From: Sasha Levin Date: Sat, 6 May 2023 11:59:14 +0000 (-0400) Subject: Fixes for 6.2 X-Git-Tag: v5.15.111~104 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b714f47fd5d4da99b610056c3638dddce2bb5fa6;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.2 Signed-off-by: Sasha Levin --- diff --git a/queue-6.2/accel-link-to-compute-accelerator-subsystem-intro.patch b/queue-6.2/accel-link-to-compute-accelerator-subsystem-intro.patch new file mode 100644 index 00000000000..ffd9ad92ecc --- /dev/null +++ b/queue-6.2/accel-link-to-compute-accelerator-subsystem-intro.patch @@ -0,0 +1,43 @@ +From 365f102d66e43b991074dfa163c7541ebe2d3772 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 11:35:26 +0700 +Subject: accel: Link to compute accelerator subsystem intro + +From: Bagas Sanjaya + +[ Upstream commit 6d179f84f274a87da51f24ac3e9427221bbaed51 ] + +Commit 2c204f3d53218d ("accel: add dedicated minor for accelerator +devices") adds link to accelerator nodes section of DRM internals doc +(Documentation/gpu/drm-internals.rst), but the target doesn't exist. +Instead, there is only an introduction doc for computer accelerator +subsytem. + +Link to that doc until there is documentation of accelerator internals. + +Fixes: 2c204f3d53218d ("accel: add dedicated minor for accelerator devices") +Signed-off-by: Bagas Sanjaya +Reviewed-by: Jeffrey Hugo +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + include/drm/drm_file.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h +index 0d1f853092ab8..ecffe24e2b1b0 100644 +--- a/include/drm/drm_file.h ++++ b/include/drm/drm_file.h +@@ -408,7 +408,8 @@ static inline bool drm_is_render_client(const struct drm_file *file_priv) + * Returns true if this is an open file of the compute acceleration node, i.e. + * &drm_file.minor of @file_priv is a accel minor. + * +- * See also the :ref:`section on accel nodes `. ++ * See also :doc:`Introduction to compute accelerators subsystem ++ * `. + */ + static inline bool drm_is_accel_client(const struct drm_file *file_priv) + { +-- +2.39.2 + diff --git a/queue-6.2/acpi-bus-ensure-that-notify-handlers-are-not-running.patch b/queue-6.2/acpi-bus-ensure-that-notify-handlers-are-not-running.patch new file mode 100644 index 00000000000..daf9d5a1a04 --- /dev/null +++ b/queue-6.2/acpi-bus-ensure-that-notify-handlers-are-not-running.patch @@ -0,0 +1,39 @@ +From 267fccda50a3dec04c2920221770a33d4bd6e71e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 16:00:48 +0200 +Subject: ACPI: bus: Ensure that notify handlers are not running after removal + +From: Rafael J. Wysocki + +[ Upstream commit faae443738c6f0dac9b0d3d11d108f6911a989a9 ] + +Currently, acpi_device_remove_notify_handler() may return while the +notify handler being removed is still running which may allow the +module holding that handler to be torn down prematurely. + +Address this issue by making acpi_device_remove_notify_handler() wait +for the handling of all the ACPI events in progress to complete before +returning. + +Fixes: 5894b0c46e49 ("ACPI / scan: Move bus operations and notification routines to bus.c") +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/bus.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index 7c16bc15e7a14..837cd86d0316b 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -589,6 +589,7 @@ static void acpi_device_remove_notify_handler(struct acpi_device *device, + acpi_remove_notify_handler(device->handle, type, + acpi_notify_device); + } ++ acpi_os_wait_events_complete(); + } + + /* Handle events targeting \_SB device (at present only graceful shutdown) */ +-- +2.39.2 + diff --git a/queue-6.2/acpi-pm-do-not-turn-of-unused-power-resources-on-the.patch b/queue-6.2/acpi-pm-do-not-turn-of-unused-power-resources-on-the.patch new file mode 100644 index 00000000000..495f676e069 --- /dev/null +++ b/queue-6.2/acpi-pm-do-not-turn-of-unused-power-resources-on-the.patch @@ -0,0 +1,91 @@ +From 4fb24692e4f572035d02e217203a28c57049827c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 13:02:20 +0200 +Subject: ACPI: PM: Do not turn of unused power resources on the Toshiba Click + Mini +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit 9b04d99788cf475cbd277f30ec66230ccb7e99f4 ] + +The CPR3 power resource on the Toshiba Click Mini toggles a GPIO +which is called SISP (for SIS touchscreen power?) on/off. + +This CPR3 power resource is not listed in any _PR? lists, let alone +in a _PR0 list for the SIS0817 touchscreen ACPI device which needs it. + +Before commit a1224f34d72a ("ACPI: PM: Check states of power resources +during initialization") this was not an issue because since nothing +referenced the CPR3 power resource its state was always +ACPI_POWER_RESOURCE_STATE_UNKNOWN and power resources with this state +get ignored by acpi_turn_off_unused_power_resources(). + +This clearly is a bug in the DSDT of this device. Add a DMI quirk +to make acpi_turn_off_unused_power_resources() a no-op on this +model to fix the touchscreen no longer working since kernel 5.16 . + +This quirk also causes 2 other power resources to not get turned +off, but the _OFF method on these already was a no-op, so this makes +no difference for the other 2 power resources. + +Fixes: a1224f34d72a ("ACPI: PM: Check states of power resources during initialization") +Reported-by: Gé Koerkamp +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216946 +Link: https://lore.kernel.org/regressions/32a14a8a-9795-4c8c-7e00-da9012f548f8@leemhuis.info/ +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/power.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c +index 23507d29f0006..c2c70139c4f1d 100644 +--- a/drivers/acpi/power.c ++++ b/drivers/acpi/power.c +@@ -23,6 +23,7 @@ + + #define pr_fmt(fmt) "ACPI: PM: " fmt + ++#include + #include + #include + #include +@@ -1022,6 +1023,21 @@ void acpi_resume_power_resources(void) + } + #endif + ++static const struct dmi_system_id dmi_leave_unused_power_resources_on[] = { ++ { ++ /* ++ * The Toshiba Click Mini has a CPR3 power-resource which must ++ * be on for the touchscreen to work, but which is not in any ++ * _PR? lists. The other 2 affected power-resources are no-ops. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE Click Mini L9W-B"), ++ }, ++ }, ++ {} ++}; ++ + /** + * acpi_turn_off_unused_power_resources - Turn off power resources not in use. + */ +@@ -1029,6 +1045,9 @@ void acpi_turn_off_unused_power_resources(void) + { + struct acpi_power_resource *resource; + ++ if (dmi_check_system(dmi_leave_unused_power_resources_on)) ++ return; ++ + mutex_lock(&power_resource_list_lock); + + list_for_each_entry_reverse(resource, &acpi_power_resource_list, list_node) { +-- +2.39.2 + diff --git a/queue-6.2/acpi-processor-fix-evaluating-_pdc-method-when-runni.patch b/queue-6.2/acpi-processor-fix-evaluating-_pdc-method-when-runni.patch new file mode 100644 index 00000000000..47c0a03d57d --- /dev/null +++ b/queue-6.2/acpi-processor-fix-evaluating-_pdc-method-when-runni.patch @@ -0,0 +1,146 @@ +From 6cd2b3d93563c22ae98e1e6159fe1a1af6344d5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 12:13:29 +0100 +Subject: ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Roger Pau Monne + +[ Upstream commit 073828e954459b883f23e53999d31e4c55ab9654 ] + +In ACPI systems, the OS can direct power management, as opposed to the +firmware. This OS-directed Power Management is called OSPM. Part of +telling the firmware that the OS going to direct power management is +making ACPI "_PDC" (Processor Driver Capabilities) calls. These _PDC +methods must be evaluated for every processor object. If these _PDC +calls are not completed for every processor it can lead to +inconsistency and later failures in things like the CPU frequency +driver. + +In a Xen system, the dom0 kernel is responsible for system-wide power +management. The dom0 kernel is in charge of OSPM. However, the +number of CPUs available to dom0 can be different than the number of +CPUs physically present on the system. + +This leads to a problem: the dom0 kernel needs to evaluate _PDC for +all the processors, but it can't always see them. + +In dom0 kernels, ignore the existing ACPI method for determining if a +processor is physically present because it might not be accurate. +Instead, ask the hypervisor for this information. + +Fix this by introducing a custom function to use when running as Xen +dom0 in order to check whether a processor object matches a CPU that's +online. Such checking is done using the existing information fetched +by the Xen pCPU subsystem, extending it to also store the ACPI ID. + +This ensures that _PDC method gets evaluated for all physically online +CPUs, regardless of the number of CPUs made available to dom0. + +Fixes: 5d554a7bb064 ("ACPI: processor: add internal processor_physically_present()") +Signed-off-by: Roger Pau Monné +Reviewed-by: Juergen Gross +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/processor_pdc.c | 11 +++++++++++ + drivers/xen/pcpu.c | 20 ++++++++++++++++++++ + include/xen/xen.h | 11 +++++++++++ + 3 files changed, 42 insertions(+) + +diff --git a/drivers/acpi/processor_pdc.c b/drivers/acpi/processor_pdc.c +index 8c3f82c9fff35..18fb04523f93b 100644 +--- a/drivers/acpi/processor_pdc.c ++++ b/drivers/acpi/processor_pdc.c +@@ -14,6 +14,8 @@ + #include + #include + ++#include ++ + #include "internal.h" + + static bool __init processor_physically_present(acpi_handle handle) +@@ -47,6 +49,15 @@ static bool __init processor_physically_present(acpi_handle handle) + return false; + } + ++ if (xen_initial_domain()) ++ /* ++ * When running as a Xen dom0 the number of processors Linux ++ * sees can be different from the real number of processors on ++ * the system, and we still need to execute _PDC for all of ++ * them. ++ */ ++ return xen_processor_present(acpi_id); ++ + type = (acpi_type == ACPI_TYPE_DEVICE) ? 1 : 0; + cpuid = acpi_get_cpuid(handle, type, acpi_id); + +diff --git a/drivers/xen/pcpu.c b/drivers/xen/pcpu.c +index fd3a644b08559..b3e3d1bb37f3e 100644 +--- a/drivers/xen/pcpu.c ++++ b/drivers/xen/pcpu.c +@@ -58,6 +58,7 @@ struct pcpu { + struct list_head list; + struct device dev; + uint32_t cpu_id; ++ uint32_t acpi_id; + uint32_t flags; + }; + +@@ -249,6 +250,7 @@ static struct pcpu *create_and_register_pcpu(struct xenpf_pcpuinfo *info) + + INIT_LIST_HEAD(&pcpu->list); + pcpu->cpu_id = info->xen_cpuid; ++ pcpu->acpi_id = info->acpi_id; + pcpu->flags = info->flags; + + /* Need hold on xen_pcpu_lock before pcpu list manipulations */ +@@ -381,3 +383,21 @@ static int __init xen_pcpu_init(void) + return ret; + } + arch_initcall(xen_pcpu_init); ++ ++#ifdef CONFIG_ACPI ++bool __init xen_processor_present(uint32_t acpi_id) ++{ ++ const struct pcpu *pcpu; ++ bool online = false; ++ ++ mutex_lock(&xen_pcpu_lock); ++ list_for_each_entry(pcpu, &xen_pcpus, list) ++ if (pcpu->acpi_id == acpi_id) { ++ online = pcpu->flags & XEN_PCPU_FLAGS_ONLINE; ++ break; ++ } ++ mutex_unlock(&xen_pcpu_lock); ++ ++ return online; ++} ++#endif +diff --git a/include/xen/xen.h b/include/xen/xen.h +index 7adf59837c258..0efeb652f9b8f 100644 +--- a/include/xen/xen.h ++++ b/include/xen/xen.h +@@ -71,4 +71,15 @@ static inline void xen_free_unpopulated_pages(unsigned int nr_pages, + } + #endif + ++#if defined(CONFIG_XEN_DOM0) && defined(CONFIG_ACPI) && defined(CONFIG_X86) ++bool __init xen_processor_present(uint32_t acpi_id); ++#else ++#include ++static inline bool xen_processor_present(uint32_t acpi_id) ++{ ++ BUG(); ++ return false; ++} ++#endif ++ + #endif /* _XEN_XEN_H */ +-- +2.39.2 + diff --git a/queue-6.2/acpi-viot-initialize-the-correct-iommu-fwspec.patch b/queue-6.2/acpi-viot-initialize-the-correct-iommu-fwspec.patch new file mode 100644 index 00000000000..49512579d56 --- /dev/null +++ b/queue-6.2/acpi-viot-initialize-the-correct-iommu-fwspec.patch @@ -0,0 +1,61 @@ +From ef2177789dc9813b1b258004513f68c466e2d77c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 18:05:29 +0000 +Subject: ACPI: VIOT: Initialize the correct IOMMU fwspec + +From: Jean-Philippe Brucker + +[ Upstream commit 47d26684185d09e083669bbbd0c465ab3493a51f ] + +When setting up DMA for a PCI device, we need to initialize its +iommu_fwspec with all possible alias RIDs (such as PCI bridges). To do +this we use pci_for_each_dma_alias() which calls +viot_pci_dev_iommu_init(). This function incorrectly initializes the +fwspec of the bridge instead of the device being configured. Fix it by +passing the original device as context to pci_for_each_dma_alias(). + +Fixes: 3cf485540e7b ("ACPI: Add driver for the VIOT table") +Link: https://lore.kernel.org/all/Y8qzOKm6kvhGWG1T@myrica +Reported-by: Eric Auger +Signed-off-by: Jean-Philippe Brucker +Reviewed-by: Eric Auger +Tested-by: Eric Auger +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/viot.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/viot.c b/drivers/acpi/viot.c +index ed752cbbe6362..c8025921c129b 100644 +--- a/drivers/acpi/viot.c ++++ b/drivers/acpi/viot.c +@@ -328,6 +328,7 @@ static int viot_pci_dev_iommu_init(struct pci_dev *pdev, u16 dev_id, void *data) + { + u32 epid; + struct viot_endpoint *ep; ++ struct device *aliased_dev = data; + u32 domain_nr = pci_domain_nr(pdev->bus); + + list_for_each_entry(ep, &viot_pci_ranges, list) { +@@ -338,7 +339,7 @@ static int viot_pci_dev_iommu_init(struct pci_dev *pdev, u16 dev_id, void *data) + epid = ((domain_nr - ep->segment_start) << 16) + + dev_id - ep->bdf_start + ep->endpoint_id; + +- return viot_dev_iommu_init(&pdev->dev, ep->viommu, ++ return viot_dev_iommu_init(aliased_dev, ep->viommu, + epid); + } + } +@@ -372,7 +373,7 @@ int viot_iommu_configure(struct device *dev) + { + if (dev_is_pci(dev)) + return pci_for_each_dma_alias(to_pci_dev(dev), +- viot_pci_dev_iommu_init, NULL); ++ viot_pci_dev_iommu_init, dev); + else if (dev_is_platform(dev)) + return viot_mmio_dev_iommu_init(to_platform_device(dev)); + return -ENODEV; +-- +2.39.2 + diff --git a/queue-6.2/afs-avoid-endless-loop-if-file-is-larger-than-expect.patch b/queue-6.2/afs-avoid-endless-loop-if-file-is-larger-than-expect.patch new file mode 100644 index 00000000000..98ed6734233 --- /dev/null +++ b/queue-6.2/afs-avoid-endless-loop-if-file-is-larger-than-expect.patch @@ -0,0 +1,60 @@ +From 0d24ebe1c37e260a3f5f20c710570ef74bba7b99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 10:19:42 -0400 +Subject: afs: Avoid endless loop if file is larger than expected + +From: Marc Dionne + +[ Upstream commit 9ea4eff4b6f4f36546d537a74da44fd3f30903ab ] + +afs_read_dir fetches an amount of data that's based on what the inode +size is thought to be. If the file on the server is larger than what +was fetched, the code rechecks i_size and retries. If the local i_size +was not properly updated, this can lead to an endless loop of fetching +i_size from the server and noticing each time that the size is larger on +the server. + +If it is known that the remote size is larger than i_size, bump up the +fetch size to that size. + +Fixes: f3ddee8dc4e2 ("afs: Fix directory handling") +Signed-off-by: Marc Dionne +Signed-off-by: David Howells +cc: linux-afs@lists.infradead.org +Signed-off-by: Sasha Levin +--- + fs/afs/dir.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/afs/dir.c b/fs/afs/dir.c +index b7c1f8c84b38a..be8f8da5b6b02 100644 +--- a/fs/afs/dir.c ++++ b/fs/afs/dir.c +@@ -275,6 +275,7 @@ static struct afs_read *afs_read_dir(struct afs_vnode *dvnode, struct key *key) + loff_t i_size; + int nr_pages, i; + int ret; ++ loff_t remote_size = 0; + + _enter(""); + +@@ -289,6 +290,8 @@ static struct afs_read *afs_read_dir(struct afs_vnode *dvnode, struct key *key) + + expand: + i_size = i_size_read(&dvnode->netfs.inode); ++ if (i_size < remote_size) ++ i_size = remote_size; + if (i_size < 2048) { + ret = afs_bad(dvnode, afs_file_error_dir_small); + goto error; +@@ -364,6 +367,7 @@ static struct afs_read *afs_read_dir(struct afs_vnode *dvnode, struct key *key) + * buffer. + */ + up_write(&dvnode->validate_lock); ++ remote_size = req->file_size; + goto expand; + } + +-- +2.39.2 + diff --git a/queue-6.2/afs-fix-getattr-to-report-server-i_size-on-dirs-not-.patch b/queue-6.2/afs-fix-getattr-to-report-server-i_size-on-dirs-not-.patch new file mode 100644 index 00000000000..8865d3e8cc0 --- /dev/null +++ b/queue-6.2/afs-fix-getattr-to-report-server-i_size-on-dirs-not-.patch @@ -0,0 +1,56 @@ +From b3d5861a908f9a963a8ec6131e16dce57b06d4e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 13:49:42 +0000 +Subject: afs: Fix getattr to report server i_size on dirs, not local size + +From: David Howells + +[ Upstream commit 45f66fa03ba9943cca5af88d691399332b8bde08 ] + +Fix afs_getattr() to report the server's idea of the file size of a +directory rather than the local size. The local size may differ as we edit +the local copy to avoid having to redownload it and we may end up with a +differently structured blob of a different size. + +However, if the directory is discarded from the pagecache we then download +it again and the user may see the directory file size apparently change. + +Fixes: 63a4681ff39c ("afs: Locally edit directory data for mkdir/create/unlink/...") +Signed-off-by: David Howells +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Sasha Levin +--- + fs/afs/inode.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index 52d040ffde35f..5921dd3687e39 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -450,7 +450,7 @@ static void afs_get_inode_cache(struct afs_vnode *vnode) + 0 : FSCACHE_ADV_SINGLE_CHUNK, + &key, sizeof(key), + &aux, sizeof(aux), +- vnode->status.size)); ++ i_size_read(&vnode->netfs.inode))); + #endif + } + +@@ -766,6 +766,13 @@ int afs_getattr(struct user_namespace *mnt_userns, const struct path *path, + if (test_bit(AFS_VNODE_SILLY_DELETED, &vnode->flags) && + stat->nlink > 0) + stat->nlink -= 1; ++ ++ /* Lie about the size of directories. We maintain a locally ++ * edited copy and may make different allocation decisions on ++ * it, but we need to give userspace the server's size. ++ */ ++ if (S_ISDIR(inode->i_mode)) ++ stat->size = vnode->netfs.remote_i_size; + } while (need_seqretry(&vnode->cb_lock, seq)); + + done_seqretry(&vnode->cb_lock, seq); +-- +2.39.2 + diff --git a/queue-6.2/afs-fix-updating-of-i_size-with-dv-jump-from-server.patch b/queue-6.2/afs-fix-updating-of-i_size-with-dv-jump-from-server.patch new file mode 100644 index 00000000000..d28feae6c34 --- /dev/null +++ b/queue-6.2/afs-fix-updating-of-i_size-with-dv-jump-from-server.patch @@ -0,0 +1,40 @@ +From 1746b91bb420cbc7289ef25e008edb959292e8d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 10:07:01 -0400 +Subject: afs: Fix updating of i_size with dv jump from server + +From: Marc Dionne + +[ Upstream commit d7f74e9a917503ee78f2b603a456d7227cf38919 ] + +If the data version returned from the server is larger than expected, +the local data is invalidated, but we may still want to note the remote +file size. + +Since we're setting change_size, we have to also set data_changed +for the i_size to get updated. + +Fixes: 3f4aa9818163 ("afs: Fix EOF corruption") +Signed-off-by: Marc Dionne +Signed-off-by: David Howells +cc: linux-afs@lists.infradead.org +Signed-off-by: Sasha Levin +--- + fs/afs/inode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index 6d3a3dbe49286..52d040ffde35f 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -230,6 +230,7 @@ static void afs_apply_status(struct afs_operation *op, + set_bit(AFS_VNODE_ZAP_DATA, &vnode->flags); + } + change_size = true; ++ data_changed = true; + } else if (vnode->status.type == AFS_FTYPE_DIR) { + /* Expected directory change is handled elsewhere so + * that we can locally edit the directory and save on a +-- +2.39.2 + diff --git a/queue-6.2/arm-dts-gta04-fix-excess-dma-channel-usage.patch b/queue-6.2/arm-dts-gta04-fix-excess-dma-channel-usage.patch new file mode 100644 index 00000000000..3c1c0e5ae8c --- /dev/null +++ b/queue-6.2/arm-dts-gta04-fix-excess-dma-channel-usage.patch @@ -0,0 +1,73 @@ +From 6fa962c7a6bfc7a12702b11574cbf7c1eb74383d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 22:11:51 +0100 +Subject: ARM: dts: gta04: fix excess dma channel usage + +From: H. Nikolaus Schaller + +[ Upstream commit a622310f7f0185da02e42cdb06475f533efaae60 ] + +OMAP processors support 32 channels but there is no check or +inspect this except booting a device and looking at dmesg reports +of not available channels. + +Recently some more subsystems with DMA (aes1+2) were added filling +the list of dma channels beyond the limit of 32 (even if other +parameters indicate 96 or 128 channels). This leads to random +subsystem failures i(e.g. mcbsp for audio) after boot or boot +messages that DMA can not be initialized. + +Another symptom is that + +/sys/kernel/debug/dmaengine/summary + +has 32 entries and does not show all required channels. + +Fix by disabling unused (on the GTA04 hardware) mcspi1...4. +Each SPI channel allocates 4 DMA channels rapidly filling +the available ones. + +Disabling unused SPI modules on the OMAP3 SoC may also save +some energy (has not been checked). + +Fixes: c312f066314e ("ARM: dts: omap3: Migrate AES from hwmods to sysc-omap2") +Signed-off-by: H. Nikolaus Schaller +[re-enabled aes2, improved commit subject line] +Signed-off-by: Andreas Kemnade +Message-Id: <20230113211151.2314874-1-andreas@kemnade.info> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index 87e0ab1bbe957..e0be0fb23f80f 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -612,6 +612,22 @@ + clock-frequency = <100000>; + }; + ++&mcspi1 { ++ status = "disabled"; ++}; ++ ++&mcspi2 { ++ status = "disabled"; ++}; ++ ++&mcspi3 { ++ status = "disabled"; ++}; ++ ++&mcspi4 { ++ status = "disabled"; ++}; ++ + &usb_otg_hs { + interface-type = <0>; + usb-phy = <&usb2_phy>; +-- +2.39.2 + diff --git a/queue-6.2/arm-dts-qcom-apq8064-fix-opp-table-child-name.patch b/queue-6.2/arm-dts-qcom-apq8064-fix-opp-table-child-name.patch new file mode 100644 index 00000000000..8e706476f67 --- /dev/null +++ b/queue-6.2/arm-dts-qcom-apq8064-fix-opp-table-child-name.patch @@ -0,0 +1,38 @@ +From 5cc797253f65514fc9d5b1c931f7c312f436b2e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Feb 2023 13:08:31 +0100 +Subject: ARM: dts: qcom-apq8064: Fix opp table child name + +From: Konrad Dybcio + +[ Upstream commit b9745c275246a7e43c34d1b3be5ff9a9f3cf9305 ] + +The opp-320000000 name is rather misleading with the opp-hz value +of 450 MHz. Fix it! + +Fixes: 8db0b6c7b636 ("ARM: dts: qcom: apq8064: Convert adreno from legacy gpu-pwrlevels to opp-v2") +Signed-off-by: Konrad Dybcio +Reviewed-by: David Heidelberg +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230220120831.1591820-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-apq8064.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi +index 0da9623ea0849..4133321edad88 100644 +--- a/arch/arm/boot/dts/qcom-apq8064.dtsi ++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi +@@ -1261,7 +1261,7 @@ + gpu_opp_table: opp-table { + compatible = "operating-points-v2"; + +- opp-320000000 { ++ opp-450000000 { + opp-hz = /bits/ 64 <450000000>; + }; + +-- +2.39.2 + diff --git a/queue-6.2/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch b/queue-6.2/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..cae97d950fb --- /dev/null +++ b/queue-6.2/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,45 @@ +From e81ebd171e46aa3b6e5d4f3a56a493641f430ffb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:51 +0530 +Subject: ARM: dts: qcom: ipq4019: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 2540279e9a9e74fc880d1e4c83754ecfcbe290a0 ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address +(0x40200000) specified in the ranges property for I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: 187519403273 ("ARM: dts: ipq4019: Add a few peripheral nodes") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-16-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-ipq4019.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi +index acb08dcf94428..a89a17278a118 100644 +--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi +@@ -426,8 +426,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000>, +- <0x82000000 0 0x40300000 0x40300000 0 0x00d00000>; ++ ranges = <0x81000000 0x0 0x00000000 0x40200000 0x0 0x00100000>, ++ <0x82000000 0x0 0x40300000 0x40300000 0x0 0x00d00000>; + + interrupts = ; + interrupt-names = "msi"; +-- +2.39.2 + diff --git a/queue-6.2/arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch b/queue-6.2/arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..05bb9a5334d --- /dev/null +++ b/queue-6.2/arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,68 @@ +From e2503d47b5603e8537f943048702e640d71b2408 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:52 +0530 +Subject: ARM: dts: qcom: ipq8064: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 0b16b34e491629016109e56747ad64588074194b ] + +For 64KiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x10000. Hence, fix the bogus PCI addresses +(0x0fe00000, 0x31e00000, 0x35e00000) specified in the ranges property for +I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: 93241840b664 ("ARM: dts: qcom: Add pcie nodes for ipq8064") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-17-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-ipq8064.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-ipq8064.dtsi b/arch/arm/boot/dts/qcom-ipq8064.dtsi +index 7e784b0995da2..1e6eb6773a0b0 100644 +--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi +@@ -1082,8 +1082,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00010000 /* downstream I/O */ +- 0x82000000 0 0x08000000 0x08000000 0 0x07e00000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0x0 0x00000000 0x0fe00000 0x0 0x00010000 /* I/O */ ++ 0x82000000 0x0 0x08000000 0x08000000 0x0 0x07e00000>; /* MEM */ + + interrupts = ; + interrupt-names = "msi"; +@@ -1133,8 +1133,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00010000 /* downstream I/O */ +- 0x82000000 0 0x2e000000 0x2e000000 0 0x03e00000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0x0 0x00000000 0x31e00000 0x0 0x00010000 /* I/O */ ++ 0x82000000 0x0 0x2e000000 0x2e000000 0x0 0x03e00000>; /* MEM */ + + interrupts = ; + interrupt-names = "msi"; +@@ -1184,8 +1184,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00010000 /* downstream I/O */ +- 0x82000000 0 0x32000000 0x32000000 0 0x03e00000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0x0 0x00000000 0x35e00000 0x0 0x00010000 /* I/O */ ++ 0x82000000 0x0 0x32000000 0x32000000 0x0 0x03e00000>; /* MEM */ + + interrupts = ; + interrupt-names = "msi"; +-- +2.39.2 + diff --git a/queue-6.2/arm-dts-qcom-sdx55-fix-the-unit-address-of-pcie-ep-n.patch b/queue-6.2/arm-dts-qcom-sdx55-fix-the-unit-address-of-pcie-ep-n.patch new file mode 100644 index 00000000000..dafa9c0c37c --- /dev/null +++ b/queue-6.2/arm-dts-qcom-sdx55-fix-the-unit-address-of-pcie-ep-n.patch @@ -0,0 +1,123 @@ +From 2f4abb989b6ff03ad0e886235620fea24d1667d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 13:54:16 +0530 +Subject: ARM: dts: qcom: sdx55: Fix the unit address of PCIe EP node + +From: Manivannan Sadhasivam + +[ Upstream commit 3b76b736cd9933ff88764ffec01cbd859c1475e7 ] + +Unit address of PCIe EP node should be 0x1c00000 as it has to match the +first address specified in the reg property. + +This also requires sorting the node in the ascending order. + +Fixes: e6b69813283f ("ARM: dts: qcom: sdx55: Add support for PCIe EP") +Reviewed-by: Konrad Dybcio +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230308082424.140224-6-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-sdx55.dtsi | 78 +++++++++++++++---------------- + 1 file changed, 39 insertions(+), 39 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-sdx55.dtsi b/arch/arm/boot/dts/qcom-sdx55.dtsi +index 93d71aff3fab7..e84ca795cae65 100644 +--- a/arch/arm/boot/dts/qcom-sdx55.dtsi ++++ b/arch/arm/boot/dts/qcom-sdx55.dtsi +@@ -303,6 +303,45 @@ + status = "disabled"; + }; + ++ pcie_ep: pcie-ep@1c00000 { ++ compatible = "qcom,sdx55-pcie-ep"; ++ reg = <0x01c00000 0x3000>, ++ <0x40000000 0xf1d>, ++ <0x40000f20 0xc8>, ++ <0x40001000 0x1000>, ++ <0x40200000 0x100000>, ++ <0x01c03000 0x3000>; ++ reg-names = "parf", "dbi", "elbi", "atu", "addr_space", ++ "mmio"; ++ ++ qcom,perst-regs = <&tcsr 0xb258 0xb270>; ++ ++ clocks = <&gcc GCC_PCIE_AUX_CLK>, ++ <&gcc GCC_PCIE_CFG_AHB_CLK>, ++ <&gcc GCC_PCIE_MSTR_AXI_CLK>, ++ <&gcc GCC_PCIE_SLV_AXI_CLK>, ++ <&gcc GCC_PCIE_SLV_Q2A_AXI_CLK>, ++ <&gcc GCC_PCIE_SLEEP_CLK>, ++ <&gcc GCC_PCIE_0_CLKREF_CLK>; ++ clock-names = "aux", "cfg", "bus_master", "bus_slave", ++ "slave_q2a", "sleep", "ref"; ++ ++ interrupts = , ++ ; ++ interrupt-names = "global", "doorbell"; ++ reset-gpios = <&tlmm 57 GPIO_ACTIVE_LOW>; ++ wake-gpios = <&tlmm 53 GPIO_ACTIVE_LOW>; ++ resets = <&gcc GCC_PCIE_BCR>; ++ reset-names = "core"; ++ power-domains = <&gcc PCIE_GDSC>; ++ phys = <&pcie0_lane>; ++ phy-names = "pciephy"; ++ max-link-speed = <3>; ++ num-lanes = <2>; ++ ++ status = "disabled"; ++ }; ++ + pcie0_phy: phy@1c07000 { + compatible = "qcom,sdx55-qmp-pcie-phy"; + reg = <0x01c07000 0x1c4>; +@@ -400,45 +439,6 @@ + status = "disabled"; + }; + +- pcie_ep: pcie-ep@40000000 { +- compatible = "qcom,sdx55-pcie-ep"; +- reg = <0x01c00000 0x3000>, +- <0x40000000 0xf1d>, +- <0x40000f20 0xc8>, +- <0x40001000 0x1000>, +- <0x40200000 0x100000>, +- <0x01c03000 0x3000>; +- reg-names = "parf", "dbi", "elbi", "atu", "addr_space", +- "mmio"; +- +- qcom,perst-regs = <&tcsr 0xb258 0xb270>; +- +- clocks = <&gcc GCC_PCIE_AUX_CLK>, +- <&gcc GCC_PCIE_CFG_AHB_CLK>, +- <&gcc GCC_PCIE_MSTR_AXI_CLK>, +- <&gcc GCC_PCIE_SLV_AXI_CLK>, +- <&gcc GCC_PCIE_SLV_Q2A_AXI_CLK>, +- <&gcc GCC_PCIE_SLEEP_CLK>, +- <&gcc GCC_PCIE_0_CLKREF_CLK>; +- clock-names = "aux", "cfg", "bus_master", "bus_slave", +- "slave_q2a", "sleep", "ref"; +- +- interrupts = , +- ; +- interrupt-names = "global", "doorbell"; +- reset-gpios = <&tlmm 57 GPIO_ACTIVE_LOW>; +- wake-gpios = <&tlmm 53 GPIO_ACTIVE_LOW>; +- resets = <&gcc GCC_PCIE_BCR>; +- reset-names = "core"; +- power-domains = <&gcc PCIE_GDSC>; +- phys = <&pcie0_lane>; +- phy-names = "pciephy"; +- max-link-speed = <3>; +- num-lanes = <2>; +- +- status = "disabled"; +- }; +- + remoteproc_mpss: remoteproc@4080000 { + compatible = "qcom,sdx55-mpss-pas"; + reg = <0x04080000 0x4040>; +-- +2.39.2 + diff --git a/queue-6.2/arm-dts-stm32-fix-spi1-pin-assignment-on-stm32mp15.patch b/queue-6.2/arm-dts-stm32-fix-spi1-pin-assignment-on-stm32mp15.patch new file mode 100644 index 00000000000..e702fb1b81e --- /dev/null +++ b/queue-6.2/arm-dts-stm32-fix-spi1-pin-assignment-on-stm32mp15.patch @@ -0,0 +1,69 @@ +From 732964505b2138e2e1660f0105881f33fa18032c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 18:03:31 +0100 +Subject: ARM: dts: stm32: fix spi1 pin assignment on stm32mp15 + +From: Alexandre Torgue + +[ Upstream commit 1b9f0ec81af0012aae30aa3b4c711ad71d42e246 ] + +Bank A and B IOs can't be handled by the pin controller 'Z'. This patch +assign spi1 pin definition to the correct controller. + +Fixes: 9ad65d245b7b ("ARM: dts: stm32: stm32mp15-pinctrl: add spi1-1 pinmux group") + +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15-pinctrl.dtsi | 30 ++++++++++++------------ + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi +index a9d2bec990141..e15a3b2a9b399 100644 +--- a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi ++++ b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi +@@ -1880,6 +1880,21 @@ + }; + }; + ++ spi1_pins_b: spi1-1 { ++ pins1 { ++ pinmux = , /* SPI1_SCK */ ++ ; /* SPI1_MOSI */ ++ bias-disable; ++ drive-push-pull; ++ slew-rate = <1>; ++ }; ++ ++ pins2 { ++ pinmux = ; /* SPI1_MISO */ ++ bias-disable; ++ }; ++ }; ++ + spi2_pins_a: spi2-0 { + pins1 { + pinmux = , /* SPI2_SCK */ +@@ -2448,19 +2463,4 @@ + bias-disable; + }; + }; +- +- spi1_pins_b: spi1-1 { +- pins1 { +- pinmux = , /* SPI1_SCK */ +- ; /* SPI1_MOSI */ +- bias-disable; +- drive-push-pull; +- slew-rate = <1>; +- }; +- +- pins2 { +- pinmux = ; /* SPI1_MISO */ +- bias-disable; +- }; +- }; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-apple-t8103-disable-unused-pcie-ports.patch b/queue-6.2/arm64-dts-apple-t8103-disable-unused-pcie-ports.patch new file mode 100644 index 00000000000..1d36d286649 --- /dev/null +++ b/queue-6.2/arm64-dts-apple-t8103-disable-unused-pcie-ports.patch @@ -0,0 +1,201 @@ +From 8017697201709b35dc76d5bcf08a9338ac70404f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 15:07:22 +0100 +Subject: arm64: dts: apple: t8103: Disable unused PCIe ports + +From: Janne Grunau + +[ Upstream commit a0189fdfb73dac856b8fa9b9f9581e5099c9391f ] + +The PCIe ports are unused (without devices) so disable them instead of +removing them. + +Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices") +Signed-off-by: Janne Grunau +Reviewed-by: Sven Peter +Signed-off-by: Hector Martin +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/apple/t8103-j274.dts | 10 ++++++++++ + arch/arm64/boot/dts/apple/t8103-j293.dts | 15 --------------- + arch/arm64/boot/dts/apple/t8103-j313.dts | 15 --------------- + arch/arm64/boot/dts/apple/t8103-j456.dts | 10 ++++++++++ + arch/arm64/boot/dts/apple/t8103-j457.dts | 11 +++-------- + arch/arm64/boot/dts/apple/t8103.dtsi | 4 ++++ + 6 files changed, 27 insertions(+), 38 deletions(-) + +diff --git a/arch/arm64/boot/dts/apple/t8103-j274.dts b/arch/arm64/boot/dts/apple/t8103-j274.dts +index b52ddc4098939..1c3e37f86d46d 100644 +--- a/arch/arm64/boot/dts/apple/t8103-j274.dts ++++ b/arch/arm64/boot/dts/apple/t8103-j274.dts +@@ -37,10 +37,12 @@ + + &port01 { + bus-range = <2 2>; ++ status = "okay"; + }; + + &port02 { + bus-range = <3 3>; ++ status = "okay"; + ethernet0: ethernet@0,0 { + reg = <0x30000 0x0 0x0 0x0 0x0>; + /* To be filled by the loader */ +@@ -48,6 +50,14 @@ + }; + }; + ++&pcie0_dart_1 { ++ status = "okay"; ++}; ++ ++&pcie0_dart_2 { ++ status = "okay"; ++}; ++ + &i2c2 { + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/apple/t8103-j293.dts b/arch/arm64/boot/dts/apple/t8103-j293.dts +index 151074109a114..c363dfef80709 100644 +--- a/arch/arm64/boot/dts/apple/t8103-j293.dts ++++ b/arch/arm64/boot/dts/apple/t8103-j293.dts +@@ -25,21 +25,6 @@ + brcm,board-type = "apple,honshu"; + }; + +-/* +- * Remove unused PCIe ports and disable the associated DARTs. +- */ +- +-&pcie0_dart_1 { +- status = "disabled"; +-}; +- +-&pcie0_dart_2 { +- status = "disabled"; +-}; +- +-/delete-node/ &port01; +-/delete-node/ &port02; +- + &i2c2 { + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/apple/t8103-j313.dts b/arch/arm64/boot/dts/apple/t8103-j313.dts +index bc1f865aa7909..08409be1cf357 100644 +--- a/arch/arm64/boot/dts/apple/t8103-j313.dts ++++ b/arch/arm64/boot/dts/apple/t8103-j313.dts +@@ -24,18 +24,3 @@ + &wifi0 { + brcm,board-type = "apple,shikoku"; + }; +- +-/* +- * Remove unused PCIe ports and disable the associated DARTs. +- */ +- +-&pcie0_dart_1 { +- status = "disabled"; +-}; +- +-&pcie0_dart_2 { +- status = "disabled"; +-}; +- +-/delete-node/ &port01; +-/delete-node/ &port02; +diff --git a/arch/arm64/boot/dts/apple/t8103-j456.dts b/arch/arm64/boot/dts/apple/t8103-j456.dts +index 2db425ceb30f6..58c8e43789b48 100644 +--- a/arch/arm64/boot/dts/apple/t8103-j456.dts ++++ b/arch/arm64/boot/dts/apple/t8103-j456.dts +@@ -55,13 +55,23 @@ + + &port01 { + bus-range = <2 2>; ++ status = "okay"; + }; + + &port02 { + bus-range = <3 3>; ++ status = "okay"; + ethernet0: ethernet@0,0 { + reg = <0x30000 0x0 0x0 0x0 0x0>; + /* To be filled by the loader */ + local-mac-address = [00 10 18 00 00 00]; + }; + }; ++ ++&pcie0_dart_1 { ++ status = "okay"; ++}; ++ ++&pcie0_dart_2 { ++ status = "okay"; ++}; +diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts +index 3821ff146c56b..152f95fd49a21 100644 +--- a/arch/arm64/boot/dts/apple/t8103-j457.dts ++++ b/arch/arm64/boot/dts/apple/t8103-j457.dts +@@ -37,6 +37,7 @@ + + &port02 { + bus-range = <3 3>; ++ status = "okay"; + ethernet0: ethernet@0,0 { + reg = <0x30000 0x0 0x0 0x0 0x0>; + /* To be filled by the loader */ +@@ -44,12 +45,6 @@ + }; + }; + +-/* +- * Remove unused PCIe port and disable the associated DART. +- */ +- +-&pcie0_dart_1 { +- status = "disabled"; ++&pcie0_dart_2 { ++ status = "okay"; + }; +- +-/delete-node/ &port01; +diff --git a/arch/arm64/boot/dts/apple/t8103.dtsi b/arch/arm64/boot/dts/apple/t8103.dtsi +index 9859219699f45..87a9c1ba6d0f4 100644 +--- a/arch/arm64/boot/dts/apple/t8103.dtsi ++++ b/arch/arm64/boot/dts/apple/t8103.dtsi +@@ -724,6 +724,7 @@ + interrupt-parent = <&aic>; + interrupts = ; + power-domains = <&ps_apcie_gp>; ++ status = "disabled"; + }; + + pcie0_dart_2: iommu@683008000 { +@@ -733,6 +734,7 @@ + interrupt-parent = <&aic>; + interrupts = ; + power-domains = <&ps_apcie_gp>; ++ status = "disabled"; + }; + + pcie0: pcie@690000000 { +@@ -807,6 +809,7 @@ + <0 0 0 2 &port01 0 0 0 1>, + <0 0 0 3 &port01 0 0 0 2>, + <0 0 0 4 &port01 0 0 0 3>; ++ status = "disabled"; + }; + + port02: pci@2,0 { +@@ -826,6 +829,7 @@ + <0 0 0 2 &port02 0 0 0 1>, + <0 0 0 3 &port02 0 0 0 2>, + <0 0 0 4 &port02 0 0 0 3>; ++ status = "disabled"; + }; + }; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-broadcom-bcmbca-bcm4908-fix-led-nodenames.patch b/queue-6.2/arm64-dts-broadcom-bcmbca-bcm4908-fix-led-nodenames.patch new file mode 100644 index 00000000000..993e6840713 --- /dev/null +++ b/queue-6.2/arm64-dts-broadcom-bcmbca-bcm4908-fix-led-nodenames.patch @@ -0,0 +1,76 @@ +From d63b87fcd019720a4102920820366ecbda4df373 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 15:43:59 +0100 +Subject: arm64: dts: broadcom: bcmbca: bcm4908: fix LED nodenames +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 23be9f68f933adee8163b8efc9c6bff71410cc7c ] + +This fixes: +arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dtb: leds@800: 'led-lan@19', 'led-power@11', 'led-wan-red@12', 'led-wan-white@15', 'led-wps@14' do not match any of the regexes: '^led@[a-f0-9]+$', 'pinctrl-[0-9]+' + From schema: Documentation/devicetree/bindings/leds/leds-bcm63138.yaml + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/all/20230228144400.21689-2-zajec5@gmail.com/ +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + .../dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts +index 839ca33178b01..d94a53d68320b 100644 +--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908-asus-gt-ac5300.dts +@@ -120,7 +120,7 @@ + }; + + &leds { +- led-power@11 { ++ led@11 { + reg = <0x11>; + function = LED_FUNCTION_POWER; + color = ; +@@ -130,7 +130,7 @@ + pinctrl-0 = <&pins_led_17_a>; + }; + +- led-wan-red@12 { ++ led@12 { + reg = <0x12>; + function = LED_FUNCTION_WAN; + color = ; +@@ -139,7 +139,7 @@ + pinctrl-0 = <&pins_led_18_a>; + }; + +- led-wps@14 { ++ led@14 { + reg = <0x14>; + function = LED_FUNCTION_WPS; + color = ; +@@ -148,7 +148,7 @@ + pinctrl-0 = <&pins_led_20_a>; + }; + +- led-wan-white@15 { ++ led@15 { + reg = <0x15>; + function = LED_FUNCTION_WAN; + color = ; +@@ -157,7 +157,7 @@ + pinctrl-0 = <&pins_led_21_a>; + }; + +- led-lan@19 { ++ led@19 { + reg = <0x19>; + function = LED_FUNCTION_LAN; + color = ; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-broadcom-bcmbca-bcm4908-fix-nand-interrupt.patch b/queue-6.2/arm64-dts-broadcom-bcmbca-bcm4908-fix-nand-interrupt.patch new file mode 100644 index 00000000000..1dc310d8fd1 --- /dev/null +++ b/queue-6.2/arm64-dts-broadcom-bcmbca-bcm4908-fix-nand-interrupt.patch @@ -0,0 +1,42 @@ +From 1b087bbe805ae7fb8ec33499c040c8c11b6e9038 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 15:43:58 +0100 +Subject: arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 5cca02449490e767289bda38db1577e2c375c084 ] + +This fixes: +arch/arm64/boot/dts/broadcom/bcmbca/bcm94908.dtb: nand-controller@1800: interrupt-names:0: 'nand_ctlrdy' was expected + From schema: Documentation/devicetree/bindings/mtd/brcm,brcmnand.yaml +arch/arm64/boot/dts/broadcom/bcmbca/bcm94908.dtb: nand-controller@1800: Unevaluated properties are not allowed ('interrupt-names' was unexpected) + From schema: Documentation/devicetree/bindings/mtd/brcm,brcmnand.yaml + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/all/20230228144400.21689-1-zajec5@gmail.com/ +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +index eb2a78f4e0332..af5dc04aa1878 100644 +--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +@@ -538,7 +538,7 @@ + reg = <0x1800 0x600>, <0x2000 0x10>; + reg-names = "nand", "nand-int-base"; + interrupts = ; +- interrupt-names = "nand"; ++ interrupt-names = "nand_ctlrdy"; + status = "okay"; + + nandcs: nand@0 { +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-broadcom-bcmbca-bcm4908-fix-procmon-nodena.patch b/queue-6.2/arm64-dts-broadcom-bcmbca-bcm4908-fix-procmon-nodena.patch new file mode 100644 index 00000000000..8ede5a1374c --- /dev/null +++ b/queue-6.2/arm64-dts-broadcom-bcmbca-bcm4908-fix-procmon-nodena.patch @@ -0,0 +1,40 @@ +From 92ee92c9be1f2d24024a4167b0e459d00d6ecf06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 15:44:00 +0100 +Subject: arm64: dts: broadcom: bcmbca: bcm4908: fix procmon nodename +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit f16a8294dd7a02c7ad042cd2e3acc5ea06698dc1 ] + +This fixes: +arch/arm64/boot/dts/broadcom/bcmbca/bcm94908.dtb: syscon@280000: $nodename:0: 'syscon@280000' does not match '^([a-z][a-z0-9\\-]+-bus|bus|localbus|soc|axi|ahb|apb)(@.+)?$' + From schema: schemas/simple-bus.yaml + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/all/20230228144400.21689-3-zajec5@gmail.com/ +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +index af5dc04aa1878..343b320cbd746 100644 +--- a/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi ++++ b/arch/arm64/boot/dts/broadcom/bcmbca/bcm4908.dtsi +@@ -254,7 +254,7 @@ + }; + }; + +- procmon: syscon@280000 { ++ procmon: bus@280000 { + compatible = "simple-bus"; + reg = <0x280000 0x1000>; + ranges; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-mediatek-mt8192-asurada-fix-voltage-constr.patch b/queue-6.2/arm64-dts-mediatek-mt8192-asurada-fix-voltage-constr.patch new file mode 100644 index 00000000000..7a3f3e3d61e --- /dev/null +++ b/queue-6.2/arm64-dts-mediatek-mt8192-asurada-fix-voltage-constr.patch @@ -0,0 +1,43 @@ +From ed3d3269e36ba3fe74cbca3058482583cf23a660 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 10:55:15 +0100 +Subject: arm64: dts: mediatek: mt8192-asurada: Fix voltage constraint for Vgpu + +From: AngeloGioacchino Del Regno + +[ Upstream commit ff4c868ba8df9dcd144ab4943a50adca1cf33ba2 ] + +The MT8192 SoC specifies a maximum voltage for the GPU's digital supply +of 0.88V and the GPU OPPs are declaring a maximum voltage of 0.80V. + +In order to keep the GPU voltage in the safe range, change the maximum +voltage for mt6315@7's vbuck1 to 0.80V as sending, for any mistake, +1.193V would be catastrophic. + +Fixes: 3183cb62b033 ("arm64: dts: mediatek: asurada: Add SPMI regulators") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Chen-yu Tsai +Tested-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20230301095523.428461-12-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi +index 4b314435f8fd6..50367da93cd79 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi +@@ -935,7 +935,7 @@ + regulator-compatible = "vbuck1"; + regulator-name = "Vgpu"; + regulator-min-microvolt = <606250>; +- regulator-max-microvolt = <1193750>; ++ regulator-max-microvolt = <800000>; + regulator-enable-ramp-delay = <256>; + regulator-allowed-modes = <0 1 2>; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-apq8096-db820c-drop-unit-address-from.patch b/queue-6.2/arm64-dts-qcom-apq8096-db820c-drop-unit-address-from.patch new file mode 100644 index 00000000000..3db0d31f3dc --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-apq8096-db820c-drop-unit-address-from.patch @@ -0,0 +1,53 @@ +From a5b8359dfd175976c836876efbdf66e0e3f1300f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 19:36:22 +0100 +Subject: arm64: dts: qcom: apq8096-db820c: drop unit address from PMI8994 + regulator + +From: Krzysztof Kozlowski + +[ Upstream commit ec57cbce1a6d9384f8ac1ff966b204dc262f4927 ] + +The PMIC regulators are not supposed to have unit addresses. + +Fixes: 2317b87a2a6f ("arm64: dts: qcom: db820c: Add vdd_gfx and tie it into mmcc") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230312183622.460488-8-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8096-db820c.dts | 3 +-- + arch/arm64/boot/dts/qcom/pmi8994.dtsi | 2 -- + 2 files changed, 1 insertion(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dts b/arch/arm64/boot/dts/qcom/apq8096-db820c.dts +index fe6c415e82297..5251dbcab4d90 100644 +--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dts ++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dts +@@ -706,8 +706,7 @@ + &pmi8994_spmi_regulators { + vdd_s2-supply = <&vph_pwr>; + +- vdd_gfx: s2@1700 { +- reg = <0x1700 0x100>; ++ vdd_gfx: s2 { + regulator-name = "VDD_GFX"; + regulator-min-microvolt = <980000>; + regulator-max-microvolt = <980000>; +diff --git a/arch/arm64/boot/dts/qcom/pmi8994.dtsi b/arch/arm64/boot/dts/qcom/pmi8994.dtsi +index a0af91698d497..0192968f4d9b3 100644 +--- a/arch/arm64/boot/dts/qcom/pmi8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/pmi8994.dtsi +@@ -49,8 +49,6 @@ + + pmi8994_spmi_regulators: regulators { + compatible = "qcom,pmi8994-regulators"; +- #address-cells = <1>; +- #size-cells = <1>; + }; + + pmi8994_wled: wled@d800 { +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-ipq6018-add-remove-some-newlines.patch b/queue-6.2/arm64-dts-qcom-ipq6018-add-remove-some-newlines.patch new file mode 100644 index 00000000000..f4b54b9bcdc --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-ipq6018-add-remove-some-newlines.patch @@ -0,0 +1,103 @@ +From c1b6229f2f23a7323c1ce8585b785a2ccbd24e41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 10:46:29 +0100 +Subject: arm64: dts: qcom: ipq6018: Add/remove some newlines + +From: Konrad Dybcio + +[ Upstream commit 6db9ed9a128cbae1423d043f3debd8bfa77783fd ] + +Some lines were broken very aggresively, presumably to fit under 80 chars +and some places could have used a newline, particularly between subsequent +nodes. Address all that and remove redundant comments near PCIe ranges +while at it so as not to exceed 100 chars needlessly. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230102094642.74254-5-konrad.dybcio@linaro.org +Stable-dep-of: 75a6e1fdb351 ("arm64: dts: qcom: ipq6018: Fix the PCI I/O port range") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq6018.dtsi | 26 ++++++++++++-------------- + 1 file changed, 12 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +index 8937b10748f3e..0d9074b3b1a26 100644 +--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +@@ -102,26 +102,31 @@ + opp-microvolt = <725000>; + clock-latency-ns = <200000>; + }; ++ + opp-1056000000 { + opp-hz = /bits/ 64 <1056000000>; + opp-microvolt = <787500>; + clock-latency-ns = <200000>; + }; ++ + opp-1320000000 { + opp-hz = /bits/ 64 <1320000000>; + opp-microvolt = <862500>; + clock-latency-ns = <200000>; + }; ++ + opp-1440000000 { + opp-hz = /bits/ 64 <1440000000>; + opp-microvolt = <925000>; + clock-latency-ns = <200000>; + }; ++ + opp-1608000000 { + opp-hz = /bits/ 64 <1608000000>; + opp-microvolt = <987500>; + clock-latency-ns = <200000>; + }; ++ + opp-1800000000 { + opp-hz = /bits/ 64 <1800000000>; + opp-microvolt = <1062500>; +@@ -131,8 +136,7 @@ + + pmuv8: pmu { + compatible = "arm,cortex-a53-pmu"; +- interrupts = ; ++ interrupts = ; + }; + + psci: psci { +@@ -734,24 +738,18 @@ + phys = <&pcie_phy0>; + phy-names = "pciephy"; + +- ranges = <0x81000000 0 0x20200000 0 0x20200000 +- 0 0x10000>, /* downstream I/O */ +- <0x82000000 0 0x20220000 0 0x20220000 +- 0 0xfde0000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0 0x20200000 0 0x20200000 0 0x10000>, ++ <0x82000000 0 0x20220000 0 0x20220000 0 0xfde0000>; + + interrupts = ; + interrupt-names = "msi"; + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0x7>; +- interrupt-map = <0 0 0 1 &intc 0 75 +- IRQ_TYPE_LEVEL_HIGH>, /* int_a */ +- <0 0 0 2 &intc 0 78 +- IRQ_TYPE_LEVEL_HIGH>, /* int_b */ +- <0 0 0 3 &intc 0 79 +- IRQ_TYPE_LEVEL_HIGH>, /* int_c */ +- <0 0 0 4 &intc 0 83 +- IRQ_TYPE_LEVEL_HIGH>; /* int_d */ ++ interrupt-map = <0 0 0 1 &intc 0 75 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ ++ <0 0 0 2 &intc 0 78 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ ++ <0 0 0 3 &intc 0 79 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ ++ <0 0 0 4 &intc 0 83 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ + + clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>, + <&gcc GCC_PCIE0_AXI_M_CLK>, +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-ipq6018-fix-the-pci-i-o-port-range.patch b/queue-6.2/arm64-dts-qcom-ipq6018-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..a2a08f0a7cb --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-ipq6018-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,45 @@ +From e34a34d571e477a3059ac0e8eb9a5c065540c2d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:42 +0530 +Subject: arm64: dts: qcom: ipq6018: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 75a6e1fdb351189f55097741e8460ca3f9b2883f ] + +For 64KiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x10000. Hence, fix the bogus PCI address +(0x20200000) specified in the ranges property for I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: 095bbdd9a5c3 ("arm64: dts: qcom: ipq6018: Add pcie support") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-7-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq6018.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +index 0d9074b3b1a26..8a5eb027caba3 100644 +--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +@@ -738,8 +738,8 @@ + phys = <&pcie_phy0>; + phy-names = "pciephy"; + +- ranges = <0x81000000 0 0x20200000 0 0x20200000 0 0x10000>, +- <0x82000000 0 0x20220000 0 0x20220000 0 0xfde0000>; ++ ranges = <0x81000000 0x0 0x00000000 0x0 0x20200000 0x0 0x10000>, ++ <0x82000000 0x0 0x20220000 0x0 0x20220000 0x0 0xfde0000>; + + interrupts = ; + interrupt-names = "msi"; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-ipq6018-fix-up-indentation.patch b/queue-6.2/arm64-dts-qcom-ipq6018-fix-up-indentation.patch new file mode 100644 index 00000000000..7d86d1a24c5 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-ipq6018-fix-up-indentation.patch @@ -0,0 +1,121 @@ +From 3aaccc4657608c128d4897da6f03de426db70fcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 10:46:27 +0100 +Subject: arm64: dts: qcom: ipq6018: Fix up indentation + +From: Konrad Dybcio + +[ Upstream commit c2596b717e9d96ae57c45481acfbafe9d3d54e56 ] + +The dwc3 subnode was indented using spaces for some reason and other +properties were not exactly properly indented. Fix it. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230102094642.74254-3-konrad.dybcio@linaro.org +Stable-dep-of: 75a6e1fdb351 ("arm64: dts: qcom: ipq6018: Fix the PCI I/O port range") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq6018.dtsi | 44 +++++++++++++-------------- + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +index 6f12c1a8f90f3..d1c02efc2ea9f 100644 +--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +@@ -201,8 +201,8 @@ + compatible = "qcom,crypto-v5.1"; + reg = <0x0 0x0073a000 0x0 0x6000>; + clocks = <&gcc GCC_CRYPTO_AHB_CLK>, +- <&gcc GCC_CRYPTO_AXI_CLK>, +- <&gcc GCC_CRYPTO_CLK>; ++ <&gcc GCC_CRYPTO_AXI_CLK>, ++ <&gcc GCC_CRYPTO_CLK>; + clock-names = "iface", "bus", "core"; + dmas = <&cryptobam 2>, <&cryptobam 3>; + dma-names = "rx", "tx"; +@@ -272,7 +272,7 @@ + reg = <0x0 0x078b1000 0x0 0x200>; + interrupts = ; + clocks = <&gcc GCC_BLSP1_UART3_APPS_CLK>, +- <&gcc GCC_BLSP1_AHB_CLK>; ++ <&gcc GCC_BLSP1_AHB_CLK>; + clock-names = "core", "iface"; + status = "disabled"; + }; +@@ -285,7 +285,7 @@ + interrupts = ; + spi-max-frequency = <50000000>; + clocks = <&gcc GCC_BLSP1_QUP1_SPI_APPS_CLK>, +- <&gcc GCC_BLSP1_AHB_CLK>; ++ <&gcc GCC_BLSP1_AHB_CLK>; + clock-names = "core", "iface"; + dmas = <&blsp_dma 12>, <&blsp_dma 13>; + dma-names = "tx", "rx"; +@@ -300,7 +300,7 @@ + interrupts = ; + spi-max-frequency = <50000000>; + clocks = <&gcc GCC_BLSP1_QUP2_SPI_APPS_CLK>, +- <&gcc GCC_BLSP1_AHB_CLK>; ++ <&gcc GCC_BLSP1_AHB_CLK>; + clock-names = "core", "iface"; + dmas = <&blsp_dma 14>, <&blsp_dma 15>; + dma-names = "tx", "rx"; +@@ -358,8 +358,8 @@ + clock-names = "core", "aon"; + + dmas = <&qpic_bam 0>, +- <&qpic_bam 1>, +- <&qpic_bam 2>; ++ <&qpic_bam 1>, ++ <&qpic_bam 2>; + dma-names = "tx", "rx", "cmd"; + pinctrl-0 = <&qpic_pins>; + pinctrl-names = "default"; +@@ -372,10 +372,10 @@ + #size-cells = <2>; + interrupt-controller; + #interrupt-cells = <0x3>; +- reg = <0x0 0x0b000000 0x0 0x1000>, /*GICD*/ +- <0x0 0x0b002000 0x0 0x1000>, /*GICC*/ +- <0x0 0x0b001000 0x0 0x1000>, /*GICH*/ +- <0x0 0x0b004000 0x0 0x1000>; /*GICV*/ ++ reg = <0x0 0x0b000000 0x0 0x1000>, /*GICD*/ ++ <0x0 0x0b002000 0x0 0x1000>, /*GICC*/ ++ <0x0 0x0b001000 0x0 0x1000>, /*GICH*/ ++ <0x0 0x0b004000 0x0 0x1000>; /*GICV*/ + interrupts = ; + ranges = <0 0 0 0xb00a000 0 0xffd>; + +@@ -663,17 +663,17 @@ + status = "disabled"; + + dwc_1: usb@7000000 { +- compatible = "snps,dwc3"; +- reg = <0x0 0x07000000 0x0 0xcd00>; +- interrupts = ; +- phys = <&qusb_phy_1>; +- phy-names = "usb2-phy"; +- tx-fifo-resize; +- snps,is-utmi-l1-suspend; +- snps,hird-threshold = /bits/ 8 <0x0>; +- snps,dis_u2_susphy_quirk; +- snps,dis_u3_susphy_quirk; +- dr_mode = "host"; ++ compatible = "snps,dwc3"; ++ reg = <0x0 0x07000000 0x0 0xcd00>; ++ interrupts = ; ++ phys = <&qusb_phy_1>; ++ phy-names = "usb2-phy"; ++ tx-fifo-resize; ++ snps,is-utmi-l1-suspend; ++ snps,hird-threshold = /bits/ 8 <0x0>; ++ snps,dis_u2_susphy_quirk; ++ snps,dis_u3_susphy_quirk; ++ dr_mode = "host"; + }; + }; + +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-ipq6018-pad-addresses-to-8-hex-digits.patch b/queue-6.2/arm64-dts-qcom-ipq6018-pad-addresses-to-8-hex-digits.patch new file mode 100644 index 00000000000..6373e7101d2 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-ipq6018-pad-addresses-to-8-hex-digits.patch @@ -0,0 +1,114 @@ +From cb8bdd111958d1f23c6d67f316c1779e00bc41f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 10:46:26 +0100 +Subject: arm64: dts: qcom: ipq6018: Pad addresses to 8 hex digits + +From: Konrad Dybcio + +[ Upstream commit 647380e41520c7dbd651ebf0d9fd7dfa4928f42d ] + +Some addresses were 7-hex-digits long, or less. Fix that. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230102094642.74254-2-konrad.dybcio@linaro.org +Stable-dep-of: 75a6e1fdb351 ("arm64: dts: qcom: ipq6018: Fix the PCI I/O port range") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq6018.dtsi | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +index 2ceae73a6069e..6f12c1a8f90f3 100644 +--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +@@ -146,7 +146,7 @@ + ranges; + + rpm_msg_ram: memory@60000 { +- reg = <0x0 0x60000 0x0 0x6000>; ++ reg = <0x0 0x00060000 0x0 0x6000>; + no-map; + }; + +@@ -181,7 +181,7 @@ + + prng: qrng@e1000 { + compatible = "qcom,prng-ee"; +- reg = <0x0 0xe3000 0x0 0x1000>; ++ reg = <0x0 0x000e3000 0x0 0x1000>; + clocks = <&gcc GCC_PRNG_AHB_CLK>; + clock-names = "core"; + }; +@@ -388,7 +388,7 @@ + + pcie_phy: phy@84000 { + compatible = "qcom,ipq6018-qmp-pcie-phy"; +- reg = <0x0 0x84000 0x0 0x1bc>; /* Serdes PLL */ ++ reg = <0x0 0x00084000 0x0 0x1bc>; /* Serdes PLL */ + status = "disabled"; + #address-cells = <2>; + #size-cells = <2>; +@@ -404,10 +404,10 @@ + "common"; + + pcie_phy0: phy@84200 { +- reg = <0x0 0x84200 0x0 0x16c>, /* Serdes Tx */ +- <0x0 0x84400 0x0 0x200>, /* Serdes Rx */ +- <0x0 0x84800 0x0 0x1f0>, /* PCS: Lane0, COM, PCIE */ +- <0x0 0x84c00 0x0 0xf4>; /* pcs_misc */ ++ reg = <0x0 0x00084200 0x0 0x16c>, /* Serdes Tx */ ++ <0x0 0x00084400 0x0 0x200>, /* Serdes Rx */ ++ <0x0 0x00084800 0x0 0x1f0>, /* PCS: Lane0, COM, PCIE */ ++ <0x0 0x00084c00 0x0 0xf4>; /* pcs_misc */ + #phy-cells = <0>; + + clocks = <&gcc GCC_PCIE0_PIPE_CLK>; +@@ -623,7 +623,7 @@ + #address-cells = <1>; + #size-cells = <0>; + compatible = "qcom,ipq6018-mdio", "qcom,ipq4019-mdio"; +- reg = <0x0 0x90000 0x0 0x64>; ++ reg = <0x0 0x00090000 0x0 0x64>; + clocks = <&gcc GCC_MDIO_AHB_CLK>; + clock-names = "gcc_mdio_ahb_clk"; + status = "disabled"; +@@ -631,7 +631,7 @@ + + qusb_phy_1: qusb@59000 { + compatible = "qcom,ipq6018-qusb2-phy"; +- reg = <0x0 0x059000 0x0 0x180>; ++ reg = <0x0 0x00059000 0x0 0x180>; + #phy-cells = <0>; + + clocks = <&gcc GCC_USB1_PHY_CFG_AHB_CLK>, +@@ -664,7 +664,7 @@ + + dwc_1: usb@7000000 { + compatible = "snps,dwc3"; +- reg = <0x0 0x7000000 0x0 0xcd00>; ++ reg = <0x0 0x07000000 0x0 0xcd00>; + interrupts = ; + phys = <&qusb_phy_1>; + phy-names = "usb2-phy"; +@@ -679,7 +679,7 @@ + + ssphy_0: ssphy@78000 { + compatible = "qcom,ipq6018-qmp-usb3-phy"; +- reg = <0x0 0x78000 0x0 0x1c4>; ++ reg = <0x0 0x00078000 0x0 0x1c4>; + #address-cells = <2>; + #size-cells = <2>; + ranges; +@@ -708,7 +708,7 @@ + + qusb_phy_0: qusb@79000 { + compatible = "qcom,ipq6018-qusb2-phy"; +- reg = <0x0 0x079000 0x0 0x180>; ++ reg = <0x0 0x00079000 0x0 0x180>; + #phy-cells = <0>; + + clocks = <&gcc GCC_USB0_PHY_CFG_AHB_CLK>, +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-ipq6018-sort-nodes-properly.patch b/queue-6.2/arm64-dts-qcom-ipq6018-sort-nodes-properly.patch new file mode 100644 index 00000000000..3c5887a4b19 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-ipq6018-sort-nodes-properly.patch @@ -0,0 +1,662 @@ +From e7d34526700faa04598d1421569f6d54b380d1f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 10:46:28 +0100 +Subject: arm64: dts: qcom: ipq6018: Sort nodes properly + +From: Konrad Dybcio + +[ Upstream commit 2c6e322a41c5e1ca45be50b9d5fbcda62dc23a0d ] + +Order nodes by unit address if one exists and alphabetically otherwise. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230102094642.74254-4-konrad.dybcio@linaro.org +Stable-dep-of: 75a6e1fdb351 ("arm64: dts: qcom: ipq6018: Fix the PCI I/O port range") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq6018.dtsi | 562 +++++++++++++------------- + 1 file changed, 281 insertions(+), 281 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +index d1c02efc2ea9f..8937b10748f3e 100644 +--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +@@ -87,6 +87,12 @@ + }; + }; + ++ firmware { ++ scm { ++ compatible = "qcom,scm-ipq6018", "qcom,scm"; ++ }; ++ }; ++ + cpu_opp_table: opp-table-cpu { + compatible = "operating-points-v2"; + opp-shared; +@@ -123,12 +129,6 @@ + }; + }; + +- firmware { +- scm { +- compatible = "qcom,scm-ipq6018", "qcom,scm"; +- }; +- }; +- + pmuv8: pmu { + compatible = "arm,cortex-a53-pmu"; + interrupts = ; ++ qcom,rpm-msg-ram = <&rpm_msg_ram>; ++ mboxes = <&apcs_glb 0>; ++ ++ rpm_requests: glink-channel { ++ compatible = "qcom,rpm-ipq6018"; ++ qcom,glink-channels = "rpm_requests"; ++ ++ regulators { ++ compatible = "qcom,rpm-mp5496-regulators"; ++ ++ ipq6018_s2: s2 { ++ regulator-min-microvolt = <725000>; ++ regulator-max-microvolt = <1062500>; ++ regulator-always-on; ++ }; ++ }; ++ }; ++ }; ++ + smem { + compatible = "qcom,smem"; + memory-region = <&smem_region>; +@@ -179,6 +201,102 @@ + dma-ranges; + compatible = "simple-bus"; + ++ qusb_phy_1: qusb@59000 { ++ compatible = "qcom,ipq6018-qusb2-phy"; ++ reg = <0x0 0x00059000 0x0 0x180>; ++ #phy-cells = <0>; ++ ++ clocks = <&gcc GCC_USB1_PHY_CFG_AHB_CLK>, ++ <&xo>; ++ clock-names = "cfg_ahb", "ref"; ++ ++ resets = <&gcc GCC_QUSB2_1_PHY_BCR>; ++ status = "disabled"; ++ }; ++ ++ ssphy_0: ssphy@78000 { ++ compatible = "qcom,ipq6018-qmp-usb3-phy"; ++ reg = <0x0 0x00078000 0x0 0x1c4>; ++ #address-cells = <2>; ++ #size-cells = <2>; ++ ranges; ++ ++ clocks = <&gcc GCC_USB0_AUX_CLK>, ++ <&gcc GCC_USB0_PHY_CFG_AHB_CLK>, <&xo>; ++ clock-names = "aux", "cfg_ahb", "ref"; ++ ++ resets = <&gcc GCC_USB0_PHY_BCR>, ++ <&gcc GCC_USB3PHY_0_PHY_BCR>; ++ reset-names = "phy","common"; ++ status = "disabled"; ++ ++ usb0_ssphy: phy@78200 { ++ reg = <0x0 0x00078200 0x0 0x130>, /* Tx */ ++ <0x0 0x00078400 0x0 0x200>, /* Rx */ ++ <0x0 0x00078800 0x0 0x1f8>, /* PCS */ ++ <0x0 0x00078600 0x0 0x044>; /* PCS misc */ ++ #phy-cells = <0>; ++ #clock-cells = <0>; ++ clocks = <&gcc GCC_USB0_PIPE_CLK>; ++ clock-names = "pipe0"; ++ clock-output-names = "gcc_usb0_pipe_clk_src"; ++ }; ++ }; ++ ++ qusb_phy_0: qusb@79000 { ++ compatible = "qcom,ipq6018-qusb2-phy"; ++ reg = <0x0 0x00079000 0x0 0x180>; ++ #phy-cells = <0>; ++ ++ clocks = <&gcc GCC_USB0_PHY_CFG_AHB_CLK>, ++ <&xo>; ++ clock-names = "cfg_ahb", "ref"; ++ ++ resets = <&gcc GCC_QUSB2_0_PHY_BCR>; ++ status = "disabled"; ++ }; ++ ++ pcie_phy: phy@84000 { ++ compatible = "qcom,ipq6018-qmp-pcie-phy"; ++ reg = <0x0 0x00084000 0x0 0x1bc>; /* Serdes PLL */ ++ status = "disabled"; ++ #address-cells = <2>; ++ #size-cells = <2>; ++ ranges; ++ ++ clocks = <&gcc GCC_PCIE0_AUX_CLK>, ++ <&gcc GCC_PCIE0_AHB_CLK>; ++ clock-names = "aux", "cfg_ahb"; ++ ++ resets = <&gcc GCC_PCIE0_PHY_BCR>, ++ <&gcc GCC_PCIE0PHY_PHY_BCR>; ++ reset-names = "phy", ++ "common"; ++ ++ pcie_phy0: phy@84200 { ++ reg = <0x0 0x00084200 0x0 0x16c>, /* Serdes Tx */ ++ <0x0 0x00084400 0x0 0x200>, /* Serdes Rx */ ++ <0x0 0x00084800 0x0 0x1f0>, /* PCS: Lane0, COM, PCIE */ ++ <0x0 0x00084c00 0x0 0xf4>; /* pcs_misc */ ++ #phy-cells = <0>; ++ ++ clocks = <&gcc GCC_PCIE0_PIPE_CLK>; ++ clock-names = "pipe0"; ++ clock-output-names = "gcc_pcie0_pipe_clk_src"; ++ #clock-cells = <0>; ++ }; ++ }; ++ ++ mdio: mdio@90000 { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ compatible = "qcom,ipq6018-mdio", "qcom,ipq4019-mdio"; ++ reg = <0x0 0x00090000 0x0 0x64>; ++ clocks = <&gcc GCC_MDIO_AHB_CLK>; ++ clock-names = "gcc_mdio_ahb_clk"; ++ status = "disabled"; ++ }; ++ + prng: qrng@e1000 { + compatible = "qcom,prng-ee"; + reg = <0x0 0x000e3000 0x0 0x1000>; +@@ -257,6 +375,41 @@ + reg = <0x0 0x01937000 0x0 0x21000>; + }; + ++ usb2: usb@70f8800 { ++ compatible = "qcom,ipq6018-dwc3", "qcom,dwc3"; ++ reg = <0x0 0x070F8800 0x0 0x400>; ++ #address-cells = <2>; ++ #size-cells = <2>; ++ ranges; ++ clocks = <&gcc GCC_USB1_MASTER_CLK>, ++ <&gcc GCC_USB1_SLEEP_CLK>, ++ <&gcc GCC_USB1_MOCK_UTMI_CLK>; ++ clock-names = "core", ++ "sleep", ++ "mock_utmi"; ++ ++ assigned-clocks = <&gcc GCC_USB1_MASTER_CLK>, ++ <&gcc GCC_USB1_MOCK_UTMI_CLK>; ++ assigned-clock-rates = <133330000>, ++ <24000000>; ++ resets = <&gcc GCC_USB1_BCR>; ++ status = "disabled"; ++ ++ dwc_1: usb@7000000 { ++ compatible = "snps,dwc3"; ++ reg = <0x0 0x07000000 0x0 0xcd00>; ++ interrupts = ; ++ phys = <&qusb_phy_1>; ++ phy-names = "usb2-phy"; ++ tx-fifo-resize; ++ snps,is-utmi-l1-suspend; ++ snps,hird-threshold = /bits/ 8 <0x0>; ++ snps,dis_u2_susphy_quirk; ++ snps,dis_u3_susphy_quirk; ++ dr_mode = "host"; ++ }; ++ }; ++ + blsp_dma: dma-controller@7884000 { + compatible = "qcom,bam-v1.7.0"; + reg = <0x0 0x07884000 0x0 0x2b000>; +@@ -366,6 +519,49 @@ + status = "disabled"; + }; + ++ usb3: usb@8af8800 { ++ compatible = "qcom,ipq6018-dwc3", "qcom,dwc3"; ++ reg = <0x0 0x08af8800 0x0 0x400>; ++ #address-cells = <2>; ++ #size-cells = <2>; ++ ranges; ++ ++ clocks = <&gcc GCC_SYS_NOC_USB0_AXI_CLK>, ++ <&gcc GCC_USB0_MASTER_CLK>, ++ <&gcc GCC_USB0_SLEEP_CLK>, ++ <&gcc GCC_USB0_MOCK_UTMI_CLK>; ++ clock-names = "cfg_noc", ++ "core", ++ "sleep", ++ "mock_utmi"; ++ ++ assigned-clocks = <&gcc GCC_SYS_NOC_USB0_AXI_CLK>, ++ <&gcc GCC_USB0_MASTER_CLK>, ++ <&gcc GCC_USB0_MOCK_UTMI_CLK>; ++ assigned-clock-rates = <133330000>, ++ <133330000>, ++ <20000000>; ++ ++ resets = <&gcc GCC_USB0_BCR>; ++ status = "disabled"; ++ ++ dwc_0: usb@8a00000 { ++ compatible = "snps,dwc3"; ++ reg = <0x0 0x08a00000 0x0 0xcd00>; ++ interrupts = ; ++ phys = <&qusb_phy_0>, <&usb0_ssphy>; ++ phy-names = "usb2-phy", "usb3-phy"; ++ clocks = <&xo>; ++ clock-names = "ref"; ++ tx-fifo-resize; ++ snps,is-utmi-l1-suspend; ++ snps,hird-threshold = /bits/ 8 <0x0>; ++ snps,dis_u2_susphy_quirk; ++ snps,dis_u3_susphy_quirk; ++ dr_mode = "host"; ++ }; ++ }; ++ + intc: interrupt-controller@b000000 { + compatible = "qcom,msm-qgic2"; + #address-cells = <2>; +@@ -386,130 +582,29 @@ + }; + }; + +- pcie_phy: phy@84000 { +- compatible = "qcom,ipq6018-qmp-pcie-phy"; +- reg = <0x0 0x00084000 0x0 0x1bc>; /* Serdes PLL */ +- status = "disabled"; +- #address-cells = <2>; +- #size-cells = <2>; +- ranges; +- +- clocks = <&gcc GCC_PCIE0_AUX_CLK>, +- <&gcc GCC_PCIE0_AHB_CLK>; +- clock-names = "aux", "cfg_ahb"; +- +- resets = <&gcc GCC_PCIE0_PHY_BCR>, +- <&gcc GCC_PCIE0PHY_PHY_BCR>; +- reset-names = "phy", +- "common"; ++ watchdog@b017000 { ++ compatible = "qcom,kpss-wdt"; ++ interrupts = ; ++ reg = <0x0 0x0b017000 0x0 0x40>; ++ clocks = <&sleep_clk>; ++ timeout-sec = <10>; ++ }; + +- pcie_phy0: phy@84200 { +- reg = <0x0 0x00084200 0x0 0x16c>, /* Serdes Tx */ +- <0x0 0x00084400 0x0 0x200>, /* Serdes Rx */ +- <0x0 0x00084800 0x0 0x1f0>, /* PCS: Lane0, COM, PCIE */ +- <0x0 0x00084c00 0x0 0xf4>; /* pcs_misc */ +- #phy-cells = <0>; ++ apcs_glb: mailbox@b111000 { ++ compatible = "qcom,ipq6018-apcs-apps-global"; ++ reg = <0x0 0x0b111000 0x0 0x1000>; ++ #clock-cells = <1>; ++ clocks = <&a53pll>, <&xo>; ++ clock-names = "pll", "xo"; ++ #mbox-cells = <1>; ++ }; + +- clocks = <&gcc GCC_PCIE0_PIPE_CLK>; +- clock-names = "pipe0"; +- clock-output-names = "gcc_pcie0_pipe_clk_src"; +- #clock-cells = <0>; +- }; +- }; +- +- pcie0: pci@20000000 { +- compatible = "qcom,pcie-ipq6018"; +- reg = <0x0 0x20000000 0x0 0xf1d>, +- <0x0 0x20000f20 0x0 0xa8>, +- <0x0 0x20001000 0x0 0x1000>, +- <0x0 0x80000 0x0 0x4000>, +- <0x0 0x20100000 0x0 0x1000>; +- reg-names = "dbi", "elbi", "atu", "parf", "config"; +- +- device_type = "pci"; +- linux,pci-domain = <0>; +- bus-range = <0x00 0xff>; +- num-lanes = <1>; +- max-link-speed = <3>; +- #address-cells = <3>; +- #size-cells = <2>; +- +- phys = <&pcie_phy0>; +- phy-names = "pciephy"; +- +- ranges = <0x81000000 0 0x20200000 0 0x20200000 +- 0 0x10000>, /* downstream I/O */ +- <0x82000000 0 0x20220000 0 0x20220000 +- 0 0xfde0000>; /* non-prefetchable memory */ +- +- interrupts = ; +- interrupt-names = "msi"; +- +- #interrupt-cells = <1>; +- interrupt-map-mask = <0 0 0 0x7>; +- interrupt-map = <0 0 0 1 &intc 0 75 +- IRQ_TYPE_LEVEL_HIGH>, /* int_a */ +- <0 0 0 2 &intc 0 78 +- IRQ_TYPE_LEVEL_HIGH>, /* int_b */ +- <0 0 0 3 &intc 0 79 +- IRQ_TYPE_LEVEL_HIGH>, /* int_c */ +- <0 0 0 4 &intc 0 83 +- IRQ_TYPE_LEVEL_HIGH>; /* int_d */ +- +- clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>, +- <&gcc GCC_PCIE0_AXI_M_CLK>, +- <&gcc GCC_PCIE0_AXI_S_CLK>, +- <&gcc GCC_PCIE0_AXI_S_BRIDGE_CLK>, +- <&gcc PCIE0_RCHNG_CLK>; +- clock-names = "iface", +- "axi_m", +- "axi_s", +- "axi_bridge", +- "rchng"; +- +- resets = <&gcc GCC_PCIE0_PIPE_ARES>, +- <&gcc GCC_PCIE0_SLEEP_ARES>, +- <&gcc GCC_PCIE0_CORE_STICKY_ARES>, +- <&gcc GCC_PCIE0_AXI_MASTER_ARES>, +- <&gcc GCC_PCIE0_AXI_SLAVE_ARES>, +- <&gcc GCC_PCIE0_AHB_ARES>, +- <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>, +- <&gcc GCC_PCIE0_AXI_SLAVE_STICKY_ARES>; +- reset-names = "pipe", +- "sleep", +- "sticky", +- "axi_m", +- "axi_s", +- "ahb", +- "axi_m_sticky", +- "axi_s_sticky"; +- +- status = "disabled"; +- }; +- +- watchdog@b017000 { +- compatible = "qcom,kpss-wdt"; +- interrupts = ; +- reg = <0x0 0x0b017000 0x0 0x40>; +- clocks = <&sleep_clk>; +- timeout-sec = <10>; +- }; +- +- apcs_glb: mailbox@b111000 { +- compatible = "qcom,ipq6018-apcs-apps-global"; +- reg = <0x0 0x0b111000 0x0 0x1000>; +- #clock-cells = <1>; +- clocks = <&a53pll>, <&xo>; +- clock-names = "pll", "xo"; +- #mbox-cells = <1>; +- }; +- +- a53pll: clock@b116000 { +- compatible = "qcom,ipq6018-a53pll"; +- reg = <0x0 0x0b116000 0x0 0x40>; +- #clock-cells = <0>; +- clocks = <&xo>; +- clock-names = "xo"; ++ a53pll: clock@b116000 { ++ compatible = "qcom,ipq6018-a53pll"; ++ reg = <0x0 0x0b116000 0x0 0x40>; ++ #clock-cells = <0>; ++ clocks = <&xo>; ++ clock-names = "xo"; + }; + + timer@b120000 { +@@ -619,147 +714,74 @@ + }; + }; + +- mdio: mdio@90000 { +- #address-cells = <1>; +- #size-cells = <0>; +- compatible = "qcom,ipq6018-mdio", "qcom,ipq4019-mdio"; +- reg = <0x0 0x00090000 0x0 0x64>; +- clocks = <&gcc GCC_MDIO_AHB_CLK>; +- clock-names = "gcc_mdio_ahb_clk"; +- status = "disabled"; +- }; +- +- qusb_phy_1: qusb@59000 { +- compatible = "qcom,ipq6018-qusb2-phy"; +- reg = <0x0 0x00059000 0x0 0x180>; +- #phy-cells = <0>; +- +- clocks = <&gcc GCC_USB1_PHY_CFG_AHB_CLK>, +- <&xo>; +- clock-names = "cfg_ahb", "ref"; +- +- resets = <&gcc GCC_QUSB2_1_PHY_BCR>; +- status = "disabled"; +- }; +- +- usb2: usb@70f8800 { +- compatible = "qcom,ipq6018-dwc3", "qcom,dwc3"; +- reg = <0x0 0x070F8800 0x0 0x400>; +- #address-cells = <2>; +- #size-cells = <2>; +- ranges; +- clocks = <&gcc GCC_USB1_MASTER_CLK>, +- <&gcc GCC_USB1_SLEEP_CLK>, +- <&gcc GCC_USB1_MOCK_UTMI_CLK>; +- clock-names = "core", +- "sleep", +- "mock_utmi"; +- +- assigned-clocks = <&gcc GCC_USB1_MASTER_CLK>, +- <&gcc GCC_USB1_MOCK_UTMI_CLK>; +- assigned-clock-rates = <133330000>, +- <24000000>; +- resets = <&gcc GCC_USB1_BCR>; +- status = "disabled"; +- +- dwc_1: usb@7000000 { +- compatible = "snps,dwc3"; +- reg = <0x0 0x07000000 0x0 0xcd00>; +- interrupts = ; +- phys = <&qusb_phy_1>; +- phy-names = "usb2-phy"; +- tx-fifo-resize; +- snps,is-utmi-l1-suspend; +- snps,hird-threshold = /bits/ 8 <0x0>; +- snps,dis_u2_susphy_quirk; +- snps,dis_u3_susphy_quirk; +- dr_mode = "host"; +- }; +- }; ++ pcie0: pci@20000000 { ++ compatible = "qcom,pcie-ipq6018"; ++ reg = <0x0 0x20000000 0x0 0xf1d>, ++ <0x0 0x20000f20 0x0 0xa8>, ++ <0x0 0x20001000 0x0 0x1000>, ++ <0x0 0x80000 0x0 0x4000>, ++ <0x0 0x20100000 0x0 0x1000>; ++ reg-names = "dbi", "elbi", "atu", "parf", "config"; + +- ssphy_0: ssphy@78000 { +- compatible = "qcom,ipq6018-qmp-usb3-phy"; +- reg = <0x0 0x00078000 0x0 0x1c4>; +- #address-cells = <2>; ++ device_type = "pci"; ++ linux,pci-domain = <0>; ++ bus-range = <0x00 0xff>; ++ num-lanes = <1>; ++ max-link-speed = <3>; ++ #address-cells = <3>; + #size-cells = <2>; +- ranges; +- +- clocks = <&gcc GCC_USB0_AUX_CLK>, +- <&gcc GCC_USB0_PHY_CFG_AHB_CLK>, <&xo>; +- clock-names = "aux", "cfg_ahb", "ref"; +- +- resets = <&gcc GCC_USB0_PHY_BCR>, +- <&gcc GCC_USB3PHY_0_PHY_BCR>; +- reset-names = "phy","common"; +- status = "disabled"; +- +- usb0_ssphy: phy@78200 { +- reg = <0x0 0x00078200 0x0 0x130>, /* Tx */ +- <0x0 0x00078400 0x0 0x200>, /* Rx */ +- <0x0 0x00078800 0x0 0x1f8>, /* PCS */ +- <0x0 0x00078600 0x0 0x044>; /* PCS misc */ +- #phy-cells = <0>; +- #clock-cells = <0>; +- clocks = <&gcc GCC_USB0_PIPE_CLK>; +- clock-names = "pipe0"; +- clock-output-names = "gcc_usb0_pipe_clk_src"; +- }; +- }; + +- qusb_phy_0: qusb@79000 { +- compatible = "qcom,ipq6018-qusb2-phy"; +- reg = <0x0 0x00079000 0x0 0x180>; +- #phy-cells = <0>; ++ phys = <&pcie_phy0>; ++ phy-names = "pciephy"; + +- clocks = <&gcc GCC_USB0_PHY_CFG_AHB_CLK>, +- <&xo>; +- clock-names = "cfg_ahb", "ref"; ++ ranges = <0x81000000 0 0x20200000 0 0x20200000 ++ 0 0x10000>, /* downstream I/O */ ++ <0x82000000 0 0x20220000 0 0x20220000 ++ 0 0xfde0000>; /* non-prefetchable memory */ + +- resets = <&gcc GCC_QUSB2_0_PHY_BCR>; +- status = "disabled"; +- }; ++ interrupts = ; ++ interrupt-names = "msi"; + +- usb3: usb@8af8800 { +- compatible = "qcom,ipq6018-dwc3", "qcom,dwc3"; +- reg = <0x0 0x8af8800 0x0 0x400>; +- #address-cells = <2>; +- #size-cells = <2>; +- ranges; ++ #interrupt-cells = <1>; ++ interrupt-map-mask = <0 0 0 0x7>; ++ interrupt-map = <0 0 0 1 &intc 0 75 ++ IRQ_TYPE_LEVEL_HIGH>, /* int_a */ ++ <0 0 0 2 &intc 0 78 ++ IRQ_TYPE_LEVEL_HIGH>, /* int_b */ ++ <0 0 0 3 &intc 0 79 ++ IRQ_TYPE_LEVEL_HIGH>, /* int_c */ ++ <0 0 0 4 &intc 0 83 ++ IRQ_TYPE_LEVEL_HIGH>; /* int_d */ + +- clocks = <&gcc GCC_SYS_NOC_USB0_AXI_CLK>, +- <&gcc GCC_USB0_MASTER_CLK>, +- <&gcc GCC_USB0_SLEEP_CLK>, +- <&gcc GCC_USB0_MOCK_UTMI_CLK>; +- clock-names = "cfg_noc", +- "core", +- "sleep", +- "mock_utmi"; ++ clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>, ++ <&gcc GCC_PCIE0_AXI_M_CLK>, ++ <&gcc GCC_PCIE0_AXI_S_CLK>, ++ <&gcc GCC_PCIE0_AXI_S_BRIDGE_CLK>, ++ <&gcc PCIE0_RCHNG_CLK>; ++ clock-names = "iface", ++ "axi_m", ++ "axi_s", ++ "axi_bridge", ++ "rchng"; + +- assigned-clocks = <&gcc GCC_SYS_NOC_USB0_AXI_CLK>, +- <&gcc GCC_USB0_MASTER_CLK>, +- <&gcc GCC_USB0_MOCK_UTMI_CLK>; +- assigned-clock-rates = <133330000>, +- <133330000>, +- <20000000>; ++ resets = <&gcc GCC_PCIE0_PIPE_ARES>, ++ <&gcc GCC_PCIE0_SLEEP_ARES>, ++ <&gcc GCC_PCIE0_CORE_STICKY_ARES>, ++ <&gcc GCC_PCIE0_AXI_MASTER_ARES>, ++ <&gcc GCC_PCIE0_AXI_SLAVE_ARES>, ++ <&gcc GCC_PCIE0_AHB_ARES>, ++ <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>, ++ <&gcc GCC_PCIE0_AXI_SLAVE_STICKY_ARES>; ++ reset-names = "pipe", ++ "sleep", ++ "sticky", ++ "axi_m", ++ "axi_s", ++ "ahb", ++ "axi_m_sticky", ++ "axi_s_sticky"; + +- resets = <&gcc GCC_USB0_BCR>; + status = "disabled"; +- +- dwc_0: usb@8a00000 { +- compatible = "snps,dwc3"; +- reg = <0x0 0x8a00000 0x0 0xcd00>; +- interrupts = ; +- phys = <&qusb_phy_0>, <&usb0_ssphy>; +- phy-names = "usb2-phy", "usb3-phy"; +- clocks = <&xo>; +- clock-names = "ref"; +- tx-fifo-resize; +- snps,is-utmi-l1-suspend; +- snps,hird-threshold = /bits/ 8 <0x0>; +- snps,dis_u2_susphy_quirk; +- snps,dis_u3_susphy_quirk; +- dr_mode = "host"; +- }; + }; + }; + +@@ -794,26 +816,4 @@ + #interrupt-cells = <2>; + }; + }; +- +- rpm-glink { +- compatible = "qcom,glink-rpm"; +- interrupts = ; +- qcom,rpm-msg-ram = <&rpm_msg_ram>; +- mboxes = <&apcs_glb 0>; +- +- rpm_requests: glink-channel { +- compatible = "qcom,rpm-ipq6018"; +- qcom,glink-channels = "rpm_requests"; +- +- regulators { +- compatible = "qcom,rpm-mp5496-regulators"; +- +- ipq6018_s2: s2 { +- regulator-min-microvolt = <725000>; +- regulator-max-microvolt = <1062500>; +- regulator-always-on; +- }; +- }; +- }; +- }; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-ipq6018-use-lowercase-hex.patch b/queue-6.2/arm64-dts-qcom-ipq6018-use-lowercase-hex.patch new file mode 100644 index 00000000000..15b5770146f --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-ipq6018-use-lowercase-hex.patch @@ -0,0 +1,64 @@ +From 953ff3becaee3fb9a4e3e7c81dd687b6481d7f4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 12:10:29 +0100 +Subject: arm64: dts: qcom: ipq6018: Use lowercase hex + +From: Konrad Dybcio + +[ Upstream commit 0431dba3733bf52dacf7382e7b0c1b4c0b59e88d ] + +Use lowercase hex, as that's the preferred and overwhermingly present +style. