfig(ctrl->pci_bus, tdevice, 0x08, &work); ++ if (ret) + continue; + dbg("Looking for bridge bus_num %d dev_num %d\n", bus_num, tdevice); + /* Yep we got one. bridge ? */ +-- +2.43.0 + diff --git a/queue-5.4/pci-cpqphp-use-pci_possible_error-to-check-config-re.patch b/queue-5.4/pci-cpqphp-use-pci_possible_error-to-check-config-re.patch new file mode 100644 index 00000000000..fc75ce65a42 --- /dev/null +++ b/queue-5.4/pci-cpqphp-use-pci_possible_error-to-check-config-re.patch @@ -0,0 +1,54 @@ +From a9556a01d4bbee44f3f3c8d98ca73e9b91d1d297 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2024 14:50:50 +0800 +Subject: PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads + +From: weiyufeng + +[ Upstream commit a18a025c2fb5fbf2d1d0606ea0d7441ac90e9c39 ] + +When config pci_ops.read() can detect failed PCI transactions, the data +returned to the CPU is PCI_ERROR_RESPONSE (~0 or 0xffffffff). + +Obviously a successful PCI config read may *also* return that data if a +config register happens to contain ~0, so it doesn't definitively indicate +an error unless we know the register cannot contain ~0. + +Use PCI_POSSIBLE_ERROR() to check the response we get when we read data +from hardware. This unifies PCI error response checking and makes error +checks consistent and easier to find. + +Link: https://lore.kernel.org/r/b12005c0d57bb9d4c8b486724d078b7bd92f8321.1637243717.git.naveennaidu479@gmail.com +Signed-off-by: Naveen Naidu +Signed-off-by: Bjorn Helgaas +Stable-dep-of: e2226dbc4a49 ("PCI: cpqphp: Fix PCIBIOS_* return value confusion") +Signed-off-by: Sasha Levin +--- + drivers/pci/hotplug/cpqphp_pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/hotplug/cpqphp_pci.c b/drivers/pci/hotplug/cpqphp_pci.c +index 1b2b3f3b648bc..a20875da4ec70 100644 +--- a/drivers/pci/hotplug/cpqphp_pci.c ++++ b/drivers/pci/hotplug/cpqphp_pci.c +@@ -138,7 +138,7 @@ static int PCI_RefinedAccessConfig(struct pci_bus *bus, unsigned int devfn, u8 o + + if (pci_bus_read_config_dword(bus, devfn, PCI_VENDOR_ID, &vendID) == -1) + return -1; +- if (vendID == 0xffffffff) ++ if (PCI_POSSIBLE_ERROR(vendID)) + return -1; + return pci_bus_read_config_dword(bus, devfn, offset, value); + } +@@ -251,7 +251,7 @@ static int PCI_GetBusDevHelper(struct controller *ctrl, u8 *bus_num, u8 *dev_num + *dev_num = tdevice; + ctrl->pci_bus->number = tbus; + pci_bus_read_config_dword(ctrl->pci_bus, *dev_num, PCI_VENDOR_ID, &work); +- if (!nobridge || (work == 0xffffffff)) ++ if (!nobridge || PCI_POSSIBLE_ERROR(work)) + return 0; + + dbg("bus_num %d devfn %d\n", *bus_num, *dev_num); +-- +2.43.0 + diff --git a/queue-5.4/perf-cs-etm-don-t-flush-when-packet_queue-fills-up.patch b/queue-5.4/perf-cs-etm-don-t-flush-when-packet_queue-fills-up.patch new file mode 100644 index 00000000000..d3f62a7d32e --- /dev/null +++ b/queue-5.4/perf-cs-etm-don-t-flush-when-packet_queue-fills-up.patch @@ -0,0 +1,121 @@ +From dcf1e11467a20b8ae15a27e2080559dc223a78bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2024 14:57:32 +0100 +Subject: perf cs-etm: Don't flush when packet_queue fills up + +From: James Clark + +[ Upstream commit 5afd032961e8465808c4bc385c06e7676fbe1951 ] + +cs_etm__flush(), like cs_etm__sample() is an operation that generates a +sample and then swaps the current with the previous packet. Calling +flush after processing the queues results in two swaps which corrupts +the next sample. Therefore it wasn't appropriate to call flush here so +remove it. + +Flushing is still done on a discontinuity to explicitly clear the last +branch buffer, but when the packet_queue fills up before reaching a +timestamp, that's not a discontinuity and the call to +cs_etm__process_traceid_queue() already generated samples and drained +the buffers correctly. + +This is visible by looking for a branch that has the same target as the +previous branch and the following source is before the address of the +last target, which is impossible as execution would have had to have +gone backwards: + + ffff800080849d40 _find_next_and_bit+0x78 => ffff80008011cadc update_sg_lb_stats+0x94 + (packet_queue fills here before a timestamp, resulting in a flush and + branch target ffff80008011cadc is duplicated.) + ffff80008011cb1c update_sg_lb_stats+0xd4 => ffff80008011cadc update_sg_lb_stats+0x94 + ffff8000801117c4 cpu_util+0x24 => ffff8000801117d4 cpu_util+0x34 + +After removing the flush the correct branch target is used for the +second sample, and ffff8000801117c4 is no longer before the previous +address: + + ffff800080849d40 _find_next_and_bit+0x78 => ffff80008011cadc update_sg_lb_stats+0x94 + ffff80008011cb1c update_sg_lb_stats+0xd4 => ffff8000801117a0 cpu_util+0x0 + ffff8000801117c4 cpu_util+0x24 => ffff8000801117d4 cpu_util+0x34 + +Make sure that a final branch stack is output at the end of the trace +by calling cs_etm__end_block(). This is already done for both the +timeless decode paths. + +Fixes: 21fe8dc1191a ("perf cs-etm: Add support for CPU-wide trace scenarios") +Reported-by: Ganapatrao Kulkarni +Closes: https://lore.kernel.org/all/20240719092619.274730-1-gankulkarni@os.amperecomputing.com/ +Reviewed-by: Leo Yan +Signed-off-by: James Clark +Tested-by: Ganapatrao Kulkarni +Cc: Ben Gainey +Cc: Suzuki K Poulose +Cc: Will Deacon +Cc: Mathieu Poirier +Cc: Mike Leach +Cc: Ruidong Tian +Cc: Benjamin Gray +Cc: linux-arm-kernel@lists.infradead.org +Cc: coresight@lists.linaro.org +Cc: John Garry +Cc: scclevenger@os.amperecomputing.com +Link: https://lore.kernel.org/r/20240916135743.1490403-2-james.clark@linaro.org +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/cs-etm.c | 25 ++++++++++++++++++------- + 1 file changed, 18 insertions(+), 7 deletions(-) + +diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c +index f5a9cb4088080..bd63bd14417fd 100644 +--- a/tools/perf/util/cs-etm.c ++++ b/tools/perf/util/cs-etm.c +@@ -2066,12 +2066,6 @@ static void cs_etm__clear_all_traceid_queues(struct cs_etm_queue *etmq) + + /* Ignore return value */ + cs_etm__process_traceid_queue(etmq, tidq); +- +- /* +- * Generate an instruction sample with the remaining +- * branchstack entries. +- */ +- cs_etm__flush(etmq, tidq); + } + } + +@@ -2154,7 +2148,7 @@ static int cs_etm__process_queues(struct cs_etm_auxtrace *etm) + + while (1) { + if (!etm->heap.heap_cnt) +- goto out; ++ break; + + /* Take the entry at the top of the min heap */ + cs_queue_nr = etm->heap.heap_array[0].queue_nr; +@@ -2237,6 +2231,23 @@ static int cs_etm__process_queues(struct cs_etm_auxtrace *etm) + ret = auxtrace_heap__add(&etm->heap, cs_queue_nr, timestamp); + } + ++ for (i = 0; i < etm->queues.nr_queues; i++) { ++ struct int_node *inode; ++ ++ etmq = etm->queues.queue_array[i].priv; ++ if (!etmq) ++ continue; ++ ++ intlist__for_each_entry(inode, etmq->traceid_queues_list) { ++ int idx = (int)(intptr_t)inode->priv; ++ ++ /* Flush any remaining branch stack entries */ ++ tidq = etmq->traceid_queues[idx]; ++ ret = cs_etm__end_block(etmq, tidq); ++ if (ret) ++ return ret; ++ } ++ } + out: + return ret; + } +-- +2.43.0 + diff --git a/queue-5.4/perf-probe-correct-demangled-symbols-in-c-program.patch b/queue-5.4/perf-probe-correct-demangled-symbols-in-c-program.patch new file mode 100644 index 00000000000..d74fd481409 --- /dev/null +++ b/queue-5.4/perf-probe-correct-demangled-symbols-in-c-program.patch @@ -0,0 +1,141 @@ +From fbd211b24e7af46dcf843ee91f41ebdda5e0c604 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Oct 2024 15:14:32 +0100 +Subject: perf probe: Correct demangled symbols in C++ program + +From: Leo Yan + +[ Upstream commit 314909f13cc12d47c468602c37dace512d225eeb ] + +An issue can be observed when probe C++ demangled symbol with steps: + + # nm test_cpp_mangle | grep print_data + 0000000000000c94 t _GLOBAL__sub_I__Z10print_datai + 0000000000000afc T _Z10print_datai + 0000000000000b38 T _Z10print_dataR5Point + + # perf probe -x /home/niayan01/test_cpp_mangle -F --demangle + ... + print_data(Point&) + print_data(int) + ... + + # perf --debug verbose=3 probe -x test_cpp_mangle --add "test=print_data(int)" + probe-definition(0): test=print_data(int) + symbol:print_data(int) file:(null) line:0 offset:0 return:0 lazy:(null) + 0 arguments + Open Debuginfo file: /home/niayan01/test_cpp_mangle + Try to find probe point from debuginfo. + Symbol print_data(int) address found : afc + Matched function: print_data [2ccf] + Probe point found: print_data+0 + Found 1 probe_trace_events. + Opening /sys/kernel/tracing//uprobe_events write=1 + Opening /sys/kernel/tracing//README write=0 + Writing event: p:probe_test_cpp_mangle/test /home/niayan01/test_cpp_mangle:0xb38 + ... + +When tried to probe symbol "print_data(int)", the log shows: + + Symbol print_data(int) address found : afc + +The found address is 0xafc - which is right with verifying the output +result from nm. Afterwards when write event, the command uses offset +0xb38 in the last log, which is a wrong address. + +The dwarf_diename() gets a common function name, in above case, it +returns string "print_data". As a result, the tool parses the offset +based on the common name. This leads to probe at the wrong symbol +"print_data(Point&)". + +To fix the issue, use the die_get_linkage_name() function to retrieve +the distinct linkage name - this is the mangled name for the C++ case. +Based on this unique name, the tool can get a correct offset for +probing. Based on DWARF doc, it is possible the linkage name is missed +in the DIE, it rolls back to use dwarf_diename(). + +After: + + # perf --debug verbose=3 probe -x test_cpp_mangle --add "test=print_data(int)" + probe-definition(0): test=print_data(int) + symbol:print_data(int) file:(null) line:0 offset:0 return:0 lazy:(null) + 0 arguments + Open Debuginfo file: /home/niayan01/test_cpp_mangle + Try to find probe point from debuginfo. + Symbol print_data(int) address found : afc + Matched function: print_data [2d06] + Probe point found: print_data+0 + Found 1 probe_trace_events. + Opening /sys/kernel/tracing//uprobe_events write=1 + Opening /sys/kernel/tracing//README write=0 + Writing event: p:probe_test_cpp_mangle/test /home/niayan01/test_cpp_mangle:0xafc + Added new event: + probe_test_cpp_mangle:test (on print_data(int) in /home/niayan01/test_cpp_mangle) + + You can now use it in all perf tools, such as: + + perf record -e probe_test_cpp_mangle:test -aR sleep 1 + + # perf --debug verbose=3 probe -x test_cpp_mangle --add "test2=print_data(Point&)" + probe-definition(0): test2=print_data(Point&) + symbol:print_data(Point&) file:(null) line:0 offset:0 return:0 lazy:(null) + 0 arguments + Open Debuginfo file: /home/niayan01/test_cpp_mangle + Try to find probe point from debuginfo. + Symbol print_data(Point&) address found : b38 + Matched function: print_data [2ccf] + Probe point found: print_data+0 + Found 1 probe_trace_events. + Opening /sys/kernel/tracing//uprobe_events write=1 + Parsing probe_events: p:probe_test_cpp_mangle/test /home/niayan01/test_cpp_mangle:0x0000000000000afc + Group:probe_test_cpp_mangle Event:test probe:p + Opening /sys/kernel/tracing//README write=0 + Writing event: p:probe_test_cpp_mangle/test2 /home/niayan01/test_cpp_mangle:0xb38 + Added new event: + probe_test_cpp_mangle:test2 (on print_data(Point&) in /home/niayan01/test_cpp_mangle) + + You can now use it in all perf tools, such as: + + perf record -e probe_test_cpp_mangle:test2 -aR sleep 1 + +Fixes: fb1587d869a3 ("perf probe: List probes with line number and file name") +Signed-off-by: Leo Yan +Acked-by: Masami Hiramatsu (Google) +Link: https://lore.kernel.org/r/20241012141432.877894-1-leo.yan@arm.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/probe-finder.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index 849d8d2e5976b..261ad8d123af7 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -1604,8 +1604,21 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, + + /* Find a corresponding function (name, baseline and baseaddr) */ + if (die_find_realfunc(&cudie, (Dwarf_Addr)addr, &spdie)) { +- /* Get function entry information */ +- func = basefunc = dwarf_diename(&spdie); ++ /* ++ * Get function entry information. ++ * ++ * As described in the document DWARF Debugging Information ++ * Format Version 5, section 2.22 Linkage Names, "mangled names, ++ * are used in various ways, ... to distinguish multiple ++ * entities that have the same name". ++ * ++ * Firstly try to get distinct linkage name, if fail then ++ * rollback to get associated name in DIE. ++ */ ++ func = basefunc = die_get_linkage_name(&spdie); ++ if (!func) ++ func = basefunc = dwarf_diename(&spdie); ++ + if (!func || + die_entrypc(&spdie, &baseaddr) != 0 || + dwarf_decl_line(&spdie, &baseline) != 0) { +-- +2.43.0 + diff --git a/queue-5.4/perf-trace-avoid-garbage-when-not-printing-a-syscall.patch b/queue-5.4/perf-trace-avoid-garbage-when-not-printing-a-syscall.patch new file mode 100644 index 00000000000..cc68c7e39e2 --- /dev/null +++ b/queue-5.4/perf-trace-avoid-garbage-when-not-printing-a-syscall.patch @@ -0,0 +1,63 @@ +From 8b8fa60575b722539e366adb54a70e9ec2b2c22d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 23:21:27 +0000 +Subject: perf trace: Avoid garbage when not printing a syscall's arguments + +From: Benjamin Peterson + +[ Upstream commit 1302e352b26f34991b619b5d0b621b76d20a3883 ] + +syscall__scnprintf_args may not place anything in the output buffer +(e.g., because the arguments are all zero). If that happened in +trace__fprintf_sys_enter, its fprintf would receive an unitialized +buffer leading to garbage output. + +Fix the problem by passing the (possibly zero) bounds of the argument +buffer to the output fprintf. + +Fixes: a98392bb1e169a04 ("perf trace: Use beautifiers on syscalls:sys_enter_ handlers") +Signed-off-by: Benjamin Peterson +Tested-by: Arnaldo Carvalho de Melo +Tested-by: Howard Chu +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20241107232128.108981-2-benjamin@engflow.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-trace.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c +index 745ea920eca98..c8c01e706118e 100644 +--- a/tools/perf/builtin-trace.c ++++ b/tools/perf/builtin-trace.c +@@ -2079,6 +2079,7 @@ static int trace__fprintf_sys_enter(struct trace *trace, struct evsel *evsel, + char msg[1024]; + void *args, *augmented_args = NULL; + int augmented_args_size; ++ size_t printed = 0; + + if (sc == NULL) + return -1; +@@ -2094,8 +2095,8 @@ static int trace__fprintf_sys_enter(struct trace *trace, struct evsel *evsel, + + args = perf_evsel__sc_tp_ptr(evsel, args, sample); + augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size); +- syscall__scnprintf_args(sc, msg, sizeof(msg), args, augmented_args, augmented_args_size, trace, thread); +- fprintf(trace->output, "%s", msg); ++ printed += syscall__scnprintf_args(sc, msg, sizeof(msg), args, augmented_args, augmented_args_size, trace, thread); ++ fprintf(trace->output, "%.