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221212111037.98160-2-konrad.dybcio@linaro.org +Stable-dep-of: 75a6e1fdb351 ("arm64: dts: qcom: ipq6018: Fix the PCI I/O port range") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq6018.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +index 5d453f11acd98..2ceae73a6069e 100644 +--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +@@ -679,7 +679,7 @@ + + ssphy_0: ssphy@78000 { + compatible = "qcom,ipq6018-qmp-usb3-phy"; +- reg = <0x0 0x78000 0x0 0x1C4>; ++ reg = <0x0 0x78000 0x0 0x1c4>; + #address-cells = <2>; + #size-cells = <2>; + ranges; +@@ -696,7 +696,7 @@ + usb0_ssphy: phy@78200 { + reg = <0x0 0x00078200 0x0 0x130>, /* Tx */ + <0x0 0x00078400 0x0 0x200>, /* Rx */ +- <0x0 0x00078800 0x0 0x1F8>, /* PCS */ ++ <0x0 0x00078800 0x0 0x1f8>, /* PCS */ + <0x0 0x00078600 0x0 0x044>; /* PCS misc */ + #phy-cells = <0>; + #clock-cells = <0>; +@@ -721,7 +721,7 @@ + + usb3: usb@8af8800 { + compatible = "qcom,ipq6018-dwc3", "qcom,dwc3"; +- reg = <0x0 0x8AF8800 0x0 0x400>; ++ reg = <0x0 0x8af8800 0x0 0x400>; + #address-cells = <2>; + #size-cells = <2>; + ranges; +@@ -747,7 +747,7 @@ + + dwc_0: usb@8a00000 { + compatible = "snps,dwc3"; +- reg = <0x0 0x8A00000 0x0 0xcd00>; ++ reg = <0x0 0x8a00000 0x0 0xcd00>; + interrupts = ; + phys = <&qusb_phy_0>, <&usb0_ssphy>; + phy-names = "usb2-phy", "usb3-phy"; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch b/queue-6.2/arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..39e883ab715 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,61 @@ +From c5fd700d0a7a11766bf613550033632f04f2a958 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:41 +0530 +Subject: arm64: dts: qcom: ipq8074: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit e49eafefe5ab325e38dd074f2005076ffc271e54 ] + +For 64KiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x10000. Hence, fix the bogus PCI addresses +(0x10200000, 0x20200000) specified in the ranges property for I/O region. + +While at it, let's use the missing 0x prefix for the addresses and align +them in a single line. + +Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-6-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index 4294beeb494fd..ffb50e5ea2efd 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -772,10 +772,8 @@ + phys = <&pcie_phy1>; + phy-names = "pciephy"; + +- ranges = <0x81000000 0 0x10200000 0x10200000 +- 0 0x10000>, /* downstream I/O */ +- <0x82000000 0 0x10220000 0x10220000 +- 0 0xfde0000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0x0 0x00000000 0x10200000 0x0 0x10000>, /* I/O */ ++ <0x82000000 0x0 0x10220000 0x10220000 0x0 0xfde0000>; /* MEM */ + + interrupts = ; + interrupt-names = "msi"; +@@ -836,10 +834,8 @@ + phys = <&pcie_phy0>; + phy-names = "pciephy"; + +- ranges = <0x81000000 0 0x20200000 0x20200000 +- 0 0x10000>, /* downstream I/O */ +- <0x82000000 0 0x20220000 0x20220000 +- 0 0xfde0000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0x0 0x00000000 0x20200000 0x0 0x10000>, /* I/O */ ++ <0x82000000 0x0 0x20220000 0x20220000 0x0 0xfde0000>; /* MEM */ + + interrupts = ; + interrupt-names = "msi"; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-msm8976-add-and-provide-xo-clk-to-rpm.patch b/queue-6.2/arm64-dts-qcom-msm8976-add-and-provide-xo-clk-to-rpm.patch new file mode 100644 index 00000000000..c939bf233a6 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-msm8976-add-and-provide-xo-clk-to-rpm.patch @@ -0,0 +1,70 @@ +From 965510dad43f55108aaa6e068e6855aa4b194f58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Mar 2023 13:30:49 +0100 +Subject: arm64: dts: qcom: msm8976: Add and provide xo clk to rpmcc + +From: Adam Skladowski + +[ Upstream commit 4a2c9b9e1215c557c17a48e3fabe9b1674c1d608 ] + +In order for consumers of RPMCC XO clock to probe successfully +their parent needs to be feed with reference clock to obtain proper rate, +add fixed xo-board clock and supply it to rpmcc to make consumers happy. +Frequency setting is left per board basis just like on other recent trees. + +Fixes: 0484d3ce0902 ("arm64: dts: qcom: Add DTS for MSM8976 and MSM8956 SoCs") +Fixes: ff7f6d34ca07 ("arm64: dts: qcom: Add support for SONY Xperia X/X Compact") +Signed-off-by: Adam Skladowski +Reviewed-by: Dmitry Baryshkov +[bjorn: Squashed the two patches] +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230302123051.12440-1-a39.skl@gmail.com +Link: https://lore.kernel.org/r/20230302123051.12440-2-a39.skl@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8956-sony-xperia-loire.dtsi | 4 ++++ + arch/arm64/boot/dts/qcom/msm8976.dtsi | 9 +++++++++ + 2 files changed, 13 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8956-sony-xperia-loire.dtsi b/arch/arm64/boot/dts/qcom/msm8956-sony-xperia-loire.dtsi +index 67baced639c91..085d79542e1bb 100644 +--- a/arch/arm64/boot/dts/qcom/msm8956-sony-xperia-loire.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8956-sony-xperia-loire.dtsi +@@ -280,3 +280,7 @@ + vdda3p3-supply = <&pm8950_l13>; + status = "okay"; + }; ++ ++&xo_board { ++ clock-frequency = <19200000>; ++}; +diff --git a/arch/arm64/boot/dts/qcom/msm8976.dtsi b/arch/arm64/boot/dts/qcom/msm8976.dtsi +index 05dcb30b07795..c125ebcdd1e47 100644 +--- a/arch/arm64/boot/dts/qcom/msm8976.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8976.dtsi +@@ -20,6 +20,13 @@ + + chosen { }; + ++ clocks { ++ xo_board: xo-board { ++ compatible = "fixed-clock"; ++ #clock-cells = <0>; ++ }; ++ }; ++ + cpus { + #address-cells = <1>; + #size-cells = <0>; +@@ -351,6 +358,8 @@ + + rpmcc: clock-controller { + compatible = "qcom,rpmcc-msm8976", "qcom,rpmcc"; ++ clocks = <&xo_board>; ++ clock-names = "xo"; + #clock-cells = <1>; + }; + +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-msm8994-angler-fix-cont_splash_mem-ma.patch b/queue-6.2/arm64-dts-qcom-msm8994-angler-fix-cont_splash_mem-ma.patch new file mode 100644 index 00000000000..87072eaf875 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-msm8994-angler-fix-cont_splash_mem-ma.patch @@ -0,0 +1,57 @@ +From 940d52d320b01d0fdc2feb9f77c8ba9513dd74b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 21:04:13 +0100 +Subject: arm64: dts: qcom: msm8994-angler: Fix cont_splash_mem mapping + +From: Petr Vorel + +[ Upstream commit fe88480a6be92ecbf6f205ff3a7d7e5ded0562dd ] + +Angler's cont_splash_mem mapping is shorter in downstream [1], +therefore 380cd3a34b7f was wrong. Obviously also 0e5ded926f2a was wrong +(workaround which fixed booting at the time). + +This fixes error: +[ 0.000000] memory@3401000 (0x0000000003401000--0x0000000005601000) overlaps with tzapp@4800000 (0x0000000004800000--0x0000000006100000) + +[1] https://android.googlesource.com/kernel/msm/+/refs/heads/android-msm-angler-3.10-marshmallow-mr1/arch/arm64/boot/dts/huawei/huawei_msm8994_angler_row_vn1/huawei-fingerprint.dtsi#16 + +Fixes: 380cd3a34b7f ("arm64: dts: msm8994-angler: fix the memory map") +Fixes: 0e5ded926f2a ("arm64: dts: qcom: msm8994-angler: Disable cont_splash_mem") + +Signed-off-by: Petr Vorel +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230131200414.24373-2-pvorel@suse.cz +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts +index 7b0f62144c3ee..59b9ed78cf0cb 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts ++++ b/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts +@@ -2,7 +2,7 @@ + /* + * Copyright (c) 2015, Huawei Inc. All rights reserved. + * Copyright (c) 2016, The Linux Foundation. All rights reserved. +- * Copyright (c) 2021-2022, Petr Vorel ++ * Copyright (c) 2021-2023, Petr Vorel + */ + + /dts-v1/; +@@ -31,6 +31,11 @@ + #size-cells = <2>; + ranges; + ++ cont_splash_mem: memory@3401000 { ++ reg = <0 0x03401000 0 0x1000000>; ++ no-map; ++ }; ++ + tzapp_mem: tzapp@4800000 { + reg = <0 0x04800000 0 0x1900000>; + no-map; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-msm8994-angler-removed-clash-with-sme.patch b/queue-6.2/arm64-dts-qcom-msm8994-angler-removed-clash-with-sme.patch new file mode 100644 index 00000000000..c110bda479e --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-msm8994-angler-removed-clash-with-sme.patch @@ -0,0 +1,81 @@ +From 24d0c03bcfdc67d185ff8563e836c97a2f859a81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 21:04:14 +0100 +Subject: arm64: dts: qcom: msm8994-angler: removed clash with smem_region + +From: Petr Vorel + +[ Upstream commit c85c8a992794dfcd7cea7a41871710c27c5592a6 ] + +This fixes memory overlap error: +[ 0.000000] reserved@6300000 (0x0000000006300000--0x0000000007000000) overlaps with smem_region@6a00000 (0x0000000006a00000--0x0000000006c00000) + +smem_region is the same as in downstream (qcom,smem) [1], therefore +split reserved memory into two sections on either side of smem_region. + +Not adding labels as it's not expected to be used. + +[1] https://android.googlesource.com/kernel/msm/+/refs/heads/android-msm-angler-3.10-marshmallow-mr1/arch/arm/boot/dts/qcom/msm8994.dtsi#948 + +Fixes: 380cd3a34b7f ("arm64: dts: msm8994-angler: fix the memory map") + +Signed-off-by: Petr Vorel +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230131200414.24373-3-pvorel@suse.cz +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi | 5 ----- + arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts | 4 ++-- + arch/arm64/boot/dts/qcom/msm8994.dtsi | 5 +++++ + 3 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +index cd77dcb558722..b8f2a01bcb96c 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +@@ -60,11 +60,6 @@ + reg = <0x0 0x05000000 0x0 0x1a00000>; + no-map; + }; +- +- reserved@6c00000 { +- reg = <0x0 0x06c00000 0x0 0x400000>; +- no-map; +- }; + }; + }; + +diff --git a/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts +index 59b9ed78cf0cb..29e79ae0849d8 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts ++++ b/arch/arm64/boot/dts/qcom/msm8994-huawei-angler-rev-101.dts +@@ -41,8 +41,8 @@ + no-map; + }; + +- removed_region: reserved@6300000 { +- reg = <0 0x06300000 0 0xD00000>; ++ reserved@6300000 { ++ reg = <0 0x06300000 0 0x700000>; + no-map; + }; + }; +diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi +index 9ff9d35496d21..24c3fced8df71 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi +@@ -228,6 +228,11 @@ + reg = <0 0xc9400000 0 0x3f00000>; + no-map; + }; ++ ++ reserved@6c00000 { ++ reg = <0 0x06c00000 0 0x400000>; ++ no-map; ++ }; + }; + + smd { +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-msm8994-kitakami-drop-unit-address-fr.patch b/queue-6.2/arm64-dts-qcom-msm8994-kitakami-drop-unit-address-fr.patch new file mode 100644 index 00000000000..482ad610d7d --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-msm8994-kitakami-drop-unit-address-fr.patch @@ -0,0 +1,39 @@ +From 029ed09ab58b17d6dca494a6df4fb7321da4acb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 19:36:20 +0100 +Subject: arm64: dts: qcom: msm8994-kitakami: drop unit address from PMI8994 + regulator + +From: Krzysztof Kozlowski + +[ Upstream commit 3555dd528ba9c08d6ccd56239c695dbeac3b63e3 ] + +The PMIC regulators are not supposed to have unit addresses. + +Fixes: e9783584c9b7 ("arm64: dts: qcom: msm8994-kitakami: Add VDD_GFX regulator") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230312183622.460488-6-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi b/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi +index f3d153c349188..db2282c9f68bf 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994-sony-xperia-kitakami.dtsi +@@ -173,8 +173,7 @@ + * power domain.. which still isn't enough and forces us to bind + * OXILI_CX and OXILI_GX together! + */ +- vdd_gfx: s2@1700 { +- reg = <0x1700 0x100>; ++ vdd_gfx: s2 { + regulator-name = "VDD_GFX"; + regulator-min-microvolt = <980000>; + regulator-max-microvolt = <980000>; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-msm8994-msft-lumia-octagon-drop-unit-.patch b/queue-6.2/arm64-dts-qcom-msm8994-msft-lumia-octagon-drop-unit-.patch new file mode 100644 index 00000000000..c78d3e7699d --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-msm8994-msft-lumia-octagon-drop-unit-.patch @@ -0,0 +1,39 @@ +From e24641531d32902b747020323ea79d76e10b9f9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 19:36:21 +0100 +Subject: arm64: dts: qcom: msm8994-msft-lumia-octagon: drop unit address from + PMI8994 regulator + +From: Krzysztof Kozlowski + +[ Upstream commit 7a202df0f3eed006e4a9e7c06d62cf67be56c14c ] + +The PMIC regulators are not supposed to have unit addresses. + +Fixes: 60b214effb80 ("arm64: dts: qcom: msm8994-octagon: Configure regulators") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230312183622.460488-7-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi b/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi +index 9b67f0d3820cd..63dda2ab06241 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi +@@ -542,8 +542,7 @@ + }; + + &pmi8994_spmi_regulators { +- vdd_gfx: s2@1700 { +- reg = <0x1700 0x100>; ++ vdd_gfx: s2 { + regulator-min-microvolt = <980000>; + regulator-max-microvolt = <980000>; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch b/queue-6.2/arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..aad8a9cb7bd --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,68 @@ +From 99bb9978f2946c450658bead9a3c3986dcad78eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:43 +0530 +Subject: arm64: dts: qcom: msm8996: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit cf0ac10feb17661987d0018eb9475dc03e2a2253 ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses +(0x0c200000, 0x0d200000, 0x0e200000) specified in the ranges property for +I/O region. + +While at it, let's also align the entries. + +Fixes: ed965ef89227 ("arm64: dts: qcom: msm8996: add support to pcie") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-8-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 71678749d66f6..25d97cc2d08ff 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -1841,8 +1841,8 @@ + + #address-cells = <3>; + #size-cells = <2>; +- ranges = <0x01000000 0x0 0x0c200000 0x0c200000 0x0 0x100000>, +- <0x02000000 0x0 0x0c300000 0x0c300000 0x0 0xd00000>; ++ ranges = <0x01000000 0x0 0x00000000 0x0c200000 0x0 0x100000>, ++ <0x02000000 0x0 0x0c300000 0x0c300000 0x0 0xd00000>; + + device_type = "pci"; + +@@ -1895,8 +1895,8 @@ + + #address-cells = <3>; + #size-cells = <2>; +- ranges = <0x01000000 0x0 0x0d200000 0x0d200000 0x0 0x100000>, +- <0x02000000 0x0 0x0d300000 0x0d300000 0x0 0xd00000>; ++ ranges = <0x01000000 0x0 0x00000000 0x0d200000 0x0 0x100000>, ++ <0x02000000 0x0 0x0d300000 0x0d300000 0x0 0xd00000>; + + device_type = "pci"; + +@@ -1946,8 +1946,8 @@ + + #address-cells = <3>; + #size-cells = <2>; +- ranges = <0x01000000 0x0 0x0e200000 0x0e200000 0x0 0x100000>, +- <0x02000000 0x0 0x0e300000 0x0e300000 0x0 0x1d00000>; ++ ranges = <0x01000000 0x0 0x00000000 0x0e200000 0x0 0x100000>, ++ <0x02000000 0x0 0x0e300000 0x0e300000 0x0 0x1d00000>; + + device_type = "pci"; + +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch b/queue-6.2/arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch new file mode 100644 index 00000000000..4f178354654 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch @@ -0,0 +1,37 @@ +From 45d8ebd3cedb673b0be5e7a0f47196a6501e5e1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 22:03:31 +0100 +Subject: arm64: dts: qcom: msm8998: Fix stm-stimulus-base reg name + +From: Konrad Dybcio + +[ Upstream commit b5d08f08377218b1d2ab4026e427a7788b271c8e ] + +The name stm-data-base comes from ancient (msm-3.10 or older) +downstream kernels. Upstream uses stm-stimulus-base instead. Fix it. + +Fixes: 783abfa2249a ("arm64: dts: qcom: msm8998: Add Coresight support") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230213210331.2106877-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi +index 539382dab0ada..923017a4f9250 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -1514,7 +1514,7 @@ + compatible = "arm,coresight-stm", "arm,primecell"; + reg = <0x06002000 0x1000>, + <0x16280000 0x180000>; +- reg-names = "stm-base", "stm-data-base"; ++ reg-names = "stm-base", "stm-stimulus-base"; + status = "disabled"; + + clocks = <&rpmcc RPM_SMD_QDSS_CLK>, <&rpmcc RPM_SMD_QDSS_A_CLK>; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch b/queue-6.2/arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..e3de16be683 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,41 @@ +From f8e44ddb797fed4174cc84ae81c5c5323303addb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:38 +0530 +Subject: arm64: dts: qcom: msm8998: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit c30a27dcfe4545edbda1578b3a63ed6147519cdd ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address +(0x1b200000) specified in the ranges property for I/O region. + +Fixes: b84dfd175c09 ("arm64: dts: qcom: msm8998: Add PCIe PHY and RC nodes") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-3-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi +index 923017a4f9250..c8c76338ae18b 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -916,7 +916,7 @@ + phy-names = "pciephy"; + status = "disabled"; + +- ranges = <0x01000000 0x0 0x1b200000 0x1b200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x1b200000 0x0 0x100000>, + <0x02000000 0x0 0x1b300000 0x1b300000 0x0 0xd00000>; + + #interrupt-cells = <1>; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-msm8998-oneplus-cheeseburger-revert-f.patch b/queue-6.2/arm64-dts-qcom-msm8998-oneplus-cheeseburger-revert-f.patch new file mode 100644 index 00000000000..b73adf27792 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-msm8998-oneplus-cheeseburger-revert-f.patch @@ -0,0 +1,43 @@ +From 0b3cfb565a6e58ca274789e1cee0ff946a807b33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 19:36:19 +0100 +Subject: arm64: dts: qcom: msm8998-oneplus-cheeseburger: revert "fix backlight + pin function" + +From: Krzysztof Kozlowski + +[ Upstream commit 97b4fdc6b82d6d5cfb92a9b164540278720fb700 ] + +This reverts commit 46546f28825cf3a5ef6873b9cf947cd85c8a7258 because it +mistakenly took PMIC pinctrl/GPIO as TLMM. The TLMM pinctrl uses "gpio" +function, but PMIC uses "normal", so original code was correct: + + msm8998-oneplus-cheeseburger.dtb: pmic@2: gpio@c000:button-backlight-state: 'oneOf' conditional failed, one must be fixed: + 'gpio' is not one of ['normal', 'paired', 'func1', 'func2', 'dtest1', 'dtest2', 'dtest3', 'dtest4', 'func3', 'func4'] + +Fixes: 46546f28825c ("arm64: dts: qcom: msm8998-oneplus-cheeseburger: fix backlight pin function") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230312183622.460488-5-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998-oneplus-cheeseburger.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998-oneplus-cheeseburger.dts b/arch/arm64/boot/dts/qcom/msm8998-oneplus-cheeseburger.dts +index 9fb1fb9b85298..794e9f2ab77ab 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998-oneplus-cheeseburger.dts ++++ b/arch/arm64/boot/dts/qcom/msm8998-oneplus-cheeseburger.dts +@@ -34,7 +34,7 @@ + &pmi8998_gpio { + button_backlight_default: button-backlight-state { + pins = "gpio5"; +- function = "gpio"; ++ function = "normal"; + bias-pull-down; + qcom,drive-strength = ; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sc7180-trogdor-lazor-correct-trackpad.patch b/queue-6.2/arm64-dts-qcom-sc7180-trogdor-lazor-correct-trackpad.patch new file mode 100644 index 00000000000..e827f5dcd1f --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sc7180-trogdor-lazor-correct-trackpad.patch @@ -0,0 +1,42 @@ +From 06527d10d6ccf2acc6c8a9cd7352f212742a0e5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 19:36:17 +0100 +Subject: arm64: dts: qcom: sc7180-trogdor-lazor: correct trackpad supply + +From: Krzysztof Kozlowski + +[ Upstream commit 52e2996f253d82520011340d40dbc1c76ea79208 ] + +The hid-over-i2c takes VDD, not VCC supply. Fix copy-pasta from other +boards which use elan,ekth3000 with valid VCC: + + sc7180-trogdor-lazor-limozeen-nots-r4.dtb: trackpad@2c: 'vcc-supply' does not match any of the regexes: 'pinctrl-[0-9]+' + +Fixes: 2c26adb8dbab ("arm64: dts: qcom: Add sc7180-lazor-limozeen skus") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Stephen Boyd +Reviewed-by: Douglas Anderson +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230312183622.460488-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + .../boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts +index 850776c5323d1..70d5a7aa88735 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-limozeen-nots-r4.dts +@@ -26,7 +26,7 @@ + interrupt-parent = <&tlmm>; + interrupts = <58 IRQ_TYPE_EDGE_FALLING>; + +- vcc-supply = <&pp3300_fp_tp>; ++ vdd-supply = <&pp3300_fp_tp>; + hid-descr-addr = <0x20>; + + wakeup-source; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sc7180-trogdor-pazquel-correct-trackp.patch b/queue-6.2/arm64-dts-qcom-sc7180-trogdor-pazquel-correct-trackp.patch new file mode 100644 index 00000000000..1b5af671b57 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sc7180-trogdor-pazquel-correct-trackp.patch @@ -0,0 +1,42 @@ +From e14d67db1fff6e015cd9b43068d47e64bf304b1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 19:36:18 +0100 +Subject: arm64: dts: qcom: sc7180-trogdor-pazquel: correct trackpad supply + +From: Krzysztof Kozlowski + +[ Upstream commit 24f39eec6a70768e7c2eb2f3d8158f45050ff75a ] + +The hid-over-i2c takes VDD, not VCC supply. Fix copy-pasta from other +boards which use elan,ekth3000 with valid VCC: + + sc7180-trogdor-pazquel360-lte.dtb: trackpad@15: 'vcc-supply' does not match any of the regexes: 'pinctrl-[0-9]+' + +Fixes: fb69f6adaf88 ("arm64: dts: qcom: sc7180: Add pazquel dts files") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Stephen Boyd +Reviewed-by: Douglas Anderson +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230312183622.460488-4-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180-trogdor-pazquel.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-pazquel.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-pazquel.dtsi +index d06cc4ea33756..8823edbb4d6e2 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-pazquel.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-pazquel.dtsi +@@ -39,7 +39,7 @@ + interrupt-parent = <&tlmm>; + interrupts = <0 IRQ_TYPE_EDGE_FALLING>; + +- vcc-supply = <&pp3300_fp_tp>; ++ vdd-supply = <&pp3300_fp_tp>; + post-power-on-delay-ms = <100>; + hid-descr-addr = <0x0001>; + +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sc7280-fix-eud-port-properties.patch b/queue-6.2/arm64-dts-qcom-sc7280-fix-eud-port-properties.patch new file mode 100644 index 00000000000..e074c35dc1d --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sc7280-fix-eud-port-properties.patch @@ -0,0 +1,61 @@ +From 7dd76deb23fa5355c3828048db47efd5e4e7f910 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 13:59:05 +0100 +Subject: arm64: dts: qcom: sc7280: fix EUD port properties + +From: Krzysztof Kozlowski + +[ Upstream commit a369c74243ca4ad60b9de0ac5c2207fb4c4117b8 ] + +Nodes with unit addresses must have also 'reg' property: + + sc7280-herobrine-crd.dtb: eud@88e0000: ports:port@0: 'reg' is a required property + +Fixes: 0b059979090d ("arm64: dts: qcom: sc7280: Add EUD dt node and dwc3 connector") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Reviewed-by: Souradeep Chowdhury +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230308125906.236885-10-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index a407cd2579719..3218d5396981d 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -3592,12 +3592,17 @@ + <0 0x88e2000 0 0x1000>; + interrupts-extended = <&pdc 11 IRQ_TYPE_LEVEL_HIGH>; + ports { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ + port@0 { ++ reg = <0>; + eud_ep: endpoint { + remote-endpoint = <&usb2_role_switch>; + }; + }; + port@1 { ++ reg = <1>; + eud_con: endpoint { + remote-endpoint = <&con_eud>; + }; +@@ -3608,7 +3613,11 @@ + eud_typec: connector { + compatible = "usb-c-connector"; + ports { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ + port@0 { ++ reg = <0>; + con_eud: endpoint { + remote-endpoint = <&eud_con>; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sc7280-fix-the-pci-i-o-port-range.patch b/queue-6.2/arm64-dts-qcom-sc7280-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..16f32d88642 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sc7280-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,41 @@ +From d609b0700c2ad79104883289c355b2046029c2a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:39 +0530 +Subject: arm64: dts: qcom: sc7280: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 1d4743d6312582978966d38908b69085621b7693 ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address +(0x40200000) specified in the ranges property for I/O region. + +Fixes: 92e0ee9f83b3 ("arm64: dts: qcom: sc7280: Add PCIe and PHY related nodes") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-4-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index 3218d5396981d..7ff3a4504d0b1 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -2068,7 +2068,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x40200000 0x0 0x40200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>, + <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>; + + interrupts = ; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sc7280-herobrine-villager-correct-tra.patch b/queue-6.2/arm64-dts-qcom-sc7280-herobrine-villager-correct-tra.patch new file mode 100644 index 00000000000..8613a2910a3 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sc7280-herobrine-villager-correct-tra.patch @@ -0,0 +1,42 @@ +From 4a873d443c75e7c188d8b513a493db82a9a082d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 19:36:16 +0100 +Subject: arm64: dts: qcom: sc7280-herobrine-villager: correct trackpad supply + +From: Krzysztof Kozlowski + +[ Upstream commit de88b1759b35086d5e63736fb604ea2d06486b1a ] + +The hid-over-i2c takes VDD, not VCC supply. Fix copy-pasta from other +Herobrine boards which use elan,ekth3000 with valid VCC: + + sc7280-herobrine-villager-r1-lte.dtb: trackpad@2c: 'vcc-supply' does not match any of the regexes: 'pinctrl-[0-9]+' + +Fixes: ee2a62116015 ("arm64: dts: qcom: sc7280: Add device tree for herobrine villager") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Stephen Boyd +Reviewed-by: Douglas Anderson +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230312183622.460488-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280-herobrine-villager.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280-herobrine-villager.dtsi b/arch/arm64/boot/dts/qcom/sc7280-herobrine-villager.dtsi +index 17553e0fd6fd9..43d76ea8869fb 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280-herobrine-villager.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280-herobrine-villager.dtsi +@@ -33,7 +33,7 @@ ap_tp_i2c: &i2c0 { + interrupts = <7 IRQ_TYPE_EDGE_FALLING>; + + hid-descr-addr = <0x20>; +- vcc-supply = <&pp3300_z1>; ++ vdd-supply = <&pp3300_z1>; + + wakeup-source; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sc8280xp-fix-the-pci-i-o-port-range.patch b/queue-6.2/arm64-dts-qcom-sc8280xp-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..a4fb4077c3d --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sc8280xp-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,78 @@ +From e4a1f15e1d41cd4b73a32020777eaca08ae1d904 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:46 +0530 +Subject: arm64: dts: qcom: sc8280xp: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 89fe81c01715f81c3a7d371e9e5f7d7ae5bc557c ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses +(0x30200000, 0x32200000, 0x34200000, 0x38200000, 0x3c200000) specified in +the ranges property for I/O region. + +Fixes: 813e83157001 ("arm64: dts: qcom: sc8280xp/sa8540p: add PCIe2-4 nodes") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-11-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index 8363e82369854..966dca906bf07 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -902,7 +902,7 @@ + reg-names = "parf", "dbi", "elbi", "atu", "config"; + #address-cells = <3>; + #size-cells = <2>; +- ranges = <0x01000000 0x0 0x30200000 0x0 0x30200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x30200000 0x0 0x100000>, + <0x02000000 0x0 0x30300000 0x0 0x30300000 0x0 0x1d00000>; + bus-range = <0x00 0xff>; + +@@ -1001,7 +1001,7 @@ + reg-names = "parf", "dbi", "elbi", "atu", "config"; + #address-cells = <3>; + #size-cells = <2>; +- ranges = <0x01000000 0x0 0x32200000 0x0 0x32200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x32200000 0x0 0x100000>, + <0x02000000 0x0 0x32300000 0x0 0x32300000 0x0 0x1d00000>; + bus-range = <0x00 0xff>; + +@@ -1098,7 +1098,7 @@ + reg-names = "parf", "dbi", "elbi", "atu", "config"; + #address-cells = <3>; + #size-cells = <2>; +- ranges = <0x01000000 0x0 0x34200000 0x0 0x34200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x34200000 0x0 0x100000>, + <0x02000000 0x0 0x34300000 0x0 0x34300000 0x0 0x1d00000>; + bus-range = <0x00 0xff>; + +@@ -1198,7 +1198,7 @@ + reg-names = "parf", "dbi", "elbi", "atu", "config"; + #address-cells = <3>; + #size-cells = <2>; +- ranges = <0x01000000 0x0 0x38200000 0x0 0x38200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x38200000 0x0 0x100000>, + <0x02000000 0x0 0x38300000 0x0 0x38300000 0x0 0x1d00000>; + bus-range = <0x00 0xff>; + +@@ -1295,7 +1295,7 @@ + reg-names = "parf", "dbi", "elbi", "atu", "config"; + #address-cells = <3>; + #size-cells = <2>; +- ranges = <0x01000000 0x0 0x3c200000 0x0 0x3c200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x3c200000 0x0 0x100000>, + <0x02000000 0x0 0x3c300000 0x0 0x3c300000 0x0 0x1d00000>; + bus-range = <0x00 0xff>; + +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sdm845-align-tlmm-pin-configuration-w.patch b/queue-6.2/arm64-dts-qcom-sdm845-align-tlmm-pin-configuration-w.patch new file mode 100644 index 00000000000..5f83f9bf120 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sdm845-align-tlmm-pin-configuration-w.patch @@ -0,0 +1,2610 @@ +From 6f38379a8def4eb47d5a78dc924f5d62fc2fce21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 16:13:18 +0100 +Subject: arm64: dts: qcom: sdm845: align TLMM pin configuration with DT schema + +From: Krzysztof Kozlowski + +[ Upstream commit d05e342882e4fb2ccd8e4b6af00b0b82e22ad325 ] + +DT schema expects TLMM pin configuration nodes to be named with +'-state' suffix and their optional children with '-pins' suffix. + +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Douglas Anderson +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221222151319.122398-3-krzysztof.kozlowski@linaro.org +Stable-dep-of: 37f7349b56de ("arm64: dts: sdm845: Rename qspi data12 as data23") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi | 397 ++++------ + arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 93 +-- + .../arm64/boot/dts/qcom/sdm845-lg-common.dtsi | 60 +- + arch/arm64/boot/dts/qcom/sdm845-lg-judyln.dts | 2 +- + arch/arm64/boot/dts/qcom/sdm845-mtp.dts | 77 +- + .../boot/dts/qcom/sdm845-oneplus-common.dtsi | 101 +-- + .../boot/dts/qcom/sdm845-shift-axolotl.dts | 150 ++-- + .../dts/qcom/sdm845-sony-xperia-tama.dtsi | 6 +- + .../qcom/sdm845-xiaomi-beryllium-common.dtsi | 12 +- + .../boot/dts/qcom/sdm845-xiaomi-polaris.dts | 21 +- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 689 ++++++++---------- + .../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 53 +- + .../boot/dts/qcom/sdm850-samsung-w737.dts | 121 +-- + 13 files changed, 701 insertions(+), 1081 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi b/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi +index ca676e04687b0..246d9339728c2 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi +@@ -995,104 +995,69 @@ ap_ts_i2c: &i2c14 { + /* PINCTRL - additions to nodes defined in sdm845.dtsi */ + + &qspi_cs0 { +- pinconf { +- pins = "gpio90"; +- bias-disable; +- }; ++ bias-disable; + }; + + &qspi_clk { +- pinconf { +- pins = "gpio95"; +- bias-disable; +- }; ++ bias-disable; + }; + + &qspi_data01 { +- pinconf { +- pins = "gpio91", "gpio92"; +- +- /* High-Z when no transfers; nice to park the lines */ +- bias-pull-up; +- }; ++ /* High-Z when no transfers; nice to park the lines */ ++ bias-pull-up; + }; + + &qup_i2c3_default { +- pinconf { +- pins = "gpio41", "gpio42"; +- drive-strength = <2>; ++ drive-strength = <2>; + +- /* Has external pullup */ +- bias-disable; +- }; ++ /* Has external pullup */ ++ bias-disable; + }; + + &qup_i2c11_default { +- pinconf { +- pins = "gpio31", "gpio32"; +- drive-strength = <2>; ++ drive-strength = <2>; + +- /* Has external pullup */ +- bias-disable; +- }; ++ /* Has external pullup */ ++ bias-disable; + }; + + &qup_i2c12_default { +- pinconf { +- pins = "gpio49", "gpio50"; +- drive-strength = <2>; ++ drive-strength = <2>; + +- /* Has external pullup */ +- bias-disable; +- }; ++ /* Has external pullup */ ++ bias-disable; + }; + + &qup_i2c14_default { +- pinconf { +- pins = "gpio33", "gpio34"; +- drive-strength = <2>; ++ drive-strength = <2>; + +- /* Has external pullup */ +- bias-disable; +- }; ++ /* Has external pullup */ ++ bias-disable; + }; + + &qup_spi0_default { +- pinconf { +- pins = "gpio0", "gpio1", "gpio2", "gpio3"; +- drive-strength = <2>; +- bias-disable; +- }; ++ drive-strength = <2>; ++ bias-disable; + }; + + &qup_spi5_default { +- pinconf { +- pins = "gpio85", "gpio86", "gpio87", "gpio88"; +- drive-strength = <2>; +- bias-disable; +- }; ++ drive-strength = <2>; ++ bias-disable; + }; + + &qup_spi10_default { +- pinconf { +- pins = "gpio53", "gpio54", "gpio55", "gpio56"; +- drive-strength = <2>; +- bias-disable; +- }; ++ drive-strength = <2>; ++ bias-disable; + }; + +-&qup_uart9_default { +- pinconf-tx { +- pins = "gpio4"; +- drive-strength = <2>; +- bias-disable; +- }; ++&qup_uart9_rx { ++ drive-strength = <2>; ++ bias-pull-up; ++}; + +- pinconf-rx { +- pins = "gpio5"; +- drive-strength = <2>; +- bias-pull-up; +- }; ++&qup_uart9_tx { ++ drive-strength = <2>; ++ bias-disable; + }; + + /* PINCTRL - board-specific pinctrl */ +@@ -1180,243 +1145,153 @@ ap_ts_i2c: &i2c14 { + output-low; + }; + +- ap_edp_bklten: ap-edp-bklten { +- pinmux { +- pins = "gpio37"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio37"; +- drive-strength = <2>; +- bias-disable; +- }; ++ ap_edp_bklten: ap-edp-bklten-state { ++ pins = "gpio37"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-disable; + }; + +- bios_flash_wp_r_l: bios-flash-wp-r-l { +- pinmux { +- pins = "gpio128"; +- function = "gpio"; +- input-enable; +- }; +- +- pinconf { +- pins = "gpio128"; +- bias-disable; +- }; ++ bios_flash_wp_r_l: bios-flash-wp-r-l-state { ++ pins = "gpio128"; ++ function = "gpio"; ++ input-enable; ++ bias-disable; + }; + +- ec_ap_int_l: ec-ap-int-l { +- pinmux { +- pins = "gpio122"; +- function = "gpio"; +- input-enable; +- }; +- +- pinconf { +- pins = "gpio122"; +- bias-pull-up; +- }; ++ ec_ap_int_l: ec-ap-int-l-state { ++ pins = "gpio122"; ++ function = "gpio"; ++ input-enable; ++ bias-pull-up; + }; + +- edp_brij_en: edp-brij-en { +- pinmux { +- pins = "gpio102"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio102"; +- drive-strength = <2>; +- bias-disable; +- }; ++ edp_brij_en: edp-brij-en-state { ++ pins = "gpio102"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-disable; + }; + +- edp_brij_irq: edp-brij-irq { +- pinmux { +- pins = "gpio10"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio10"; +- drive-strength = <2>; +- bias-pull-down; +- }; ++ edp_brij_irq: edp-brij-irq-state { ++ pins = "gpio10"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-pull-down; + }; + +- en_pp3300_dx_edp: en-pp3300-dx-edp { +- pinmux { +- pins = "gpio43"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio43"; +- drive-strength = <2>; +- bias-disable; +- }; ++ en_pp3300_dx_edp: en-pp3300-dx-edp-state { ++ pins = "gpio43"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-disable; + }; + +- h1_ap_int_odl: h1-ap-int-odl { +- pinmux { +- pins = "gpio129"; +- function = "gpio"; +- input-enable; +- }; +- +- pinconf { +- pins = "gpio129"; +- bias-pull-up; +- }; ++ h1_ap_int_odl: h1-ap-int-odl-state { ++ pins = "gpio129"; ++ function = "gpio"; ++ input-enable; ++ bias-pull-up; + }; + +- pen_eject_odl: pen-eject-odl { +- pinmux { +- pins = "gpio119"; +- function = "gpio"; +- bias-pull-up; +- }; ++ pen_eject_odl: pen-eject-odl-state { ++ pins = "gpio119"; ++ function = "gpio"; ++ bias-pull-up; + }; + +- pen_irq_l: pen-irq-l { +- pinmux { +- pins = "gpio24"; +- function = "gpio"; +- }; ++ pen_irq_l: pen-irq-l-state { ++ pins = "gpio24"; ++ function = "gpio"; + +- pinconf { +- pins = "gpio24"; +- +- /* Has external pullup */ +- bias-disable; +- }; ++ /* Has external pullup */ ++ bias-disable; + }; + +- pen_pdct_l: pen-pdct-l { +- pinmux { +- pins = "gpio63"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio63"; ++ pen_pdct_l: pen-pdct-l-state { ++ pins = "gpio63"; ++ function = "gpio"; + +- /* Has external pullup */ +- bias-disable; +- }; ++ /* Has external pullup */ ++ bias-disable; + }; + +- pen_rst_l: pen-rst-l { +- pinmux { +- pins = "gpio23"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio23"; +- bias-disable; +- drive-strength = <2>; ++ pen_rst_l: pen-rst-l-state { ++ pins = "gpio23"; ++ function = "gpio"; ++ bias-disable; ++ drive-strength = <2>; + +- /* +- * The pen driver doesn't currently support +- * driving this reset line. By specifying +- * output-high here we're relying on the fact +- * that this pin has a default pulldown at boot +- * (which makes sure the pen was in reset if it +- * was powered) and then we set it high here to +- * take it out of reset. Better would be if the +- * pen driver could control this and we could +- * remove "output-high" here. +- */ +- output-high; +- }; ++ /* ++ * The pen driver doesn't currently support ++ * driving this reset line. By specifying ++ * output-high here we're relying on the fact ++ * that this pin has a default pulldown at boot ++ * (which makes sure the pen was in reset if it ++ * was powered) and then we set it high here to ++ * take it out of reset. Better would be if the ++ * pen driver could control this and we could ++ * remove "output-high" here. ++ */ ++ output-high; + }; + +- sdc2_clk: sdc2-clk { +- pinconf { +- pins = "sdc2_clk"; +- bias-disable; ++ sdc2_clk: sdc2-clk-state { ++ pins = "sdc2_clk"; ++ bias-disable; + +- /* +- * It seems that mmc_test reports errors if drive +- * strength is not 16. +- */ +- drive-strength = <16>; +- }; ++ /* ++ * It seems that mmc_test reports errors if drive ++ * strength is not 16. ++ */ ++ drive-strength = <16>; + }; + +- sdc2_cmd: sdc2-cmd { +- pinconf { +- pins = "sdc2_cmd"; +- bias-pull-up; +- drive-strength = <16>; +- }; ++ sdc2_cmd: sdc2-cmd-state { ++ pins = "sdc2_cmd"; ++ bias-pull-up; ++ drive-strength = <16>; + }; + +- sdc2_data: sdc2-data { +- pinconf { +- pins = "sdc2_data"; +- bias-pull-up; +- drive-strength = <16>; +- }; ++ sdc2_data: sdc2-data-state { ++ pins = "sdc2_data"; ++ bias-pull-up; ++ drive-strength = <16>; + }; + +- sd_cd_odl: sd-cd-odl { +- pinmux { +- pins = "gpio44"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio44"; +- bias-pull-up; +- }; ++ sd_cd_odl: sd-cd-odl-state { ++ pins = "gpio44"; ++ function = "gpio"; ++ bias-pull-up; + }; + +- ts_int_l: ts-int-l { +- pinmux { +- pins = "gpio125"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio125"; +- bias-pull-up; +- }; ++ ts_int_l: ts-int-l-state { ++ pins = "gpio125"; ++ function = "gpio"; ++ bias-pull-up; + }; + +- ts_reset_l: ts-reset-l { +- pinmux { +- pins = "gpio118"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio118"; +- bias-disable; +- drive-strength = <2>; +- }; ++ ts_reset_l: ts-reset-l-state { ++ pins = "gpio118"; ++ function = "gpio"; ++ bias-disable; ++ drive-strength = <2>; + }; + +- ap_suspend_l_assert: ap_suspend_l_assert { +- config { +- pins = "gpio126"; +- function = "gpio"; +- bias-disable; +- drive-strength = <2>; +- output-low; +- }; ++ ap_suspend_l_assert: ap-suspend-l-assert-state { ++ pins = "gpio126"; ++ function = "gpio"; ++ bias-disable; ++ drive-strength = <2>; ++ output-low; + }; + +- ap_suspend_l_deassert: ap_suspend_l_deassert { +- config { +- pins = "gpio126"; +- function = "gpio"; +- bias-disable; +- drive-strength = <2>; +- output-high; +- }; ++ ap_suspend_l_deassert: ap-suspend-l-deassert-state { ++ pins = "gpio126"; ++ function = "gpio"; ++ bias-disable; ++ drive-strength = <2>; ++ output-high; + }; + }; + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +index 75a4645936232..8d814a139daf7 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +@@ -825,8 +825,8 @@ + }; + + &tlmm { +- cam0_default: cam0_default { +- rst { ++ cam0_default: cam0-default-state { ++ rst-pins { + pins = "gpio9"; + function = "gpio"; + +@@ -834,7 +834,7 @@ + bias-disable; + }; + +- mclk0 { ++ mclk0-pins { + pins = "gpio13"; + function = "cam_mclk"; + +@@ -843,8 +843,8 @@ + }; + }; + +- cam3_default: cam3_default { +- rst { ++ cam3_default: cam3-default-state { ++ rst-pins { + function = "gpio"; + pins = "gpio21"; + +@@ -852,7 +852,7 @@ + bias-disable; + }; + +- mclk3 { ++ mclk3-pins { + function = "cam_mclk"; + pins = "gpio16"; + +@@ -861,7 +861,7 @@ + }; + }; + +- dsi_sw_sel: dsi-sw-sel { ++ dsi_sw_sel: dsi-sw-sel-state { + pins = "gpio120"; + function = "gpio"; + +@@ -870,20 +870,20 @@ + output-high; + }; + +- lt9611_irq_pin: lt9611-irq { ++ lt9611_irq_pin: lt9611-irq-state { + pins = "gpio84"; + function = "gpio"; + bias-disable; + }; + +- pcie0_default_state: pcie0-default { +- clkreq { ++ pcie0_default_state: pcie0-default-state { ++ clkreq-pins { + pins = "gpio36"; + function = "pci_e0"; + bias-pull-up; + }; + +- reset-n { ++ reset-n-pins { + pins = "gpio35"; + function = "gpio"; + +@@ -892,7 +892,7 @@ + bias-pull-down; + }; + +- wake-n { ++ wake-n-pins { + pins = "gpio37"; + function = "gpio"; + +@@ -901,7 +901,7 @@ + }; + }; + +- pcie0_pwren_state: pcie0-pwren { ++ pcie0_pwren_state: pcie0-pwren-state { + pins = "gpio90"; + function = "gpio"; + +@@ -909,8 +909,8 @@ + bias-disable; + }; + +- pcie1_default_state: pcie1-default { +- perst-n { ++ pcie1_default_state: pcie1-default-state { ++ perst-n-pins { + pins = "gpio102"; + function = "gpio"; + +@@ -918,13 +918,13 @@ + bias-disable; + }; + +- clkreq { ++ clkreq-pins { + pins = "gpio103"; + function = "pci_e1"; + bias-pull-up; + }; + +- wake-n { ++ wake-n-pins { + pins = "gpio11"; + function = "gpio"; + +@@ -932,7 +932,7 @@ + bias-pull-up; + }; + +- reset-n { ++ reset-n-pins { + pins = "gpio75"; + function = "gpio"; + +@@ -942,8 +942,8 @@ + }; + }; + +- sdc2_default_state: sdc2-default { +- clk { ++ sdc2_default_state: sdc2-default-state { ++ clk-pins { + pins = "sdc2_clk"; + bias-disable; + +@@ -954,26 +954,26 @@ + drive-strength = <16>; + }; + +- cmd { ++ cmd-pins { + pins = "sdc2_cmd"; + bias-pull-up; + drive-strength = <10>; + }; + +- data { ++ data-pins { + pins = "sdc2_data"; + bias-pull-up; + drive-strength = <10>; + }; + }; + +- sdc2_card_det_n: sd-card-det-n { ++ sdc2_card_det_n: sd-card-det-n-state { + pins = "gpio126"; + function = "gpio"; + bias-pull-up; + }; + +- wcd_intr_default: wcd_intr_default { ++ wcd_intr_default: wcd-intr-default-state { + pins = "gpio54"; + function = "gpio"; + +@@ -985,6 +985,8 @@ + + &uart3 { + label = "LS-UART0"; ++ pinctrl-0 = <&qup_uart3_4pin>; ++ + status = "disabled"; + }; + +@@ -1130,39 +1132,22 @@ + + /* PINCTRL - additions to nodes defined in sdm845.dtsi */ + &qup_spi2_default { +- pinconf { +- pins = "gpio27", "gpio28", "gpio29", "gpio30"; +- drive-strength = <16>; +- }; +-}; +- +-&qup_uart3_default { +- pinmux { +- pins = "gpio41", "gpio42", "gpio43", "gpio44"; +- function = "qup3"; +- }; ++ drive-strength = <16>; + }; + + &qup_i2c10_default { +- pinconf { +- pins = "gpio55", "gpio56"; +- drive-strength = <2>; +- bias-disable; +- }; ++ drive-strength = <2>; ++ bias-disable; + }; + +-&qup_uart9_default { +- pinconf-tx { +- pins = "gpio4"; +- drive-strength = <2>; +- bias-disable; +- }; ++&qup_uart9_rx { ++ drive-strength = <2>; ++ bias-pull-up; ++}; + +- pinconf-rx { +- pins = "gpio5"; +- drive-strength = <2>; +- bias-pull-up; +- }; ++&qup_uart9_tx { ++ drive-strength = <2>; ++ bias-disable; + }; + + &pm8998_gpio { +@@ -1171,8 +1156,6 @@ + + /* PINCTRL - additions to nodes defined in sdm845.dtsi */ + &qup_spi0_default { +- config { +- drive-strength = <6>; +- bias-disable; +- }; ++ drive-strength = <6>; ++ bias-disable; + }; +diff --git a/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi +index 943287804e1a6..539d82d2f84da 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi +@@ -553,48 +553,36 @@ + &tlmm { + gpio-reserved-ranges = <28 4>, <81 4>; + +- sdc2_clk: sdc2-clk { +- pinconf { +- pins = "sdc2_clk"; +- bias-disable; +- +- /* +- * It seems that mmc_test reports errors if drive +- * strength is not 16 on clk, cmd, and data pins. +- * +- * TODO: copy-pasted from mtp, try other values +- * on these devices. +- */ +- drive-strength = <16>; +- }; ++ sdc2_clk: sdc2-clk-state { ++ pins = "sdc2_clk"; ++ bias-disable; ++ ++ /* ++ * It seems that mmc_test reports errors if drive ++ * strength is not 16 on clk, cmd, and data pins. ++ * ++ * TODO: copy-pasted from mtp, try other values ++ * on these devices. ++ */ ++ drive-strength = <16>; + }; + +- sdc2_cmd: sdc2-cmd { +- pinconf { +- pins = "sdc2_cmd"; +- bias-pull-up; +- drive-strength = <16>; +- }; ++ sdc2_cmd: sdc2-cmd-state { ++ pins = "sdc2_cmd"; ++ bias-pull-up; ++ drive-strength = <16>; + }; + +- sdc2_data: sdc2-data { +- pinconf { +- pins = "sdc2_data"; +- bias-pull-up; +- drive-strength = <16>; +- }; ++ sdc2_data: sdc2-data-state { ++ pins = "sdc2_data"; ++ bias-pull-up; ++ drive-strength = <16>; + }; + +- sd_card_det_n: sd-card-det-n { +- pinmux { +- pins = "gpio126"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio126"; +- bias-pull-up; +- }; ++ sd_card_det_n: sd-card-det-n-state { ++ pins = "gpio126"; ++ function = "gpio"; ++ bias-pull-up; + }; + }; + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-lg-judyln.dts b/arch/arm64/boot/dts/qcom/sdm845-lg-judyln.dts +index 7d967a104b3eb..a12723310c8b6 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-lg-judyln.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-lg-judyln.dts +@@ -58,7 +58,7 @@ + }; + + &tlmm { +- thinq_key_default: thinq-key-default { ++ thinq_key_default: thinq-key-default-state { + pins = "gpio89"; + function = "gpio"; + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts +index de2d10e0315af..7c5478b71f8b1 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts +@@ -719,68 +719,49 @@ + /* PINCTRL - additions to nodes defined in sdm845.dtsi */ + + &qup_i2c10_default { +- pinconf { +- pins = "gpio55", "gpio56"; +- drive-strength = <2>; +- bias-disable; +- }; ++ drive-strength = <2>; ++ bias-disable; + }; + +-&qup_uart9_default { +- pinconf-tx { +- pins = "gpio4"; +- drive-strength = <2>; +- bias-disable; +- }; ++&qup_uart9_rx { ++ drive-strength = <2>; ++ bias-pull-up; ++}; + +- pinconf-rx { +- pins = "gpio5"; +- drive-strength = <2>; +- bias-pull-up; +- }; ++&qup_uart9_tx { ++ drive-strength = <2>; ++ bias-disable; + }; + + &tlmm { + gpio-reserved-ranges = <0 4>, <81 4>; + +- sdc2_clk: sdc2-clk { +- pinconf { +- pins = "sdc2_clk"; +- bias-disable; ++ sdc2_clk: sdc2-clk-state { ++ pins = "sdc2_clk"; ++ bias-disable; + +- /* +- * It seems that mmc_test reports errors if drive +- * strength is not 16 on clk, cmd, and data pins. +- */ +- drive-strength = <16>; +- }; ++ /* ++ * It seems that mmc_test reports errors if drive ++ * strength is not 16 on clk, cmd, and data pins. ++ */ ++ drive-strength = <16>; + }; + +- sdc2_cmd: sdc2-cmd { +- pinconf { +- pins = "sdc2_cmd"; +- bias-pull-up; +- drive-strength = <16>; +- }; ++ sdc2_cmd: sdc2-cmd-state { ++ pins = "sdc2_cmd"; ++ bias-pull-up; ++ drive-strength = <16>; + }; + +- sdc2_data: sdc2-data { +- pinconf { +- pins = "sdc2_data"; +- bias-pull-up; +- drive-strength = <16>; +- }; ++ sdc2_data: sdc2-data-state { ++ pins = "sdc2_data"; ++ bias-pull-up; ++ drive-strength = <16>; + }; + +- sd_card_det_n: sd-card-det-n { +- pinmux { +- pins = "gpio126"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio126"; +- bias-pull-up; +- }; ++ sd_card_det_n: sd-card-det-n-state { ++ pins = "gpio126"; ++ function = "gpio"; ++ bias-pull-up; + }; + }; +diff --git a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi +index 42cf4dd5ea284..738c9d0b322f6 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi +@@ -474,35 +474,24 @@ + status = "okay"; + }; + +-&qup_i2c12_default { +- mux { +- pins = "gpio49", "gpio50"; +- function = "qup12"; +- drive-strength = <2>; +- bias-disable; +- }; ++&qup_i2c10_default { ++ drive-strength = <2>; ++ bias-disable; + }; + +-&qup_i2c10_default { +- pinconf { +- pins = "gpio55", "gpio56"; +- drive-strength = <2>; +- bias-disable; +- }; ++&qup_i2c12_default { ++ drive-strength = <2>; ++ bias-disable; + }; + +-&qup_uart9_default { +- pinconf-tx { +- pins = "gpio4"; +- drive-strength = <2>; +- bias-disable; +- }; ++&qup_uart9_rx { ++ drive-strength = <2>; ++ bias-pull-up; ++}; + +- pinconf-rx { +- pins = "gpio5"; +- drive-strength = <2>; +- bias-pull-up; +- }; ++&qup_uart9_tx { ++ drive-strength = <2>; ++ bias-disable; + }; + + &uart6 { +@@ -588,51 +577,41 @@ + &tlmm { + gpio-reserved-ranges = <0 4>, <81 4>; + +- tri_state_key_default: tri_state_key_default { +- mux { +- pins = "gpio40", "gpio42", "gpio26"; +- function = "gpio"; +- drive-strength = <2>; +- bias-disable; +- }; ++ tri_state_key_default: tri-state-key-default-state { ++ pins = "gpio40", "gpio42", "gpio26"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-disable; + }; + +- ts_default_pins: ts-int { +- mux { +- pins = "gpio99", "gpio125"; +- function = "gpio"; +- drive-strength = <16>; +- bias-pull-up; +- }; ++ ts_default_pins: ts-int-state { ++ pins = "gpio99", "gpio125"; ++ function = "gpio"; ++ drive-strength = <16>; ++ bias-pull-up; + }; + +- panel_reset_pins: panel-reset { +- mux { +- pins = "gpio6", "gpio25", "gpio26"; +- function = "gpio"; +- drive-strength = <8>; +- bias-disable; +- }; ++ panel_reset_pins: panel-reset-state { ++ pins = "gpio6", "gpio25", "gpio26"; ++ function = "gpio"; ++ drive-strength = <8>; ++ bias-disable; + }; + +- panel_te_pin: panel-te { +- mux { +- pins = "gpio10"; +- function = "mdp_vsync"; +- drive-strength = <2>; +- bias-disable; +- input-enable; +- }; ++ panel_te_pin: panel-te-state { ++ pins = "gpio10"; ++ function = "mdp_vsync"; ++ drive-strength = <2>; ++ bias-disable; ++ input-enable; + }; + +- panel_esd_pin: panel-esd { +- mux { +- pins = "gpio30"; +- function = "gpio"; +- drive-strength = <2>; +- bias-pull-down; +- input-enable; +- }; ++ panel_esd_pin: panel-esd-state { ++ pins = "gpio30"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-pull-down; ++ input-enable; + }; + }; + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts b/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts +index e6191602c70a8..34a2df3fc6e58 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts +@@ -554,18 +554,14 @@ + }; + }; + +-&qup_uart9_default { +- pinconf-rx { +- pins = "gpio5"; +- drive-strength = <2>; +- bias-pull-up; +- }; ++&qup_uart9_rx { ++ drive-strength = <2>; ++ bias-pull-up; ++}; + +- pinconf-tx { +- pins = "gpio4"; +- drive-strength = <2>; +- bias-disable; +- }; ++&qup_uart9_tx { ++ drive-strength = <2>; ++ bias-disable; + }; + + &qupv3_id_0 { +@@ -579,110 +575,62 @@ + &tlmm { + gpio-reserved-ranges = <0 4>, <81 4>; + +- sde_dsi_active: sde-dsi-active { +- mux { +- pins = "gpio6", "gpio11"; +- function = "gpio"; +- }; +- +- config { +- pins = "gpio6", "gpio11"; +- drive-strength = <8>; +- bias-disable; +- }; ++ sde_dsi_active: sde-dsi-active-state { ++ pins = "gpio6", "gpio11"; ++ function = "gpio"; ++ drive-strength = <8>; ++ bias-disable; + }; + +- sde_dsi_suspend: sde-dsi-suspend { +- mux { +- pins = "gpio6", "gpio11"; +- function = "gpio"; +- }; +- +- config { +- pins = "gpio6", "gpio11"; +- drive-strength = <2>; +- bias-pull-down; +- }; ++ sde_dsi_suspend: sde-dsi-suspend-state { ++ pins = "gpio6", "gpio11"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-pull-down; + }; + +- sde_te_active: sde-te-active { +- mux { +- pins = "gpio10"; +- function = "mdp_vsync"; +- }; +- +- config { +- pins = "gpio10"; +- drive-strength = <2>; +- bias-pull-down; +- }; ++ sde_te_active: sde-te-active-state { ++ pins = "gpio10"; ++ function = "mdp_vsync"; ++ drive-strength = <2>; ++ bias-pull-down; + }; + +- sde_te_suspend: sde-te-suspend { +- mux { +- pins = "gpio10"; +- function = "mdp_vsync"; +- }; +- +- config { +- pins = "gpio10"; +- drive-strength = <2>; +- bias-pull-down; +- }; ++ sde_te_suspend: sde-te-suspend-state { ++ pins = "gpio10"; ++ function = "mdp_vsync"; ++ drive-strength = <2>; ++ bias-pull-down; + }; + +- ts_int_active: ts-int-active { +- mux { +- pins = "gpio125"; +- function = "gpio"; +- }; +- +- config { +- pins = "gpio125"; +- drive-strength = <8>; +- bias-pull-up; +- input-enable; +- }; ++ ts_int_active: ts-int-active-state { ++ pins = "gpio125"; ++ function = "gpio"; ++ drive-strength = <8>; ++ bias-pull-up; ++ input-enable; + }; + +- ts_int_suspend: ts-int-suspend { +- mux { +- pins = "gpio125"; +- function = "gpio"; +- }; +- +- config { +- pins = "gpio125"; +- drive-strength = <2>; +- bias-pull-down; +- input-enable; +- }; ++ ts_int_suspend: ts-int-suspend-state { ++ pins = "gpio125"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-pull-down; ++ input-enable; + }; + +- ts_reset_active: ts-reset-active { +- mux { +- pins = "gpio99"; +- function = "gpio"; +- }; +- +- config { +- pins = "gpio99"; +- drive-strength = <8>; +- bias-pull-up; +- }; ++ ts_reset_active: ts-reset-active-state { ++ pins = "gpio99"; ++ function = "gpio"; ++ drive-strength = <8>; ++ bias-pull-up; + }; + +- ts_reset_suspend: ts-reset-suspend { +- mux { +- pins = "gpio99"; +- function = "gpio"; +- }; +- +- config { +- pins = "gpio99"; +- drive-strength = <2>; +- bias-pull-down; +- }; ++ ts_reset_suspend: ts-reset-suspend-state { ++ pins = "gpio99"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-pull-down; + }; + }; + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi b/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi +index 87dd0fc367476..20c4e4699ac72 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi +@@ -383,19 +383,19 @@ + gpio-reserved-ranges = <0 4>, <81 4>; + + sdc2_default_state: sdc2-default-state { +- clk { ++ clk-pins { + pins = "sdc2_clk"; + drive-strength = <16>; + bias-disable; + }; + +- cmd { ++ cmd-pins { + pins = "sdc2_cmd"; + drive-strength = <10>; + bias-pull-up; + }; + +- data { ++ data-pins { + pins = "sdc2_data"; + drive-strength = <10>; + bias-pull-up; +diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi +index d2866155dd870..eb761dfff8783 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi +@@ -440,33 +440,33 @@ + &tlmm { + gpio-reserved-ranges = <0 4>, <81 4>; + +- sdc2_default_state: sdc2-default { +- clk { ++ sdc2_default_state: sdc2-default-state { ++ clk-pins { + pins = "sdc2_clk"; + bias-disable; + drive-strength = <16>; + }; + +- cmd { ++ cmd-pins { + pins = "sdc2_cmd"; + bias-pull-up; + drive-strength = <10>; + }; + +- data { ++ data-pins { + pins = "sdc2_data"; + bias-pull-up; + drive-strength = <10>; + }; + }; + +- sdc2_card_det_n: sd-card-det-n { ++ sdc2_card_det_n: sd-card-det-n-state { + pins = "gpio126"; + function = "gpio"; + bias-pull-up; + }; + +- wcd_intr_default: wcd_intr_default { ++ wcd_intr_default: wcd-intr-default-state { + pins = "gpio54"; + function = "gpio"; + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts +index fba229d0bd108..8ca1487272820 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts +@@ -565,24 +565,21 @@ + }; + + &qup_i2c14_default { +- pinconf { +- pins = "gpio33", "gpio34"; +- drive-strength = <2>; +- bias-disable; +- }; ++ drive-strength = <2>; ++ bias-disable; + }; + + &tlmm { + gpio-reserved-ranges = <0 4>, <81 4>; + +- ts_reset_default: ts-reset-default { ++ ts_reset_default: ts-reset-default-state { + pins = "gpio99"; + function = "gpio"; + drive-strength = <16>; + output-high; + }; + +- ts_int_default: ts-int-default { ++ ts_int_default: ts-int-default-state { + pins = "gpio125"; + function = "gpio"; + bias-pull-down; +@@ -590,14 +587,14 @@ + input-enable; + }; + +- ts_reset_sleep: ts-reset-sleep { ++ ts_reset_sleep: ts-reset-sleep-state { + pins = "gpio99"; + function = "gpio"; + bias-disable; + drive-strength = <2>; + }; + +- ts_int_sleep: ts-int-sleep { ++ ts_int_sleep: ts-int-sleep-state { + pins = "gpio125"; + function = "gpio"; + bias-pull-down; +@@ -605,21 +602,21 @@ + input-enable; + }; + +- sde_dsi_active: sde-dsi-active { ++ sde_dsi_active: sde-dsi-active-state { + pins = "gpio6", "gpio10"; + function = "gpio"; + drive-strength = <8>; + bias-disable; + }; + +- sde_dsi_suspend: sde-dsi-suspend { ++ sde_dsi_suspend: sde-dsi-suspend-state { + pins = "gpio6", "gpio10"; + function = "gpio"; + drive-strength = <2>; + bias-pull-down; + }; + +- wcd_intr_default: wcd-intr-default { ++ wcd_intr_default: wcd-intr-default-state { + pins = "gpio54"; + function = "gpio"; + input-enable; +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 0b263a7da981c..481b721881cd7 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -2641,7 +2641,7 @@ + gpio-ranges = <&tlmm 0 0 151>; + wakeup-parent = <&pdc_intc>; + +- cci0_default: cci0-default { ++ cci0_default: cci0-default-state { + /* SDA, SCL */ + pins = "gpio17", "gpio18"; + function = "cci_i2c"; +@@ -2650,7 +2650,7 @@ + drive-strength = <2>; /* 2 mA */ + }; + +- cci0_sleep: cci0-sleep { ++ cci0_sleep: cci0-sleep-state { + /* SDA, SCL */ + pins = "gpio17", "gpio18"; + function = "cci_i2c"; +@@ -2659,7 +2659,7 @@ + bias-pull-down; + }; + +- cci1_default: cci1-default { ++ cci1_default: cci1-default-state { + /* SDA, SCL */ + pins = "gpio19", "gpio20"; + function = "cci_i2c"; +@@ -2668,7 +2668,7 @@ + drive-strength = <2>; /* 2 mA */ + }; + +- cci1_sleep: cci1-sleep { ++ cci1_sleep: cci1-sleep-state { + /* SDA, SCL */ + pins = "gpio19", "gpio20"; + function = "cci_i2c"; +@@ -2677,556 +2677,497 @@ + bias-pull-down; + }; + +- qspi_clk: qspi-clk { +- pinmux { +- pins = "gpio95"; +- function = "qspi_clk"; +- }; ++ qspi_clk: qspi-clk-state { ++ pins = "gpio95"; ++ function = "qspi_clk"; + }; + +- qspi_cs0: qspi-cs0 { +- pinmux { +- pins = "gpio90"; +- function = "qspi_cs"; +- }; ++ qspi_cs0: qspi-cs0-state { ++ pins = "gpio90"; ++ function = "qspi_cs"; + }; + +- qspi_cs1: qspi-cs1 { +- pinmux { +- pins = "gpio89"; +- function = "qspi_cs"; +- }; ++ qspi_cs1: qspi-cs1-state { ++ pins = "gpio89"; ++ function = "qspi_cs"; + }; + +- qspi_data01: qspi-data01 { +- pinmux-data { +- pins = "gpio91", "gpio92"; +- function = "qspi_data"; +- }; ++ qspi_data01: qspi-data01-state { ++ pins = "gpio91", "gpio92"; ++ function = "qspi_data"; + }; + +- qspi_data12: qspi-data12 { +- pinmux-data { +- pins = "gpio93", "gpio94"; +- function = "qspi_data"; +- }; ++ qspi_data12: qspi-data12-state { ++ pins = "gpio93", "gpio94"; ++ function = "qspi_data"; + }; + +- qup_i2c0_default: qup-i2c0-default { +- pinmux { +- pins = "gpio0", "gpio1"; +- function = "qup0"; +- }; ++ qup_i2c0_default: qup-i2c0-default-state { ++ pins = "gpio0", "gpio1"; ++ function = "qup0"; + }; + +- qup_i2c1_default: qup-i2c1-default { +- pinmux { +- pins = "gpio17", "gpio18"; +- function = "qup1"; +- }; ++ qup_i2c1_default: qup-i2c1-default-state { ++ pins = "gpio17", "gpio18"; ++ function = "qup1"; + }; + +- qup_i2c2_default: qup-i2c2-default { +- pinmux { +- pins = "gpio27", "gpio28"; +- function = "qup2"; +- }; ++ qup_i2c2_default: qup-i2c2-default-state { ++ pins = "gpio27", "gpio28"; ++ function = "qup2"; + }; + +- qup_i2c3_default: qup-i2c3-default { +- pinmux { +- pins = "gpio41", "gpio42"; +- function = "qup3"; +- }; ++ qup_i2c3_default: qup-i2c3-default-state { ++ pins = "gpio41", "gpio42"; ++ function = "qup3"; + }; + +- qup_i2c4_default: qup-i2c4-default { +- pinmux { +- pins = "gpio89", "gpio90"; +- function = "qup4"; +- }; ++ qup_i2c4_default: qup-i2c4-default-state { ++ pins = "gpio89", "gpio90"; ++ function = "qup4"; + }; + +- qup_i2c5_default: qup-i2c5-default { +- pinmux { +- pins = "gpio85", "gpio86"; +- function = "qup5"; +- }; ++ qup_i2c5_default: qup-i2c5-default-state { ++ pins = "gpio85", "gpio86"; ++ function = "qup5"; + }; + +- qup_i2c6_default: qup-i2c6-default { +- pinmux { +- pins = "gpio45", "gpio46"; +- function = "qup6"; +- }; ++ qup_i2c6_default: qup-i2c6-default-state { ++ pins = "gpio45", "gpio46"; ++ function = "qup6"; + }; + +- qup_i2c7_default: qup-i2c7-default { +- pinmux { +- pins = "gpio93", "gpio94"; +- function = "qup7"; +- }; ++ qup_i2c7_default: qup-i2c7-default-state { ++ pins = "gpio93", "gpio94"; ++ function = "qup7"; + }; + +- qup_i2c8_default: qup-i2c8-default { +- pinmux { +- pins = "gpio65", "gpio66"; +- function = "qup8"; +- }; ++ qup_i2c8_default: qup-i2c8-default-state { ++ pins = "gpio65", "gpio66"; ++ function = "qup8"; + }; + +- qup_i2c9_default: qup-i2c9-default { +- pinmux { +- pins = "gpio6", "gpio7"; +- function = "qup9"; +- }; ++ qup_i2c9_default: qup-i2c9-default-state { ++ pins = "gpio6", "gpio7"; ++ function = "qup9"; + }; + +- qup_i2c10_default: qup-i2c10-default { +- pinmux { +- pins = "gpio55", "gpio56"; +- function = "qup10"; +- }; ++ qup_i2c10_default: qup-i2c10-default-state { ++ pins = "gpio55", "gpio56"; ++ function = "qup10"; + }; + +- qup_i2c11_default: qup-i2c11-default { +- pinmux { +- pins = "gpio31", "gpio32"; +- function = "qup11"; +- }; ++ qup_i2c11_default: qup-i2c11-default-state { ++ pins = "gpio31", "gpio32"; ++ function = "qup11"; + }; + +- qup_i2c12_default: qup-i2c12-default { +- pinmux { +- pins = "gpio49", "gpio50"; +- function = "qup12"; +- }; ++ qup_i2c12_default: qup-i2c12-default-state { ++ pins = "gpio49", "gpio50"; ++ function = "qup12"; + }; + +- qup_i2c13_default: qup-i2c13-default { +- pinmux { +- pins = "gpio105", "gpio106"; +- function = "qup13"; +- }; ++ qup_i2c13_default: qup-i2c13-default-state { ++ pins = "gpio105", "gpio106"; ++ function = "qup13"; + }; + +- qup_i2c14_default: qup-i2c14-default { +- pinmux { +- pins = "gpio33", "gpio34"; +- function = "qup14"; +- }; ++ qup_i2c14_default: qup-i2c14-default-state { ++ pins = "gpio33", "gpio34"; ++ function = "qup14"; + }; + +- qup_i2c15_default: qup-i2c15-default { +- pinmux { +- pins = "gpio81", "gpio82"; +- function = "qup15"; +- }; ++ qup_i2c15_default: qup-i2c15-default-state { ++ pins = "gpio81", "gpio82"; ++ function = "qup15"; + }; + +- qup_spi0_default: qup-spi0-default { +- pinmux { +- pins = "gpio0", "gpio1", +- "gpio2", "gpio3"; +- function = "qup0"; +- }; ++ qup_spi0_default: qup-spi0-default-state { ++ pins = "gpio0", "gpio1", "gpio2", "gpio3"; ++ function = "qup0"; ++ drive-strength = <6>; ++ bias-disable; ++ }; + +- config { +- pins = "gpio0", "gpio1", +- "gpio2", "gpio3"; +- drive-strength = <6>; +- bias-disable; +- }; ++ qup_spi1_default: qup-spi1-default-state { ++ pins = "gpio17", "gpio18", "gpio19", "gpio20"; ++ function = "qup1"; + }; + +- qup_spi1_default: qup-spi1-default { +- pinmux { +- pins = "gpio17", "gpio18", +- "gpio19", "gpio20"; +- function = "qup1"; +- }; ++ qup_spi2_default: qup-spi2-default-state { ++ pins = "gpio27", "gpio28", "gpio29", "gpio30"; ++ function = "qup2"; + }; + +- qup_spi2_default: qup-spi2-default { +- pinmux { +- pins = "gpio27", "gpio28", +- "gpio29", "gpio30"; +- function = "qup2"; +- }; ++ qup_spi3_default: qup-spi3-default-state { ++ pins = "gpio41", "gpio42", "gpio43", "gpio44"; ++ function = "qup3"; + }; + +- qup_spi3_default: qup-spi3-default { +- pinmux { +- pins = "gpio41", "gpio42", +- "gpio43", "gpio44"; +- function = "qup3"; +- }; ++ qup_spi4_default: qup-spi4-default-state { ++ pins = "gpio89", "gpio90", "gpio91", "gpio92"; ++ function = "qup4"; + }; + +- qup_spi4_default: qup-spi4-default { +- pinmux { +- pins = "gpio89", "gpio90", +- "gpio91", "gpio92"; +- function = "qup4"; +- }; ++ qup_spi5_default: qup-spi5-default-state { ++ pins = "gpio85", "gpio86", "gpio87", "gpio88"; ++ function = "qup5"; + }; + +- qup_spi5_default: qup-spi5-default { +- pinmux { +- pins = "gpio85", "gpio86", +- "gpio87", "gpio88"; +- function = "qup5"; +- }; ++ qup_spi6_default: qup-spi6-default-state { ++ pins = "gpio45", "gpio46", "gpio47", "gpio48"; ++ function = "qup6"; + }; + +- qup_spi6_default: qup-spi6-default { +- pinmux { +- pins = "gpio45", "gpio46", +- "gpio47", "gpio48"; +- function = "qup6"; +- }; ++ qup_spi7_default: qup-spi7-default-state { ++ pins = "gpio93", "gpio94", "gpio95", "gpio96"; ++ function = "qup7"; + }; + +- qup_spi7_default: qup-spi7-default { +- pinmux { +- pins = "gpio93", "gpio94", +- "gpio95", "gpio96"; +- function = "qup7"; +- }; ++ qup_spi8_default: qup-spi8-default-state { ++ pins = "gpio65", "gpio66", "gpio67", "gpio68"; ++ function = "qup8"; + }; + +- qup_spi8_default: qup-spi8-default { +- pinmux { +- pins = "gpio65", "gpio66", +- "gpio67", "gpio68"; +- function = "qup8"; +- }; ++ qup_spi9_default: qup-spi9-default-state { ++ pins = "gpio6", "gpio7", "gpio4", "gpio5"; ++ function = "qup9"; + }; + +- qup_spi9_default: qup-spi9-default { +- pinmux { +- pins = "gpio6", "gpio7", +- "gpio4", "gpio5"; +- function = "qup9"; +- }; ++ qup_spi10_default: qup-spi10-default-state { ++ pins = "gpio55", "gpio56", "gpio53", "gpio54"; ++ function = "qup10"; + }; + +- qup_spi10_default: qup-spi10-default { +- pinmux { +- pins = "gpio55", "gpio56", +- "gpio53", "gpio54"; +- function = "qup10"; +- }; ++ qup_spi11_default: qup-spi11-default-state { ++ pins = "gpio31", "gpio32", "gpio33", "gpio34"; ++ function = "qup11"; + }; + +- qup_spi11_default: qup-spi11-default { +- pinmux { +- pins = "gpio31", "gpio32", +- "gpio33", "gpio34"; +- function = "qup11"; +- }; ++ qup_spi12_default: qup-spi12-default-state { ++ pins = "gpio49", "gpio50", "gpio51", "gpio52"; ++ function = "qup12"; + }; + +- qup_spi12_default: qup-spi12-default { +- pinmux { +- pins = "gpio49", "gpio50", +- "gpio51", "gpio52"; +- function = "qup12"; +- }; ++ qup_spi13_default: qup-spi13-default-state { ++ pins = "gpio105", "gpio106", "gpio107", "gpio108"; ++ function = "qup13"; + }; + +- qup_spi13_default: qup-spi13-default { +- pinmux { +- pins = "gpio105", "gpio106", +- "gpio107", "gpio108"; +- function = "qup13"; +- }; ++ qup_spi14_default: qup-spi14-default-state { ++ pins = "gpio33", "gpio34", "gpio31", "gpio32"; ++ function = "qup14"; + }; + +- qup_spi14_default: qup-spi14-default { +- pinmux { +- pins = "gpio33", "gpio34", +- "gpio31", "gpio32"; +- function = "qup14"; +- }; ++ qup_spi15_default: qup-spi15-default-state { ++ pins = "gpio81", "gpio82", "gpio83", "gpio84"; ++ function = "qup15"; + }; + +- qup_spi15_default: qup-spi15-default { +- pinmux { +- pins = "gpio81", "gpio82", +- "gpio83", "gpio84"; +- function = "qup15"; ++ qup_uart0_default: qup-uart0-default-state { ++ qup_uart0_tx: tx-pins { ++ pins = "gpio2"; ++ function = "qup0"; + }; +- }; + +- qup_uart0_default: qup-uart0-default { +- pinmux { +- pins = "gpio2", "gpio3"; ++ qup_uart0_rx: rx-pins { ++ pins = "gpio3"; + function = "qup0"; + }; + }; + +- qup_uart1_default: qup-uart1-default { +- pinmux { +- pins = "gpio19", "gpio20"; ++ qup_uart1_default: qup-uart1-default-state { ++ qup_uart1_tx: tx-pins { ++ pins = "gpio19"; ++ function = "qup1"; ++ }; ++ ++ qup_uart1_rx: rx-pins { ++ pins = "gpio20"; + function = "qup1"; + }; + }; + +- qup_uart2_default: qup-uart2-default { +- pinmux { +- pins = "gpio29", "gpio30"; ++ qup_uart2_default: qup-uart2-default-state { ++ qup_uart2_tx: tx-pins { ++ pins = "gpio29"; + function = "qup2"; + }; ++ ++ qup_uart2_rx: rx-pins { ++ pins = "gpio30"; ++ function = "qup2"; ++ }; ++ }; ++ ++ qup_uart3_default: qup-uart3-default-state { ++ qup_uart3_tx: tx-pins { ++ pins = "gpio43"; ++ function = "qup3"; ++ }; ++ ++ qup_uart3_rx: rx-pins { ++ pins = "gpio44"; ++ function = "qup3"; ++ }; + }; + +- qup_uart3_default: qup-uart3-default { +- pinmux { +- pins = "gpio43", "gpio44"; ++ qup_uart3_4pin: qup-uart3-4pin-state { ++ qup_uart3_4pin_cts: cts-pins { ++ pins = "gpio41"; ++ function = "qup3"; ++ }; ++ ++ qup_uart3_4pin_rts_tx: rts-tx-pins { ++ pins = "gpio42", "gpio43"; ++ function = "qup3"; ++ }; ++ ++ qup_uart3_4pin_rx: rx-pins { ++ pins = "gpio44"; + function = "qup3"; + }; + }; + +- qup_uart4_default: qup-uart4-default { +- pinmux { +- pins = "gpio91", "gpio92"; ++ qup_uart4_default: qup-uart4-default-state { ++ qup_uart4_tx: tx-pins { ++ pins = "gpio91"; ++ function = "qup4"; ++ }; ++ ++ qup_uart4_rx: rx-pins { ++ pins = "gpio92"; + function = "qup4"; + }; + }; + +- qup_uart5_default: qup-uart5-default { +- pinmux { +- pins = "gpio87", "gpio88"; ++ qup_uart5_default: qup-uart5-default-state { ++ qup_uart5_tx: tx-pins { ++ pins = "gpio87"; ++ function = "qup5"; ++ }; ++ ++ qup_uart5_rx: rx-pins { ++ pins = "gpio88"; + function = "qup5"; + }; + }; + +- qup_uart6_default: qup-uart6-default { +- pinmux { +- pins = "gpio47", "gpio48"; ++ qup_uart6_default: qup-uart6-default-state { ++ qup_uart6_tx: tx-pins { ++ pins = "gpio47"; ++ function = "qup6"; ++ }; ++ ++ qup_uart6_rx: rx-pins { ++ pins = "gpio48"; + function = "qup6"; + }; + }; + + qup_uart6_4pin: qup-uart6-4pin-state { +- +- cts-pins { ++ qup_uart6_4pin_cts: cts-pins { + pins = "gpio45"; + function = "qup6"; + bias-pull-down; + }; + +- rts-tx-pins { ++ qup_uart6_4pin_rts_tx: rts-tx-pins { + pins = "gpio46", "gpio47"; + function = "qup6"; + drive-strength = <2>; + bias-disable; + }; + +- rx-pins { ++ qup_uart6_4pin_rx: rx-pins { + pins = "gpio48"; + function = "qup6"; + bias-pull-up; + }; + }; + +- qup_uart7_default: qup-uart7-default { +- pinmux { +- pins = "gpio95", "gpio96"; ++ qup_uart7_default: qup-uart7-default-state { ++ qup_uart7_tx: tx-pins { ++ pins = "gpio95"; + function = "qup7"; + }; +- }; + +- qup_uart8_default: qup-uart8-default { +- pinmux { +- pins = "gpio67", "gpio68"; +- function = "qup8"; +- }; +- }; +- +- qup_uart9_default: qup-uart9-default { +- pinmux { +- pins = "gpio4", "gpio5"; +- function = "qup9"; ++ qup_uart7_rx: rx-pins { ++ pins = "gpio96"; ++ function = "qup7"; + }; + }; + +- qup_uart10_default: qup-uart10-default { +- pinmux { +- pins = "gpio53", "gpio54"; +- function = "qup10"; ++ qup_uart8_default: qup-uart8-default-state { ++ qup_uart8_tx: tx-pins { ++ pins = "gpio67"; ++ function = "qup8"; + }; +- }; + +- qup_uart11_default: qup-uart11-default { +- pinmux { +- pins = "gpio33", "gpio34"; +- function = "qup11"; ++ qup_uart8_rx: rx-pins { ++ pins = "gpio68"; ++ function = "qup8"; + }; + }; + +- qup_uart12_default: qup-uart12-default { +- pinmux { +- pins = "gpio51", "gpio52"; +- function = "qup12"; ++ qup_uart9_default: qup-uart9-default-state { ++ qup_uart9_tx: tx-pins { ++ pins = "gpio4"; ++ function = "qup9"; + }; +- }; + +- qup_uart13_default: qup-uart13-default { +- pinmux { +- pins = "gpio107", "gpio108"; +- function = "qup13"; ++ qup_uart9_rx: rx-pins { ++ pins = "gpio5"; ++ function = "qup9"; + }; + }; + +- qup_uart14_default: qup-uart14-default { +- pinmux { +- pins = "gpio31", "gpio32"; +- function = "qup14"; ++ qup_uart10_default: qup-uart10-default-state { ++ qup_uart10_tx: tx-pins { ++ pins = "gpio53"; ++ function = "qup10"; + }; +- }; + +- qup_uart15_default: qup-uart15-default { +- pinmux { +- pins = "gpio83", "gpio84"; +- function = "qup15"; ++ qup_uart10_rx: rx-pins { ++ pins = "gpio54"; ++ function = "qup10"; + }; + }; + +- quat_mi2s_sleep: quat_mi2s_sleep { +- mux { +- pins = "gpio58", "gpio59"; +- function = "gpio"; ++ qup_uart11_default: qup-uart11-default-state { ++ qup_uart11_tx: tx-pins { ++ pins = "gpio33"; ++ function = "qup11"; + }; + +- config { +- pins = "gpio58", "gpio59"; +- drive-strength = <2>; +- bias-pull-down; +- input-enable; ++ qup_uart11_rx: rx-pins { ++ pins = "gpio34"; ++ function = "qup11"; + }; + }; + +- quat_mi2s_active: quat_mi2s_active { +- mux { +- pins = "gpio58", "gpio59"; +- function = "qua_mi2s"; ++ qup_uart12_default: qup-uart12-default-state { ++ qup_uart12_tx: tx-pins { ++ pins = "gpio51"; ++ function = "qup0"; + }; + +- config { +- pins = "gpio58", "gpio59"; +- drive-strength = <8>; +- bias-disable; +- output-high; ++ qup_uart12_rx: rx-pins { ++ pins = "gpio52"; ++ function = "qup0"; + }; + }; + +- quat_mi2s_sd0_sleep: quat_mi2s_sd0_sleep { +- mux { +- pins = "gpio60"; +- function = "gpio"; ++ qup_uart13_default: qup-uart13-default-state { ++ qup_uart13_tx: tx-pins { ++ pins = "gpio107"; ++ function = "qup13"; + }; + +- config { +- pins = "gpio60"; +- drive-strength = <2>; +- bias-pull-down; +- input-enable; ++ qup_uart13_rx: rx-pins { ++ pins = "gpio108"; ++ function = "qup13"; + }; + }; + +- quat_mi2s_sd0_active: quat_mi2s_sd0_active { +- mux { +- pins = "gpio60"; +- function = "qua_mi2s"; ++ qup_uart14_default: qup-uart14-default-state { ++ qup_uart14_tx: tx-pins { ++ pins = "gpio31"; ++ function = "qup14"; + }; + +- config { +- pins = "gpio60"; +- drive-strength = <8>; +- bias-disable; ++ qup_uart14_rx: rx-pins { ++ pins = "gpio32"; ++ function = "qup14"; + }; + }; + +- quat_mi2s_sd1_sleep: quat_mi2s_sd1_sleep { +- mux { +- pins = "gpio61"; +- function = "gpio"; ++ qup_uart15_default: qup-uart15-default-state { ++ qup_uart15_tx: tx-pins { ++ pins = "gpio83"; ++ function = "qup15"; + }; + +- config { +- pins = "gpio61"; +- drive-strength = <2>; +- bias-pull-down; +- input-enable; ++ qup_uart15_rx: rx-pins { ++ pins = "gpio84"; ++ function = "qup15"; + }; + }; + +- quat_mi2s_sd1_active: quat_mi2s_sd1_active { +- mux { +- pins = "gpio61"; +- function = "qua_mi2s"; +- }; ++ quat_mi2s_sleep: quat-mi2s-sleep-state { ++ pins = "gpio58", "gpio59"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-pull-down; ++ input-enable; ++ }; + +- config { +- pins = "gpio61"; +- drive-strength = <8>; +- bias-disable; +- }; ++ quat_mi2s_active: quat-mi2s-active-state { ++ pins = "gpio58", "gpio59"; ++ function = "qua_mi2s"; ++ drive-strength = <8>; ++ bias-disable; ++ output-high; + }; + +- quat_mi2s_sd2_sleep: quat_mi2s_sd2_sleep { +- mux { +- pins = "gpio62"; +- function = "gpio"; +- }; ++ quat_mi2s_sd0_sleep: quat-mi2s-sd0-sleep-state { ++ pins = "gpio60"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-pull-down; ++ input-enable; ++ }; + +- config { +- pins = "gpio62"; +- drive-strength = <2>; +- bias-pull-down; +- input-enable; +- }; ++ quat_mi2s_sd0_active: quat-mi2s-sd0-active-state { ++ pins = "gpio60"; ++ function = "qua_mi2s"; ++ drive-strength = <8>; ++ bias-disable; + }; + +- quat_mi2s_sd2_active: quat_mi2s_sd2_active { +- mux { +- pins = "gpio62"; +- function = "qua_mi2s"; +- }; ++ quat_mi2s_sd1_sleep: quat-mi2s-sd1-sleep-state { ++ pins = "gpio61"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-pull-down; ++ input-enable; ++ }; + +- config { +- pins = "gpio62"; +- drive-strength = <8>; +- bias-disable; +- }; ++ quat_mi2s_sd1_active: quat-mi2s-sd1-active-state { ++ pins = "gpio61"; ++ function = "qua_mi2s"; ++ drive-strength = <8>; ++ bias-disable; + }; + +- quat_mi2s_sd3_sleep: quat_mi2s_sd3_sleep { +- mux { +- pins = "gpio63"; +- function = "gpio"; +- }; ++ quat_mi2s_sd2_sleep: quat-mi2s-sd2-sleep-state { ++ pins = "gpio62"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-pull-down; ++ input-enable; ++ }; + +- config { +- pins = "gpio63"; +- drive-strength = <2>; +- bias-pull-down; +- input-enable; +- }; ++ quat_mi2s_sd2_active: quat-mi2s-sd2-active-state { ++ pins = "gpio62"; ++ function = "qua_mi2s"; ++ drive-strength = <8>; ++ bias-disable; + }; + +- quat_mi2s_sd3_active: quat_mi2s_sd3_active { +- mux { +- pins = "gpio63"; +- function = "qua_mi2s"; +- }; ++ quat_mi2s_sd3_sleep: quat-mi2s-sd3-sleep-state { ++ pins = "gpio63"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-pull-down; ++ input-enable; ++ }; + +- config { +- pins = "gpio63"; +- drive-strength = <8>; +- bias-disable; +- }; ++ quat_mi2s_sd3_active: quat-mi2s-sd3-active-state { ++ pins = "gpio63"; ++ function = "qua_mi2s"; ++ drive-strength = <8>; ++ bias-disable; + }; + }; + +diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts +index f32b7445f7c96..83e4a92430fb7 100644 +--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts ++++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts +@@ -479,41 +479,13 @@ + }; + + &qup_i2c10_default { +- pinconf { +- pins = "gpio55", "gpio56"; +- drive-strength = <2>; +- bias-disable; +- }; ++ drive-strength = <2>; ++ bias-disable; + }; + + &qup_i2c12_default { +- pinmux { +- drive-strength = <2>; +- bias-disable; +- }; +-}; +- +-&qup_uart6_default { +- pinmux { +- pins = "gpio45", "gpio46", "gpio47", "gpio48"; +- function = "qup6"; +- }; +- +- cts { +- pins = "gpio45"; +- bias-pull-down; +- }; +- +- rts-tx { +- pins = "gpio46", "gpio47"; +- drive-strength = <2>; +- bias-disable; +- }; +- +- rx { +- pins = "gpio48"; +- bias-pull-up; +- }; ++ drive-strength = <2>; ++ bias-disable; + }; + + &qupv3_id_0 { +@@ -621,13 +593,14 @@ + &tlmm { + gpio-reserved-ranges = <0 4>, <81 4>; + +- sn65dsi86_pin_active: sn65dsi86-enable { ++ sn65dsi86_pin_active: sn65dsi86-enable-state { + pins = "gpio96"; ++ function = "gpio"; + drive-strength = <2>; + bias-disable; + }; + +- i2c3_hid_active: i2c2-hid-active { ++ i2c3_hid_active: i2c2-hid-active-state { + pins = "gpio37"; + function = "gpio"; + +@@ -636,7 +609,7 @@ + drive-strength = <2>; + }; + +- i2c5_hid_active: i2c5-hid-active { ++ i2c5_hid_active: i2c5-hid-active-state { + pins = "gpio125"; + function = "gpio"; + +@@ -645,7 +618,7 @@ + drive-strength = <2>; + }; + +- i2c11_hid_active: i2c11-hid-active { ++ i2c11_hid_active: i2c11-hid-active-state { + pins = "gpio92"; + function = "gpio"; + +@@ -654,7 +627,7 @@ + drive-strength = <2>; + }; + +- wcd_intr_default: wcd_intr_default { ++ wcd_intr_default: wcd-intr-default-state { + pins = "gpio54"; + function = "gpio"; + +@@ -663,7 +636,7 @@ + drive-strength = <2>; + }; + +- lid_pin_active: lid-pin { ++ lid_pin_active: lid-pin-state { + pins = "gpio124"; + function = "gpio"; + +@@ -671,7 +644,7 @@ + bias-disable; + }; + +- mode_pin_active: mode-pin { ++ mode_pin_active: mode-pin-state { + pins = "gpio95"; + function = "gpio"; + +@@ -681,6 +654,8 @@ + }; + + &uart6 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&qup_uart6_4pin>; + status = "okay"; + + bluetooth { +diff --git a/arch/arm64/boot/dts/qcom/sdm850-samsung-w737.dts b/arch/arm64/boot/dts/qcom/sdm850-samsung-w737.dts +index daca1e0ad62ad..9215066146ffe 100644 +--- a/arch/arm64/boot/dts/qcom/sdm850-samsung-w737.dts ++++ b/arch/arm64/boot/dts/qcom/sdm850-samsung-w737.dts +@@ -399,49 +399,18 @@ + }; + + &qup_i2c10_default { +- pinconf { +- pins = "gpio55", "gpio56"; +- drive-strength = <2>; +- bias-disable; +- }; ++ drive-strength = <2>; ++ bias-disable; + }; + + &qup_i2c11_default { +- pinconf { +- pins = "gpio31", "gpio32"; +- drive-strength = <2>; +- bias-disable; +- }; ++ drive-strength = <2>; ++ bias-disable; + }; + + &qup_i2c12_default { +- pinmux { +- drive-strength = <2>; +- bias-disable; +- }; +-}; +- +-&qup_uart6_default { +- pinmux { +- pins = "gpio45", "gpio46", "gpio47", "gpio48"; +- function = "qup6"; +- }; +- +- cts { +- pins = "gpio45"; +- bias-pull-down; +- }; +- +- rts-tx { +- pins = "gpio46", "gpio47"; +- drive-strength = <2>; +- bias-disable; +- }; +- +- rx { +- pins = "gpio48"; +- bias-pull-up; +- }; ++ drive-strength = <2>; ++ bias-disable; + }; + + &qupv3_id_0 { +@@ -549,59 +518,41 @@ + &tlmm { + gpio-reserved-ranges = <0 6>, <85 4>; + +- pen_irq_l: pen-irq-l { +- pinmux { +- pins = "gpio119"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio119"; +- bias-disable; +- }; ++ pen_irq_l: pen-irq-l-state { ++ pins = "gpio119"; ++ function = "gpio"; ++ bias-disable; + }; + +- pen_pdct_l: pen-pdct-l { +- pinmux { +- pins = "gpio124"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio124"; +- bias-disable; +- drive-strength = <2>; +- output-high; +- }; ++ pen_pdct_l: pen-pdct-l-state { ++ pins = "gpio124"; ++ function = "gpio"; ++ bias-disable; ++ drive-strength = <2>; ++ output-high; + }; + +- pen_rst_l: pen-rst-l { +- pinmux { +- pins = "gpio21"; +- function = "gpio"; +- }; +- +- pinconf { +- pins = "gpio21"; +- bias-disable; +- drive-strength = <2>; +- +- /* +- * The pen driver doesn't currently support +- * driving this reset line. By specifying +- * output-high here we're relying on the fact +- * that this pin has a default pulldown at boot +- * (which makes sure the pen was in reset if it +- * was powered) and then we set it high here to +- * take it out of reset. Better would be if the +- * pen driver could control this and we could +- * remove "output-high" here. +- */ +- output-high; +- }; ++ pen_rst_l: pen-rst-l-state { ++ pins = "gpio21"; ++ function = "gpio"; ++ bias-disable; ++ drive-strength = <2>; ++ ++ /* ++ * The pen driver doesn't currently support ++ * driving this reset line. By specifying ++ * output-high here we're relying on the fact ++ * that this pin has a default pulldown at boot ++ * (which makes sure the pen was in reset if it ++ * was powered) and then we set it high here to ++ * take it out of reset. Better would be if the ++ * pen driver could control this and we could ++ * remove "output-high" here. ++ */ ++ output-high; + }; + +- wcd_intr_default: wcd_intr_default { ++ wcd_intr_default: wcd-intr-default-state { + pins = "gpio54"; + function = "gpio"; + +@@ -612,6 +563,8 @@ + }; + + &uart6 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&qup_uart6_4pin>; + status = "okay"; + + bluetooth { +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch b/queue-6.2/arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch new file mode 100644 index 00000000000..3334606c004 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch @@ -0,0 +1,91 @@ +From ac96dac667407661c21e09db794f6e263704516e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 17:46:18 +0100 +Subject: arm64: dts: qcom: sdm845: correct dynamic power coefficients + +From: Vincent Guittot + +[ Upstream commit 44750f153699b6e4f851a399287e5c8df208d696 ] + +While stressing EAS on my dragonboard RB3, I have noticed that LITTLE cores +where never selected as the most energy efficient CPU whatever the +utilization level of waking task. + +energy model framework uses its cost field to estimate the energy with +the formula: + + nrg = cost of the selected OPP * utilization / CPU's max capacity + +which ends up selecting the CPU with lowest cost / max capacity ration +as long as the utilization fits in the OPP's capacity. + +If we compare the cost of a little OPP with similar capacity of a big OPP +like : + OPP(kHz) OPP capacity cost max capacity cost/max capacity +LITTLE 1766400 407 351114 407 863 +big 1056000 408 520267 1024 508 + +This can be interpreted as the LITTLE core consumes 70% more than big core +for the same compute capacity. + +According to [1], LITTLE consumes 10% less than big core for Coremark +benchmark at those OPPs. If we consider that everything else stays +unchanged, the dynamic-power-coefficient of LITTLE core should be +only 53% of the current value: 290 * 53% = 154 + +Set the dynamic-power-coefficient of CPU0-3 to 154 to fix the energy model. + +[1] https://github.com/kdrag0n/freqbench/tree/master/results/sdm845/main + +Fixes: 0e0a8e35d725 ("arm64: dts: qcom: sdm845: correct dynamic power coefficients") +Signed-off-by: Vincent Guittot +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230106164618.1845281-1-vincent.guittot@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index f36c23e7a2248..ed525397d2335 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -198,7 +198,7 @@ + reg = <0x0 0x0>; + enable-method = "psci"; + capacity-dmips-mhz = <611>; +- dynamic-power-coefficient = <290>; ++ dynamic-power-coefficient = <154>; + qcom,freq-domain = <&cpufreq_hw 0>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>, +@@ -222,7 +222,7 @@ + reg = <0x0 0x100>; + enable-method = "psci"; + capacity-dmips-mhz = <611>; +- dynamic-power-coefficient = <290>; ++ dynamic-power-coefficient = <154>; + qcom,freq-domain = <&cpufreq_hw 0>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>, +@@ -243,7 +243,7 @@ + reg = <0x0 0x200>; + enable-method = "psci"; + capacity-dmips-mhz = <611>; +- dynamic-power-coefficient = <290>; ++ dynamic-power-coefficient = <154>; + qcom,freq-domain = <&cpufreq_hw 0>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>, +@@ -264,7 +264,7 @@ + reg = <0x0 0x300>; + enable-method = "psci"; + capacity-dmips-mhz = <611>; +- dynamic-power-coefficient = <290>; ++ dynamic-power-coefficient = <154>; + qcom,freq-domain = <&cpufreq_hw 0>; + operating-points-v2 = <&cpu0_opp_table>; + interconnects = <&gladiator_noc MASTER_APPSS_PROC 3 &mem_noc SLAVE_EBI1 3>, +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch b/queue-6.2/arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..b66fd81d198 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,55 @@ +From 82a6dea5a56e9d1d61dc357f25cc2ac39cb34a7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:37 +0530 +Subject: arm64: dts: qcom: sdm845: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 67aa109eee654c76dcc100554e637fa64d5aa099 ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses +(0x60200000, 0x40200000) specified in the ranges property for I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: 42ad231338c1 ("arm64: dts: qcom: sdm845: Add second PCIe PHY and controller") +Fixes: 5c538e09cb19 ("arm64: dts: qcom: sdm845: Add first PCIe controller and PHY") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-2-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index ed525397d2335..0b263a7da981c 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -2226,8 +2226,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x60200000 0 0x60200000 0x0 0x100000>, +- <0x02000000 0x0 0x60300000 0 0x60300000 0x0 0xd00000>; ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>, ++ <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0xd00000>; + + interrupts = ; + interrupt-names = "msi"; +@@ -2331,7 +2331,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x40200000 0x0 0x40200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>, + <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>; + + interrupts = ; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sm8150-fix-the-pci-i-o-port-range.patch b/queue-6.2/arm64-dts-qcom-sm8150-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..28ee7268fcf --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sm8150-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,54 @@ +From aed0749f6a8ee58edd184d3fd5e2564059e6bca8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:47 +0530 +Subject: arm64: dts: qcom: sm8150: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 422b110b9b0af0afd4a4b19e8fc3ceab9e71d842 ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses +(0x60200000, 0x40200000) specified in the ranges property for I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: a1c86c680533 ("arm64: dts: qcom: sm8150: Add PCIe nodes") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-12-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi +index f790223ed8f5a..d338a987e8868 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi +@@ -1783,8 +1783,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x60200000 0 0x60200000 0x0 0x100000>, +- <0x02000000 0x0 0x60300000 0 0x60300000 0x0 0x3d00000>; ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>, ++ <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0x3d00000>; + + interrupts = ; + interrupt-names = "msi"; +@@ -1879,7 +1879,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x40200000 0x0 0x40200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>, + <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>; + + interrupts = ; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sm8250-fix-the-pci-i-o-port-range.patch b/queue-6.2/arm64-dts-qcom-sm8250-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..72c18718e82 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sm8250-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,64 @@ +From a53fdea68f14e23a8100aa5905f7518ded5ab13d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:44 +0530 +Subject: arm64: dts: qcom: sm8250: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit e115a4495db687898b8d91d4f16c2cf55bbf167c ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses +(0x60200000, 0x40200000, 0x64200000) specified in the ranges property for +I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: e53bdfc00977 ("arm64: dts: qcom: sm8250: Add PCIe support") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-9-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index 927032863e2f1..d3f2f617047f1 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -1807,8 +1807,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x60200000 0 0x60200000 0x0 0x100000>, +- <0x02000000 0x0 0x60300000 0 0x60300000 0x0 0x3d00000>; ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>, ++ <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0x3d00000>; + + interrupts = , + , +@@ -1916,7 +1916,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x40200000 0x0 0x40200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>, + <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>; + + interrupts = ; +@@ -2024,7 +2024,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x64200000 0x0 0x64200000 0x0 0x100000>, ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x64200000 0x0 0x100000>, + <0x02000000 0x0 0x64300000 0x0 0x64300000 0x0 0x3d00000>; + + interrupts = ; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sm8350-microsoft-surface-fix-usb-dual.patch b/queue-6.2/arm64-dts-qcom-sm8350-microsoft-surface-fix-usb-dual.patch new file mode 100644 index 00000000000..ad3b71f9145 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sm8350-microsoft-surface-fix-usb-dual.patch @@ -0,0 +1,41 @@ +From 55e41eac47edfc85154a7a9ad99d20e8400097c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Mar 2023 14:03:15 +0100 +Subject: arm64: dts: qcom: sm8350-microsoft-surface: fix USB dual-role mode + property + +From: Krzysztof Kozlowski + +[ Upstream commit 0beda02e530f8fc571877939645cb20ade113027 ] + +The "dr_mode" is a property of USB DWC3 node, not the Qualcomm wrapper +one: + sm8350-microsoft-surface-duo2.dtb: usb@a6f8800: 'dr_mode' does not match any of the regexes: '^usb@[0-9a-f]+$', 'pinctrl-[0-9]+' + +Fixes: c16160cfa565 ("arm64: dts: qcom: add minimal DTS for Microsoft Surface Duo 2") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230304130315.51595-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8350-microsoft-surface-duo2.dts | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350-microsoft-surface-duo2.dts b/arch/arm64/boot/dts/qcom/sm8350-microsoft-surface-duo2.dts +index 9c4cfd995ff29..e87514d8fd84e 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350-microsoft-surface-duo2.dts ++++ b/arch/arm64/boot/dts/qcom/sm8350-microsoft-surface-duo2.dts +@@ -341,6 +341,9 @@ + + &usb_1 { + status = "okay"; ++}; ++ ++&usb_1_dwc3 { + dr_mode = "peripheral"; + }; + +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sm8450-fix-pcie1-gpios-properties-nam.patch b/queue-6.2/arm64-dts-qcom-sm8450-fix-pcie1-gpios-properties-nam.patch new file mode 100644 index 00000000000..7fa1ffd259c --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sm8450-fix-pcie1-gpios-properties-nam.patch @@ -0,0 +1,39 @@ +From 58e1deb8c96574bfcba9423c2797b44ae9040c13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 10:28:49 +0100 +Subject: arm64: dts: qcom: sm8450: fix pcie1 gpios properties name + +From: Neil Armstrong + +[ Upstream commit e57430d2483506f046e39bf8c61159dde88aede2 ] + +Add the final "s" to the pgio properties and fix the invalid "enable" +name to the correct "wake", checked against the HDK8450 schematics. + +Fixes: bc6588bc25fb ("arm64: dts: qcom: sm8450: add PCIe1 root device") +Signed-off-by: Neil Armstrong +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230323-topic-sm8450-upstream-dt-bindings-fixes-v2-4-0ca1bea1a843@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index d712c71144015..d86ee3dd2270a 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -1883,8 +1883,8 @@ + phys = <&pcie1_lane>; + phy-names = "pciephy"; + +- perst-gpio = <&tlmm 97 GPIO_ACTIVE_LOW>; +- enable-gpio = <&tlmm 99 GPIO_ACTIVE_HIGH>; ++ perst-gpios = <&tlmm 97 GPIO_ACTIVE_LOW>; ++ wake-gpios = <&tlmm 99 GPIO_ACTIVE_HIGH>; + + pinctrl-names = "default"; + pinctrl-0 = <&pcie1_default_state>; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-qcom-sm8450-fix-the-pci-i-o-port-range.patch b/queue-6.2/arm64-dts-qcom-sm8450-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..c3dfba23b45 --- /dev/null +++ b/queue-6.2/arm64-dts-qcom-sm8450-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,57 @@ +From 6ac2678378307593cb691e4d19f06397b72db11c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:48 +0530 +Subject: arm64: dts: qcom: sm8450: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit f57903c8f4c77938eb71fc67e4652264a9fa14f9 ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI addresses +(0x60200000, 0x40200000) specified in the ranges property for I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: bc6588bc25fb ("arm64: dts: qcom: sm8450: add PCIe1 root device") +Fixes: 7b09b1b47335 ("arm64: dts: qcom: sm8450: add PCIe0 RC device") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-13-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index 16a73288c1b37..d712c71144015 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -1726,8 +1726,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x60200000 0 0x60200000 0x0 0x100000>, +- <0x02000000 0x0 0x60300000 0 0x60300000 0x0 0x3d00000>; ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x60200000 0x0 0x100000>, ++ <0x02000000 0x0 0x60300000 0x0 0x60300000 0x0 0x3d00000>; + + interrupts = ; + interrupt-names = "msi"; +@@ -1835,8 +1835,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x01000000 0x0 0x40200000 0 0x40200000 0x0 0x100000>, +- <0x02000000 0x0 0x40300000 0 0x40300000 0x0 0x1fd00000>; ++ ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>, ++ <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>; + + interrupts = ; + interrupt-names = "msi"; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch b/queue-6.2/arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch new file mode 100644 index 00000000000..4a0bc6bc507 --- /dev/null +++ b/queue-6.2/arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch @@ -0,0 +1,53 @@ +From fca9884d3d668d43c939c5572098bc937b677451 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 16:30:32 +0100 +Subject: arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 554edc3e9239bb81e61be9f0f5dbbeb528a69e72 ] + +According to the RZ/G Series, 2nd Generation Hardware User’s Manual +Rev. 1.11, the System CPU cores on RZ/G2E do not have their own power +supply, but use the common internal power supply (typical 1.03V). + +Hence remove the "opp-microvolt" properties from the Operating +Performance Points table. They are optional, and unused, when none of +the CPU nodes is tied to a regulator using the "cpu-supply" property. + +Fixes: 231d8908a66fa98f ("arm64: dts: renesas: r8a774c0: Add OPPs table for cpu devices") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/8348e18a011ded94e35919cd8e17c0be1f9acf2f.1676560856.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a774c0.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi +index 151e32ac03683..ec7c7851519f4 100644 +--- a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi +@@ -49,17 +49,14 @@ + opp-shared; + opp-800000000 { + opp-hz = /bits/ 64 <800000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + }; + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + }; + opp-1200000000 { + opp-hz = /bits/ 64 <1200000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + opp-suspend; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch b/queue-6.2/arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch new file mode 100644 index 00000000000..03499ee3201 --- /dev/null +++ b/queue-6.2/arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch @@ -0,0 +1,53 @@ +From e144a30a1fe383f6e4ac32845b0f9b7d442c7221 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 16:30:31 +0100 +Subject: arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit fb76b0fae3ca880363214e1dcd6513ab8bd529e7 ] + +According to the R-Car Series, 3rd Generation Hardware User’s Manual +Rev. 2.30, the System CPU cores on R-Car E3 do not have their own power +supply, but use the common internal power supply (typical 1.03V). + +Hence remove the "opp-microvolt" properties from the Operating +Performance Points table. They are optional, and unused, when none of +the CPU nodes is tied to a regulator using the "cpu-supply" property. + +Fixes: dd7188eb4ed128dc ("arm64: dts: renesas: r8a77990: Add OPPs table for cpu devices") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/9232578d9d395d529f64db3333a371e31327f459.1676560856.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a77990.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a77990.dtsi b/arch/arm64/boot/dts/renesas/r8a77990.dtsi +index 3053b4b214978..3ed31ffd73a28 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77990.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a77990.dtsi +@@ -49,17 +49,14 @@ + opp-shared; + opp-800000000 { + opp-hz = /bits/ 64 <800000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + }; + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + }; + opp-1200000000 { + opp-hz = /bits/ 64 <1200000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + opp-suspend; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-renesas-r9a07g043-update-irq-numbers-for-s.patch b/queue-6.2/arm64-dts-renesas-r9a07g043-update-irq-numbers-for-s.patch new file mode 100644 index 00000000000..e714e202953 --- /dev/null +++ b/queue-6.2/arm64-dts-renesas-r9a07g043-update-irq-numbers-for-s.patch @@ -0,0 +1,86 @@ +From 08fc71cdf68fc42ccee93cc8ecb804779fca1911 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Feb 2023 18:52:25 +0000 +Subject: arm64: dts: renesas: r9a07g043: Update IRQ numbers for SSI channels + +From: Lad Prabhakar + +[ Upstream commit 2a5c9891392dca47f6865a2add1986876e40849c ] + +From R01UH0968EJ0100 Rev.1.00 HW manual the interrupt numbers for SSI +channels have been updated, + +SPI 329 - SSIF0 is now marked as reserved +SPI 333 - SSIF1 is now marked as reserved +SPI 335 - SSIF2 is now marked as reserved +SPI 336 - SSIF2 is now marked as reserved +SPI 341 - SSIF3 is now marked as reserved + +This patch drops the above IRQs from SoC DTSI. + +Fixes: 559f2b0708c70 ("arm64: dts: renesas: r9a07g043: Add SSI{1,2,3} nodes and fillup the SSI0 stub node") +Signed-off-by: Lad Prabhakar +Reviewed-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230217185225.43310-5-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r9a07g043.dtsi | 19 +++++++------------ + 1 file changed, 7 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r9a07g043.dtsi b/arch/arm64/boot/dts/renesas/r9a07g043.dtsi +index 3f7d451b11995..95817679b3884 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g043.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g043.dtsi +@@ -80,9 +80,8 @@ + reg = <0 0x10049c00 0 0x400>; + interrupts = , + , +- , +- ; +- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt"; ++ ; ++ interrupt-names = "int_req", "dma_rx", "dma_tx"; + clocks = <&cpg CPG_MOD R9A07G043_SSI0_PCLK2>, + <&cpg CPG_MOD R9A07G043_SSI0_PCLK_SFR>, + <&audio_clk1>, <&audio_clk2>; +@@ -101,9 +100,8 @@ + reg = <0 0x1004a000 0 0x400>; + interrupts = , + , +- , +- ; +- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt"; ++ ; ++ interrupt-names = "int_req", "dma_rx", "dma_tx"; + clocks = <&cpg CPG_MOD R9A07G043_SSI1_PCLK2>, + <&cpg CPG_MOD R9A07G043_SSI1_PCLK_SFR>, + <&audio_clk1>, <&audio_clk2>; +@@ -121,10 +119,8 @@ + "renesas,rz-ssi"; + reg = <0 0x1004a400 0 0x400>; + interrupts = , +- , +- , + ; +- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt"; ++ interrupt-names = "int_req", "dma_rt"; + clocks = <&cpg CPG_MOD R9A07G043_SSI2_PCLK2>, + <&cpg CPG_MOD R9A07G043_SSI2_PCLK_SFR>, + <&audio_clk1>, <&audio_clk2>; +@@ -143,9 +139,8 @@ + reg = <0 0x1004a800 0 0x400>; + interrupts = , + , +- , +- ; +- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt"; ++ ; ++ interrupt-names = "int_req", "dma_rx", "dma_tx"; + clocks = <&cpg CPG_MOD R9A07G043_SSI3_PCLK2>, + <&cpg CPG_MOD R9A07G043_SSI3_PCLK_SFR>, + <&audio_clk1>, <&audio_clk2>; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-renesas-r9a07g044-update-irq-numbers-for-s.patch b/queue-6.2/arm64-dts-renesas-r9a07g044-update-irq-numbers-for-s.patch new file mode 100644 index 00000000000..bf738a8fde5 --- /dev/null +++ b/queue-6.2/arm64-dts-renesas-r9a07g044-update-irq-numbers-for-s.patch @@ -0,0 +1,86 @@ +From a5e989a979bef3581f2fe2f2101072c9841fdc76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Feb 2023 18:52:24 +0000 +Subject: arm64: dts: renesas: r9a07g044: Update IRQ numbers for SSI channels + +From: Lad Prabhakar + +[ Upstream commit 5da750ddd96454757a3b467e968e3fb70bb12bc8 ] + +From R01UH0914EJ0120 Rev.1.20 HW manual the interrupt numbers for SSI +channels have been updated, + +SPI 329 - SSIF0 is now marked as reserved +SPI 333 - SSIF1 is now marked as reserved +SPI 335 - SSIF2 is now marked as reserved +SPI 336 - SSIF2 is now marked as reserved +SPI 341 - SSIF3 is now marked as reserved + +This patch drops the above IRQs from SoC DTSI. + +Fixes: 92a341315afc9 ("arm64: dts: renesas: r9a07g044: Add SSI support") +Signed-off-by: Lad Prabhakar +Reviewed-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230217185225.43310-4-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 19 +++++++------------ + 1 file changed, 7 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi +index 487536696d900..6a42df15440cf 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi +@@ -175,9 +175,8 @@ + reg = <0 0x10049c00 0 0x400>; + interrupts = , + , +- , +- ; +- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt"; ++ ; ++ interrupt-names = "int_req", "dma_rx", "dma_tx"; + clocks = <&cpg CPG_MOD R9A07G044_SSI0_PCLK2>, + <&cpg CPG_MOD R9A07G044_SSI0_PCLK_SFR>, + <&audio_clk1>, <&audio_clk2>; +@@ -196,9 +195,8 @@ + reg = <0 0x1004a000 0 0x400>; + interrupts = , + , +- , +- ; +- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt"; ++ ; ++ interrupt-names = "int_req", "dma_rx", "dma_tx"; + clocks = <&cpg CPG_MOD R9A07G044_SSI1_PCLK2>, + <&cpg CPG_MOD R9A07G044_SSI1_PCLK_SFR>, + <&audio_clk1>, <&audio_clk2>; +@@ -216,10 +214,8 @@ + "renesas,rz-ssi"; + reg = <0 0x1004a400 0 0x400>; + interrupts = , +- , +- , + ; +- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt"; ++ interrupt-names = "int_req", "dma_rt"; + clocks = <&cpg CPG_MOD R9A07G044_SSI2_PCLK2>, + <&cpg CPG_MOD R9A07G044_SSI2_PCLK_SFR>, + <&audio_clk1>, <&audio_clk2>; +@@ -238,9 +234,8 @@ + reg = <0 0x1004a800 0 0x400>; + interrupts = , + , +- , +- ; +- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt"; ++ ; ++ interrupt-names = "int_req", "dma_rx", "dma_tx"; + clocks = <&cpg CPG_MOD R9A07G044_SSI3_PCLK2>, + <&cpg CPG_MOD R9A07G044_SSI3_PCLK_SFR>, + <&audio_clk1>, <&audio_clk2>; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-renesas-r9a07g054-update-irq-numbers-for-s.patch b/queue-6.2/arm64-dts-renesas-r9a07g054-update-irq-numbers-for-s.patch new file mode 100644 index 00000000000..ebf88a6ac06 --- /dev/null +++ b/queue-6.2/arm64-dts-renesas-r9a07g054-update-irq-numbers-for-s.patch @@ -0,0 +1,86 @@ +From 96f2fdff4e3f0d09a039509c671efd587273960c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Feb 2023 18:52:24 +0000 +Subject: arm64: dts: renesas: r9a07g054: Update IRQ numbers for SSI channels + +From: Lad Prabhakar + +[ Upstream commit c2b0dc0e83ef4a74cbe381fd0c84cea16cf067f0 ] + +From R01UH0936EJ0120 Rev.1.20 HW manual the interrupt numbers for SSI +channels have been updated, + +SPI 329 - SSIF0 is now marked as reserved +SPI 333 - SSIF1 is now marked as reserved +SPI 335 - SSIF2 is now marked as reserved +SPI 336 - SSIF2 is now marked as reserved +SPI 341 - SSIF3 is now marked as reserved + +This patch drops the above IRQs from SoC DTSI. + +Fixes: cd0339ec25895c0b ("arm64: dts: renesas: r9a07g054: Add SSI{1,2,3} nodes and fillup the SSI0 stub node") +Signed-off-by: Lad Prabhakar +Reviewed-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230217185225.43310-4-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 19 +++++++------------ + 1 file changed, 7 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi +index 304ade54425bf..fea537d9fce66 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi +@@ -175,9 +175,8 @@ + reg = <0 0x10049c00 0 0x400>; + interrupts = , + , +- , +- ; +- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt"; ++ ; ++ interrupt-names = "int_req", "dma_rx", "dma_tx"; + clocks = <&cpg CPG_MOD R9A07G054_SSI0_PCLK2>, + <&cpg CPG_MOD R9A07G054_SSI0_PCLK_SFR>, + <&audio_clk1>, <&audio_clk2>; +@@ -196,9 +195,8 @@ + reg = <0 0x1004a000 0 0x400>; + interrupts = , + , +- , +- ; +- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt"; ++ ; ++ interrupt-names = "int_req", "dma_rx", "dma_tx"; + clocks = <&cpg CPG_MOD R9A07G054_SSI1_PCLK2>, + <&cpg CPG_MOD R9A07G054_SSI1_PCLK_SFR>, + <&audio_clk1>, <&audio_clk2>; +@@ -216,10 +214,8 @@ + "renesas,rz-ssi"; + reg = <0 0x1004a400 0 0x400>; + interrupts = , +- , +- , + ; +- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt"; ++ interrupt-names = "int_req", "dma_rt"; + clocks = <&cpg CPG_MOD R9A07G054_SSI2_PCLK2>, + <&cpg CPG_MOD R9A07G054_SSI2_PCLK_SFR>, + <&audio_clk1>, <&audio_clk2>; +@@ -238,9 +234,8 @@ + reg = <0 0x1004a800 0 0x400>; + interrupts = , + , +- , +- ; +- interrupt-names = "int_req", "dma_rx", "dma_tx", "dma_rt"; ++ ; ++ interrupt-names = "int_req", "dma_rx", "dma_tx"; + clocks = <&cpg CPG_MOD R9A07G054_SSI3_PCLK2>, + <&cpg CPG_MOD R9A07G054_SSI3_PCLK_SFR>, + <&audio_clk1>, <&audio_clk2>; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-sc7180-rename-qspi-data12-as-data23.patch b/queue-6.2/arm64-dts-sc7180-rename-qspi-data12-as-data23.patch new file mode 100644 index 00000000000..cecc37a1056 --- /dev/null +++ b/queue-6.2/arm64-dts-sc7180-rename-qspi-data12-as-data23.patch @@ -0,0 +1,40 @@ +From ee7e0a861879d37908329f8c9a962fcf19d1fee1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 10:30:05 -0700 +Subject: arm64: dts: sc7180: Rename qspi data12 as data23 + +From: Douglas Anderson + +[ Upstream commit d84f8f2687bdc67f20262e822b206419bcfd0038 ] + +There are 4 qspi data pins: data0, data1, data2, and data3. Currently +we have a shared pin state for data0 and data1 (2 lane config) and a +pin state for data2 and data3 (you'd enable both this and the 2 lane +state for 4 lanes). The second state is obviously misnamed. Fix it. + +Fixes: ba3fc6496366 ("arm64: dts: sc7180: Add qupv3_0 and qupv3_1") +Signed-off-by: Douglas Anderson +Acked-by: Linus Walleij +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230323102605.1.Ifc1b5be04653f4ab119698a5944bfecded2080d6@changeid +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi +index e45726be81c82..4e7d93ff75c47 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi +@@ -1512,7 +1512,7 @@ + function = "qspi_data"; + }; + +- qspi_data12: qspi-data12-state { ++ qspi_data23: qspi-data23-state { + pins = "gpio66", "gpio67"; + function = "qspi_data"; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-sc7280-rename-qspi-data12-as-data23.patch b/queue-6.2/arm64-dts-sc7280-rename-qspi-data12-as-data23.patch new file mode 100644 index 00000000000..9ace3a9c262 --- /dev/null +++ b/queue-6.2/arm64-dts-sc7280-rename-qspi-data12-as-data23.patch @@ -0,0 +1,40 @@ +From 98ec43fad8bec4297f486364ec4c03fc48cdd6f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 10:30:06 -0700 +Subject: arm64: dts: sc7280: Rename qspi data12 as data23 + +From: Douglas Anderson + +[ Upstream commit 14acf21c0d3f7b7298ffcd2e5b5db4a476ec6202 ] + +There are 4 qspi data pins: data0, data1, data2, and data3. Currently +we have a shared pin state for data0 and data1 (2 lane config) and a +pin state for data2 and data3 (you'd enable both this and the 2 lane +state for 4 lanes). The second state is obviously misnamed. Fix it. + +Fixes: 7720ea001b52 ("arm64: dts: qcom: sc7280: Add QSPI node") +Signed-off-by: Douglas Anderson +Acked-by: Linus Walleij +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230323102605.2.I4043491bb24b1e92267c5033d76cdb0fe60934da@changeid +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index 7ff3a4504d0b1..286d59d11f2e9 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -4349,7 +4349,7 @@ + function = "qspi_data"; + }; + +- qspi_data12: qspi-data12-state { ++ qspi_data23: qspi-data23-state { + pins = "gpio16", "gpio17"; + function = "qspi_data"; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-sdm845-rename-qspi-data12-as-data23.patch b/queue-6.2/arm64-dts-sdm845-rename-qspi-data12-as-data23.patch new file mode 100644 index 00000000000..fecbcf3d4ae --- /dev/null +++ b/queue-6.2/arm64-dts-sdm845-rename-qspi-data12-as-data23.patch @@ -0,0 +1,40 @@ +From 6cd8c54d76f4f34718057ecd717e8caf875471b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 10:30:07 -0700 +Subject: arm64: dts: sdm845: Rename qspi data12 as data23 + +From: Douglas Anderson + +[ Upstream commit 37f7349b56decc91c66f8039712e63740b1f25f9 ] + +There are 4 qspi data pins: data0, data1, data2, and data3. Currently +we have a shared pin state for data0 and data1 (2 lane config) and a +pin state for data2 and data3 (you'd enable both this and the 2 lane +state for 4 lanes). The second state is obviously misnamed. Fix it. + +Fixes: e1ce853932b7 ("arm64: dts: qcom: sdm845: Add qspi (quad SPI) node") +Signed-off-by: Douglas Anderson +Acked-by: Linus Walleij +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230323102605.3.I88528d037b7fda4e53a40f661be5ac61628691cd@changeid +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 481b721881cd7..81ec17e7d7310 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -2697,7 +2697,7 @@ + function = "qspi_data"; + }; + +- qspi_data12: qspi-data12-state { ++ qspi_data23: qspi-data23-state { + pins = "gpio93", "gpio94"; + function = "qspi_data"; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-ti-k3-am62-main-fix-gpio-numbers-in-dt.patch b/queue-6.2/arm64-dts-ti-k3-am62-main-fix-gpio-numbers-in-dt.patch new file mode 100644 index 00000000000..65eab737af1 --- /dev/null +++ b/queue-6.2/arm64-dts-ti-k3-am62-main-fix-gpio-numbers-in-dt.patch @@ -0,0 +1,51 @@ +From e44012784d761621438331e0ff1f81764787d978 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 14:29:17 +0530 +Subject: arm64: dts: ti: k3-am62-main: Fix GPIO numbers in DT + +From: Nitin Yadav + +[ Upstream commit 28c8f2189d80c8b37068c367e9864b5aa530f208 ] + +Fix number of gpio pins in main_gpio0 & main_gpio1 +DT nodes according to AM62x SK datasheet. The Link +of datasheet is in the following line: +https://www.ti.com/lit/ds/symlink/am625.pdf?ts=1673852494660 + +Section: 6.3.10 GPIO (Page No. 63-67) + +Fixes: f1d17330a5be ("arm64: dts: ti: Introduce base support for AM62x SoC") +Signed-off-by: Nitin Yadav +Signed-off-by: Nishanth Menon +Reviewed-by: Bryan Brattlof +Link: https://lore.kernel.org/r/20230202085917.3044567-1-n-yadav@ti.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +index ae1ec58117c35..0bdc16b0d08f2 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +@@ -461,7 +461,7 @@ + <193>, <194>, <195>; + interrupt-controller; + #interrupt-cells = <2>; +- ti,ngpio = <87>; ++ ti,ngpio = <92>; + ti,davinci-gpio-unbanked = <0>; + power-domains = <&k3_pds 77 TI_SCI_PD_EXCLUSIVE>; + clocks = <&k3_clks 77 0>; +@@ -478,7 +478,7 @@ + <183>, <184>, <185>; + interrupt-controller; + #interrupt-cells = <2>; +- ti,ngpio = <88>; ++ ti,ngpio = <52>; + ti,davinci-gpio-unbanked = <0>; + power-domains = <&k3_pds 78 TI_SCI_PD_EXCLUSIVE>; + clocks = <&k3_clks 78 0>; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-ti-k3-am625-correct-l2-cache-size-to-512kb.patch b/queue-6.2/arm64-dts-ti-k3-am625-correct-l2-cache-size-to-512kb.patch new file mode 100644 index 00000000000..f459411a059 --- /dev/null +++ b/queue-6.2/arm64-dts-ti-k3-am625-correct-l2-cache-size-to-512kb.patch @@ -0,0 +1,38 @@ +From d52a3b8e28e420e13a65025877bfb28ee479211c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 10:19:34 +0530 +Subject: arm64: dts: ti: k3-am625: Correct L2 cache size to 512KB + +From: Vignesh Raghavendra + +[ Upstream commit 6974371cab1c488a53960945cb139b20ebb5f16b ] + +Per AM62x SoC datasheet[0] L2 cache is 512KB. + +[0] https://www.ti.com/lit/gpn/am625 Page 1. + +Fixes: f1d17330a5be ("arm64: dts: ti: Introduce base support for AM62x SoC") +Signed-off-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20230320044935.2512288-1-vigneshr@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am625.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am625.dtsi b/arch/arm64/boot/dts/ti/k3-am625.dtsi +index cea2cc7de5dd3..26d78562ceba7 100644 +--- a/arch/arm64/boot/dts/ti/k3-am625.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am625.dtsi +@@ -147,7 +147,7 @@ + L2_0: l2-cache0 { + compatible = "cache"; + cache-level = <2>; +- cache-size = <0x40000>; ++ cache-size = <0x80000>; + cache-line-size = <64>; + cache-sets = <512>; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-ti-k3-am62a7-correct-l2-cache-size-to-512k.patch b/queue-6.2/arm64-dts-ti-k3-am62a7-correct-l2-cache-size-to-512k.patch new file mode 100644 index 00000000000..2eb57fb4e72 --- /dev/null +++ b/queue-6.2/arm64-dts-ti-k3-am62a7-correct-l2-cache-size-to-512k.patch @@ -0,0 +1,38 @@ +From 3d26c3142cd79b26d21255fa84f3fd3b9fc5a955 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 10:19:35 +0530 +Subject: arm64: dts: ti: k3-am62a7: Correct L2 cache size to 512KB + +From: Vignesh Raghavendra + +[ Upstream commit 438b8dc949bf45979c32553e96086ff1c6e2504e ] + +Per AM62Ax SoC datasheet[0] L2 cache is 512KB. + +[0] https://www.ti.com/lit/gpn/am62a7 Page 1. + +Fixes: 5fc6b1b62639 ("arm64: dts: ti: Introduce AM62A7 family of SoCs") +Signed-off-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20230320044935.2512288-2-vigneshr@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62a7.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62a7.dtsi b/arch/arm64/boot/dts/ti/k3-am62a7.dtsi +index 331d89fda29d0..f1ebaec404fbc 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62a7.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62a7.dtsi +@@ -96,7 +96,7 @@ + L2_0: l2-cache0 { + compatible = "cache"; + cache-level = <2>; +- cache-size = <0x40000>; ++ cache-size = <0x80000>; + cache-line-size = <64>; + cache-sets = <512>; + }; +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-ti-k3-am62a7-sk-fix-ddr-size-to-full-4gb.patch b/queue-6.2/arm64-dts-ti-k3-am62a7-sk-fix-ddr-size-to-full-4gb.patch new file mode 100644 index 00000000000..9dc6c1fd1df --- /dev/null +++ b/queue-6.2/arm64-dts-ti-k3-am62a7-sk-fix-ddr-size-to-full-4gb.patch @@ -0,0 +1,46 @@ +From d56802994ba0ae3fac6ad964f0430ce99f3ce0e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 15:16:45 +0530 +Subject: arm64: dts: ti: k3-am62a7-sk: Fix DDR size to full 4GB + +From: Devarsh Thakkar + +[ Upstream commit a1bc0d6084dba8a31831c65318a8a8e46f00906f ] + +All revisions of AM62A7-SK board have 4GB LPDDR4 Micron +MT53E2G32D4DE-046 AUT:B memory. Commit 38c4a08c820c ("arm64: dts: ti: +Add support for AM62A7-SK") enabled just 2GB due to a schematics error +in early revision of the board. Fix it by enabling full 4GB available on +the platform. + +Design docs: https://www.ti.com/lit/zip/sprr459 + +Fixes: 38c4a08c820c ("arm64: dts: ti: Add support for AM62A7-SK") +Signed-off-by: Devarsh Thakkar +Signed-off-by: Nishanth Menon +Reviewed-by: Bryan Brattlof +Link: https://lore.kernel.org/r/20230314094645.3411599-1-devarsht@ti.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts +index 576dbce80ad83..b08a083d722d4 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts +@@ -26,8 +26,9 @@ + + memory@80000000 { + device_type = "memory"; +- /* 2G RAM */ +- reg = <0x00000000 0x80000000 0x00000000 0x80000000>; ++ /* 4G RAM */ ++ reg = <0x00000000 0x80000000 0x00000000 0x80000000>, ++ <0x00000008 0x80000000 0x00000000 0x80000000>; + }; + + reserved-memory { +-- +2.39.2 + diff --git a/queue-6.2/arm64-dts-ti-k3-j721e-main-remove-ti-strobe-sel-prop.patch b/queue-6.2/arm64-dts-ti-k3-j721e-main-remove-ti-strobe-sel-prop.patch new file mode 100644 index 00000000000..bb8208efab2 --- /dev/null +++ b/queue-6.2/arm64-dts-ti-k3-j721e-main-remove-ti-strobe-sel-prop.patch @@ -0,0 +1,44 @@ +From b1eb778bf9e69afae9252eeae9a98b99841d4c3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Feb 2023 13:07:24 +0530 +Subject: arm64: dts: ti: k3-j721e-main: Remove ti,strobe-sel property + +From: Bhavya Kapoor + +[ Upstream commit 4f4b30a777d3e61603119297965343a37be36435 ] + +According to latest errata of J721e [1], (i2024) 'MMCSD: Peripherals +Do Not Support HS400' which applies to MMCSD0 subsystem. Speed modes +supported has been already updated but missed dropping 'ti,strobe-sel' +property which is only required by HS400 speed mode. + +Thus, drop 'ti,strobe-sel' property from kernel dtsi for J721e SoC. + +[1] https://www.ti.com/lit/er/sprz455/sprz455.pdf + +Fixes: eb8f6194e807 ("arm64: dts: ti: k3-j721e-main: Update the speed modes supported and their itap delay values for MMCSD subsystems") +Signed-off-by: Bhavya Kapoor +Signed-off-by: Nishanth Menon +Reviewed-by: Diwakar Dhyani +Reviewed-by: Nitin Yadav +Link: https://lore.kernel.org/r/20230203073724.29529-1-b-kapoor@ti.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi +index c935622f01028..bfa296dce3a31 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi +@@ -1180,7 +1180,6 @@ + ti,itap-del-sel-mmc-hs = <0xa>; + ti,itap-del-sel-ddr52 = <0x3>; + ti,trm-icp = <0x8>; +- ti,strobe-sel = <0x77>; + dma-coherent; + }; + +-- +2.39.2 + diff --git a/queue-6.2/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch b/queue-6.2/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch new file mode 100644 index 00000000000..992f3a9462b --- /dev/null +++ b/queue-6.2/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch @@ -0,0 +1,128 @@ +From cb671179d163cd6e79b1e9b36025b144b9fdf705 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 13:01:48 +0530 +Subject: arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step + +From: Sumit Garg + +[ Upstream commit af6c0bd59f4f3ad5daad2f7b777954b1954551d5 ] + +Currently only the first attempt to single-step has any effect. After +that all further stepping remains "stuck" at the same program counter +value. + +Refer to the ARM Architecture Reference Manual (ARM DDI 0487E.a) D2.12, +PSTATE.SS=1 should be set at each step before transferring the PE to the +'Active-not-pending' state. The problem here is PSTATE.SS=1 is not set +since the second single-step. + +After the first single-step, the PE transferes to the 'Inactive' state, +with PSTATE.SS=0 and MDSCR.SS=1, thus PSTATE.SS won't be set to 1 due to +kernel_active_single_step()=true. Then the PE transferes to the +'Active-pending' state when ERET and returns to the debugger by step +exception. + +Before this patch: +================== +Entering kdb (current=0xffff3376039f0000, pid 1) on processor 0 due to Keyboard Entry +[0]kdb> + +[0]kdb> +[0]kdb> bp write_sysrq_trigger +Instruction(i) BP #0 at 0xffffa45c13d09290 (write_sysrq_trigger) + is enabled addr at ffffa45c13d09290, hardtype=0 installed=0 + +[0]kdb> go +$ echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to Breakpoint @ 0xffffad651a309290 +[1]kdb> ss + +Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294 +[1]kdb> ss + +Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294 +[1]kdb> + +After this patch: +================= +Entering kdb (current=0xffff6851c39f0000, pid 1) on processor 0 due to Keyboard Entry +[0]kdb> bp write_sysrq_trigger +Instruction(i) BP #0 at 0xffffc02d2dd09290 (write_sysrq_trigger) + is enabled addr at ffffc02d2dd09290, hardtype=0 installed=0 + +[0]kdb> go +$ echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to Breakpoint @ 0xffffc02d2dd09290 +[1]kdb> ss + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09294 +[1]kdb> ss + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09298 +[1]kdb> ss + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd0929c +[1]kdb> + +Fixes: 44679a4f142b ("arm64: KGDB: Add step debugging support") +Co-developed-by: Wei Li +Signed-off-by: Wei Li +Signed-off-by: Sumit Garg +Tested-by: Douglas Anderson +Acked-by: Daniel Thompson +Tested-by: Daniel Thompson +Link: https://lore.kernel.org/r/20230202073148.657746-3-sumit.garg@linaro.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/debug-monitors.h | 1 + + arch/arm64/kernel/debug-monitors.c | 5 +++++ + arch/arm64/kernel/kgdb.c | 2 ++ + 3 files changed, 8 insertions(+) + +diff --git a/arch/arm64/include/asm/debug-monitors.h b/arch/arm64/include/asm/debug-monitors.h +index 7b7e05c02691c..13d437bcbf58c 100644 +--- a/arch/arm64/include/asm/debug-monitors.h ++++ b/arch/arm64/include/asm/debug-monitors.h +@@ -104,6 +104,7 @@ void user_regs_reset_single_step(struct user_pt_regs *regs, + void kernel_enable_single_step(struct pt_regs *regs); + void kernel_disable_single_step(void); + int kernel_active_single_step(void); ++void kernel_rewind_single_step(struct pt_regs *regs); + + #ifdef CONFIG_HAVE_HW_BREAKPOINT + int reinstall_suspended_bps(struct pt_regs *regs); +diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c +index 3da09778267ec..64f2ecbdfe5c2 100644 +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -438,6 +438,11 @@ int kernel_active_single_step(void) + } + NOKPROBE_SYMBOL(kernel_active_single_step); + ++void kernel_rewind_single_step(struct pt_regs *regs) ++{ ++ set_regs_spsr_ss(regs); ++} ++ + /* ptrace API */ + void user_enable_single_step(struct task_struct *task) + { +diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c +index cda9c1e9864f7..4e1f983df3d1c 100644 +--- a/arch/arm64/kernel/kgdb.c ++++ b/arch/arm64/kernel/kgdb.c +@@ -224,6 +224,8 @@ int kgdb_arch_handle_exception(int exception_vector, int signo, + */ + if (!kernel_active_single_step()) + kernel_enable_single_step(linux_regs); ++ else ++ kernel_rewind_single_step(linux_regs); + err = 0; + break; + default: +-- +2.39.2 + diff --git a/queue-6.2/asoc-cs35l41-only-disable-internal-boost.patch b/queue-6.2/asoc-cs35l41-only-disable-internal-boost.patch new file mode 100644 index 00000000000..0848d4175b4 --- /dev/null +++ b/queue-6.2/asoc-cs35l41-only-disable-internal-boost.patch @@ -0,0 +1,111 @@ +From 6e9c8a4b6fa7fbf5f9e9cebb6fe8c2a1ebc0876a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Feb 2023 08:43:21 +0000 +Subject: ASoC: cs35l41: Only disable internal boost + +From: Lucas Tanure + +[ Upstream commit 4658de99d43cd740e019e7fd124b4128f8f4027f ] + +In error situations, only the internal boost case should be disabled and +re-enabled. +Also, for other boost cases re-enabling the boost to the default internal +boost config is incorrect. + +Fixes: 6450ef559056 ("ASoC: cs35l41: CS35L41 Boosted Smart Amplifier") +Signed-off-by: Lucas Tanure +Acked-by: Charles Keepax +Reviewed-by: David Rhodes +Link: https://lore.kernel.org/r/20230223084324.9076-2-lucas.tanure@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l41.c | 34 +++++++++++++++++++--------------- + 1 file changed, 19 insertions(+), 15 deletions(-) + +diff --git a/sound/soc/codecs/cs35l41.c b/sound/soc/codecs/cs35l41.c +index c223d83e02cfb..f2b5032daa6ae 100644 +--- a/sound/soc/codecs/cs35l41.c ++++ b/sound/soc/codecs/cs35l41.c +@@ -356,6 +356,19 @@ static const struct snd_kcontrol_new cs35l41_aud_controls[] = { + WM_ADSP_FW_CONTROL("DSP1", 0), + }; + ++static void cs35l41_boost_enable(struct cs35l41_private *cs35l41, unsigned int enable) ++{ ++ switch (cs35l41->hw_cfg.bst_type) { ++ case CS35L41_INT_BOOST: ++ enable = enable ? CS35L41_BST_EN_DEFAULT : CS35L41_BST_DIS_FET_OFF; ++ regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2, CS35L41_BST_EN_MASK, ++ enable << CS35L41_BST_EN_SHIFT); ++ break; ++ default: ++ break; ++ } ++} ++ + static irqreturn_t cs35l41_irq(int irq, void *data) + { + struct cs35l41_private *cs35l41 = data; +@@ -431,8 +444,7 @@ static irqreturn_t cs35l41_irq(int irq, void *data) + + if (status[0] & CS35L41_BST_OVP_ERR) { + dev_crit_ratelimited(cs35l41->dev, "VBST Over Voltage error\n"); +- regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2, +- CS35L41_BST_EN_MASK, 0); ++ cs35l41_boost_enable(cs35l41, 0); + regmap_write(cs35l41->regmap, CS35L41_IRQ1_STATUS1, + CS35L41_BST_OVP_ERR); + regmap_write(cs35l41->regmap, CS35L41_PROTECT_REL_ERR_IGN, 0); +@@ -441,16 +453,13 @@ static irqreturn_t cs35l41_irq(int irq, void *data) + CS35L41_BST_OVP_ERR_RLS); + regmap_update_bits(cs35l41->regmap, CS35L41_PROTECT_REL_ERR_IGN, + CS35L41_BST_OVP_ERR_RLS, 0); +- regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2, +- CS35L41_BST_EN_MASK, +- CS35L41_BST_EN_DEFAULT << CS35L41_BST_EN_SHIFT); ++ cs35l41_boost_enable(cs35l41, 1); + ret = IRQ_HANDLED; + } + + if (status[0] & CS35L41_BST_DCM_UVP_ERR) { + dev_crit_ratelimited(cs35l41->dev, "DCM VBST Under Voltage Error\n"); +- regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2, +- CS35L41_BST_EN_MASK, 0); ++ cs35l41_boost_enable(cs35l41, 0); + regmap_write(cs35l41->regmap, CS35L41_IRQ1_STATUS1, + CS35L41_BST_DCM_UVP_ERR); + regmap_write(cs35l41->regmap, CS35L41_PROTECT_REL_ERR_IGN, 0); +@@ -459,16 +468,13 @@ static irqreturn_t cs35l41_irq(int irq, void *data) + CS35L41_BST_UVP_ERR_RLS); + regmap_update_bits(cs35l41->regmap, CS35L41_PROTECT_REL_ERR_IGN, + CS35L41_BST_UVP_ERR_RLS, 0); +- regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2, +- CS35L41_BST_EN_MASK, +- CS35L41_BST_EN_DEFAULT << CS35L41_BST_EN_SHIFT); ++ cs35l41_boost_enable(cs35l41, 1); + ret = IRQ_HANDLED; + } + + if (status[0] & CS35L41_BST_SHORT_ERR) { + dev_crit_ratelimited(cs35l41->dev, "LBST error: powering off!