*s", (int)printed, msg); + err = 0; + out_put: + thread__put(thread); +-- +2.43.0 + diff --git a/queue-5.4/perf-trace-do-not-lose-last-events-in-a-race.patch b/queue-5.4/perf-trace-do-not-lose-last-events-in-a-race.patch new file mode 100644 index 00000000000..c0dc67c5efe --- /dev/null +++ b/queue-5.4/perf-trace-do-not-lose-last-events-in-a-race.patch @@ -0,0 +1,74 @@ +From 816f27aca02f8a22d422e34b45c5a2dcdf446ab6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 23:21:26 +0000 +Subject: perf trace: Do not lose last events in a race + +From: Benjamin Peterson + +[ Upstream commit 3fd7c36973a250e17a4ee305a31545a9426021f4 ] + +If a perf trace event selector specifies a maximum number of events to output +(i.e., "/nr=N/" syntax), the event printing handler, trace__event_handler, +disables the event selector after the maximum number events are +printed. + +Furthermore, trace__event_handler checked if the event selector was +disabled before doing any work. This avoided exceeding the maximum +number of events to print if more events were in the buffer before the +selector was disabled. + +However, the event selector can be disabled for reasons other than +exceeding the maximum number of events. In particular, when the traced +subprocess exits, the main loop disables all event selectors. This meant +the last events of a traced subprocess might be lost to the printing +handler's short-circuiting logic. + +This nondeterministic problem could be seen by running the following many times: + + $ perf trace -e syscalls:sys_enter_exit_group true + +trace__event_handler should simply check for exceeding the maximum number of +events to print rather than the state of the event selector. + +Fixes: a9c5e6c1e9bff42c ("perf trace: Introduce per-event maximum number of events property") +Signed-off-by: Benjamin Peterson +Tested-by: Howard Chu +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20241107232128.108981-1-benjamin@engflow.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-trace.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c +index 6052eb057821d..745ea920eca98 100644 +--- a/tools/perf/builtin-trace.c ++++ b/tools/perf/builtin-trace.c +@@ -2401,13 +2401,8 @@ static int trace__event_handler(struct trace *trace, struct evsel *evsel, + { + struct thread *thread; + int callchain_ret = 0; +- /* +- * Check if we called perf_evsel__disable(evsel) due to, for instance, +- * this event's max_events having been hit and this is an entry coming +- * from the ring buffer that we should discard, since the max events +- * have already been considered/printed. +- */ +- if (evsel->disabled) ++ ++ if (evsel->nr_events_printed >= evsel->max_events) + return 0; + + thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); +-- +2.43.0 + diff --git a/queue-5.4/power-supply-core-remove-might_sleep-from-power_supp.patch b/queue-5.4/power-supply-core-remove-might_sleep-from-power_supp.patch new file mode 100644 index 00000000000..8e2ae5fc960 --- /dev/null +++ b/queue-5.4/power-supply-core-remove-might_sleep-from-power_supp.patch @@ -0,0 +1,44 @@ +From 36441d82a3e7cddc498603e752cf3b99aa96c871 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Sep 2024 12:39:14 -0700 +Subject: power: supply: core: Remove might_sleep() from power_supply_put() + +From: Bart Van Assche + +[ Upstream commit f6da4553ff24a5d1c959c9627c965323adc3d307 ] + +The put_device() call in power_supply_put() may call +power_supply_dev_release(). The latter function does not sleep so +power_supply_put() doesn't sleep either. Hence, remove the might_sleep() +call from power_supply_put(). This patch suppresses false positive +complaints about calling a sleeping function from atomic context if +power_supply_put() is called from atomic context. + +Cc: Kyle Tso +Cc: Krzysztof Kozlowski +Fixes: 1a352462b537 ("power_supply: Add power_supply_put for decrementing device reference counter") +Signed-off-by: Bart Van Assche +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20240917193914.47566-1-bvanassche@acm.org +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/power_supply_core.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c +index 2d6836b33da33..606e21fe599d2 100644 +--- a/drivers/power/supply/power_supply_core.c ++++ b/drivers/power/supply/power_supply_core.c +@@ -479,8 +479,6 @@ EXPORT_SYMBOL_GPL(power_supply_get_by_name); + */ + void power_supply_put(struct power_supply *psy) + { +- might_sleep(); +- + atomic_dec(&psy->use_cnt); + put_device(&psy->dev); + } +-- +2.43.0 + diff --git a/queue-5.4/powerpc-sstep-make-emulate_vsx_load-and-emulate_vsx_.patch b/queue-5.4/powerpc-sstep-make-emulate_vsx_load-and-emulate_vsx_.patch new file mode 100644 index 00000000000..3e31c983dc4 --- /dev/null +++ b/queue-5.4/powerpc-sstep-make-emulate_vsx_load-and-emulate_vsx_.patch @@ -0,0 +1,76 @@ +From 6a0ce10fbc65bd9b5173fc55a6e6529485058690 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 15:03:49 +0200 +Subject: powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static + +From: Michal Suchanek + +[ Upstream commit a26c4dbb3d9c1821cb0fc11cb2dbc32d5bf3463b ] + +These functions are not used outside of sstep.c + +Fixes: 350779a29f11 ("powerpc: Handle most loads and stores in instruction emulation code") +Signed-off-by: Michal Suchanek +Signed-off-by: Michael Ellerman +Link: https://patch.msgid.link/20241001130356.14664-1-msuchanek@suse.de +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/sstep.h | 5 ----- + arch/powerpc/lib/sstep.c | 12 ++++-------- + 2 files changed, 4 insertions(+), 13 deletions(-) + +diff --git a/arch/powerpc/include/asm/sstep.h b/arch/powerpc/include/asm/sstep.h +index 769f055509c9a..eef81dd406075 100644 +--- a/arch/powerpc/include/asm/sstep.h ++++ b/arch/powerpc/include/asm/sstep.h +@@ -160,9 +160,4 @@ extern int emulate_step(struct pt_regs *regs, unsigned int instr); + */ + extern int emulate_loadstore(struct pt_regs *regs, struct instruction_op *op); + +-extern void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg, +- const void *mem, bool cross_endian); +-extern void emulate_vsx_store(struct instruction_op *op, +- const union vsx_reg *reg, void *mem, +- bool cross_endian); + extern int emulate_dcbz(unsigned long ea, struct pt_regs *regs); +diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c +index 490162fb0893f..368a36079cb6c 100644 +--- a/arch/powerpc/lib/sstep.c ++++ b/arch/powerpc/lib/sstep.c +@@ -663,8 +663,8 @@ static nokprobe_inline int emulate_stq(struct pt_regs *regs, unsigned long ea, + #endif /* __powerpc64 */ + + #ifdef CONFIG_VSX +-void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg, +- const void *mem, bool rev) ++static nokprobe_inline void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg, ++ const void *mem, bool rev) + { + int size, read_size; + int i, j; +@@ -744,11 +744,9 @@ void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg, + break; + } + } +-EXPORT_SYMBOL_GPL(emulate_vsx_load); +-NOKPROBE_SYMBOL(emulate_vsx_load); + +-void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg, +- void *mem, bool rev) ++static nokprobe_inline void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg, ++ void *mem, bool rev) + { + int size, write_size; + int i, j; +@@ -820,8 +818,6 @@ void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg, + break; + } + } +-EXPORT_SYMBOL_GPL(emulate_vsx_store); +-NOKPROBE_SYMBOL(emulate_vsx_store); + + static nokprobe_inline int do_vsx_load(struct instruction_op *op, + unsigned long ea, struct pt_regs *regs, +-- +2.43.0 + diff --git a/queue-5.4/powerpc-vdso-flag-vdso64-entry-points-as-functions.patch b/queue-5.4/powerpc-vdso-flag-vdso64-entry-points-as-functions.patch new file mode 100644 index 00000000000..b623ca9f02f --- /dev/null +++ b/queue-5.4/powerpc-vdso-flag-vdso64-entry-points-as-functions.patch @@ -0,0 +1,112 @@ +From 1d623373bcda2e277e8100b4e68558dfd240f088 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2024 00:17:57 +0200 +Subject: powerpc/vdso: Flag VDSO64 entry points as functions + +From: Christophe Leroy + +[ Upstream commit 0161bd38c24312853ed5ae9a425a1c41c4ac674a ] + +On powerpc64 as shown below by readelf, vDSO functions symbols have +type NOTYPE. + +$ powerpc64-linux-gnu-readelf -a arch/powerpc/kernel/vdso/vdso64.so.dbg +ELF Header: + Magic: 7f 45 4c 46 02 02 01 00 00 00 00 00 00 00 00 00 + Class: ELF64 + Data: 2's complement, big endian + Version: 1 (current) + OS/ABI: UNIX - System V + ABI Version: 0 + Type: DYN (Shared object file) + Machine: PowerPC64 + Version: 0x1 +... + +Symbol table '.dynsym' contains 12 entries: + Num: Value Size Type Bind Vis Ndx Name +... + 1: 0000000000000524 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15 +... + 4: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LINUX_2.6.15 + 5: 00000000000006c0 48 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15 + +Symbol table '.symtab' contains 56 entries: + Num: Value Size Type Bind Vis Ndx Name +... + 45: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LINUX_2.6.15 + 46: 00000000000006c0 48 NOTYPE GLOBAL DEFAULT 8 __kernel_getcpu + 47: 0000000000000524 84 NOTYPE GLOBAL DEFAULT 8 __kernel_clock_getres + +To overcome that, commit ba83b3239e65 ("selftests: vDSO: fix vDSO +symbols lookup for powerpc64") was applied to have selftests also +look for NOTYPE symbols, but the correct fix should be to flag VDSO +entry points as functions. + +The original commit that brought VDSO support into powerpc/64 has the +following explanation: + + Note that the symbols exposed by the vDSO aren't "normal" function symbols, apps + can't be expected to link against them directly, the vDSO's are both seen + as if they were linked at 0 and the symbols just contain offsets to the + various functions. This is done on purpose to avoid a relocation step + (ppc64 functions normally have descriptors with abs addresses in them). + When glibc uses those functions, it's expected to use it's own trampolines + that know how to reach them. + +The descriptors it's talking about are the OPD function descriptors +used on ABI v1 (big endian). But it would be more correct for a text +symbol to have type function, even if there's no function descriptor +for it. + +glibc has a special case already for handling the VDSO symbols which +creates a fake opd pointing at the kernel symbol. So changing the VDSO +symbol type to function shouldn't affect that. + +For ABI v2, there is no function descriptors and VDSO functions can +safely have function type. + +So lets flag VDSO entry points as functions and revert the +selftest change. + +Link: https://github.com/mpe/linux-fullhistory/commit/5f2dd691b62da9d9cc54b938f8b29c22c93cb805 +Fixes: ba83b3239e65 ("selftests: vDSO: fix vDSO symbols lookup for powerpc64") +Signed-off-by: Christophe Leroy +Reviewed-By: Segher Boessenkool +Signed-off-by: Michael Ellerman +Link: https://patch.msgid.link/b6ad2f1ee9887af3ca5ecade2a56f4acda517a85.1728512263.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/vdso.h | 1 + + tools/testing/selftests/vDSO/parse_vdso.c | 3 +-- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/include/asm/vdso.h b/arch/powerpc/include/asm/vdso.h +index b5e1f8f8a05c2..64bf8612f479e 100644 +--- a/arch/powerpc/include/asm/vdso.h ++++ b/arch/powerpc/include/asm/vdso.h +@@ -49,6 +49,7 @@ int vdso_getcpu_init(void); + + #define V_FUNCTION_BEGIN(name) \ + .globl name; \ ++ .type name,@function; \ + name: \ + + #define V_FUNCTION_END(name) \ +diff --git a/tools/testing/selftests/vDSO/parse_vdso.c b/tools/testing/selftests/vDSO/parse_vdso.c +index 540f9a284e9f0..9ef3ad3789c17 100644 +--- a/tools/testing/selftests/vDSO/parse_vdso.c ++++ b/tools/testing/selftests/vDSO/parse_vdso.c +@@ -238,8 +238,7 @@ void *vdso_sym(const char *version, const char *name) + ELF(Sym) *sym = &vdso_info.symtab[chain]; + + /* Check for a defined global or weak function w/ right name. */ +- if (ELF64_ST_TYPE(sym->st_info) != STT_FUNC && +- ELF64_ST_TYPE(sym->st_info) != STT_NOTYPE) ++ if (ELF64_ST_TYPE(sym->st_info) != STT_FUNC) + continue; + if (ELF64_ST_BIND(sym->st_info) != STB_GLOBAL && + ELF64_ST_BIND(sym->st_info) != STB_WEAK) +-- +2.43.0 + diff --git a/queue-5.4/rdma-bnxt_re-check-cqe-flags-to-know-imm_data-vs-inv.patch b/queue-5.4/rdma-bnxt_re-check-cqe-flags-to-know-imm_data-vs-inv.patch new file mode 100644 index 00000000000..a106e466ffb --- /dev/null +++ b/queue-5.4/rdma-bnxt_re-check-cqe-flags-to-know-imm_data-vs-inv.patch @@ -0,0 +1,80 @@ +From b592c9455762def059c706d98f3d645793fa9cc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2024 03:06:54 -0700 +Subject: RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey + +From: Kashyap Desai + +[ Upstream commit 808ca6de989c598bc5af1ae0ad971a66077efac0 ] + +Invalidate rkey is cpu endian and immediate data is in big endian format. +Both immediate data and invalidate the remote key returned by +HW is in little endian format. + +While handling the commit in fixes tag, the difference between +immediate data and invalidate rkey endianness was not considered. + +Without changes of this patch, Kernel ULP was failing while processing +inv_rkey. + +dmesg log snippet - +nvme nvme0: Bogus remote invalidation for rkey 0x2000019Fix in this patch + +Do endianness conversion based on completion queue entry flag. +Also, the HW completions are already converted to host endianness in +bnxt_qplib_cq_process_res_rc and bnxt_qplib_cq_process_res_ud and there +is no need to convert it again in bnxt_re_poll_cq. Modified the union to +hold the correct data type. + +Fixes: 95b087f87b78 ("bnxt_re: Fix imm_data endianness") +Signed-off-by: Kashyap Desai +Signed-off-by: Selvin Xavier +Link: https://patch.msgid.link/1730110014-20755-1-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +++++-- + drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index 4a1c11bdc4adc..eca36da7f9d4b 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -3250,7 +3250,7 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *gsi_sqp, + wc->byte_len = orig_cqe->length; + wc->qp = &gsi_qp->ib_qp; + +- wc->ex.imm_data = cpu_to_be32(le32_to_cpu(orig_cqe->immdata)); ++ wc->ex.imm_data = cpu_to_be32(orig_cqe->immdata); + wc->src_qp = orig_cqe->src_qp; + memcpy(wc->smac, orig_cqe->smac, ETH_ALEN); + if (bnxt_re_is_vlan_pkt(orig_cqe, &vlan_id, &sl)) { +@@ -3391,7 +3391,10 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc) + continue; + } + wc->qp = &qp->ib_qp; +- wc->ex.imm_data = cpu_to_be32(le32_to_cpu(cqe->immdata)); ++ if (cqe->flags & CQ_RES_RC_FLAGS_IMM) ++ wc->ex.imm_data = cpu_to_be32(cqe->immdata); ++ else ++ wc->ex.invalidate_rkey = cqe->invrkey; + wc->src_qp = cqe->src_qp; + memcpy(wc->smac, cqe->smac, ETH_ALEN); + wc->port_num = 1; +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +index bdc3a4f969c7e..a40f8cd8860a7 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +@@ -350,7 +350,7 @@ struct bnxt_qplib_cqe { + u16 cfa_meta; + u64 wr_id; + union { +- __le32 immdata; ++ u32 immdata; + u32 invrkey; + }; + u64 qp_handle; +-- +2.43.0 + diff --git a/queue-5.4/regmap-irq-set-lockdep-class-for-hierarchical-irq-do.patch b/queue-5.4/regmap-irq-set-lockdep-class-for-hierarchical-irq-do.patch new file mode 100644 index 00000000000..db7550e935b --- /dev/null +++ b/queue-5.4/regmap-irq-set-lockdep-class-for-hierarchical-irq-do.patch @@ -0,0 +1,85 @@ +From c7c8bc8f09bd118a26690d2821ad2fbe7cd9f980 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2024 18:55:53 +0200 +Subject: regmap: irq: Set lockdep class for hierarchical IRQ domains + +From: Andy Shevchenko + +[ Upstream commit 953e549471cabc9d4980f1da2e9fa79f4c23da06 ] + +Lockdep gives a false positive splat as it can't distinguish the lock +which is taken by different IRQ descriptors from different IRQ chips +that are organized in a way of a hierarchy: + + ====================================================== + WARNING: possible circular locking dependency detected + 6.12.0-rc5-next-20241101-00148-g9fabf8160b53 #562 Tainted: G W + ------------------------------------------------------ + modprobe/141 is trying to acquire lock: + ffff899446947868 (intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock){+.