\n"); +- regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2, +- CS35L41_BST_EN_MASK, 0); ++ cs35l41_boost_enable(cs35l41, 0); + regmap_write(cs35l41->regmap, CS35L41_IRQ1_STATUS1, + CS35L41_BST_SHORT_ERR); + regmap_write(cs35l41->regmap, CS35L41_PROTECT_REL_ERR_IGN, 0); +@@ -477,9 +483,7 @@ static irqreturn_t cs35l41_irq(int irq, void *data) + CS35L41_BST_SHORT_ERR_RLS); + regmap_update_bits(cs35l41->regmap, CS35L41_PROTECT_REL_ERR_IGN, + CS35L41_BST_SHORT_ERR_RLS, 0); +- regmap_update_bits(cs35l41->regmap, CS35L41_PWR_CTRL2, +- CS35L41_BST_EN_MASK, +- CS35L41_BST_EN_DEFAULT << CS35L41_BST_EN_SHIFT); ++ cs35l41_boost_enable(cs35l41, 1); + ret = IRQ_HANDLED; + } + +-- +2.39.2 + diff --git a/queue-6.2/asoc-es8316-handle-optional-irq-assignment.patch b/queue-6.2/asoc-es8316-handle-optional-irq-assignment.patch new file mode 100644 index 00000000000..119a5c00d0c --- /dev/null +++ b/queue-6.2/asoc-es8316-handle-optional-irq-assignment.patch @@ -0,0 +1,62 @@ +From 95c6d008740c05006bc4f3511da48c7897316d50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 12:49:01 +0300 +Subject: ASoC: es8316: Handle optional IRQ assignment + +From: Cristian Ciocaltea + +[ Upstream commit 39db65a0a17b54915b269d3685f253a4731f344c ] + +The driver is able to work fine without relying on a mandatory interrupt +being assigned to the I2C device. This is only needed when making use of +the jack-detect support. + +However, the following warning message is always emitted when there is +no such interrupt available: + + es8316 0-0011: Failed to get IRQ 0: -22 + +Do not attempt to request an IRQ if it is not available/valid. This also +ensures the rather misleading message is not displayed anymore. + +Also note the IRQ validation relies on commit dab472eb931bc291 ("i2c / +ACPI: Use 0 to indicate that device does not have interrupt assigned"). + +Fixes: 822257661031 ("ASoC: es8316: Add jack-detect support") +Signed-off-by: Cristian Ciocaltea +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20230328094901.50763-1-cristian.ciocaltea@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8316.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c +index 056c3082fe02c..f7d7a9c91e04c 100644 +--- a/sound/soc/codecs/es8316.c ++++ b/sound/soc/codecs/es8316.c +@@ -842,12 +842,14 @@ static int es8316_i2c_probe(struct i2c_client *i2c_client) + es8316->irq = i2c_client->irq; + mutex_init(&es8316->lock); + +- ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq, +- IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN, +- "es8316", es8316); +- if (ret) { +- dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret); +- es8316->irq = -ENXIO; ++ if (es8316->irq > 0) { ++ ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq, ++ IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN, ++ "es8316", es8316); ++ if (ret) { ++ dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret); ++ es8316->irq = -ENXIO; ++ } + } + + return devm_snd_soc_register_component(&i2c_client->dev, +-- +2.39.2 + diff --git a/queue-6.2/asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch b/queue-6.2/asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch new file mode 100644 index 00000000000..a55be13b359 --- /dev/null +++ b/queue-6.2/asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch @@ -0,0 +1,72 @@ +From e0f4226cf0dd0194063770603b1230d6774e195b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 23:26:47 +0800 +Subject: ASoC: fsl_mqs: move of_node_put() to the correct location + +From: Liliang Ye + +[ Upstream commit 1c34890273a020d61d6127ade3f68ed1cb21c16a ] + +of_node_put() should have been done directly after +mqs_priv->regmap = syscon_node_to_regmap(gpr_np); +otherwise it creates a reference leak on the success path. + +To fix this, of_node_put() is moved to the correct location, and change +all the gotos to direct returns. + +Fixes: a9d273671440 ("ASoC: fsl_mqs: Fix error handling in probe") +Signed-off-by: Liliang Ye +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20230403152647.17638-1-yll@hust.edu.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_mqs.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +diff --git a/sound/soc/fsl/fsl_mqs.c b/sound/soc/fsl/fsl_mqs.c +index 4922e6795b73f..32d20d351bbf7 100644 +--- a/sound/soc/fsl/fsl_mqs.c ++++ b/sound/soc/fsl/fsl_mqs.c +@@ -210,10 +210,10 @@ static int fsl_mqs_probe(struct platform_device *pdev) + } + + mqs_priv->regmap = syscon_node_to_regmap(gpr_np); ++ of_node_put(gpr_np); + if (IS_ERR(mqs_priv->regmap)) { + dev_err(&pdev->dev, "failed to get gpr regmap\n"); +- ret = PTR_ERR(mqs_priv->regmap); +- goto err_free_gpr_np; ++ return PTR_ERR(mqs_priv->regmap); + } + } else { + regs = devm_platform_ioremap_resource(pdev, 0); +@@ -242,8 +242,7 @@ static int fsl_mqs_probe(struct platform_device *pdev) + if (IS_ERR(mqs_priv->mclk)) { + dev_err(&pdev->dev, "failed to get the clock: %ld\n", + PTR_ERR(mqs_priv->mclk)); +- ret = PTR_ERR(mqs_priv->mclk); +- goto err_free_gpr_np; ++ return PTR_ERR(mqs_priv->mclk); + } + + dev_set_drvdata(&pdev->dev, mqs_priv); +@@ -252,13 +251,9 @@ static int fsl_mqs_probe(struct platform_device *pdev) + ret = devm_snd_soc_register_component(&pdev->dev, &soc_codec_fsl_mqs, + &fsl_mqs_dai, 1); + if (ret) +- goto err_free_gpr_np; +- return 0; +- +-err_free_gpr_np: +- of_node_put(gpr_np); ++ return ret; + +- return ret; ++ return 0; + } + + static int fsl_mqs_remove(struct platform_device *pdev) +-- +2.39.2 + diff --git a/queue-6.2/asoc-soc-compress-inherit-atomicity-from-dai-link-fo.patch b/queue-6.2/asoc-soc-compress-inherit-atomicity-from-dai-link-fo.patch new file mode 100644 index 00000000000..6560aba4de7 --- /dev/null +++ b/queue-6.2/asoc-soc-compress-inherit-atomicity-from-dai-link-fo.patch @@ -0,0 +1,49 @@ +From 962ae1963513726b841a4ddb7575a8d28be39b9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 14:40:19 +0200 +Subject: ASoC: soc-compress: Inherit atomicity from DAI link for Compress FE + +From: Daniel Baluta + +[ Upstream commit 37b58becc1cee4d591024f2056d7ffa99c6089e0 ] + +After commit bbf7d3b1c4f40 ("ASoC: soc-pcm: align BE 'atomicity' with +that of the FE") BE and FE atomicity must match. + +In the case of Compress PCM there is a mismatch in atomicity between FE +and BE and we get errors like this: + +[ 36.434566] sai1-wm8960-hifi: dpcm_be_connect: FE is atomic but BE +is nonatomic, invalid configuration +[ 36.444278] PCM Deep Buffer: ASoC: can't connect SAI1.OUT + +In order to fix this we must inherit the atomicity from DAI link +associated with current PCM Compress FE. + +Fixes: bbf7d3b1c4f4 ("ASoC: soc-pcm: align BE 'atomicity' with that of the FE") +Signed-off-by: Daniel Baluta +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20230324124019.30826-1-daniel.baluta@oss.nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-compress.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c +index e7aa6f360cabe..d649b0cf4744f 100644 +--- a/sound/soc/soc-compress.c ++++ b/sound/soc/soc-compress.c +@@ -622,6 +622,9 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) + return ret; + } + ++ /* inherit atomicity from DAI link */ ++ be_pcm->nonatomic = rtd->dai_link->nonatomic; ++ + rtd->pcm = be_pcm; + rtd->fe_compr = 1; + if (rtd->dai_link->dpcm_playback) +-- +2.39.2 + diff --git a/queue-6.2/blk-mq-don-t-plug-for-head-insertions-in-blk_execute.patch b/queue-6.2/blk-mq-don-t-plug-for-head-insertions-in-blk_execute.patch new file mode 100644 index 00000000000..be3b2ffd45b --- /dev/null +++ b/queue-6.2/blk-mq-don-t-plug-for-head-insertions-in-blk_execute.patch @@ -0,0 +1,38 @@ +From 2843592dba68b0406b8c1edd95943ed355a778d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 08:40:38 +0200 +Subject: blk-mq: don't plug for head insertions in blk_execute_rq_nowait + +From: Christoph Hellwig + +[ Upstream commit 50947d7fe9fa6abe3ddc40769dfb02a51c58edb6 ] + +Plugs never insert at head, so don't plug for head insertions. + +Fixes: 1c2d2fff6dc0 ("block: wire-up support for passthrough plugging") +Signed-off-by: Christoph Hellwig +Reviewed-by: Bart Van Assche +Reviewed-by: Damien Le Moal +Link: https://lore.kernel.org/r/20230413064057.707578-2-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 22d739cf8d326..9f1bafb62973d 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1345,7 +1345,7 @@ void blk_execute_rq_nowait(struct request *rq, bool at_head) + * device, directly accessing the plug instead of using blk_mq_plug() + * should not have any consequences. + */ +- if (current->plug) ++ if (current->plug && !at_head) + blk_add_rq_to_plug(current->plug, rq); + else + blk_mq_sched_insert_request(rq, at_head, true, false); +-- +2.39.2 + diff --git a/queue-6.2/bpf-add-__bpf_kfunc-tag-for-marking-kernel-functions.patch b/queue-6.2/bpf-add-__bpf_kfunc-tag-for-marking-kernel-functions.patch new file mode 100644 index 00000000000..d141fda6f55 --- /dev/null +++ b/queue-6.2/bpf-add-__bpf_kfunc-tag-for-marking-kernel-functions.patch @@ -0,0 +1,78 @@ +From 37f6226ab577b5fc03de352124e1533e5a5eb54b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 11:30:13 -0600 +Subject: bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs + +From: David Vernet + +[ Upstream commit 57e7c169cd6afa093d858b8edfb9bceaf2e1c93b ] + +kfuncs are functions defined in the kernel, which may be invoked by BPF +programs. They may or may not also be used as regular kernel functions, +implying that they may be static (in which case the compiler could e.g. +inline it away, or elide one or more arguments), or it could have +external linkage, but potentially be elided in an LTO build if a +function is observed to never be used, and is stripped from the final +kernel binary. + +This has already resulted in some issues, such as those discussed in [0] +wherein changes in DWARF that identify when a parameter has been +optimized out can break BTF encodings (and in general break the kfunc). + +[0]: https://lore.kernel.org/all/1675088985-20300-2-git-send-email-alan.maguire@oracle.com/ + +We therefore require some convenience macro that kfunc developers can +use just add to their kfuncs, and which will prevent all of the above +issues from happening. This is in contrast with what we have today, +where some kfunc definitions have "noinline", some have "__used", and +others are static and have neither. + +Note that longer term, this mechanism may be replaced by a macro that +more closely resembles EXPORT_SYMBOL_GPL(), as described in [1]. For +now, we're going with this shorter-term approach to fix existing issues +in kfuncs. + +[1]: https://lore.kernel.org/lkml/Y9AFT4pTydKh+PD3@maniforge.lan/ + +Note as well that checkpatch complains about this patch with the +following: + +ERROR: Macros with complex values should be enclosed in parentheses ++#define __bpf_kfunc __used noinline + +There seems to be a precedent for using this pattern in other places +such as compiler_types.h (see e.g. __randomize_layout and noinstr), so +it seems appropriate. + +Signed-off-by: David Vernet +Signed-off-by: Daniel Borkmann +Acked-by: Stanislav Fomichev +Link: https://lore.kernel.org/bpf/20230201173016.342758-2-void@manifault.com +Stable-dep-of: f6a6a5a97628 ("bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call") +Signed-off-by: Sasha Levin +--- + include/linux/btf.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/include/linux/btf.h b/include/linux/btf.h +index 5f628f323442a..ff62fa63dc197 100644 +--- a/include/linux/btf.h ++++ b/include/linux/btf.h +@@ -72,6 +72,14 @@ + #define KF_DESTRUCTIVE (1 << 6) /* kfunc performs destructive actions */ + #define KF_RCU (1 << 7) /* kfunc only takes rcu pointer arguments */ + ++/* ++ * Tag marking a kernel function as a kfunc. This is meant to minimize the ++ * amount of copy-paste that kfunc authors have to include for correctness so ++ * as to avoid issues such as the compiler inlining or eliding either a static ++ * kfunc, or a global kfunc in an LTO build. ++ */ ++#define __bpf_kfunc __used noinline ++ + /* + * Return the name of the passed struct, if exists, or halt the build if for + * example the structure gets renamed. In this way, developers have to revisit +-- +2.39.2 + diff --git a/queue-6.2/bpf-add-basic-bpf_rb_-root-node-support.patch b/queue-6.2/bpf-add-basic-bpf_rb_-root-node-support.patch new file mode 100644 index 00000000000..fe225083fbc --- /dev/null +++ b/queue-6.2/bpf-add-basic-bpf_rb_-root-node-support.patch @@ -0,0 +1,658 @@ +From 4ec0200b70dd18d43579378a264ce6664e45c84d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 16:40:10 -0800 +Subject: bpf: Add basic bpf_rb_{root,node} support + +From: Dave Marchevsky + +[ Upstream commit 9c395c1b99bd23f74bc628fa000480c49593d17f ] + +This patch adds special BPF_RB_{ROOT,NODE} btf_field_types similar to +BPF_LIST_{HEAD,NODE}, adds the necessary plumbing to detect the new +types, and adds bpf_rb_root_free function for freeing bpf_rb_root in +map_values. + +structs bpf_rb_root and bpf_rb_node are opaque types meant to +obscure structs rb_root_cached rb_node, respectively. + +btf_struct_access will prevent BPF programs from touching these special +fields automatically now that they're recognized. + +btf_check_and_fixup_fields now groups list_head and rb_root together as +"graph root" fields and {list,rb}_node as "graph node", and does same +ownership cycle checking as before. Note that this function does _not_ +prevent ownership type mixups (e.g. rb_root owning list_node) - that's +handled by btf_parse_graph_root. + +After this patch, a bpf program can have a struct bpf_rb_root in a +map_value, but not add anything to nor do anything useful with it. + +Signed-off-by: Dave Marchevsky +Link: https://lore.kernel.org/r/20230214004017.2534011-2-davemarchevsky@fb.com +Signed-off-by: Alexei Starovoitov +Stable-dep-of: f6a6a5a97628 ("bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call") +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 20 ++- + include/uapi/linux/bpf.h | 11 ++ + kernel/bpf/btf.c | 162 ++++++++++++------ + kernel/bpf/helpers.c | 40 +++++ + kernel/bpf/syscall.c | 28 ++- + kernel/bpf/verifier.c | 5 +- + tools/include/uapi/linux/bpf.h | 11 ++ + .../selftests/bpf/prog_tests/linked_list.c | 12 +- + 8 files changed, 216 insertions(+), 73 deletions(-) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 69b4b623ff06b..1c88f6761eea3 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -180,7 +180,10 @@ enum btf_field_type { + BPF_KPTR = BPF_KPTR_UNREF | BPF_KPTR_REF, + BPF_LIST_HEAD = (1 << 4), + BPF_LIST_NODE = (1 << 5), +- BPF_GRAPH_NODE_OR_ROOT = BPF_LIST_NODE | BPF_LIST_HEAD, ++ BPF_RB_ROOT = (1 << 6), ++ BPF_RB_NODE = (1 << 7), ++ BPF_GRAPH_NODE_OR_ROOT = BPF_LIST_NODE | BPF_LIST_HEAD | ++ BPF_RB_NODE | BPF_RB_ROOT, + }; + + struct btf_field_kptr { +@@ -284,6 +287,10 @@ static inline const char *btf_field_type_name(enum btf_field_type type) + return "bpf_list_head"; + case BPF_LIST_NODE: + return "bpf_list_node"; ++ case BPF_RB_ROOT: ++ return "bpf_rb_root"; ++ case BPF_RB_NODE: ++ return "bpf_rb_node"; + default: + WARN_ON_ONCE(1); + return "unknown"; +@@ -304,6 +311,10 @@ static inline u32 btf_field_type_size(enum btf_field_type type) + return sizeof(struct bpf_list_head); + case BPF_LIST_NODE: + return sizeof(struct bpf_list_node); ++ case BPF_RB_ROOT: ++ return sizeof(struct bpf_rb_root); ++ case BPF_RB_NODE: ++ return sizeof(struct bpf_rb_node); + default: + WARN_ON_ONCE(1); + return 0; +@@ -324,6 +335,10 @@ static inline u32 btf_field_type_align(enum btf_field_type type) + return __alignof__(struct bpf_list_head); + case BPF_LIST_NODE: + return __alignof__(struct bpf_list_node); ++ case BPF_RB_ROOT: ++ return __alignof__(struct bpf_rb_root); ++ case BPF_RB_NODE: ++ return __alignof__(struct bpf_rb_node); + default: + WARN_ON_ONCE(1); + return 0; +@@ -441,6 +456,9 @@ void copy_map_value_locked(struct bpf_map *map, void *dst, void *src, + void bpf_timer_cancel_and_free(void *timer); + void bpf_list_head_free(const struct btf_field *field, void *list_head, + struct bpf_spin_lock *spin_lock); ++void bpf_rb_root_free(const struct btf_field *field, void *rb_root, ++ struct bpf_spin_lock *spin_lock); ++ + + int bpf_obj_name_cpy(char *dst, const char *src, unsigned int size); + +diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h +index 464ca3f01fe7a..bd260134c4201 100644 +--- a/include/uapi/linux/bpf.h ++++ b/include/uapi/linux/bpf.h +@@ -6901,6 +6901,17 @@ struct bpf_list_node { + __u64 :64; + } __attribute__((aligned(8))); + ++struct bpf_rb_root { ++ __u64 :64; ++ __u64 :64; ++} __attribute__((aligned(8))); ++ ++struct bpf_rb_node { ++ __u64 :64; ++ __u64 :64; ++ __u64 :64; ++} __attribute__((aligned(8))); ++ + struct bpf_sysctl { + __u32 write; /* Sysctl is being read (= 0) or written (= 1). + * Allows 1,2,4-byte read, but no write. +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index b38b3335cd1e7..70ab572f81bc7 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -3305,12 +3305,14 @@ static const char *btf_find_decl_tag_value(const struct btf *btf, + return NULL; + } + +-static int btf_find_list_head(const struct btf *btf, const struct btf_type *pt, +- const struct btf_type *t, int comp_idx, +- u32 off, int sz, struct btf_field_info *info) ++static int ++btf_find_graph_root(const struct btf *btf, const struct btf_type *pt, ++ const struct btf_type *t, int comp_idx, u32 off, ++ int sz, struct btf_field_info *info, ++ enum btf_field_type head_type) + { ++ const char *node_field_name; + const char *value_type; +- const char *list_node; + s32 id; + + if (!__btf_type_is_struct(t)) +@@ -3320,26 +3322,32 @@ static int btf_find_list_head(const struct btf *btf, const struct btf_type *pt, + value_type = btf_find_decl_tag_value(btf, pt, comp_idx, "contains:"); + if (!value_type) + return -EINVAL; +- list_node = strstr(value_type, ":"); +- if (!list_node) ++ node_field_name = strstr(value_type, ":"); ++ if (!node_field_name) + return -EINVAL; +- value_type = kstrndup(value_type, list_node - value_type, GFP_KERNEL | __GFP_NOWARN); ++ value_type = kstrndup(value_type, node_field_name - value_type, GFP_KERNEL | __GFP_NOWARN); + if (!value_type) + return -ENOMEM; + id = btf_find_by_name_kind(btf, value_type, BTF_KIND_STRUCT); + kfree(value_type); + if (id < 0) + return id; +- list_node++; +- if (str_is_empty(list_node)) ++ node_field_name++; ++ if (str_is_empty(node_field_name)) + return -EINVAL; +- info->type = BPF_LIST_HEAD; ++ info->type = head_type; + info->off = off; + info->graph_root.value_btf_id = id; +- info->graph_root.node_name = list_node; ++ info->graph_root.node_name = node_field_name; + return BTF_FIELD_FOUND; + } + ++#define field_mask_test_name(field_type, field_type_str) \ ++ if (field_mask & field_type && !strcmp(name, field_type_str)) { \ ++ type = field_type; \ ++ goto end; \ ++ } ++ + static int btf_get_field_type(const char *name, u32 field_mask, u32 *seen_mask, + int *align, int *sz) + { +@@ -3363,18 +3371,11 @@ static int btf_get_field_type(const char *name, u32 field_mask, u32 *seen_mask, + goto end; + } + } +- if (field_mask & BPF_LIST_HEAD) { +- if (!strcmp(name, "bpf_list_head")) { +- type = BPF_LIST_HEAD; +- goto end; +- } +- } +- if (field_mask & BPF_LIST_NODE) { +- if (!strcmp(name, "bpf_list_node")) { +- type = BPF_LIST_NODE; +- goto end; +- } +- } ++ field_mask_test_name(BPF_LIST_HEAD, "bpf_list_head"); ++ field_mask_test_name(BPF_LIST_NODE, "bpf_list_node"); ++ field_mask_test_name(BPF_RB_ROOT, "bpf_rb_root"); ++ field_mask_test_name(BPF_RB_NODE, "bpf_rb_node"); ++ + /* Only return BPF_KPTR when all other types with matchable names fail */ + if (field_mask & BPF_KPTR) { + type = BPF_KPTR_REF; +@@ -3387,6 +3388,8 @@ static int btf_get_field_type(const char *name, u32 field_mask, u32 *seen_mask, + return type; + } + ++#undef field_mask_test_name ++ + static int btf_find_struct_field(const struct btf *btf, + const struct btf_type *t, u32 field_mask, + struct btf_field_info *info, int info_cnt) +@@ -3419,6 +3422,7 @@ static int btf_find_struct_field(const struct btf *btf, + case BPF_SPIN_LOCK: + case BPF_TIMER: + case BPF_LIST_NODE: ++ case BPF_RB_NODE: + ret = btf_find_struct(btf, member_type, off, sz, field_type, + idx < info_cnt ? &info[idx] : &tmp); + if (ret < 0) +@@ -3432,8 +3436,11 @@ static int btf_find_struct_field(const struct btf *btf, + return ret; + break; + case BPF_LIST_HEAD: +- ret = btf_find_list_head(btf, t, member_type, i, off, sz, +- idx < info_cnt ? &info[idx] : &tmp); ++ case BPF_RB_ROOT: ++ ret = btf_find_graph_root(btf, t, member_type, ++ i, off, sz, ++ idx < info_cnt ? &info[idx] : &tmp, ++ field_type); + if (ret < 0) + return ret; + break; +@@ -3480,6 +3487,7 @@ static int btf_find_datasec_var(const struct btf *btf, const struct btf_type *t, + case BPF_SPIN_LOCK: + case BPF_TIMER: + case BPF_LIST_NODE: ++ case BPF_RB_NODE: + ret = btf_find_struct(btf, var_type, off, sz, field_type, + idx < info_cnt ? &info[idx] : &tmp); + if (ret < 0) +@@ -3493,8 +3501,11 @@ static int btf_find_datasec_var(const struct btf *btf, const struct btf_type *t, + return ret; + break; + case BPF_LIST_HEAD: +- ret = btf_find_list_head(btf, var, var_type, -1, off, sz, +- idx < info_cnt ? &info[idx] : &tmp); ++ case BPF_RB_ROOT: ++ ret = btf_find_graph_root(btf, var, var_type, ++ -1, off, sz, ++ idx < info_cnt ? &info[idx] : &tmp, ++ field_type); + if (ret < 0) + return ret; + break; +@@ -3596,8 +3607,11 @@ static int btf_parse_kptr(const struct btf *btf, struct btf_field *field, + return ret; + } + +-static int btf_parse_list_head(const struct btf *btf, struct btf_field *field, +- struct btf_field_info *info) ++static int btf_parse_graph_root(const struct btf *btf, ++ struct btf_field *field, ++ struct btf_field_info *info, ++ const char *node_type_name, ++ size_t node_type_align) + { + const struct btf_type *t, *n = NULL; + const struct btf_member *member; +@@ -3619,13 +3633,13 @@ static int btf_parse_list_head(const struct btf *btf, struct btf_field *field, + n = btf_type_by_id(btf, member->type); + if (!__btf_type_is_struct(n)) + return -EINVAL; +- if (strcmp("bpf_list_node", __btf_name_by_offset(btf, n->name_off))) ++ if (strcmp(node_type_name, __btf_name_by_offset(btf, n->name_off))) + return -EINVAL; + offset = __btf_member_bit_offset(n, member); + if (offset % 8) + return -EINVAL; + offset /= 8; +- if (offset % __alignof__(struct bpf_list_node)) ++ if (offset % node_type_align) + return -EINVAL; + + field->graph_root.btf = (struct btf *)btf; +@@ -3637,6 +3651,20 @@ static int btf_parse_list_head(const struct btf *btf, struct btf_field *field, + return 0; + } + ++static int btf_parse_list_head(const struct btf *btf, struct btf_field *field, ++ struct btf_field_info *info) ++{ ++ return btf_parse_graph_root(btf, field, info, "bpf_list_node", ++ __alignof__(struct bpf_list_node)); ++} ++ ++static int btf_parse_rb_root(const struct btf *btf, struct btf_field *field, ++ struct btf_field_info *info) ++{ ++ return btf_parse_graph_root(btf, field, info, "bpf_rb_node", ++ __alignof__(struct bpf_rb_node)); ++} ++ + struct btf_record *btf_parse_fields(const struct btf *btf, const struct btf_type *t, + u32 field_mask, u32 value_size) + { +@@ -3699,7 +3727,13 @@ struct btf_record *btf_parse_fields(const struct btf *btf, const struct btf_type + if (ret < 0) + goto end; + break; ++ case BPF_RB_ROOT: ++ ret = btf_parse_rb_root(btf, &rec->fields[i], &info_arr[i]); ++ if (ret < 0) ++ goto end; ++ break; + case BPF_LIST_NODE: ++ case BPF_RB_NODE: + break; + default: + ret = -EFAULT; +@@ -3708,8 +3742,9 @@ struct btf_record *btf_parse_fields(const struct btf *btf, const struct btf_type + rec->cnt++; + } + +- /* bpf_list_head requires bpf_spin_lock */ +- if (btf_record_has_field(rec, BPF_LIST_HEAD) && rec->spin_lock_off < 0) { ++ /* bpf_{list_head, rb_node} require bpf_spin_lock */ ++ if ((btf_record_has_field(rec, BPF_LIST_HEAD) || ++ btf_record_has_field(rec, BPF_RB_ROOT)) && rec->spin_lock_off < 0) { + ret = -EINVAL; + goto end; + } +@@ -3720,22 +3755,28 @@ struct btf_record *btf_parse_fields(const struct btf *btf, const struct btf_type + return ERR_PTR(ret); + } + ++#define GRAPH_ROOT_MASK (BPF_LIST_HEAD | BPF_RB_ROOT) ++#define GRAPH_NODE_MASK (BPF_LIST_NODE | BPF_RB_NODE) ++ + int btf_check_and_fixup_fields(const struct btf *btf, struct btf_record *rec) + { + int i; + +- /* There are two owning types, kptr_ref and bpf_list_head. The former +- * only supports storing kernel types, which can never store references +- * to program allocated local types, atleast not yet. Hence we only need +- * to ensure that bpf_list_head ownership does not form cycles. ++ /* There are three types that signify ownership of some other type: ++ * kptr_ref, bpf_list_head, bpf_rb_root. ++ * kptr_ref only supports storing kernel types, which can't store ++ * references to program allocated local types. ++ * ++ * Hence we only need to ensure that bpf_{list_head,rb_root} ownership ++ * does not form cycles. + */ +- if (IS_ERR_OR_NULL(rec) || !(rec->field_mask & BPF_LIST_HEAD)) ++ if (IS_ERR_OR_NULL(rec) || !(rec->field_mask & GRAPH_ROOT_MASK)) + return 0; + for (i = 0; i < rec->cnt; i++) { + struct btf_struct_meta *meta; + u32 btf_id; + +- if (!(rec->fields[i].type & BPF_LIST_HEAD)) ++ if (!(rec->fields[i].type & GRAPH_ROOT_MASK)) + continue; + btf_id = rec->fields[i].graph_root.value_btf_id; + meta = btf_find_struct_meta(btf, btf_id); +@@ -3743,39 +3784,47 @@ int btf_check_and_fixup_fields(const struct btf *btf, struct btf_record *rec) + return -EFAULT; + rec->fields[i].graph_root.value_rec = meta->record; + +- if (!(rec->field_mask & BPF_LIST_NODE)) ++ /* We need to set value_rec for all root types, but no need ++ * to check ownership cycle for a type unless it's also a ++ * node type. ++ */ ++ if (!(rec->field_mask & GRAPH_NODE_MASK)) + continue; + + /* We need to ensure ownership acyclicity among all types. The + * proper way to do it would be to topologically sort all BTF + * IDs based on the ownership edges, since there can be multiple +- * bpf_list_head in a type. Instead, we use the following +- * reasoning: ++ * bpf_{list_head,rb_node} in a type. Instead, we use the ++ * following resaoning: + * + * - A type can only be owned by another type in user BTF if it +- * has a bpf_list_node. ++ * has a bpf_{list,rb}_node. Let's call these node types. + * - A type can only _own_ another type in user BTF if it has a +- * bpf_list_head. ++ * bpf_{list_head,rb_root}. Let's call these root types. + * +- * We ensure that if a type has both bpf_list_head and +- * bpf_list_node, its element types cannot be owning types. ++ * We ensure that if a type is both a root and node, its ++ * element types cannot be root types. + * + * To ensure acyclicity: + * +- * When A only has bpf_list_head, ownership chain can be: ++ * When A is an root type but not a node, its ownership ++ * chain can be: + * A -> B -> C + * Where: +- * - B has both bpf_list_head and bpf_list_node. +- * - C only has bpf_list_node. ++ * - A is an root, e.g. has bpf_rb_root. ++ * - B is both a root and node, e.g. has bpf_rb_node and ++ * bpf_list_head. ++ * - C is only an root, e.g. has bpf_list_node + * +- * When A has both bpf_list_head and bpf_list_node, some other +- * type already owns it in the BTF domain, hence it can not own +- * another owning type through any of the bpf_list_head edges. ++ * When A is both a root and node, some other type already ++ * owns it in the BTF domain, hence it can not own ++ * another root type through any of the ownership edges. + * A -> B + * Where: +- * - B only has bpf_list_node. ++ * - A is both an root and node. ++ * - B is only an node. + */ +- if (meta->record->field_mask & BPF_LIST_HEAD) ++ if (meta->record->field_mask & GRAPH_ROOT_MASK) + return -ELOOP; + } + return 0; +@@ -5238,6 +5287,8 @@ static const char *alloc_obj_fields[] = { + "bpf_spin_lock", + "bpf_list_head", + "bpf_list_node", ++ "bpf_rb_root", ++ "bpf_rb_node", + }; + + static struct btf_struct_metas * +@@ -5311,7 +5362,8 @@ btf_parse_struct_metas(struct bpf_verifier_log *log, struct btf *btf) + + type = &tab->types[tab->cnt]; + type->btf_id = i; +- record = btf_parse_fields(btf, t, BPF_SPIN_LOCK | BPF_LIST_HEAD | BPF_LIST_NODE, t->size); ++ record = btf_parse_fields(btf, t, BPF_SPIN_LOCK | BPF_LIST_HEAD | BPF_LIST_NODE | ++ BPF_RB_ROOT | BPF_RB_NODE, t->size); + /* The record cannot be unset, treat it as an error if so */ + if (IS_ERR_OR_NULL(record)) { + ret = PTR_ERR_OR_ZERO(record) ?: -EFAULT; +diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c +index 527040ffead41..92a57cc106656 100644 +--- a/kernel/bpf/helpers.c ++++ b/kernel/bpf/helpers.c +@@ -1761,6 +1761,46 @@ void bpf_list_head_free(const struct btf_field *field, void *list_head, + } + } + ++/* Like rbtree_postorder_for_each_entry_safe, but 'pos' and 'n' are ++ * 'rb_node *', so field name of rb_node within containing struct is not ++ * needed. ++ * ++ * Since bpf_rb_tree's node type has a corresponding struct btf_field with ++ * graph_root.node_offset, it's not necessary to know field name ++ * or type of node struct ++ */ ++#define bpf_rbtree_postorder_for_each_entry_safe(pos, n, root) \ ++ for (pos = rb_first_postorder(root); \ ++ pos && ({ n = rb_next_postorder(pos); 1; }); \ ++ pos = n) ++ ++void bpf_rb_root_free(const struct btf_field *field, void *rb_root, ++ struct bpf_spin_lock *spin_lock) ++{ ++ struct rb_root_cached orig_root, *root = rb_root; ++ struct rb_node *pos, *n; ++ void *obj; ++ ++ BUILD_BUG_ON(sizeof(struct rb_root_cached) > sizeof(struct bpf_rb_root)); ++ BUILD_BUG_ON(__alignof__(struct rb_root_cached) > __alignof__(struct bpf_rb_root)); ++ ++ __bpf_spin_lock_irqsave(spin_lock); ++ orig_root = *root; ++ *root = RB_ROOT_CACHED; ++ __bpf_spin_unlock_irqrestore(spin_lock); ++ ++ bpf_rbtree_postorder_for_each_entry_safe(pos, n, &orig_root.rb_root) { ++ obj = pos; ++ obj -= field->graph_root.node_offset; ++ ++ bpf_obj_free_fields(field->graph_root.value_rec, obj); ++ ++ migrate_disable(); ++ bpf_mem_free(&bpf_global_ma, obj); ++ migrate_enable(); ++ } ++} ++ + __diag_push(); + __diag_ignore_all("-Wmissing-prototypes", + "Global functions as their definitions will be in vmlinux BTF"); +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index ecca9366c7a6f..011983b39472f 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -527,9 +527,6 @@ void btf_record_free(struct btf_record *rec) + return; + for (i = 0; i < rec->cnt; i++) { + switch (rec->fields[i].type) { +- case BPF_SPIN_LOCK: +- case BPF_TIMER: +- break; + case BPF_KPTR_UNREF: + case BPF_KPTR_REF: + if (rec->fields[i].kptr.module) +@@ -538,7 +535,11 @@ void btf_record_free(struct btf_record *rec) + break; + case BPF_LIST_HEAD: + case BPF_LIST_NODE: +- /* Nothing to release for bpf_list_head */ ++ case BPF_RB_ROOT: ++ case BPF_RB_NODE: ++ case BPF_SPIN_LOCK: ++ case BPF_TIMER: ++ /* Nothing to release */ + break; + default: + WARN_ON_ONCE(1); +@@ -571,9 +572,6 @@ struct btf_record *btf_record_dup(const struct btf_record *rec) + new_rec->cnt = 0; + for (i = 0; i < rec->cnt; i++) { + switch (fields[i].type) { +- case BPF_SPIN_LOCK: +- case BPF_TIMER: +- break; + case BPF_KPTR_UNREF: + case BPF_KPTR_REF: + btf_get(fields[i].kptr.btf); +@@ -584,7 +582,11 @@ struct btf_record *btf_record_dup(const struct btf_record *rec) + break; + case BPF_LIST_HEAD: + case BPF_LIST_NODE: +- /* Nothing to acquire for bpf_list_head */ ++ case BPF_RB_ROOT: ++ case BPF_RB_NODE: ++ case BPF_SPIN_LOCK: ++ case BPF_TIMER: ++ /* Nothing to acquire */ + break; + default: + ret = -EFAULT; +@@ -664,7 +666,13 @@ void bpf_obj_free_fields(const struct btf_record *rec, void *obj) + continue; + bpf_list_head_free(field, field_ptr, obj + rec->spin_lock_off); + break; ++ case BPF_RB_ROOT: ++ if (WARN_ON_ONCE(rec->spin_lock_off < 0)) ++ continue; ++ bpf_rb_root_free(field, field_ptr, obj + rec->spin_lock_off); ++ break; + case BPF_LIST_NODE: ++ case BPF_RB_NODE: + break; + default: + WARN_ON_ONCE(1); +@@ -1005,7 +1013,8 @@ static int map_check_btf(struct bpf_map *map, const struct btf *btf, + return -EINVAL; + + map->record = btf_parse_fields(btf, value_type, +- BPF_SPIN_LOCK | BPF_TIMER | BPF_KPTR | BPF_LIST_HEAD, ++ BPF_SPIN_LOCK | BPF_TIMER | BPF_KPTR | BPF_LIST_HEAD | ++ BPF_RB_ROOT, + map->value_size); + if (!IS_ERR_OR_NULL(map->record)) { + int i; +@@ -1053,6 +1062,7 @@ static int map_check_btf(struct bpf_map *map, const struct btf *btf, + } + break; + case BPF_LIST_HEAD: ++ case BPF_RB_ROOT: + if (map->map_type != BPF_MAP_TYPE_HASH && + map->map_type != BPF_MAP_TYPE_LRU_HASH && + map->map_type != BPF_MAP_TYPE_ARRAY) { +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index d7c2c048807c0..975f30e4f8612 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -14583,9 +14583,10 @@ static int check_map_prog_compatibility(struct bpf_verifier_env *env, + { + enum bpf_prog_type prog_type = resolve_prog_type(prog); + +- if (btf_record_has_field(map->record, BPF_LIST_HEAD)) { ++ if (btf_record_has_field(map->record, BPF_LIST_HEAD) || ++ btf_record_has_field(map->record, BPF_RB_ROOT)) { + if (is_tracing_prog_type(prog_type)) { +- verbose(env, "tracing progs cannot use bpf_list_head yet\n"); ++ verbose(env, "tracing progs cannot use bpf_{list_head,rb_root} yet\n"); + return -EINVAL; + } + } +diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h +index 464ca3f01fe7a..bd260134c4201 100644 +--- a/tools/include/uapi/linux/bpf.h ++++ b/tools/include/uapi/linux/bpf.h +@@ -6901,6 +6901,17 @@ struct bpf_list_node { + __u64 :64; + } __attribute__((aligned(8))); + ++struct bpf_rb_root { ++ __u64 :64; ++ __u64 :64; ++} __attribute__((aligned(8))); ++ ++struct bpf_rb_node { ++ __u64 :64; ++ __u64 :64; ++ __u64 :64; ++} __attribute__((aligned(8))); ++ + struct bpf_sysctl { + __u32 write; /* Sysctl is being read (= 0) or written (= 1). + * Allows 1,2,4-byte read, but no write. +diff --git a/tools/testing/selftests/bpf/prog_tests/linked_list.c b/tools/testing/selftests/bpf/prog_tests/linked_list.c +index 2592b8aa5e41a..c456b34a823ac 100644 +--- a/tools/testing/selftests/bpf/prog_tests/linked_list.c ++++ b/tools/testing/selftests/bpf/prog_tests/linked_list.c +@@ -58,12 +58,12 @@ static struct { + TEST(inner_map, pop_front) + TEST(inner_map, pop_back) + #undef TEST +- { "map_compat_kprobe", "tracing progs cannot use bpf_list_head yet" }, +- { "map_compat_kretprobe", "tracing progs cannot use bpf_list_head yet" }, +- { "map_compat_tp", "tracing progs cannot use bpf_list_head yet" }, +- { "map_compat_perf", "tracing progs cannot use bpf_list_head yet" }, +- { "map_compat_raw_tp", "tracing progs cannot use bpf_list_head yet" }, +- { "map_compat_raw_tp_w", "tracing progs cannot use bpf_list_head yet" }, ++ { "map_compat_kprobe", "tracing progs cannot use bpf_{list_head,rb_root} yet" }, ++ { "map_compat_kretprobe", "tracing progs cannot use bpf_{list_head,rb_root} yet" }, ++ { "map_compat_tp", "tracing progs cannot use bpf_{list_head,rb_root} yet" }, ++ { "map_compat_perf", "tracing progs cannot use bpf_{list_head,rb_root} yet" }, ++ { "map_compat_raw_tp", "tracing progs cannot use bpf_{list_head,rb_root} yet" }, ++ { "map_compat_raw_tp_w", "tracing progs cannot use bpf_{list_head,rb_root} yet" }, + { "obj_type_id_oor", "local type ID argument must be in range [0, U32_MAX]" }, + { "obj_new_no_composite", "bpf_obj_new type ID argument must be of a struct" }, + { "obj_new_no_struct", "bpf_obj_new type ID argument must be of a struct" }, +-- +2.39.2 + diff --git a/queue-6.2/bpf-add-bpf_rbtree_-add-remove-first-kfuncs.patch b/queue-6.2/bpf-add-bpf_rbtree_-add-remove-first-kfuncs.patch new file mode 100644 index 00000000000..8fc9827fe2c --- /dev/null +++ b/queue-6.2/bpf-add-bpf_rbtree_-add-remove-first-kfuncs.patch @@ -0,0 +1,165 @@ +From dfdd86688831ba19ff66d8ba8edf10440a9e7a4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 16:40:11 -0800 +Subject: bpf: Add bpf_rbtree_{add,remove,first} kfuncs + +From: Dave Marchevsky + +[ Upstream commit bd1279ae8a691d7ec75852c6d0a22139afb034a4 ] + +This patch adds implementations of bpf_rbtree_{add,remove,first} +and teaches verifier about their BTF_IDs as well as those of +bpf_rb_{root,node}. + +All three kfuncs have some nonstandard component to their verification +that needs to be addressed in future patches before programs can +properly use them: + + * bpf_rbtree_add: Takes 'less' callback, need to verify it + + * bpf_rbtree_first: Returns ptr_to_node_type(off=rb_node_off) instead + of ptr_to_rb_node(off=0). Return value ref is + non-owning. + + * bpf_rbtree_remove: Returns ptr_to_node_type(off=rb_node_off) instead + of ptr_to_rb_node(off=0). 2nd arg (node) is a + non-owning reference. + +Signed-off-by: Dave Marchevsky +Link: https://lore.kernel.org/r/20230214004017.2534011-3-davemarchevsky@fb.com +Signed-off-by: Alexei Starovoitov +Stable-dep-of: f6a6a5a97628 ("bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call") +Signed-off-by: Sasha Levin +--- + kernel/bpf/helpers.c | 54 +++++++++++++++++++++++++++++++++++++++++++ + kernel/bpf/verifier.c | 14 ++++++++++- + 2 files changed, 67 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c +index 92a57cc106656..5b692a5f2946b 100644 +--- a/kernel/bpf/helpers.c ++++ b/kernel/bpf/helpers.c +@@ -1873,6 +1873,56 @@ struct bpf_list_node *bpf_list_pop_back(struct bpf_list_head *head) + return __bpf_list_del(head, true); + } + ++__bpf_kfunc struct bpf_rb_node *bpf_rbtree_remove(struct bpf_rb_root *root, ++ struct bpf_rb_node *node) ++{ ++ struct rb_root_cached *r = (struct rb_root_cached *)root; ++ struct rb_node *n = (struct rb_node *)node; ++ ++ rb_erase_cached(n, r); ++ RB_CLEAR_NODE(n); ++ return (struct bpf_rb_node *)n; ++} ++ ++/* Need to copy rbtree_add_cached's logic here because our 'less' is a BPF ++ * program ++ */ ++static void __bpf_rbtree_add(struct bpf_rb_root *root, struct bpf_rb_node *node, ++ void *less) ++{ ++ struct rb_node **link = &((struct rb_root_cached *)root)->rb_root.rb_node; ++ bpf_callback_t cb = (bpf_callback_t)less; ++ struct rb_node *parent = NULL; ++ bool leftmost = true; ++ ++ while (*link) { ++ parent = *link; ++ if (cb((uintptr_t)node, (uintptr_t)parent, 0, 0, 0)) { ++ link = &parent->rb_left; ++ } else { ++ link = &parent->rb_right; ++ leftmost = false; ++ } ++ } ++ ++ rb_link_node((struct rb_node *)node, parent, link); ++ rb_insert_color_cached((struct rb_node *)node, ++ (struct rb_root_cached *)root, leftmost); ++} ++ ++__bpf_kfunc void bpf_rbtree_add(struct bpf_rb_root *root, struct bpf_rb_node *node, ++ bool (less)(struct bpf_rb_node *a, const struct bpf_rb_node *b)) ++{ ++ __bpf_rbtree_add(root, node, (void *)less); ++} ++ ++__bpf_kfunc struct bpf_rb_node *bpf_rbtree_first(struct bpf_rb_root *root) ++{ ++ struct rb_root_cached *r = (struct rb_root_cached *)root; ++ ++ return (struct bpf_rb_node *)rb_first_cached(r); ++} ++ + /** + * bpf_task_acquire - Acquire a reference to a task. A task acquired by this + * kfunc which is not stored in a map as a kptr, must be released by calling +@@ -2097,6 +2147,10 @@ BTF_ID_FLAGS(func, bpf_task_acquire, KF_ACQUIRE | KF_TRUSTED_ARGS) + BTF_ID_FLAGS(func, bpf_task_acquire_not_zero, KF_ACQUIRE | KF_RCU | KF_RET_NULL) + BTF_ID_FLAGS(func, bpf_task_kptr_get, KF_ACQUIRE | KF_KPTR_GET | KF_RET_NULL) + BTF_ID_FLAGS(func, bpf_task_release, KF_RELEASE) ++BTF_ID_FLAGS(func, bpf_rbtree_remove, KF_ACQUIRE) ++BTF_ID_FLAGS(func, bpf_rbtree_add) ++BTF_ID_FLAGS(func, bpf_rbtree_first, KF_RET_NULL) ++ + #ifdef CONFIG_CGROUPS + BTF_ID_FLAGS(func, bpf_cgroup_acquire, KF_ACQUIRE | KF_TRUSTED_ARGS) + BTF_ID_FLAGS(func, bpf_cgroup_kptr_get, KF_ACQUIRE | KF_KPTR_GET | KF_RET_NULL) +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 975f30e4f8612..2997869917613 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -8555,6 +8555,8 @@ BTF_ID_LIST(kf_arg_btf_ids) + BTF_ID(struct, bpf_dynptr_kern) + BTF_ID(struct, bpf_list_head) + BTF_ID(struct, bpf_list_node) ++BTF_ID(struct, bpf_rb_root) ++BTF_ID(struct, bpf_rb_node) + + static bool __is_kfunc_ptr_arg_type(const struct btf *btf, + const struct btf_param *arg, int type) +@@ -8660,6 +8662,9 @@ enum special_kfunc_type { + KF_bpf_rdonly_cast, + KF_bpf_rcu_read_lock, + KF_bpf_rcu_read_unlock, ++ KF_bpf_rbtree_remove, ++ KF_bpf_rbtree_add, ++ KF_bpf_rbtree_first, + }; + + BTF_SET_START(special_kfunc_set) +@@ -8671,6 +8676,9 @@ BTF_ID(func, bpf_list_pop_front) + BTF_ID(func, bpf_list_pop_back) + BTF_ID(func, bpf_cast_to_kern_ctx) + BTF_ID(func, bpf_rdonly_cast) ++BTF_ID(func, bpf_rbtree_remove) ++BTF_ID(func, bpf_rbtree_add) ++BTF_ID(func, bpf_rbtree_first) + BTF_SET_END(special_kfunc_set) + + BTF_ID_LIST(special_kfunc_list) +@@ -8684,6 +8692,9 @@ BTF_ID(func, bpf_cast_to_kern_ctx) + BTF_ID(func, bpf_rdonly_cast) + BTF_ID(func, bpf_rcu_read_lock) + BTF_ID(func, bpf_rcu_read_unlock) ++BTF_ID(func, bpf_rbtree_remove) ++BTF_ID(func, bpf_rbtree_add) ++BTF_ID(func, bpf_rbtree_first) + + static bool is_kfunc_bpf_rcu_read_lock(struct bpf_kfunc_call_arg_meta *meta) + { +@@ -9439,7 +9450,8 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + } + + if (meta.func_id == special_kfunc_list[KF_bpf_list_push_front] || +- meta.func_id == special_kfunc_list[KF_bpf_list_push_back]) { ++ meta.func_id == special_kfunc_list[KF_bpf_list_push_back] || ++ meta.func_id == special_kfunc_list[KF_bpf_rbtree_add]) { + release_ref_obj_id = regs[BPF_REG_2].ref_obj_id; + err = ref_convert_owning_non_owning(env, release_ref_obj_id); + if (err) { +-- +2.39.2 + diff --git a/queue-6.2/bpf-add-callback-validation-to-kfunc-verifier-logic.patch b/queue-6.2/bpf-add-callback-validation-to-kfunc-verifier-logic.patch new file mode 100644 index 00000000000..f137eb33cf6 --- /dev/null +++ b/queue-6.2/bpf-add-callback-validation-to-kfunc-verifier-logic.patch @@ -0,0 +1,292 @@ +From 9f90495b901f390fa44baeb906532aeb75ba9843 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 16:40:13 -0800 +Subject: bpf: Add callback validation to kfunc verifier logic + +From: Dave Marchevsky + +[ Upstream commit 5d92ddc3de1b44a82108af68ed71f638ca20509a ] + +Some BPF helpers take a callback function which the helper calls. For +each helper that takes such a callback, there's a special call to +__check_func_call with a callback-state-setting callback that sets up +verifier bpf_func_state for the callback's frame. + +kfuncs don't have any of this infrastructure yet, so let's add it in +this patch, following existing helper pattern as much as possible. To +validate functionality of this added plumbing, this patch adds +callback handling for the bpf_rbtree_add kfunc and hopes to lay +groundwork for future graph datastructure callbacks. + +In the "general plumbing" category we have: + + * check_kfunc_call doing callback verification right before clearing + CALLER_SAVED_REGS, exactly like check_helper_call + * recognition of func_ptr BTF types in kfunc args as + KF_ARG_PTR_TO_CALLBACK + propagation of subprogno for this arg type + +In the "rbtree_add / graph datastructure-specific plumbing" category: + + * Since bpf_rbtree_add must be called while the spin_lock associated + with the tree is held, don't complain when callback's func_state + doesn't unlock it by frame exit + * Mark rbtree_add callback's args with ref_set_non_owning + to prevent rbtree api functions from being called in the callback. + Semantically this makes sense, as less() takes no ownership of its + args when determining which comes first. + +Signed-off-by: Dave Marchevsky +Link: https://lore.kernel.org/r/20230214004017.2534011-5-davemarchevsky@fb.com +Signed-off-by: Alexei Starovoitov +Stable-dep-of: f6a6a5a97628 ("bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call") +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 134 ++++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 129 insertions(+), 5 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 3bb38cb9c604f..3fa2b177ab624 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -191,6 +191,7 @@ struct bpf_verifier_stack_elem { + static int acquire_reference_state(struct bpf_verifier_env *env, int insn_idx); + static int release_reference(struct bpf_verifier_env *env, int ref_obj_id); + static void invalidate_non_owning_refs(struct bpf_verifier_env *env); ++static bool in_rbtree_lock_required_cb(struct bpf_verifier_env *env); + static int ref_set_non_owning(struct bpf_verifier_env *env, + struct bpf_reg_state *reg); + +@@ -1609,6 +1610,16 @@ static void mark_ptr_not_null_reg(struct bpf_reg_state *reg) + reg->type &= ~PTR_MAYBE_NULL; + } + ++static void mark_reg_graph_node(struct bpf_reg_state *regs, u32 regno, ++ struct btf_field_graph_root *ds_head) ++{ ++ __mark_reg_known_zero(®s[regno]); ++ regs[regno].type = PTR_TO_BTF_ID | MEM_ALLOC; ++ regs[regno].btf = ds_head->btf; ++ regs[regno].btf_id = ds_head->value_btf_id; ++ regs[regno].off = ds_head->node_offset; ++} ++ + static bool reg_is_pkt_pointer(const struct bpf_reg_state *reg) + { + return type_is_pkt_pointer(reg->type); +@@ -6771,6 +6782,10 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, + meta->ret_btf_id = reg->btf_id; + break; + case ARG_PTR_TO_SPIN_LOCK: ++ if (in_rbtree_lock_required_cb(env)) { ++ verbose(env, "can't spin_{lock,unlock} in rbtree cb\n"); ++ return -EACCES; ++ } + if (meta->func_id == BPF_FUNC_spin_lock) { + err = process_spin_lock(env, regno, true); + if (err) +@@ -7354,6 +7369,8 @@ static int set_callee_state(struct bpf_verifier_env *env, + struct bpf_func_state *caller, + struct bpf_func_state *callee, int insn_idx); + ++static bool is_callback_calling_kfunc(u32 btf_id); ++ + static int __check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + int *insn_idx, int subprog, + set_callee_state_fn set_callee_state_cb) +@@ -7408,10 +7425,18 @@ static int __check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn + * interested in validating only BPF helpers that can call subprogs as + * callbacks + */ +- if (set_callee_state_cb != set_callee_state && !is_callback_calling_function(insn->imm)) { +- verbose(env, "verifier bug: helper %s#%d is not marked as callback-calling\n", +- func_id_name(insn->imm), insn->imm); +- return -EFAULT; ++ if (set_callee_state_cb != set_callee_state) { ++ if (bpf_pseudo_kfunc_call(insn) && ++ !is_callback_calling_kfunc(insn->imm)) { ++ verbose(env, "verifier bug: kfunc %s#%d not marked as callback-calling\n", ++ func_id_name(insn->imm), insn->imm); ++ return -EFAULT; ++ } else if (!bpf_pseudo_kfunc_call(insn) && ++ !is_callback_calling_function(insn->imm)) { /* helper */ ++ verbose(env, "verifier bug: helper %s#%d not marked as callback-calling\n", ++ func_id_name(insn->imm), insn->imm); ++ return -EFAULT; ++ } + } + + if (insn->code == (BPF_JMP | BPF_CALL) && +@@ -7676,6 +7701,63 @@ static int set_user_ringbuf_callback_state(struct bpf_verifier_env *env, + return 0; + } + ++static int set_rbtree_add_callback_state(struct bpf_verifier_env *env, ++ struct bpf_func_state *caller, ++ struct bpf_func_state *callee, ++ int insn_idx) ++{ ++ /* void bpf_rbtree_add(struct bpf_rb_root *root, struct bpf_rb_node *node, ++ * bool (less)(struct bpf_rb_node *a, const struct bpf_rb_node *b)); ++ * ++ * 'struct bpf_rb_node *node' arg to bpf_rbtree_add is the same PTR_TO_BTF_ID w/ offset ++ * that 'less' callback args will be receiving. However, 'node' arg was release_reference'd ++ * by this point, so look at 'root' ++ */ ++ struct btf_field *field; ++ ++ field = reg_find_field_offset(&caller->regs[BPF_REG_1], caller->regs[BPF_REG_1].off, ++ BPF_RB_ROOT); ++ if (!field || !field->graph_root.value_btf_id) ++ return -EFAULT; ++ ++ mark_reg_graph_node(callee->regs, BPF_REG_1, &field->graph_root); ++ ref_set_non_owning(env, &callee->regs[BPF_REG_1]); ++ mark_reg_graph_node(callee->regs, BPF_REG_2, &field->graph_root); ++ ref_set_non_owning(env, &callee->regs[BPF_REG_2]); ++ ++ __mark_reg_not_init(env, &callee->regs[BPF_REG_3]); ++ __mark_reg_not_init(env, &callee->regs[BPF_REG_4]); ++ __mark_reg_not_init(env, &callee->regs[BPF_REG_5]); ++ callee->in_callback_fn = true; ++ callee->callback_ret_range = tnum_range(0, 1); ++ return 0; ++} ++ ++static bool is_rbtree_lock_required_kfunc(u32 btf_id); ++ ++/* Are we currently verifying the callback for a rbtree helper that must ++ * be called with lock held? If so, no need to complain about unreleased ++ * lock ++ */ ++static bool in_rbtree_lock_required_cb(struct bpf_verifier_env *env) ++{ ++ struct bpf_verifier_state *state = env->cur_state; ++ struct bpf_insn *insn = env->prog->insnsi; ++ struct bpf_func_state *callee; ++ int kfunc_btf_id; ++ ++ if (!state->curframe) ++ return false; ++ ++ callee = state->frame[state->curframe]; ++ ++ if (!callee->in_callback_fn) ++ return false; ++ ++ kfunc_btf_id = insn[callee->callsite].imm; ++ return is_rbtree_lock_required_kfunc(kfunc_btf_id); ++} ++ + static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx) + { + struct bpf_verifier_state *state = env->cur_state; +@@ -8427,6 +8509,7 @@ struct bpf_kfunc_call_arg_meta { + bool r0_rdonly; + u32 ret_btf_id; + u64 r0_size; ++ u32 subprogno; + struct { + u64 value; + bool found; +@@ -8605,6 +8688,18 @@ static bool is_kfunc_arg_rbtree_node(const struct btf *btf, const struct btf_par + return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_RB_NODE_ID); + } + ++static bool is_kfunc_arg_callback(struct bpf_verifier_env *env, const struct btf *btf, ++ const struct btf_param *arg) ++{ ++ const struct btf_type *t; ++ ++ t = btf_type_resolve_func_ptr(btf, arg->type, NULL); ++ if (!t) ++ return false; ++ ++ return true; ++} ++ + /* Returns true if struct is composed of scalars, 4 levels of nesting allowed */ + static bool __btf_type_is_scalar_struct(struct bpf_verifier_env *env, + const struct btf *btf, +@@ -8664,6 +8759,7 @@ enum kfunc_ptr_arg_type { + KF_ARG_PTR_TO_BTF_ID, /* Also covers reg2btf_ids conversions */ + KF_ARG_PTR_TO_MEM, + KF_ARG_PTR_TO_MEM_SIZE, /* Size derived from next argument, skip it */ ++ KF_ARG_PTR_TO_CALLBACK, + KF_ARG_PTR_TO_RB_ROOT, + KF_ARG_PTR_TO_RB_NODE, + }; +@@ -8788,6 +8884,9 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *env, + return KF_ARG_PTR_TO_BTF_ID; + } + ++ if (is_kfunc_arg_callback(env, meta->btf, &args[argno])) ++ return KF_ARG_PTR_TO_CALLBACK; ++ + if (argno + 1 < nargs && is_kfunc_arg_mem_size(meta->btf, &args[argno + 1], ®s[regno + 1])) + arg_mem_size = true; + +@@ -9019,6 +9118,16 @@ static bool is_bpf_graph_api_kfunc(u32 btf_id) + return is_bpf_list_api_kfunc(btf_id) || is_bpf_rbtree_api_kfunc(btf_id); + } + ++static bool is_callback_calling_kfunc(u32 btf_id) ++{ ++ return btf_id == special_kfunc_list[KF_bpf_rbtree_add]; ++} ++ ++static bool is_rbtree_lock_required_kfunc(u32 btf_id) ++{ ++ return is_bpf_rbtree_api_kfunc(btf_id); ++} ++ + static bool check_kfunc_is_graph_root_api(struct bpf_verifier_env *env, + enum btf_field_type head_field_type, + u32 kfunc_btf_id) +@@ -9351,6 +9460,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ + case KF_ARG_PTR_TO_RB_NODE: + case KF_ARG_PTR_TO_MEM: + case KF_ARG_PTR_TO_MEM_SIZE: ++ case KF_ARG_PTR_TO_CALLBACK: + /* Trusted by default */ + break; + default: +@@ -9502,6 +9612,9 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ + /* Skip next '__sz' argument */ + i++; + break; ++ case KF_ARG_PTR_TO_CALLBACK: ++ meta->subprogno = reg->subprogno; ++ break; + } + } + +@@ -9636,6 +9749,16 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + } + } + ++ if (meta.func_id == special_kfunc_list[KF_bpf_rbtree_add]) { ++ err = __check_func_call(env, insn, insn_idx_p, meta.subprogno, ++ set_rbtree_add_callback_state); ++ if (err) { ++ verbose(env, "kfunc %s#%d failed callback verification\n", ++ func_name, func_id); ++ return err; ++ } ++ } ++ + for (i = 0; i < CALLER_SAVED_REGS; i++) + mark_reg_not_init(env, regs, caller_saved[i]); + +@@ -14501,7 +14624,8 @@ static int do_check(struct bpf_verifier_env *env) + return -EINVAL; + } + +- if (env->cur_state->active_lock.ptr) { ++ if (env->cur_state->active_lock.ptr && ++ !in_rbtree_lock_required_cb(env)) { + verbose(env, "bpf_spin_unlock is missing\n"); + return -EINVAL; + } +-- +2.39.2 + diff --git a/queue-6.2/bpf-add-support-for-bpf_rb_root-and-bpf_rb_node-in-k.patch b/queue-6.2/bpf-add-support-for-bpf_rb_root-and-bpf_rb_node-in-k.patch new file mode 100644 index 00000000000..e7f116a4a32 --- /dev/null +++ b/queue-6.2/bpf-add-support-for-bpf_rb_root-and-bpf_rb_node-in-k.patch @@ -0,0 +1,403 @@ +From 1e3916cce707fb33eeeb02d086bd57691765aa8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 16:40:12 -0800 +Subject: bpf: Add support for bpf_rb_root and bpf_rb_node in kfunc args + +From: Dave Marchevsky + +[ Upstream commit cd6791b4b6f66f6b7925c840efe5c8fa0ce1ac87 ] + +Now that we find bpf_rb_root and bpf_rb_node in structs, let's give args +that contain those types special classification and properly handle +these types when checking kfunc args. + +"Properly handling" these types largely requires generalizing similar +handling for bpf_list_{head,node}, with little new logic added in this +patch. + +Signed-off-by: Dave Marchevsky +Link: https://lore.kernel.org/r/20230214004017.2534011-4-davemarchevsky@fb.com +Signed-off-by: Alexei Starovoitov +Stable-dep-of: f6a6a5a97628 ("bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call") +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 238 +++++++++++++++++++++++++++++++++++------- + 1 file changed, 203 insertions(+), 35 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 2997869917613..3bb38cb9c604f 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -8438,6 +8438,9 @@ struct bpf_kfunc_call_arg_meta { + struct { + struct btf_field *field; + } arg_list_head; ++ struct { ++ struct btf_field *field; ++ } arg_rbtree_root; + }; + + static bool is_kfunc_acquire(struct bpf_kfunc_call_arg_meta *meta) +@@ -8549,6 +8552,8 @@ enum { + KF_ARG_DYNPTR_ID, + KF_ARG_LIST_HEAD_ID, + KF_ARG_LIST_NODE_ID, ++ KF_ARG_RB_ROOT_ID, ++ KF_ARG_RB_NODE_ID, + }; + + BTF_ID_LIST(kf_arg_btf_ids) +@@ -8590,6 +8595,16 @@ static bool is_kfunc_arg_list_node(const struct btf *btf, const struct btf_param + return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_LIST_NODE_ID); + } + ++static bool is_kfunc_arg_rbtree_root(const struct btf *btf, const struct btf_param *arg) ++{ ++ return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_RB_ROOT_ID); ++} ++ ++static bool is_kfunc_arg_rbtree_node(const struct btf *btf, const struct btf_param *arg) ++{ ++ return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_RB_NODE_ID); ++} ++ + /* Returns true if struct is composed of scalars, 4 levels of nesting allowed */ + static bool __btf_type_is_scalar_struct(struct bpf_verifier_env *env, + const struct btf *btf, +@@ -8649,6 +8664,8 @@ enum kfunc_ptr_arg_type { + KF_ARG_PTR_TO_BTF_ID, /* Also covers reg2btf_ids conversions */ + KF_ARG_PTR_TO_MEM, + KF_ARG_PTR_TO_MEM_SIZE, /* Size derived from next argument, skip it */ ++ KF_ARG_PTR_TO_RB_ROOT, ++ KF_ARG_PTR_TO_RB_NODE, + }; + + enum special_kfunc_type { +@@ -8756,6 +8773,12 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *env, + if (is_kfunc_arg_list_node(meta->btf, &args[argno])) + return KF_ARG_PTR_TO_LIST_NODE; + ++ if (is_kfunc_arg_rbtree_root(meta->btf, &args[argno])) ++ return KF_ARG_PTR_TO_RB_ROOT; ++ ++ if (is_kfunc_arg_rbtree_node(meta->btf, &args[argno])) ++ return KF_ARG_PTR_TO_RB_NODE; ++ + if ((base_type(reg->type) == PTR_TO_BTF_ID || reg2btf_ids[base_type(reg->type)])) { + if (!btf_type_is_struct(ref_t)) { + verbose(env, "kernel function %s args#%d pointer type %s %s is not supported\n", +@@ -8984,95 +9007,193 @@ static bool is_bpf_list_api_kfunc(u32 btf_id) + btf_id == special_kfunc_list[KF_bpf_list_pop_back]; + } + +-static int process_kf_arg_ptr_to_list_head(struct bpf_verifier_env *env, +- struct bpf_reg_state *reg, u32 regno, +- struct bpf_kfunc_call_arg_meta *meta) ++static bool is_bpf_rbtree_api_kfunc(u32 btf_id) ++{ ++ return btf_id == special_kfunc_list[KF_bpf_rbtree_add] || ++ btf_id == special_kfunc_list[KF_bpf_rbtree_remove] || ++ btf_id == special_kfunc_list[KF_bpf_rbtree_first]; ++} ++ ++static bool is_bpf_graph_api_kfunc(u32 btf_id) ++{ ++ return is_bpf_list_api_kfunc(btf_id) || is_bpf_rbtree_api_kfunc(btf_id); ++} ++ ++static bool check_kfunc_is_graph_root_api(struct bpf_verifier_env *env, ++ enum btf_field_type head_field_type, ++ u32 kfunc_btf_id) + { ++ bool ret; ++ ++ switch (head_field_type) { ++ case BPF_LIST_HEAD: ++ ret = is_bpf_list_api_kfunc(kfunc_btf_id); ++ break; ++ case BPF_RB_ROOT: ++ ret = is_bpf_rbtree_api_kfunc(kfunc_btf_id); ++ break; ++ default: ++ verbose(env, "verifier internal error: unexpected graph root argument type %s\n", ++ btf_field_type_name(head_field_type)); ++ return false; ++ } ++ ++ if (!ret) ++ verbose(env, "verifier internal error: %s head arg for unknown kfunc\n", ++ btf_field_type_name(head_field_type)); ++ return ret; ++} ++ ++static bool check_kfunc_is_graph_node_api(struct bpf_verifier_env *env, ++ enum btf_field_type node_field_type, ++ u32 kfunc_btf_id) ++{ ++ bool ret; ++ ++ switch (node_field_type) { ++ case BPF_LIST_NODE: ++ ret = (kfunc_btf_id == special_kfunc_list[KF_bpf_list_push_front] || ++ kfunc_btf_id == special_kfunc_list[KF_bpf_list_push_back]); ++ break; ++ case BPF_RB_NODE: ++ ret = (kfunc_btf_id == special_kfunc_list[KF_bpf_rbtree_remove] || ++ kfunc_btf_id == special_kfunc_list[KF_bpf_rbtree_add]); ++ break; ++ default: ++ verbose(env, "verifier internal error: unexpected graph node argument type %s\n", ++ btf_field_type_name(node_field_type)); ++ return false; ++ } ++ ++ if (!ret) ++ verbose(env, "verifier internal error: %s node arg for unknown kfunc\n", ++ btf_field_type_name(node_field_type)); ++ return ret; ++} ++ ++static int ++__process_kf_arg_ptr_to_graph_root(struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg, u32 regno, ++ struct bpf_kfunc_call_arg_meta *meta, ++ enum btf_field_type head_field_type, ++ struct btf_field **head_field) ++{ ++ const char *head_type_name; + struct btf_field *field; + struct btf_record *rec; +- u32 list_head_off; ++ u32 head_off; + +- if (meta->btf != btf_vmlinux || !is_bpf_list_api_kfunc(meta->func_id)) { +- verbose(env, "verifier internal error: bpf_list_head argument for unknown kfunc\n"); ++ if (meta->btf != btf_vmlinux) { ++ verbose(env, "verifier internal error: unexpected btf mismatch in kfunc call\n"); + return -EFAULT; + } + ++ if (!check_kfunc_is_graph_root_api(env, head_field_type, meta->func_id)) ++ return -EFAULT; ++ ++ head_type_name = btf_field_type_name(head_field_type); + if (!tnum_is_const(reg->var_off)) { + verbose(env, +- "R%d doesn't have constant offset. bpf_list_head has to be at the constant offset\n", +- regno); ++ "R%d doesn't have constant offset. %s has to be at the constant offset\n", ++ regno, head_type_name); + return -EINVAL; + } + + rec = reg_btf_record(reg); +- list_head_off = reg->off + reg->var_off.value; +- field = btf_record_find(rec, list_head_off, BPF_LIST_HEAD); ++ head_off = reg->off + reg->var_off.value; ++ field = btf_record_find(rec, head_off, head_field_type); + if (!field) { +- verbose(env, "bpf_list_head not found at offset=%u\n", list_head_off); ++ verbose(env, "%s not found at offset=%u\n", head_type_name, head_off); + return -EINVAL; + } + + /* All functions require bpf_list_head to be protected using a bpf_spin_lock */ + if (check_reg_allocation_locked(env, reg)) { +- verbose(env, "bpf_spin_lock at off=%d must be held for bpf_list_head\n", +- rec->spin_lock_off); ++ verbose(env, "bpf_spin_lock at off=%d must be held for %s\n", ++ rec->spin_lock_off, head_type_name); + return -EINVAL; + } + +- if (meta->arg_list_head.field) { +- verbose(env, "verifier internal error: repeating bpf_list_head arg\n"); ++ if (*head_field) { ++ verbose(env, "verifier internal error: repeating %s arg\n", head_type_name); + return -EFAULT; + } +- meta->arg_list_head.field = field; ++ *head_field = field; + return 0; + } + +-static int process_kf_arg_ptr_to_list_node(struct bpf_verifier_env *env, ++static int process_kf_arg_ptr_to_list_head(struct bpf_verifier_env *env, + struct bpf_reg_state *reg, u32 regno, + struct bpf_kfunc_call_arg_meta *meta) + { ++ return __process_kf_arg_ptr_to_graph_root(env, reg, regno, meta, BPF_LIST_HEAD, ++ &meta->arg_list_head.field); ++} ++ ++static int process_kf_arg_ptr_to_rbtree_root(struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg, u32 regno, ++ struct bpf_kfunc_call_arg_meta *meta) ++{ ++ return __process_kf_arg_ptr_to_graph_root(env, reg, regno, meta, BPF_RB_ROOT, ++ &meta->arg_rbtree_root.field); ++} ++ ++static int ++__process_kf_arg_ptr_to_graph_node(struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg, u32 regno, ++ struct bpf_kfunc_call_arg_meta *meta, ++ enum btf_field_type head_field_type, ++ enum btf_field_type node_field_type, ++ struct btf_field **node_field) ++{ ++ const char *node_type_name; + const struct btf_type *et, *t; + struct btf_field *field; +- u32 list_node_off; ++ u32 node_off; + +- if (meta->btf != btf_vmlinux || +- (meta->func_id != special_kfunc_list[KF_bpf_list_push_front] && +- meta->func_id != special_kfunc_list[KF_bpf_list_push_back])) { +- verbose(env, "verifier internal error: bpf_list_node argument for unknown kfunc\n"); ++ if (meta->btf != btf_vmlinux) { ++ verbose(env, "verifier internal error: unexpected btf mismatch in kfunc call\n"); + return -EFAULT; + } + ++ if (!check_kfunc_is_graph_node_api(env, node_field_type, meta->func_id)) ++ return -EFAULT; ++ ++ node_type_name = btf_field_type_name(node_field_type); + if (!tnum_is_const(reg->var_off)) { + verbose(env, +- "R%d doesn't have constant offset. bpf_list_node has to be at the constant offset\n", +- regno); ++ "R%d doesn't have constant offset. %s has to be at the constant offset\n", ++ regno, node_type_name); + return -EINVAL; + } + +- list_node_off = reg->off + reg->var_off.value; +- field = reg_find_field_offset(reg, list_node_off, BPF_LIST_NODE); +- if (!field || field->offset != list_node_off) { +- verbose(env, "bpf_list_node not found at offset=%u\n", list_node_off); ++ node_off = reg->off + reg->var_off.value; ++ field = reg_find_field_offset(reg, node_off, node_field_type); ++ if (!field || field->offset != node_off) { ++ verbose(env, "%s not found at offset=%u\n", node_type_name, node_off); + return -EINVAL; + } + +- field = meta->arg_list_head.field; ++ field = *node_field; + + et = btf_type_by_id(field->graph_root.btf, field->graph_root.value_btf_id); + t = btf_type_by_id(reg->btf, reg->btf_id); + if (!btf_struct_ids_match(&env->log, reg->btf, reg->btf_id, 0, field->graph_root.btf, + field->graph_root.value_btf_id, true)) { +- verbose(env, "operation on bpf_list_head expects arg#1 bpf_list_node at offset=%d " ++ verbose(env, "operation on %s expects arg#1 %s at offset=%d " + "in struct %s, but arg is at offset=%d in struct %s\n", ++ btf_field_type_name(head_field_type), ++ btf_field_type_name(node_field_type), + field->graph_root.node_offset, + btf_name_by_offset(field->graph_root.btf, et->name_off), +- list_node_off, btf_name_by_offset(reg->btf, t->name_off)); ++ node_off, btf_name_by_offset(reg->btf, t->name_off)); + return -EINVAL; + } + +- if (list_node_off != field->graph_root.node_offset) { +- verbose(env, "arg#1 offset=%d, but expected bpf_list_node at offset=%d in struct %s\n", +- list_node_off, field->graph_root.node_offset, ++ if (node_off != field->graph_root.node_offset) { ++ verbose(env, "arg#1 offset=%d, but expected %s at offset=%d in struct %s\n", ++ node_off, btf_field_type_name(node_field_type), ++ field->graph_root.node_offset, + btf_name_by_offset(field->graph_root.btf, et->name_off)); + return -EINVAL; + } +@@ -9080,6 +9201,24 @@ static int process_kf_arg_ptr_to_list_node(struct bpf_verifier_env *env, + return 0; + } + ++static int process_kf_arg_ptr_to_list_node(struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg, u32 regno, ++ struct bpf_kfunc_call_arg_meta *meta) ++{ ++ return __process_kf_arg_ptr_to_graph_node(env, reg, regno, meta, ++ BPF_LIST_HEAD, BPF_LIST_NODE, ++ &meta->arg_list_head.field); ++} ++ ++static int process_kf_arg_ptr_to_rbtree_node(struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg, u32 regno, ++ struct bpf_kfunc_call_arg_meta *meta) ++{ ++ return __process_kf_arg_ptr_to_graph_node(env, reg, regno, meta, ++ BPF_RB_ROOT, BPF_RB_NODE, ++ &meta->arg_rbtree_root.field); ++} ++ + static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_arg_meta *meta) + { + const char *func_name = meta->func_name, *ref_tname; +@@ -9208,6 +9347,8 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ + case KF_ARG_PTR_TO_DYNPTR: + case KF_ARG_PTR_TO_LIST_HEAD: + case KF_ARG_PTR_TO_LIST_NODE: ++ case KF_ARG_PTR_TO_RB_ROOT: ++ case KF_ARG_PTR_TO_RB_NODE: + case KF_ARG_PTR_TO_MEM: + case KF_ARG_PTR_TO_MEM_SIZE: + /* Trusted by default */ +@@ -9286,6 +9427,20 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ + if (ret < 0) + return ret; + break; ++ case KF_ARG_PTR_TO_RB_ROOT: ++ if (reg->type != PTR_TO_MAP_VALUE && ++ reg->type != (PTR_TO_BTF_ID | MEM_ALLOC)) { ++ verbose(env, "arg#%d expected pointer to map value or allocated object\n", i); ++ return -EINVAL; ++ } ++ if (reg->type == (PTR_TO_BTF_ID | MEM_ALLOC) && !reg->ref_obj_id) { ++ verbose(env, "allocated object must be referenced\n"); ++ return -EINVAL; ++ } ++ ret = process_kf_arg_ptr_to_rbtree_root(env, reg, regno, meta); ++ if (ret < 0) ++ return ret; ++ break; + case KF_ARG_PTR_TO_LIST_NODE: + if (reg->type != (PTR_TO_BTF_ID | MEM_ALLOC)) { + verbose(env, "arg#%d expected pointer to allocated object\n", i); +@@ -9299,6 +9454,19 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ + if (ret < 0) + return ret; + break; ++ case KF_ARG_PTR_TO_RB_NODE: ++ if (reg->type != (PTR_TO_BTF_ID | MEM_ALLOC)) { ++ verbose(env, "arg#%d expected pointer to allocated object\n", i); ++ return -EINVAL; ++ } ++ if (!reg->ref_obj_id) { ++ verbose(env, "allocated object must be referenced\n"); ++ return -EINVAL; ++ } ++ ret = process_kf_arg_ptr_to_rbtree_node(env, reg, regno, meta); ++ if (ret < 0) ++ return ret; ++ break; + case KF_ARG_PTR_TO_BTF_ID: + /* Only base_type is checked, further checks are done here */ + if ((base_type(reg->type) != PTR_TO_BTF_ID || +@@ -14297,7 +14465,7 @@ static int do_check(struct bpf_verifier_env *env) + if ((insn->src_reg == BPF_REG_0 && insn->imm != BPF_FUNC_spin_unlock) || + (insn->src_reg == BPF_PSEUDO_CALL) || + (insn->src_reg == BPF_PSEUDO_KFUNC_CALL && +- (insn->off != 0 || !is_bpf_list_api_kfunc(insn->imm)))) { ++ (insn->off != 0 || !is_bpf_graph_api_kfunc(insn->imm)))) { + verbose(env, "function calls are not allowed while holding a lock\n"); + return -EINVAL; + } +-- +2.39.2 + diff --git a/queue-6.2/bpf-btf-fix-is_int_ptr.patch b/queue-6.2/bpf-btf-fix-is_int_ptr.patch new file mode 100644 index 00000000000..225aa985fab --- /dev/null +++ b/queue-6.2/bpf-btf-fix-is_int_ptr.patch @@ -0,0 +1,50 @@ +From 8a3f63b95bbb038cc2196d93e7682259ec61d076 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 16:59:07 +0800 +Subject: bpf/btf: Fix is_int_ptr() + +From: Feng Zhou + +[ Upstream commit 91f2dc6838c19342f7f2993627c622835cc24890 ] + +When tracing a kernel function with arg type is u32*, btf_ctx_access() +would report error: arg2 type INT is not a struct. + +The commit bb6728d75611 ("bpf: Allow access to int pointer arguments +in tracing programs") added support for int pointer, but did not skip +modifiers before checking it's type. This patch fixes it. + +Fixes: bb6728d75611 ("bpf: Allow access to int pointer arguments in tracing programs") +Co-developed-by: Chengming Zhou +Signed-off-by: Chengming Zhou +Signed-off-by: Feng Zhou +Signed-off-by: Daniel Borkmann +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/bpf/20230410085908.98493-2-zhoufeng.zf@bytedance.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 70ab572f81bc7..7f18d48c4a15b 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -5848,12 +5848,8 @@ struct btf *bpf_prog_get_target_btf(const struct bpf_prog *prog) + + static bool is_int_ptr(struct btf *btf, const struct btf_type *t) + { +- /* t comes in already as a pointer */ +- t = btf_type_by_id(btf, t->type); +- +- /* allow const */ +- if (BTF_INFO_KIND(t->info) == BTF_KIND_CONST) +- t = btf_type_by_id(btf, t->type); ++ /* skip modifiers */ ++ t = btf_type_skip_modifiers(btf, t->type, NULL); + + return btf_type_is_int(t); + } +-- +2.39.2 + diff --git a/queue-6.2/bpf-don-t-efault-for-getsockopt-with-optval-null.patch b/queue-6.2/bpf-don-t-efault-for-getsockopt-with-optval-null.patch new file mode 100644 index 00000000000..3c7a2b9b035 --- /dev/null +++ b/queue-6.2/bpf-don-t-efault-for-getsockopt-with-optval-null.patch @@ -0,0 +1,53 @@ +From f4f307d99f878709d005bd6e2625c6e05e951369 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 15:53:38 -0700 +Subject: bpf: Don't EFAULT for getsockopt with optval=NULL + +From: Stanislav Fomichev + +[ Upstream commit 00e74ae0863827d944e36e56a4ce1e77e50edb91 ] + +Some socket options do getsockopt with optval=NULL to estimate the size +of the final buffer (which is returned via optlen). This breaks BPF +getsockopt assumptions about permitted optval buffer size. Let's enforce +these assumptions only when non-NULL optval is provided. + +Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks") +Reported-by: Martin KaFai Lau +Signed-off-by: Stanislav Fomichev +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/ZD7Js4fj5YyI2oLd@google.com/T/#mb68daf700f87a9244a15d01d00c3f0e5b08f49f7 +Link: https://lore.kernel.org/bpf/20230418225343.553806-2-sdf@google.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/cgroup.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c +index bf2fdb33fb313..819f011f0a9cd 100644 +--- a/kernel/bpf/cgroup.c ++++ b/kernel/bpf/cgroup.c +@@ -1921,14 +1921,17 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, + if (ret < 0) + goto out; + +- if (ctx.optlen > max_optlen || ctx.optlen < 0) { ++ if (optval && (ctx.optlen > max_optlen || ctx.optlen < 0)) { + ret = -EFAULT; + goto out; + } + + if (ctx.optlen != 0) { +- if (copy_to_user(optval, ctx.optval, ctx.optlen) || +- put_user(ctx.optlen, optlen)) { ++ if (optval && copy_to_user(optval, ctx.optval, ctx.optlen)) { ++ ret = -EFAULT; ++ goto out; ++ } ++ if (put_user(ctx.optlen, optlen)) { + ret = -EFAULT; + goto out; + } +-- +2.39.2 + diff --git a/queue-6.2/bpf-factor-out-fetching-basic-kfunc-metadata.patch b/queue-6.2/bpf-factor-out-fetching-basic-kfunc-metadata.patch new file mode 100644 index 00000000000..c2114c6f81b --- /dev/null +++ b/queue-6.2/bpf-factor-out-fetching-basic-kfunc-metadata.patch @@ -0,0 +1,201 @@ +From 37b4560dc5afe21de0eb18fb7e21fe20856c3910 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 10:41:14 -0800 +Subject: bpf: factor out fetching basic kfunc metadata + +From: Andrii Nakryiko + +[ Upstream commit 07236eab7a3139da97aef9f5f21f403be82a82ea ] + +Factor out logic to fetch basic kfunc metadata based on struct bpf_insn. +This is not exactly short or trivial code to just copy/paste and this +information is sometimes necessary in other parts of the verifier logic. +Subsequent patches will rely on this to determine if an instruction is +a kfunc call to iterator next method. + +No functional changes intended, including that verbose() warning +behavior when kfunc is not allowed for a particular program type. + +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/r/20230308184121.1165081-2-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Stable-dep-of: f6a6a5a97628 ("bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call") +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 92 +++++++++++++++++++++++++++---------------- + 1 file changed, 59 insertions(+), 33 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 3fa2b177ab624..6db3589f0e7cc 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -9627,24 +9627,21 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ + return 0; + } + +-static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, +- int *insn_idx_p) ++static int fetch_kfunc_meta(struct bpf_verifier_env *env, ++ struct bpf_insn *insn, ++ struct bpf_kfunc_call_arg_meta *meta, ++ const char **kfunc_name) + { +- const struct btf_type *t, *func, *func_proto, *ptr_type; +- u32 i, nargs, func_id, ptr_type_id, release_ref_obj_id; +- struct bpf_reg_state *regs = cur_regs(env); +- const char *func_name, *ptr_type_name; +- bool sleepable, rcu_lock, rcu_unlock; +- struct bpf_kfunc_call_arg_meta meta; +- int err, insn_idx = *insn_idx_p; +- const struct btf_param *args; +- const struct btf_type *ret_t; ++ const struct btf_type *func, *func_proto; ++ u32 func_id, *kfunc_flags; ++ const char *func_name; + struct btf *desc_btf; +- u32 *kfunc_flags; + +- /* skip for now, but return error when we find this in fixup_kfunc_call */ ++ if (kfunc_name) ++ *kfunc_name = NULL; ++ + if (!insn->imm) +- return 0; ++ return -EINVAL; + + desc_btf = find_kfunc_desc_btf(env, insn->off); + if (IS_ERR(desc_btf)) +@@ -9653,22 +9650,51 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + func_id = insn->imm; + func = btf_type_by_id(desc_btf, func_id); + func_name = btf_name_by_offset(desc_btf, func->name_off); ++ if (kfunc_name) ++ *kfunc_name = func_name; + func_proto = btf_type_by_id(desc_btf, func->type); + + kfunc_flags = btf_kfunc_id_set_contains(desc_btf, resolve_prog_type(env->prog), func_id); + if (!kfunc_flags) { +- verbose(env, "calling kernel function %s is not allowed\n", +- func_name); + return -EACCES; + } + +- /* Prepare kfunc call metadata */ +- memset(&meta, 0, sizeof(meta)); +- meta.btf = desc_btf; +- meta.func_id = func_id; +- meta.kfunc_flags = *kfunc_flags; +- meta.func_proto = func_proto; +- meta.func_name = func_name; ++ memset(meta, 0, sizeof(*meta)); ++ meta->btf = desc_btf; ++ meta->func_id = func_id; ++ meta->kfunc_flags = *kfunc_flags; ++ meta->func_proto = func_proto; ++ meta->func_name = func_name; ++ ++ return 0; ++} ++ ++static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, ++ int *insn_idx_p) ++{ ++ const struct btf_type *t, *ptr_type; ++ u32 i, nargs, ptr_type_id, release_ref_obj_id; ++ struct bpf_reg_state *regs = cur_regs(env); ++ const char *func_name, *ptr_type_name; ++ bool sleepable, rcu_lock, rcu_unlock; ++ struct bpf_kfunc_call_arg_meta meta; ++ struct bpf_insn_aux_data *insn_aux; ++ int err, insn_idx = *insn_idx_p; ++ const struct btf_param *args; ++ const struct btf_type *ret_t; ++ struct btf *desc_btf; ++ ++ /* skip for now, but return error when we find this in fixup_kfunc_call */ ++ if (!insn->imm) ++ return 0; ++ ++ err = fetch_kfunc_meta(env, insn, &meta, &func_name); ++ if (err == -EACCES && func_name) ++ verbose(env, "calling kernel function %s is not allowed\n", func_name); ++ if (err) ++ return err; ++ desc_btf = meta.btf; ++ insn_aux = &env->insn_aux_data[insn_idx]; + + if (is_kfunc_destructive(&meta) && !capable(CAP_SYS_BOOT)) { + verbose(env, "destructive kfunc calls require CAP_SYS_BOOT capability\n"); +@@ -9725,7 +9751,7 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + err = release_reference(env, regs[meta.release_regno].ref_obj_id); + if (err) { + verbose(env, "kfunc %s#%d reference has not been acquired before\n", +- func_name, func_id); ++ func_name, meta.func_id); + return err; + } + } +@@ -9737,14 +9763,14 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + err = ref_convert_owning_non_owning(env, release_ref_obj_id); + if (err) { + verbose(env, "kfunc %s#%d conversion of owning ref to non-owning failed\n", +- func_name, func_id); ++ func_name, meta.func_id); + return err; + } + + err = release_reference(env, release_ref_obj_id); + if (err) { + verbose(env, "kfunc %s#%d reference has not been acquired before\n", +- func_name, func_id); ++ func_name, meta.func_id); + return err; + } + } +@@ -9754,7 +9780,7 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + set_rbtree_add_callback_state); + if (err) { + verbose(env, "kfunc %s#%d failed callback verification\n", +- func_name, func_id); ++ func_name, meta.func_id); + return err; + } + } +@@ -9763,7 +9789,7 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + mark_reg_not_init(env, regs, caller_saved[i]); + + /* Check return type */ +- t = btf_type_skip_modifiers(desc_btf, func_proto->type, NULL); ++ t = btf_type_skip_modifiers(desc_btf, meta.func_proto->type, NULL); + + if (is_kfunc_acquire(&meta) && !btf_type_is_struct_ptr(meta.btf, t)) { + /* Only exception is bpf_obj_new_impl */ +@@ -9812,11 +9838,11 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + regs[BPF_REG_0].btf = ret_btf; + regs[BPF_REG_0].btf_id = ret_btf_id; + +- env->insn_aux_data[insn_idx].obj_new_size = ret_t->size; +- env->insn_aux_data[insn_idx].kptr_struct_meta = ++ insn_aux->obj_new_size = ret_t->size; ++ insn_aux->kptr_struct_meta = + btf_find_struct_meta(ret_btf, ret_btf_id); + } else if (meta.func_id == special_kfunc_list[KF_bpf_obj_drop_impl]) { +- env->insn_aux_data[insn_idx].kptr_struct_meta = ++ insn_aux->kptr_struct_meta = + btf_find_struct_meta(meta.arg_obj_drop.btf, + meta.arg_obj_drop.btf_id); + } else if (meta.func_id == special_kfunc_list[KF_bpf_list_pop_front] || +@@ -9898,8 +9924,8 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + regs[BPF_REG_0].id = ++env->id_gen; + } /* else { add_kfunc_call() ensures it is btf_type_is_void(t) } */ + +- nargs = btf_type_vlen(func_proto); +- args = (const struct btf_param *)(func_proto + 1); ++ nargs = btf_type_vlen(meta.func_proto); ++ args = (const struct btf_param *)(meta.func_proto + 1); + for (i = 0; i < nargs; i++) { + u32 regno = i + 1; + +-- +2.39.2 + diff --git a/queue-6.2/bpf-fix-__reg_bound_offset-64-32-var_off-subreg-prop.patch b/queue-6.2/bpf-fix-__reg_bound_offset-64-32-var_off-subreg-prop.patch new file mode 100644 index 00000000000..c692a9da169 --- /dev/null +++ b/queue-6.2/bpf-fix-__reg_bound_offset-64-32-var_off-subreg-prop.patch @@ -0,0 +1,266 @@ +From c7d18389538a833ab2117a2cb8e9bdc2ccb7fc75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 22:30:55 +0100 +Subject: bpf: Fix __reg_bound_offset 64->32 var_off subreg propagation + +From: Daniel Borkmann + +[ Upstream commit 7be14c1c9030f73cc18b4ff23b78a0a081f16188 ] + +Xu reports that after commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 +bounds tracking"), the following BPF program is rejected by the verifier: + + 0: (61) r2 = *(u32 *)(r1 +0) ; R2_w=pkt(off=0,r=0,imm=0) + 1: (61) r3 = *(u32 *)(r1 +4) ; R3_w=pkt_end(off=0,imm=0) + 2: (bf) r1 = r2 + 3: (07) r1 += 1 + 4: (2d) if r1 > r3 goto pc+8 + 5: (71) r1 = *(u8 *)(r2 +0) ; R1_w=scalar(umax=255,var_off=(0x0; 0xff)) + 6: (18) r0 = 0x7fffffffffffff10 + 8: (0f) r1 += r0 ; R1_w=scalar(umin=0x7fffffffffffff10,umax=0x800000000000000f) + 9: (18) r0 = 0x8000000000000000 + 11: (07) r0 += 1 + 12: (ad) if r0 < r1 goto pc-2 + 13: (b7) r0 = 0 + 14: (95) exit + +And the verifier log says: + + func#0 @0 + 0: R1=ctx(off=0,imm=0) R10=fp0 + 0: (61) r2 = *(u32 *)(r1 +0) ; R1=ctx(off=0,imm=0) R2_w=pkt(off=0,r=0,imm=0) + 1: (61) r3 = *(u32 *)(r1 +4) ; R1=ctx(off=0,imm=0) R3_w=pkt_end(off=0,imm=0) + 2: (bf) r1 = r2 ; R1_w=pkt(off=0,r=0,imm=0) R2_w=pkt(off=0,r=0,imm=0) + 3: (07) r1 += 1 ; R1_w=pkt(off=1,r=0,imm=0) + 4: (2d) if r1 > r3 goto pc+8 ; R1_w=pkt(off=1,r=1,imm=0) R3_w=pkt_end(off=0,imm=0) + 5: (71) r1 = *(u8 *)(r2 +0) ; R1_w=scalar(umax=255,var_off=(0x0; 0xff)) R2_w=pkt(off=0,r=1,imm=0) + 6: (18) r0 = 0x7fffffffffffff10 ; R0_w=9223372036854775568 + 8: (0f) r1 += r0 ; R0_w=9223372036854775568 R1_w=scalar(umin=9223372036854775568,umax=9223372036854775823,s32_min=-240,s32_max=15) + 9: (18) r0 = 0x8000000000000000 ; R0_w=-9223372036854775808 + 11: (07) r0 += 1 ; R0_w=-9223372036854775807 + 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775807 R1_w=scalar(umin=9223372036854775568,umax=9223372036854775809) + 13: (b7) r0 = 0 ; R0_w=0 + 14: (95) exit + + from 12 to 11: R0_w=-9223372036854775807 R1_w=scalar(umin=9223372036854775810,umax=9223372036854775823,var_off=(0x8000000000000000; 0xffffffff)) R2_w=pkt(off=0,r=1,imm=0) R3_w=pkt_end(off=0,imm=0) R10=fp0 + 11: (07) r0 += 1 ; R0_w=-9223372036854775806 + 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775806 R1_w=scalar(umin=9223372036854775810,umax=9223372036854775810,var_off=(0x8000000000000000; 0xffffffff)) + 13: safe + + [...] + + from 12 to 11: R0_w=-9223372036854775795 R1=scalar(umin=9223372036854775822,umax=9223372036854775823,var_off=(0x8000000000000000; 0xffffffff)) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0 + 11: (07) r0 += 1 ; R0_w=-9223372036854775794 + 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775794 R1=scalar(umin=9223372036854775822,umax=9223372036854775822,var_off=(0x8000000000000000; 0xffffffff)) + 13: safe + + from 12 to 11: R0_w=-9223372036854775794 R1=scalar(umin=9223372036854775823,umax=9223372036854775823,var_off=(0x8000000000000000; 0xffffffff)) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0 + 11: (07) r0 += 1 ; R0_w=-9223372036854775793 + 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775793 R1=scalar(umin=9223372036854775823,umax=9223372036854775823,var_off=(0x8000000000000000; 0xffffffff)) + 13: safe + + from 12 to 11: R0_w=-9223372036854775793 R1=scalar(umin=9223372036854775824,umax=9223372036854775823,var_off=(0x8000000000000000; 0xffffffff)) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0 + 11: (07) r0 += 1 ; R0_w=-9223372036854775792 + 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775792 R1=scalar(umin=9223372036854775824,umax=9223372036854775823,var_off=(0x8000000000000000; 0xffffffff)) + 13: safe + + [...] + +The 64bit umin=9223372036854775810 bound continuously bumps by +1 while +umax=9223372036854775823 stays as-is until the verifier complexity limit +is reached and the program gets finally rejected. During this simulation, +the umin also eventually surpasses umax. Looking at the first 'from 12 +to 11' output line from the loop, R1 has the following state: + + R1_w=scalar(umin=0x8000000000000002 (9223372036854775810), + umax=0x800000000000000f (9223372036854775823), + var_off=(0x8000000000000000; + 0xffffffff)) + +The var_off has technically not an inconsistent state but it's very +imprecise and far off surpassing 64bit umax bounds whereas the expected +output with refined known bits in var_off should have been like: + + R1_w=scalar(umin=0x8000000000000002 (9223372036854775810), + umax=0x800000000000000f (9223372036854775823), + var_off=(0x8000000000000000; + 0xf)) + +In the above log, var_off stays as var_off=(0x8000000000000000; 0xffffffff) +and does not converge into a narrower mask where more bits become known, +eventually transforming R1 into a constant upon umin=9223372036854775823, +umax=9223372036854775823 case where the verifier would have terminated and +let the program pass. + +The __reg_combine_64_into_32() marks the subregister unknown and propagates +64bit {s,u}min/{s,u}max bounds to their 32bit equivalents iff they are within +the 32bit universe. The question came up whether __reg_combine_64_into_32() +should special case the situation that when 64bit {s,u}min bounds have +the same value as 64bit {s,u}max bounds to then assign the latter as +well to the 32bit reg->{s,u}32_{min,max}_value. As can be seen from the +above example however, that is just /one/ special case and not a /generic/ +solution given above example would still not be addressed this way and +remain at an imprecise var_off=(0x8000000000000000; 0xffffffff). + +The improvement is needed in __reg_bound_offset() to refine var32_off with +the updated var64_off instead of the prior reg->var_off. The reg_bounds_sync() +code first refines information about the register's min/max bounds via +__update_reg_bounds() from the current var_off, then in __reg_deduce_bounds() +from sign bit and with the potentially learned bits from bounds it'll +update the var_off tnum in __reg_bound_offset(). For example, intersecting +with the old var_off might have improved bounds slightly, e.g. if umax +was 0x7f...f and var_off was (0; 0xf...fc), then new var_off will then +result in (0; 0x7f...fc). The intersected var64_off holds then the +universe which is a superset of var32_off. The point for the latter is +not to broaden, but to further refine known bits based on the intersection +of var_off with 32 bit bounds, so that we later construct the final var_off +from upper and lower 32 bits. The final __update_reg_bounds() can then +potentially still slightly refine bounds if more bits became known from the +new var_off. + +After the improvement, we can see R1 converging successively: + + func#0 @0 + 0: R1=ctx(off=0,imm=0) R10=fp0 + 0: (61) r2 = *(u32 *)(r1 +0) ; R1=ctx(off=0,imm=0) R2_w=pkt(off=0,r=0,imm=0) + 1: (61) r3 = *(u32 *)(r1 +4) ; R1=ctx(off=0,imm=0) R3_w=pkt_end(off=0,imm=0) + 2: (bf) r1 = r2 ; R1_w=pkt(off=0,r=0,imm=0) R2_w=pkt(off=0,r=0,imm=0) + 3: (07) r1 += 1 ; R1_w=pkt(off=1,r=0,imm=0) + 4: (2d) if r1 > r3 goto pc+8 ; R1_w=pkt(off=1,r=1,imm=0) R3_w=pkt_end(off=0,imm=0) + 5: (71) r1 = *(u8 *)(r2 +0) ; R1_w=scalar(umax=255,var_off=(0x0; 0xff)) R2_w=pkt(off=0,r=1,imm=0) + 6: (18) r0 = 0x7fffffffffffff10 ; R0_w=9223372036854775568 + 8: (0f) r1 += r0 ; R0_w=9223372036854775568 R1_w=scalar(umin=9223372036854775568,umax=9223372036854775823,s32_min=-240,s32_max=15) + 9: (18) r0 = 0x8000000000000000 ; R0_w=-9223372036854775808 + 11: (07) r0 += 1 ; R0_w=-9223372036854775807 + 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775807 R1_w=scalar(umin=9223372036854775568,umax=9223372036854775809) + 13: (b7) r0 = 0 ; R0_w=0 + 14: (95) exit + + from 12 to 11: R0_w=-9223372036854775807 R1_w=scalar(umin=9223372036854775810,umax=9223372036854775823,var_off=(0x8000000000000000; 0xf),s32_min=0,s32_max=15,u32_max=15) R2_w=pkt(off=0,r=1,imm=0) R3_w=pkt_end(off=0,imm=0) R10=fp0 + 11: (07) r0 += 1 ; R0_w=-9223372036854775806 + 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775806 R1_w=-9223372036854775806 + 13: safe + + from 12 to 11: R0_w=-9223372036854775806 R1_w=scalar(umin=9223372036854775811,umax=9223372036854775823,var_off=(0x8000000000000000; 0xf),s32_min=0,s32_max=15,u32_max=15) R2_w=pkt(off=0,r=1,imm=0) R3_w=pkt_end(off=0,imm=0) R10=fp0 + 11: (07) r0 += 1 ; R0_w=-9223372036854775805 + 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775805 R1_w=-9223372036854775805 + 13: safe + + [...] + + from 12 to 11: R0_w=-9223372036854775798 R1=scalar(umin=9223372036854775819,umax=9223372036854775823,var_off=(0x8000000000000008; 0x7),s32_min=8,s32_max=15,u32_min=8,u32_max=15) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0 + 11: (07) r0 += 1 ; R0_w=-9223372036854775797 + 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775797 R1=-9223372036854775797 + 13: safe + + from 12 to 11: R0_w=-9223372036854775797 R1=scalar(umin=9223372036854775820,umax=9223372036854775823,var_off=(0x800000000000000c; 0x3),s32_min=12,s32_max=15,u32_min=12,u32_max=15) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0 + 11: (07) r0 += 1 ; R0_w=-9223372036854775796 + 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775796 R1=-9223372036854775796 + 13: safe + + from 12 to 11: R0_w=-9223372036854775796 R1=scalar(umin=9223372036854775821,umax=9223372036854775823,var_off=(0x800000000000000c; 0x3),s32_min=12,s32_max=15,u32_min=12,u32_max=15) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0 + 11: (07) r0 += 1 ; R0_w=-9223372036854775795 + 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775795 R1=-9223372036854775795 + 13: safe + + from 12 to 11: R0_w=-9223372036854775795 R1=scalar(umin=9223372036854775822,umax=9223372036854775823,var_off=(0x800000000000000e; 0x1),s32_min=14,s32_max=15,u32_min=14,u32_max=15) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0 + 11: (07) r0 += 1 ; R0_w=-9223372036854775794 + 12: (ad) if r0 < r1 goto pc-2 ; R0_w=-9223372036854775794 R1=-9223372036854775794 + 13: safe + + from 12 to 11: R0_w=-9223372036854775794 R1=-9223372036854775793 R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0 + 11: (07) r0 += 1 ; R0_w=-9223372036854775793 + 12: (ad) if r0 < r1 goto pc-2 + last_idx 12 first_idx 12 + parent didn't have regs=1 stack=0 marks: R0_rw=P-9223372036854775801 R1_r=scalar(umin=9223372036854775815,umax=9223372036854775823,var_off=(0x8000000000000000; 0xf),s32_min=0,s32_max=15,u32_max=15) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0 + last_idx 11 first_idx 11 + regs=1 stack=0 before 11: (07) r0 += 1 + parent didn't have regs=1 stack=0 marks: R0_rw=P-9223372036854775805 R1_rw=scalar(umin=9223372036854775812,umax=9223372036854775823,var_off=(0x8000000000000000; 0xf),s32_min=0,s32_max=15,u32_max=15) R2_w=pkt(off=0,r=1,imm=0) R3_w=pkt_end(off=0,imm=0) R10=fp0 + last_idx 12 first_idx 0 + regs=1 stack=0 before 12: (ad) if r0 < r1 goto pc-2 + regs=1 stack=0 before 11: (07) r0 += 1 + regs=1 stack=0 before 12: (ad) if r0 < r1 goto pc-2 + regs=1 stack=0 before 11: (07) r0 += 1 + regs=1 stack=0 before 12: (ad) if r0 < r1 goto pc-2 + regs=1 stack=0 before 11: (07) r0 += 1 + regs=1 stack=0 before 9: (18) r0 = 0x8000000000000000 + last_idx 12 first_idx 12 + parent didn't have regs=2 stack=0 marks: R0_rw=P-9223372036854775801 R1_r=Pscalar(umin=9223372036854775815,umax=9223372036854775823,var_off=(0x8000000000000000; 0xf),s32_min=0,s32_max=15,u32_max=15) R2=pkt(off=0,r=1,imm=0) R3=pkt_end(off=0,imm=0) R10=fp0 + last_idx 11 first_idx 11 + regs=2 stack=0 before 11: (07) r0 += 1 + parent didn't have regs=2 stack=0 marks: R0_rw=P-9223372036854775805 R1_rw=Pscalar(umin=9223372036854775812,umax=9223372036854775823,var_off=(0x8000000000000000; 0xf),s32_min=0,s32_max=15,u32_max=15) R2_w=pkt(off=0,r=1,imm=0) R3_w=pkt_end(off=0,imm=0) R10=fp0 + last_idx 12 first_idx 0 + regs=2 stack=0 before 12: (ad) if r0 < r1 goto pc-2 + regs=2 stack=0 before 11: (07) r0 += 1 + regs=2 stack=0 before 12: (ad) if r0 < r1 goto pc-2 + regs=2 stack=0 before 11: (07) r0 += 1 + regs=2 stack=0 before 12: (ad) if r0 < r1 goto pc-2 + regs=2 stack=0 before 11: (07) r0 += 1 + regs=2 stack=0 before 9: (18) r0 = 0x8000000000000000 + regs=2 stack=0 before 8: (0f) r1 += r0 + regs=3 stack=0 before 6: (18) r0 = 0x7fffffffffffff10 + regs=2 stack=0 before 5: (71) r1 = *(u8 *)(r2 +0) + 13: safe + + from 4 to 13: safe + verification time 322 usec + stack depth 0 + processed 56 insns (limit 1000000) max_states_per_insn 1 total_states 3 peak_states 3 mark_read 1 + +This also fixes up a test case along with this improvement where we match +on the verifier log. The updated log now has a refined var_off, too. + +Fixes: 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") +Reported-by: Xu Kuohai +Signed-off-by: Daniel Borkmann +Signed-off-by: Andrii Nakryiko +Reviewed-by: John Fastabend +Link: https://lore.kernel.org/bpf/20230314203424.4015351-2-xukuohai@huaweicloud.com +Link: https://lore.kernel.org/bpf/20230322213056.2470-1-daniel@iogearbox.net +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 6 +++--- + tools/testing/selftests/bpf/prog_tests/align.c | 4 ++-- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index bb8579a3bf310..0afafb539d783 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -1769,9 +1769,9 @@ static void __reg_bound_offset(struct bpf_reg_state *reg) + struct tnum var64_off = tnum_intersect(reg->var_off, + tnum_range(reg->umin_value, + reg->umax_value)); +- struct tnum var32_off = tnum_intersect(tnum_subreg(reg->var_off), +- tnum_range(reg->u32_min_value, +- reg->u32_max_value)); ++ struct tnum var32_off = tnum_intersect(tnum_subreg(var64_off), ++ tnum_range(reg->u32_min_value, ++ reg->u32_max_value)); + + reg->var_off = tnum_or(tnum_clear_subreg(var64_off), var32_off); + } +diff --git a/tools/testing/selftests/bpf/prog_tests/align.c b/tools/testing/selftests/bpf/prog_tests/align.c +index 4666f88f2bb4f..8baebb41541dc 100644 +--- a/tools/testing/selftests/bpf/prog_tests/align.c ++++ b/tools/testing/selftests/bpf/prog_tests/align.c +@@ -575,14 +575,14 @@ static struct bpf_align_test tests[] = { + /* New unknown value in R7 is (4n), >= 76 */ + {14, "R7_w=scalar(umin=76,umax=1096,var_off=(0x0; 0x7fc))"}, + /* Adding it to packet pointer gives nice bounds again */ +- {16, "R5_w=pkt(id=3,off=0,r=0,umin=2,umax=1082,var_off=(0x2; 0xfffffffc)"}, ++ {16, "R5_w=pkt(id=3,off=0,r=0,umin=2,umax=1082,var_off=(0x2; 0x7fc)"}, + /* At the time the word size load is performed from R5, + * its total fixed offset is NET_IP_ALIGN + reg->off (0) + * which is 2. Then the variable offset is (4n+2), so + * the total offset is 4-byte aligned and meets the + * load's requirements. + */ +- {20, "R5=pkt(id=3,off=0,r=4,umin=2,umax=1082,var_off=(0x2; 0xfffffffc)"}, ++ {20, "R5=pkt(id=3,off=0,r=4,umin=2,umax=1082,var_off=(0x2; 0x7fc)"}, + }, + }, + }; +-- +2.39.2 + diff --git a/queue-6.2/bpf-fix-precision-propagation-verbose-logging.patch b/queue-6.2/bpf-fix-precision-propagation-verbose-logging.patch new file mode 100644 index 00000000000..533903f3775 --- /dev/null +++ b/queue-6.2/bpf-fix-precision-propagation-verbose-logging.patch @@ -0,0 +1,46 @@ +From 81674d737d86afa6f9fd722690453b895ff93d48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 11:40:17 -0700 +Subject: bpf: fix precision propagation verbose logging + +From: Andrii Nakryiko + +[ Upstream commit 34f0677e7afd3a292bc1aadda7ce8e35faedb204 ] + +Fix wrong order of frame index vs register/slot index in precision +propagation verbose (level 2) output. It's wrong and very confusing as is. + +Fixes: 529409ea92d5 ("bpf: propagate precision across all frames, not just the last one") +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/r/20230313184017.4083374-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index a53ba87a1cd2a..df353ba844f41 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -13678,7 +13678,7 @@ static int propagate_precision(struct bpf_verifier_env *env, + !(state_reg->live & REG_LIVE_READ)) + continue; + if (env->log.level & BPF_LOG_LEVEL2) +- verbose(env, "frame %d: propagating r%d\n", i, fr); ++ verbose(env, "frame %d: propagating r%d\n", fr, i); + err = mark_chain_precision_frame(env, fr, i); + if (err < 0) + return err; +@@ -13694,7 +13694,7 @@ static int propagate_precision(struct bpf_verifier_env *env, + continue; + if (env->log.level & BPF_LOG_LEVEL2) + verbose(env, "frame %d: propagating fp%d\n", +- (-i - 1) * BPF_REG_SIZE, fr); ++ fr, (-i - 1) * BPF_REG_SIZE); + err = mark_chain_precision_stack_frame(env, fr, i); + if (err < 0) + return err; +-- +2.39.2 + diff --git a/queue-6.2/bpf-fix-race-between-btf_put-and-btf_idr-walk.patch b/queue-6.2/bpf-fix-race-between-btf_put-and-btf_idr-walk.patch new file mode 100644 index 00000000000..12ee65bc632 --- /dev/null +++ b/queue-6.2/bpf-fix-race-between-btf_put-and-btf_idr-walk.patch @@ -0,0 +1,65 @@ +From 8414e6c942e6dc77053894e8aed95f9cbda8cd2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 18:49:01 -0700 +Subject: bpf: Fix race between btf_put and btf_idr walk. + +From: Alexei Starovoitov + +[ Upstream commit acf1c3d68e9a31f10d92bc67ad4673cdae5e8d92 ] + +Florian and Eduard reported hard dead lock: +[ 58.433327] _raw_spin_lock_irqsave+0x40/0x50 +[ 58.433334] btf_put+0x43/0x90 +[ 58.433338] bpf_find_btf_id+0x157/0x240 +[ 58.433353] btf_parse_fields+0x921/0x11c0 + +This happens since btf->refcount can be 1 at the time of btf_put() and +btf_put() will call btf_free_id() which will try to grab btf_idr_lock +and will dead lock. +Avoid the issue by doing btf_put() without locking. + +Fixes: 3d78417b60fb ("bpf: Add bpf_btf_find_by_name_kind() helper.") +Fixes: 1e89106da253 ("bpf: Add bpf_core_add_cands() and wire it into bpf_core_apply_relo_insn().") +Reported-by: Florian Westphal +Reported-by: Eduard Zingerman +Signed-off-by: Alexei Starovoitov +Signed-off-by: Daniel Borkmann +Tested-by: Eduard Zingerman +Link: https://lore.kernel.org/bpf/20230421014901.70908-1-alexei.starovoitov@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 7f18d48c4a15b..6f3326417f27e 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -566,8 +566,8 @@ static s32 bpf_find_btf_id(const char *name, u32 kind, struct btf **btf_p) + *btf_p = btf; + return ret; + } +- spin_lock_bh(&btf_idr_lock); + btf_put(btf); ++ spin_lock_bh(&btf_idr_lock); + } + spin_unlock_bh(&btf_idr_lock); + return ret; +@@ -8185,12 +8185,10 @@ bpf_core_find_cands(struct bpf_core_ctx *ctx, u32 local_type_id) + btf_get(mod_btf); + spin_unlock_bh(&btf_idr_lock); + cands = bpf_core_add_cands(cands, mod_btf, btf_nr_types(main_btf)); +- if (IS_ERR(cands)) { +- btf_put(mod_btf); ++ btf_put(mod_btf); ++ if (IS_ERR(cands)) + return ERR_CAST(cands); +- } + spin_lock_bh(&btf_idr_lock); +- btf_put(mod_btf); + } + spin_unlock_bh(&btf_idr_lock); + /* cands is a pointer to kmalloced memory here if cands->cnt > 0 +-- +2.39.2 + diff --git a/queue-6.2/bpf-fix-struct_meta-lookup-for-bpf_obj_free_fields-k.patch b/queue-6.2/bpf-fix-struct_meta-lookup-for-bpf_obj_free_fields-k.patch new file mode 100644 index 00000000000..b35c9ae523c --- /dev/null +++ b/queue-6.2/bpf-fix-struct_meta-lookup-for-bpf_obj_free_fields-k.patch @@ -0,0 +1,69 @@ +From ae8da802193db32c81fe615ce599018dcbdbdad5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 13:00:27 -0700 +Subject: bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call + +From: Dave Marchevsky + +[ Upstream commit f6a6a5a976288e4d0d94eb1c6c9e983e8e5cdb31 ] + +bpf_obj_drop_impl has a void return type. In check_kfunc_call, the "else +if" which sets insn_aux->kptr_struct_meta for bpf_obj_drop_impl is +surrounded by a larger if statement which checks btf_type_is_ptr. As a +result: + + * The bpf_obj_drop_impl-specific code will never execute + * The btf_struct_meta input to bpf_obj_drop is always NULL + * __bpf_obj_drop_impl will always see a NULL btf_record when called + from BPF program, and won't call bpf_obj_free_fields + * program-allocated kptrs which have fields that should be cleaned up + by bpf_obj_free_fields may instead leak resources + +This patch adds a btf_type_is_void branch to the larger if and moves +special handling for bpf_obj_drop_impl there, fixing the issue. + +Fixes: ac9f06050a35 ("bpf: Introduce bpf_obj_drop") +Cc: Kumar Kartikeya Dwivedi +Signed-off-by: Dave Marchevsky +Link: https://lore.kernel.org/r/20230403200027.2271029-1-davemarchevsky@fb.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 6db3589f0e7cc..1c7dad0e79b92 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -9841,10 +9841,6 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + insn_aux->obj_new_size = ret_t->size; + insn_aux->kptr_struct_meta = + btf_find_struct_meta(ret_btf, ret_btf_id); +- } else if (meta.func_id == special_kfunc_list[KF_bpf_obj_drop_impl]) { +- insn_aux->kptr_struct_meta = +- btf_find_struct_meta(meta.arg_obj_drop.btf, +- meta.arg_obj_drop.btf_id); + } else if (meta.func_id == special_kfunc_list[KF_bpf_list_pop_front] || + meta.func_id == special_kfunc_list[KF_bpf_list_pop_back]) { + struct btf_field *field = meta.arg_list_head.field; +@@ -9922,7 +9918,15 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + } + if (reg_may_point_to_spin_lock(®s[BPF_REG_0]) && !regs[BPF_REG_0].id) + regs[BPF_REG_0].id = ++env->id_gen; +- } /* else { add_kfunc_call() ensures it is btf_type_is_void(t) } */ ++ } else if (btf_type_is_void(t)) { ++ if (meta.btf == btf_vmlinux && btf_id_set_contains(&special_kfunc_set, meta.func_id)) { ++ if (meta.func_id == special_kfunc_list[KF_bpf_obj_drop_impl]) { ++ insn_aux->kptr_struct_meta = ++ btf_find_struct_meta(meta.arg_obj_drop.btf, ++ meta.arg_obj_drop.btf_id); ++ } ++ } ++ } + + nargs = btf_type_vlen(meta.func_proto); + args = (const struct btf_param *)(meta.func_proto + 1); +-- +2.39.2 + diff --git a/queue-6.2/bpf-migrate-release_on_unlock-logic-to-non-owning-re.patch b/queue-6.2/bpf-migrate-release_on_unlock-logic-to-non-owning-re.patch new file mode 100644 index 00000000000..a72f10ddcb6 --- /dev/null +++ b/queue-6.2/bpf-migrate-release_on_unlock-logic-to-non-owning-re.patch @@ -0,0 +1,667 @@ +From a30c0ec20ba05db2fa319b4ed249a5deabf46ba2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Feb 2023 01:27:07 -0800 +Subject: bpf: Migrate release_on_unlock logic to non-owning ref semantics + +From: Dave Marchevsky + +[ Upstream commit 6a3cd3318ff65622415e34e8ee39d76331e7c869 ] + +This patch introduces non-owning reference semantics to the verifier, +specifically linked_list API kfunc handling. release_on_unlock logic for +refs is refactored - with small functional changes - to implement these +semantics, and bpf_list_push_{front,back} are migrated to use them. + +When a list node is pushed to a list, the program still has a pointer to +the node: + + n = bpf_obj_new(typeof(*n)); + + bpf_spin_lock(&l); + bpf_list_push_back(&l, n); + /* n still points to the just-added node */ + bpf_spin_unlock(&l); + +What the verifier considers n to be after the push, and thus what can be +done with n, are changed by this patch. + +Common properties both before/after this patch: + * After push, n is only a valid reference to the node until end of + critical section + * After push, n cannot be pushed to any list + * After push, the program can read the node's fields using n + +Before: + * After push, n retains the ref_obj_id which it received on + bpf_obj_new, but the associated bpf_reference_state's + release_on_unlock field is set to true + * release_on_unlock field and associated logic is used to implement + "n is only a valid ref until end of critical section" + * After push, n cannot be written to, the node must be removed from + the list before writing to its fields + * After push, n is marked PTR_UNTRUSTED + +After: + * After push, n's ref is released and ref_obj_id set to 0. NON_OWN_REF + type flag is added to reg's type, indicating that it's a non-owning + reference. + * NON_OWN_REF flag and logic is used to implement "n is only a + valid ref until end of critical section" + * n can be written to (except for special fields e.g. bpf_list_node, + timer, ...) + +Summary of specific implementation changes to achieve the above: + + * release_on_unlock field, ref_set_release_on_unlock helper, and logic + to "release on unlock" based on that field are removed + + * The anonymous active_lock struct used by bpf_verifier_state is + pulled out into a named struct bpf_active_lock. + + * NON_OWN_REF type flag is introduced along with verifier logic + changes to handle non-owning refs + + * Helpers are added to use NON_OWN_REF flag to implement non-owning + ref semantics as described above + * invalidate_non_owning_refs - helper to clobber all non-owning refs + matching a particular bpf_active_lock identity. Replaces + release_on_unlock logic in process_spin_lock. + * ref_set_non_owning - set NON_OWN_REF type flag after doing some + sanity checking + * ref_convert_owning_non_owning - convert owning reference w/ + specified ref_obj_id to non-owning references. Set NON_OWN_REF + flag for each reg with that ref_obj_id and 0-out its ref_obj_id + + * Update linked_list selftests to account for minor semantic + differences introduced by this patch + * Writes to a release_on_unlock node ref are not allowed, while + writes to non-owning reference pointees are. As a result the + linked_list "write after push" failure tests are no longer scenarios + that should fail. + * The test##missing_lock##op and test##incorrect_lock##op + macro-generated failure tests need to have a valid node argument in + order to have the same error output as before. Otherwise + verification will fail early and the expected error output won't be seen. + +Signed-off-by: Dave Marchevsky +Link: https://lore.kernel.org/r/20230212092715.1422619-2-davemarchevsky@fb.com +Signed-off-by: Alexei Starovoitov +Stable-dep-of: f6a6a5a97628 ("bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call") +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 6 + + include/linux/bpf_verifier.h | 38 ++-- + kernel/bpf/verifier.c | 168 +++++++++++++----- + .../selftests/bpf/prog_tests/linked_list.c | 2 - + .../testing/selftests/bpf/progs/linked_list.c | 2 +- + .../selftests/bpf/progs/linked_list_fail.c | 100 +++++++---- + 6 files changed, 206 insertions(+), 110 deletions(-) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 6f207ba587283..69b4b623ff06b 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -180,6 +180,7 @@ enum btf_field_type { + BPF_KPTR = BPF_KPTR_UNREF | BPF_KPTR_REF, + BPF_LIST_HEAD = (1 << 4), + BPF_LIST_NODE = (1 << 5), ++ BPF_GRAPH_NODE_OR_ROOT = BPF_LIST_NODE | BPF_LIST_HEAD, + }; + + struct btf_field_kptr { +@@ -582,6 +583,11 @@ enum bpf_type_flag { + /* MEM is tagged with rcu and memory access needs rcu_read_lock protection. */ + MEM_RCU = BIT(13 + BPF_BASE_TYPE_BITS), + ++ /* Used to tag PTR_TO_BTF_ID | MEM_ALLOC references which are non-owning. ++ * Currently only valid for linked-list and rbtree nodes. ++ */ ++ NON_OWN_REF = BIT(14 + BPF_BASE_TYPE_BITS), ++ + __BPF_TYPE_FLAG_MAX, + __BPF_TYPE_LAST_FLAG = __BPF_TYPE_FLAG_MAX - 1, + }; +diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h +index 53d175cbaa027..ed2f082eabb37 100644 +--- a/include/linux/bpf_verifier.h ++++ b/include/linux/bpf_verifier.h +@@ -43,6 +43,22 @@ enum bpf_reg_liveness { + REG_LIVE_DONE = 0x8, /* liveness won't be updating this register anymore */ + }; + ++/* For every reg representing a map value or allocated object pointer, ++ * we consider the tuple of (ptr, id) for them to be unique in verifier ++ * context and conside them to not alias each other for the purposes of ++ * tracking lock state. ++ */ ++struct bpf_active_lock { ++ /* This can either be reg->map_ptr or reg->btf. If ptr is NULL, ++ * there's no active lock held, and other fields have no ++ * meaning. If non-NULL, it indicates that a lock is held and ++ * id member has the reg->id of the register which can be >= 0. ++ */ ++ void *ptr; ++ /* This will be reg->id */ ++ u32 id; ++}; ++ + struct bpf_reg_state { + /* Ordering of fields matters. See states_equal() */ + enum bpf_reg_type type; +@@ -223,11 +239,6 @@ struct bpf_reference_state { + * exiting a callback function. + */ + int callback_ref; +- /* Mark the reference state to release the registers sharing the same id +- * on bpf_spin_unlock (for nodes that we will lose ownership to but are +- * safe to access inside the critical section). +- */ +- bool release_on_unlock; + }; + + /* state of the program: +@@ -328,21 +339,8 @@ struct bpf_verifier_state { + u32 branches; + u32 insn_idx; + u32 curframe; +- /* For every reg representing a map value or allocated object pointer, +- * we consider the tuple of (ptr, id) for them to be unique in verifier +- * context and conside them to not alias each other for the purposes of +- * tracking lock state. +- */ +- struct { +- /* This can either be reg->map_ptr or reg->btf. If ptr is NULL, +- * there's no active lock held, and other fields have no +- * meaning. If non-NULL, it indicates that a lock is held and +- * id member has the reg->id of the register which can be >= 0. +- */ +- void *ptr; +- /* This will be reg->id */ +- u32 id; +- } active_lock; ++ ++ struct bpf_active_lock active_lock; + bool speculative; + bool active_rcu_lock; + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 9c44fd71dcb55..d7c2c048807c0 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -190,6 +190,9 @@ struct bpf_verifier_stack_elem { + + static int acquire_reference_state(struct bpf_verifier_env *env, int insn_idx); + static int release_reference(struct bpf_verifier_env *env, int ref_obj_id); ++static void invalidate_non_owning_refs(struct bpf_verifier_env *env); ++static int ref_set_non_owning(struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg); + + static bool bpf_map_ptr_poisoned(const struct bpf_insn_aux_data *aux) + { +@@ -456,6 +459,11 @@ static bool type_is_ptr_alloc_obj(u32 type) + return base_type(type) == PTR_TO_BTF_ID && type_flag(type) & MEM_ALLOC; + } + ++static bool type_is_non_owning_ref(u32 type) ++{ ++ return type_is_ptr_alloc_obj(type) && type_flag(type) & NON_OWN_REF; ++} ++ + static struct btf_record *reg_btf_record(const struct bpf_reg_state *reg) + { + struct btf_record *rec = NULL; +@@ -1044,6 +1052,8 @@ static void print_verifier_state(struct bpf_verifier_env *env, + verbose_a("id=%d", reg->id); + if (reg->ref_obj_id) + verbose_a("ref_obj_id=%d", reg->ref_obj_id); ++ if (type_is_non_owning_ref(reg->type)) ++ verbose_a("%s", "non_own_ref"); + if (t != SCALAR_VALUE) + verbose_a("off=%d", reg->off); + if (type_is_pkt_pointer(t)) +@@ -5003,7 +5013,8 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env, + return -EACCES; + } + +- if (type_is_alloc(reg->type) && !reg->ref_obj_id) { ++ if (type_is_alloc(reg->type) && !type_is_non_owning_ref(reg->type) && ++ !reg->ref_obj_id) { + verbose(env, "verifier internal error: ref_obj_id for allocated object must be non-zero\n"); + return -EFAULT; + } +@@ -5986,9 +5997,7 @@ static int process_spin_lock(struct bpf_verifier_env *env, int regno, + cur->active_lock.ptr = btf; + cur->active_lock.id = reg->id; + } else { +- struct bpf_func_state *fstate = cur_func(env); + void *ptr; +- int i; + + if (map) + ptr = map; +@@ -6004,25 +6013,11 @@ static int process_spin_lock(struct bpf_verifier_env *env, int regno, + verbose(env, "bpf_spin_unlock of different lock\n"); + return -EINVAL; + } +- cur->active_lock.ptr = NULL; +- cur->active_lock.id = 0; + +- for (i = fstate->acquired_refs - 1; i >= 0; i--) { +- int err; ++ invalidate_non_owning_refs(env); + +- /* Complain on error because this reference state cannot +- * be freed before this point, as bpf_spin_lock critical +- * section does not allow functions that release the +- * allocated object immediately. +- */ +- if (!fstate->refs[i].release_on_unlock) +- continue; +- err = release_reference(env, fstate->refs[i].id); +- if (err) { +- verbose(env, "failed to release release_on_unlock reference"); +- return err; +- } +- } ++ cur->active_lock.ptr = NULL; ++ cur->active_lock.id = 0; + } + return 0; + } +@@ -6490,6 +6485,23 @@ static int check_reg_type(struct bpf_verifier_env *env, u32 regno, + return 0; + } + ++static struct btf_field * ++reg_find_field_offset(const struct bpf_reg_state *reg, s32 off, u32 fields) ++{ ++ struct btf_field *field; ++ struct btf_record *rec; ++ ++ rec = reg_btf_record(reg); ++ if (!rec) ++ return NULL; ++ ++ field = btf_record_find(rec, off, fields); ++ if (!field) ++ return NULL; ++ ++ return field; ++} ++ + int check_func_arg_reg_off(struct bpf_verifier_env *env, + const struct bpf_reg_state *reg, int regno, + enum bpf_arg_type arg_type) +@@ -6511,6 +6523,18 @@ int check_func_arg_reg_off(struct bpf_verifier_env *env, + */ + if (arg_type_is_dynptr(arg_type) && type == PTR_TO_STACK) + return 0; ++ ++ if ((type_is_ptr_alloc_obj(type) || type_is_non_owning_ref(type)) && reg->off) { ++ if (reg_find_field_offset(reg, reg->off, BPF_GRAPH_NODE_OR_ROOT)) ++ return __check_ptr_off_reg(env, reg, regno, true); ++ ++ verbose(env, "R%d must have zero offset when passed to release func\n", ++ regno); ++ verbose(env, "No graph node or root found at R%d type:%s off:%d\n", regno, ++ kernel_type_name(reg->btf, reg->btf_id), reg->off); ++ return -EINVAL; ++ } ++ + /* Doing check_ptr_off_reg check for the offset will catch this + * because fixed_off_ok is false, but checking here allows us + * to give the user a better error message. +@@ -6545,6 +6569,7 @@ int check_func_arg_reg_off(struct bpf_verifier_env *env, + case PTR_TO_BTF_ID | PTR_TRUSTED: + case PTR_TO_BTF_ID | MEM_RCU: + case PTR_TO_BTF_ID | MEM_ALLOC | PTR_TRUSTED: ++ case PTR_TO_BTF_ID | MEM_ALLOC | NON_OWN_REF: + /* When referenced PTR_TO_BTF_ID is passed to release function, + * its fixed offset must be 0. In the other cases, fixed offset + * can be non-zero. This was already checked above. So pass +@@ -7297,6 +7322,17 @@ static int release_reference(struct bpf_verifier_env *env, + return 0; + } + ++static void invalidate_non_owning_refs(struct bpf_verifier_env *env) ++{ ++ struct bpf_func_state *unused; ++ struct bpf_reg_state *reg; ++ ++ bpf_for_each_reg_in_vstate(env->cur_state, unused, reg, ({ ++ if (type_is_non_owning_ref(reg->type)) ++ __mark_reg_unknown(env, reg); ++ })); ++} ++ + static void clear_caller_saved_regs(struct bpf_verifier_env *env, + struct bpf_reg_state *regs) + { +@@ -8804,38 +8840,54 @@ static int process_kf_arg_ptr_to_kptr(struct bpf_verifier_env *env, + return 0; + } + +-static int ref_set_release_on_unlock(struct bpf_verifier_env *env, u32 ref_obj_id) ++static int ref_set_non_owning(struct bpf_verifier_env *env, struct bpf_reg_state *reg) + { +- struct bpf_func_state *state = cur_func(env); ++ struct bpf_verifier_state *state = env->cur_state; ++ ++ if (!state->active_lock.ptr) { ++ verbose(env, "verifier internal error: ref_set_non_owning w/o active lock\n"); ++ return -EFAULT; ++ } ++ ++ if (type_flag(reg->type) & NON_OWN_REF) { ++ verbose(env, "verifier internal error: NON_OWN_REF already set\n"); ++ return -EFAULT; ++ } ++ ++ reg->type |= NON_OWN_REF; ++ return 0; ++} ++ ++static int ref_convert_owning_non_owning(struct bpf_verifier_env *env, u32 ref_obj_id) ++{ ++ struct bpf_func_state *state, *unused; + struct bpf_reg_state *reg; + int i; + +- /* bpf_spin_lock only allows calling list_push and list_pop, no BPF +- * subprogs, no global functions. This means that the references would +- * not be released inside the critical section but they may be added to +- * the reference state, and the acquired_refs are never copied out for a +- * different frame as BPF to BPF calls don't work in bpf_spin_lock +- * critical sections. +- */ ++ state = cur_func(env); ++ + if (!ref_obj_id) { +- verbose(env, "verifier internal error: ref_obj_id is zero for release_on_unlock\n"); ++ verbose(env, "verifier internal error: ref_obj_id is zero for " ++ "owning -> non-owning conversion\n"); + return -EFAULT; + } ++ + for (i = 0; i < state->acquired_refs; i++) { +- if (state->refs[i].id == ref_obj_id) { +- if (state->refs[i].release_on_unlock) { +- verbose(env, "verifier internal error: expected false release_on_unlock"); +- return -EFAULT; ++ if (state->refs[i].id != ref_obj_id) ++ continue; ++ ++ /* Clear ref_obj_id here so release_reference doesn't clobber ++ * the whole reg ++ */ ++ bpf_for_each_reg_in_vstate(env->cur_state, unused, reg, ({ ++ if (reg->ref_obj_id == ref_obj_id) { ++ reg->ref_obj_id = 0; ++ ref_set_non_owning(env, reg); + } +- state->refs[i].release_on_unlock = true; +- /* Now mark everyone sharing same ref_obj_id as untrusted */ +- bpf_for_each_reg_in_vstate(env->cur_state, state, reg, ({ +- if (reg->ref_obj_id == ref_obj_id) +- reg->type |= PTR_UNTRUSTED; +- })); +- return 0; +- } ++ })); ++ return 0; + } ++ + verbose(env, "verifier internal error: ref state missing for ref_obj_id\n"); + return -EFAULT; + } +@@ -8970,7 +9022,6 @@ static int process_kf_arg_ptr_to_list_node(struct bpf_verifier_env *env, + { + const struct btf_type *et, *t; + struct btf_field *field; +- struct btf_record *rec; + u32 list_node_off; + + if (meta->btf != btf_vmlinux || +@@ -8987,9 +9038,8 @@ static int process_kf_arg_ptr_to_list_node(struct bpf_verifier_env *env, + return -EINVAL; + } + +- rec = reg_btf_record(reg); + list_node_off = reg->off + reg->var_off.value; +- field = btf_record_find(rec, list_node_off, BPF_LIST_NODE); ++ field = reg_find_field_offset(reg, list_node_off, BPF_LIST_NODE); + if (!field || field->offset != list_node_off) { + verbose(env, "bpf_list_node not found at offset=%u\n", list_node_off); + return -EINVAL; +@@ -9015,8 +9065,8 @@ static int process_kf_arg_ptr_to_list_node(struct bpf_verifier_env *env, + btf_name_by_offset(field->graph_root.btf, et->name_off)); + return -EINVAL; + } +- /* Set arg#1 for expiration after unlock */ +- return ref_set_release_on_unlock(env, reg->ref_obj_id); ++ ++ return 0; + } + + static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_arg_meta *meta) +@@ -9289,11 +9339,11 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + int *insn_idx_p) + { + const struct btf_type *t, *func, *func_proto, *ptr_type; ++ u32 i, nargs, func_id, ptr_type_id, release_ref_obj_id; + struct bpf_reg_state *regs = cur_regs(env); + const char *func_name, *ptr_type_name; + bool sleepable, rcu_lock, rcu_unlock; + struct bpf_kfunc_call_arg_meta meta; +- u32 i, nargs, func_id, ptr_type_id; + int err, insn_idx = *insn_idx_p; + const struct btf_param *args; + const struct btf_type *ret_t; +@@ -9388,6 +9438,24 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + } + } + ++ if (meta.func_id == special_kfunc_list[KF_bpf_list_push_front] || ++ meta.func_id == special_kfunc_list[KF_bpf_list_push_back]) { ++ release_ref_obj_id = regs[BPF_REG_2].ref_obj_id; ++ err = ref_convert_owning_non_owning(env, release_ref_obj_id); ++ if (err) { ++ verbose(env, "kfunc %s#%d conversion of owning ref to non-owning failed\n", ++ func_name, func_id); ++ return err; ++ } ++ ++ err = release_reference(env, release_ref_obj_id); ++ if (err) { ++ verbose(env, "kfunc %s#%d reference has not been acquired before\n", ++ func_name, func_id); ++ return err; ++ } ++ } ++ + for (i = 0; i < CALLER_SAVED_REGS; i++) + mark_reg_not_init(env, regs, caller_saved[i]); + +@@ -11708,8 +11776,10 @@ static void mark_ptr_or_null_reg(struct bpf_func_state *state, + */ + if (WARN_ON_ONCE(reg->smin_value || reg->smax_value || !tnum_equals_const(reg->var_off, 0))) + return; +- if (reg->type != (PTR_TO_BTF_ID | MEM_ALLOC | PTR_MAYBE_NULL) && WARN_ON_ONCE(reg->off)) ++ if (!(type_is_ptr_alloc_obj(reg->type) || type_is_non_owning_ref(reg->type)) && ++ WARN_ON_ONCE(reg->off)) + return; ++ + if (is_null) { + reg->type = SCALAR_VALUE; + /* We don't need id and ref_obj_id from this point +diff --git a/tools/testing/selftests/bpf/prog_tests/linked_list.c b/tools/testing/selftests/bpf/prog_tests/linked_list.c +index 9a7d4c47af633..2592b8aa5e41a 100644 +--- a/tools/testing/selftests/bpf/prog_tests/linked_list.c ++++ b/tools/testing/selftests/bpf/prog_tests/linked_list.c +@@ -78,8 +78,6 @@ static struct { + { "direct_write_head", "direct access to bpf_list_head is disallowed" }, + { "direct_read_node", "direct access to bpf_list_node is disallowed" }, + { "direct_write_node", "direct access to bpf_list_node is disallowed" }, +- { "write_after_push_front", "only read is supported" }, +- { "write_after_push_back", "only read is supported" }, + { "use_after_unlock_push_front", "invalid mem access 'scalar'" }, + { "use_after_unlock_push_back", "invalid mem access 'scalar'" }, + { "double_push_front", "arg#1 expected pointer to allocated object" }, +diff --git a/tools/testing/selftests/bpf/progs/linked_list.c b/tools/testing/selftests/bpf/progs/linked_list.c +index 4ad88da5cda2d..4fa4a9b01bde3 100644 +--- a/tools/testing/selftests/bpf/progs/linked_list.c ++++ b/tools/testing/selftests/bpf/progs/linked_list.c +@@ -260,7 +260,7 @@ int test_list_push_pop_multiple(struct bpf_spin_lock *lock, struct bpf_list_head + { + int ret; + +- ret = list_push_pop_multiple(lock ,head, false); ++ ret = list_push_pop_multiple(lock, head, false); + if (ret) + return ret; + return list_push_pop_multiple(lock, head, true); +diff --git a/tools/testing/selftests/bpf/progs/linked_list_fail.c b/tools/testing/selftests/bpf/progs/linked_list_fail.c +index 1d9017240e197..69cdc07cba13a 100644 +--- a/tools/testing/selftests/bpf/progs/linked_list_fail.c ++++ b/tools/testing/selftests/bpf/progs/linked_list_fail.c +@@ -54,28 +54,44 @@ + return 0; \ + } + +-CHECK(kptr, push_front, &f->head); +-CHECK(kptr, push_back, &f->head); + CHECK(kptr, pop_front, &f->head); + CHECK(kptr, pop_back, &f->head); + +-CHECK(global, push_front, &ghead); +-CHECK(global, push_back, &ghead); + CHECK(global, pop_front, &ghead); + CHECK(global, pop_back, &ghead); + +-CHECK(map, push_front, &v->head); +-CHECK(map, push_back, &v->head); + CHECK(map, pop_front, &v->head); + CHECK(map, pop_back, &v->head); + +-CHECK(inner_map, push_front, &iv->head); +-CHECK(inner_map, push_back, &iv->head); + CHECK(inner_map, pop_front, &iv->head); + CHECK(inner_map, pop_back, &iv->head); + + #undef CHECK + ++#define CHECK(test, op, hexpr, nexpr) \ ++ SEC("?tc") \ ++ int test##_missing_lock_##op(void *ctx) \ ++ { \ ++ INIT; \ ++ void (*p)(void *, void *) = (void *)&bpf_list_##op; \ ++ p(hexpr, nexpr); \ ++ return 0; \ ++ } ++ ++CHECK(kptr, push_front, &f->head, b); ++CHECK(kptr, push_back, &f->head, b); ++ ++CHECK(global, push_front, &ghead, f); ++CHECK(global, push_back, &ghead, f); ++ ++CHECK(map, push_front, &v->head, f); ++CHECK(map, push_back, &v->head, f); ++ ++CHECK(inner_map, push_front, &iv->head, f); ++CHECK(inner_map, push_back, &iv->head, f); ++ ++#undef CHECK ++ + #define CHECK(test, op, lexpr, hexpr) \ + SEC("?tc") \ + int test##_incorrect_lock_##op(void *ctx) \ +@@ -108,11 +124,47 @@ CHECK(inner_map, pop_back, &iv->head); + CHECK(inner_map_global, op, &iv->lock, &ghead); \ + CHECK(inner_map_map, op, &iv->lock, &v->head); + +-CHECK_OP(push_front); +-CHECK_OP(push_back); + CHECK_OP(pop_front); + CHECK_OP(pop_back); + ++#undef CHECK ++#undef CHECK_OP ++ ++#define CHECK(test, op, lexpr, hexpr, nexpr) \ ++ SEC("?tc") \ ++ int test##_incorrect_lock_##op(void *ctx) \ ++ { \ ++ INIT; \ ++ void (*p)(void *, void*) = (void *)&bpf_list_##op; \ ++ bpf_spin_lock(lexpr); \ ++ p(hexpr, nexpr); \ ++ return 0; \ ++ } ++ ++#define CHECK_OP(op) \ ++ CHECK(kptr_kptr, op, &f1->lock, &f2->head, b); \ ++ CHECK(kptr_global, op, &f1->lock, &ghead, f); \ ++ CHECK(kptr_map, op, &f1->lock, &v->head, f); \ ++ CHECK(kptr_inner_map, op, &f1->lock, &iv->head, f); \ ++ \ ++ CHECK(global_global, op, &glock2, &ghead, f); \ ++ CHECK(global_kptr, op, &glock, &f1->head, b); \ ++ CHECK(global_map, op, &glock, &v->head, f); \ ++ CHECK(global_inner_map, op, &glock, &iv->head, f); \ ++ \ ++ CHECK(map_map, op, &v->lock, &v2->head, f); \ ++ CHECK(map_kptr, op, &v->lock, &f2->head, b); \ ++ CHECK(map_global, op, &v->lock, &ghead, f); \ ++ CHECK(map_inner_map, op, &v->lock, &iv->head, f); \ ++ \ ++ CHECK(inner_map_inner_map, op, &iv->lock, &iv2->head, f); \ ++ CHECK(inner_map_kptr, op, &iv->lock, &f2->head, b); \ ++ CHECK(inner_map_global, op, &iv->lock, &ghead, f); \ ++ CHECK(inner_map_map, op, &iv->lock, &v->head, f); ++ ++CHECK_OP(push_front); ++CHECK_OP(push_back); ++ + #undef CHECK + #undef CHECK_OP + #undef INIT +@@ -303,34 +355,6 @@ int direct_write_node(void *ctx) + return 0; + } + +-static __always_inline +-int write_after_op(void (*push_op)(void *head, void *node)) +-{ +- struct foo *f; +- +- f = bpf_obj_new(typeof(*f)); +- if (!f) +- return 0; +- bpf_spin_lock(&glock); +- push_op(&ghead, &f->node); +- f->data = 42; +- bpf_spin_unlock(&glock); +- +- return 0; +-} +- +-SEC("?tc") +-int write_after_push_front(void *ctx) +-{ +- return write_after_op((void *)bpf_list_push_front); +-} +- +-SEC("?tc") +-int write_after_push_back(void *ctx) +-{ +- return write_after_op((void *)bpf_list_push_back); +-} +- + static __always_inline + int use_after_unlock(void (*op)(void *head, void *node)) + { +-- +2.39.2 + diff --git a/queue-6.2/bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch b/queue-6.2/bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch new file mode 100644 index 00000000000..b0f4d0f04dc --- /dev/null +++ b/queue-6.2/bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch @@ -0,0 +1,93 @@ +From 139d72103707cd18b0cdcda32db4aacec845454a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 17:54:00 +0100 +Subject: bpf: Remove misleading spec_v1 check on var-offset stack read + +From: Luis Gerhorst + +[ Upstream commit 082cdc69a4651dd2a77539d69416a359ed1214f5 ] + +For every BPF_ADD/SUB involving a pointer, adjust_ptr_min_max_vals() +ensures that the resulting pointer has a constant offset if +bypass_spec_v1 is false. This is ensured by calling sanitize_check_bounds() +which in turn calls check_stack_access_for_ptr_arithmetic(). There, +-EACCESS is returned if the register's offset is not constant, thereby +rejecting the program. + +In summary, an unprivileged user must never be able to create stack +pointers with a variable offset. That is also the case, because a +respective check in check_stack_write() is missing. If they were able +to create a variable-offset pointer, users could still use it in a +stack-write operation to trigger unsafe speculative behavior [1]. + +Because unprivileged users must already be prevented from creating +variable-offset stack pointers, viable options are to either remove +this check (replacing it with a clarifying comment), or to turn it +into a "verifier BUG"-message, also adding a similar check in +check_stack_write() (for consistency, as a second-level defense). +This patch implements the first option to reduce verifier bloat. + +This check was introduced by commit 01f810ace9ed ("bpf: Allow +variable-offset stack access") which correctly notes that +"variable-offset reads and writes are disallowed (they were already +disallowed for the indirect access case) because the speculative +execution checking code doesn't support them". However, it does not +further discuss why the check in check_stack_read() is necessary. +The code which made this check obsolete was also introduced in this +commit. + +I have compiled ~650 programs from the Linux selftests, Linux samples, +Cilium, and libbpf/examples projects and confirmed that none of these +trigger the check in check_stack_read() [2]. Instead, all of these +programs are, as expected, already rejected when constructing the +variable-offset pointers. Note that the check in +check_stack_access_for_ptr_arithmetic() also prints "off=%d" while the +code removed by this patch does not (the error removed does not appear +in the "verification_error" values). For reproducibility, the +repository linked includes the raw data and scripts used to create +the plot. + + [1] https://arxiv.org/pdf/1807.03757.pdf + [2] https://gitlab.cs.fau.de/un65esoq/bpf-spectre/-/raw/53dc19fcf459c186613b1156a81504b39c8d49db/data/plots/23-02-26_23-56_bpftool/bpftool/0004-errors.pdf?inline=false + +Fixes: 01f810ace9ed ("bpf: Allow variable-offset stack access") +Signed-off-by: Luis Gerhorst +Signed-off-by: Daniel Borkmann +Acked-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20230315165358.23701-1-gerhorst@cs.fau.de +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index df353ba844f41..c61216f88ad6a 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -3895,17 +3895,13 @@ static int check_stack_read(struct bpf_verifier_env *env, + } + /* Variable offset is prohibited for unprivileged mode for simplicity + * since it requires corresponding support in Spectre masking for stack +- * ALU. See also retrieve_ptr_limit(). ++ * ALU. See also retrieve_ptr_limit(). The check in ++ * check_stack_access_for_ptr_arithmetic() called by ++ * adjust_ptr_min_max_vals() prevents users from creating stack pointers ++ * with variable offsets, therefore no check is required here. Further, ++ * just checking it here would be insufficient as speculative stack ++ * writes could still lead to unsafe speculative behaviour. + */ +- if (!env->bypass_spec_v1 && var_off) { +- char tn_buf[48]; +- +- tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off); +- verbose(env, "R%d variable offset stack access prohibited for !root, var_off=%s\n", +- ptr_regno, tn_buf); +- return -EACCES; +- } +- + if (!var_off) { + off += reg->var_off.value; + err = check_stack_read_fixed_off(env, state, off, size, +-- +2.39.2 + diff --git a/queue-6.2/bpf-rename-list_head-graph_root-in-field-info-types.patch b/queue-6.2/bpf-rename-list_head-graph_root-in-field-info-types.patch new file mode 100644 index 00000000000..dc3fb7d514b --- /dev/null +++ b/queue-6.2/bpf-rename-list_head-graph_root-in-field-info-types.patch @@ -0,0 +1,193 @@ +From 932ed430ab9e8a507d9ccb330831d4a82fefa924 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Dec 2022 00:24:57 -0800 +Subject: bpf: rename list_head -> graph_root in field info types + +From: Dave Marchevsky + +[ Upstream commit 30465003ad776a922c32b2dac58db14f120f037e ] + +Many of the structs recently added to track field info for linked-list +head are useful as-is for rbtree root. So let's do a mechanical renaming +of list_head-related types and fields: + +include/linux/bpf.h: + struct btf_field_list_head -> struct btf_field_graph_root + list_head -> graph_root in struct btf_field union +kernel/bpf/btf.c: + list_head -> graph_root in struct btf_field_info + +This is a nonfunctional change, functionality to actually use these +fields for rbtree will be added in further patches. + +Signed-off-by: Dave Marchevsky +Link: https://lore.kernel.org/r/20221217082506.1570898-5-davemarchevsky@fb.com +Signed-off-by: Alexei Starovoitov +Stable-dep-of: f6a6a5a97628 ("bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call") +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 4 ++-- + kernel/bpf/btf.c | 21 +++++++++++---------- + kernel/bpf/helpers.c | 4 ++-- + kernel/bpf/verifier.c | 21 +++++++++++---------- + 4 files changed, 26 insertions(+), 24 deletions(-) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 8f9ad2722a2ba..6f207ba587283 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -189,7 +189,7 @@ struct btf_field_kptr { + u32 btf_id; + }; + +-struct btf_field_list_head { ++struct btf_field_graph_root { + struct btf *btf; + u32 value_btf_id; + u32 node_offset; +@@ -201,7 +201,7 @@ struct btf_field { + enum btf_field_type type; + union { + struct btf_field_kptr kptr; +- struct btf_field_list_head list_head; ++ struct btf_field_graph_root graph_root; + }; + }; + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 9880faa7e6760..b38b3335cd1e7 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -3228,7 +3228,7 @@ struct btf_field_info { + struct { + const char *node_name; + u32 value_btf_id; +- } list_head; ++ } graph_root; + }; + }; + +@@ -3335,8 +3335,8 @@ static int btf_find_list_head(const struct btf *btf, const struct btf_type *pt, + return -EINVAL; + info->type = BPF_LIST_HEAD; + info->off = off; +- info->list_head.value_btf_id = id; +- info->list_head.node_name = list_node; ++ info->graph_root.value_btf_id = id; ++ info->graph_root.node_name = list_node; + return BTF_FIELD_FOUND; + } + +@@ -3604,13 +3604,14 @@ static int btf_parse_list_head(const struct btf *btf, struct btf_field *field, + u32 offset; + int i; + +- t = btf_type_by_id(btf, info->list_head.value_btf_id); ++ t = btf_type_by_id(btf, info->graph_root.value_btf_id); + /* We've already checked that value_btf_id is a struct type. We + * just need to figure out the offset of the list_node, and + * verify its type. + */ + for_each_member(i, t, member) { +- if (strcmp(info->list_head.node_name, __btf_name_by_offset(btf, member->name_off))) ++ if (strcmp(info->graph_root.node_name, ++ __btf_name_by_offset(btf, member->name_off))) + continue; + /* Invalid BTF, two members with same name */ + if (n) +@@ -3627,9 +3628,9 @@ static int btf_parse_list_head(const struct btf *btf, struct btf_field *field, + if (offset % __alignof__(struct bpf_list_node)) + return -EINVAL; + +- field->list_head.btf = (struct btf *)btf; +- field->list_head.value_btf_id = info->list_head.value_btf_id; +- field->list_head.node_offset = offset; ++ field->graph_root.btf = (struct btf *)btf; ++ field->graph_root.value_btf_id = info->graph_root.value_btf_id; ++ field->graph_root.node_offset = offset; + } + if (!n) + return -ENOENT; +@@ -3736,11 +3737,11 @@ int btf_check_and_fixup_fields(const struct btf *btf, struct btf_record *rec) + + if (!(rec->fields[i].type & BPF_LIST_HEAD)) + continue; +- btf_id = rec->fields[i].list_head.value_btf_id; ++ btf_id = rec->fields[i].graph_root.value_btf_id; + meta = btf_find_struct_meta(btf, btf_id); + if (!meta) + return -EFAULT; +- rec->fields[i].list_head.value_rec = meta->record; ++ rec->fields[i].graph_root.value_rec = meta->record; + + if (!