+.}-{4:4}, at: regmap_update_bits_base+0x33/0x90 + + but task is already holding lock: + ffff899446947c68 (&d->lock){+.+.}-{4:4}, at: __setup_irq+0x682/0x790 + + which lock already depends on the new lock. + + -> #3 (&d->lock){+.+.}-{4:4}: + -> #2 (&desc->request_mutex){+.+.}-{4:4}: + -> #1 (ipclock){+.+.}-{4:4}: + -> #0 (intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock){+.+.}-{4:4}: + + Chain exists of: + intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock --> &desc->request_mutex --> &d->lock + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&d->lock); + lock(&desc->request_mutex); + lock(&d->lock); + lock(intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock); + + *** DEADLOCK *** + + 3 locks held by modprobe/141: + #0: ffff8994419368f8 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xf6/0x250 + #1: ffff89944690b250 (&desc->request_mutex){+.+.}-{4:4}, at: __setup_irq+0x1a2/0x790 + #2: ffff899446947c68 (&d->lock){+.+.}-{4:4}, at: __setup_irq+0x682/0x790 + +Set a lockdep class when we map the IRQ so that it doesn't warn about +a lockdep bug that doesn't exist. + +Fixes: 4af8be67fd99 ("regmap: Convert regmap_irq to use irq_domain") +Signed-off-by: Andy Shevchenko +Link: https://patch.msgid.link/20241101165553.4055617-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap-irq.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c +index 3c1e554df4eb2..54cb9a02254f9 100644 +--- a/drivers/base/regmap/regmap-irq.c ++++ b/drivers/base/regmap/regmap-irq.c +@@ -522,12 +522,16 @@ static irqreturn_t regmap_irq_thread(int irq, void *d) + return IRQ_NONE; + } + ++static struct lock_class_key regmap_irq_lock_class; ++static struct lock_class_key regmap_irq_request_class; ++ + static int regmap_irq_map(struct irq_domain *h, unsigned int virq, + irq_hw_number_t hw) + { + struct regmap_irq_chip_data *data = h->host_data; + + irq_set_chip_data(virq, data); ++ irq_set_lockdep_class(virq, ®map_irq_lock_class, ®map_irq_request_class); + irq_set_chip(virq, &data->irq_chip); + irq_set_nested_thread(virq, 1); + irq_set_parent(virq, data->irq); +-- +2.43.0 + diff --git a/queue-5.4/rpmsg-glink-add-tx_data_cont-command-while-sending.patch b/queue-5.4/rpmsg-glink-add-tx_data_cont-command-while-sending.patch new file mode 100644 index 00000000000..5535931b364 --- /dev/null +++ b/queue-5.4/rpmsg-glink-add-tx_data_cont-command-while-sending.patch @@ -0,0 +1,92 @@ +From e71ddb119736b3784d03260e4b9716edcde6bb77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jul 2020 10:48:13 +0530 +Subject: rpmsg: glink: Add TX_DATA_CONT command while sending + +From: Arun Kumar Neelakantam + +[ Upstream commit 8956927faed366b60b0355f4a4317a10e281ced7 ] + +With current design the transport can send packets of size upto +FIFO_SIZE which is 16k and return failure for all packets above 16k. + +Add TX_DATA_CONT command to send packets greater than 16k by splitting +into 8K chunks. + +Signed-off-by: Arun Kumar Neelakantam +Signed-off-by: Deepak Kumar Singh +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1596086296-28529-4-git-send-email-deesin@codeaurora.org +Stable-dep-of: 06c59d97f63c ("rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length") +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_glink_native.c | 38 +++++++++++++++++++++++++++---- + 1 file changed, 34 insertions(+), 4 deletions(-) + +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index 2dea1e7487bb4..421ed358ad9cd 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -1276,6 +1276,8 @@ static int __qcom_glink_send(struct glink_channel *channel, + } __packed req; + int ret; + unsigned long flags; ++ int chunk_size = len; ++ int left_size = 0; + + if (!glink->intentless) { + while (!intent) { +@@ -1309,18 +1311,46 @@ static int __qcom_glink_send(struct glink_channel *channel, + iid = intent->id; + } + ++ if (wait && chunk_size > SZ_8K) { ++ chunk_size = SZ_8K; ++ left_size = len - chunk_size; ++ } + req.msg.cmd = cpu_to_le16(RPM_CMD_TX_DATA); + req.msg.param1 = cpu_to_le16(channel->lcid); + req.msg.param2 = cpu_to_le32(iid); +- req.chunk_size = cpu_to_le32(len); +- req.left_size = cpu_to_le32(0); ++ req.chunk_size = cpu_to_le32(chunk_size); ++ req.left_size = cpu_to_le32(left_size); + +- ret = qcom_glink_tx(glink, &req, sizeof(req), data, len, wait); ++ ret = qcom_glink_tx(glink, &req, sizeof(req), data, chunk_size, wait); + + /* Mark intent available if we failed */ +- if (ret && intent) ++ if (ret && intent) { + intent->in_use = false; ++ return ret; ++ } + ++ while (left_size > 0) { ++ data = (void *)((char *)data + chunk_size); ++ chunk_size = left_size; ++ if (chunk_size > SZ_8K) ++ chunk_size = SZ_8K; ++ left_size -= chunk_size; ++ ++ req.msg.cmd = cpu_to_le16(RPM_CMD_TX_DATA_CONT); ++ req.msg.param1 = cpu_to_le16(channel->lcid); ++ req.msg.param2 = cpu_to_le32(iid); ++ req.chunk_size = cpu_to_le32(chunk_size); ++ req.left_size = cpu_to_le32(left_size); ++ ++ ret = qcom_glink_tx(glink, &req, sizeof(req), data, ++ chunk_size, wait); ++ ++ /* Mark intent available if we failed */ ++ if (ret && intent) { ++ intent->in_use = false; ++ break; ++ } ++ } + return ret; + } + +-- +2.43.0 + diff --git a/queue-5.4/rpmsg-glink-fix-glink-command-prefix.patch b/queue-5.4/rpmsg-glink-fix-glink-command-prefix.patch new file mode 100644 index 00000000000..05f1005f882 --- /dev/null +++ b/queue-5.4/rpmsg-glink-fix-glink-command-prefix.patch @@ -0,0 +1,284 @@ +From 5df73529494a0dcb9a1e4097a77856c7162d3a34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 14:59:33 -0800 +Subject: rpmsg: glink: Fix GLINK command prefix + +From: Bjorn Andersson + +[ Upstream commit 4e816d0318fdfe8932da80dbf04ba318b13e4b3a ] + +The upstream GLINK driver was first introduced to communicate with the +RPM on MSM8996, presumably as an artifact from that era the command +defines was prefixed RPM_CMD, while they actually are GLINK_CMDs. + +Let's rename these, to keep things tidy. No functional change. + +Signed-off-by: Bjorn Andersson +Reviewed-by: Chris Lew +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230214225933.2025595-1-quic_bjorande@quicinc.com +Stable-dep-of: 06c59d97f63c ("rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length") +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_glink_native.c | 98 +++++++++++++++---------------- + 1 file changed, 49 insertions(+), 49 deletions(-) + +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index 4581b7041c9a9..4766c21f96901 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -191,20 +191,20 @@ struct glink_channel { + + static const struct rpmsg_endpoint_ops glink_endpoint_ops; + +-#define RPM_CMD_VERSION 0 +-#define RPM_CMD_VERSION_ACK 1 +-#define RPM_CMD_OPEN 2 +-#define RPM_CMD_CLOSE 3 +-#define RPM_CMD_OPEN_ACK 4 +-#define RPM_CMD_INTENT 5 +-#define RPM_CMD_RX_DONE 6 +-#define RPM_CMD_RX_INTENT_REQ 7 +-#define RPM_CMD_RX_INTENT_REQ_ACK 8 +-#define RPM_CMD_TX_DATA 9 +-#define RPM_CMD_CLOSE_ACK 11 +-#define RPM_CMD_TX_DATA_CONT 12 +-#define RPM_CMD_READ_NOTIF 13 +-#define RPM_CMD_RX_DONE_W_REUSE 14 ++#define GLINK_CMD_VERSION 0 ++#define GLINK_CMD_VERSION_ACK 1 ++#define GLINK_CMD_OPEN 2 ++#define GLINK_CMD_CLOSE 3 ++#define GLINK_CMD_OPEN_ACK 4 ++#define GLINK_CMD_INTENT 5 ++#define GLINK_CMD_RX_DONE 6 ++#define GLINK_CMD_RX_INTENT_REQ 7 ++#define GLINK_CMD_RX_INTENT_REQ_ACK 8 ++#define GLINK_CMD_TX_DATA 9 ++#define GLINK_CMD_CLOSE_ACK 11 ++#define GLINK_CMD_TX_DATA_CONT 12 ++#define GLINK_CMD_READ_NOTIF 13 ++#define GLINK_CMD_RX_DONE_W_REUSE 14 + + #define GLINK_FEATURE_INTENTLESS BIT(1) + +@@ -313,7 +313,7 @@ static void qcom_glink_send_read_notify(struct qcom_glink *glink) + { + struct glink_msg msg; + +- msg.cmd = cpu_to_le16(RPM_CMD_READ_NOTIF); ++ msg.cmd = cpu_to_le16(GLINK_CMD_READ_NOTIF); + msg.param1 = 0; + msg.param2 = 0; + +@@ -375,7 +375,7 @@ static int qcom_glink_send_version(struct qcom_glink *glink) + { + struct glink_msg msg; + +- msg.cmd = cpu_to_le16(RPM_CMD_VERSION); ++ msg.cmd = cpu_to_le16(GLINK_CMD_VERSION); + msg.param1 = cpu_to_le16(GLINK_VERSION_1); + msg.param2 = cpu_to_le32(glink->features); + +@@ -386,7 +386,7 @@ static void qcom_glink_send_version_ack(struct qcom_glink *glink) + { + struct glink_msg msg; + +- msg.cmd = cpu_to_le16(RPM_CMD_VERSION_ACK); ++ msg.cmd = cpu_to_le16(GLINK_CMD_VERSION_ACK); + msg.param1 = cpu_to_le16(GLINK_VERSION_1); + msg.param2 = cpu_to_le32(glink->features); + +@@ -398,7 +398,7 @@ static void qcom_glink_send_open_ack(struct qcom_glink *glink, + { + struct glink_msg msg; + +- msg.cmd = cpu_to_le16(RPM_CMD_OPEN_ACK); ++ msg.cmd = cpu_to_le16(GLINK_CMD_OPEN_ACK); + msg.param1 = cpu_to_le16(channel->rcid); + msg.param2 = cpu_to_le32(0); + +@@ -424,11 +424,11 @@ static void qcom_glink_handle_intent_req_ack(struct qcom_glink *glink, + } + + /** +- * qcom_glink_send_open_req() - send a RPM_CMD_OPEN request to the remote ++ * qcom_glink_send_open_req() - send a GLINK_CMD_OPEN request to the remote + * @glink: Ptr to the glink edge + * @channel: Ptr to the channel that the open req is sent + * +- * Allocates a local channel id and sends a RPM_CMD_OPEN message to the remote. ++ * Allocates a local channel id and sends a GLINK_CMD_OPEN message to the remote. + * Will return with refcount held, regardless of outcome. + * + * Returns 0 on success, negative errno otherwise. +@@ -457,7 +457,7 @@ static int qcom_glink_send_open_req(struct qcom_glink *glink, + + channel->lcid = ret; + +- req.msg.cmd = cpu_to_le16(RPM_CMD_OPEN); ++ req.msg.cmd = cpu_to_le16(GLINK_CMD_OPEN); + req.msg.param1 = cpu_to_le16(channel->lcid); + req.msg.param2 = cpu_to_le32(name_len); + strcpy(req.name, channel->name); +@@ -482,7 +482,7 @@ static void qcom_glink_send_close_req(struct qcom_glink *glink, + { + struct glink_msg req; + +- req.cmd = cpu_to_le16(RPM_CMD_CLOSE); ++ req.cmd = cpu_to_le16(GLINK_CMD_CLOSE); + req.param1 = cpu_to_le16(channel->lcid); + req.param2 = 0; + +@@ -494,7 +494,7 @@ static void qcom_glink_send_close_ack(struct qcom_glink *glink, + { + struct glink_msg req; + +- req.cmd = cpu_to_le16(RPM_CMD_CLOSE_ACK); ++ req.cmd = cpu_to_le16(GLINK_CMD_CLOSE_ACK); + req.param1 = cpu_to_le16(rcid); + req.param2 = 0; + +@@ -525,7 +525,7 @@ static void qcom_glink_rx_done_work(struct work_struct *work) + iid = intent->id; + reuse = intent->reuse; + +- cmd.id = reuse ? RPM_CMD_RX_DONE_W_REUSE : RPM_CMD_RX_DONE; ++ cmd.id = reuse ? GLINK_CMD_RX_DONE_W_REUSE : GLINK_CMD_RX_DONE; + cmd.lcid = cid; + cmd.liid = iid; + +@@ -637,7 +637,7 @@ static int qcom_glink_send_intent_req_ack(struct qcom_glink *glink, + { + struct glink_msg msg; + +- msg.cmd = cpu_to_le16(RPM_CMD_RX_INTENT_REQ_ACK); ++ msg.cmd = cpu_to_le16(GLINK_CMD_RX_INTENT_REQ_ACK); + msg.param1 = cpu_to_le16(channel->lcid); + msg.param2 = cpu_to_le32(granted); + +@@ -668,7 +668,7 @@ static int qcom_glink_advertise_intent(struct qcom_glink *glink, + } __packed; + struct command cmd; + +- cmd.id = cpu_to_le16(RPM_CMD_INTENT); ++ cmd.id = cpu_to_le16(GLINK_CMD_INTENT); + cmd.lcid = cpu_to_le16(channel->lcid); + cmd.count = cpu_to_le32(1); + cmd.size = cpu_to_le32(intent->size); +@@ -1033,42 +1033,42 @@ static irqreturn_t qcom_glink_native_intr(int irq, void *data) + param2 = le32_to_cpu(msg.param2); + + switch (cmd) { +- case RPM_CMD_VERSION: +- case RPM_CMD_VERSION_ACK: +- case RPM_CMD_CLOSE: +- case RPM_CMD_CLOSE_ACK: +- case RPM_CMD_RX_INTENT_REQ: ++ case GLINK_CMD_VERSION: ++ case GLINK_CMD_VERSION_ACK: ++ case GLINK_CMD_CLOSE: ++ case GLINK_CMD_CLOSE_ACK: ++ case GLINK_CMD_RX_INTENT_REQ: + ret = qcom_glink_rx_defer(glink, 0); + break; +- case RPM_CMD_OPEN_ACK: ++ case GLINK_CMD_OPEN_ACK: + ret = qcom_glink_rx_open_ack(glink, param1); + qcom_glink_rx_advance(glink, ALIGN(sizeof(msg), 8)); + break; +- case RPM_CMD_OPEN: ++ case GLINK_CMD_OPEN: + ret = qcom_glink_rx_defer(glink, param2); + break; +- case RPM_CMD_TX_DATA: +- case RPM_CMD_TX_DATA_CONT: ++ case GLINK_CMD_TX_DATA: ++ case GLINK_CMD_TX_DATA_CONT: + ret = qcom_glink_rx_data(glink, avail); + break; +- case RPM_CMD_READ_NOTIF: ++ case GLINK_CMD_READ_NOTIF: + qcom_glink_rx_advance(glink, ALIGN(sizeof(msg), 8)); + + mbox_send_message(glink->mbox_chan, NULL); + mbox_client_txdone(glink->mbox_chan, 0); + break; +- case RPM_CMD_INTENT: ++ case GLINK_CMD_INTENT: + qcom_glink_handle_intent(glink, param1, param2, avail); + break; +- case RPM_CMD_RX_DONE: ++ case GLINK_CMD_RX_DONE: + qcom_glink_handle_rx_done(glink, param1, param2, false); + qcom_glink_rx_advance(glink, ALIGN(sizeof(msg), 8)); + break; +- case RPM_CMD_RX_DONE_W_REUSE: ++ case GLINK_CMD_RX_DONE_W_REUSE: + qcom_glink_handle_rx_done(glink, param1, param2, true); + qcom_glink_rx_advance(glink, ALIGN(sizeof(msg), 8)); + break; +- case RPM_CMD_RX_INTENT_REQ_ACK: ++ case GLINK_CMD_RX_INTENT_REQ_ACK: + qcom_glink_handle_intent_req_ack(glink, param1, param2); + qcom_glink_rx_advance(glink, ALIGN(sizeof(msg), 8)); + break; +@@ -1271,7 +1271,7 @@ static int qcom_glink_request_intent(struct qcom_glink *glink, + + reinit_completion(&channel->intent_req_comp); + +- cmd.id = RPM_CMD_RX_INTENT_REQ; ++ cmd.id = GLINK_CMD_RX_INTENT_REQ; + cmd.cid = channel->lcid; + cmd.size = size; + +@@ -1345,7 +1345,7 @@ static int __qcom_glink_send(struct glink_channel *channel, + chunk_size = SZ_8K; + left_size = len - chunk_size; + } +- req.msg.cmd = cpu_to_le16(RPM_CMD_TX_DATA); ++ req.msg.cmd = cpu_to_le16(GLINK_CMD_TX_DATA); + req.msg.param1 = cpu_to_le16(channel->lcid); + req.msg.param2 = cpu_to_le32(iid); + req.chunk_size = cpu_to_le32(chunk_size); +@@ -1366,7 +1366,7 @@ static int __qcom_glink_send(struct glink_channel *channel, + chunk_size = SZ_8K; + left_size -= chunk_size; + +- req.msg.cmd = cpu_to_le16(RPM_CMD_TX_DATA_CONT); ++ req.msg.cmd = cpu_to_le16(GLINK_CMD_TX_DATA_CONT); + req.msg.param1 = cpu_to_le16(channel->lcid); + req.msg.param2 = cpu_to_le32(iid); + req.chunk_size = cpu_to_le32(chunk_size); +@@ -1605,22 +1605,22 @@ static void qcom_glink_work(struct work_struct *work) + param2 = le32_to_cpu(msg->param2); + + switch (cmd) { +- case RPM_CMD_VERSION: ++ case GLINK_CMD_VERSION: + qcom_glink_receive_version(glink, param1, param2); + break; +- case RPM_CMD_VERSION_ACK: ++ case GLINK_CMD_VERSION_ACK: + qcom_glink_receive_version_ack(glink, param1, param2); + break; +- case RPM_CMD_OPEN: ++ case GLINK_CMD_OPEN: + qcom_glink_rx_open(glink, param1, msg->data); + break; +- case RPM_CMD_CLOSE: ++ case GLINK_CMD_CLOSE: + qcom_glink_rx_close(glink, param1); + break; +- case RPM_CMD_CLOSE_ACK: ++ case GLINK_CMD_CLOSE_ACK: + qcom_glink_rx_close_ack(glink, param1); + break; +- case RPM_CMD_RX_INTENT_REQ: ++ case GLINK_CMD_RX_INTENT_REQ: + qcom_glink_handle_intent_req(glink, param1, param2); + break; + default: +-- +2.43.0 + diff --git a/queue-5.4/rpmsg-glink-send-read_notify-command-in-fifo-full-ca.patch b/queue-5.4/rpmsg-glink-send-read_notify-command-in-fifo-full-ca.patch new file mode 100644 index 00000000000..ba6e0661f34 --- /dev/null +++ b/queue-5.4/rpmsg-glink-send-read_notify-command-in-fifo-full-ca.patch @@ -0,0 +1,123 @@ +From ce3b37175c37eabd1e9a1787a5ea8d288da30fe2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jul 2020 10:48:16 +0530 +Subject: rpmsg: glink: Send READ_NOTIFY command in FIFO full case + +From: Arun Kumar Neelakantam + +[ Upstream commit b16a37e1846c9573a847a56fa2f31ba833dae45a ] + +The current design sleeps unconditionally in TX FIFO full case and +wakeup only after sleep timer expires which adds random delays in +clients TX path. + +Avoid sleep and use READ_NOTIFY command so that writer can be woken up +when remote notifies about read completion by sending IRQ. + +Signed-off-by: Deepak Kumar Singh +Signed-off-by: Arun Kumar Neelakantam +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1596086296-28529-7-git-send-email-deesin@codeaurora.org +Stable-dep-of: 06c59d97f63c ("rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length") +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_glink_native.c | 36 ++++++++++++++++++++++++++++++- + 1 file changed, 35 insertions(+), 1 deletion(-) + +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index 421ed358ad9cd..4581b7041c9a9 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -92,6 +92,8 @@ struct glink_core_rx_intent { + * @rcids: idr of all channels with a known remote channel id + * @features: remote features + * @intentless: flag to indicate that there is no intent ++ * @tx_avail_notify: Waitqueue for pending tx tasks ++ * @sent_read_notify: flag to check cmd sent or not + */ + struct qcom_glink { + struct device *dev; +@@ -118,6 +120,8 @@ struct qcom_glink { + unsigned long features; + + bool intentless; ++ wait_queue_head_t tx_avail_notify; ++ bool sent_read_notify; + }; + + enum { +@@ -305,6 +309,20 @@ static void qcom_glink_tx_write(struct qcom_glink *glink, + glink->tx_pipe->write(glink->tx_pipe, hdr, hlen, data, dlen); + } + ++static void qcom_glink_send_read_notify(struct qcom_glink *glink) ++{ ++ struct glink_msg msg; ++ ++ msg.cmd = cpu_to_le16(RPM_CMD_READ_NOTIF); ++ msg.param1 = 0; ++ msg.param2 = 0; ++ ++ qcom_glink_tx_write(glink, &msg, sizeof(msg), NULL, 0); ++ ++ mbox_send_message(glink->mbox_chan, NULL); ++ mbox_client_txdone(glink->mbox_chan, 0); ++} ++ + static int qcom_glink_tx(struct qcom_glink *glink, + const void *hdr, size_t hlen, + const void *data, size_t dlen, bool wait) +@@ -325,12 +343,21 @@ static int qcom_glink_tx(struct qcom_glink *glink, + goto out; + } + ++ if (!glink->sent_read_notify) { ++ glink->sent_read_notify = true; ++ qcom_glink_send_read_notify(glink); ++ } ++ + /* Wait without holding the tx_lock */ + spin_unlock_irqrestore(&glink->tx_lock, flags); + +- usleep_range(10000, 15000); ++ wait_event_timeout(glink->tx_avail_notify, ++ qcom_glink_tx_avail(glink) >= tlen, 10 * HZ); + + spin_lock_irqsave(&glink->tx_lock, flags); ++ ++ if (qcom_glink_tx_avail(glink) >= tlen) ++ glink->sent_read_notify = false; + } + + qcom_glink_tx_write(glink, hdr, hlen, data, dlen); +@@ -991,6 +1018,9 @@ static irqreturn_t qcom_glink_native_intr(int irq, void *data) + unsigned int cmd; + int ret = 0; + ++ /* To wakeup any blocking writers */ ++ wake_up_all(&glink->tx_avail_notify); ++ + for (;;) { + avail = qcom_glink_rx_avail(glink); + if (avail < sizeof(msg)) +@@ -1530,6 +1560,9 @@ static void qcom_glink_rx_close_ack(struct qcom_glink *glink, unsigned int lcid) + struct glink_channel *channel; + unsigned long flags; + ++ /* To wakeup any blocking writers */ ++ wake_up_all(&glink->tx_avail_notify); ++ + spin_lock_irqsave(&glink->idr_lock, flags); + channel = idr_find(&glink->lcids, lcid); + if (WARN(!channel, "close ack on unknown channel\n")) { +@@ -1636,6 +1669,7 @@ struct qcom_glink *qcom_glink_native_probe(struct device *dev, + spin_lock_init(&glink->rx_lock); + INIT_LIST_HEAD(&glink->rx_queue); + INIT_WORK(&glink->rx_work, qcom_glink_work); ++ init_waitqueue_head(&glink->tx_avail_notify); + + spin_lock_init(&glink->idr_lock); + idr_init(&glink->lcids); +-- +2.43.0 + diff --git a/queue-5.4/rpmsg-glink-use-only-lower-16-bits-of-param2-for-cmd.patch b/queue-5.4/rpmsg-glink-use-only-lower-16-bits-of-param2-for-cmd.patch new file mode 100644 index 00000000000..47900fc9f3d --- /dev/null +++ b/queue-5.4/rpmsg-glink-use-only-lower-16-bits-of-param2-for-cmd.patch @@ -0,0 +1,44 @@ +From 9bcf92244c74537bc2dcd3b03f4845fa9dc32fae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 19:59:35 -0400 +Subject: rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name + length + +From: Jonathan Marek + +[ Upstream commit 06c59d97f63c1b8af521fa5aef8a716fb988b285 ] + +The name len field of the CMD_OPEN packet is only 16-bits and the upper +16-bits of "param2" are a different "prio" field, which can be nonzero in +certain situations, and CMD_OPEN packets can be unexpectedly dropped +because of this. + +Fix this by masking out the upper 16 bits of param2. + +Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver") +Signed-off-by: Jonathan Marek +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241007235935.6216-1-jonathan@marek.ca +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_glink_native.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index 4766c21f96901..47ffaca8d86b5 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -1045,7 +1045,8 @@ static irqreturn_t qcom_glink_native_intr(int irq, void *data) + qcom_glink_rx_advance(glink, ALIGN(sizeof(msg), 8)); + break; + case GLINK_CMD_OPEN: +- ret = qcom_glink_rx_defer(glink, param2); ++ /* upper 16 bits of param2 are the "prio" field */ ++ ret = qcom_glink_rx_defer(glink, param2 & 0xffff); + break; + case GLINK_CMD_TX_DATA: + case GLINK_CMD_TX_DATA_CONT: +-- +2.43.0 + diff --git a/queue-5.4/s390-syscalls-avoid-creation-of-arch-arch-directory.patch b/queue-5.4/s390-syscalls-avoid-creation-of-arch-arch-directory.patch new file mode 100644 index 00000000000..1c7b37a1b1f --- /dev/null +++ b/queue-5.4/s390-syscalls-avoid-creation-of-arch-arch-directory.patch @@ -0,0 +1,54 @@ +From 615d1022c9f86445d3465fc48faccd4dd8ed7db8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 22:45:52 +0900 +Subject: s390/syscalls: Avoid creation of arch/arch/ directory + +From: Masahiro Yamada + +[ Upstream commit 0708967e2d56e370231fd07defa0d69f9ad125e8 ] + +Building the kernel with ARCH=s390 creates a weird arch/arch/ directory. + + $ find arch/arch + arch/arch + arch/arch/s390 + arch/arch/s390/include + arch/arch/s390/include/generated + arch/arch/s390/include/generated/asm + arch/arch/s390/include/generated/uapi + arch/arch/s390/include/generated/uapi/asm + +The root cause is 'targets' in arch/s390/kernel/syscalls/Makefile, +where the relative path is incorrect. + +Strictly speaking, 'targets' was not necessary in the first place +because this Makefile uses 'filechk' instead of 'if_changed'. + +However, this commit keeps it, as it will be useful when converting +'filechk' to 'if_changed' later. + +Fixes: 5c75824d915e ("s390/syscalls: add Makefile to generate system call header files") +Signed-off-by: Masahiro Yamada +Link: https://lore.kernel.org/r/20241111134603.2063226-1-masahiroy@kernel.org +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/syscalls/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/syscalls/Makefile b/arch/s390/kernel/syscalls/Makefile +index b98f25029b8e6..7b77ed779c7b2 100644 +--- a/arch/s390/kernel/syscalls/Makefile ++++ b/arch/s390/kernel/syscalls/Makefile +@@ -12,7 +12,7 @@ kapi-hdrs-y := $(kapi)/unistd_nr.h + uapi-hdrs-y := $(uapi)/unistd_32.h + uapi-hdrs-y += $(uapi)/unistd_64.h + +-targets += $(addprefix ../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y)) ++targets += $(addprefix ../../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y)) + + PHONY += kapi uapi + +-- +2.43.0 + diff --git a/queue-5.4/scsi-bfa-fix-use-after-free-in-bfad_im_module_exit.patch b/queue-5.4/scsi-bfa-fix-use-after-free-in-bfad_im_module_exit.patch new file mode 100644 index 00000000000..84d02946d32 --- /dev/null +++ b/queue-5.4/scsi-bfa-fix-use-after-free-in-bfad_im_module_exit.patch @@ -0,0 +1,109 @@ +From afb196c66f54e6fe88bc35b482f3cf44d2ab3420 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2024 09:18:09 +0800 +Subject: scsi: bfa: Fix use-after-free in bfad_im_module_exit() + +From: Ye Bin + +[ Upstream commit 178b8f38932d635e90f5f0e9af1986c6f4a89271 ] + +BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20 +Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 + +Call Trace: + + dump_stack_lvl+0x95/0xe0 + print_report+0xcb/0x620 + kasan_report+0xbd/0xf0 + __lock_acquire+0x2aca/0x3a20 + lock_acquire+0x19b/0x520 + _raw_spin_lock+0x2b/0x40 + attribute_container_unregister+0x30/0x160 + fc_release_transport+0x19/0x90 [scsi_transport_fc] + bfad_im_module_exit+0x23/0x60 [bfa] + bfad_init+0xdb/0xff0 [bfa] + do_one_initcall+0xdc/0x550 + do_init_module+0x22d/0x6b0 + load_module+0x4e96/0x5ff0 + init_module_from_file+0xcd/0x130 + idempotent_init_module+0x330/0x620 + __x64_sys_finit_module+0xb3/0x110 + do_syscall_64+0xc1/0x1d0 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + +Allocated by task 25303: + kasan_save_stack+0x24/0x50 + kasan_save_track+0x14/0x30 + __kasan_kmalloc+0x7f/0x90 + fc_attach_transport+0x4f/0x4740 [scsi_transport_fc] + bfad_im_module_init+0x17/0x80 [bfa] + bfad_init+0x23/0xff0 [bfa] + do_one_initcall+0xdc/0x550 + do_init_module+0x22d/0x6b0 + load_module+0x4e96/0x5ff0 + init_module_from_file+0xcd/0x130 + idempotent_init_module+0x330/0x620 + __x64_sys_finit_module+0xb3/0x110 + do_syscall_64+0xc1/0x1d0 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Freed by task 25303: + kasan_save_stack+0x24/0x50 + kasan_save_track+0x14/0x30 + kasan_save_free_info+0x3b/0x60 + __kasan_slab_free+0x38/0x50 + kfree+0x212/0x480 + bfad_im_module_init+0x7e/0x80 [bfa] + bfad_init+0x23/0xff0 [bfa] + do_one_initcall+0xdc/0x550 + do_init_module+0x22d/0x6b0 + load_module+0x4e96/0x5ff0 + init_module_from_file+0xcd/0x130 + idempotent_init_module+0x330/0x620 + __x64_sys_finit_module+0xb3/0x110 + do_syscall_64+0xc1/0x1d0 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Above issue happens as follows: + +bfad_init + error = bfad_im_module_init() + fc_release_transport(bfad_im_scsi_transport_template); + if (error) + goto ext; + +ext: + bfad_im_module_exit(); + fc_release_transport(bfad_im_scsi_transport_template); + --> Trigger double release + +Don't call bfad_im_module_exit() if bfad_im_module_init() failed. + +Fixes: 7725ccfda597 ("[SCSI] bfa: Brocade BFA FC SCSI driver") +Signed-off-by: Ye Bin +Link: https://lore.kernel.org/r/20241023011809.63466-1-yebin@huaweicloud.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bfa/bfad.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c +index 93e4011809919..df848d2bd08e7 100644 +--- a/drivers/scsi/bfa/bfad.c ++++ b/drivers/scsi/bfa/bfad.c +@@ -1706,9 +1706,8 @@ bfad_init(void) + + error = bfad_im_module_init(); + if (error) { +- error = -ENOMEM; + printk(KERN_WARNING "bfad_im_module_init failure\n"); +- goto ext; ++ return -ENOMEM; + } + + if (strcmp(FCPI_NAME, " fcpim") == 0) +-- +2.43.0 + diff --git a/queue-5.4/scsi-fusion-remove-unused-variable-rc.patch b/queue-5.4/scsi-fusion-remove-unused-variable-rc.patch new file mode 100644 index 00000000000..e0e04a4c106 --- /dev/null +++ b/queue-5.4/scsi-fusion-remove-unused-variable-rc.patch @@ -0,0 +1,46 @@ +From ca333a9cd49edaab3c903978c91d2c2762ac951a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2024 16:44:17 +0800 +Subject: scsi: fusion: Remove unused variable 'rc' + +From: Zeng Heng + +[ Upstream commit bd65694223f7ad11c790ab63ad1af87a771192ee ] + +The return value of scsi_device_reprobe() is currently ignored in +_scsih_reprobe_lun(). Fixing the calling code to deal with the potential +error is non-trivial, so for now just WARN_ON(). + +The handling of scsi_device_reprobe()'s return value refers to +_scsih_reprobe_lun() and the following link: + +https://lore.kernel.org/all/094fdbf57487af4f395238c0525b2a560c8f68f0.1469766027.git.calvinowens@fb.com/ + +Fixes: f99be43b3024 ("[SCSI] fusion: power pc and miscellaneous bug fixs") +Signed-off-by: Zeng Heng +Link: https://lore.kernel.org/r/20241024084417.154655-1-zengheng4@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/message/fusion/mptsas.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c +index 6a79cd0ebe2b0..633c8ef3cfe20 100644 +--- a/drivers/message/fusion/mptsas.c ++++ b/drivers/message/fusion/mptsas.c +@@ -4205,10 +4205,8 @@ mptsas_find_phyinfo_by_phys_disk_num(MPT_ADAPTER *ioc, u8 phys_disk_num, + static void + mptsas_reprobe_lun(struct scsi_device *sdev, void *data) + { +- int rc; +- + sdev->no_uld_attach = data ? 1 : 0; +- rc = scsi_device_reprobe(sdev); ++ WARN_ON(scsi_device_reprobe(sdev)); + } + + static void +-- +2.43.0 + diff --git a/queue-5.4/scsi-qedf-fix-a-possible-memory-leak-in-qedf_alloc_a.patch b/queue-5.4/scsi-qedf-fix-a-possible-memory-leak-in-qedf_alloc_a.patch new file mode 100644 index 00000000000..bc226fd6367 --- /dev/null +++ b/queue-5.4/scsi-qedf-fix-a-possible-memory-leak-in-qedf_alloc_a.patch @@ -0,0 +1,37 @@ +From 20a673a27ffcb9a03fbc5617fc5e420f88b9fe89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Oct 2024 20:57:10 +0800 +Subject: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() + +From: Zhen Lei + +[ Upstream commit c62c30429db3eb4ced35c7fcf6f04a61ce3a01bb ] + +Hook "qed_ops->common->sb_init = qed_sb_init" does not release the DMA +memory sb_virt when it fails. Add dma_free_coherent() to free it. This +is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb(). + +Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20241026125711.484-2-thunder.leizhen@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index e0601b5520b78..3f137ca650388 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -2596,6 +2596,7 @@ static int qedf_alloc_and_init_sb(struct qedf_ctx *qedf, + sb_id, QED_SB_TYPE_STORAGE); + + if (ret) { ++ dma_free_coherent(&qedf->pdev->dev, sizeof(*sb_virt), sb_virt, sb_phys); + QEDF_ERR(&qedf->dbg_ctx, + "Status block initialization failed (0x%x) for id = %d.\n", + ret, sb_id); +-- +2.43.0 + diff --git a/queue-5.4/scsi-qedi-fix-a-possible-memory-leak-in-qedi_alloc_a.patch b/queue-5.4/scsi-qedi-fix-a-possible-memory-leak-in-qedi_alloc_a.patch new file mode 100644 index 00000000000..4f85037119e --- /dev/null +++ b/queue-5.4/scsi-qedi-fix-a-possible-memory-leak-in-qedi_alloc_a.patch @@ -0,0 +1,37 @@ +From cee42f4ed7fa4893569c6b5f0ae4b26eeb1b8668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Oct 2024 20:57:11 +0800 +Subject: scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() + +From: Zhen Lei + +[ Upstream commit 95bbdca4999bc59a72ebab01663d421d6ce5775d ] + +Hook "qedi_ops->common->sb_init = qed_sb_init" does not release the DMA +memory sb_virt when it fails. Add dma_free_coherent() to free it. This +is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb(). + +Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.") +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20241026125711.484-3-thunder.leizhen@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index 6b47921202eba..67d2d66d8e731 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -359,6 +359,7 @@ static int qedi_alloc_and_init_sb(struct qedi_ctx *qedi, + ret = qedi_ops->common->sb_init(qedi->cdev, sb_info, sb_virt, sb_phys, + sb_id, QED_SB_TYPE_STORAGE); + if (ret) { ++ dma_free_coherent(&qedi->pdev->dev, sizeof(*sb_virt), sb_virt, sb_phys); + QEDI_ERR(&qedi->dbg_ctx, + "Status block initialization failed for id = %d.