(rec->field_mask & BPF_LIST_NODE)) + continue; +diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c +index af30c6cbd65db..527040ffead41 100644 +--- a/kernel/bpf/helpers.c ++++ b/kernel/bpf/helpers.c +@@ -1745,12 +1745,12 @@ void bpf_list_head_free(const struct btf_field *field, void *list_head, + while (head != orig_head) { + void *obj = head; + +- obj -= field->list_head.node_offset; ++ obj -= field->graph_root.node_offset; + head = head->next; + /* The contained type can also have resources, including a + * bpf_list_head which needs to be freed. + */ +- bpf_obj_free_fields(field->list_head.value_rec, obj); ++ bpf_obj_free_fields(field->graph_root.value_rec, obj); + /* bpf_mem_free requires migrate_disable(), since we can be + * called from map free path as well apart from BPF program (as + * part of map ops doing bpf_obj_free_fields). +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 0afafb539d783..9c44fd71dcb55 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -8997,21 +8997,22 @@ static int process_kf_arg_ptr_to_list_node(struct bpf_verifier_env *env, + + field = meta->arg_list_head.field; + +- et = btf_type_by_id(field->list_head.btf, field->list_head.value_btf_id); ++ et = btf_type_by_id(field->graph_root.btf, field->graph_root.value_btf_id); + t = btf_type_by_id(reg->btf, reg->btf_id); +- if (!btf_struct_ids_match(&env->log, reg->btf, reg->btf_id, 0, field->list_head.btf, +- field->list_head.value_btf_id, true)) { ++ if (!btf_struct_ids_match(&env->log, reg->btf, reg->btf_id, 0, field->graph_root.btf, ++ field->graph_root.value_btf_id, true)) { + verbose(env, "operation on bpf_list_head expects arg#1 bpf_list_node at offset=%d " + "in struct %s, but arg is at offset=%d in struct %s\n", +- field->list_head.node_offset, btf_name_by_offset(field->list_head.btf, et->name_off), ++ field->graph_root.node_offset, ++ btf_name_by_offset(field->graph_root.btf, et->name_off), + list_node_off, btf_name_by_offset(reg->btf, t->name_off)); + return -EINVAL; + } + +- if (list_node_off != field->list_head.node_offset) { ++ if (list_node_off != field->graph_root.node_offset) { + verbose(env, "arg#1 offset=%d, but expected bpf_list_node at offset=%d in struct %s\n", +- list_node_off, field->list_head.node_offset, +- btf_name_by_offset(field->list_head.btf, et->name_off)); ++ list_node_off, field->graph_root.node_offset, ++ btf_name_by_offset(field->graph_root.btf, et->name_off)); + return -EINVAL; + } + /* Set arg#1 for expiration after unlock */ +@@ -9453,9 +9454,9 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, + + mark_reg_known_zero(env, regs, BPF_REG_0); + regs[BPF_REG_0].type = PTR_TO_BTF_ID | MEM_ALLOC; +- regs[BPF_REG_0].btf = field->list_head.btf; +- regs[BPF_REG_0].btf_id = field->list_head.value_btf_id; +- regs[BPF_REG_0].off = field->list_head.node_offset; ++ regs[BPF_REG_0].btf = field->graph_root.btf; ++ regs[BPF_REG_0].btf_id = field->graph_root.value_btf_id; ++ regs[BPF_REG_0].off = field->graph_root.node_offset; + } else if (meta.func_id == special_kfunc_list[KF_bpf_cast_to_kern_ctx]) { + mark_reg_known_zero(env, regs, BPF_REG_0); + regs[BPF_REG_0].type = PTR_TO_BTF_ID | PTR_TRUSTED; +-- +2.39.2 + diff --git a/queue-6.2/bpf-return-long-from-bpf_map_ops-funcs.patch b/queue-6.2/bpf-return-long-from-bpf_map_ops-funcs.patch new file mode 100644 index 00000000000..47278ad9773 --- /dev/null +++ b/queue-6.2/bpf-return-long-from-bpf_map_ops-funcs.patch @@ -0,0 +1,837 @@ +From 60ce33b25bfd6e5f110e973a7334b7fd8376e599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 12:47:54 -0700 +Subject: bpf: return long from bpf_map_ops funcs + +From: JP Kobryn + +[ Upstream commit d7ba4cc900bf1eea2d8c807c6b1fc6bd61f41237 ] + +This patch changes the return types of bpf_map_ops functions to long, where +previously int was returned. Using long allows for bpf programs to maintain +the sign bit in the absence of sign extension during situations where +inlined bpf helper funcs make calls to the bpf_map_ops funcs and a negative +error is returned. + +The definitions of the helper funcs are generated from comments in the bpf +uapi header at `include/uapi/linux/bpf.h`. The return type of these +helpers was previously changed from int to long in commit bdb7b79b4ce8. For +any case where one of the map helpers call the bpf_map_ops funcs that are +still returning 32-bit int, a compiler might not include sign extension +instructions to properly convert the 32-bit negative value a 64-bit +negative value. + +For example: +bpf assembly excerpt of an inlined helper calling a kernel function and +checking for a specific error: + +; err = bpf_map_update_elem(&mymap, &key, &val, BPF_NOEXIST); + ... + 46: call 0xffffffffe103291c ; htab_map_update_elem +; if (err && err != -EEXIST) { + 4b: cmp $0xffffffffffffffef,%rax ; cmp -EEXIST,%rax + +kernel function assembly excerpt of return value from +`htab_map_update_elem` returning 32-bit int: + +movl $0xffffffef, %r9d +... +movl %r9d, %eax + +...results in the comparison: +cmp $0xffffffffffffffef, $0x00000000ffffffef + +Fixes: bdb7b79b4ce8 ("bpf: Switch most helper return values from 32-bit int to 64-bit long") +Tested-by: Eduard Zingerman +Signed-off-by: JP Kobryn +Link: https://lore.kernel.org/r/20230322194754.185781-3-inwardvessel@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 14 ++++++------- + include/linux/filter.h | 6 +++--- + kernel/bpf/arraymap.c | 12 ++++++------ + kernel/bpf/bloom_filter.c | 12 ++++++------ + kernel/bpf/bpf_cgrp_storage.c | 6 +++--- + kernel/bpf/bpf_inode_storage.c | 6 +++--- + kernel/bpf/bpf_struct_ops.c | 6 +++--- + kernel/bpf/bpf_task_storage.c | 6 +++--- + kernel/bpf/cpumap.c | 8 ++++---- + kernel/bpf/devmap.c | 24 +++++++++++------------ + kernel/bpf/hashtab.c | 36 +++++++++++++++++----------------- + kernel/bpf/local_storage.c | 6 +++--- + kernel/bpf/lpm_trie.c | 6 +++--- + kernel/bpf/queue_stack_maps.c | 22 ++++++++++----------- + kernel/bpf/reuseport_array.c | 2 +- + kernel/bpf/ringbuf.c | 6 +++--- + kernel/bpf/stackmap.c | 6 +++--- + kernel/bpf/verifier.c | 14 ++++++------- + net/core/bpf_sk_storage.c | 6 +++--- + net/core/sock_map.c | 8 ++++---- + net/xdp/xskmap.c | 8 ++++---- + 21 files changed, 110 insertions(+), 110 deletions(-) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index cf0d88109e3f9..8f9ad2722a2ba 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -95,11 +95,11 @@ struct bpf_map_ops { + + /* funcs callable from userspace and from eBPF programs */ + void *(*map_lookup_elem)(struct bpf_map *map, void *key); +- int (*map_update_elem)(struct bpf_map *map, void *key, void *value, u64 flags); +- int (*map_delete_elem)(struct bpf_map *map, void *key); +- int (*map_push_elem)(struct bpf_map *map, void *value, u64 flags); +- int (*map_pop_elem)(struct bpf_map *map, void *value); +- int (*map_peek_elem)(struct bpf_map *map, void *value); ++ long (*map_update_elem)(struct bpf_map *map, void *key, void *value, u64 flags); ++ long (*map_delete_elem)(struct bpf_map *map, void *key); ++ long (*map_push_elem)(struct bpf_map *map, void *value, u64 flags); ++ long (*map_pop_elem)(struct bpf_map *map, void *value); ++ long (*map_peek_elem)(struct bpf_map *map, void *value); + void *(*map_lookup_percpu_elem)(struct bpf_map *map, void *key, u32 cpu); + + /* funcs called by prog_array and perf_event_array map */ +@@ -138,7 +138,7 @@ struct bpf_map_ops { + struct bpf_local_storage __rcu ** (*map_owner_storage_ptr)(void *owner); + + /* Misc helpers.*/ +- int (*map_redirect)(struct bpf_map *map, u64 key, u64 flags); ++ long (*map_redirect)(struct bpf_map *map, u64 key, u64 flags); + + /* map_meta_equal must be implemented for maps that can be + * used as an inner map. It is a runtime check to ensure +@@ -156,7 +156,7 @@ struct bpf_map_ops { + int (*map_set_for_each_callback_args)(struct bpf_verifier_env *env, + struct bpf_func_state *caller, + struct bpf_func_state *callee); +- int (*map_for_each_callback)(struct bpf_map *map, ++ long (*map_for_each_callback)(struct bpf_map *map, + bpf_callback_t callback_fn, + void *callback_ctx, u64 flags); + +diff --git a/include/linux/filter.h b/include/linux/filter.h +index ccc4a4a58c727..b08ba0a643f8c 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -1503,9 +1503,9 @@ static inline bool bpf_sk_lookup_run_v6(struct net *net, int protocol, + } + #endif /* IS_ENABLED(CONFIG_IPV6) */ + +-static __always_inline int __bpf_xdp_redirect_map(struct bpf_map *map, u64 index, +- u64 flags, const u64 flag_mask, +- void *lookup_elem(struct bpf_map *map, u32 key)) ++static __always_inline long __bpf_xdp_redirect_map(struct bpf_map *map, u64 index, ++ u64 flags, const u64 flag_mask, ++ void *lookup_elem(struct bpf_map *map, u32 key)) + { + struct bpf_redirect_info *ri = this_cpu_ptr(&bpf_redirect_info); + const u64 action_mask = XDP_ABORTED | XDP_DROP | XDP_PASS | XDP_TX; +diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c +index 4847069595569..cb80bcc880b44 100644 +--- a/kernel/bpf/arraymap.c ++++ b/kernel/bpf/arraymap.c +@@ -307,8 +307,8 @@ static int array_map_get_next_key(struct bpf_map *map, void *key, void *next_key + } + + /* Called from syscall or from eBPF program */ +-static int array_map_update_elem(struct bpf_map *map, void *key, void *value, +- u64 map_flags) ++static long array_map_update_elem(struct bpf_map *map, void *key, void *value, ++ u64 map_flags) + { + struct bpf_array *array = container_of(map, struct bpf_array, map); + u32 index = *(u32 *)key; +@@ -386,7 +386,7 @@ int bpf_percpu_array_update(struct bpf_map *map, void *key, void *value, + } + + /* Called from syscall or from eBPF program */ +-static int array_map_delete_elem(struct bpf_map *map, void *key) ++static long array_map_delete_elem(struct bpf_map *map, void *key) + { + return -EINVAL; + } +@@ -686,8 +686,8 @@ static const struct bpf_iter_seq_info iter_seq_info = { + .seq_priv_size = sizeof(struct bpf_iter_seq_array_map_info), + }; + +-static int bpf_for_each_array_elem(struct bpf_map *map, bpf_callback_t callback_fn, +- void *callback_ctx, u64 flags) ++static long bpf_for_each_array_elem(struct bpf_map *map, bpf_callback_t callback_fn, ++ void *callback_ctx, u64 flags) + { + u32 i, key, num_elems = 0; + struct bpf_array *array; +@@ -847,7 +847,7 @@ int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file, + return 0; + } + +-static int fd_array_map_delete_elem(struct bpf_map *map, void *key) ++static long fd_array_map_delete_elem(struct bpf_map *map, void *key) + { + struct bpf_array *array = container_of(map, struct bpf_array, map); + void *old_ptr; +diff --git a/kernel/bpf/bloom_filter.c b/kernel/bpf/bloom_filter.c +index 48ee750849f25..b386a8fdf28cc 100644 +--- a/kernel/bpf/bloom_filter.c ++++ b/kernel/bpf/bloom_filter.c +@@ -41,7 +41,7 @@ static u32 hash(struct bpf_bloom_filter *bloom, void *value, + return h & bloom->bitset_mask; + } + +-static int bloom_map_peek_elem(struct bpf_map *map, void *value) ++static long bloom_map_peek_elem(struct bpf_map *map, void *value) + { + struct bpf_bloom_filter *bloom = + container_of(map, struct bpf_bloom_filter, map); +@@ -56,7 +56,7 @@ static int bloom_map_peek_elem(struct bpf_map *map, void *value) + return 0; + } + +-static int bloom_map_push_elem(struct bpf_map *map, void *value, u64 flags) ++static long bloom_map_push_elem(struct bpf_map *map, void *value, u64 flags) + { + struct bpf_bloom_filter *bloom = + container_of(map, struct bpf_bloom_filter, map); +@@ -73,12 +73,12 @@ static int bloom_map_push_elem(struct bpf_map *map, void *value, u64 flags) + return 0; + } + +-static int bloom_map_pop_elem(struct bpf_map *map, void *value) ++static long bloom_map_pop_elem(struct bpf_map *map, void *value) + { + return -EOPNOTSUPP; + } + +-static int bloom_map_delete_elem(struct bpf_map *map, void *value) ++static long bloom_map_delete_elem(struct bpf_map *map, void *value) + { + return -EOPNOTSUPP; + } +@@ -177,8 +177,8 @@ static void *bloom_map_lookup_elem(struct bpf_map *map, void *key) + return ERR_PTR(-EINVAL); + } + +-static int bloom_map_update_elem(struct bpf_map *map, void *key, +- void *value, u64 flags) ++static long bloom_map_update_elem(struct bpf_map *map, void *key, ++ void *value, u64 flags) + { + /* The eBPF program should use map_push_elem instead */ + return -EINVAL; +diff --git a/kernel/bpf/bpf_cgrp_storage.c b/kernel/bpf/bpf_cgrp_storage.c +index 6cdf6d9ed91df..d4a074247b64d 100644 +--- a/kernel/bpf/bpf_cgrp_storage.c ++++ b/kernel/bpf/bpf_cgrp_storage.c +@@ -100,8 +100,8 @@ static void *bpf_cgrp_storage_lookup_elem(struct bpf_map *map, void *key) + return sdata ? sdata->data : NULL; + } + +-static int bpf_cgrp_storage_update_elem(struct bpf_map *map, void *key, +- void *value, u64 map_flags) ++static long bpf_cgrp_storage_update_elem(struct bpf_map *map, void *key, ++ void *value, u64 map_flags) + { + struct bpf_local_storage_data *sdata; + struct cgroup *cgroup; +@@ -132,7 +132,7 @@ static int cgroup_storage_delete(struct cgroup *cgroup, struct bpf_map *map) + return 0; + } + +-static int bpf_cgrp_storage_delete_elem(struct bpf_map *map, void *key) ++static long bpf_cgrp_storage_delete_elem(struct bpf_map *map, void *key) + { + struct cgroup *cgroup; + int err, fd; +diff --git a/kernel/bpf/bpf_inode_storage.c b/kernel/bpf/bpf_inode_storage.c +index 05f4c66c9089f..a8afc656808b2 100644 +--- a/kernel/bpf/bpf_inode_storage.c ++++ b/kernel/bpf/bpf_inode_storage.c +@@ -97,8 +97,8 @@ static void *bpf_fd_inode_storage_lookup_elem(struct bpf_map *map, void *key) + return sdata ? sdata->data : NULL; + } + +-static int bpf_fd_inode_storage_update_elem(struct bpf_map *map, void *key, +- void *value, u64 map_flags) ++static long bpf_fd_inode_storage_update_elem(struct bpf_map *map, void *key, ++ void *value, u64 map_flags) + { + struct bpf_local_storage_data *sdata; + struct file *f; +@@ -133,7 +133,7 @@ static int inode_storage_delete(struct inode *inode, struct bpf_map *map) + return 0; + } + +-static int bpf_fd_inode_storage_delete_elem(struct bpf_map *map, void *key) ++static long bpf_fd_inode_storage_delete_elem(struct bpf_map *map, void *key) + { + struct file *f; + int fd, err; +diff --git a/kernel/bpf/bpf_struct_ops.c b/kernel/bpf/bpf_struct_ops.c +index ece9870cab68e..36c17271d38bd 100644 +--- a/kernel/bpf/bpf_struct_ops.c ++++ b/kernel/bpf/bpf_struct_ops.c +@@ -349,8 +349,8 @@ int bpf_struct_ops_prepare_trampoline(struct bpf_tramp_links *tlinks, + model, flags, tlinks, NULL); + } + +-static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, +- void *value, u64 flags) ++static long bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, ++ void *value, u64 flags) + { + struct bpf_struct_ops_map *st_map = (struct bpf_struct_ops_map *)map; + const struct bpf_struct_ops *st_ops = st_map->st_ops; +@@ -524,7 +524,7 @@ static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, + return err; + } + +-static int bpf_struct_ops_map_delete_elem(struct bpf_map *map, void *key) ++static long bpf_struct_ops_map_delete_elem(struct bpf_map *map, void *key) + { + enum bpf_struct_ops_state prev_state; + struct bpf_struct_ops_map *st_map; +diff --git a/kernel/bpf/bpf_task_storage.c b/kernel/bpf/bpf_task_storage.c +index 1e486055a523d..b29f0bf28fd15 100644 +--- a/kernel/bpf/bpf_task_storage.c ++++ b/kernel/bpf/bpf_task_storage.c +@@ -127,8 +127,8 @@ static void *bpf_pid_task_storage_lookup_elem(struct bpf_map *map, void *key) + return ERR_PTR(err); + } + +-static int bpf_pid_task_storage_update_elem(struct bpf_map *map, void *key, +- void *value, u64 map_flags) ++static long bpf_pid_task_storage_update_elem(struct bpf_map *map, void *key, ++ void *value, u64 map_flags) + { + struct bpf_local_storage_data *sdata; + struct task_struct *task; +@@ -180,7 +180,7 @@ static int task_storage_delete(struct task_struct *task, struct bpf_map *map, + return 0; + } + +-static int bpf_pid_task_storage_delete_elem(struct bpf_map *map, void *key) ++static long bpf_pid_task_storage_delete_elem(struct bpf_map *map, void *key) + { + struct task_struct *task; + unsigned int f_flags; +diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c +index e0b2d016f0bf9..d33785bedbe5d 100644 +--- a/kernel/bpf/cpumap.c ++++ b/kernel/bpf/cpumap.c +@@ -540,7 +540,7 @@ static void __cpu_map_entry_replace(struct bpf_cpu_map *cmap, + } + } + +-static int cpu_map_delete_elem(struct bpf_map *map, void *key) ++static long cpu_map_delete_elem(struct bpf_map *map, void *key) + { + struct bpf_cpu_map *cmap = container_of(map, struct bpf_cpu_map, map); + u32 key_cpu = *(u32 *)key; +@@ -553,8 +553,8 @@ static int cpu_map_delete_elem(struct bpf_map *map, void *key) + return 0; + } + +-static int cpu_map_update_elem(struct bpf_map *map, void *key, void *value, +- u64 map_flags) ++static long cpu_map_update_elem(struct bpf_map *map, void *key, void *value, ++ u64 map_flags) + { + struct bpf_cpu_map *cmap = container_of(map, struct bpf_cpu_map, map); + struct bpf_cpumap_val cpumap_value = {}; +@@ -667,7 +667,7 @@ static int cpu_map_get_next_key(struct bpf_map *map, void *key, void *next_key) + return 0; + } + +-static int cpu_map_redirect(struct bpf_map *map, u64 index, u64 flags) ++static long cpu_map_redirect(struct bpf_map *map, u64 index, u64 flags) + { + return __bpf_xdp_redirect_map(map, index, flags, 0, + __cpu_map_lookup_elem); +diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c +index d01e4c55b376a..95dafde24ba9c 100644 +--- a/kernel/bpf/devmap.c ++++ b/kernel/bpf/devmap.c +@@ -799,7 +799,7 @@ static void __dev_map_entry_free(struct rcu_head *rcu) + kfree(dev); + } + +-static int dev_map_delete_elem(struct bpf_map *map, void *key) ++static long dev_map_delete_elem(struct bpf_map *map, void *key) + { + struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map); + struct bpf_dtab_netdev *old_dev; +@@ -814,7 +814,7 @@ static int dev_map_delete_elem(struct bpf_map *map, void *key) + return 0; + } + +-static int dev_map_hash_delete_elem(struct bpf_map *map, void *key) ++static long dev_map_hash_delete_elem(struct bpf_map *map, void *key) + { + struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map); + struct bpf_dtab_netdev *old_dev; +@@ -885,8 +885,8 @@ static struct bpf_dtab_netdev *__dev_map_alloc_node(struct net *net, + return ERR_PTR(-EINVAL); + } + +-static int __dev_map_update_elem(struct net *net, struct bpf_map *map, +- void *key, void *value, u64 map_flags) ++static long __dev_map_update_elem(struct net *net, struct bpf_map *map, ++ void *key, void *value, u64 map_flags) + { + struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map); + struct bpf_dtab_netdev *dev, *old_dev; +@@ -925,15 +925,15 @@ static int __dev_map_update_elem(struct net *net, struct bpf_map *map, + return 0; + } + +-static int dev_map_update_elem(struct bpf_map *map, void *key, void *value, +- u64 map_flags) ++static long dev_map_update_elem(struct bpf_map *map, void *key, void *value, ++ u64 map_flags) + { + return __dev_map_update_elem(current->nsproxy->net_ns, + map, key, value, map_flags); + } + +-static int __dev_map_hash_update_elem(struct net *net, struct bpf_map *map, +- void *key, void *value, u64 map_flags) ++static long __dev_map_hash_update_elem(struct net *net, struct bpf_map *map, ++ void *key, void *value, u64 map_flags) + { + struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map); + struct bpf_dtab_netdev *dev, *old_dev; +@@ -985,21 +985,21 @@ static int __dev_map_hash_update_elem(struct net *net, struct bpf_map *map, + return err; + } + +-static int dev_map_hash_update_elem(struct bpf_map *map, void *key, void *value, +- u64 map_flags) ++static long dev_map_hash_update_elem(struct bpf_map *map, void *key, void *value, ++ u64 map_flags) + { + return __dev_map_hash_update_elem(current->nsproxy->net_ns, + map, key, value, map_flags); + } + +-static int dev_map_redirect(struct bpf_map *map, u64 ifindex, u64 flags) ++static long dev_map_redirect(struct bpf_map *map, u64 ifindex, u64 flags) + { + return __bpf_xdp_redirect_map(map, ifindex, flags, + BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS, + __dev_map_lookup_elem); + } + +-static int dev_hash_map_redirect(struct bpf_map *map, u64 ifindex, u64 flags) ++static long dev_hash_map_redirect(struct bpf_map *map, u64 ifindex, u64 flags) + { + return __bpf_xdp_redirect_map(map, ifindex, flags, + BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS, +diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c +index 5dfcb5ad0d068..90852e0e64f26 100644 +--- a/kernel/bpf/hashtab.c ++++ b/kernel/bpf/hashtab.c +@@ -1057,8 +1057,8 @@ static int check_flags(struct bpf_htab *htab, struct htab_elem *l_old, + } + + /* Called from syscall or from eBPF program */ +-static int htab_map_update_elem(struct bpf_map *map, void *key, void *value, +- u64 map_flags) ++static long htab_map_update_elem(struct bpf_map *map, void *key, void *value, ++ u64 map_flags) + { + struct bpf_htab *htab = container_of(map, struct bpf_htab, map); + struct htab_elem *l_new = NULL, *l_old; +@@ -1159,8 +1159,8 @@ static void htab_lru_push_free(struct bpf_htab *htab, struct htab_elem *elem) + bpf_lru_push_free(&htab->lru, &elem->lru_node); + } + +-static int htab_lru_map_update_elem(struct bpf_map *map, void *key, void *value, +- u64 map_flags) ++static long htab_lru_map_update_elem(struct bpf_map *map, void *key, void *value, ++ u64 map_flags) + { + struct bpf_htab *htab = container_of(map, struct bpf_htab, map); + struct htab_elem *l_new, *l_old = NULL; +@@ -1226,9 +1226,9 @@ static int htab_lru_map_update_elem(struct bpf_map *map, void *key, void *value, + return ret; + } + +-static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key, +- void *value, u64 map_flags, +- bool onallcpus) ++static long __htab_percpu_map_update_elem(struct bpf_map *map, void *key, ++ void *value, u64 map_flags, ++ bool onallcpus) + { + struct bpf_htab *htab = container_of(map, struct bpf_htab, map); + struct htab_elem *l_new = NULL, *l_old; +@@ -1281,9 +1281,9 @@ static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key, + return ret; + } + +-static int __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key, +- void *value, u64 map_flags, +- bool onallcpus) ++static long __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key, ++ void *value, u64 map_flags, ++ bool onallcpus) + { + struct bpf_htab *htab = container_of(map, struct bpf_htab, map); + struct htab_elem *l_new = NULL, *l_old; +@@ -1348,21 +1348,21 @@ static int __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key, + return ret; + } + +-static int htab_percpu_map_update_elem(struct bpf_map *map, void *key, +- void *value, u64 map_flags) ++static long htab_percpu_map_update_elem(struct bpf_map *map, void *key, ++ void *value, u64 map_flags) + { + return __htab_percpu_map_update_elem(map, key, value, map_flags, false); + } + +-static int htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key, +- void *value, u64 map_flags) ++static long htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key, ++ void *value, u64 map_flags) + { + return __htab_lru_percpu_map_update_elem(map, key, value, map_flags, + false); + } + + /* Called from syscall or from eBPF program */ +-static int htab_map_delete_elem(struct bpf_map *map, void *key) ++static long htab_map_delete_elem(struct bpf_map *map, void *key) + { + struct bpf_htab *htab = container_of(map, struct bpf_htab, map); + struct hlist_nulls_head *head; +@@ -1398,7 +1398,7 @@ static int htab_map_delete_elem(struct bpf_map *map, void *key) + return ret; + } + +-static int htab_lru_map_delete_elem(struct bpf_map *map, void *key) ++static long htab_lru_map_delete_elem(struct bpf_map *map, void *key) + { + struct bpf_htab *htab = container_of(map, struct bpf_htab, map); + struct hlist_nulls_head *head; +@@ -2119,8 +2119,8 @@ static const struct bpf_iter_seq_info iter_seq_info = { + .seq_priv_size = sizeof(struct bpf_iter_seq_hash_map_info), + }; + +-static int bpf_for_each_hash_elem(struct bpf_map *map, bpf_callback_t callback_fn, +- void *callback_ctx, u64 flags) ++static long bpf_for_each_hash_elem(struct bpf_map *map, bpf_callback_t callback_fn, ++ void *callback_ctx, u64 flags) + { + struct bpf_htab *htab = container_of(map, struct bpf_htab, map); + struct hlist_nulls_head *head; +diff --git a/kernel/bpf/local_storage.c b/kernel/bpf/local_storage.c +index e90d9f63edc5d..66d8ce2ab5b34 100644 +--- a/kernel/bpf/local_storage.c ++++ b/kernel/bpf/local_storage.c +@@ -141,8 +141,8 @@ static void *cgroup_storage_lookup_elem(struct bpf_map *_map, void *key) + return &READ_ONCE(storage->buf)->data[0]; + } + +-static int cgroup_storage_update_elem(struct bpf_map *map, void *key, +- void *value, u64 flags) ++static long cgroup_storage_update_elem(struct bpf_map *map, void *key, ++ void *value, u64 flags) + { + struct bpf_cgroup_storage *storage; + struct bpf_storage_buffer *new; +@@ -348,7 +348,7 @@ static void cgroup_storage_map_free(struct bpf_map *_map) + bpf_map_area_free(map); + } + +-static int cgroup_storage_delete_elem(struct bpf_map *map, void *key) ++static long cgroup_storage_delete_elem(struct bpf_map *map, void *key) + { + return -EINVAL; + } +diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c +index d833496e9e426..27980506fc7d5 100644 +--- a/kernel/bpf/lpm_trie.c ++++ b/kernel/bpf/lpm_trie.c +@@ -300,8 +300,8 @@ static struct lpm_trie_node *lpm_trie_node_alloc(const struct lpm_trie *trie, + } + + /* Called from syscall or from eBPF program */ +-static int trie_update_elem(struct bpf_map *map, +- void *_key, void *value, u64 flags) ++static long trie_update_elem(struct bpf_map *map, ++ void *_key, void *value, u64 flags) + { + struct lpm_trie *trie = container_of(map, struct lpm_trie, map); + struct lpm_trie_node *node, *im_node = NULL, *new_node = NULL; +@@ -431,7 +431,7 @@ static int trie_update_elem(struct bpf_map *map, + } + + /* Called from syscall or from eBPF program */ +-static int trie_delete_elem(struct bpf_map *map, void *_key) ++static long trie_delete_elem(struct bpf_map *map, void *_key) + { + struct lpm_trie *trie = container_of(map, struct lpm_trie, map); + struct bpf_lpm_trie_key *key = _key; +diff --git a/kernel/bpf/queue_stack_maps.c b/kernel/bpf/queue_stack_maps.c +index 8a5e060de63bc..80f958ff63966 100644 +--- a/kernel/bpf/queue_stack_maps.c ++++ b/kernel/bpf/queue_stack_maps.c +@@ -95,7 +95,7 @@ static void queue_stack_map_free(struct bpf_map *map) + bpf_map_area_free(qs); + } + +-static int __queue_map_get(struct bpf_map *map, void *value, bool delete) ++static long __queue_map_get(struct bpf_map *map, void *value, bool delete) + { + struct bpf_queue_stack *qs = bpf_queue_stack(map); + unsigned long flags; +@@ -124,7 +124,7 @@ static int __queue_map_get(struct bpf_map *map, void *value, bool delete) + } + + +-static int __stack_map_get(struct bpf_map *map, void *value, bool delete) ++static long __stack_map_get(struct bpf_map *map, void *value, bool delete) + { + struct bpf_queue_stack *qs = bpf_queue_stack(map); + unsigned long flags; +@@ -156,32 +156,32 @@ static int __stack_map_get(struct bpf_map *map, void *value, bool delete) + } + + /* Called from syscall or from eBPF program */ +-static int queue_map_peek_elem(struct bpf_map *map, void *value) ++static long queue_map_peek_elem(struct bpf_map *map, void *value) + { + return __queue_map_get(map, value, false); + } + + /* Called from syscall or from eBPF program */ +-static int stack_map_peek_elem(struct bpf_map *map, void *value) ++static long stack_map_peek_elem(struct bpf_map *map, void *value) + { + return __stack_map_get(map, value, false); + } + + /* Called from syscall or from eBPF program */ +-static int queue_map_pop_elem(struct bpf_map *map, void *value) ++static long queue_map_pop_elem(struct bpf_map *map, void *value) + { + return __queue_map_get(map, value, true); + } + + /* Called from syscall or from eBPF program */ +-static int stack_map_pop_elem(struct bpf_map *map, void *value) ++static long stack_map_pop_elem(struct bpf_map *map, void *value) + { + return __stack_map_get(map, value, true); + } + + /* Called from syscall or from eBPF program */ +-static int queue_stack_map_push_elem(struct bpf_map *map, void *value, +- u64 flags) ++static long queue_stack_map_push_elem(struct bpf_map *map, void *value, ++ u64 flags) + { + struct bpf_queue_stack *qs = bpf_queue_stack(map); + unsigned long irq_flags; +@@ -227,14 +227,14 @@ static void *queue_stack_map_lookup_elem(struct bpf_map *map, void *key) + } + + /* Called from syscall or from eBPF program */ +-static int queue_stack_map_update_elem(struct bpf_map *map, void *key, +- void *value, u64 flags) ++static long queue_stack_map_update_elem(struct bpf_map *map, void *key, ++ void *value, u64 flags) + { + return -EINVAL; + } + + /* Called from syscall or from eBPF program */ +-static int queue_stack_map_delete_elem(struct bpf_map *map, void *key) ++static long queue_stack_map_delete_elem(struct bpf_map *map, void *key) + { + return -EINVAL; + } +diff --git a/kernel/bpf/reuseport_array.c b/kernel/bpf/reuseport_array.c +index 82c61612f382a..d1188b0350914 100644 +--- a/kernel/bpf/reuseport_array.c ++++ b/kernel/bpf/reuseport_array.c +@@ -59,7 +59,7 @@ static void *reuseport_array_lookup_elem(struct bpf_map *map, void *key) + } + + /* Called from syscall only */ +-static int reuseport_array_delete_elem(struct bpf_map *map, void *key) ++static long reuseport_array_delete_elem(struct bpf_map *map, void *key) + { + struct reuseport_array *array = reuseport_array(map); + u32 index = *(u32 *)key; +diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c +index 80f4b4d88aafa..ce8ca5511ac13 100644 +--- a/kernel/bpf/ringbuf.c ++++ b/kernel/bpf/ringbuf.c +@@ -241,13 +241,13 @@ static void *ringbuf_map_lookup_elem(struct bpf_map *map, void *key) + return ERR_PTR(-ENOTSUPP); + } + +-static int ringbuf_map_update_elem(struct bpf_map *map, void *key, void *value, +- u64 flags) ++static long ringbuf_map_update_elem(struct bpf_map *map, void *key, void *value, ++ u64 flags) + { + return -ENOTSUPP; + } + +-static int ringbuf_map_delete_elem(struct bpf_map *map, void *key) ++static long ringbuf_map_delete_elem(struct bpf_map *map, void *key) + { + return -ENOTSUPP; + } +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index aecea7451b610..496ce1695dd89 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -618,14 +618,14 @@ static int stack_map_get_next_key(struct bpf_map *map, void *key, + return 0; + } + +-static int stack_map_update_elem(struct bpf_map *map, void *key, void *value, +- u64 map_flags) ++static long stack_map_update_elem(struct bpf_map *map, void *key, void *value, ++ u64 map_flags) + { + return -EINVAL; + } + + /* Called from syscall or from eBPF program */ +-static int stack_map_delete_elem(struct bpf_map *map, void *key) ++static long stack_map_delete_elem(struct bpf_map *map, void *key) + { + struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map); + struct stack_map_bucket *old_bucket; +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index c61216f88ad6a..bb8579a3bf310 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -16113,21 +16113,21 @@ static int do_misc_fixups(struct bpf_verifier_env *env) + BUILD_BUG_ON(!__same_type(ops->map_lookup_elem, + (void *(*)(struct bpf_map *map, void *key))NULL)); + BUILD_BUG_ON(!__same_type(ops->map_delete_elem, +- (int (*)(struct bpf_map *map, void *key))NULL)); ++ (long (*)(struct bpf_map *map, void *key))NULL)); + BUILD_BUG_ON(!__same_type(ops->map_update_elem, +- (int (*)(struct bpf_map *map, void *key, void *value, ++ (long (*)(struct bpf_map *map, void *key, void *value, + u64 flags))NULL)); + BUILD_BUG_ON(!__same_type(ops->map_push_elem, +- (int (*)(struct bpf_map *map, void *value, ++ (long (*)(struct bpf_map *map, void *value, + u64 flags))NULL)); + BUILD_BUG_ON(!__same_type(ops->map_pop_elem, +- (int (*)(struct bpf_map *map, void *value))NULL)); ++ (long (*)(struct bpf_map *map, void *value))NULL)); + BUILD_BUG_ON(!__same_type(ops->map_peek_elem, +- (int (*)(struct bpf_map *map, void *value))NULL)); ++ (long (*)(struct bpf_map *map, void *value))NULL)); + BUILD_BUG_ON(!__same_type(ops->map_redirect, +- (int (*)(struct bpf_map *map, u64 index, u64 flags))NULL)); ++ (long (*)(struct bpf_map *map, u64 index, u64 flags))NULL)); + BUILD_BUG_ON(!__same_type(ops->map_for_each_callback, +- (int (*)(struct bpf_map *map, ++ (long (*)(struct bpf_map *map, + bpf_callback_t callback_fn, + void *callback_ctx, + u64 flags))NULL)); +diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c +index bb378c33f542c..6a4b3e9313241 100644 +--- a/net/core/bpf_sk_storage.c ++++ b/net/core/bpf_sk_storage.c +@@ -100,8 +100,8 @@ static void *bpf_fd_sk_storage_lookup_elem(struct bpf_map *map, void *key) + return ERR_PTR(err); + } + +-static int bpf_fd_sk_storage_update_elem(struct bpf_map *map, void *key, +- void *value, u64 map_flags) ++static long bpf_fd_sk_storage_update_elem(struct bpf_map *map, void *key, ++ void *value, u64 map_flags) + { + struct bpf_local_storage_data *sdata; + struct socket *sock; +@@ -120,7 +120,7 @@ static int bpf_fd_sk_storage_update_elem(struct bpf_map *map, void *key, + return err; + } + +-static int bpf_fd_sk_storage_delete_elem(struct bpf_map *map, void *key) ++static long bpf_fd_sk_storage_delete_elem(struct bpf_map *map, void *key) + { + struct socket *sock; + int fd, err; +diff --git a/net/core/sock_map.c b/net/core/sock_map.c +index a68a7290a3b2b..a055139f410e2 100644 +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -437,7 +437,7 @@ static void sock_map_delete_from_link(struct bpf_map *map, struct sock *sk, + __sock_map_delete(stab, sk, link_raw); + } + +-static int sock_map_delete_elem(struct bpf_map *map, void *key) ++static long sock_map_delete_elem(struct bpf_map *map, void *key) + { + struct bpf_stab *stab = container_of(map, struct bpf_stab, map); + u32 i = *(u32 *)key; +@@ -587,8 +587,8 @@ int sock_map_update_elem_sys(struct bpf_map *map, void *key, void *value, + return ret; + } + +-static int sock_map_update_elem(struct bpf_map *map, void *key, +- void *value, u64 flags) ++static long sock_map_update_elem(struct bpf_map *map, void *key, ++ void *value, u64 flags) + { + struct sock *sk = (struct sock *)value; + int ret; +@@ -916,7 +916,7 @@ static void sock_hash_delete_from_link(struct bpf_map *map, struct sock *sk, + raw_spin_unlock_bh(&bucket->lock); + } + +-static int sock_hash_delete_elem(struct bpf_map *map, void *key) ++static long sock_hash_delete_elem(struct bpf_map *map, void *key) + { + struct bpf_shtab *htab = container_of(map, struct bpf_shtab, map); + u32 hash, key_size = map->key_size; +diff --git a/net/xdp/xskmap.c b/net/xdp/xskmap.c +index 771d0fa90ef58..3436a8efb8dc7 100644 +--- a/net/xdp/xskmap.c ++++ b/net/xdp/xskmap.c +@@ -150,8 +150,8 @@ static void *xsk_map_lookup_elem_sys_only(struct bpf_map *map, void *key) + return ERR_PTR(-EOPNOTSUPP); + } + +-static int xsk_map_update_elem(struct bpf_map *map, void *key, void *value, +- u64 map_flags) ++static long xsk_map_update_elem(struct bpf_map *map, void *key, void *value, ++ u64 map_flags) + { + struct xsk_map *m = container_of(map, struct xsk_map, map); + struct xdp_sock __rcu **map_entry; +@@ -211,7 +211,7 @@ static int xsk_map_update_elem(struct bpf_map *map, void *key, void *value, + return err; + } + +-static int xsk_map_delete_elem(struct bpf_map *map, void *key) ++static long xsk_map_delete_elem(struct bpf_map *map, void *key) + { + struct xsk_map *m = container_of(map, struct xsk_map, map); + struct xdp_sock __rcu **map_entry; +@@ -231,7 +231,7 @@ static int xsk_map_delete_elem(struct bpf_map *map, void *key) + return 0; + } + +-static int xsk_map_redirect(struct bpf_map *map, u64 index, u64 flags) ++static long xsk_map_redirect(struct bpf_map *map, u64 index, u64 flags) + { + return __bpf_xdp_redirect_map(map, index, flags, 0, + __xsk_map_lookup_elem); +-- +2.39.2 + diff --git a/queue-6.2/bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch b/queue-6.2/bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch new file mode 100644 index 00000000000..76244020879 --- /dev/null +++ b/queue-6.2/bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch @@ -0,0 +1,83 @@ +From 8ec4c4366b0ab5ff23899273c11702e809cd2b52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 20:26:22 +0800 +Subject: bpf, sockmap: fix deadlocks in the sockhash and sockmap + +From: Xin Liu + +[ Upstream commit ed17aa92dc56b6d8883e4b7a8f1c6fbf5ed6cd29 ] + +When huang uses sched_switch tracepoint, the tracepoint +does only one thing in the mounted ebpf program, which +deletes the fixed elements in sockhash ([0]) + +It seems that elements in sockhash are rarely actively +deleted by users or ebpf program. Therefore, we do not +pay much attention to their deletion. Compared with hash +maps, sockhash only provides spin_lock_bh protection. +This causes it to appear to have self-locking behavior +in the interrupt context. + + [0]:https://lore.kernel.org/all/CABcoxUayum5oOqFMMqAeWuS8+EzojquSOSyDA3J_2omY=2EeAg@mail.gmail.com/ + +Reported-by: Hsin-Wei Hung +Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: Xin Liu +Acked-by: John Fastabend +Link: https://lore.kernel.org/r/20230406122622.109978-1-liuxin350@huawei.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/sock_map.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/core/sock_map.c b/net/core/sock_map.c +index a055139f410e2..dd5d7b1fa3580 100644 +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -414,8 +414,9 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, + { + struct sock *sk; + int err = 0; ++ unsigned long flags; + +- raw_spin_lock_bh(&stab->lock); ++ raw_spin_lock_irqsave(&stab->lock, flags); + sk = *psk; + if (!sk_test || sk_test == sk) + sk = xchg(psk, NULL); +@@ -425,7 +426,7 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, + else + err = -EINVAL; + +- raw_spin_unlock_bh(&stab->lock); ++ raw_spin_unlock_irqrestore(&stab->lock, flags); + return err; + } + +@@ -923,11 +924,12 @@ static long sock_hash_delete_elem(struct bpf_map *map, void *key) + struct bpf_shtab_bucket *bucket; + struct bpf_shtab_elem *elem; + int ret = -ENOENT; ++ unsigned long flags; + + hash = sock_hash_bucket_hash(key, key_size); + bucket = sock_hash_select_bucket(htab, hash); + +- raw_spin_lock_bh(&bucket->lock); ++ raw_spin_lock_irqsave(&bucket->lock, flags); + elem = sock_hash_lookup_elem_raw(&bucket->head, hash, key, key_size); + if (elem) { + hlist_del_rcu(&elem->node); +@@ -935,7 +937,7 @@ static long sock_hash_delete_elem(struct bpf_map *map, void *key) + sock_hash_free_elem(htab, elem); + ret = 0; + } +- raw_spin_unlock_bh(&bucket->lock); ++ raw_spin_unlock_irqrestore(&bucket->lock, flags); + return ret; + } + +-- +2.39.2 + diff --git a/queue-6.2/bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch b/queue-6.2/bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch new file mode 100644 index 00000000000..5281078b998 --- /dev/null +++ b/queue-6.2/bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch @@ -0,0 +1,101 @@ +From b7001e9863c36f4d320a751cbf73921e45c24518 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 20:28:42 +0200 +Subject: bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap + +From: Daniel Borkmann + +[ Upstream commit 8c5c2a4898e3d6bad86e29d471e023c8a19ba799 ] + +syzbot reported a splat and bisected it to recent commit ed17aa92dc56 ("bpf, +sockmap: fix deadlocks in the sockhash and sockmap"): + + [...] + WARNING: CPU: 1 PID: 9280 at kernel/softirq.c:376 __local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376 + Modules linked in: + CPU: 1 PID: 9280 Comm: syz-executor.1 Not tainted 6.2.0-syzkaller-13249-gd319f344561d #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 + RIP: 0010:__local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376 + [...] + Call Trace: + + spin_unlock_bh include/linux/spinlock.h:395 [inline] + sock_map_del_link+0x2ea/0x510 net/core/sock_map.c:165 + sock_map_unref+0xb0/0x1d0 net/core/sock_map.c:184 + sock_hash_delete_elem+0x1ec/0x2a0 net/core/sock_map.c:945 + map_delete_elem kernel/bpf/syscall.c:1536 [inline] + __sys_bpf+0x2edc/0x53e0 kernel/bpf/syscall.c:5053 + __do_sys_bpf kernel/bpf/syscall.c:5166 [inline] + __se_sys_bpf kernel/bpf/syscall.c:5164 [inline] + __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5164 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + RIP: 0033:0x7fe8f7c8c169 + + [...] + +Revert for now until we have a proper solution. + +Fixes: ed17aa92dc56 ("bpf, sockmap: fix deadlocks in the sockhash and sockmap") +Reported-by: syzbot+49f6cef45247ff249498@syzkaller.appspotmail.com +Cc: Hsin-Wei Hung +Cc: Xin Liu +Cc: John Fastabend +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/000000000000f1db9605f939720e@google.com/ +Signed-off-by: Sasha Levin +--- + net/core/sock_map.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/net/core/sock_map.c b/net/core/sock_map.c +index dd5d7b1fa3580..a055139f410e2 100644 +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -414,9 +414,8 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, + { + struct sock *sk; + int err = 0; +- unsigned long flags; + +- raw_spin_lock_irqsave(&stab->lock, flags); ++ raw_spin_lock_bh(&stab->lock); + sk = *psk; + if (!sk_test || sk_test == sk) + sk = xchg(psk, NULL); +@@ -426,7 +425,7 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, + else + err = -EINVAL; + +- raw_spin_unlock_irqrestore(&stab->lock, flags); ++ raw_spin_unlock_bh(&stab->lock); + return err; + } + +@@ -924,12 +923,11 @@ static long sock_hash_delete_elem(struct bpf_map *map, void *key) + struct bpf_shtab_bucket *bucket; + struct bpf_shtab_elem *elem; + int ret = -ENOENT; +- unsigned long flags; + + hash = sock_hash_bucket_hash(key, key_size); + bucket = sock_hash_select_bucket(htab, hash); + +- raw_spin_lock_irqsave(&bucket->lock, flags); ++ raw_spin_lock_bh(&bucket->lock); + elem = sock_hash_lookup_elem_raw(&bucket->head, hash, key, key_size); + if (elem) { + hlist_del_rcu(&elem->node); +@@ -937,7 +935,7 @@ static long sock_hash_delete_elem(struct bpf_map *map, void *key) + sock_hash_free_elem(htab, elem); + ret = 0; + } +- raw_spin_unlock_irqrestore(&bucket->lock, flags); ++ raw_spin_unlock_bh(&bucket->lock); + return ret; + } + +-- +2.39.2 + diff --git a/queue-6.2/bpf-take-into-account-liveness-when-propagating-prec.patch b/queue-6.2/bpf-take-into-account-liveness-when-propagating-prec.patch new file mode 100644 index 00000000000..b4ab6f5037a --- /dev/null +++ b/queue-6.2/bpf-take-into-account-liveness-when-propagating-prec.patch @@ -0,0 +1,61 @@ +From 0c51b02cdfc284183eb32fcdab2c32afbde16a9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 14:41:31 -0800 +Subject: bpf: take into account liveness when propagating precision + +From: Andrii Nakryiko + +[ Upstream commit 52c2b005a3c18c565fc70cfd0ca49375f301e952 ] + +When doing state comparison, if old state has register that is not +marked as REG_LIVE_READ, then we just skip comparison, regardless what's +the state of corresponing register in current state. This is because not +REG_LIVE_READ register is irrelevant for further program execution and +correctness. All good here. + +But when we get to precision propagation, after two states were declared +equivalent, we don't take into account old register's liveness, and thus +attempt to propagate precision for register in current state even if +that register in old state was not REG_LIVE_READ anymore. This is bad, +because register in current state could be anything at all and this +could cause -EFAULT due to internal logic bugs. + +Fix by taking into account REG_LIVE_READ liveness mark to keep the logic +in state comparison in sync with precision propagation. + +Fixes: a3ce685dd01a ("bpf: fix precision tracking") +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/r/20230309224131.57449-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 9db6afc86733b..a53ba87a1cd2a 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -13674,7 +13674,8 @@ static int propagate_precision(struct bpf_verifier_env *env, + state_reg = state->regs; + for (i = 0; i < BPF_REG_FP; i++, state_reg++) { + if (state_reg->type != SCALAR_VALUE || +- !state_reg->precise) ++ !state_reg->precise || ++ !(state_reg->live & REG_LIVE_READ)) + continue; + if (env->log.level & BPF_LOG_LEVEL2) + verbose(env, "frame %d: propagating r%d\n", i, fr); +@@ -13688,7 +13689,8 @@ static int propagate_precision(struct bpf_verifier_env *env, + continue; + state_reg = &state->stack[i].spilled_ptr; + if (state_reg->type != SCALAR_VALUE || +- !state_reg->precise) ++ !state_reg->precise || ++ !(state_reg->live & REG_LIVE_READ)) + continue; + if (env->log.level & BPF_LOG_LEVEL2) + verbose(env, "frame %d: propagating fp%d\n", +-- +2.39.2 + diff --git a/queue-6.2/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch b/queue-6.2/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch new file mode 100644 index 00000000000..68f010d1897 --- /dev/null +++ b/queue-6.2/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch @@ -0,0 +1,46 @@ +From cc9a5dc1e1b3f6b4f0d43e63363d83f07b58c591 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 14:21:15 +0100 +Subject: bpftool: Fix bug for long instructions in program CFG dumps + +From: Quentin Monnet + +[ Upstream commit 67cf52cdb6c8fa6365d29106555dacf95c9fd374 ] + +When dumping the control flow graphs for programs using the 16-byte long +load instruction, we need to skip the second part of this instruction +when looking for the next instruction to process. Otherwise, we end up +printing "BUG_ld_00" from the kernel disassembler in the CFG. + +Fixes: efcef17a6d65 ("tools: bpftool: generate .dot graph from CFG information") +Signed-off-by: Quentin Monnet +Link: https://lore.kernel.org/r/20230405132120.59886-3-quentin@isovalent.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/xlated_dumper.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c +index 6fe3134ae45d4..3daa05d9bbb73 100644 +--- a/tools/bpf/bpftool/xlated_dumper.c ++++ b/tools/bpf/bpftool/xlated_dumper.c +@@ -372,8 +372,15 @@ void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end, + struct bpf_insn *insn_start = buf_start; + struct bpf_insn *insn_end = buf_end; + struct bpf_insn *cur = insn_start; ++ bool double_insn = false; + + for (; cur <= insn_end; cur++) { ++ if (double_insn) { ++ double_insn = false; ++ continue; ++ } ++ double_insn = cur->code == (BPF_LD | BPF_IMM | BPF_DW); ++ + printf("% 4d: ", (int)(cur - insn_start + start_idx)); + print_bpf_insn(&cbs, cur, true); + if (cur != insn_end) +-- +2.39.2 + diff --git a/queue-6.2/cacheinfo-check-sib_leaf-in-cache_leaves_are_shared.patch b/queue-6.2/cacheinfo-check-sib_leaf-in-cache_leaves_are_shared.patch new file mode 100644 index 00000000000..82df98dfdda --- /dev/null +++ b/queue-6.2/cacheinfo-check-sib_leaf-in-cache_leaves_are_shared.patch @@ -0,0 +1,59 @@ +From 9ef377191040383c36ccde353a88519a9cb26f5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 10:14:49 +0200 +Subject: cacheinfo: Check sib_leaf in cache_leaves_are_shared() + +From: Pierre Gondois + +[ Upstream commit 7a306e3eabf2b2fd8cffa69b87b32dbf814d79ce ] + +If there is no ACPI/DT information, it is assumed that L1 caches +are private and L2 (and higher) caches are shared. A cache is +'shared' between two CPUs if it is accessible from these two +CPUs. + +Each CPU owns a representation (i.e. has a dedicated cacheinfo struct) +of the caches it has access to. cache_leaves_are_shared() tries to +identify whether two representations are designating the same actual +cache. + +In cache_leaves_are_shared(), if 'this_leaf' is a L2 cache (or higher) +and 'sib_leaf' is a L1 cache, the caches are detected as shared as +only this_leaf's cache level is checked. +This is leads to setting sib_leaf as being shared with another CPU, +which is incorrect as this is a L1 cache. + +Check 'sib_leaf->level'. Also update the comment as the function is +called when populating 'shared_cpu_map'. + +Fixes: f16d1becf96f ("cacheinfo: Use cache identifiers to check if the caches are shared if available") +Signed-off-by: Pierre Gondois +Reviewed-by: Conor Dooley +Link: https://lore.kernel.org/r/20230414081453.244787-2-pierre.gondois@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/base/cacheinfo.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c +index f05acf3c16c6b..88205a240fb2e 100644 +--- a/drivers/base/cacheinfo.c ++++ b/drivers/base/cacheinfo.c +@@ -38,11 +38,10 @@ static inline bool cache_leaves_are_shared(struct cacheinfo *this_leaf, + { + /* + * For non DT/ACPI systems, assume unique level 1 caches, +- * system-wide shared caches for all other levels. This will be used +- * only if arch specific code has not populated shared_cpu_map ++ * system-wide shared caches for all other levels. + */ + if (!(IS_ENABLED(CONFIG_OF) || IS_ENABLED(CONFIG_ACPI))) +- return !(this_leaf->level == 1); ++ return (this_leaf->level != 1) && (sib_leaf->level != 1); + + if ((sib_leaf->attributes & CACHE_ID) && + (this_leaf->attributes & CACHE_ID)) +-- +2.39.2 + diff --git a/queue-6.2/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch b/queue-6.2/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch new file mode 100644 index 00000000000..83874f0f710 --- /dev/null +++ b/queue-6.2/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch @@ -0,0 +1,74 @@ +From c8f444624ae4ea08cf3cf28ff6828ec85d0e9274 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 09:32:27 +0100 +Subject: clk: add missing of_node_put() in "assigned-clocks" property parsing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Léger + +[ Upstream commit 27a6e1b09a782517fddac91259970ac466a3f7b6 ] + +When returning from of_parse_phandle_with_args(), the np member of the +of_phandle_args structure should be put after usage. Add missing +of_node_put() calls in both __set_clk_parents() and __set_clk_rates(). + +Fixes: 86be408bfbd8 ("clk: Support for clock parents and rates assigned from device tree") +Signed-off-by: Clément Léger +Link: https://lore.kernel.org/r/20230131083227.10990-1-clement.leger@bootlin.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-conf.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/clk-conf.c b/drivers/clk/clk-conf.c +index 2ef819606c417..1a4e6340f95ce 100644 +--- a/drivers/clk/clk-conf.c ++++ b/drivers/clk/clk-conf.c +@@ -33,9 +33,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier) + else + return rc; + } +- if (clkspec.np == node && !clk_supplier) ++ if (clkspec.np == node && !clk_supplier) { ++ of_node_put(clkspec.np); + return 0; ++ } + pclk = of_clk_get_from_provider(&clkspec); ++ of_node_put(clkspec.np); + if (IS_ERR(pclk)) { + if (PTR_ERR(pclk) != -EPROBE_DEFER) + pr_warn("clk: couldn't get parent clock %d for %pOF\n", +@@ -48,10 +51,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier) + if (rc < 0) + goto err; + if (clkspec.np == node && !clk_supplier) { ++ of_node_put(clkspec.np); + rc = 0; + goto err; + } + clk = of_clk_get_from_provider(&clkspec); ++ of_node_put(clkspec.np); + if (IS_ERR(clk)) { + if (PTR_ERR(clk) != -EPROBE_DEFER) + pr_warn("clk: couldn't get assigned clock %d for %pOF\n", +@@ -93,10 +98,13 @@ static int __set_clk_rates(struct device_node *node, bool clk_supplier) + else + return rc; + } +- if (clkspec.np == node && !clk_supplier) ++ if (clkspec.np == node && !clk_supplier) { ++ of_node_put(clkspec.np); + return 0; ++ } + + clk = of_clk_get_from_provider(&clkspec); ++ of_node_put(clkspec.np); + if (IS_ERR(clk)) { + if (PTR_ERR(clk) != -EPROBE_DEFER) + pr_warn("clk: couldn't get clock %d for %pOF\n", +-- +2.39.2 + diff --git a/queue-6.2/clk-at91-clk-sam9x60-pll-fix-return-value-check.patch b/queue-6.2/clk-at91-clk-sam9x60-pll-fix-return-value-check.patch new file mode 100644 index 00000000000..75d1b96d572 --- /dev/null +++ b/queue-6.2/clk-at91-clk-sam9x60-pll-fix-return-value-check.patch @@ -0,0 +1,38 @@ +From 805a3115f37272d8c2f90e5b31e87aae5108bba2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 12:59:31 +0200 +Subject: clk: at91: clk-sam9x60-pll: fix return value check + +From: Claudiu Beznea + +[ Upstream commit 1bd8e27fd0db0fe7f489213836dcbab92934f8fa ] + +sam9x60_frac_pll_compute_mul_frac() can't return zero. Remove the check +against zero to reflect this. + +Fixes: 43b1bb4a9b3e ("clk: at91: clk-sam9x60-pll: re-factor to support plls with multiple outputs") +Reported-by: Dan Carpenter +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230227105931.2812412-1-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-sam9x60-pll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c +index d757003004cbb..0882ed01d5c27 100644 +--- a/drivers/clk/at91/clk-sam9x60-pll.c ++++ b/drivers/clk/at91/clk-sam9x60-pll.c +@@ -668,7 +668,7 @@ sam9x60_clk_register_frac_pll(struct regmap *regmap, spinlock_t *lock, + + ret = sam9x60_frac_pll_compute_mul_frac(&frac->core, FCORE_MIN, + parent_rate, true); +- if (ret <= 0) { ++ if (ret < 0) { + hw = ERR_PTR(ret); + goto free; + } +-- +2.39.2 + diff --git a/queue-6.2/clk-imx-fracn-gppll-disable-hardware-select-control.patch b/queue-6.2/clk-imx-fracn-gppll-disable-hardware-select-control.patch new file mode 100644 index 00000000000..d550af9b03d --- /dev/null +++ b/queue-6.2/clk-imx-fracn-gppll-disable-hardware-select-control.patch @@ -0,0 +1,49 @@ +From 392bab64248fab331ffcf582bd01f59030972467 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 17:52:55 +0800 +Subject: clk: imx: fracn-gppll: disable hardware select control + +From: Peng Fan + +[ Upstream commit 4435467b15b069e5a6f50ca9a9260e86b74dbc13 ] + +When programming PLL, should disable Hardware control select to make PLL +controlled by register, not hardware inputs through OSCPLL. + +Fixes: 1b26cb8a77a4 ("clk: imx: support fracn gppll") +Signed-off-by: Peng Fan +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20230403095300.3386988-3-peng.fan@oss.nxp.com +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-fracn-gppll.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/clk/imx/clk-fracn-gppll.c b/drivers/clk/imx/clk-fracn-gppll.c +index ec50c41e2a4c9..f6674110a88e0 100644 +--- a/drivers/clk/imx/clk-fracn-gppll.c ++++ b/drivers/clk/imx/clk-fracn-gppll.c +@@ -15,6 +15,7 @@ + #include "clk.h" + + #define PLL_CTRL 0x0 ++#define HW_CTRL_SEL BIT(16) + #define CLKMUX_BYPASS BIT(2) + #define CLKMUX_EN BIT(1) + #define POWERUP_MASK BIT(0) +@@ -193,6 +194,11 @@ static int clk_fracn_gppll_set_rate(struct clk_hw *hw, unsigned long drate, + + rate = imx_get_pll_settings(pll, drate); + ++ /* Hardware control select disable. PLL is control by register */ ++ tmp = readl_relaxed(pll->base + PLL_CTRL); ++ tmp &= ~HW_CTRL_SEL; ++ writel_relaxed(tmp, pll->base + PLL_CTRL); ++ + /* Disable output */ + tmp = readl_relaxed(pll->base + PLL_CTRL); + tmp &= ~CLKMUX_EN; +-- +2.39.2 + diff --git a/queue-6.2/clk-imx-fracn-gppll-fix-the-rate-table.patch b/queue-6.2/clk-imx-fracn-gppll-fix-the-rate-table.patch new file mode 100644 index 00000000000..491b6a09858 --- /dev/null +++ b/queue-6.2/clk-imx-fracn-gppll-fix-the-rate-table.patch @@ -0,0 +1,60 @@ +From 2df1c88453ae0982ebb5738de07eb686426e2668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 17:52:54 +0800 +Subject: clk: imx: fracn-gppll: fix the rate table + +From: Peng Fan + +[ Upstream commit cf8dccfedce848f67eaa42e8839305d028319161 ] + +The Fvco should be range 2.4GHz to 5GHz, the original table voilate the +spec, so update the table to fix it. + +Fixes: c196175acdd3 ("clk: imx: clk-fracn-gppll: Add more freq config for video pll") +Fixes: 044034efbeea ("clk: imx: clk-fracn-gppll: fix mfd value") +Fixes: 1b26cb8a77a4 ("clk: imx: support fracn gppll") +Signed-off-by: Jacky Bai +Signed-off-by: Peng Fan +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20230403095300.3386988-2-peng.fan@oss.nxp.com +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-fracn-gppll.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/imx/clk-fracn-gppll.c b/drivers/clk/imx/clk-fracn-gppll.c +index a2aaa14fc1aef..ec50c41e2a4c9 100644 +--- a/drivers/clk/imx/clk-fracn-gppll.c ++++ b/drivers/clk/imx/clk-fracn-gppll.c +@@ -60,18 +60,20 @@ struct clk_fracn_gppll { + }; + + /* +- * Fvco = Fref * (MFI + MFN / MFD) +- * Fout = Fvco / (rdiv * odiv) ++ * Fvco = (Fref / rdiv) * (MFI + MFN / MFD) ++ * Fout = Fvco / odiv ++ * The (Fref / rdiv) should be in range 20MHz to 40MHz ++ * The Fvco should be in range 2.5Ghz to 5Ghz + */ + static const struct imx_fracn_gppll_rate_table fracn_tbl[] = { +- PLL_FRACN_GP(650000000U, 81, 0, 1, 0, 3), ++ PLL_FRACN_GP(650000000U, 162, 50, 100, 0, 6), + PLL_FRACN_GP(594000000U, 198, 0, 1, 0, 8), +- PLL_FRACN_GP(560000000U, 70, 0, 1, 0, 3), +- PLL_FRACN_GP(498000000U, 83, 0, 1, 0, 4), ++ PLL_FRACN_GP(560000000U, 140, 0, 1, 0, 6), ++ PLL_FRACN_GP(498000000U, 166, 0, 1, 0, 8), + PLL_FRACN_GP(484000000U, 121, 0, 1, 0, 6), + PLL_FRACN_GP(445333333U, 167, 0, 1, 0, 9), +- PLL_FRACN_GP(400000000U, 50, 0, 1, 0, 3), +- PLL_FRACN_GP(393216000U, 81, 92, 100, 0, 5) ++ PLL_FRACN_GP(400000000U, 200, 0, 1, 0, 12), ++ PLL_FRACN_GP(393216000U, 163, 84, 100, 0, 10) + }; + + struct imx_fracn_gppll_clk imx_fracn_gppll = { +-- +2.39.2 + diff --git a/queue-6.2/clk-imx-imx8ulp-fix-xbar_divbus-and-ad_slow-clock-pa.patch b/queue-6.2/clk-imx-imx8ulp-fix-xbar_divbus-and-ad_slow-clock-pa.patch new file mode 100644 index 00000000000..452b928baf3 --- /dev/null +++ b/queue-6.2/clk-imx-imx8ulp-fix-xbar_divbus-and-ad_slow-clock-pa.patch @@ -0,0 +1,43 @@ +From 102a800f4bcd6d7a2b2b15e7165bc6184dda0d0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Mar 2023 14:38:10 +0800 +Subject: clk: imx: imx8ulp: Fix XBAR_DIVBUS and AD_SLOW clock parents + +From: Peng Fan + +[ Upstream commit d608c18018c897b88d66f1340fe274b7181817fa ] + +XBAR_DIVBUS and AD_SLOW should set parent to XBAR_AD_DIVPLAT and +XBAR_DIVBUS respectively, not the NIC_AD. otherwise we will get +wrong clock rate. + +Fixes: c43a801a5789 ("clk: imx: Add clock driver for imx8ulp") +Reviewed-by: Jacky Bai +Signed-off-by: Ye Li +Signed-off-by: Peng Fan +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20230331063814.2462059-2-peng.fan@oss.nxp.com +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8ulp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx8ulp.c b/drivers/clk/imx/clk-imx8ulp.c +index 8eb1af2d64298..ca0e4a3aa454e 100644 +--- a/drivers/clk/imx/clk-imx8ulp.c ++++ b/drivers/clk/imx/clk-imx8ulp.c +@@ -200,8 +200,8 @@ static int imx8ulp_clk_cgc1_init(struct platform_device *pdev) + clks[IMX8ULP_CLK_NIC_AD_DIVPLAT] = imx_clk_hw_divider_flags("nic_ad_divplat", "nic_sel", base + 0x34, 21, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL); + clks[IMX8ULP_CLK_NIC_PER_DIVPLAT] = imx_clk_hw_divider_flags("nic_per_divplat", "nic_ad_divplat", base + 0x34, 14, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL); + clks[IMX8ULP_CLK_XBAR_AD_DIVPLAT] = imx_clk_hw_divider_flags("xbar_ad_divplat", "nic_ad_divplat", base + 0x38, 14, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL); +- clks[IMX8ULP_CLK_XBAR_DIVBUS] = imx_clk_hw_divider_flags("xbar_divbus", "nic_ad_divplat", base + 0x38, 7, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL); +- clks[IMX8ULP_CLK_XBAR_AD_SLOW] = imx_clk_hw_divider_flags("xbar_ad_slow", "nic_ad_divplat", base + 0x38, 0, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL); ++ clks[IMX8ULP_CLK_XBAR_DIVBUS] = imx_clk_hw_divider_flags("xbar_divbus", "xbar_ad_divplat", base + 0x38, 7, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL); ++ clks[IMX8ULP_CLK_XBAR_AD_SLOW] = imx_clk_hw_divider_flags("xbar_ad_slow", "xbar_divbus", base + 0x38, 0, 6, CLK_SET_RATE_PARENT | CLK_IS_CRITICAL); + + clks[IMX8ULP_CLK_SOSC_DIV1_GATE] = imx_clk_hw_gate_dis("sosc_div1_gate", "sosc", base + 0x108, 7); + clks[IMX8ULP_CLK_SOSC_DIV2_GATE] = imx_clk_hw_gate_dis("sosc_div2_gate", "sosc", base + 0x108, 15); +-- +2.39.2 + diff --git a/queue-6.2/clk-mediatek-clk-pllfh-fix-missing-of_node_put-in-fh.patch b/queue-6.2/clk-mediatek-clk-pllfh-fix-missing-of_node_put-in-fh.patch new file mode 100644 index 00000000000..08796d3285c --- /dev/null +++ b/queue-6.2/clk-mediatek-clk-pllfh-fix-missing-of_node_put-in-fh.patch @@ -0,0 +1,61 @@ +From a0d310a2695ac1990a3d113c12e376ba9777a9fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Dec 2022 17:29:46 +0800 +Subject: clk: mediatek: clk-pllfh: fix missing of_node_put() in + fhctl_parse_dt() + +From: Yang Yingliang + +[ Upstream commit f1d97a37f975ac615e4d6875c27516150642d499 ] + +The device_node pointer returned by of_find_compatible_node() with +refcount incremented, when finish using it, the refcount need be +decreased. + +Fixes: d7964de8a8ea ("clk: mediatek: Add new clock driver to handle FHCTL hardware") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221229092946.4162345-1-yangyingliang@huawei.com +[sboyd@kernel.org: Also unmap on error] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-pllfh.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-pllfh.c b/drivers/clk/mediatek/clk-pllfh.c +index f48780bec5077..f135b32c6dbed 100644 +--- a/drivers/clk/mediatek/clk-pllfh.c ++++ b/drivers/clk/mediatek/clk-pllfh.c +@@ -75,13 +75,13 @@ void fhctl_parse_dt(const u8 *compatible_node, struct mtk_pllfh_data *pllfhs, + base = of_iomap(node, 0); + if (!base) { + pr_err("%s(): ioremap failed\n", __func__); +- return; ++ goto out_node_put; + } + + num_clocks = of_clk_get_parent_count(node); + if (!num_clocks) { + pr_err("%s(): failed to get clocks property\n", __func__); +- return; ++ goto err; + } + + for (i = 0; i < num_clocks; i++) { +@@ -102,6 +102,13 @@ void fhctl_parse_dt(const u8 *compatible_node, struct mtk_pllfh_data *pllfhs, + pllfh->state.ssc_rate = ssc_rate; + pllfh->state.base = base; + } ++ ++out_node_put: ++ of_node_put(node); ++ return; ++err: ++ iounmap(base); ++ goto out_node_put; + } + + static void pllfh_init(struct mtk_fh *fh, struct mtk_pllfh_data *pllfh_data) +-- +2.39.2 + diff --git a/queue-6.2/clk-mediatek-consistently-use-gate_mtk-macro.patch b/queue-6.2/clk-mediatek-consistently-use-gate_mtk-macro.patch new file mode 100644 index 00000000000..14471680650 --- /dev/null +++ b/queue-6.2/clk-mediatek-consistently-use-gate_mtk-macro.patch @@ -0,0 +1,1775 @@ +From b62992c479ec121abf1366dea413b9b5bb0cbcaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 15:05:11 +0100 +Subject: clk: mediatek: Consistently use GATE_MTK() macro + +From: AngeloGioacchino Del Regno + +[ Upstream commit 4c85e20b656607897e3bb06ff565822fa4b4de95 ] + +All the various MediaTek clock drivers are, in a way or another, +redefining the GATE_MTK() macro with different names: while some +are doing that by actually using GATE_MTK(), others are copying +it entirely (hence, entirely redefining it). + +Change all clock drivers to always and consistently use this macro. + +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Chen-Yu Tsai +Tested-by: Chen-Yu Tsai # MT8183, MT8192, MT8195 Chromebooks +Link: https://lore.kernel.org/r/20230306140543.1813621-23-angelogioacchino.delregno@collabora.com +Signed-off-by: Stephen Boyd +Stable-dep-of: fa8c0d01df62 ("clk: mediatek: mt7622: Properly use CLK_IS_CRITICAL flag") +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt2701-aud.c | 40 +++-------- + drivers/clk/mediatek/clk-mt2701-bdp.c | 20 ++---- + drivers/clk/mediatek/clk-mt2701-eth.c | 10 +-- + drivers/clk/mediatek/clk-mt2701-g3d.c | 10 +-- + drivers/clk/mediatek/clk-mt2701-hif.c | 10 +-- + drivers/clk/mediatek/clk-mt2701-img.c | 10 +-- + drivers/clk/mediatek/clk-mt2701-mm.c | 20 ++---- + drivers/clk/mediatek/clk-mt2701-vdec.c | 20 ++---- + drivers/clk/mediatek/clk-mt2701.c | 40 +++-------- + drivers/clk/mediatek/clk-mt2712-bdp.c | 10 +-- + drivers/clk/mediatek/clk-mt2712-img.c | 10 +-- + drivers/clk/mediatek/clk-mt2712-jpgdec.c | 10 +-- + drivers/clk/mediatek/clk-mt2712-mfg.c | 10 +-- + drivers/clk/mediatek/clk-mt2712-mm.c | 34 +++------ + drivers/clk/mediatek/clk-mt2712-vdec.c | 20 ++---- + drivers/clk/mediatek/clk-mt2712-venc.c | 10 +-- + drivers/clk/mediatek/clk-mt2712.c | 60 ++++------------ + drivers/clk/mediatek/clk-mt6765-audio.c | 20 ++---- + drivers/clk/mediatek/clk-mt6765-cam.c | 10 +-- + drivers/clk/mediatek/clk-mt6765-img.c | 10 +-- + drivers/clk/mediatek/clk-mt6765-mipi0a.c | 10 +-- + drivers/clk/mediatek/clk-mt6765-mm.c | 10 +-- + drivers/clk/mediatek/clk-mt6765-vcodec.c | 10 +-- + drivers/clk/mediatek/clk-mt6765.c | 80 +++++----------------- + drivers/clk/mediatek/clk-mt6797-img.c | 10 +-- + drivers/clk/mediatek/clk-mt6797-mm.c | 20 ++---- + drivers/clk/mediatek/clk-mt6797-vdec.c | 20 ++---- + drivers/clk/mediatek/clk-mt6797-venc.c | 10 +-- + drivers/clk/mediatek/clk-mt6797.c | 42 ++++-------- + drivers/clk/mediatek/clk-mt7622-aud.c | 40 +++-------- + drivers/clk/mediatek/clk-mt7622-eth.c | 20 ++---- + drivers/clk/mediatek/clk-mt7622-hif.c | 20 ++---- + drivers/clk/mediatek/clk-mt7622.c | 61 ++++------------- + drivers/clk/mediatek/clk-mt7629-eth.c | 20 ++---- + drivers/clk/mediatek/clk-mt7629-hif.c | 20 ++---- + drivers/clk/mediatek/clk-mt7629.c | 40 +++-------- + drivers/clk/mediatek/clk-mt7986-eth.c | 24 ++----- + drivers/clk/mediatek/clk-mt7986-infracfg.c | 24 ++----- + drivers/clk/mediatek/clk-mt8135.c | 30 ++------ + drivers/clk/mediatek/clk-mt8167-aud.c | 11 +-- + drivers/clk/mediatek/clk-mt8167-img.c | 10 +-- + drivers/clk/mediatek/clk-mt8167-mfgcfg.c | 10 +-- + drivers/clk/mediatek/clk-mt8167-mm.c | 22 ++---- + drivers/clk/mediatek/clk-mt8167-vdec.c | 20 ++---- + drivers/clk/mediatek/clk-mt8173-mm.c | 22 ++---- + drivers/clk/mediatek/clk-mt8516-aud.c | 10 +-- + drivers/clk/mediatek/clk-mt8516.c | 60 ++++------------ + 47 files changed, 222 insertions(+), 838 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mt2701-aud.c b/drivers/clk/mediatek/clk-mt2701-aud.c +index 6ba398eb7df91..4287bd3f545ee 100644 +--- a/drivers/clk/mediatek/clk-mt2701-aud.c ++++ b/drivers/clk/mediatek/clk-mt2701-aud.c +@@ -15,41 +15,17 @@ + + #include + +-#define GATE_AUDIO0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &audio0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_AUDIO0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &audio0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + +-#define GATE_AUDIO1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &audio1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_AUDIO1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &audio1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + +-#define GATE_AUDIO2(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &audio2_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_AUDIO2(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &audio2_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + +-#define GATE_AUDIO3(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &audio3_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_AUDIO3(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &audio3_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + + static const struct mtk_gate_regs audio0_cg_regs = { + .set_ofs = 0x0, +diff --git a/drivers/clk/mediatek/clk-mt2701-bdp.c b/drivers/clk/mediatek/clk-mt2701-bdp.c +index 435ed4819d563..b0f0572079452 100644 +--- a/drivers/clk/mediatek/clk-mt2701-bdp.c ++++ b/drivers/clk/mediatek/clk-mt2701-bdp.c +@@ -24,23 +24,11 @@ static const struct mtk_gate_regs bdp1_cg_regs = { + .sta_ofs = 0x0110, + }; + +-#define GATE_BDP0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &bdp0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_BDP0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &bdp0_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + +-#define GATE_BDP1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &bdp1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_BDP1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &bdp1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + + static const struct mtk_gate bdp_clks[] = { + GATE_BDP0(CLK_BDP_BRG_BA, "brg_baclk", "mm_sel", 0), +diff --git a/drivers/clk/mediatek/clk-mt2701-eth.c b/drivers/clk/mediatek/clk-mt2701-eth.c +index edf1e2ed2b596..601358748750e 100644 +--- a/drivers/clk/mediatek/clk-mt2701-eth.c ++++ b/drivers/clk/mediatek/clk-mt2701-eth.c +@@ -16,14 +16,8 @@ static const struct mtk_gate_regs eth_cg_regs = { + .sta_ofs = 0x0030, + }; + +-#define GATE_ETH(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = ð_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_ETH(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, ð_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate eth_clks[] = { + GATE_ETH(CLK_ETHSYS_HSDMA, "hsdma_clk", "ethif_sel", 5), +diff --git a/drivers/clk/mediatek/clk-mt2701-g3d.c b/drivers/clk/mediatek/clk-mt2701-g3d.c +index 1458109d99d94..8d1fc8e3336eb 100644 +--- a/drivers/clk/mediatek/clk-mt2701-g3d.c ++++ b/drivers/clk/mediatek/clk-mt2701-g3d.c +@@ -16,14 +16,8 @@ + + #include + +-#define GATE_G3D(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &g3d_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_G3D(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &g3d_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate_regs g3d_cg_regs = { + .sta_ofs = 0x0, +diff --git a/drivers/clk/mediatek/clk-mt2701-hif.c b/drivers/clk/mediatek/clk-mt2701-hif.c +index 434cbbe8c0371..edeeb033a2350 100644 +--- a/drivers/clk/mediatek/clk-mt2701-hif.c ++++ b/drivers/clk/mediatek/clk-mt2701-hif.c +@@ -16,14 +16,8 @@ static const struct mtk_gate_regs hif_cg_regs = { + .sta_ofs = 0x0030, + }; + +-#define GATE_HIF(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &hif_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_HIF(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &hif_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate hif_clks[] = { + GATE_HIF(CLK_HIFSYS_USB0PHY, "usb0_phy_clk", "ethpll_500m_ck", 21), +diff --git a/drivers/clk/mediatek/clk-mt2701-img.c b/drivers/clk/mediatek/clk-mt2701-img.c +index 7e53deb7f9905..eb172473f0755 100644 +--- a/drivers/clk/mediatek/clk-mt2701-img.c ++++ b/drivers/clk/mediatek/clk-mt2701-img.c +@@ -18,14 +18,8 @@ static const struct mtk_gate_regs img_cg_regs = { + .sta_ofs = 0x0000, + }; + +-#define GATE_IMG(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &img_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_IMG(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &img_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate img_clks[] = { + GATE_IMG(CLK_IMG_SMI_COMM, "img_smi_comm", "mm_sel", 0), +diff --git a/drivers/clk/mediatek/clk-mt2701-mm.c b/drivers/clk/mediatek/clk-mt2701-mm.c +index 9ea7abad99d23..eb069f3bc9a2b 100644 +--- a/drivers/clk/mediatek/clk-mt2701-mm.c ++++ b/drivers/clk/mediatek/clk-mt2701-mm.c +@@ -24,23 +24,11 @@ static const struct mtk_gate_regs disp1_cg_regs = { + .sta_ofs = 0x0110, + }; + +-#define GATE_DISP0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &disp0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_DISP0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &disp0_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_DISP1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &disp1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_DISP1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &disp1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate mm_clks[] = { + GATE_DISP0(CLK_MM_SMI_COMMON, "mm_smi_comm", "mm_sel", 0), +diff --git a/drivers/clk/mediatek/clk-mt2701-vdec.c b/drivers/clk/mediatek/clk-mt2701-vdec.c +index d3089da0ab62e..0f07c5d731df6 100644 +--- a/drivers/clk/mediatek/clk-mt2701-vdec.c ++++ b/drivers/clk/mediatek/clk-mt2701-vdec.c +@@ -24,23 +24,11 @@ static const struct mtk_gate_regs vdec1_cg_regs = { + .sta_ofs = 0x0008, + }; + +-#define GATE_VDEC0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &vdec0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_VDEC0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &vdec0_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + +-#define GATE_VDEC1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &vdec1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_VDEC1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &vdec1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + + static const struct mtk_gate vdec_clks[] = { + GATE_VDEC0(CLK_VDEC_CKGEN, "vdec_cken", "vdec_sel", 0), +diff --git a/drivers/clk/mediatek/clk-mt2701.c b/drivers/clk/mediatek/clk-mt2701.c +index 9b442af37e672..1c3a93143dc5e 100644 +--- a/drivers/clk/mediatek/clk-mt2701.c ++++ b/drivers/clk/mediatek/clk-mt2701.c +@@ -636,14 +636,8 @@ static const struct mtk_gate_regs top_aud_cg_regs = { + .sta_ofs = 0x012C, + }; + +-#define GATE_TOP_AUD(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top_aud_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_TOP_AUD(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top_aud_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + + static const struct mtk_gate top_clks[] = { + GATE_TOP_AUD(CLK_TOP_AUD_48K_TIMING, "a1sys_hp_ck", "aud_mux1_div", +@@ -701,14 +695,8 @@ static const struct mtk_gate_regs infra_cg_regs = { + .sta_ofs = 0x0048, + }; + +-#define GATE_ICG(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &infra_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_ICG(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate infra_clks[] = { + GATE_ICG(CLK_INFRA_DBG, "dbgclk", "axi_sel", 0), +@@ -822,23 +810,11 @@ static const struct mtk_gate_regs peri1_cg_regs = { + .sta_ofs = 0x001c, + }; + +-#define GATE_PERI0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &peri0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_PERI0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &peri0_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_PERI1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &peri1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_PERI1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &peri1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate peri_clks[] = { + GATE_PERI0(CLK_PERI_USB0_MCU, "usb0_mcu_ck", "axi_sel", 31), +diff --git a/drivers/clk/mediatek/clk-mt2712-bdp.c b/drivers/clk/mediatek/clk-mt2712-bdp.c +index 684d03e9f6de1..5e668651dd901 100644 +--- a/drivers/clk/mediatek/clk-mt2712-bdp.c ++++ b/drivers/clk/mediatek/clk-mt2712-bdp.c +@@ -18,14 +18,8 @@ static const struct mtk_gate_regs bdp_cg_regs = { + .sta_ofs = 0x100, + }; + +-#define GATE_BDP(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &bdp_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_BDP(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &bdp_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + + static const struct mtk_gate bdp_clks[] = { + GATE_BDP(CLK_BDP_BRIDGE_B, "bdp_bridge_b", "mm_sel", 0), +diff --git a/drivers/clk/mediatek/clk-mt2712-img.c b/drivers/clk/mediatek/clk-mt2712-img.c +index 335049cdc856c..3ffa51384e6b2 100644 +--- a/drivers/clk/mediatek/clk-mt2712-img.c ++++ b/drivers/clk/mediatek/clk-mt2712-img.c +@@ -18,14 +18,8 @@ static const struct mtk_gate_regs img_cg_regs = { + .sta_ofs = 0x0, + }; + +-#define GATE_IMG(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &img_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_IMG(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &img_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + + static const struct mtk_gate img_clks[] = { + GATE_IMG(CLK_IMG_SMI_LARB2, "img_smi_larb2", "mm_sel", 0), +diff --git a/drivers/clk/mediatek/clk-mt2712-jpgdec.c b/drivers/clk/mediatek/clk-mt2712-jpgdec.c +index 07ba7c5e80aff..8c768d5ce24d5 100644 +--- a/drivers/clk/mediatek/clk-mt2712-jpgdec.c ++++ b/drivers/clk/mediatek/clk-mt2712-jpgdec.c +@@ -18,14 +18,8 @@ static const struct mtk_gate_regs jpgdec_cg_regs = { + .sta_ofs = 0x0, + }; + +-#define GATE_JPGDEC(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &jpgdec_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_JPGDEC(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &jpgdec_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + + static const struct mtk_gate jpgdec_clks[] = { + GATE_JPGDEC(CLK_JPGDEC_JPGDEC1, "jpgdec_jpgdec1", "jpgdec_sel", 0), +diff --git a/drivers/clk/mediatek/clk-mt2712-mfg.c b/drivers/clk/mediatek/clk-mt2712-mfg.c +index 42f8cf3ecf4cb..8949315c2dd20 100644 +--- a/drivers/clk/mediatek/clk-mt2712-mfg.c ++++ b/drivers/clk/mediatek/clk-mt2712-mfg.c +@@ -18,14 +18,8 @@ static const struct mtk_gate_regs mfg_cg_regs = { + .sta_ofs = 0x0, + }; + +-#define GATE_MFG(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &mfg_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_MFG(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &mfg_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate mfg_clks[] = { + GATE_MFG(CLK_MFG_BG3D, "mfg_bg3d", "mfg_sel", 0), +diff --git a/drivers/clk/mediatek/clk-mt2712-mm.c b/drivers/clk/mediatek/clk-mt2712-mm.c +index 7d44b09b8a0a7..ad6daa8f28a83 100644 +--- a/drivers/clk/mediatek/clk-mt2712-mm.c ++++ b/drivers/clk/mediatek/clk-mt2712-mm.c +@@ -30,32 +30,14 @@ static const struct mtk_gate_regs mm2_cg_regs = { + .sta_ofs = 0x220, + }; + +-#define GATE_MM0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &mm0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } +- +-#define GATE_MM1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &mm1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } +- +-#define GATE_MM2(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &mm2_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_MM0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &mm0_cg_regs, _shift, &mtk_clk_gate_ops_setclr) ++ ++#define GATE_MM1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &mm1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) ++ ++#define GATE_MM2(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &mm2_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate mm_clks[] = { + /* MM0 */ +diff --git a/drivers/clk/mediatek/clk-mt2712-vdec.c b/drivers/clk/mediatek/clk-mt2712-vdec.c +index 6296ed5c5b555..572290dd43c87 100644 +--- a/drivers/clk/mediatek/clk-mt2712-vdec.c ++++ b/drivers/clk/mediatek/clk-mt2712-vdec.c +@@ -24,23 +24,11 @@ static const struct mtk_gate_regs vdec1_cg_regs = { + .sta_ofs = 0x8, + }; + +-#define GATE_VDEC0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &vdec0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_VDEC0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &vdec0_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + +-#define GATE_VDEC1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &vdec1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_VDEC1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &vdec1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + + static const struct mtk_gate vdec_clks[] = { + /* VDEC0 */ +diff --git a/drivers/clk/mediatek/clk-mt2712-venc.c b/drivers/clk/mediatek/clk-mt2712-venc.c +index b9bfc35de629c..9588eb03016eb 100644 +--- a/drivers/clk/mediatek/clk-mt2712-venc.c ++++ b/drivers/clk/mediatek/clk-mt2712-venc.c +@@ -18,14 +18,8 @@ static const struct mtk_gate_regs venc_cg_regs = { + .sta_ofs = 0x0, + }; + +-#define GATE_VENC(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &venc_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_VENC(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &venc_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + + static const struct mtk_gate venc_clks[] = { + GATE_VENC(CLK_VENC_SMI_COMMON_CON, "venc_smi", "mm_sel", 0), +diff --git a/drivers/clk/mediatek/clk-mt2712.c b/drivers/clk/mediatek/clk-mt2712.c +index 7309b5813da96..d6c2cc183b1a1 100644 +--- a/drivers/clk/mediatek/clk-mt2712.c ++++ b/drivers/clk/mediatek/clk-mt2712.c +@@ -958,23 +958,11 @@ static const struct mtk_gate_regs top1_cg_regs = { + .sta_ofs = 0x424, + }; + +-#define GATE_TOP0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_TOP0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + +-#define GATE_TOP1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_TOP1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate top_clks[] = { + /* TOP0 */ +@@ -998,14 +986,8 @@ static const struct mtk_gate_regs infra_cg_regs = { + .sta_ofs = 0x48, + }; + +-#define GATE_INFRA(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &infra_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_INFRA(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate infra_clks[] = { + GATE_INFRA(CLK_INFRA_DBGCLK, "infra_dbgclk", "axi_sel", 0), +@@ -1035,32 +1017,14 @@ static const struct mtk_gate_regs peri2_cg_regs = { + .sta_ofs = 0x42c, + }; + +-#define GATE_PERI0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &peri0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_PERI0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &peri0_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_PERI1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &peri1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_PERI1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &peri1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_PERI2(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &peri2_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_PERI2(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &peri2_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate peri_clks[] = { + /* PERI0 */ +diff --git a/drivers/clk/mediatek/clk-mt6765-audio.c b/drivers/clk/mediatek/clk-mt6765-audio.c +index 0aa6c0d352ca5..5682e0302eee2 100644 +--- a/drivers/clk/mediatek/clk-mt6765-audio.c ++++ b/drivers/clk/mediatek/clk-mt6765-audio.c +@@ -24,23 +24,11 @@ static const struct mtk_gate_regs audio1_cg_regs = { + .sta_ofs = 0x4, + }; + +-#define GATE_AUDIO0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &audio0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_AUDIO0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &audio0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + +-#define GATE_AUDIO1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &audio1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_AUDIO1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &audio1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + + static const struct mtk_gate audio_clks[] = { + /* AUDIO0 */ +diff --git a/drivers/clk/mediatek/clk-mt6765-cam.c b/drivers/clk/mediatek/clk-mt6765-cam.c +index 25f2bef38126e..6e7d192c19cb0 100644 +--- a/drivers/clk/mediatek/clk-mt6765-cam.c ++++ b/drivers/clk/mediatek/clk-mt6765-cam.c +@@ -18,14 +18,8 @@ static const struct mtk_gate_regs cam_cg_regs = { + .sta_ofs = 0x0, + }; + +-#define GATE_CAM(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &cam_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_CAM(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &cam_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate cam_clks[] = { + GATE_CAM(CLK_CAM_LARB3, "cam_larb3", "mm_ck", 0), +diff --git a/drivers/clk/mediatek/clk-mt6765-img.c b/drivers/clk/mediatek/clk-mt6765-img.c +index a62303ef4f41d..cfbc907988aff 100644 +--- a/drivers/clk/mediatek/clk-mt6765-img.c ++++ b/drivers/clk/mediatek/clk-mt6765-img.c +@@ -18,14 +18,8 @@ static const struct mtk_gate_regs img_cg_regs = { + .sta_ofs = 0x0, + }; + +-#define GATE_IMG(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &img_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_IMG(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &img_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate img_clks[] = { + GATE_IMG(CLK_IMG_LARB2, "img_larb2", "mm_ck", 0), +diff --git a/drivers/clk/mediatek/clk-mt6765-mipi0a.c b/drivers/clk/mediatek/clk-mt6765-mipi0a.c +index 25c829fc38661..f2b9dc8084801 100644 +--- a/drivers/clk/mediatek/clk-mt6765-mipi0a.c ++++ b/drivers/clk/mediatek/clk-mt6765-mipi0a.c +@@ -18,14 +18,8 @@ static const struct mtk_gate_regs mipi0a_cg_regs = { + .sta_ofs = 0x80, + }; + +-#define GATE_MIPI0A(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &mipi0a_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_MIPI0A(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &mipi0a_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate mipi0a_clks[] = { + GATE_MIPI0A(CLK_MIPI0A_CSR_CSI_EN_0A, +diff --git a/drivers/clk/mediatek/clk-mt6765-mm.c b/drivers/clk/mediatek/clk-mt6765-mm.c +index bda774668a361..a4570c9dbefa5 100644 +--- a/drivers/clk/mediatek/clk-mt6765-mm.c ++++ b/drivers/clk/mediatek/clk-mt6765-mm.c +@@ -18,14 +18,8 @@ static const struct mtk_gate_regs mm_cg_regs = { + .sta_ofs = 0x100, + }; + +-#define GATE_MM(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &mm_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_MM(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &mm_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate mm_clks[] = { + /* MM */ +diff --git a/drivers/clk/mediatek/clk-mt6765-vcodec.c b/drivers/clk/mediatek/clk-mt6765-vcodec.c +index 2bc1fbde87da9..75d72b9b4032c 100644 +--- a/drivers/clk/mediatek/clk-mt6765-vcodec.c ++++ b/drivers/clk/mediatek/clk-mt6765-vcodec.c +@@ -18,14 +18,8 @@ static const struct mtk_gate_regs venc_cg_regs = { + .sta_ofs = 0x0, + }; + +-#define GATE_VENC(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &venc_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_VENC(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &venc_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + + static const struct mtk_gate venc_clks[] = { + GATE_VENC(CLK_VENC_SET0_LARB, "venc_set0_larb", "mm_ck", 0), +diff --git a/drivers/clk/mediatek/clk-mt6765.c b/drivers/clk/mediatek/clk-mt6765.c +index e9b9e67297335..665981fc411f5 100644 +--- a/drivers/clk/mediatek/clk-mt6765.c ++++ b/drivers/clk/mediatek/clk-mt6765.c +@@ -483,32 +483,14 @@ static const struct mtk_gate_regs top2_cg_regs = { + .sta_ofs = 0x320, + }; + +-#define GATE_TOP0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_TOP0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + +-#define GATE_TOP1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_TOP1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + +-#define GATE_TOP2(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top2_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_TOP2(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top2_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + + static const struct mtk_gate top_clks[] = { + /* TOP0 */ +@@ -559,41 +541,17 @@ static const struct mtk_gate_regs ifr5_cg_regs = { + .sta_ofs = 0xc8, + }; + +-#define GATE_IFR2(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &ifr2_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_IFR2(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &ifr2_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_IFR3(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &ifr3_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_IFR3(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &ifr3_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_IFR4(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &ifr4_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_IFR4(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &ifr4_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_IFR5(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &ifr5_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_IFR5(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &ifr5_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate ifr_clks[] = { + /* INFRA_TOPAXI */ +@@ -674,14 +632,8 @@ static const struct mtk_gate_regs apmixed_cg_regs = { + .sta_ofs = 0x14, + }; + +-#define GATE_APMIXED(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &apmixed_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_APMIXED(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &apmixed_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate apmixed_clks[] = { + /* AUDIO0 */ +diff --git a/drivers/clk/mediatek/clk-mt6797-img.c b/drivers/clk/mediatek/clk-mt6797-img.c +index 7c6a53fbb8be6..06441393478f6 100644 +--- a/drivers/clk/mediatek/clk-mt6797-img.c ++++ b/drivers/clk/mediatek/clk-mt6797-img.c +@@ -16,14 +16,8 @@ static const struct mtk_gate_regs img_cg_regs = { + .sta_ofs = 0x0000, + }; + +-#define GATE_IMG(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &img_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_IMG(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &img_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate img_clks[] = { + GATE_IMG(CLK_IMG_FDVT, "img_fdvt", "mm_sel", 11), +diff --git a/drivers/clk/mediatek/clk-mt6797-mm.c b/drivers/clk/mediatek/clk-mt6797-mm.c +index 0846011fc8943..99a63f46642fa 100644 +--- a/drivers/clk/mediatek/clk-mt6797-mm.c ++++ b/drivers/clk/mediatek/clk-mt6797-mm.c +@@ -23,23 +23,11 @@ static const struct mtk_gate_regs mm1_cg_regs = { + .sta_ofs = 0x0110, + }; + +-#define GATE_MM0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &mm0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +-} ++#define GATE_MM0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &mm0_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_MM1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &mm1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +-} ++#define GATE_MM1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &mm1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate mm_clks[] = { + GATE_MM0(CLK_MM_SMI_COMMON, "mm_smi_common", "mm_sel", 0), +diff --git a/drivers/clk/mediatek/clk-mt6797-vdec.c b/drivers/clk/mediatek/clk-mt6797-vdec.c +index 6120fccc859f1..8622ddd87a5bb 100644 +--- a/drivers/clk/mediatek/clk-mt6797-vdec.c ++++ b/drivers/clk/mediatek/clk-mt6797-vdec.c +@@ -24,23 +24,11 @@ static const struct mtk_gate_regs vdec1_cg_regs = { + .sta_ofs = 0x0008, + }; + +-#define GATE_VDEC0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &vdec0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +-} ++#define GATE_VDEC0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &vdec0_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + +-#define GATE_VDEC1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &vdec1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +-} ++#define GATE_VDEC1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &vdec1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + + static const struct mtk_gate vdec_clks[] = { + GATE_VDEC0(CLK_VDEC_CKEN_ENG, "vdec_cken_eng", "vdec_sel", 8), +diff --git a/drivers/clk/mediatek/clk-mt6797-venc.c b/drivers/clk/mediatek/clk-mt6797-venc.c +index 834d3834d2bbc..928d611a476e4 100644 +--- a/drivers/clk/mediatek/clk-mt6797-venc.c ++++ b/drivers/clk/mediatek/clk-mt6797-venc.c +@@ -18,14 +18,8 @@ static const struct mtk_gate_regs venc_cg_regs = { + .sta_ofs = 0x0000, + }; + +-#define GATE_VENC(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &venc_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_VENC(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &venc_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + + static const struct mtk_gate venc_clks[] = { + GATE_VENC(CLK_VENC_0, "venc_0", "mm_sel", 0), +diff --git a/drivers/clk/mediatek/clk-mt6797.c b/drivers/clk/mediatek/clk-mt6797.c +index b89f325a4b9b8..78339cb35beb0 100644 +--- a/drivers/clk/mediatek/clk-mt6797.c ++++ b/drivers/clk/mediatek/clk-mt6797.c +@@ -420,40 +420,22 @@ static const struct mtk_gate_regs infra2_cg_regs = { + .sta_ofs = 0x00b0, + }; + +-#define GATE_ICG0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &infra0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +-} ++#define GATE_ICG0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &infra0_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_ICG1(_id, _name, _parent, _shift) \ +- GATE_ICG1_FLAGS(_id, _name, _parent, _shift, 0) ++#define GATE_ICG1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &infra1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_ICG1_FLAGS(_id, _name, _parent, _shift, _flags) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &infra1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- .flags = _flags, \ +-} ++#define GATE_ICG1_FLAGS(_id, _name, _parent, _shift, _flags) \ ++ GATE_MTK_FLAGS(_id, _name, _parent, &infra1_cg_regs, _shift, \ ++ &mtk_clk_gate_ops_setclr, _flags) + +-#define GATE_ICG2(_id, _name, _parent, _shift) \ +- GATE_ICG2_FLAGS(_id, _name, _parent, _shift, 0) ++#define GATE_ICG2(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &infra2_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_ICG2_FLAGS(_id, _name, _parent, _shift, _flags) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &infra2_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- .flags = _flags, \ +-} ++#define GATE_ICG2_FLAGS(_id, _name, _parent, _shift, _flags) \ ++ GATE_MTK_FLAGS(_id, _name, _parent, &infra2_cg_regs, _shift, \ ++ &mtk_clk_gate_ops_setclr, _flags) + + /* + * Clock gates dramc and dramc_b are needed by the DRAM controller. +diff --git a/drivers/clk/mediatek/clk-mt7622-aud.c b/drivers/clk/mediatek/clk-mt7622-aud.c +index 9f2e5aa7b5d9b..b17731fa11445 100644 +--- a/drivers/clk/mediatek/clk-mt7622-aud.c ++++ b/drivers/clk/mediatek/clk-mt7622-aud.c +@@ -16,41 +16,17 @@ + + #include + +-#define GATE_AUDIO0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &audio0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_AUDIO0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &audio0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + +-#define GATE_AUDIO1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &audio1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_AUDIO1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &audio1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + +-#define GATE_AUDIO2(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &audio2_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_AUDIO2(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &audio2_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + +-#define GATE_AUDIO3(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &audio3_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_AUDIO3(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &audio3_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + + static const struct mtk_gate_regs audio0_cg_regs = { + .set_ofs = 0x0, +diff --git a/drivers/clk/mediatek/clk-mt7622-eth.c b/drivers/clk/mediatek/clk-mt7622-eth.c +index 43de0477d5d99..a60190e834186 100644 +--- a/drivers/clk/mediatek/clk-mt7622-eth.c ++++ b/drivers/clk/mediatek/clk-mt7622-eth.c +@@ -16,14 +16,8 @@ + + #include + +-#define GATE_ETH(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = ð_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_ETH(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, ð_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate_regs eth_cg_regs = { + .set_ofs = 0x30, +@@ -45,14 +39,8 @@ static const struct mtk_gate_regs sgmii_cg_regs = { + .sta_ofs = 0xE4, + }; + +-#define GATE_SGMII(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &sgmii_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_SGMII(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &sgmii_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate sgmii_clks[] = { + GATE_SGMII(CLK_SGMII_TX250M_EN, "sgmii_tx250m_en", +diff --git a/drivers/clk/mediatek/clk-mt7622-hif.c b/drivers/clk/mediatek/clk-mt7622-hif.c +index 67e96231dd25b..55baa6d06a205 100644 +--- a/drivers/clk/mediatek/clk-mt7622-hif.c ++++ b/drivers/clk/mediatek/clk-mt7622-hif.c +@@ -16,23 +16,11 @@ + + #include + +-#define GATE_PCIE(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &pcie_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_PCIE(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &pcie_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + +-#define GATE_SSUSB(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &ssusb_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_SSUSB(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &ssusb_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate_regs pcie_cg_regs = { + .set_ofs = 0x30, +diff --git a/drivers/clk/mediatek/clk-mt7622.c b/drivers/clk/mediatek/clk-mt7622.c +index 3b55f8641fae0..41b3d032bf91c 100644 +--- a/drivers/clk/mediatek/clk-mt7622.c ++++ b/drivers/clk/mediatek/clk-mt7622.c +@@ -50,59 +50,24 @@ + _pd_reg, _pd_shift, _tuner_reg, _pcw_reg, _pcw_shift, \ + NULL, "clkxtal") + +-#define GATE_APMIXED(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &apmixed_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_APMIXED(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &apmixed_cg_regs, _shift, \ ++ &mtk_clk_gate_ops_no_setclr_inv) + +-#define GATE_INFRA(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &infra_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_INFRA(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_TOP0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_TOP0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + +-#define GATE_TOP1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_TOP1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + +-#define GATE_PERI0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &peri0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_PERI0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &peri0_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_PERI1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &peri1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_PERI1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &peri1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static DEFINE_SPINLOCK(mt7622_clk_lock); + +diff --git a/drivers/clk/mediatek/clk-mt7629-eth.c b/drivers/clk/mediatek/clk-mt7629-eth.c +index 282dd65594654..b0c8fa3b8bbec 100644 +--- a/drivers/clk/mediatek/clk-mt7629-eth.c ++++ b/drivers/clk/mediatek/clk-mt7629-eth.c +@@ -16,14 +16,8 @@ + + #include + +-#define GATE_ETH(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = ð_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_ETH(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, ð_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate_regs eth_cg_regs = { + .set_ofs = 0x30, +@@ -45,14 +39,8 @@ static const struct mtk_gate_regs sgmii_cg_regs = { + .sta_ofs = 0xE4, + }; + +-#define GATE_SGMII(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &sgmii_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_SGMII(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &sgmii_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate sgmii_clks[2][4] = { + { +diff --git a/drivers/clk/mediatek/clk-mt7629-hif.c b/drivers/clk/mediatek/clk-mt7629-hif.c +index 0c8b9e1397890..3628811a2f57f 100644 +--- a/drivers/clk/mediatek/clk-mt7629-hif.c ++++ b/drivers/clk/mediatek/clk-mt7629-hif.c +@@ -16,23 +16,11 @@ + + #include + +-#define GATE_PCIE(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &pcie_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_PCIE(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &pcie_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + +-#define GATE_SSUSB(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &ssusb_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_SSUSB(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &ssusb_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate_regs pcie_cg_regs = { + .set_ofs = 0x30, +diff --git a/drivers/clk/mediatek/clk-mt7629.c b/drivers/clk/mediatek/clk-mt7629.c +index e4a08c811adc2..0bc88b7d171b5 100644 +--- a/drivers/clk/mediatek/clk-mt7629.c ++++ b/drivers/clk/mediatek/clk-mt7629.c +@@ -50,41 +50,17 @@ + _pd_reg, _pd_shift, _tuner_reg, _pcw_reg, _pcw_shift, \ + NULL, "clk20m") + +-#define GATE_APMIXED(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &apmixed_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_APMIXED(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &apmixed_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + +-#define GATE_INFRA(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &infra_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_INFRA(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_PERI0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &peri0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_PERI0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &peri0_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_PERI1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &peri1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_PERI1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &peri1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static DEFINE_SPINLOCK(mt7629_clk_lock); + +diff --git a/drivers/clk/mediatek/clk-mt7986-eth.c b/drivers/clk/mediatek/clk-mt7986-eth.c +index 7868c0728e962..c21e1d672384a 100644 +--- a/drivers/clk/mediatek/clk-mt7986-eth.c ++++ b/drivers/clk/mediatek/clk-mt7986-eth.c +@@ -22,12 +22,8 @@ static const struct mtk_gate_regs sgmii0_cg_regs = { + .sta_ofs = 0xe4, + }; + +-#define GATE_SGMII0(_id, _name, _parent, _shift) \ +- { \ +- .id = _id, .name = _name, .parent_name = _parent, \ +- .regs = &sgmii0_cg_regs, .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_SGMII0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &sgmii0_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate sgmii0_clks[] __initconst = { + GATE_SGMII0(CLK_SGMII0_TX250M_EN, "sgmii0_tx250m_en", "top_xtal", 2), +@@ -42,12 +38,8 @@ static const struct mtk_gate_regs sgmii1_cg_regs = { + .sta_ofs = 0xe4, + }; + +-#define GATE_SGMII1(_id, _name, _parent, _shift) \ +- { \ +- .id = _id, .name = _name, .parent_name = _parent, \ +- .regs = &sgmii1_cg_regs, .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_SGMII1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &sgmii1_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate sgmii1_clks[] __initconst = { + GATE_SGMII1(CLK_SGMII1_TX250M_EN, "sgmii1_tx250m_en", "top_xtal", 2), +@@ -62,12 +54,8 @@ static const struct mtk_gate_regs eth_cg_regs = { + .sta_ofs = 0x30, + }; + +-#define GATE_ETH(_id, _name, _parent, _shift) \ +- { \ +- .id = _id, .name = _name, .parent_name = _parent, \ +- .regs = ð_cg_regs, .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr_inv, \ +- } ++#define GATE_ETH(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, ð_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr_inv) + + static const struct mtk_gate eth_clks[] __initconst = { + GATE_ETH(CLK_ETH_FE_EN, "eth_fe_en", "netsys_2x_sel", 6), +diff --git a/drivers/clk/mediatek/clk-mt7986-infracfg.c b/drivers/clk/mediatek/clk-mt7986-infracfg.c +index 49666047bf0ed..74e68a7197301 100644 +--- a/drivers/clk/mediatek/clk-mt7986-infracfg.c ++++ b/drivers/clk/mediatek/clk-mt7986-infracfg.c +@@ -87,26 +87,14 @@ static const struct mtk_gate_regs infra2_cg_regs = { + .sta_ofs = 0x68, + }; + +-#define GATE_INFRA0(_id, _name, _parent, _shift) \ +- { \ +- .id = _id, .name = _name, .parent_name = _parent, \ +- .regs = &infra0_cg_regs, .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_INFRA0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &infra0_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_INFRA1(_id, _name, _parent, _shift) \ +- { \ +- .id = _id, .name = _name, .parent_name = _parent, \ +- .regs = &infra1_cg_regs, .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_INFRA1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &infra1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_INFRA2(_id, _name, _parent, _shift) \ +- { \ +- .id = _id, .name = _name, .parent_name = _parent, \ +- .regs = &infra2_cg_regs, .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_INFRA2(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &infra2_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate infra_clks[] = { + /* INFRA0 */ +diff --git a/drivers/clk/mediatek/clk-mt8135.c b/drivers/clk/mediatek/clk-mt8135.c +index b68888a034c40..1cbe0958d9cd0 100644 +--- a/drivers/clk/mediatek/clk-mt8135.c ++++ b/drivers/clk/mediatek/clk-mt8135.c +@@ -401,14 +401,8 @@ static const struct mtk_gate_regs infra_cg_regs = { + .sta_ofs = 0x0048, + }; + +-#define GATE_ICG(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &infra_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_ICG(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate infra_clks[] __initconst = { + GATE_ICG(CLK_INFRA_PMIC_WRAP, "pmic_wrap_ck", "axi_sel", 23), +@@ -438,23 +432,11 @@ static const struct mtk_gate_regs peri1_cg_regs = { + .sta_ofs = 0x001c, + }; + +-#define GATE_PERI0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &peri0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_PERI0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &peri0_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_PERI1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &peri1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_PERI1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &peri1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate peri_gates[] __initconst = { + /* PERI0 */ +diff --git a/drivers/clk/mediatek/clk-mt8167-aud.c b/drivers/clk/mediatek/clk-mt8167-aud.c +index ce1ae8d243c33..b5ac196cd9454 100644 +--- a/drivers/clk/mediatek/clk-mt8167-aud.c ++++ b/drivers/clk/mediatek/clk-mt8167-aud.c +@@ -23,14 +23,9 @@ static const struct mtk_gate_regs aud_cg_regs = { + .sta_ofs = 0x0, + }; + +-#define GATE_AUD(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &aud_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_AUD(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &aud_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) ++ + + static const struct mtk_gate aud_clks[] __initconst = { + GATE_AUD(CLK_AUD_AFE, "aud_afe", "clk26m_ck", 2), +diff --git a/drivers/clk/mediatek/clk-mt8167-img.c b/drivers/clk/mediatek/clk-mt8167-img.c +index e359e563d2b79..4e7c0772b4f99 100644 +--- a/drivers/clk/mediatek/clk-mt8167-img.c ++++ b/drivers/clk/mediatek/clk-mt8167-img.c +@@ -23,14 +23,8 @@ static const struct mtk_gate_regs img_cg_regs = { + .sta_ofs = 0x0, + }; + +-#define GATE_IMG(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &img_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_IMG(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &img_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate img_clks[] __initconst = { + GATE_IMG(CLK_IMG_LARB1_SMI, "img_larb1_smi", "smi_mm", 0), +diff --git a/drivers/clk/mediatek/clk-mt8167-mfgcfg.c b/drivers/clk/mediatek/clk-mt8167-mfgcfg.c +index 4fd82fe87d6e5..192714498b2ec 100644 +--- a/drivers/clk/mediatek/clk-mt8167-mfgcfg.c ++++ b/drivers/clk/mediatek/clk-mt8167-mfgcfg.c +@@ -23,14 +23,8 @@ static const struct mtk_gate_regs mfg_cg_regs = { + .sta_ofs = 0x0, + }; + +-#define GATE_MFG(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &mfg_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_MFG(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &mfg_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate mfg_clks[] __initconst = { + GATE_MFG(CLK_MFG_BAXI, "mfg_baxi", "ahb_infra_sel", 0), +diff --git a/drivers/clk/mediatek/clk-mt8167-mm.c b/drivers/clk/mediatek/clk-mt8167-mm.c +index 73910060577f6..a94961b7b8cc6 100644 +--- a/drivers/clk/mediatek/clk-mt8167-mm.c ++++ b/drivers/clk/mediatek/clk-mt8167-mm.c +@@ -29,23 +29,11 @@ static const struct mtk_gate_regs mm1_cg_regs = { + .sta_ofs = 0x110, + }; + +-#define GATE_MM0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &mm0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } +- +-#define GATE_MM1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &mm1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_MM0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &mm0_cg_regs, _shift, &mtk_clk_gate_ops_setclr) ++ ++#define GATE_MM1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &mm1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate mm_clks[] = { + /* MM0 */ +diff --git a/drivers/clk/mediatek/clk-mt8167-vdec.c b/drivers/clk/mediatek/clk-mt8167-vdec.c +index ee4fffb6859da..38f0ba357d599 100644 +--- a/drivers/clk/mediatek/clk-mt8167-vdec.c ++++ b/drivers/clk/mediatek/clk-mt8167-vdec.c +@@ -29,23 +29,11 @@ static const struct mtk_gate_regs vdec1_cg_regs = { + .sta_ofs = 0x8, + }; + +-#define GATE_VDEC0_I(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &vdec0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_VDEC0_I(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &vdec0_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + +-#define GATE_VDEC1_I(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &vdec1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_VDEC1_I(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &vdec1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + + static const struct mtk_gate vdec_clks[] __initconst = { + /* VDEC0 */ +diff --git a/drivers/clk/mediatek/clk-mt8173-mm.c b/drivers/clk/mediatek/clk-mt8173-mm.c +index 8abf42c2030c6..5826eabdc9c77 100644 +--- a/drivers/clk/mediatek/clk-mt8173-mm.c ++++ b/drivers/clk/mediatek/clk-mt8173-mm.c +@@ -25,23 +25,11 @@ static const struct mtk_gate_regs mm1_cg_regs = { + .sta_ofs = 0x0110, + }; + +-#define GATE_MM0(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &mm0_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } +- +-#define GATE_MM1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &mm1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_MM0(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &mm0_cg_regs, _shift, &mtk_clk_gate_ops_setclr) ++ ++#define GATE_MM1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &mm1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate mt8173_mm_clks[] = { + /* MM0 */ +diff --git a/drivers/clk/mediatek/clk-mt8516-aud.c b/drivers/clk/mediatek/clk-mt8516-aud.c +index 90f48068a8de7..a3dafc719799c 100644 +--- a/drivers/clk/mediatek/clk-mt8516-aud.c ++++ b/drivers/clk/mediatek/clk-mt8516-aud.c +@@ -22,14 +22,8 @@ static const struct mtk_gate_regs aud_cg_regs = { + .sta_ofs = 0x0, + }; + +-#define GATE_AUD(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &aud_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_AUD(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &aud_cg_regs, _shift, &mtk_clk_gate_ops_no_setclr) + + static const struct mtk_gate aud_clks[] __initconst = { + GATE_AUD(CLK_AUD_AFE, "aud_afe", "clk26m_ck", 2), +diff --git a/drivers/clk/mediatek/clk-mt8516.c b/drivers/clk/mediatek/clk-mt8516.c +index b96db88893e23..056953d594c66 100644 +--- a/drivers/clk/mediatek/clk-mt8516.c ++++ b/drivers/clk/mediatek/clk-mt8516.c +@@ -525,59 +525,23 @@ static const struct mtk_gate_regs top5_cg_regs = { + .sta_ofs = 0x44, + }; + +-#define GATE_TOP1(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top1_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_TOP1(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_TOP2(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top2_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_TOP2(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top2_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_TOP2_I(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top2_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_TOP2_I(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top2_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + +-#define GATE_TOP3(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top3_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr, \ +- } ++#define GATE_TOP3(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top3_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +-#define GATE_TOP4_I(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top4_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_setclr_inv, \ +- } ++#define GATE_TOP4_I(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top4_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv) + +-#define GATE_TOP5(_id, _name, _parent, _shift) { \ +- .id = _id, \ +- .name = _name, \ +- .parent_name = _parent, \ +- .regs = &top5_cg_regs, \ +- .shift = _shift, \ +- .ops = &mtk_clk_gate_ops_no_setclr, \ +- } ++#define GATE_TOP5(_id, _name, _parent, _shift) \ ++ GATE_MTK(_id, _name, _parent, &top5_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + + static const struct mtk_gate top_clks[] __initconst = { + /* TOP1 */ +-- +2.39.2 + diff --git a/queue-6.2/clk-mediatek-mt2712-add-error-handling-to-clk_mt2712.patch b/queue-6.2/clk-mediatek-mt2712-add-error-handling-to-clk_mt2712.patch new file mode 100644 index 00000000000..52678e19220 --- /dev/null +++ b/queue-6.2/clk-mediatek-mt2712-add-error-handling-to-clk_mt2712.patch @@ -0,0 +1,59 @@ +From f8fbd996f12cb31b224bff295b03ac4c4a3d237b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 15:04:56 +0100 +Subject: clk: mediatek: mt2712: Add error handling to + clk_mt2712_apmixed_probe() + +From: AngeloGioacchino Del Regno + +[ Upstream commit 20cace1b9d7e33f68f0ee17196bf0df618dbacbe ] + +This function was completely missing error handling: add it. + +Fixes: e2f744a82d72 ("clk: mediatek: Add MT2712 clock support") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20230306140543.1813621-8-angelogioacchino.delregno@collabora.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt2712.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mt2712.c b/drivers/clk/mediatek/clk-mt2712.c +index 56980dd6c2eaf..7309b5813da96 100644 +--- a/drivers/clk/mediatek/clk-mt2712.c ++++ b/drivers/clk/mediatek/clk-mt2712.c +@@ -1283,15 +1283,25 @@ static int clk_mt2712_apmixed_probe(struct platform_device *pdev) + struct device_node *node = pdev->dev.of_node; + + clk_data = mtk_alloc_clk_data(CLK_APMIXED_NR_CLK); ++ if (!clk_data) ++ return -ENOMEM; + +- mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data); ++ r = mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data); ++ if (r) ++ goto free_clk_data; + + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); ++ if (r) { ++ dev_err(&pdev->dev, "Cannot register clock provider: %d\n", r); ++ goto unregister_plls; ++ } + +- if (r != 0) +- pr_err("%s(): could not register clock provider: %d\n", +- __func__, r); ++ return 0; + ++unregister_plls: ++ mtk_clk_unregister_plls(plls, ARRAY_SIZE(plls), clk_data); ++free_clk_data: ++ mtk_free_clk_data(clk_data); + return r; + } + +-- +2.39.2 + diff --git a/queue-6.2/clk-mediatek-mt7622-properly-use-clk_is_critical-fla.patch b/queue-6.2/clk-mediatek-mt7622-properly-use-clk_is_critical-fla.patch new file mode 100644 index 00000000000..5cf28587ef2 --- /dev/null +++ b/queue-6.2/clk-mediatek-mt7622-properly-use-clk_is_critical-fla.patch @@ -0,0 +1,120 @@ +From 1e8a62254226d9d0b23d75eb8db4b479e9f13569 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 15:05:12 +0100 +Subject: clk: mediatek: mt7622: Properly use CLK_IS_CRITICAL flag + +From: AngeloGioacchino Del Regno + +[ Upstream commit fa8c0d01df62130ff596d560380a6f844f62639e ] + +Instead of calling clk_prepare_enable() for clocks that shall stay +enabled, use the CLK_IS_CRITICAL flag, which purpose is exactly that. + +Fixes: 2fc0a509e4ee ("clk: mediatek: add clock support for MT7622 SoC") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20230306140543.1813621-24-angelogioacchino.delregno@collabora.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt7622.c | 35 +++++++++++++------------------ + 1 file changed, 15 insertions(+), 20 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mt7622.c b/drivers/clk/mediatek/clk-mt7622.c +index 41b3d032bf91c..eebbb87906930 100644 +--- a/drivers/clk/mediatek/clk-mt7622.c ++++ b/drivers/clk/mediatek/clk-mt7622.c +@@ -50,9 +50,9 @@ + _pd_reg, _pd_shift, _tuner_reg, _pcw_reg, _pcw_shift, \ + NULL, "clkxtal") + +-#define GATE_APMIXED(_id, _name, _parent, _shift) \ +- GATE_MTK(_id, _name, _parent, &apmixed_cg_regs, _shift, \ +- &mtk_clk_gate_ops_no_setclr_inv) ++#define GATE_APMIXED_AO(_id, _name, _parent, _shift) \ ++ GATE_MTK_FLAGS(_id, _name, _parent, &apmixed_cg_regs, _shift, \ ++ &mtk_clk_gate_ops_no_setclr_inv, CLK_IS_CRITICAL) + + #define GATE_INFRA(_id, _name, _parent, _shift) \ + GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr) +@@ -66,6 +66,10 @@ + #define GATE_PERI0(_id, _name, _parent, _shift) \ + GATE_MTK(_id, _name, _parent, &peri0_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + ++#define GATE_PERI0_AO(_id, _name, _parent, _shift) \ ++ GATE_MTK_FLAGS(_id, _name, _parent, &peri0_cg_regs, _shift, \ ++ &mtk_clk_gate_ops_setclr, CLK_IS_CRITICAL) ++ + #define GATE_PERI1(_id, _name, _parent, _shift) \ + GATE_MTK(_id, _name, _parent, &peri1_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + +@@ -315,7 +319,7 @@ static const struct mtk_pll_data plls[] = { + }; + + static const struct mtk_gate apmixed_clks[] = { +- GATE_APMIXED(CLK_APMIXED_MAIN_CORE_EN, "main_core_en", "mainpll", 5), ++ GATE_APMIXED_AO(CLK_APMIXED_MAIN_CORE_EN, "main_core_en", "mainpll", 5), + }; + + static const struct mtk_gate infra_clks[] = { +@@ -450,7 +454,7 @@ static const struct mtk_gate peri_clks[] = { + GATE_PERI0(CLK_PERI_AP_DMA_PD, "peri_ap_dma_pd", "axi_sel", 12), + GATE_PERI0(CLK_PERI_MSDC30_0_PD, "peri_msdc30_0", "msdc30_0_sel", 13), + GATE_PERI0(CLK_PERI_MSDC30_1_PD, "peri_msdc30_1", "msdc30_1_sel", 14), +- GATE_PERI0(CLK_PERI_UART0_PD, "peri_uart0_pd", "axi_sel", 17), ++ GATE_PERI0_AO(CLK_PERI_UART0_PD, "peri_uart0_pd", "axi_sel", 17), + GATE_PERI0(CLK_PERI_UART1_PD, "peri_uart1_pd", "axi_sel", 18), + GATE_PERI0(CLK_PERI_UART2_PD, "peri_uart2_pd", "axi_sel", 19), + GATE_PERI0(CLK_PERI_UART3_PD, "peri_uart3_pd", "axi_sel", 20), +@@ -478,12 +482,12 @@ static struct mtk_composite infra_muxes[] = { + + static struct mtk_composite top_muxes[] = { + /* CLK_CFG_0 */ +- MUX_GATE(CLK_TOP_AXI_SEL, "axi_sel", axi_parents, +- 0x040, 0, 3, 7), +- MUX_GATE(CLK_TOP_MEM_SEL, "mem_sel", mem_parents, +- 0x040, 8, 1, 15), +- MUX_GATE(CLK_TOP_DDRPHYCFG_SEL, "ddrphycfg_sel", ddrphycfg_parents, +- 0x040, 16, 1, 23), ++ MUX_GATE_FLAGS(CLK_TOP_AXI_SEL, "axi_sel", axi_parents, ++ 0x040, 0, 3, 7, CLK_IS_CRITICAL), ++ MUX_GATE_FLAGS(CLK_TOP_MEM_SEL, "mem_sel", mem_parents, ++ 0x040, 8, 1, 15, CLK_IS_CRITICAL), ++ MUX_GATE_FLAGS(CLK_TOP_DDRPHYCFG_SEL, "ddrphycfg_sel", ddrphycfg_parents, ++ 0x040, 16, 1, 23, CLK_IS_CRITICAL), + MUX_GATE(CLK_TOP_ETH_SEL, "eth_sel", eth_parents, + 0x040, 24, 3, 31), + +@@ -620,10 +624,6 @@ static int mtk_topckgen_init(struct platform_device *pdev) + mtk_clk_register_gates(node, top_clks, ARRAY_SIZE(top_clks), + clk_data); + +- clk_prepare_enable(clk_data->hws[CLK_TOP_AXI_SEL]->clk); +- clk_prepare_enable(clk_data->hws[CLK_TOP_MEM_SEL]->clk); +- clk_prepare_enable(clk_data->hws[CLK_TOP_DDRPHYCFG_SEL]->clk); +- + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + } + +@@ -666,9 +666,6 @@ static int mtk_apmixedsys_init(struct platform_device *pdev) + mtk_clk_register_gates(node, apmixed_clks, + ARRAY_SIZE(apmixed_clks), clk_data); + +- clk_prepare_enable(clk_data->hws[CLK_APMIXED_ARMPLL]->clk); +- clk_prepare_enable(clk_data->hws[CLK_APMIXED_MAIN_CORE_EN]->clk); +- + return of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + } + +@@ -695,8 +692,6 @@ static int mtk_pericfg_init(struct platform_device *pdev) + if (r) + return r; + +- clk_prepare_enable(clk_data->hws[CLK_PERI_UART0_PD]->clk); +- + mtk_register_reset_controller_with_dev(&pdev->dev, &clk_rst_desc[1]); + + return 0; +-- +2.39.2 + diff --git a/queue-6.2/clk-mediatek-mt8135-properly-use-clk_is_critical-fla.patch b/queue-6.2/clk-mediatek-mt8135-properly-use-clk_is_critical-fla.patch new file mode 100644 index 00000000000..4f868fd3b2f --- /dev/null +++ b/queue-6.2/clk-mediatek-mt8135-properly-use-clk_is_critical-fla.patch @@ -0,0 +1,85 @@ +From 5cb73631e4994f96c980c2dc5a9a85d16c7f2b59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 15:05:40 +0100 +Subject: clk: mediatek: mt8135: Properly use CLK_IS_CRITICAL flag + +From: AngeloGioacchino Del Regno + +[ Upstream commit f4f9a9c003b52ea3cffda186753bfb3e37b970f8 ] + +Instead of calling clk_prepare_enable() for clocks that shall stay +enabled, use the CLK_IS_CRITICAL flag, which purpose is exactly that. + +Fixes: a8aede794843 ("clk: mediatek: Add basic clocks for Mediatek MT8135.") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20230306140543.1813621-52-angelogioacchino.delregno@collabora.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt8135.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mt8135.c b/drivers/clk/mediatek/clk-mt8135.c +index 1cbe0958d9cd0..3ea06d2ec2f11 100644 +--- a/drivers/clk/mediatek/clk-mt8135.c ++++ b/drivers/clk/mediatek/clk-mt8135.c +@@ -2,6 +2,8 @@ + /* + * Copyright (c) 2014 MediaTek Inc. + * Author: James Liao ++ * Copyright (c) 2023 Collabora, Ltd. ++ * AngeloGioacchino Del Regno + */ + + #include +@@ -390,7 +392,7 @@ static const struct mtk_composite top_muxes[] __initconst = { + MUX_GATE(CLK_TOP_GCPU_SEL, "gcpu_sel", gcpu_parents, 0x0164, 24, 3, 31), + /* CLK_CFG_9 */ + MUX_GATE(CLK_TOP_DPI1_SEL, "dpi1_sel", dpi1_parents, 0x0168, 0, 2, 7), +- MUX_GATE(CLK_TOP_CCI_SEL, "cci_sel", cci_parents, 0x0168, 8, 3, 15), ++ MUX_GATE_FLAGS(CLK_TOP_CCI_SEL, "cci_sel", cci_parents, 0x0168, 8, 3, 15, CLK_IS_CRITICAL), + MUX_GATE(CLK_TOP_APLL_SEL, "apll_sel", apll_parents, 0x0168, 16, 3, 23), + MUX_GATE(CLK_TOP_HDMIPLL_SEL, "hdmipll_sel", hdmipll_parents, 0x0168, 24, 2, 31), + }; +@@ -404,6 +406,10 @@ static const struct mtk_gate_regs infra_cg_regs = { + #define GATE_ICG(_id, _name, _parent, _shift) \ + GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + ++#define GATE_ICG_AO(_id, _name, _parent, _shift) \ ++ GATE_MTK_FLAGS(_id, _name, _parent, &infra_cg_regs, _shift, \ ++ &mtk_clk_gate_ops_setclr, CLK_IS_CRITICAL) ++ + static const struct mtk_gate infra_clks[] __initconst = { + GATE_ICG(CLK_INFRA_PMIC_WRAP, "pmic_wrap_ck", "axi_sel", 23), + GATE_ICG(CLK_INFRA_PMICSPI, "pmicspi_ck", "pmicspi_sel", 22), +@@ -411,7 +417,7 @@ static const struct mtk_gate infra_clks[] __initconst = { + GATE_ICG(CLK_INFRA_CCIF0_AP_CTRL, "ccif0_ap_ctrl", "axi_sel", 20), + GATE_ICG(CLK_INFRA_KP, "kp_ck", "axi_sel", 16), + GATE_ICG(CLK_INFRA_CPUM, "cpum_ck", "cpum_tck_in", 15), +- GATE_ICG(CLK_INFRA_M4U, "m4u_ck", "mem_sel", 8), ++ GATE_ICG_AO(CLK_INFRA_M4U, "m4u_ck", "mem_sel", 8), + GATE_ICG(CLK_INFRA_MFGAXI, "mfgaxi_ck", "axi_sel", 7), + GATE_ICG(CLK_INFRA_DEVAPC, "devapc_ck", "axi_sel", 6), + GATE_ICG(CLK_INFRA_AUDIO, "audio_ck", "aud_intbus_sel", 5), +@@ -533,8 +539,6 @@ static void __init mtk_topckgen_init(struct device_node *node) + mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base, + &mt8135_clk_lock, clk_data); + +- clk_prepare_enable(clk_data->hws[CLK_TOP_CCI_SEL]->clk); +- + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) + pr_err("%s(): could not register clock provider: %d\n", +@@ -552,8 +556,6 @@ static void __init mtk_infrasys_init(struct device_node *node) + mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks), + clk_data); + +- clk_prepare_enable(clk_data->hws[CLK_INFRA_M4U]->clk); +- + r = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + if (r) + pr_err("%s(): could not register clock provider: %d\n", +-- +2.39.2 + diff --git a/queue-6.2/clk-qcom-dispcc-qcm2290-get-rid-of-test-clock.patch b/queue-6.2/clk-qcom-dispcc-qcm2290-get-rid-of-test-clock.patch new file mode 100644 index 00000000000..75ed52659ea --- /dev/null +++ b/queue-6.2/clk-qcom-dispcc-qcm2290-get-rid-of-test-clock.patch @@ -0,0 +1,76 @@ +From 1013e0e7014ef05330adf17f95abadfced041c61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Dec 2022 20:52:29 +0200 +Subject: clk: qcom: dispcc-qcm2290: get rid of test clock + +From: Dmitry Baryshkov + +[ Upstream commit 62db82f9c8004f1226f5cec8a5441fb89eb984fa ] + +The test clock apparently it's not used by anyone upstream. Remove it. + +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221228185237.3111988-9-dmitry.baryshkov@linaro.org +Stable-dep-of: 68d1151f0306 ("clk: qcom: dispcc-qcm2290: Remove inexistent DSI1PHY clk") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-qcm2290.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/clk/qcom/dispcc-qcm2290.c b/drivers/clk/qcom/dispcc-qcm2290.c +index 96b149365912a..2ebd9a02b8950 100644 +--- a/drivers/clk/qcom/dispcc-qcm2290.c ++++ b/drivers/clk/qcom/dispcc-qcm2290.c +@@ -71,7 +71,6 @@ static const struct parent_map disp_cc_parent_map_0[] = { + static const struct clk_parent_data disp_cc_parent_data_0[] = { + { .fw_name = "bi_tcxo" }, + { .fw_name = "dsi0_phy_pll_out_byteclk" }, +- { .fw_name = "core_bi_pll_test_se" }, + }; + + static const struct parent_map disp_cc_parent_map_1[] = { +@@ -80,7 +79,6 @@ static const struct parent_map disp_cc_parent_map_1[] = { + + static const struct clk_parent_data disp_cc_parent_data_1[] = { + { .fw_name = "bi_tcxo" }, +- { .fw_name = "core_bi_pll_test_se" }, + }; + + static const struct parent_map disp_cc_parent_map_2[] = { +@@ -91,7 +89,6 @@ static const struct parent_map disp_cc_parent_map_2[] = { + static const struct clk_parent_data disp_cc_parent_data_2[] = { + { .fw_name = "bi_tcxo_ao" }, + { .fw_name = "gcc_disp_gpll0_div_clk_src" }, +- { .fw_name = "core_bi_pll_test_se" }, + }; + + static const struct parent_map disp_cc_parent_map_3[] = { +@@ -104,7 +101,6 @@ static const struct clk_parent_data disp_cc_parent_data_3[] = { + { .fw_name = "bi_tcxo" }, + { .hw = &disp_cc_pll0.clkr.hw }, + { .fw_name = "gcc_disp_gpll0_clk_src" }, +- { .fw_name = "core_bi_pll_test_se" }, + }; + + static const struct parent_map disp_cc_parent_map_4[] = { +@@ -117,7 +113,6 @@ static const struct clk_parent_data disp_cc_parent_data_4[] = { + { .fw_name = "bi_tcxo" }, + { .fw_name = "dsi0_phy_pll_out_dsiclk" }, + { .fw_name = "dsi1_phy_pll_out_dsiclk" }, +- { .fw_name = "core_bi_pll_test_se" }, + }; + + static const struct parent_map disp_cc_parent_map_5[] = { +@@ -126,7 +121,6 @@ static const struct parent_map disp_cc_parent_map_5[] = { + + static const struct clk_parent_data disp_cc_parent_data_5[] = { + { .fw_name = "sleep_clk" }, +- { .fw_name = "core_bi_pll_test_se" }, + }; + + static struct clk_rcg2 disp_cc_mdss_byte0_clk_src = { +-- +2.39.2 + diff --git a/queue-6.2/clk-qcom-dispcc-qcm2290-remove-inexistent-dsi1phy-cl.patch b/queue-6.2/clk-qcom-dispcc-qcm2290-remove-inexistent-dsi1phy-cl.patch new file mode 100644 index 00000000000..e5bc0db86b1 --- /dev/null +++ b/queue-6.2/clk-qcom-dispcc-qcm2290-remove-inexistent-dsi1phy-cl.patch @@ -0,0 +1,50 @@ +From 7f4fc6637ccd8191aa7667e4775886d1fbd96994 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 16:53:06 +0200 +Subject: clk: qcom: dispcc-qcm2290: Remove inexistent DSI1PHY clk + +From: Konrad Dybcio + +[ Upstream commit 68d1151f03067533827fc50b770954ef33149533 ] + +There's only one DSI PHY on this SoC. Remove the ghost entry for the +clock produced by a secondary one. + +Fixes: cc517ea3333f ("clk: qcom: Add display clock controller driver for QCM2290") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230412-topic-qcm_dispcc-v1-2-bf2989a75ae4@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-qcm2290.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/clk/qcom/dispcc-qcm2290.c b/drivers/clk/qcom/dispcc-qcm2290.c +index 2ebd9a02b8950..24755dc841f9d 100644 +--- a/drivers/clk/qcom/dispcc-qcm2290.c ++++ b/drivers/clk/qcom/dispcc-qcm2290.c +@@ -26,7 +26,6 @@ enum { + P_DISP_CC_PLL0_OUT_MAIN, + P_DSI0_PHY_PLL_OUT_BYTECLK, + P_DSI0_PHY_PLL_OUT_DSICLK, +- P_DSI1_PHY_PLL_OUT_DSICLK, + P_GPLL0_OUT_MAIN, + P_SLEEP_CLK, + }; +@@ -106,13 +105,11 @@ static const struct clk_parent_data disp_cc_parent_data_3[] = { + static const struct parent_map disp_cc_parent_map_4[] = { + { P_BI_TCXO, 0 }, + { P_DSI0_PHY_PLL_OUT_DSICLK, 1 }, +- { P_DSI1_PHY_PLL_OUT_DSICLK, 2 }, + }; + + static const struct clk_parent_data disp_cc_parent_data_4[] = { + { .fw_name = "bi_tcxo" }, + { .fw_name = "dsi0_phy_pll_out_dsiclk" }, +- { .fw_name = "dsi1_phy_pll_out_dsiclk" }, + }; + + static const struct parent_map disp_cc_parent_map_5[] = { +-- +2.39.2 + diff --git a/queue-6.2/clk-qcom-gcc-qcm2290-fix-up-gcc_sdcc2_apps_clk_src.patch b/queue-6.2/clk-qcom-gcc-qcm2290-fix-up-gcc_sdcc2_apps_clk_src.patch new file mode 100644 index 00000000000..bb9c0c576bf --- /dev/null +++ b/queue-6.2/clk-qcom-gcc-qcm2290-fix-up-gcc_sdcc2_apps_clk_src.patch @@ -0,0 +1,38 @@ +From 4054315e798a9958d178ac4548257f3ba9c4454e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 18:30:48 +0100 +Subject: clk: qcom: gcc-qcm2290: Fix up gcc_sdcc2_apps_clk_src + +From: Konrad Dybcio + +[ Upstream commit 1bf088a9f0e50acd175ba8deef0db11c099fa26e ] + +Add the PARENT_ENABLE flag to prevent the clock from getting stuck +at boot and use floor_ops to avoid SDHCI overclocking. + +Fixes: 496d1a13d405 ("clk: qcom: Add Global Clock Controller driver for QCM2290") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230315173048.3497655-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-qcm2290.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-qcm2290.c b/drivers/clk/qcom/gcc-qcm2290.c +index 7792b8f237047..096deff2ba257 100644 +--- a/drivers/clk/qcom/gcc-qcm2290.c ++++ b/drivers/clk/qcom/gcc-qcm2290.c +@@ -1243,7 +1243,8 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = { + .name = "gcc_sdcc2_apps_clk_src", + .parent_data = gcc_parents_12, + .num_parents = ARRAY_SIZE(gcc_parents_12), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, ++ .flags = CLK_OPS_PARENT_ENABLE, + }, + }; + +-- +2.39.2 + diff --git a/queue-6.2/clk-qcom-gcc-sm6115-mark-rcgs-shared-where-applicabl.patch b/queue-6.2/clk-qcom-gcc-sm6115-mark-rcgs-shared-where-applicabl.patch new file mode 100644 index 00000000000..80575e99391 --- /dev/null +++ b/queue-6.2/clk-qcom-gcc-sm6115-mark-rcgs-shared-where-applicabl.patch @@ -0,0 +1,252 @@ +From eca62fa804599c3588cca38ff5f38c72a6976e84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 00:47:19 +0200 +Subject: clk: qcom: gcc-sm6115: Mark RCGs shared where applicable + +From: Konrad Dybcio + +[ Upstream commit 996c32b745a15a637e8244a25f06b74acce98976 ] + +The vast majority of shared RCGs were not marked as such. Fix it. + +Fixes: cbe63bfdc54f ("clk: qcom: Add Global Clock controller (GCC) driver for SM6115") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230404224719.909746-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sm6115.c | 50 +++++++++++++++++------------------ + 1 file changed, 25 insertions(+), 25 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-sm6115.c b/drivers/clk/qcom/gcc-sm6115.c +index 565f9912039fe..631419caf695a 100644 +--- a/drivers/clk/qcom/gcc-sm6115.c ++++ b/drivers/clk/qcom/gcc-sm6115.c +@@ -694,7 +694,7 @@ static struct clk_rcg2 gcc_camss_axi_clk_src = { + .parent_data = gcc_parents_7, + .num_parents = ARRAY_SIZE(gcc_parents_7), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -715,7 +715,7 @@ static struct clk_rcg2 gcc_camss_cci_clk_src = { + .parent_data = gcc_parents_9, + .num_parents = ARRAY_SIZE(gcc_parents_9), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -738,7 +738,7 @@ static struct clk_rcg2 gcc_camss_csi0phytimer_clk_src = { + .parent_data = gcc_parents_4, + .num_parents = ARRAY_SIZE(gcc_parents_4), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -753,7 +753,7 @@ static struct clk_rcg2 gcc_camss_csi1phytimer_clk_src = { + .parent_data = gcc_parents_4, + .num_parents = ARRAY_SIZE(gcc_parents_4), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -768,7 +768,7 @@ static struct clk_rcg2 gcc_camss_csi2phytimer_clk_src = { + .parent_data = gcc_parents_4, + .num_parents = ARRAY_SIZE(gcc_parents_4), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -790,7 +790,7 @@ static struct clk_rcg2 gcc_camss_mclk0_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -805,7 +805,7 @@ static struct clk_rcg2 gcc_camss_mclk1_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -820,7 +820,7 @@ static struct clk_rcg2 gcc_camss_mclk2_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -835,7 +835,7 @@ static struct clk_rcg2 gcc_camss_mclk3_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -857,7 +857,7 @@ static struct clk_rcg2 gcc_camss_ope_ahb_clk_src = { + .parent_data = gcc_parents_8, + .num_parents = ARRAY_SIZE(gcc_parents_8), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -881,7 +881,7 @@ static struct clk_rcg2 gcc_camss_ope_clk_src = { + .parent_data = gcc_parents_8, + .num_parents = ARRAY_SIZE(gcc_parents_8), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -916,7 +916,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_clk_src = { + .parent_data = gcc_parents_5, + .num_parents = ARRAY_SIZE(gcc_parents_5), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -941,7 +941,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_csid_clk_src = { + .parent_data = gcc_parents_6, + .num_parents = ARRAY_SIZE(gcc_parents_6), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -956,7 +956,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_clk_src = { + .parent_data = gcc_parents_5, + .num_parents = ARRAY_SIZE(gcc_parents_5), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -971,7 +971,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_csid_clk_src = { + .parent_data = gcc_parents_6, + .num_parents = ARRAY_SIZE(gcc_parents_6), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -986,7 +986,7 @@ static struct clk_rcg2 gcc_camss_tfe_2_clk_src = { + .parent_data = gcc_parents_5, + .num_parents = ARRAY_SIZE(gcc_parents_5), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1001,7 +1001,7 @@ static struct clk_rcg2 gcc_camss_tfe_2_csid_clk_src = { + .parent_data = gcc_parents_6, + .num_parents = ARRAY_SIZE(gcc_parents_6), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1024,7 +1024,7 @@ static struct clk_rcg2 gcc_camss_tfe_cphy_rx_clk_src = { + .parent_data = gcc_parents_10, + .num_parents = ARRAY_SIZE(gcc_parents_10), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1046,7 +1046,7 @@ static struct clk_rcg2 gcc_camss_top_ahb_clk_src = { + .parent_data = gcc_parents_7, + .num_parents = ARRAY_SIZE(gcc_parents_7), + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1116,7 +1116,7 @@ static struct clk_rcg2 gcc_pdm2_clk_src = { + .name = "gcc_pdm2_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1329,7 +1329,7 @@ static struct clk_rcg2 gcc_ufs_phy_axi_clk_src = { + .name = "gcc_ufs_phy_axi_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1351,7 +1351,7 @@ static struct clk_rcg2 gcc_ufs_phy_ice_core_clk_src = { + .name = "gcc_ufs_phy_ice_core_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1392,7 +1392,7 @@ static struct clk_rcg2 gcc_ufs_phy_unipro_core_clk_src = { + .name = "gcc_ufs_phy_unipro_core_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1414,7 +1414,7 @@ static struct clk_rcg2 gcc_usb30_prim_master_clk_src = { + .name = "gcc_usb30_prim_master_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1483,7 +1483,7 @@ static struct clk_rcg2 gcc_video_venus_clk_src = { + .parent_data = gcc_parents_13, + .num_parents = ARRAY_SIZE(gcc_parents_13), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +-- +2.39.2 + diff --git a/queue-6.2/clk-qcom-gcc-sm8350-fix-pcie-pipe-clocks-handling.patch b/queue-6.2/clk-qcom-gcc-sm8350-fix-pcie-pipe-clocks-handling.patch new file mode 100644 index 00000000000..9eef80631b8 --- /dev/null +++ b/queue-6.2/clk-qcom-gcc-sm8350-fix-pcie-pipe-clocks-handling.patch @@ -0,0 +1,111 @@ +From 80e5eadb38dd803db44b3cdcb63502ac86a7c5bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 16:48:29 +0300 +Subject: clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling + +From: Dmitry Baryshkov + +[ Upstream commit 1a500e0bc97b6cb3c0d9859e81973b8dd07d1b7b ] + +On SM8350 platform the PCIe PIPE clocks require additional handling to +function correctly. They are to be switched to the tcxo source before +turning PCIe GDSCs off and should be switched to PHY PIPE source once +they are working. Switch PCIe PHY clocks to use clk_regmap_phy_mux_ops, +which provide support for this dance. + +Fixes: 44c20c9ed37f ("clk: qcom: gcc: Add clock driver for SM8350") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230412134829.3686467-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sm8350.c | 47 ++++++++++------------------------- + 1 file changed, 13 insertions(+), 34 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-sm8350.c b/drivers/clk/qcom/gcc-sm8350.c +index c3731f96c8e6b..430ef407a8341 100644 +--- a/drivers/clk/qcom/gcc-sm8350.c ++++ b/drivers/clk/qcom/gcc-sm8350.c +@@ -17,6 +17,7 @@ + #include "clk-regmap.h" + #include "clk-regmap-divider.h" + #include "clk-regmap-mux.h" ++#include "clk-regmap-phy-mux.h" + #include "gdsc.h" + #include "reset.h" + +@@ -167,26 +168,6 @@ static const struct clk_parent_data gcc_parent_data_3[] = { + { .fw_name = "core_bi_pll_test_se" }, + }; + +-static const struct parent_map gcc_parent_map_4[] = { +- { P_PCIE_0_PIPE_CLK, 0 }, +- { P_BI_TCXO, 2 }, +-}; +- +-static const struct clk_parent_data gcc_parent_data_4[] = { +- { .fw_name = "pcie_0_pipe_clk", }, +- { .fw_name = "bi_tcxo" }, +-}; +- +-static const struct parent_map gcc_parent_map_5[] = { +- { P_PCIE_1_PIPE_CLK, 0 }, +- { P_BI_TCXO, 2 }, +-}; +- +-static const struct clk_parent_data gcc_parent_data_5[] = { +- { .fw_name = "pcie_1_pipe_clk" }, +- { .fw_name = "bi_tcxo" }, +-}; +- + static const struct parent_map gcc_parent_map_6[] = { + { P_BI_TCXO, 0 }, + { P_GCC_GPLL0_OUT_MAIN, 1 }, +@@ -289,32 +270,30 @@ static const struct clk_parent_data gcc_parent_data_14[] = { + { .fw_name = "bi_tcxo" }, + }; + +-static struct clk_regmap_mux gcc_pcie_0_pipe_clk_src = { ++static struct clk_regmap_phy_mux gcc_pcie_0_pipe_clk_src = { + .reg = 0x6b054, +- .shift = 0, +- .width = 2, +- .parent_map = gcc_parent_map_4, + .clkr = { + .hw.init = &(struct clk_init_data){ + .name = "gcc_pcie_0_pipe_clk_src", +- .parent_data = gcc_parent_data_4, +- .num_parents = ARRAY_SIZE(gcc_parent_data_4), +- .ops = &clk_regmap_mux_closest_ops, ++ .parent_data = &(const struct clk_parent_data){ ++ .fw_name = "pcie_0_pipe_clk", ++ }, ++ .num_parents = 1, ++ .ops = &clk_regmap_phy_mux_ops, + }, + }, + }; + +-static struct clk_regmap_mux gcc_pcie_1_pipe_clk_src = { ++static struct clk_regmap_phy_mux gcc_pcie_1_pipe_clk_src = { + .reg = 0x8d054, +- .shift = 0, +- .width = 2, +- .parent_map = gcc_parent_map_5, + .clkr = { + .hw.init = &(struct clk_init_data){ + .name = "gcc_pcie_1_pipe_clk_src", +- .parent_data = gcc_parent_data_5, +- .num_parents = ARRAY_SIZE(gcc_parent_data_5), +- .ops = &clk_regmap_mux_closest_ops, ++ .parent_data = &(const struct clk_parent_data){ ++ .fw_name = "pcie_1_pipe_clk", ++ }, ++ .num_parents = 1, ++ .ops = &clk_regmap_phy_mux_ops, + }, + }, + }; +-- +2.39.2 + diff --git a/queue-6.2/clk-qcom-lpassaudiocc-sc7280-add-required-gdsc-power.patch b/queue-6.2/clk-qcom-lpassaudiocc-sc7280-add-required-gdsc-power.patch new file mode 100644 index 00000000000..da47a319a1e --- /dev/null +++ b/queue-6.2/clk-qcom-lpassaudiocc-sc7280-add-required-gdsc-power.patch @@ -0,0 +1,40 @@ +From 9cadbd902b81e70ff10261aa4d290b9d7bece0f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 14:52:55 +0530 +Subject: clk: qcom: lpassaudiocc-sc7280: Add required gdsc power domain clks + in lpass_cc_sc7280_desc + +From: Mohammad Rafi Shaik + +[ Upstream commit aad09fc7c4a522892eb64a79627b17a3869936cb ] + +Add GDSCs in lpass_cc_sc7280_desc struct. +When qcom,adsp-pil-mode is enabled, GDSCs required to solve +dependencies in lpass_audiocc probe(). + +Fixes: 0cbcfbe50cbf ("clk: qcom: lpass: Handle the regmap overlap of lpasscc and lpass_aon") +Signed-off-by: Mohammad Rafi Shaik +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230407092255.119690-4-quic_mohs@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/lpassaudiocc-sc7280.