\n", + sb_id); +-- +2.43.0 + diff --git a/queue-5.4/selftests-net-really-check-for-bg-process-completion.patch b/queue-5.4/selftests-net-really-check-for-bg-process-completion.patch new file mode 100644 index 00000000000..8470ed849c3 --- /dev/null +++ b/queue-5.4/selftests-net-really-check-for-bg-process-completion.patch @@ -0,0 +1,43 @@ +From b02ff77a810c202ba0ddc686cf0dfb7dae11f825 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2024 19:23:51 +0100 +Subject: selftests: net: really check for bg process completion + +From: Paolo Abeni + +[ Upstream commit 52ed077aa6336dbef83a2d6d21c52d1706fb7f16 ] + +A recent refactor transformed the check for process completion +in a true statement, due to a typo. + +As a result, the relevant test-case is unable to catch the +regression it was supposed to detect. + +Restore the correct condition. + +Fixes: 691bb4e49c98 ("selftests: net: avoid just another constant wait") +Signed-off-by: Paolo Abeni +Reviewed-by: David Ahern +Link: https://patch.msgid.link/0e6f213811f8e93a235307e683af8225cc6277ae.1730828007.git.pabeni@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/pmtu.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh +index a4dc32729749d..f72001008db00 100755 +--- a/tools/testing/selftests/net/pmtu.sh ++++ b/tools/testing/selftests/net/pmtu.sh +@@ -1133,7 +1133,7 @@ check_running() { + pid=${1} + cmd=${2} + +- [ "$(cat /proc/${pid}/cmdline 2>/dev/null | tr -d '\0')" = "{cmd}" ] ++ [ "$(cat /proc/${pid}/cmdline 2>/dev/null | tr -d '\0')" = "${cmd}" ] + } + + test_cleanup_vxlanX_exception() { +-- +2.43.0 + diff --git a/queue-5.4/series b/queue-5.4/series index 57215c04f69..8a8899e557a 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -25,3 +25,119 @@ ipmr-fix-access-to-mfc_cache_list-without-lock-held.patch cifs-fix-buffer-overflow-when-parsing-nfs-reparse-po.patch nfsd-force-all-nfsv4.2-copy-requests-to-be-synchrono.patch nvme-fix-metadata-handling-in-nvme-passthrough.patch +x86-xen-pvh-annotate-indirect-branch-as-safe.patch +x86-pvh-set-phys_base-when-calling-xen_prepare_pvh.patch +x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch +mips-asm-fix-warning-when-disabling-mips_fp_support.patch +initramfs-avoid-filename-buffer-overrun.patch +nvme-pci-fix-freeing-of-the-hmb-descriptor-table.patch +m68k-mvme147-fix-scsi-controller-irq-numbers.patch +m68k-mvme16x-add-and-use-mvme16x.h.patch +m68k-mvme147-reinstate-early-console.patch +acpi-arm64-adjust-error-handling-procedure-in-gtdt_p.patch +s390-syscalls-avoid-creation-of-arch-arch-directory.patch +hfsplus-don-t-query-the-device-logical-block-size-mu.patch +firmware-google-unregister-driver_info-on-failure-an.patch +firmware-google-unregister-driver_info-on-failure.patch +edac-bluefield-fix-potential-integer-overflow.patch +edac-fsl_ddr-fix-bad-bit-shift-operations.patch +crypto-pcrypt-call-crypto-layer-directly-when-padata.patch +crypto-cavium-fix-the-if-condition-to-exit-loop-afte.patch +crypto-bcm-add-error-check-in-the-ahash_hmac_init-fu.patch +crypto-cavium-fix-an-error-handling-path-in-cpt_ucod.patch +time-fix-references-to-_msecs_to_jiffies-handling-of.patch +soc-ti-smartreflex-use-irqf_no_autoen-flag-in-reques.patch +soc-qcom-geni-se-fix-array-underflow-in-geni_se_clk_.patch +mmc-mmc_spi-drop-buggy-snprintf.patch +efi-tpm-pass-correct-address-to-memblock_reserve.patch +tpm-fix-signed-unsigned-bug-when-checking-event-logs.patch +arm-dts-cubieboard4-fix-dcdc5-regulator-constraints.patch +regmap-irq-set-lockdep-class-for-hierarchical-irq-do.patch +firmware-arm_scpi-check-the-dvfs-opp-count-returned-.patch +drm-mm-mark-drm_mm_interval_tree-functions-with-__ma.patch +wifi-ath9k-add-range-check-for-conn_rsp_epid-in-htc_.patch +drm-omap-fix-locking-in-omap_gem_new_dmabuf.patch +wifi-p54-use-irqf_no_autoen-flag-in-request_irq.patch +wifi-mwifiex-use-irqf_no_autoen-flag-in-request_irq.patch +drm-imx-ipuv3-use-irqf_no_autoen-flag-in-request_irq.patch +dt-bindings-vendor-prefixes-add-neofidelity-inc.patch +asoc-fsl_micfil-drop-unnecessary-register-read.patch +asoc-fsl_micfil-do-not-define-shift-mask-for-single-.patch +asoc-fsl_micfil-use-genmask-to-define-register-bit-f.patch +asoc-fsl_micfil-fix-regmap_write_bits-usage.patch +bpf-fix-the-xdp_adjust_tail-sample-prog-issue.patch +wifi-mwifiex-fix-memcpy-field-spanning-write-warning.patch +drm-fsl-dcu-use-gem-cma-object-functions.patch +drm-fsl-dcu-set-gem-cma-functions-with-drm_gem_cma_d.patch +drm-fsl-dcu-convert-to-linux-irq-interfaces.patch +drm-fsl-dcu-enable-pixclk-on-ls1021a.patch +drm-panfrost-remove-unused-id_mask-from-struct-panfr.patch +drm-msm-adreno-use-irqf_no_autoen-flag-in-request_ir.patch +drm-etnaviv-dump-fix-sparse-warnings.patch +drm-etnaviv-fix-power-register-offset-on-gc300.patch +drm-etnaviv-hold-gpu-lock-across-perfmon-sampling.patch +bpf-sockmap-several-fixes-to-bpf_msg_push_data.patch +bpf-sockmap-several-fixes-to-bpf_msg_pop_data.patch +bpf-sockmap-fix-sk_msg_reset_curr.patch +selftests-net-really-check-for-bg-process-completion.patch +net-rfkill-gpio-add-check-for-clk_enable.patch +alsa-us122l-use-snd_card_free_when_closed-at-disconn.patch +alsa-caiaq-use-snd_card_free_when_closed-at-disconne.patch +alsa-6fire-release-resources-at-card-release.patch +netpoll-use-rcu_access_pointer-in-netpoll_poll_lock.patch +trace-trace_event_perf-remove-duplicate-samples-on-t.patch +powerpc-vdso-flag-vdso64-entry-points-as-functions.patch +mfd-tps65010-use-irqf_no_autoen-flag-in-request_irq-.patch +mfd-da9052-spi-change-read-mask-to-write-mask.patch +mfd-intel_soc_pmic_bxtwc-use-dev_err_probe.patch +mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-usb-type.patch +mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-tmu-devi.patch +mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-pmic-dev.patch +cpufreq-loongson2-unregister-platform_driver-on-fail.patch +mtd-rawnand-atmel-fix-possible-memory-leak.patch +rdma-bnxt_re-check-cqe-flags-to-know-imm_data-vs-inv.patch +mfd-rt5033-fix-missing-regmap_del_irq_chip.patch +scsi-bfa-fix-use-after-free-in-bfad_im_module_exit.patch +scsi-fusion-remove-unused-variable-rc.patch +scsi-qedf-fix-a-possible-memory-leak-in-qedf_alloc_a.patch +scsi-qedi-fix-a-possible-memory-leak-in-qedi_alloc_a.patch +ocfs2-fix-uninitialized-value-in-ocfs2_file_read_ite.patch +powerpc-sstep-make-emulate_vsx_load-and-emulate_vsx_.patch +fbdev-sh7760fb-alloc-dma-memory-from-hardware-device.patch +fbdev-sh7760fb-fix-a-possible-memory-leak-in-sh7760f.patch +dt-bindings-clock-adi-axi-clkgen-convert-old-binding.patch +dt-bindings-clock-axi-clkgen-include-axi-clk.patch +clk-axi-clkgen-use-devm_platform_ioremap_resource-sh.patch +clk-clk-axi-clkgen-make-sure-to-enable-the-axi-bus-c.patch +perf-cs-etm-don-t-flush-when-packet_queue-fills-up.patch +perf-probe-correct-demangled-symbols-in-c-program.patch +pci-cpqphp-use-pci_possible_error-to-check-config-re.patch +pci-cpqphp-fix-pcibios_-return-value-confusion.patch +m68k-mcfgpio-fix-incorrect-register-offset-for-confi.patch +m68k-coldfire-device.c-only-build-fec-when-hw-macros.patch +perf-trace-do-not-lose-last-events-in-a-race.patch +perf-trace-avoid-garbage-when-not-printing-a-syscall.patch +rpmsg-glink-add-tx_data_cont-command-while-sending.patch +rpmsg-glink-send-read_notify-command-in-fifo-full-ca.patch +rpmsg-glink-fix-glink-command-prefix.patch +rpmsg-glink-use-only-lower-16-bits-of-param2-for-cmd.patch +nfsd-prevent-null-dereference-in-nfsd4_process_cb_up.patch +nfsd-cap-the-number-of-bytes-copied-by-nfs4_reset_re.patch +nfsd-fix-nfsd4_shutdown_copy.patch +vfio-pci-properly-hide-first-in-list-pcie-extended-c.patch +power-supply-core-remove-might_sleep-from-power_supp.patch +net-usb-lan78xx-fix-memory-leak-on-device-unplug-by-.patch +tg3-set-coherent-dma-mask-bits-to-31-for-bcm57766-ch.patch +net-usb-lan78xx-fix-refcounting-and-autosuspend-on-i.patch +marvell-pxa168_eth-fix-call-balance-of-pep-clk-handl.patch +net-stmmac-dwmac-socfpga-set-rx-watchdog-interrupt-a.patch +ipmr-convert-proc-handlers-to-rcu_read_lock.patch +ipmr-fix-tables-suspicious-rcu-usage.patch +usb-using-mutex-lock-and-supporting-o_nonblock-flag-.patch +usb-yurex-make-waiting-on-yurex_write-interruptible.patch +usb-chaoskey-fail-open-after-removal.patch +usb-chaoskey-fix-possible-deadlock-chaoskey_list_loc.patch +misc-apds990x-fix-missing-pm_runtime_disable.patch +staging-greybus-uart-clean-up-tiocgserial.patch +staging-greybus-uart-fix-atomicity-violation-in-get_.patch +apparmor-fix-do-simple-duplicate-message-elimination.patch diff --git a/queue-5.4/soc-qcom-geni-se-fix-array-underflow-in-geni_se_clk_.patch b/queue-5.4/soc-qcom-geni-se-fix-array-underflow-in-geni_se_clk_.patch new file mode 100644 index 00000000000..e7b8eb41b4b --- /dev/null +++ b/queue-5.4/soc-qcom-geni-se-fix-array-underflow-in-geni_se_clk_.patch @@ -0,0 +1,40 @@ +From a72c7cbd9c21e7bee3a93628acc5d0074521e2b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2024 10:51:31 +0300 +Subject: soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() + +From: Dan Carpenter + +[ Upstream commit 78261cb08f06c93d362cab5c5034bf5899bc7552 ] + +This loop is supposed to break if the frequency returned from +clk_round_rate() is the same as on the previous iteration. However, +that check doesn't make sense on the first iteration through the loop. +It leads to reading before the start of these->clk_perf_tbl[] array. + +Fixes: eddac5af0654 ("soc: qcom: Add GENI based QUP Wrapper driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/8cd12678-f44a-4b16-a579-c8f11175ee8c@stanley.mountain +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/qcom-geni-se.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c +index 2e66098e82975..d6115e3ce65fa 100644 +--- a/drivers/soc/qcom/qcom-geni-se.c ++++ b/drivers/soc/qcom/qcom-geni-se.c +@@ -550,7 +550,8 @@ int geni_se_clk_tbl_get(struct geni_se *se, unsigned long **tbl) + + for (i = 0; i < MAX_CLK_PERF_LEVEL; i++) { + freq = clk_round_rate(se->clk, freq + 1); +- if (freq <= 0 || freq == se->clk_perf_tbl[i - 1]) ++ if (freq <= 0 || ++ (i > 0 && freq == se->clk_perf_tbl[i - 1])) + break; + se->clk_perf_tbl[i] = freq; + } +-- +2.43.0 + diff --git a/queue-5.4/soc-ti-smartreflex-use-irqf_no_autoen-flag-in-reques.patch b/queue-5.4/soc-ti-smartreflex-use-irqf_no_autoen-flag-in-reques.patch new file mode 100644 index 00000000000..1838c27702a --- /dev/null +++ b/queue-5.4/soc-ti-smartreflex-use-irqf_no_autoen-flag-in-reques.patch @@ -0,0 +1,45 @@ +From d6af530513cf3aa333147dc22371fb4caa35b2eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2024 11:41:47 +0800 +Subject: soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq() + +From: Jinjie Ruan + +[ Upstream commit 16a0a69244240cfa32c525c021c40f85e090557a ] + +If request_irq() fails in sr_late_init(), there is no need to enable +the irq, and if it succeeds, disable_irq() after request_irq() still has +a time gap in which interrupts can come. + +request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when +request IRQ. + +Fixes: 1279ba5916f6 ("OMAP3+: SR: disable interrupt by default") +Signed-off-by: Jinjie Ruan +Link: https://lore.kernel.org/r/20240912034147.3014213-1-ruanjinjie@huawei.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + drivers/power/avs/smartreflex.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/avs/smartreflex.c b/drivers/power/avs/smartreflex.c +index 2365efe2dae15..2fe4dbbab46d2 100644 +--- a/drivers/power/avs/smartreflex.c ++++ b/drivers/power/avs/smartreflex.c +@@ -213,10 +213,10 @@ static int sr_late_init(struct omap_sr *sr_info) + + if (sr_class->notify && sr_class->notify_flags && sr_info->irq) { + ret = devm_request_irq(&sr_info->pdev->dev, sr_info->irq, +- sr_interrupt, 0, sr_info->name, sr_info); ++ sr_interrupt, IRQF_NO_AUTOEN, ++ sr_info->name, sr_info); + if (ret) + goto error; +- disable_irq(sr_info->irq); + } + + if (pdata && pdata->enable_on_init) +-- +2.43.0 + diff --git a/queue-5.4/staging-greybus-uart-clean-up-tiocgserial.patch b/queue-5.4/staging-greybus-uart-clean-up-tiocgserial.patch new file mode 100644 index 00000000000..a1effce1824 --- /dev/null +++ b/queue-5.4/staging-greybus-uart-clean-up-tiocgserial.patch @@ -0,0 +1,60 @@ +From 09080a42f8447a79d861a6c455e4b2da9874d443 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 12:23:25 +0200 +Subject: staging: greybus: uart: clean up TIOCGSERIAL + +From: Johan Hovold + +[ Upstream commit d38be702452137fa82a56ff7cc577d829add1637 ] + +TIOCSSERIAL is a horrid, underspecified, legacy interface which for most +serial devices is only useful for setting the close_delay and +closing_wait parameters. + +The xmit_fifo_size parameter could be used to set the hardware transmit +fifo size of a legacy UART when it could not be detected, but the +interface is limited to eight bits and should be left unset when not +used. + +Similarly, baud_base could be used to set the UART base clock when it +could not be detected but might as well be left unset when it is not +known. + +The type parameter could be used to set the UART type, but is +better left unspecified (type unknown) when it isn't used. + +Note that some applications have historically expected TIOCGSERIAL to be +implemented, but judging from the Debian sources, the port type not +being PORT_UNKNOWN is only used to check for the existence of legacy +serial ports (ttySn). Notably USB serial drivers like ftdi_sio have been +using PORT_UNKNOWN for twenty years without any problems. + +Drop the bogus values provided by the greybus implementation. + +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407102334.32361-8-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: fe0ebeafc3b7 ("staging: greybus: uart: Fix atomicity violation in get_serial_info()") +Signed-off-by: Sasha Levin +--- + drivers/staging/greybus/uart.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c +index 0e6bebc20695d..b8da6dc5d4d4d 100644 +--- a/drivers/staging/greybus/uart.c ++++ b/drivers/staging/greybus/uart.c +@@ -621,10 +621,7 @@ static int get_serial_info(struct tty_struct *tty, + { + struct gb_tty *gb_tty = tty->driver_data; + +- ss->type = PORT_16550A; + ss->line = gb_tty->minor; +- ss->xmit_fifo_size = 16; +- ss->baud_base = 9600; + ss->close_delay = jiffies_to_msecs(gb_tty->port.close_delay) / 10; + ss->closing_wait = + gb_tty->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ? +-- +2.43.0 + diff --git a/queue-5.4/staging-greybus-uart-fix-atomicity-violation-in-get_.patch b/queue-5.4/staging-greybus-uart-fix-atomicity-violation-in-get_.patch new file mode 100644 index 00000000000..b983c989ad8 --- /dev/null +++ b/queue-5.4/staging-greybus-uart-fix-atomicity-violation-in-get_.patch @@ -0,0 +1,49 @@ +From c24368adc983d40ef1080a6c1d3b40d4393614d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 19:33:37 +0800 +Subject: staging: greybus: uart: Fix atomicity violation in get_serial_info() + +From: Qiu-ji Chen + +[ Upstream commit fe0ebeafc3b723b2f8edf27ecec6d353b08397df ] + +Our static checker found a bug where set_serial_info() uses a mutex, but +get_serial_info() does not. Fortunately, the impact of this is relatively +minor. It doesn't cause a crash or any other serious issues. However, if a +race condition occurs between set_serial_info() and get_serial_info(), +there is a chance that the data returned by get_serial_info() will be +meaningless. + +Signed-off-by: Qiu-ji Chen +Fixes: 0aad5ad563c8 ("greybus/uart: switch to ->[sg]et_serial()") +Reviewed-by: Johan Hovold +Reviewed-by: Dan Carpenter +Reviewed-by: Alex Elder +Link: https://lore.kernel.org/r/20241107113337.402042-1-chenqiuji666@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/greybus/uart.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c +index b8da6dc5d4d4d..ae83255e9046c 100644 +--- a/drivers/staging/greybus/uart.c ++++ b/drivers/staging/greybus/uart.c +@@ -622,11 +622,13 @@ static int get_serial_info(struct tty_struct *tty, + struct gb_tty *gb_tty = tty->driver_data; + + ss->line = gb_tty->minor; ++ mutex_lock(&gb_tty->port.mutex); + ss->close_delay = jiffies_to_msecs(gb_tty->port.close_delay) / 10; + ss->closing_wait = + gb_tty->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ? + ASYNC_CLOSING_WAIT_NONE : + jiffies_to_msecs(gb_tty->port.closing_wait) / 10; ++ mutex_unlock(&gb_tty->port.mutex); + + return 0; + } +-- +2.43.0 + diff --git a/queue-5.4/tg3-set-coherent-dma-mask-bits-to-31-for-bcm57766-ch.patch b/queue-5.4/tg3-set-coherent-dma-mask-bits-to-31-for-bcm57766-ch.patch new file mode 100644 index 00000000000..db4e1d5d212 --- /dev/null +++ b/queue-5.4/tg3-set-coherent-dma-mask-bits-to-31-for-bcm57766-ch.patch @@ -0,0 +1,61 @@ +From f0fba0600572a9f593be696671e8dfaa10ad911b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2024 21:57:41 -0800 +Subject: tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets + +From: Pavan Chebbi + +[ Upstream commit 614f4d166eeeb9bd709b0ad29552f691c0f45776 ] + +The hardware on Broadcom 1G chipsets have a known limitation +where they cannot handle DMA addresses that cross over 4GB. +When such an address is encountered, the hardware sets the +address overflow error bit in the DMA status register and +triggers a reset. + +However, BCM57766 hardware is setting the overflow bit and +triggering a reset in some cases when there is no actual +underlying address overflow. The hardware team analyzed the +issue and concluded that it is happening when the status +block update has an address with higher (b16 to b31) bits +as 0xffff following a previous update that had lowest bits +as 0xffff. + +To work around this bug in the BCM57766 hardware, set the +coherent dma mask from the current 64b to 31b. This will +ensure that upper bits of the status block DMA address are +always at most 0x7fff, thus avoiding the improper overflow +check described above. This work around is intended for only +status block and ring memories and has no effect on TX and +RX buffers as they do not require coherent memory. + +Fixes: 72f2afb8a685 ("[TG3]: Add DMA address workaround") +Reported-by: Salam Noureddine +Reviewed-by: Kalesh AP +Reviewed-by: Somnath Kotur +Signed-off-by: Pavan Chebbi +Reviewed-by: Michal Kubiak +Link: https://patch.msgid.link/20241119055741.147144-1-pavan.chebbi@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 4847441cf161d..b060e1fe3bab4 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -17815,6 +17815,9 @@ static int tg3_init_one(struct pci_dev *pdev, + } else + persist_dma_mask = dma_mask = DMA_BIT_MASK(64); + ++ if (tg3_asic_rev(tp) == ASIC_REV_57766) ++ persist_dma_mask = DMA_BIT_MASK(31); ++ + /* Configure DMA attributes. */ + if (dma_mask > DMA_BIT_MASK(32)) { + err = pci_set_dma_mask(pdev, dma_mask); +-- +2.43.0 + diff --git a/queue-5.4/time-fix-references-to-_msecs_to_jiffies-handling-of.patch b/queue-5.4/time-fix-references-to-_msecs_to_jiffies-handling-of.patch new file mode 100644 index 00000000000..633d98df6b1 --- /dev/null +++ b/queue-5.4/time-fix-references-to-_msecs_to_jiffies-handling-of.patch @@ -0,0 +1,55 @@ +From 772c0de3596a844b1e4b5a9b6c803bd4bc4ee0cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 13:01:41 +0200 +Subject: time: Fix references to _msecs_to_jiffies() handling of values + +From: Miguel Ojeda + +[ Upstream commit 92b043fd995a63a57aae29ff85a39b6f30cd440c ] + +The details about the handling of the "normal" values were moved +to the _msecs_to_jiffies() helpers in commit ca42aaf0c861 ("time: +Refactor msecs_to_jiffies"). However, the same commit still mentioned +__msecs_to_jiffies() in the added documentation. + +Thus point to _msecs_to_jiffies() instead. + +Fixes: ca42aaf0c861 ("time: Refactor msecs_to_jiffies") +Signed-off-by: Miguel Ojeda +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/all/20241025110141.157205-2-ojeda@kernel.org +Signed-off-by: Sasha Levin +--- + include/linux/jiffies.h | 2 +- + kernel/time/time.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h +index 1b6d31da7cbc3..c078f28bbc10b 100644 +--- a/include/linux/jiffies.h ++++ b/include/linux/jiffies.h +@@ -350,7 +350,7 @@ static inline unsigned long _msecs_to_jiffies(const unsigned int m) + * - all other values are converted to jiffies by either multiplying + * the input value by a factor or dividing it with a factor and + * handling any 32-bit overflows. +- * for the details see __msecs_to_jiffies() ++ * for the details see _msecs_to_jiffies() + * + * msecs_to_jiffies() checks for the passed in value being a constant + * via __builtin_constant_p() allowing gcc to eliminate most of the +diff --git a/kernel/time/time.c b/kernel/time/time.c +index 83f403e7a15c4..8660090669879 100644 +--- a/kernel/time/time.c ++++ b/kernel/time/time.c +@@ -581,7 +581,7 @@ EXPORT_SYMBOL(ns_to_timespec64); + * - all other values are converted to jiffies by either multiplying + * the input value by a factor or dividing it with a factor and + * handling any 32-bit overflows. +- * for the details see __msecs_to_jiffies() ++ * for the details see _msecs_to_jiffies() + * + * msecs_to_jiffies() checks for the passed in value being a constant + * via __builtin_constant_p() allowing gcc to eliminate most of the +-- +2.43.0 + diff --git a/queue-5.4/tpm-fix-signed-unsigned-bug-when-checking-event-logs.patch b/queue-5.4/tpm-fix-signed-unsigned-bug-when-checking-event-logs.patch new file mode 100644 index 00000000000..44a7540d1af --- /dev/null +++ b/queue-5.4/tpm-fix-signed-unsigned-bug-when-checking-event-logs.patch @@ -0,0 +1,83 @@ +From 6be3d508847ff39b20c3f62fe410a08dee2ead10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Sep 2024 19:19:51 -0400 +Subject: tpm: fix signed/unsigned bug when checking event logs + +From: Gregory Price + +[ Upstream commit e6d654e9f5a97742cfe794b1c4bb5d3fb2d25e98 ] + +A prior bugfix that fixes a signed/unsigned error causes +another signed unsigned error. + +A situation where log_tbl->size is invalid can cause the +size passed to memblock_reserve to become negative. + +log_size from the main event log is an unsigned int, and +the code reduces to the following + +u64 value = (int)unsigned_value; + +This results in sign extension, and the value sent to +memblock_reserve becomes effectively negative. + +Fixes: be59d57f9806 ("efi/tpm: Fix sanity check of unsigned tbl_size being less than zero") +Signed-off-by: Gregory Price +Reviewed-by: Ilias Apalodimas +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/tpm.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c +index e8d69bd548f3f..9c3613e6af158 100644 +--- a/drivers/firmware/efi/tpm.c ++++ b/drivers/firmware/efi/tpm.c +@@ -40,7 +40,8 @@ int __init efi_tpm_eventlog_init(void) + { + struct linux_efi_tpm_eventlog *log_tbl; + struct efi_tcg2_final_events_table *final_tbl; +- int tbl_size; ++ unsigned int tbl_size; ++ int final_tbl_size; + int ret = 0; + + if (efi.tpm_log == EFI_INVALID_TABLE_ADDR) { +@@ -80,26 +81,26 @@ int __init efi_tpm_eventlog_init(void) + goto out; + } + +- tbl_size = 0; ++ final_tbl_size = 0; + if (final_tbl->nr_events != 0) { + void *events = (void *)efi.tpm_final_log + + sizeof(final_tbl->version) + + sizeof(final_tbl->nr_events); + +- tbl_size = tpm2_calc_event_log_size(events, +- final_tbl->nr_events, +- log_tbl->log); ++ final_tbl_size = tpm2_calc_event_log_size(events, ++ final_tbl->nr_events, ++ log_tbl->log); + } + +- if (tbl_size < 0) { ++ if (final_tbl_size < 0) { + pr_err(FW_BUG "Failed to parse event in TPM Final Events Log\n"); + ret = -EINVAL; + goto out_calc; + } + + memblock_reserve(efi.tpm_final_log, +- tbl_size + sizeof(*final_tbl)); +- efi_tpm_final_log_size = tbl_size; ++ final_tbl_size + sizeof(*final_tbl)); ++ efi_tpm_final_log_size = final_tbl_size; + + out_calc: + early_memunmap(final_tbl, sizeof(*final_tbl)); +-- +2.43.0 + diff --git a/queue-5.4/trace-trace_event_perf-remove-duplicate-samples-on-t.patch b/queue-5.4/trace-trace_event_perf-remove-duplicate-samples-on-t.patch new file mode 100644 index 00000000000..ca11a741785 --- /dev/null +++ b/queue-5.4/trace-trace_event_perf-remove-duplicate-samples-on-t.patch @@ -0,0 +1,83 @@ +From 1e6be902847505e61475f8526b2d7585a9b4e749 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Sep 2024 03:13:47 +0100 +Subject: trace/trace_event_perf: remove duplicate samples on the first + tracepoint event + +From: Levi Yun + +[ Upstream commit afe5960dc208fe069ddaaeb0994d857b24ac19d1 ] + +When a tracepoint event is created with attr.freq = 1, +'hwc->period_left' is not initialized correctly. As a result, +in the perf_swevent_overflow() function, when the first time the event occurs, +it calculates the event overflow and the perf_swevent_set_period() returns 3, +this leads to the event are recorded for three duplicate times. + +Step to reproduce: + 1. Enable the tracepoint event & starting tracing + $ echo 1 > /sys/kernel/tracing/events/module/module_free + $ echo 1 > /sys/kernel/tracing/tracing_on + + 2. Record with perf + $ perf record -a --strict-freq -F 1 -e "module:module_free" + + 3. Trigger module_free event. + $ modprobe -i sunrpc + $ modprobe -r sunrpc + +Result: + - Trace pipe result: + $ cat trace_pipe + modprobe-174509 [003] ..... 6504.868896: module_free: sunrpc + + - perf sample: + modprobe 174509 [003] 6504.868980: module:module_free: sunrpc + modprobe 174509 [003] 6504.868980: module:module_free: sunrpc + modprobe 174509 [003] 6504.868980: module:module_free: sunrpc + +By setting period_left via perf_swevent_set_period() as other sw_event did, +This problem could be solved. + +After patch: + - Trace pipe result: + $ cat trace_pipe + modprobe 1153096 [068] 613468.867774: module:module_free: xfs + + - perf sample + modprobe 1153096 [068] 613468.867794: module:module_free: xfs + +Link: https://lore.kernel.org/20240913021347.595330-1-yeoreum.yun@arm.com +Fixes: bd2b5b12849a ("perf_counter: More aggressive frequency adjustment") +Signed-off-by: Levi Yun +Acked-by: Namhyung Kim +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_event_perf.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c +index 563c0e659a40e..3de49b3f4cae1 100644 +--- a/kernel/trace/trace_event_perf.c ++++ b/kernel/trace/trace_event_perf.c +@@ -350,10 +350,16 @@ void perf_uprobe_destroy(struct perf_event *p_event) + int perf_trace_add(struct perf_event *p_event, int flags) + { + struct trace_event_call *tp_event = p_event->tp_event; ++ struct hw_perf_event *hwc = &p_event->hw; + + if (!(flags & PERF_EF_START)) + p_event->hw.state = PERF_HES_STOPPED; + ++ if (is_sampling_event(p_event)) { ++ hwc->last_period = hwc->sample_period; ++ perf_swevent_set_period(p_event); ++ } ++ + /* + * If TRACE_REG_PERF_ADD returns false; no custom action was performed + * and we need to take the default action of enqueueing our event on +-- +2.43.0 + diff --git a/queue-5.4/usb-chaoskey-fail-open-after-removal.patch b/queue-5.4/usb-chaoskey-fail-open-after-removal.patch new file mode 100644 index 00000000000..446dd0be75d --- /dev/null +++ b/queue-5.4/usb-chaoskey-fail-open-after-removal.patch @@ -0,0 +1,146 @@ +From 99eda3ed081b4cdb47784b486c98ad09d407c17d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2024 15:21:41 +0200 +Subject: USB: chaoskey: fail open after removal + +From: Oliver Neukum + +[ Upstream commit 422dc0a4d12d0b80dd3aab3fe5943f665ba8f041 ] + +chaoskey_open() takes the lock only to increase the +counter of openings. That means that the mutual exclusion +with chaoskey_disconnect() cannot prevent an increase +of the counter and chaoskey_open() returning a success. + +If that race is hit, chaoskey_disconnect() will happily +free all resources associated with the device after +it has dropped the lock, as it has read the counter +as zero. + +To prevent this race chaoskey_open() has to check +the presence of the device under the lock. +However, the current per device lock cannot be used, +because it is a part of the data structure to be +freed. Hence an additional global mutex is needed. +The issue is as old as the driver. + +Signed-off-by: Oliver Neukum +Reported-by: syzbot+422188bce66e76020e55@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=422188bce66e76020e55 +Fixes: 66e3e591891da ("usb: Add driver for Altus Metrum ChaosKey device (v2)") +Rule: add +Link: https://lore.kernel.org/stable/20241002132201.552578-1-oneukum%40suse.com +Link: https://lore.kernel.org/r/20241002132201.552578-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/chaoskey.c | 35 ++++++++++++++++++++++++----------- + 1 file changed, 24 insertions(+), 11 deletions(-) + +diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c +index 87067c3d6109b..32fa7fd50c380 100644 +--- a/drivers/usb/misc/chaoskey.c ++++ b/drivers/usb/misc/chaoskey.c +@@ -27,6 +27,8 @@ static struct usb_class_driver chaoskey_class; + static int chaoskey_rng_read(struct hwrng *rng, void *data, + size_t max, bool wait); + ++static DEFINE_MUTEX(chaoskey_list_lock); ++ + #define usb_dbg(usb_if, format, arg...) \ + dev_dbg(&(usb_if)->dev, format, ## arg) + +@@ -231,6 +233,7 @@ static void chaoskey_disconnect(struct usb_interface *interface) + if (dev->hwrng_registered) + hwrng_unregister(&dev->hwrng); + ++ mutex_lock(&chaoskey_list_lock); + usb_deregister_dev(interface, &chaoskey_class); + + usb_set_intfdata(interface, NULL); +@@ -245,6 +248,7 @@ static void chaoskey_disconnect(struct usb_interface *interface) + } else + mutex_unlock(&dev->lock); + ++ mutex_unlock(&chaoskey_list_lock); + usb_dbg(interface, "disconnect done"); + } + +@@ -252,6 +256,7 @@ static int chaoskey_open(struct inode *inode, struct file *file) + { + struct chaoskey *dev; + struct usb_interface *interface; ++ int rv = 0; + + /* get the interface from minor number and driver information */ + interface = usb_find_interface(&chaoskey_driver, iminor(inode)); +@@ -267,18 +272,23 @@ static int chaoskey_open(struct inode *inode, struct file *file) + } + + file->private_data = dev; ++ mutex_lock(&chaoskey_list_lock); + mutex_lock(&dev->lock); +- ++dev->open; ++ if (dev->present) ++ ++dev->open; ++ else ++ rv = -ENODEV; + mutex_unlock(&dev->lock); ++ mutex_unlock(&chaoskey_list_lock); + +- usb_dbg(interface, "open success"); +- return 0; ++ return rv; + } + + static int chaoskey_release(struct inode *inode, struct file *file) + { + struct chaoskey *dev = file->private_data; + struct usb_interface *interface; ++ int rv = 0; + + if (dev == NULL) + return -ENODEV; +@@ -287,14 +297,15 @@ static int chaoskey_release(struct inode *inode, struct file *file) + + usb_dbg(interface, "release"); + ++ mutex_lock(&chaoskey_list_lock); + mutex_lock(&dev->lock); + + usb_dbg(interface, "open count at release is %d", dev->open); + + if (dev->open <= 0) { + usb_dbg(interface, "invalid open count (%d)", dev->open); +- mutex_unlock(&dev->lock); +- return -ENODEV; ++ rv = -ENODEV; ++ goto bail; + } + + --dev->open; +@@ -303,13 +314,15 @@ static int chaoskey_release(struct inode *inode, struct file *file) + if (dev->open == 0) { + mutex_unlock(&dev->lock); + chaoskey_free(dev); +- } else +- mutex_unlock(&dev->lock); +- } else +- mutex_unlock(&dev->lock); +- ++ goto destruction; ++ } ++ } ++bail: ++ mutex_unlock(&dev->lock); ++destruction: ++ mutex_lock(&chaoskey_list_lock); + usb_dbg(interface, "release success"); +- return 0; ++ return rv; + } + + static void chaos_read_callback(struct urb *urb) +-- +2.43.0 + diff --git a/queue-5.4/usb-chaoskey-fix-possible-deadlock-chaoskey_list_loc.patch b/queue-5.4/usb-chaoskey-fix-possible-deadlock-chaoskey_list_loc.patch new file mode 100644 index 00000000000..efefc1ba678 --- /dev/null +++ b/queue-5.4/usb-chaoskey-fix-possible-deadlock-chaoskey_list_loc.patch @@ -0,0 +1,154 @@ +From 953e8d9b6b726769f1d918bbbabee6da5e0ec478 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2024 22:52:07 +0800 +Subject: USB: chaoskey: Fix possible deadlock chaoskey_list_lock + +From: Edward Adam Davis + +[ Upstream commit d73dc7b182be4238b75278bfae16afb4c5564a58 ] + +[Syzbot reported two possible deadlocks] +The first possible deadlock is: +WARNING: possible recursive locking detected +6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0 Not tainted +-------------------------------------------- +syz-executor363/2651 is trying to acquire lock: +ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x15d/0x2c0 drivers/usb/misc/chaoskey.c:322 + +but task is already holding lock: +ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x7f/0x2c0 drivers/usb/misc/chaoskey.c:299 + +other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(chaoskey_list_lock); + lock(chaoskey_list_lock); + + *** DEADLOCK *** + +The second possible deadlock is: +WARNING: possible circular locking dependency detected +6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0 Not tainted +------------------------------------------------------ +kworker/0:2/804 is trying to acquire lock: +ffffffff899dadb0 (minor_rwsem){++++}-{3:3}, at: usb_deregister_dev+0x7c/0x1e0 drivers/usb/core/file.c:186 + +but task is already holding lock: +ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_disconnect+0xa8/0x2a0 drivers/usb/misc/chaoskey.c:235 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (chaoskey_list_lock){+.+.}-{3:3}: + __mutex_lock_common kernel/locking/mutex.c:608 [inline] + __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752 + chaoskey_open+0xdd/0x220 drivers/usb/misc/chaoskey.c:274 + usb_open+0x186/0x220 drivers/usb/core/file.c:47 + chrdev_open+0x237/0x6a0 fs/char_dev.c:414 + do_dentry_open+0x6cb/0x1390 fs/open.c:958 + vfs_open+0x82/0x3f0 fs/open.c:1088 + do_open fs/namei.c:3774 [inline] + path_openat+0x1e6a/0x2d60 fs/namei.c:3933 + do_filp_open+0x1dc/0x430 fs/namei.c:3960 + do_sys_openat2+0x17a/0x1e0 fs/open.c:1415 + do_sys_open fs/open.c:1430 [inline] + __do_sys_openat fs/open.c:1446 [inline] + __se_sys_openat fs/open.c:1441 [inline] + __x64_sys_openat+0x175/0x210 fs/open.c:1441 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +-> #0 (minor_rwsem){++++}-{3:3}: + check_prev_add kernel/locking/lockdep.c:3161 [inline] + check_prevs_add kernel/locking/lockdep.c:3280 [inline] + validate_chain kernel/locking/lockdep.c:3904 [inline] + __lock_acquire+0x250b/0x3ce0 kernel/locking/lockdep.c:5202 + lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 + down_write+0x93/0x200 kernel/locking/rwsem.c:1577 + usb_deregister_dev+0x7c/0x1e0 drivers/usb/core/file.c:186 + chaoskey_disconnect+0xb7/0x2a0 drivers/usb/misc/chaoskey.c:236 + usb_unbind_interface+0x1e8/0x970 drivers/usb/core/driver.c:461 + device_remove drivers/base/dd.c:569 [inline] + device_remove+0x122/0x170 drivers/base/dd.c:561 + __device_release_driver drivers/base/dd.c:1273 [inline] + device_release_driver_internal+0x44a/0x610 drivers/base/dd.c:1296 + bus_remove_device+0x22f/0x420 drivers/base/bus.c:576 + device_del+0x396/0x9f0 drivers/base/core.c:3864 + usb_disable_device+0x36c/0x7f0 drivers/usb/core/message.c:1418 + usb_disconnect+0x2e1/0x920 drivers/usb/core/hub.c:2304 + hub_port_connect drivers/usb/core/hub.c:5361 [inline] + hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] + port_event drivers/usb/core/hub.c:5821 [inline] + hub_event+0x1bed/0x4f40 drivers/usb/core/hub.c:5903 + process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229 + process_scheduled_works kernel/workqueue.c:3310 [inline] + worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 + kthread+0x2c1/0x3a0 kernel/kthread.c:389 + ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(chaoskey_list_lock); + lock(minor_rwsem); + lock(chaoskey_list_lock); + lock(minor_rwsem); + + *** DEADLOCK *** +[Analysis] +The first is AA lock, it because wrong logic, it need a unlock. +The second is AB lock, it needs to rearrange the order of lock usage. + +Fixes: 422dc0a4d12d ("USB: chaoskey: fail open after removal") +Reported-by: syzbot+685e14d04fe35692d3bc@syzkaller.appspotmail.com +Reported-by: syzbot+1f8ca5ee82576ec01f12@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=685e14d04fe35692d3bc +Signed-off-by: Edward Adam Davis +Tested-by: syzbot+685e14d04fe35692d3bc@syzkaller.appspotmail.com +Reported-by: syzbot+5f1ce62e956b7b19610e@syzkaller.appspotmail.com +Tested-by: syzbot+5f1ce62e956b7b19610e@syzkaller.appspotmail.com +Tested-by: syzbot+1f8ca5ee82576ec01f12@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/tencent_84EB865C89862EC22EE94CB3A7C706C59206@qq.com +Cc: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/chaoskey.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c +index 32fa7fd50c380..d99d424c05a7a 100644 +--- a/drivers/usb/misc/chaoskey.c ++++ b/drivers/usb/misc/chaoskey.c +@@ -233,10 +233,10 @@ static void chaoskey_disconnect(struct usb_interface *interface) + if (dev->hwrng_registered) + hwrng_unregister(&dev->hwrng); + +- mutex_lock(&chaoskey_list_lock); + usb_deregister_dev(interface, &chaoskey_class); + + usb_set_intfdata(interface, NULL); ++ mutex_lock(&chaoskey_list_lock); + mutex_lock(&dev->lock); + + dev->present = false; +@@ -320,7 +320,7 @@ static int chaoskey_release(struct inode *inode, struct file *file) + bail: + mutex_unlock(&dev->lock); + destruction: +- mutex_lock(&chaoskey_list_lock); ++ mutex_unlock(&chaoskey_list_lock); + usb_dbg(interface, "release success"); + return rv; + } +-- +2.43.0 + diff --git a/queue-5.4/usb-using-mutex-lock-and-supporting-o_nonblock-flag-.patch b/queue-5.4/usb-using-mutex-lock-and-supporting-o_nonblock-flag-.patch new file mode 100644 index 00000000000..3e603e78d3d --- /dev/null +++ b/queue-5.4/usb-using-mutex-lock-and-supporting-o_nonblock-flag-.patch @@ -0,0 +1,130 @@ +From 448a67909a01f20e82a21ed511261976eb1b0ebd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Sep 2024 19:34:03 +0900 +Subject: usb: using mutex lock and supporting O_NONBLOCK flag in + iowarrior_read() + +From: Jeongjun Park + +[ Upstream commit 44feafbaa66ec86232b123bb8437a6a262442025 ] + +iowarrior_read() uses the iowarrior dev structure, but does not use any +lock on the structure. This can cause various bugs including data-races, +so it is more appropriate to use a mutex lock to safely protect the +iowarrior dev structure. When using a mutex lock, you should split the +branch to prevent blocking when the O_NONBLOCK flag is set. + +In addition, it is unnecessary to check for NULL on the iowarrior dev +structure obtained by reading file->private_data. Therefore, it is +better to remove the check. + +Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.") +Signed-off-by: Jeongjun Park +Link: https://lore.kernel.org/r/20240919103403.3986-1-aha310510@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/iowarrior.c | 46 ++++++++++++++++++++++++++++-------- + 1 file changed, 36 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c +index c366a65fbd802..f23291da25498 100644 +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -277,28 +277,45 @@ static ssize_t iowarrior_read(struct file *file, char __user *buffer, + struct iowarrior *dev; + int read_idx; + int offset; ++ int retval; + + dev = file->private_data; + ++ if (file->f_flags & O_NONBLOCK) { ++ retval = mutex_trylock(&dev->mutex); ++ if (!retval) ++ return -EAGAIN; ++ } else { ++ retval = mutex_lock_interruptible(&dev->mutex); ++ if (retval) ++ return -ERESTARTSYS; ++ } ++ + /* verify that the device wasn't unplugged */ +- if (!dev || !dev->present) +- return -ENODEV; ++ if (!dev->present) { ++ retval = -ENODEV; ++ goto exit; ++ } + + dev_dbg(&dev->interface->dev, "minor %d, count = %zd\n", + dev->minor, count); + + /* read count must be packet size (+ time stamp) */ + if ((count != dev->report_size) +- && (count != (dev->report_size + 1))) +- return -EINVAL; ++ && (count != (dev->report_size + 1))) { ++ retval = -EINVAL; ++ goto exit; ++ } + + /* repeat until no buffer overrun in callback handler occur */ + do { + atomic_set(&dev->overflow_flag, 0); + if ((read_idx = read_index(dev)) == -1) { + /* queue empty */ +- if (file->f_flags & O_NONBLOCK) +- return -EAGAIN; ++ if (file->f_flags & O_NONBLOCK) { ++ retval = -EAGAIN; ++ goto exit; ++ } + else { + //next line will return when there is either new data, or the device is unplugged + int r = wait_event_interruptible(dev->read_wait, +@@ -309,28 +326,37 @@ static ssize_t iowarrior_read(struct file *file, char __user *buffer, + -1)); + if (r) { + //we were interrupted by a signal +- return -ERESTART; ++ retval = -ERESTART; ++ goto exit; + } + if (!dev->present) { + //The device was unplugged +- return -ENODEV; ++ retval = -ENODEV; ++ goto exit; + } + if (read_idx == -1) { + // Can this happen ??? +- return 0; ++ retval = 0; ++ goto exit; + } + } + } + + offset = read_idx * (dev->report_size + 1); + if (copy_to_user(buffer, dev->read_queue + offset, count)) { +- return -EFAULT; ++ retval = -EFAULT; ++ goto exit; + } + } while (atomic_read(&dev->overflow_flag)); + + read_idx = ++read_idx == MAX_INTERRUPT_BUFFER ? 0 : read_idx; + atomic_set(&dev->read_idx, read_idx); ++ mutex_unlock(&dev->mutex); + return count; ++ ++exit: ++ mutex_unlock(&dev->mutex); ++ return retval; + } + + /* +-- +2.43.0 + diff --git a/queue-5.4/usb-yurex-make-waiting-on-yurex_write-interruptible.patch b/queue-5.4/usb-yurex-make-waiting-on-yurex_write-interruptible.patch new file mode 100644 index 00000000000..fd1cdc6ef82 --- /dev/null +++ b/queue-5.4/usb-yurex-make-waiting-on-yurex_write-interruptible.patch @@ -0,0 +1,68 @@ +From 3ac4f8948df1431538f89fa2bf938ded51ed5d75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2024 10:43:45 +0200 +Subject: usb: yurex: make waiting on yurex_write interruptible + +From: Oliver Neukum + +[ Upstream commit e0aa9614ab0fd35b404e4b16ebe879f9fc152591 ] + +The IO yurex_write() needs to wait for in order to have a device +ready for writing again can take a long time time. +Consequently the sleep is done in an interruptible state. +Therefore others waiting for yurex_write() itself to finish should +use mutex_lock_interruptible. + +Signed-off-by: Oliver Neukum +Fixes: 6bc235a2e24a5 ("USB: add driver for Meywa-Denki & Kayac YUREX") +Rule: add +Link: https://lore.kernel.org/stable/20240924084415.300557-1-oneukum%40suse.com +Link: https://lore.kernel.org/r/20240924084415.300557-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/iowarrior.c | 4 ---- + drivers/usb/misc/yurex.c | 5 ++++- + 2 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c +index f23291da25498..9869dda48ddea 100644 +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -915,7 +915,6 @@ static int iowarrior_probe(struct usb_interface *interface, + static void iowarrior_disconnect(struct usb_interface *interface) + { + struct iowarrior *dev = usb_get_intfdata(interface); +- int minor = dev->minor; + + usb_deregister_dev(interface, &iowarrior_class); + +@@ -939,9 +938,6 @@ static void iowarrior_disconnect(struct usb_interface *interface) + mutex_unlock(&dev->mutex); + iowarrior_delete(dev); + } +- +- dev_info(&interface->dev, "I/O-Warror #%d now disconnected\n", +- minor - IOWARRIOR_MINOR_BASE); + } + + /* usb specific object needed to register this driver with the usb subsystem */ +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c +index de2cc882f5765..6d6904856839a 100644 +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -442,7 +442,10 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + if (count == 0) + goto error; + +- mutex_lock(&dev->io_mutex); ++ retval = mutex_lock_interruptible(&dev->io_mutex); ++ if (retval < 0) ++ return -EINTR; ++ + if (dev->disconnected) { /* already disconnected */ + mutex_unlock(&dev->io_mutex); + retval = -ENODEV; +-- +2.43.0 + diff --git a/queue-5.4/vfio-pci-properly-hide-first-in-list-pcie-extended-c.patch b/queue-5.4/vfio-pci-properly-hide-first-in-list-pcie-extended-c.patch new file mode 100644 index 00000000000..ad87f1e21b0 --- /dev/null +++ b/queue-5.4/vfio-pci-properly-hide-first-in-list-pcie-extended-c.patch @@ -0,0 +1,115 @@ +From 5c632526bef048ce0aeec58b8fe2178f4dca6d14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Nov 2024 16:27:39 +0200 +Subject: vfio/pci: Properly hide first-in-list PCIe extended capability + +From: Avihai Horon + +[ Upstream commit fe4bf8d0b6716a423b16495d55b35d3fe515905d ] + +There are cases where a PCIe extended capability should be hidden from +the user. For example, an unknown capability (i.e., capability with ID +greater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally +chosen to be hidden from the user. + +Hiding a capability is done by virtualizing and modifying the 'Next +Capability Offset' field of the previous capability so it points to the +capability after the one that should be hidden. + +The special case where the first capability in the list should be hidden +is handled differently because there is no previous capability that can +be modified. In this case, the capability ID and version are zeroed +while leaving the next pointer intact. This hides the capability and +leaves an anchor for the rest of the capability list. + +However, today, hiding the first capability in the list is not done +properly if the capability is unknown, as struct +vfio_pci_core_device->pci_config_map is set to the capability ID during +initialization but the capability ID is not properly checked later when +used in vfio_config_do_rw(). This leads to the following warning [1] and +to an out-of-bounds access to ecap_perms array. + +Fix it by checking cap_id in vfio_config_do_rw(), and if it is greater +than PCI_EXT_CAP_ID_MAX, use an alternative struct perm_bits for direct +read only access instead of the ecap_perms array. + +Note that this is safe since the above is the only case where cap_id can +exceed PCI_EXT_CAP_ID_MAX (except for the special capabilities, which +are already checked before). + +[1] + +WARNING: CPU: 118 PID: 5329 at drivers/vfio/pci/vfio_pci_config.c:1900 vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] +CPU: 118 UID: 0 PID: 5329 Comm: simx-qemu-syste Not tainted 6.12.0+ #1 +(snip) +Call Trace: + + ? show_regs+0x69/0x80 + ? __warn+0x8d/0x140 + ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] + ? report_bug+0x18f/0x1a0 + ? handle_bug+0x63/0xa0 + ? exc_invalid_op+0x19/0x70 + ? asm_exc_invalid_op+0x1b/0x20 + ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] + ? vfio_pci_config_rw+0x244/0x430 [vfio_pci_core] + vfio_pci_rw+0x101/0x1b0 [vfio_pci_core] + vfio_pci_core_read+0x1d/0x30 [vfio_pci_core] + vfio_device_fops_read+0x27/0x40 [vfio] + vfs_read+0xbd/0x340 + ? vfio_device_fops_unl_ioctl+0xbb/0x740 [vfio] + ? __rseq_handle_notify_resume+0xa4/0x4b0 + __x64_sys_pread64+0x96/0xc0 + x64_sys_call+0x1c3d/0x20d0 + do_syscall_64+0x4d/0x120 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver") +Signed-off-by: Avihai Horon +Reviewed-by: Yi Liu +Tested-by: Yi Liu +Link: https://lore.kernel.org/r/20241124142739.21698-1-avihaih@nvidia.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci_config.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c +index 50cd17fcf7541..f34ee2a0c2c19 100644 +--- a/drivers/vfio/pci/vfio_pci_config.c ++++ b/drivers/vfio/pci/vfio_pci_config.c +@@ -312,6 +312,10 @@ static int vfio_virt_config_read(struct vfio_pci_device *vdev, int pos, + return count; + } + ++static struct perm_bits direct_ro_perms = { ++ .readfn = vfio_direct_config_read, ++}; ++ + /* Default capability regions to read-only, no-virtualization */ + static struct perm_bits cap_perms[PCI_CAP_ID_MAX + 1] = { + [0 ... PCI_CAP_ID_MAX] = { .readfn = vfio_direct_config_read } +@@ -1835,9 +1839,17 @@ static ssize_t vfio_config_do_rw(struct vfio_pci_device *vdev, char __user *buf, + cap_start = *ppos; + } else { + if (*ppos >= PCI_CFG_SPACE_SIZE) { +- WARN_ON(cap_id > PCI_EXT_CAP_ID_MAX); ++ /* ++ * We can get a cap_id that exceeds PCI_EXT_CAP_ID_MAX ++ * if we're hiding an unknown capability at the start ++ * of the extended capability list. Use default, ro ++ * access, which will virtualize the id and next values. ++ */ ++ if (cap_id > PCI_EXT_CAP_ID_MAX) ++ perm = &direct_ro_perms; ++ else ++ perm = &ecap_perms[cap_id]; + +- perm = &ecap_perms[cap_id]; + cap_start = vfio_find_cap_start(vdev, *ppos); + } else { + WARN_ON(cap_id > PCI_CAP_ID_MAX); +-- +2.43.0 + diff --git a/queue-5.4/wifi-ath9k-add-range-check-for-conn_rsp_epid-in-htc_.patch b/queue-5.4/wifi-ath9k-add-range-check-for-conn_rsp_epid-in-htc_.patch new file mode 100644 index 00000000000..5bef451f15e --- /dev/null +++ b/queue-5.4/wifi-ath9k-add-range-check-for-conn_rsp_epid-in-htc_.patch @@ -0,0 +1,61 @@ +From 3c1762ad42873b7d0b301c1afbf76139d30ff600 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Sep 2024 12:06:03 +0300 +Subject: wifi: ath9k: add range check for conn_rsp_epid in + htc_connect_service() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jeongjun Park + +[ Upstream commit 8619593634cbdf5abf43f5714df49b04e4ef09ab ] + +I found the following bug in my fuzzer: + + UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51 + index 255 is out of range for type 'htc_endpoint [22]' + CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 + Workqueue: events request_firmware_work_func + Call Trace: + + dump_stack_lvl+0x180/0x1b0 + __ubsan_handle_out_of_bounds+0xd4/0x130 + htc_issue_send.constprop.0+0x20c/0x230 + ? _raw_spin_unlock_irqrestore+0x3c/0x70 + ath9k_wmi_cmd+0x41d/0x610 + ? mark_held_locks+0x9f/0xe0 + ... + +Since this bug has been confirmed to be caused by insufficient verification +of conn_rsp_epid, I think it would be appropriate to add a range check for +conn_rsp_epid to htc_connect_service() to prevent the bug from occurring. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Signed-off-by: Jeongjun Park +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20240909103855.68006-1-aha310510@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_hst.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index 99667aba289df..00dc97ac53b9d 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -294,6 +294,9 @@ int htc_connect_service(struct htc_target *target, + return -ETIMEDOUT; + } + ++ if (target->conn_rsp_epid < 0 || target->conn_rsp_epid >= ENDPOINT_MAX) ++ return -EINVAL; ++ + *conn_rsp_epid = target->conn_rsp_epid; + return 0; + err: +-- +2.43.0 + diff --git a/queue-5.4/wifi-mwifiex-fix-memcpy-field-spanning-write-warning.patch b/queue-5.4/wifi-mwifiex-fix-memcpy-field-spanning-write-warning.patch new file mode 100644 index 00000000000..0801eac0c1b --- /dev/null +++ b/queue-5.4/wifi-mwifiex-fix-memcpy-field-spanning-write-warning.patch @@ -0,0 +1,56 @@ +From 4660eb8dde7afd882ef42bde16d002dd8db99959 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 01:20:54 +0300 +Subject: wifi: mwifiex: Fix memcpy() field-spanning write warning in + mwifiex_config_scan() + +From: Alper Nebi Yasak + +[ Upstream commit d241a139c2e9f8a479f25c75ebd5391e6a448500 ] + +Replace one-element array with a flexible-array member in `struct +mwifiex_ie_types_wildcard_ssid_params` to fix the following warning +on a MT8173 Chromebook (mt8173-elm-hana): + +[ 356.775250] ------------[ cut here ]------------ +[ 356.784543] memcpy: detected field-spanning write (size 6) of single field "wildcard_ssid_tlv->ssid" at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1) +[ 356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex] + +The "(size 6)" above is exactly the length of the SSID of the network +this device was connected to. The source of the warning looks like: + + ssid_len = user_scan_in->ssid_list[i].ssid_len; + [...] + memcpy(wildcard_ssid_tlv->ssid, + user_scan_in->ssid_list[i].ssid, ssid_len); + +There is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this +struct, but it already didn't account for the size of the one-element +array, so it doesn't need to be changed. + +Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") +Signed-off-by: Alper Nebi Yasak +Acked-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20241007222301.24154-1-alpernebiyasak@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h +index bfa482cf464ff..c8bf6e559dc56 100644 +--- a/drivers/net/wireless/marvell/mwifiex/fw.h ++++ b/drivers/net/wireless/marvell/mwifiex/fw.h +@@ -853,7 +853,7 @@ struct mwifiex_ietypes_chanstats { + struct mwifiex_ie_types_wildcard_ssid_params { + struct mwifiex_ie_types_header header; + u8 max_ssid_length; +- u8 ssid[1]; ++ u8 ssid[]; + } __packed; + + #define TSF_DATA_SIZE 8 +-- +2.43.0 + diff --git a/queue-5.4/wifi-mwifiex-use-irqf_no_autoen-flag-in-request_irq.patch b/queue-5.4/wifi-mwifiex-use-irqf_no_autoen-flag-in-request_irq.patch new file mode 100644 index 00000000000..3682724351a --- /dev/null +++ b/queue-5.4/wifi-mwifiex-use-irqf_no_autoen-flag-in-request_irq.patch @@ -0,0 +1,48 @@ +From 79c420f803bb3f9c37ce5de855255447f8882b9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Sep 2024 20:43:13 +0800 +Subject: wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq() + +From: Jinjie Ruan + +[ Upstream commit 9a98dd48b6d834d7a3fe5e8e7b8c3a1d006f9685 ] + +disable_irq() after request_irq() still has a time gap in which +interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will +disable IRQ auto-enable when request IRQ. + +Fixes: 853402a00823 ("mwifiex: Enable WoWLAN for both sdio and pcie") +Signed-off-by: Jinjie Ruan +Acked-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20240910124314.698896-3-ruanjinjie@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c +index 5894566ec4805..d788e2e6397ce 100644 +--- a/drivers/net/wireless/marvell/mwifiex/main.c ++++ b/drivers/net/wireless/marvell/mwifiex/main.c +@@ -1600,7 +1600,8 @@ static void mwifiex_probe_of(struct mwifiex_adapter *adapter) + } + + ret = devm_request_irq(dev, adapter->irq_wakeup, +- mwifiex_irq_wakeup_handler, IRQF_TRIGGER_LOW, ++ mwifiex_irq_wakeup_handler, ++ IRQF_TRIGGER_LOW | IRQF_NO_AUTOEN, + "wifi_wake", adapter); + if (ret) { + dev_err(dev, "Failed to request irq_wakeup %d (%d)\n", +@@ -1608,7 +1609,6 @@ static void mwifiex_probe_of(struct mwifiex_adapter *adapter) + goto err_exit; + } + +- disable_irq(adapter->irq_wakeup); + if (device_init_wakeup(dev, true)) { + dev_err(dev, "fail to init wakeup for mwifiex\n"); + goto err_exit; +-- +2.43.0 + diff --git a/queue-5.4/wifi-p54-use-irqf_no_autoen-flag-in-request_irq.patch b/queue-5.4/wifi-p54-use-irqf_no_autoen-flag-in-request_irq.patch new file mode 100644 index 00000000000..b34397f401c --- /dev/null +++ b/queue-5.4/wifi-p54-use-irqf_no_autoen-flag-in-request_irq.patch @@ -0,0 +1,47 @@ +From 150d6f7ff044df9248c602c4544b357cc0e6d3bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Sep 2024 20:43:12 +0800 +Subject: wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq() + +From: Jinjie Ruan + +[ Upstream commit bcd1371bd85e560ccc9159b7747f94bfe43b77a6 ] + +disable_irq() after request_irq() still has a time gap in which +interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will +disable IRQ auto-enable when request IRQ. + +Fixes: cd8d3d321285 ("p54spi: p54spi driver") +Signed-off-by: Jinjie Ruan +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20240910124314.698896-2-ruanjinjie@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intersil/p54/p54spi.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/intersil/p54/p54spi.c b/drivers/net/wireless/intersil/p54/p54spi.c +index cdb57819684ae..8a9168aac7281 100644 +--- a/drivers/net/wireless/intersil/p54/p54spi.c ++++ b/drivers/net/wireless/intersil/p54/p54spi.c +@@ -623,7 +623,7 @@ static int p54spi_probe(struct spi_device *spi) + gpio_direction_input(p54spi_gpio_irq); + + ret = request_irq(gpio_to_irq(p54spi_gpio_irq), +- p54spi_interrupt, 0, "p54spi", ++ p54spi_interrupt, IRQF_NO_AUTOEN, "p54spi", + priv->spi); + if (ret < 0) { + dev_err(&priv->spi->dev, "request_irq() failed"); +@@ -632,8 +632,6 @@ static int p54spi_probe(struct spi_device *spi) + + irq_set_irq_type(gpio_to_irq(p54spi_gpio_irq), IRQ_TYPE_EDGE_RISING); + +- disable_irq(gpio_to_irq(p54spi_gpio_irq)); +- + INIT_WORK(&priv->work, p54spi_work); + init_completion(&priv->fw_comp); + INIT_LIST_HEAD(&priv->tx_pending); +-- +2.43.0 + diff --git a/queue-5.4/x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch b/queue-5.4/x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch new file mode 100644 index 00000000000..c7149c21da0 --- /dev/null +++ b/queue-5.4/x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch @@ -0,0 +1,54 @@ +From 22c3b7c8feb1881a2ec6b5225702c44779877261 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2024 18:04:40 +0200 +Subject: x86/pvh: Call C code via the kernel virtual mapping + +From: Ard Biesheuvel + +[ Upstream commit e8fbc0d9cab6c1ee6403f42c0991b0c1d5dbc092 ] + +Calling C code via a different mapping than it was linked at is +problematic, because the compiler assumes that RIP-relative and absolute +symbol references are interchangeable. GCC in particular may use +RIP-relative per-CPU variable references even when not using -fpic. + +So call xen_prepare_pvh() via its kernel virtual mapping on x86_64, so +that those RIP-relative references produce the correct values. This +matches the pre-existing behavior for i386, which also invokes +xen_prepare_pvh() via the kernel virtual mapping before invoking +startup_32 with paging disabled again. + +Fixes: 7243b93345f7 ("xen/pvh: Bootstrap PVH guest") +Tested-by: Jason Andryuk +Reviewed-by: Jason Andryuk +Signed-off-by: Ard Biesheuvel +Message-ID: <20241009160438.3884381-8-ardb+git@google.com> +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/x86/platform/pvh/head.S | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S +index 7616daaae74eb..783b1e0d04a53 100644 +--- a/arch/x86/platform/pvh/head.S ++++ b/arch/x86/platform/pvh/head.S +@@ -108,7 +108,14 @@ ENTRY(pvh_start_xen) + movq %rbp, %rbx + subq $_pa(pvh_start_xen), %rbx + movq %rbx, phys_base(%rip) +- call xen_prepare_pvh ++ ++ /* Call xen_prepare_pvh() via the kernel virtual mapping */ ++ leaq xen_prepare_pvh(%rip), %rax ++ subq phys_base(%rip), %rax ++ addq $__START_KERNEL_map, %rax ++ ANNOTATE_RETPOLINE_SAFE ++ call *%rax ++ + /* + * Clear phys_base. __startup_64 will *add* to its value, + * so reset to 0. +-- +2.43.0 + diff --git a/queue-5.4/x86-pvh-set-phys_base-when-calling-xen_prepare_pvh.patch b/queue-5.4/x86-pvh-set-phys_base-when-calling-xen_prepare_pvh.patch new file mode 100644 index 00000000000..298d7abf7fb --- /dev/null +++ b/queue-5.4/x86-pvh-set-phys_base-when-calling-xen_prepare_pvh.patch @@ -0,0 +1,52 @@ +From 377caab6ef286a859c34411b83abcb48f2236148 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2024 15:36:28 -0400 +Subject: x86/pvh: Set phys_base when calling xen_prepare_pvh() + +From: Jason Andryuk + +[ Upstream commit b464b461d27d564125db760938643374864c1b1f ] + +phys_base needs to be set for __pa() to work in xen_pvh_init() when +finding the hypercall page. Set it before calling into +xen_prepare_pvh(), which calls xen_pvh_init(). Clear it afterward to +avoid __startup_64() adding to it and creating an incorrect value. + +Signed-off-by: Jason Andryuk +Reviewed-by: Juergen Gross +Message-ID: <20240823193630.2583107-4-jason.andryuk@amd.com> +Signed-off-by: Juergen Gross +Stable-dep-of: e8fbc0d9cab6 ("x86/pvh: Call C code via the kernel virtual mapping") +Signed-off-by: Sasha Levin +--- + arch/x86/platform/pvh/head.S | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S +index efd615d397d22..7616daaae74eb 100644 +--- a/arch/x86/platform/pvh/head.S ++++ b/arch/x86/platform/pvh/head.S +@@ -101,7 +101,20 @@ ENTRY(pvh_start_xen) + xor %edx, %edx + wrmsr + ++ /* ++ * Calculate load offset and store in phys_base. __pa() needs ++ * phys_base set to calculate the hypercall page in xen_pvh_init(). ++ */ ++ movq %rbp, %rbx ++ subq $_pa(pvh_start_xen), %rbx ++ movq %rbx, phys_base(%rip) + call xen_prepare_pvh ++ /* ++ * Clear phys_base. __startup_64 will *add* to its value, ++ * so reset to 0. ++ */ ++ xor %rbx, %rbx ++ movq %rbx, phys_base(%rip) + + /* startup_64 expects boot_params in %rsi. */ + mov $_pa(pvh_bootparams), %rsi +-- +2.43.0 + diff --git a/queue-5.4/x86-xen-pvh-annotate-indirect-branch-as-safe.patch b/queue-5.4/x86-xen-pvh-annotate-indirect-branch-as-safe.patch new file mode 100644 index 00000000000..2b1323dcbd1 --- /dev/null +++ b/queue-5.4/x86-xen-pvh-annotate-indirect-branch-as-safe.patch @@ -0,0 +1,46 @@ +From 162abbecc457e87e1db7c1f87f8c9e382ab4023c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 15:29:30 -0600 +Subject: x86/xen/pvh: Annotate indirect branch as safe + +From: Josh Poimboeuf + +[ Upstream commit 82694854caa8badab7c5d3a19c0139e8b471b1d3 ] + +This indirect jump is harmless; annotate it to keep objtool's retpoline +validation happy. + +Cc: Boris Ostrovsky +Cc: Juergen Gross +Signed-off-by: Josh Poimboeuf +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/4797c72a258b26e06741c58ccd4a75c42db39c1d.1611263462.git.jpoimboe@redhat.com +Stable-dep-of: e8fbc0d9cab6 ("x86/pvh: Call C code via the kernel virtual mapping") +Signed-off-by: Sasha Levin +--- + arch/x86/platform/pvh/head.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S +index 1f8825bbaffbf..efd615d397d22 100644 +--- a/arch/x86/platform/pvh/head.S ++++ b/arch/x86/platform/pvh/head.S +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + + __HEAD +@@ -105,6 +106,7 @@ ENTRY(pvh_start_xen) + /* startup_64 expects boot_params in %rsi. */ + mov $_pa(pvh_bootparams), %rsi + mov $_pa(startup_64), %rax ++ ANNOTATE_RETPOLINE_SAFE + jmp *%rax + + #else /* CONFIG_X86_64 */ +-- +2.43.0 +