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/lpassaudiocc-sc7280.c b/drivers/clk/qcom/lpassaudiocc-sc7280.c +index 1339f9211a149..134eb1529ede2 100644 +--- a/drivers/clk/qcom/lpassaudiocc-sc7280.c ++++ b/drivers/clk/qcom/lpassaudiocc-sc7280.c +@@ -696,6 +696,8 @@ static const struct qcom_cc_desc lpass_cc_sc7280_desc = { + .config = &lpass_audio_cc_sc7280_regmap_config, + .clks = lpass_cc_sc7280_clocks, + .num_clks = ARRAY_SIZE(lpass_cc_sc7280_clocks), ++ .gdscs = lpass_aon_cc_sc7280_gdscs, ++ .num_gdscs = ARRAY_SIZE(lpass_aon_cc_sc7280_gdscs), + }; + + static const struct qcom_cc_desc lpass_audio_cc_sc7280_desc = { +-- +2.39.2 + diff --git a/queue-6.2/clk-qcom-lpasscc-sc7280-skip-qdsp6ss-clock-registrat.patch b/queue-6.2/clk-qcom-lpasscc-sc7280-skip-qdsp6ss-clock-registrat.patch new file mode 100644 index 00000000000..71be71f8b71 --- /dev/null +++ b/queue-6.2/clk-qcom-lpasscc-sc7280-skip-qdsp6ss-clock-registrat.patch @@ -0,0 +1,58 @@ +From 06962bcd82dca3b1d3bfe4fdafabf340bbc6c687 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 14:52:54 +0530 +Subject: clk: qcom: lpasscc-sc7280: Skip qdsp6ss clock registration + +From: Srinivasa Rao Mandadapu + +[ Upstream commit 4fc1c2d9a2b7a394f3b873aae5e03bffd8b5cd31 ] + +The qdsp6ss memory region is being shared by ADSP remoteproc device and +lpasscc clock device, hence causing memory conflict. +To avoid this, when qdsp6ss clocks are being enabled in remoteproc driver, +skip qdsp6ss clock registration if "qcom,adsp-pil-mode" is enabled and +also assign max_register value. + +Fixes: 4ab43d171181 ("clk: qcom: Add lpass clock controller driver for SC7280") +Signed-off-by: Srinivasa Rao Mandadapu +Signed-off-by: Mohammad Rafi Shaik +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230407092255.119690-3-quic_mohs@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/lpasscc-sc7280.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/clk/qcom/lpasscc-sc7280.c b/drivers/clk/qcom/lpasscc-sc7280.c +index 5c1e17bd0d763..8486d7135ab10 100644 +--- a/drivers/clk/qcom/lpasscc-sc7280.c ++++ b/drivers/clk/qcom/lpasscc-sc7280.c +@@ -118,14 +118,18 @@ static int lpass_cc_sc7280_probe(struct platform_device *pdev) + goto destroy_pm_clk; + } + +- lpass_regmap_config.name = "qdsp6ss"; +- desc = &lpass_qdsp6ss_sc7280_desc; +- +- ret = qcom_cc_probe_by_index(pdev, 0, desc); +- if (ret) +- goto destroy_pm_clk; ++ if (!of_property_read_bool(pdev->dev.of_node, "qcom,adsp-pil-mode")) { ++ lpass_regmap_config.name = "qdsp6ss"; ++ lpass_regmap_config.max_register = 0x3f; ++ desc = &lpass_qdsp6ss_sc7280_desc; ++ ++ ret = qcom_cc_probe_by_index(pdev, 0, desc); ++ if (ret) ++ goto destroy_pm_clk; ++ } + + lpass_regmap_config.name = "top_cc"; ++ lpass_regmap_config.max_register = 0x4; + desc = &lpass_cc_top_sc7280_desc; + + ret = qcom_cc_probe_by_index(pdev, 1, desc); +-- +2.39.2 + diff --git a/queue-6.2/clocksource-drivers-davinci-fix-memory-leak-in-davin.patch b/queue-6.2/clocksource-drivers-davinci-fix-memory-leak-in-davin.patch new file mode 100644 index 00000000000..2a46c481446 --- /dev/null +++ b/queue-6.2/clocksource-drivers-davinci-fix-memory-leak-in-davin.patch @@ -0,0 +1,101 @@ +From 6802a7ba93c46e7dc7c8efb212df6c6481e9294c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 13:50:37 +0000 +Subject: clocksource/drivers/davinci: Fix memory leak in + davinci_timer_register when init fails + +From: Qinrun Dai + +[ Upstream commit fb73556386e074e9bee9fa2d253aeaefe4e063e0 ] + +Smatch reports: +drivers/clocksource/timer-davinci.c:332 davinci_timer_register() +warn: 'base' from ioremap() not released on lines: 274. + +Fix this and other potential memory leak problems +by adding a set of corresponding exit lables. + +Fixes: 721154f972aa ("clocksource/drivers/davinci: Add support for clockevents") +Signed-off-by: Qinrun Dai +Link: https://lore.kernel.org/r/20230413135037.1505799-1-flno@hust.edu.cn +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-davinci.c | 30 +++++++++++++++++++++++------ + 1 file changed, 24 insertions(+), 6 deletions(-) + +diff --git a/drivers/clocksource/timer-davinci.c b/drivers/clocksource/timer-davinci.c +index 9996c05425200..b1c248498be46 100644 +--- a/drivers/clocksource/timer-davinci.c ++++ b/drivers/clocksource/timer-davinci.c +@@ -257,21 +257,25 @@ int __init davinci_timer_register(struct clk *clk, + resource_size(&timer_cfg->reg), + "davinci-timer")) { + pr_err("Unable to request memory region\n"); +- return -EBUSY; ++ rv = -EBUSY; ++ goto exit_clk_disable; + } + + base = ioremap(timer_cfg->reg.start, resource_size(&timer_cfg->reg)); + if (!base) { + pr_err("Unable to map the register range\n"); +- return -ENOMEM; ++ rv = -ENOMEM; ++ goto exit_mem_region; + } + + davinci_timer_init(base); + tick_rate = clk_get_rate(clk); + + clockevent = kzalloc(sizeof(*clockevent), GFP_KERNEL); +- if (!clockevent) +- return -ENOMEM; ++ if (!clockevent) { ++ rv = -ENOMEM; ++ goto exit_iounmap_base; ++ } + + clockevent->dev.name = "tim12"; + clockevent->dev.features = CLOCK_EVT_FEAT_ONESHOT; +@@ -296,7 +300,7 @@ int __init davinci_timer_register(struct clk *clk, + "clockevent/tim12", clockevent); + if (rv) { + pr_err("Unable to request the clockevent interrupt\n"); +- return rv; ++ goto exit_free_clockevent; + } + + davinci_clocksource.dev.rating = 300; +@@ -323,13 +327,27 @@ int __init davinci_timer_register(struct clk *clk, + rv = clocksource_register_hz(&davinci_clocksource.dev, tick_rate); + if (rv) { + pr_err("Unable to register clocksource\n"); +- return rv; ++ goto exit_free_irq; + } + + sched_clock_register(davinci_timer_read_sched_clock, + DAVINCI_TIMER_CLKSRC_BITS, tick_rate); + + return 0; ++ ++exit_free_irq: ++ free_irq(timer_cfg->irq[DAVINCI_TIMER_CLOCKEVENT_IRQ].start, ++ clockevent); ++exit_free_clockevent: ++ kfree(clockevent); ++exit_iounmap_base: ++ iounmap(base); ++exit_mem_region: ++ release_mem_region(timer_cfg->reg.start, ++ resource_size(&timer_cfg->reg)); ++exit_clk_disable: ++ clk_disable_unprepare(clk); ++ return rv; + } + + static int __init of_davinci_timer_register(struct device_node *np) +-- +2.39.2 + diff --git a/queue-6.2/coresight-etm_pmu-set-the-module-field.patch b/queue-6.2/coresight-etm_pmu-set-the-module-field.patch new file mode 100644 index 00000000000..527e815bd66 --- /dev/null +++ b/queue-6.2/coresight-etm_pmu-set-the-module-field.patch @@ -0,0 +1,35 @@ +From dfd6b2049b1eafe7ca3b28cf69328f51fdbef51c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 10:49:22 +0100 +Subject: coresight: etm_pmu: Set the module field + +From: Suzuki K Poulose + +[ Upstream commit 18996a113f2567aef3057e300e3193ce2df1684c ] + +struct pmu::module must be set to the module owning the PMU driver. +Set this for the coresight etm_pmu. + +Fixes: 8e264c52e1dab ("coresight: core: Allow the coresight core driver to be built as a module") +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230405094922.667834-1-suzuki.poulose@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm-perf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c +index 43bbd5dc3d3b1..f9a0ee49d8e80 100644 +--- a/drivers/hwtracing/coresight/coresight-etm-perf.c ++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c +@@ -870,6 +870,7 @@ int __init etm_perf_init(void) + etm_pmu.addr_filters_sync = etm_addr_filters_sync; + etm_pmu.addr_filters_validate = etm_addr_filters_validate; + etm_pmu.nr_addr_filters = ETM_ADDR_CMP_MAX; ++ etm_pmu.module = THIS_MODULE; + + ret = perf_pmu_register(&etm_pmu, CORESIGHT_ETM_PMU_NAME, -1); + if (ret == 0) +-- +2.39.2 + diff --git a/queue-6.2/cpufreq-mediatek-fix-kp-caused-by-handler-usage-afte.patch b/queue-6.2/cpufreq-mediatek-fix-kp-caused-by-handler-usage-afte.patch new file mode 100644 index 00000000000..7a2352642ef --- /dev/null +++ b/queue-6.2/cpufreq-mediatek-fix-kp-caused-by-handler-usage-afte.patch @@ -0,0 +1,159 @@ +From 70abfc585717a59a18ba855e64f735f8beaa34c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 18:11:28 +0800 +Subject: cpufreq: mediatek: fix KP caused by handler usage after + regulator_put/clk_put + +From: Jia-Wei Chang + +[ Upstream commit d51e106240bc755cbe59634b70d567c192b045b2 ] + +Any kind of failure in mtk_cpu_dvfs_info_init() will lead to calling +regulator_put() or clk_put() and the KP will occur since the regulator/clk +handlers are used after released in mtk_cpu_dvfs_info_release(). + +To prevent the usage after regulator_put()/clk_put(), the regulator/clk +handlers are addressed in a way of "Free the Last Thing Style". + +Signed-off-by: Jia-Wei Chang +Fixes: 4b9ceb757bbb ("cpufreq: mediatek: Enable clocks and regulators") +Suggested-by: AngeloGioacchino Del Regno +Suggested-by: Dan Carpenter +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 62 +++++++++++++++--------------- + 1 file changed, 30 insertions(+), 32 deletions(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 01d949707c373..6dc225546a8d6 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -420,7 +420,7 @@ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu) + ret = PTR_ERR(info->inter_clk); + dev_err_probe(cpu_dev, ret, + "cpu%d: failed to get intermediate clk\n", cpu); +- goto out_free_resources; ++ goto out_free_mux_clock; + } + + info->proc_reg = regulator_get_optional(cpu_dev, "proc"); +@@ -428,13 +428,13 @@ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu) + ret = PTR_ERR(info->proc_reg); + dev_err_probe(cpu_dev, ret, + "cpu%d: failed to get proc regulator\n", cpu); +- goto out_free_resources; ++ goto out_free_inter_clock; + } + + ret = regulator_enable(info->proc_reg); + if (ret) { + dev_warn(cpu_dev, "cpu%d: failed to enable vproc\n", cpu); +- goto out_free_resources; ++ goto out_free_proc_reg; + } + + /* Both presence and absence of sram regulator are valid cases. */ +@@ -442,14 +442,14 @@ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu) + if (IS_ERR(info->sram_reg)) { + ret = PTR_ERR(info->sram_reg); + if (ret == -EPROBE_DEFER) +- goto out_free_resources; ++ goto out_disable_proc_reg; + + info->sram_reg = NULL; + } else { + ret = regulator_enable(info->sram_reg); + if (ret) { + dev_warn(cpu_dev, "cpu%d: failed to enable vsram\n", cpu); +- goto out_free_resources; ++ goto out_free_sram_reg; + } + } + +@@ -458,13 +458,13 @@ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu) + if (ret) { + dev_err(cpu_dev, + "cpu%d: failed to get OPP-sharing information\n", cpu); +- goto out_free_resources; ++ goto out_disable_sram_reg; + } + + ret = dev_pm_opp_of_cpumask_add_table(&info->cpus); + if (ret) { + dev_warn(cpu_dev, "cpu%d: no OPP table\n", cpu); +- goto out_free_resources; ++ goto out_disable_sram_reg; + } + + ret = clk_prepare_enable(info->cpu_clk); +@@ -533,43 +533,41 @@ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu) + out_free_opp_table: + dev_pm_opp_of_cpumask_remove_table(&info->cpus); + +-out_free_resources: +- if (regulator_is_enabled(info->proc_reg)) +- regulator_disable(info->proc_reg); +- if (info->sram_reg && regulator_is_enabled(info->sram_reg)) ++out_disable_sram_reg: ++ if (info->sram_reg) + regulator_disable(info->sram_reg); + +- if (!IS_ERR(info->proc_reg)) +- regulator_put(info->proc_reg); +- if (!IS_ERR(info->sram_reg)) ++out_free_sram_reg: ++ if (info->sram_reg) + regulator_put(info->sram_reg); +- if (!IS_ERR(info->cpu_clk)) +- clk_put(info->cpu_clk); +- if (!IS_ERR(info->inter_clk)) +- clk_put(info->inter_clk); ++ ++out_disable_proc_reg: ++ regulator_disable(info->proc_reg); ++ ++out_free_proc_reg: ++ regulator_put(info->proc_reg); ++ ++out_free_inter_clock: ++ clk_put(info->inter_clk); ++ ++out_free_mux_clock: ++ clk_put(info->cpu_clk); + + return ret; + } + + static void mtk_cpu_dvfs_info_release(struct mtk_cpu_dvfs_info *info) + { +- if (!IS_ERR(info->proc_reg)) { +- regulator_disable(info->proc_reg); +- regulator_put(info->proc_reg); +- } +- if (!IS_ERR(info->sram_reg)) { ++ regulator_disable(info->proc_reg); ++ regulator_put(info->proc_reg); ++ if (info->sram_reg) { + regulator_disable(info->sram_reg); + regulator_put(info->sram_reg); + } +- if (!IS_ERR(info->cpu_clk)) { +- clk_disable_unprepare(info->cpu_clk); +- clk_put(info->cpu_clk); +- } +- if (!IS_ERR(info->inter_clk)) { +- clk_disable_unprepare(info->inter_clk); +- clk_put(info->inter_clk); +- } +- ++ clk_disable_unprepare(info->cpu_clk); ++ clk_put(info->cpu_clk); ++ clk_disable_unprepare(info->inter_clk); ++ clk_put(info->inter_clk); + dev_pm_opp_of_cpumask_remove_table(&info->cpus); + dev_pm_opp_unregister_notifier(info->cpu_dev, &info->opp_nb); + } +-- +2.39.2 + diff --git a/queue-6.2/cpufreq-mediatek-fix-passing-zero-to-ptr_err.patch b/queue-6.2/cpufreq-mediatek-fix-passing-zero-to-ptr_err.patch new file mode 100644 index 00000000000..b61efc09b0d --- /dev/null +++ b/queue-6.2/cpufreq-mediatek-fix-passing-zero-to-ptr_err.patch @@ -0,0 +1,57 @@ +From edea1919c4bd401d6946b7ce7d00cf6166b4f00f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 18:11:27 +0800 +Subject: cpufreq: mediatek: fix passing zero to 'PTR_ERR' + +From: Jia-Wei Chang + +[ Upstream commit d51c63230994f167126d9d8381011b4cb2b0ad22 ] + +In order to prevent passing zero to 'PTR_ERR' in +mtk_cpu_dvfs_info_init(), we fix the return value of of_get_cci() using +error pointer by explicitly casting error number. + +Signed-off-by: Jia-Wei Chang +Fixes: 0daa47325bae ("cpufreq: mediatek: Link CCI device to CPU") +Reported-by: Dan Carpenter +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 7f2680bc9a0f4..01d949707c373 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -373,13 +373,13 @@ static struct device *of_get_cci(struct device *cpu_dev) + struct platform_device *pdev; + + np = of_parse_phandle(cpu_dev->of_node, "mediatek,cci", 0); +- if (IS_ERR_OR_NULL(np)) +- return NULL; ++ if (!np) ++ return ERR_PTR(-ENODEV); + + pdev = of_find_device_by_node(np); + of_node_put(np); +- if (IS_ERR_OR_NULL(pdev)) +- return NULL; ++ if (!pdev) ++ return ERR_PTR(-ENODEV); + + return &pdev->dev; + } +@@ -401,7 +401,7 @@ static int mtk_cpu_dvfs_info_init(struct mtk_cpu_dvfs_info *info, int cpu) + info->ccifreq_bound = false; + if (info->soc_data->ccifreq_supported) { + info->cci_dev = of_get_cci(info->cpu_dev); +- if (IS_ERR_OR_NULL(info->cci_dev)) { ++ if (IS_ERR(info->cci_dev)) { + ret = PTR_ERR(info->cci_dev); + dev_err(cpu_dev, "cpu%d: failed to get cci device\n", cpu); + return -ENODEV; +-- +2.39.2 + diff --git a/queue-6.2/cpufreq-mediatek-raise-proc-and-sram-max-voltage-for.patch b/queue-6.2/cpufreq-mediatek-raise-proc-and-sram-max-voltage-for.patch new file mode 100644 index 00000000000..e030649c6dd --- /dev/null +++ b/queue-6.2/cpufreq-mediatek-raise-proc-and-sram-max-voltage-for.patch @@ -0,0 +1,67 @@ +From e23b16ed9287f3d3cded08f0439888bc0715de52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 18:11:30 +0800 +Subject: cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623 + +From: AngeloGioacchino Del Regno + +[ Upstream commit 0883426fd07e39355362e3f2eb9aee1a154dcaf6 ] + +During the addition of SRAM voltage tracking for CCI scaling, this +driver got some voltage limits set for the vtrack algorithm: these +were moved to platform data first, then enforced in a later commit +6a17b3876bc8 ("cpufreq: mediatek: Refine mtk_cpufreq_voltage_tracking()") +using these as max values for the regulator_set_voltage() calls. + +In this case, the vsram/vproc constraints for MT7622 and MT7623 +were supposed to be the same as MT2701 (and a number of other SoCs), +but that turned out to be a mistake because the aforementioned two +SoCs' maximum voltage for both VPROC and VPROC_SRAM is 1.36V. + +Fix that by adding new platform data for MT7622/7623 declaring the +right {proc,sram}_max_volt parameter. + +Fixes: ead858bd128d ("cpufreq: mediatek: Move voltage limits to platform data") +Fixes: 6a17b3876bc8 ("cpufreq: mediatek: Refine mtk_cpufreq_voltage_tracking()") +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Jia-Wei Chang +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 764e4fbdd536c..9a39a7ccfae96 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -693,6 +693,15 @@ static const struct mtk_cpufreq_platform_data mt2701_platform_data = { + .ccifreq_supported = false, + }; + ++static const struct mtk_cpufreq_platform_data mt7622_platform_data = { ++ .min_volt_shift = 100000, ++ .max_volt_shift = 200000, ++ .proc_max_volt = 1360000, ++ .sram_min_volt = 0, ++ .sram_max_volt = 1360000, ++ .ccifreq_supported = false, ++}; ++ + static const struct mtk_cpufreq_platform_data mt8183_platform_data = { + .min_volt_shift = 100000, + .max_volt_shift = 200000, +@@ -724,8 +733,8 @@ static const struct mtk_cpufreq_platform_data mt8516_platform_data = { + static const struct of_device_id mtk_cpufreq_machines[] __initconst = { + { .compatible = "mediatek,mt2701", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt2712", .data = &mt2701_platform_data }, +- { .compatible = "mediatek,mt7622", .data = &mt2701_platform_data }, +- { .compatible = "mediatek,mt7623", .data = &mt2701_platform_data }, ++ { .compatible = "mediatek,mt7622", .data = &mt7622_platform_data }, ++ { .compatible = "mediatek,mt7623", .data = &mt7622_platform_data }, + { .compatible = "mediatek,mt8167", .data = &mt8516_platform_data }, + { .compatible = "mediatek,mt817x", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt8173", .data = &mt2701_platform_data }, +-- +2.39.2 + diff --git a/queue-6.2/cpufreq-mediatek-raise-proc-sram-max-voltage-for-mt8.patch b/queue-6.2/cpufreq-mediatek-raise-proc-sram-max-voltage-for-mt8.patch new file mode 100644 index 00000000000..8ebcd2cfbe9 --- /dev/null +++ b/queue-6.2/cpufreq-mediatek-raise-proc-sram-max-voltage-for-mt8.patch @@ -0,0 +1,64 @@ +From 3ced8ba69406c316f3d224b82fe9755ad297001a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 18:11:29 +0800 +Subject: cpufreq: mediatek: raise proc/sram max voltage for MT8516 + +From: Jia-Wei Chang + +[ Upstream commit d3296bb4cafd4bad4a5cf2eeab9d19cc94f9e30e ] + +Since the upper boundary of proc/sram voltage of MT8516 is 1300 mV, +which is greater than the value of MT2701 1150 mV, we fix it by adding +the corresponding platform data and specify proc/sram_max_volt to +support MT8516. + +Signed-off-by: Jia-Wei Chang +Fixes: ead858bd128d ("cpufreq: mediatek: Move voltage limits to platform data") +Fixes: 6a17b3876bc8 ("cpufreq: mediatek: Refine mtk_cpufreq_voltage_tracking()") +Reported-by: Nick Hainke +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 6dc225546a8d6..764e4fbdd536c 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -711,20 +711,29 @@ static const struct mtk_cpufreq_platform_data mt8186_platform_data = { + .ccifreq_supported = true, + }; + ++static const struct mtk_cpufreq_platform_data mt8516_platform_data = { ++ .min_volt_shift = 100000, ++ .max_volt_shift = 200000, ++ .proc_max_volt = 1310000, ++ .sram_min_volt = 0, ++ .sram_max_volt = 1310000, ++ .ccifreq_supported = false, ++}; ++ + /* List of machines supported by this driver */ + static const struct of_device_id mtk_cpufreq_machines[] __initconst = { + { .compatible = "mediatek,mt2701", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt2712", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt7622", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt7623", .data = &mt2701_platform_data }, +- { .compatible = "mediatek,mt8167", .data = &mt2701_platform_data }, ++ { .compatible = "mediatek,mt8167", .data = &mt8516_platform_data }, + { .compatible = "mediatek,mt817x", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt8173", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt8176", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt8183", .data = &mt8183_platform_data }, + { .compatible = "mediatek,mt8186", .data = &mt8186_platform_data }, + { .compatible = "mediatek,mt8365", .data = &mt2701_platform_data }, +- { .compatible = "mediatek,mt8516", .data = &mt2701_platform_data }, ++ { .compatible = "mediatek,mt8516", .data = &mt8516_platform_data }, + { } + }; + MODULE_DEVICE_TABLE(of, mtk_cpufreq_machines); +-- +2.39.2 + diff --git a/queue-6.2/cpufreq-qcom-cpufreq-hw-revert-adding-cpufreq-qos.patch b/queue-6.2/cpufreq-qcom-cpufreq-hw-revert-adding-cpufreq-qos.patch new file mode 100644 index 00000000000..065d3202fb1 --- /dev/null +++ b/queue-6.2/cpufreq-qcom-cpufreq-hw-revert-adding-cpufreq-qos.patch @@ -0,0 +1,104 @@ +From 08bd23fac19215b36052bd8e9a2e001dab9782c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 15:33:43 -0700 +Subject: cpufreq: qcom-cpufreq-hw: Revert adding cpufreq qos + +From: Bjorn Andersson + +[ Upstream commit e2b47e585931a988c856fd4ba31e1296f749aee3 ] + +The OSM/EPSS hardware controls the frequency of each CPU cluster based +on requests from the OS and various throttling events in the system. +While throttling is in effect the related dcvs interrupt will be kept +high. The purpose of the code handling this interrupt is to +continuously report the thermal pressure based on the throttled +frequency. + +The reasoning for adding QoS control to this mechanism is not entirely +clear, but the introduction of commit 'c4c0efb06f17 ("cpufreq: +qcom-cpufreq-hw: Add cpufreq qos for LMh")' causes the +scaling_max_frequncy to be set to the throttled frequency. On the next +iteration of polling, the throttled frequency is above or equal to the +newly requested frequency, so the polling is stopped. + +With cpufreq limiting the max frequency, the hardware no longer report a +throttling state and no further updates to thermal pressure or qos +state are made. + +The result of this is that scaling_max_frequency can only go down, and +the system becomes slower and slower every time a thermal throttling +event is reported by the hardware. + +Even if the logic could be improved, there is no reason for software to +limit the max freqency in response to the hardware limiting the max +frequency. At best software will follow the reported hardware state, but +typically it will cause slower backoff of the throttling. + +This reverts commit c4c0efb06f17fa4a37ad99e7752b18a5405c76dc. + +Fixes: c4c0efb06f17 ("cpufreq: qcom-cpufreq-hw: Add cpufreq qos for LMh") +Reported-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Reviewed-by: Konrad Dybcio +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/qcom-cpufreq-hw.c | 14 -------------- + 1 file changed, 14 deletions(-) + +diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c +index e8e42dbaf86c0..64a50777d88b8 100644 +--- a/drivers/cpufreq/qcom-cpufreq-hw.c ++++ b/drivers/cpufreq/qcom-cpufreq-hw.c +@@ -14,7 +14,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -57,8 +56,6 @@ struct qcom_cpufreq_data { + struct clk_hw cpu_clk; + + bool per_core_dcvs; +- +- struct freq_qos_request throttle_freq_req; + }; + + static struct { +@@ -348,8 +345,6 @@ static void qcom_lmh_dcvs_notify(struct qcom_cpufreq_data *data) + + throttled_freq = freq_hz / HZ_PER_KHZ; + +- freq_qos_update_request(&data->throttle_freq_req, throttled_freq); +- + /* Update thermal pressure (the boost frequencies are accepted) */ + arch_update_thermal_pressure(policy->related_cpus, throttled_freq); + +@@ -442,14 +437,6 @@ static int qcom_cpufreq_hw_lmh_init(struct cpufreq_policy *policy, int index) + if (data->throttle_irq < 0) + return data->throttle_irq; + +- ret = freq_qos_add_request(&policy->constraints, +- &data->throttle_freq_req, FREQ_QOS_MAX, +- FREQ_QOS_MAX_DEFAULT_VALUE); +- if (ret < 0) { +- dev_err(&pdev->dev, "Failed to add freq constraint (%d)\n", ret); +- return ret; +- } +- + data->cancel_throttle = false; + data->policy = policy; + +@@ -516,7 +503,6 @@ static void qcom_cpufreq_hw_lmh_exit(struct qcom_cpufreq_data *data) + if (data->throttle_irq <= 0) + return; + +- freq_qos_remove_request(&data->throttle_freq_req); + free_irq(data->throttle_irq, data); + } + +-- +2.39.2 + diff --git a/queue-6.2/cpufreq-use-correct-unit-when-verify-cur-freq.patch b/queue-6.2/cpufreq-use-correct-unit-when-verify-cur-freq.patch new file mode 100644 index 00000000000..e986b98394a --- /dev/null +++ b/queue-6.2/cpufreq-use-correct-unit-when-verify-cur-freq.patch @@ -0,0 +1,43 @@ +From c88dbe4d62da427da90ee1ecc033224e6d60b55e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 17:04:54 +0530 +Subject: cpufreq: use correct unit when verify cur freq + +From: Sanjay Chandrashekara + +[ Upstream commit 44295af5019f1997d038ad2611086a2d1e2af167 ] + +cpufreq_verify_current_freq checks() if the frequency returned by +the hardware has a slight delta with the valid frequency value +last set and returns "policy->cur" if the delta is within "1 MHz". +In the comparison, "policy->cur" is in "kHz" but it's compared +against HZ_PER_MHZ. So, the comparison range becomes "1 GHz". + +Fix this by comparing against KHZ_PER_MHZ instead of HZ_PER_MHZ. + +Fixes: f55ae08c8987 ("cpufreq: Avoid unnecessary frequency updates due to mismatch") +Signed-off-by: Sanjay Chandrashekara +[ sumit gupta: Commit message update ] +Signed-off-by: Sumit Gupta +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 7e56a42750ea5..285ba51b31f60 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1727,7 +1727,7 @@ static unsigned int cpufreq_verify_current_freq(struct cpufreq_policy *policy, b + * MHz. In such cases it is better to avoid getting into + * unnecessary frequency updates. + */ +- if (abs(policy->cur - new_freq) < HZ_PER_MHZ) ++ if (abs(policy->cur - new_freq) < KHZ_PER_MHZ) + return policy->cur; + + cpufreq_out_of_sync(policy, new_freq); +-- +2.39.2 + diff --git a/queue-6.2/crypto-caam-clear-some-memory-in-instantiate_rng.patch b/queue-6.2/crypto-caam-clear-some-memory-in-instantiate_rng.patch new file mode 100644 index 00000000000..05288c66779 --- /dev/null +++ b/queue-6.2/crypto-caam-clear-some-memory-in-instantiate_rng.patch @@ -0,0 +1,52 @@ +From a145ea9b9d65327ef1f0181cb44bdeb6758a6a57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 07:59:30 +0100 +Subject: crypto: caam - Clear some memory in instantiate_rng + +From: Christophe JAILLET + +[ Upstream commit 9c19fb86a8cb2ee82a832c95e139f29ea05c4d08 ] + +According to the comment at the end of the 'for' loop just a few lines +below, it looks needed to clear 'desc'. + +So it should also be cleared for the first iteration. + +Move the memset() to the beginning of the loop to be safe. + +Fixes: 281922a1d4f5 ("crypto: caam - add support for SEC v5.x RNG4") +Signed-off-by: Christophe JAILLET +Reviewed-by: Gaurav Jain +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/caam/ctrl.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c +index 32253a064d0fe..3b79e0d83d40a 100644 +--- a/drivers/crypto/caam/ctrl.c ++++ b/drivers/crypto/caam/ctrl.c +@@ -284,6 +284,10 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask, + const u32 rdsta_if = RDSTA_IF0 << sh_idx; + const u32 rdsta_pr = RDSTA_PR0 << sh_idx; + const u32 rdsta_mask = rdsta_if | rdsta_pr; ++ ++ /* Clear the contents before using the descriptor */ ++ memset(desc, 0x00, CAAM_CMD_SZ * 7); ++ + /* + * If the corresponding bit is set, this state handle + * was initialized by somebody else, so it's left alone. +@@ -327,8 +331,6 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask, + } + + dev_info(ctrldev, "Instantiated RNG4 SH%d\n", sh_idx); +- /* Clear the contents before recreating the descriptor */ +- memset(desc, 0x00, CAAM_CMD_SZ * 7); + } + + kfree(desc); +-- +2.39.2 + diff --git a/queue-6.2/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch b/queue-6.2/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch new file mode 100644 index 00000000000..6eaa0b35997 --- /dev/null +++ b/queue-6.2/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch @@ -0,0 +1,41 @@ +From d89f7ce6046333168a23345774b5222cef55d982 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 11:35:23 +0800 +Subject: crypto: drbg - Only fail when jent is unavailable in FIPS mode + +From: Herbert Xu + +[ Upstream commit 686cd976b6ddedeeb1a1fb09ba53a891d3cc9a03 ] + +When jent initialisation fails for any reason other than ENOENT, +the entire drbg fails to initialise, even when we're not in FIPS +mode. This is wrong because we can still use the kernel RNG when +we're not in FIPS mode. + +Change it so that it only fails when we are in FIPS mode. + +Fixes: 57225e679788 ("crypto: drbg - Use callback API for random readiness") +Signed-off-by: Herbert Xu +Reviewed-by: Stephan Mueller +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/drbg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/drbg.c b/crypto/drbg.c +index 982d4ca4526d8..ff4ebbc68efab 100644 +--- a/crypto/drbg.c ++++ b/crypto/drbg.c +@@ -1546,7 +1546,7 @@ static int drbg_prepare_hrng(struct drbg_state *drbg) + const int err = PTR_ERR(drbg->jent); + + drbg->jent = NULL; +- if (fips_enabled || err != -ENOENT) ++ if (fips_enabled) + return err; + pr_info("DRBG: Continuing without Jitter RNG\n"); + } +-- +2.39.2 + diff --git a/queue-6.2/crypto-qat-fix-concurrency-issue-when-device-state-c.patch b/queue-6.2/crypto-qat-fix-concurrency-issue-when-device-state-c.patch new file mode 100644 index 00000000000..830408fdfe4 --- /dev/null +++ b/queue-6.2/crypto-qat-fix-concurrency-issue-when-device-state-c.patch @@ -0,0 +1,206 @@ +From 8f476315d4beac1a5f956e18f298943b4411e3d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 15:55:42 -0500 +Subject: crypto: qat - fix concurrency issue when device state changes + +From: Shashank Gupta + +[ Upstream commit 1bdc85550a2b59bb7f62ead7173134e66dd2d60e ] + +The sysfs `state` attribute is not protected against race conditions. +If multiple processes perform a device state transition on the same +device in parallel, unexpected behaviors might occur. + +For transitioning the device state, adf_sysfs.c calls the functions +adf_dev_init(), adf_dev_start(), adf_dev_stop() and adf_dev_shutdown() +which are unprotected and interdependent on each other. To perform a +state transition, these functions needs to be called in a specific +order: + * device up: adf_dev_init() -> adf_dev_start() + * device down: adf_dev_stop() -> adf_dev_shutdown() + +This change introduces the functions adf_dev_up() and adf_dev_down() +which wrap the state machine functions and protect them with a +per-device lock. These are then used in adf_sysfs.c instead of the +individual state transition functions. + +Fixes: 5ee52118ac14 ("crypto: qat - expose device state through sysfs for 4xxx") +Signed-off-by: Shashank Gupta +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + .../crypto/qat/qat_common/adf_accel_devices.h | 1 + + .../crypto/qat/qat_common/adf_common_drv.h | 3 + + drivers/crypto/qat/qat_common/adf_dev_mgr.c | 2 + + drivers/crypto/qat/qat_common/adf_init.c | 64 +++++++++++++++++++ + drivers/crypto/qat/qat_common/adf_sysfs.c | 23 +------ + 5 files changed, 73 insertions(+), 20 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h +index 284f5aad3ee0b..7be933d6f0ffa 100644 +--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h ++++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h +@@ -310,6 +310,7 @@ struct adf_accel_dev { + u8 pf_compat_ver; + } vf; + }; ++ struct mutex state_lock; /* protect state of the device */ + bool is_vf; + u32 accel_id; + }; +diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h +index 7189265573c08..4bf1fceb7052b 100644 +--- a/drivers/crypto/qat/qat_common/adf_common_drv.h ++++ b/drivers/crypto/qat/qat_common/adf_common_drv.h +@@ -58,6 +58,9 @@ void adf_dev_stop(struct adf_accel_dev *accel_dev); + void adf_dev_shutdown(struct adf_accel_dev *accel_dev); + int adf_dev_shutdown_cache_cfg(struct adf_accel_dev *accel_dev); + ++int adf_dev_up(struct adf_accel_dev *accel_dev, bool init_config); ++int adf_dev_down(struct adf_accel_dev *accel_dev, bool cache_config); ++ + void adf_devmgr_update_class_index(struct adf_hw_device_data *hw_data); + void adf_clean_vf_map(bool); + +diff --git a/drivers/crypto/qat/qat_common/adf_dev_mgr.c b/drivers/crypto/qat/qat_common/adf_dev_mgr.c +index 4c752eed10fea..86ee36feefad3 100644 +--- a/drivers/crypto/qat/qat_common/adf_dev_mgr.c ++++ b/drivers/crypto/qat/qat_common/adf_dev_mgr.c +@@ -223,6 +223,7 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev, + map->attached = true; + list_add_tail(&map->list, &vfs_table); + } ++ mutex_init(&accel_dev->state_lock); + unlock: + mutex_unlock(&table_lock); + return ret; +@@ -269,6 +270,7 @@ void adf_devmgr_rm_dev(struct adf_accel_dev *accel_dev, + } + } + unlock: ++ mutex_destroy(&accel_dev->state_lock); + list_del(&accel_dev->list); + mutex_unlock(&table_lock); + } +diff --git a/drivers/crypto/qat/qat_common/adf_init.c b/drivers/crypto/qat/qat_common/adf_init.c +index cef7bb8ec0073..988cffd0b8338 100644 +--- a/drivers/crypto/qat/qat_common/adf_init.c ++++ b/drivers/crypto/qat/qat_common/adf_init.c +@@ -400,3 +400,67 @@ int adf_dev_shutdown_cache_cfg(struct adf_accel_dev *accel_dev) + + return 0; + } ++ ++int adf_dev_down(struct adf_accel_dev *accel_dev, bool reconfig) ++{ ++ int ret = 0; ++ ++ if (!accel_dev) ++ return -EINVAL; ++ ++ mutex_lock(&accel_dev->state_lock); ++ ++ if (!adf_dev_started(accel_dev)) { ++ dev_info(&GET_DEV(accel_dev), "Device qat_dev%d already down\n", ++ accel_dev->accel_id); ++ ret = -EINVAL; ++ goto out; ++ } ++ ++ if (reconfig) { ++ ret = adf_dev_shutdown_cache_cfg(accel_dev); ++ goto out; ++ } ++ ++ adf_dev_stop(accel_dev); ++ adf_dev_shutdown(accel_dev); ++ ++out: ++ mutex_unlock(&accel_dev->state_lock); ++ return ret; ++} ++EXPORT_SYMBOL_GPL(adf_dev_down); ++ ++int adf_dev_up(struct adf_accel_dev *accel_dev, bool config) ++{ ++ int ret = 0; ++ ++ if (!accel_dev) ++ return -EINVAL; ++ ++ mutex_lock(&accel_dev->state_lock); ++ ++ if (adf_dev_started(accel_dev)) { ++ dev_info(&GET_DEV(accel_dev), "Device qat_dev%d already up\n", ++ accel_dev->accel_id); ++ ret = -EALREADY; ++ goto out; ++ } ++ ++ if (config && GET_HW_DATA(accel_dev)->dev_config) { ++ ret = GET_HW_DATA(accel_dev)->dev_config(accel_dev); ++ if (unlikely(ret)) ++ goto out; ++ } ++ ++ ret = adf_dev_init(accel_dev); ++ if (unlikely(ret)) ++ goto out; ++ ++ ret = adf_dev_start(accel_dev); ++ ++out: ++ mutex_unlock(&accel_dev->state_lock); ++ return ret; ++} ++EXPORT_SYMBOL_GPL(adf_dev_up); +diff --git a/drivers/crypto/qat/qat_common/adf_sysfs.c b/drivers/crypto/qat/qat_common/adf_sysfs.c +index e8b078e719c20..3eb6611ab1b11 100644 +--- a/drivers/crypto/qat/qat_common/adf_sysfs.c ++++ b/drivers/crypto/qat/qat_common/adf_sysfs.c +@@ -50,38 +50,21 @@ static ssize_t state_store(struct device *dev, struct device_attribute *attr, + + switch (ret) { + case DEV_DOWN: +- if (!adf_dev_started(accel_dev)) { +- dev_info(dev, "Device qat_dev%d already down\n", +- accel_id); +- return -EINVAL; +- } +- + dev_info(dev, "Stopping device qat_dev%d\n", accel_id); + +- ret = adf_dev_shutdown_cache_cfg(accel_dev); ++ ret = adf_dev_down(accel_dev, true); + if (ret < 0) + return -EINVAL; + + break; + case DEV_UP: +- if (adf_dev_started(accel_dev)) { +- dev_info(dev, "Device qat_dev%d already up\n", +- accel_id); +- return -EINVAL; +- } +- + dev_info(dev, "Starting device qat_dev%d\n", accel_id); + +- ret = GET_HW_DATA(accel_dev)->dev_config(accel_dev); +- if (!ret) +- ret = adf_dev_init(accel_dev); +- if (!ret) +- ret = adf_dev_start(accel_dev); +- ++ ret = adf_dev_up(accel_dev, true); + if (ret < 0) { + dev_err(dev, "Failed to start device qat_dev%d\n", + accel_id); +- adf_dev_shutdown_cache_cfg(accel_dev); ++ adf_dev_down(accel_dev, true); + return ret; + } + break; +-- +2.39.2 + diff --git a/queue-6.2/crypto-sa2ul-select-crypto_des.patch b/queue-6.2/crypto-sa2ul-select-crypto_des.patch new file mode 100644 index 00000000000..ef00063107d --- /dev/null +++ b/queue-6.2/crypto-sa2ul-select-crypto_des.patch @@ -0,0 +1,45 @@ +From 88c163719f19c21f62ce083533e45624b01825c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 20:28:12 +0530 +Subject: crypto: sa2ul - Select CRYPTO_DES + +From: Suman Anna + +[ Upstream commit 8832023efd20966e29944dac92118dfbf1fa1bc0 ] + +The SA2UL Crypto driver provides support for couple of +DES3 algos "cbc(des3_ede)" and "ecb(des3_ede)", and enabling +the crypto selftest throws the following errors (as seen on +K3 J721E SoCs): + saul-crypto 4e00000.crypto: Error allocating fallback algo cbc(des3_ede) + alg: skcipher: failed to allocate transform for cbc-des3-sa2ul: -2 + saul-crypto 4e00000.crypto: Error allocating fallback algo ecb(des3_ede) + alg: skcipher: failed to allocate transform for ecb-des3-sa2ul: -2 + +Fix this by selecting CRYPTO_DES which was missed while +adding base driver support. + +Fixes: 7694b6ca649f ("crypto: sa2ul - Add crypto driver") +Signed-off-by: Suman Anna +Signed-off-by: Jayesh Choudhary +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig +index dfb103f81a64b..8d06bc30eadeb 100644 +--- a/drivers/crypto/Kconfig ++++ b/drivers/crypto/Kconfig +@@ -820,6 +820,7 @@ config CRYPTO_DEV_SA2UL + select CRYPTO_AES + select CRYPTO_ALGAPI + select CRYPTO_AUTHENC ++ select CRYPTO_DES + select CRYPTO_SHA1 + select CRYPTO_SHA256 + select CRYPTO_SHA512 +-- +2.39.2 + diff --git a/queue-6.2/debugobject-prevent-init-race-with-static-objects.patch b/queue-6.2/debugobject-prevent-init-race-with-static-objects.patch new file mode 100644 index 00000000000..fb290471c40 --- /dev/null +++ b/queue-6.2/debugobject-prevent-init-race-with-static-objects.patch @@ -0,0 +1,283 @@ +From 52d765328532890d87775dcc449b6a23c0699491 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 09:54:39 +0200 +Subject: debugobject: Prevent init race with static objects + +From: Thomas Gleixner + +[ Upstream commit 63a759694eed61025713b3e14dd827c8548daadc ] + +Statically initialized objects are usually not initialized via the init() +function of the subsystem. They are special cased and the subsystem +provides a function to validate whether an object which is not yet tracked +by debugobjects is statically initialized. This means the object is started +to be tracked on first use, e.g. activation. + +This works perfectly fine, unless there are two concurrent operations on +that object. Schspa decoded the problem: + +T0 T1 + +debug_object_assert_init(addr) + lock_hash_bucket() + obj = lookup_object(addr); + if (!obj) { + unlock_hash_bucket(); + - > preemption + lock_subsytem_object(addr); + activate_object(addr) + lock_hash_bucket(); + obj = lookup_object(addr); + if (!obj) { + unlock_hash_bucket(); + if (is_static_object(addr)) + init_and_track(addr); + lock_hash_bucket(); + obj = lookup_object(addr); + obj->state = ACTIVATED; + unlock_hash_bucket(); + + subsys function modifies content of addr, + so static object detection does + not longer work. + + unlock_subsytem_object(addr); + + if (is_static_object(addr)) <- Fails + + debugobject emits a warning and invokes the fixup function which + reinitializes the already active object in the worst case. + +This race exists forever, but was never observed until mod_timer() got a +debug_object_assert_init() added which is outside of the timer base lock +held section right at the beginning of the function to cover the lockless +early exit points too. + +Rework the code so that the lookup, the static object check and the +tracking object association happens atomically under the hash bucket +lock. This prevents the issue completely as all callers are serialized on +the hash bucket lock and therefore cannot observe inconsistent state. + +Fixes: 3ac7fe5a4aab ("infrastructure to debug (dynamic) objects") +Reported-by: syzbot+5093ba19745994288b53@syzkaller.appspotmail.com +Debugged-by: Schspa Shi +Signed-off-by: Thomas Gleixner +Reviewed-by: Stephen Boyd +Link: https://syzkaller.appspot.com/bug?id=22c8a5938eab640d1c6bcc0e3dc7be519d878462 +Link: https://lore.kernel.org/lkml/20230303161906.831686-1-schspa@gmail.com +Link: https://lore.kernel.org/r/87zg7dzgao.ffs@tglx +Signed-off-by: Sasha Levin +--- + lib/debugobjects.c | 125 ++++++++++++++++++++++++--------------------- + 1 file changed, 66 insertions(+), 59 deletions(-) + +diff --git a/lib/debugobjects.c b/lib/debugobjects.c +index df86e649d8be0..b796799fadb20 100644 +--- a/lib/debugobjects.c ++++ b/lib/debugobjects.c +@@ -216,10 +216,6 @@ static struct debug_obj *__alloc_object(struct hlist_head *list) + return obj; + } + +-/* +- * Allocate a new object. If the pool is empty, switch off the debugger. +- * Must be called with interrupts disabled. +- */ + static struct debug_obj * + alloc_object(void *addr, struct debug_bucket *b, const struct debug_obj_descr *descr) + { +@@ -552,11 +548,49 @@ static void debug_object_is_on_stack(void *addr, int onstack) + WARN_ON(1); + } + ++static struct debug_obj *lookup_object_or_alloc(void *addr, struct debug_bucket *b, ++ const struct debug_obj_descr *descr, ++ bool onstack, bool alloc_ifstatic) ++{ ++ struct debug_obj *obj = lookup_object(addr, b); ++ enum debug_obj_state state = ODEBUG_STATE_NONE; ++ ++ if (likely(obj)) ++ return obj; ++ ++ /* ++ * debug_object_init() unconditionally allocates untracked ++ * objects. It does not matter whether it is a static object or ++ * not. ++ * ++ * debug_object_assert_init() and debug_object_activate() allow ++ * allocation only if the descriptor callback confirms that the ++ * object is static and considered initialized. For non-static ++ * objects the allocation needs to be done from the fixup callback. ++ */ ++ if (unlikely(alloc_ifstatic)) { ++ if (!descr->is_static_object || !descr->is_static_object(addr)) ++ return ERR_PTR(-ENOENT); ++ /* Statically allocated objects are considered initialized */ ++ state = ODEBUG_STATE_INIT; ++ } ++ ++ obj = alloc_object(addr, b, descr); ++ if (likely(obj)) { ++ obj->state = state; ++ debug_object_is_on_stack(addr, onstack); ++ return obj; ++ } ++ ++ /* Out of memory. Do the cleanup outside of the locked region */ ++ debug_objects_enabled = 0; ++ return NULL; ++} ++ + static void + __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack) + { + enum debug_obj_state state; +- bool check_stack = false; + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; +@@ -572,16 +606,11 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack + + raw_spin_lock_irqsave(&db->lock, flags); + +- obj = lookup_object(addr, db); +- if (!obj) { +- obj = alloc_object(addr, db, descr); +- if (!obj) { +- debug_objects_enabled = 0; +- raw_spin_unlock_irqrestore(&db->lock, flags); +- debug_objects_oom(); +- return; +- } +- check_stack = true; ++ obj = lookup_object_or_alloc(addr, db, descr, onstack, false); ++ if (unlikely(!obj)) { ++ raw_spin_unlock_irqrestore(&db->lock, flags); ++ debug_objects_oom(); ++ return; + } + + switch (obj->state) { +@@ -607,8 +636,6 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack + } + + raw_spin_unlock_irqrestore(&db->lock, flags); +- if (check_stack) +- debug_object_is_on_stack(addr, onstack); + } + + /** +@@ -648,14 +675,12 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack); + */ + int debug_object_activate(void *addr, const struct debug_obj_descr *descr) + { ++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr }; + enum debug_obj_state state; + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; + int ret; +- struct debug_obj o = { .object = addr, +- .state = ODEBUG_STATE_NOTAVAILABLE, +- .descr = descr }; + + if (!debug_objects_enabled) + return 0; +@@ -664,8 +689,8 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr) + + raw_spin_lock_irqsave(&db->lock, flags); + +- obj = lookup_object(addr, db); +- if (obj) { ++ obj = lookup_object_or_alloc(addr, db, descr, false, true); ++ if (likely(!IS_ERR_OR_NULL(obj))) { + bool print_object = false; + + switch (obj->state) { +@@ -698,24 +723,16 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr) + + raw_spin_unlock_irqrestore(&db->lock, flags); + +- /* +- * We are here when a static object is activated. We +- * let the type specific code confirm whether this is +- * true or not. if true, we just make sure that the +- * static object is tracked in the object tracker. If +- * not, this must be a bug, so we try to fix it up. +- */ +- if (descr->is_static_object && descr->is_static_object(addr)) { +- /* track this static object */ +- debug_object_init(addr, descr); +- debug_object_activate(addr, descr); +- } else { +- debug_print_object(&o, "activate"); +- ret = debug_object_fixup(descr->fixup_activate, addr, +- ODEBUG_STATE_NOTAVAILABLE); +- return ret ? 0 : -EINVAL; ++ /* If NULL the allocation has hit OOM */ ++ if (!obj) { ++ debug_objects_oom(); ++ return 0; + } +- return 0; ++ ++ /* Object is neither static nor tracked. It's not initialized */ ++ debug_print_object(&o, "activate"); ++ ret = debug_object_fixup(descr->fixup_activate, addr, ODEBUG_STATE_NOTAVAILABLE); ++ return ret ? 0 : -EINVAL; + } + EXPORT_SYMBOL_GPL(debug_object_activate); + +@@ -869,6 +886,7 @@ EXPORT_SYMBOL_GPL(debug_object_free); + */ + void debug_object_assert_init(void *addr, const struct debug_obj_descr *descr) + { ++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr }; + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; +@@ -879,31 +897,20 @@ void debug_object_assert_init(void *addr, const struct debug_obj_descr *descr) + db = get_bucket((unsigned long) addr); + + raw_spin_lock_irqsave(&db->lock, flags); ++ obj = lookup_object_or_alloc(addr, db, descr, false, true); ++ raw_spin_unlock_irqrestore(&db->lock, flags); ++ if (likely(!IS_ERR_OR_NULL(obj))) ++ return; + +- obj = lookup_object(addr, db); ++ /* If NULL the allocation has hit OOM */ + if (!obj) { +- struct debug_obj o = { .object = addr, +- .state = ODEBUG_STATE_NOTAVAILABLE, +- .descr = descr }; +- +- raw_spin_unlock_irqrestore(&db->lock, flags); +- /* +- * Maybe the object is static, and we let the type specific +- * code confirm. Track this static object if true, else invoke +- * fixup. +- */ +- if (descr->is_static_object && descr->is_static_object(addr)) { +- /* Track this static object */ +- debug_object_init(addr, descr); +- } else { +- debug_print_object(&o, "assert_init"); +- debug_object_fixup(descr->fixup_assert_init, addr, +- ODEBUG_STATE_NOTAVAILABLE); +- } ++ debug_objects_oom(); + return; + } + +- raw_spin_unlock_irqrestore(&db->lock, flags); ++ /* Object is neither tracked nor static. It's not initialized. */ ++ debug_print_object(&o, "assert_init"); ++ debug_object_fixup(descr->fixup_assert_init, addr, ODEBUG_STATE_NOTAVAILABLE); + } + EXPORT_SYMBOL_GPL(debug_object_assert_init); + +-- +2.39.2 + diff --git a/queue-6.2/dma-gpi-remove-spurious-unlock-in-gpi_ch_init.patch b/queue-6.2/dma-gpi-remove-spurious-unlock-in-gpi_ch_init.patch new file mode 100644 index 00000000000..b037e63dfa6 --- /dev/null +++ b/queue-6.2/dma-gpi-remove-spurious-unlock-in-gpi_ch_init.patch @@ -0,0 +1,105 @@ +From 4ffe24da4e5427f90741ea2795c73f5d49f7ebc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 02:33:55 +0300 +Subject: dma: gpi: remove spurious unlock in gpi_ch_init + +From: Dmitry Baryshkov + +[ Upstream commit 91d6a468e335571f1e67e046050dea9af5fa4ebe ] + +gpi_ch_init() doesn't lock the ctrl_lock mutex, so there is no need to +unlock it too. Instead the mutex is handled by the function +gpi_alloc_chan_resources(), which properly locks and unlocks the mutex. + +===================================== +WARNING: bad unlock balance detected! +6.3.0-rc5-00253-g99792582ded1-dirty #15 Not tainted +------------------------------------- +kworker/u16:0/9 is trying to release lock (&gpii->ctrl_lock) at: +[] gpi_alloc_chan_resources+0x108/0x5bc +but there are no more locks to release! + +other info that might help us debug this: +6 locks held by kworker/u16:0/9: + #0: ffff575740010938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x220/0x594 + #1: ffff80000809bdd0 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work+0x220/0x594 + #2: ffff575740f2a0f8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x38/0x188 + #3: ffff57574b5570f8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x38/0x188 + #4: ffffb99d06a2f180 (of_dma_lock){+.+.}-{3:3}, at: of_dma_request_slave_channel+0x138/0x280 + #5: ffffb99d06a2ee20 (dma_list_mutex){+.+.}-{3:3}, at: dma_get_slave_channel+0x28/0x10c + +stack backtrace: +CPU: 7 PID: 9 Comm: kworker/u16:0 Not tainted 6.3.0-rc5-00253-g99792582ded1-dirty #15 +Hardware name: Google Pixel 3 (DT) +Workqueue: events_unbound deferred_probe_work_func +Call trace: + dump_backtrace+0xa0/0xfc + show_stack+0x18/0x24 + dump_stack_lvl+0x60/0xac + dump_stack+0x18/0x24 + print_unlock_imbalance_bug+0x130/0x148 + lock_release+0x270/0x300 + __mutex_unlock_slowpath+0x48/0x2cc + mutex_unlock+0x20/0x2c + gpi_alloc_chan_resources+0x108/0x5bc + dma_chan_get+0x84/0x188 + dma_get_slave_channel+0x5c/0x10c + gpi_of_dma_xlate+0x110/0x1a0 + of_dma_request_slave_channel+0x174/0x280 + dma_request_chan+0x3c/0x2d4 + geni_i2c_probe+0x544/0x63c + platform_probe+0x68/0xc4 + really_probe+0x148/0x2ac + __driver_probe_device+0x78/0xe0 + driver_probe_device+0x3c/0x160 + __device_attach_driver+0xb8/0x138 + bus_for_each_drv+0x84/0xe0 + __device_attach+0x9c/0x188 + device_initial_probe+0x14/0x20 + bus_probe_device+0xac/0xb0 + device_add+0x60c/0x7d8 + of_device_add+0x44/0x60 + of_platform_device_create_pdata+0x90/0x124 + of_platform_bus_create+0x15c/0x3c8 + of_platform_populate+0x58/0xf8 + devm_of_platform_populate+0x58/0xbc + geni_se_probe+0xf0/0x164 + platform_probe+0x68/0xc4 + really_probe+0x148/0x2ac + __driver_probe_device+0x78/0xe0 + driver_probe_device+0x3c/0x160 + __device_attach_driver+0xb8/0x138 + bus_for_each_drv+0x84/0xe0 + __device_attach+0x9c/0x188 + device_initial_probe+0x14/0x20 + bus_probe_device+0xac/0xb0 + deferred_probe_work_func+0x8c/0xc8 + process_one_work+0x2bc/0x594 + worker_thread+0x228/0x438 + kthread+0x108/0x10c + ret_from_fork+0x10/0x20 + +Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230409233355.453741-1-dmitry.baryshkov@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/qcom/gpi.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c +index 59a36cbf9b5f7..932628b319c81 100644 +--- a/drivers/dma/qcom/gpi.c ++++ b/drivers/dma/qcom/gpi.c +@@ -1966,7 +1966,6 @@ static int gpi_ch_init(struct gchan *gchan) + error_config_int: + gpi_free_ring(&gpii->ev_ring, gpii); + exit_gpi_init: +- mutex_unlock(&gpii->ctrl_lock); + return ret; + } + +-- +2.39.2 + diff --git a/queue-6.2/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch b/queue-6.2/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch new file mode 100644 index 00000000000..00f2654f55a --- /dev/null +++ b/queue-6.2/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch @@ -0,0 +1,55 @@ +From 2134463a2e57903c22ec2a77bbbd85e4a576b738 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 17:18:25 +0200 +Subject: dmaengine: at_xdmac: do not enable all cyclic channels + +From: Claudiu Beznea + +[ Upstream commit f8435befd81dd85b7b610598551fadf675849bc1 ] + +Do not global enable all the cyclic channels in at_xdmac_resume(). Instead +save the global status in at_xdmac_suspend() and re-enable the cyclic +channel only if it was active before suspend. + +Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230214151827.1050280-6-claudiu.beznea@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/at_xdmac.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index d6c9781cd46af..bfc8ae2143957 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -243,6 +243,7 @@ struct at_xdmac { + int irq; + struct clk *clk; + u32 save_gim; ++ u32 save_gs; + struct dma_pool *at_xdmac_desc_pool; + const struct at_xdmac_layout *layout; + struct at_xdmac_chan chan[]; +@@ -1988,6 +1989,7 @@ static int __maybe_unused atmel_xdmac_suspend(struct device *dev) + } + } + atxdmac->save_gim = at_xdmac_read(atxdmac, AT_XDMAC_GIM); ++ atxdmac->save_gs = at_xdmac_read(atxdmac, AT_XDMAC_GS); + + at_xdmac_off(atxdmac); + clk_disable_unprepare(atxdmac->clk); +@@ -2027,7 +2029,8 @@ static int __maybe_unused atmel_xdmac_resume(struct device *dev) + at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc); + at_xdmac_chan_write(atchan, AT_XDMAC_CIE, atchan->save_cim); + wmb(); +- at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask); ++ if (atxdmac->save_gs & atchan->mask) ++ at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask); + } + } + return 0; +-- +2.39.2 + diff --git a/queue-6.2/dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch b/queue-6.2/dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch new file mode 100644 index 00000000000..99a8832fc77 --- /dev/null +++ b/queue-6.2/dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch @@ -0,0 +1,90 @@ +From e4c44ad9e4ddcdc7d24c730ec8b6a6712ce6b0d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 19:17:57 +0900 +Subject: dmaengine: dw-edma: Fix to change for continuous transfer + +From: Shunsuke Mie + +[ Upstream commit a251994a441ee0a69ba7062c8cd2d08ead3db379 ] + +The dw-edma driver stops after processing a DMA request even if a request +remains in the issued queue, which is not the expected behavior. The DMA +engine API requires continuous processing. + +Add a trigger to start after one processing finished if there are requests +remain. + +Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") +Signed-off-by: Shunsuke Mie +Link: https://lore.kernel.org/r/20230411101758.438472-1-mie@igel.co.jp +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-edma-core.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c +index 52bdf04aff511..cb46cbef212ab 100644 +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -170,7 +170,7 @@ static void vchan_free_desc(struct virt_dma_desc *vdesc) + dw_edma_free_desc(vd2dw_edma_desc(vdesc)); + } + +-static void dw_edma_start_transfer(struct dw_edma_chan *chan) ++static int dw_edma_start_transfer(struct dw_edma_chan *chan) + { + struct dw_edma_chunk *child; + struct dw_edma_desc *desc; +@@ -178,16 +178,16 @@ static void dw_edma_start_transfer(struct dw_edma_chan *chan) + + vd = vchan_next_desc(&chan->vc); + if (!vd) +- return; ++ return 0; + + desc = vd2dw_edma_desc(vd); + if (!desc) +- return; ++ return 0; + + child = list_first_entry_or_null(&desc->chunk->list, + struct dw_edma_chunk, list); + if (!child) +- return; ++ return 0; + + dw_edma_v0_core_start(child, !desc->xfer_sz); + desc->xfer_sz += child->ll_region.sz; +@@ -195,6 +195,8 @@ static void dw_edma_start_transfer(struct dw_edma_chan *chan) + list_del(&child->list); + kfree(child); + desc->chunks_alloc--; ++ ++ return 1; + } + + static int dw_edma_device_config(struct dma_chan *dchan, +@@ -572,14 +574,14 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan) + switch (chan->request) { + case EDMA_REQ_NONE: + desc = vd2dw_edma_desc(vd); +- if (desc->chunks_alloc) { +- chan->status = EDMA_ST_BUSY; +- dw_edma_start_transfer(chan); +- } else { ++ if (!desc->chunks_alloc) { + list_del(&vd->node); + vchan_cookie_complete(vd); +- chan->status = EDMA_ST_IDLE; + } ++ ++ /* Continue transferring if there are remaining chunks or issued requests. ++ */ ++ chan->status = dw_edma_start_transfer(chan) ? EDMA_ST_BUSY : EDMA_ST_IDLE; + break; + + case EDMA_REQ_STOP: +-- +2.39.2 + diff --git a/queue-6.2/dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch b/queue-6.2/dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch new file mode 100644 index 00000000000..728eca7c02b --- /dev/null +++ b/queue-6.2/dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch @@ -0,0 +1,44 @@ +From f5cb76941cc2e4ce1460b301bb61d8c4f2e40b91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 19:17:58 +0900 +Subject: dmaengine: dw-edma: Fix to enable to issue dma request on DMA + processing + +From: Shunsuke Mie + +[ Upstream commit 970b17dfe264a9085ba4e593730ecfd496b950ab ] + +The issue_pending request is ignored while driver is processing a DMA +request. Fix to issue the pending requests on any dma channel status. + +Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") +Signed-off-by: Shunsuke Mie +Link: https://lore.kernel.org/r/20230411101758.438472-2-mie@igel.co.jp +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-edma-core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c +index cb46cbef212ab..ef4cdcf6beba0 100644 +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -279,9 +279,12 @@ static void dw_edma_device_issue_pending(struct dma_chan *dchan) + struct dw_edma_chan *chan = dchan2dw_edma_chan(dchan); + unsigned long flags; + ++ if (!chan->configured) ++ return; ++ + spin_lock_irqsave(&chan->vc.lock, flags); +- if (chan->configured && chan->request == EDMA_REQ_NONE && +- chan->status == EDMA_ST_IDLE && vchan_issue_pending(&chan->vc)) { ++ if (vchan_issue_pending(&chan->vc) && chan->request == EDMA_REQ_NONE && ++ chan->status == EDMA_ST_IDLE) { + chan->status = EDMA_ST_BUSY; + dw_edma_start_transfer(chan); + } +-- +2.39.2 + diff --git a/queue-6.2/dmaengine-mv_xor_v2-fix-an-error-code.patch b/queue-6.2/dmaengine-mv_xor_v2-fix-an-error-code.patch new file mode 100644 index 00000000000..678700887a5 --- /dev/null +++ b/queue-6.2/dmaengine-mv_xor_v2-fix-an-error-code.patch @@ -0,0 +1,37 @@ +From 0c64a2707dbef04dbf1cfee4ad7f59a362b77f2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 09:06:37 +0200 +Subject: dmaengine: mv_xor_v2: Fix an error code. + +From: Christophe JAILLET + +[ Upstream commit 827026ae2e56ec05ef1155661079badbbfc0b038 ] + +If the probe is deferred, -EPROBE_DEFER should be returned, not ++EPROBE_DEFER. + +Fixes: 3cd2c313f1d6 ("dmaengine: mv_xor_v2: Fix clock resource by adding a register clock") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/201170dff832a3c496d125772e10070cd834ebf2.1679814350.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/mv_xor_v2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c +index 113834e1167b6..d086ff1824f82 100644 +--- a/drivers/dma/mv_xor_v2.c ++++ b/drivers/dma/mv_xor_v2.c +@@ -755,7 +755,7 @@ static int mv_xor_v2_probe(struct platform_device *pdev) + + xor_dev->clk = devm_clk_get(&pdev->dev, NULL); + if (PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) { +- ret = EPROBE_DEFER; ++ ret = -EPROBE_DEFER; + goto disable_reg_clk; + } + if (!IS_ERR(xor_dev->clk)) { +-- +2.39.2 + diff --git a/queue-6.2/drivers-staging-rtl8723bs-fix-locking-in-_rtw_join_t.patch b/queue-6.2/drivers-staging-rtl8723bs-fix-locking-in-_rtw_join_t.patch new file mode 100644 index 00000000000..1a04633878a --- /dev/null +++ b/queue-6.2/drivers-staging-rtl8723bs-fix-locking-in-_rtw_join_t.patch @@ -0,0 +1,73 @@ +From eae5a7291f409e3da636737debf89deaeeb3d028 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Feb 2023 15:53:23 +0100 +Subject: drivers: staging: rtl8723bs: Fix locking in + _rtw_join_timeout_handler() + +From: Hans de Goede + +[ Upstream commit 215792eda008f6a1e7ed9d77fa20d582d22bb114 ] + +Commit 041879b12ddb ("drivers: staging: rtl8192bs: Fix deadlock in +rtw_joinbss_event_prehandle()") besides fixing the deadlock also +modified _rtw_join_timeout_handler() to use spin_[un]lock_irq() +instead of spin_[un]lock_bh(). + +_rtw_join_timeout_handler() calls rtw_do_join() which takes +pmlmepriv->scanned_queue.lock using spin_[un]lock_bh(). This +spin_unlock_bh() call re-enables softirqs which triggers an oops in +kernel/softirq.c: __local_bh_enable_ip() when it calls +lockdep_assert_irqs_enabled(): + +[ 244.506087] WARNING: CPU: 2 PID: 0 at kernel/softirq.c:376 __local_bh_enable_ip+0xa6/0x100 +... +[ 244.509022] Call Trace: +[ 244.509048] +[ 244.509100] _rtw_join_timeout_handler+0x134/0x170 [r8723bs] +[ 244.509468] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs] +[ 244.509772] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs] +[ 244.510076] call_timer_fn+0x95/0x2a0 +[ 244.510200] __run_timers.part.0+0x1da/0x2d0 + +This oops is causd by the switch to spin_[un]lock_irq() which disables +the IRQs for the entire duration of _rtw_join_timeout_handler(). + +Disabling the IRQs is not necessary since all code taking this lock +runs from either user contexts or from softirqs, switch back to +spin_[un]lock_bh() to fix this. + +Fixes: 041879b12ddb ("drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()") +Cc: Duoming Zhou +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230221145326.7808-1-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/core/rtw_mlme.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c +index c6fd6cf741ef6..ea2a6566e51bf 100644 +--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c ++++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c +@@ -1549,7 +1549,7 @@ void _rtw_join_timeout_handler(struct timer_list *t) + if (adapter->bDriverStopped || adapter->bSurpriseRemoved) + return; + +- spin_lock_irq(&pmlmepriv->lock); ++ spin_lock_bh(&pmlmepriv->lock); + + if (rtw_to_roam(adapter) > 0) { /* join timeout caused by roaming */ + while (1) { +@@ -1577,7 +1577,7 @@ void _rtw_join_timeout_handler(struct timer_list *t) + + } + +- spin_unlock_irq(&pmlmepriv->lock); ++ spin_unlock_bh(&pmlmepriv->lock); + } + + /* +-- +2.39.2 + diff --git a/queue-6.2/drivers-staging-rtl8723bs-fix-locking-in-rtw_scan_ti.patch b/queue-6.2/drivers-staging-rtl8723bs-fix-locking-in-rtw_scan_ti.patch new file mode 100644 index 00000000000..092a1e94cb0 --- /dev/null +++ b/queue-6.2/drivers-staging-rtl8723bs-fix-locking-in-rtw_scan_ti.patch @@ -0,0 +1,53 @@ +From 5932de79f52cb04a6b7009900d1479ba1cbb3273 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Feb 2023 15:53:24 +0100 +Subject: drivers: staging: rtl8723bs: Fix locking in + rtw_scan_timeout_handler() + +From: Hans de Goede + +[ Upstream commit 3f467036093fedd7e231924327455fc609b5ef02 ] + +Commit cc7ad0d77b51 ("drivers: staging: rtl8723bs: Fix deadlock in +rtw_surveydone_event_callback()") besides fixing the deadlock also +modified rtw_scan_timeout_handler() to use spin_[un]lock_irq() +instead of spin_[un]lock_bh(). + +Disabling the IRQs is not necessary since all code taking this lock +runs from either user contexts or from softirqs + +rtw_scan_timeout_handler() is the only function taking pmlmepriv->lock +which uses spin_[un]lock_irq() for this. Switch back to +spin_[un]lock_bh() to make it consistent with the rest of the code. + +Fixes: cc7ad0d77b51 ("drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback()") +Cc: Duoming Zhou +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230221145326.7808-2-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/core/rtw_mlme.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c +index ea2a6566e51bf..091842d70d486 100644 +--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c ++++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c +@@ -1590,11 +1590,11 @@ void rtw_scan_timeout_handler(struct timer_list *t) + mlmepriv.scan_to_timer); + struct mlme_priv *pmlmepriv = &adapter->mlmepriv; + +- spin_lock_irq(&pmlmepriv->lock); ++ spin_lock_bh(&pmlmepriv->lock); + + _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY); + +- spin_unlock_irq(&pmlmepriv->lock); ++ spin_unlock_bh(&pmlmepriv->lock); + + rtw_indicate_scan_done(adapter, true); + } +-- +2.39.2 + diff --git a/queue-6.2/drm-amd-display-dc-dce60-makefile-fix-previous-attem.patch b/queue-6.2/drm-amd-display-dc-dce60-makefile-fix-previous-attem.patch new file mode 100644 index 00000000000..3cc379f394c --- /dev/null +++ b/queue-6.2/drm-amd-display-dc-dce60-makefile-fix-previous-attem.patch @@ -0,0 +1,63 @@ +From 310e5f6e8f579bfa236551593597fa7c2aa3f1a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 08:17:16 +0000 +Subject: drm/amd/display/dc/dce60/Makefile: Fix previous attempt to silence + known override-init warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lee Jones + +[ Upstream commit 4082b9f5ead4966797dddcfef0905d59e5a83873 ] + +Fixes the following W=1 kernel build warning(s): + + drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:157:21: note: in expansion of macro ‘mmCRTC1_DCFE_MEM_LIGHT_SLEEP_CNTL’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_transform.h:170:9: note: in expansion of macro ‘SRI’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:183:17: note: in expansion of macro ‘XFM_COMMON_REG_LIST_DCE60’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:188:17: note: in expansion of macro ‘transform_regs’ + drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_6_0_d.h:722:43: warning: initialized field overwritten [-Woverride-init] + drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:157:21: note: in expansion of macro ‘mmCRTC2_DCFE_MEM_LIGHT_SLEEP_CNTL’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_transform.h:170:9: note: in expansion of macro ‘SRI’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:183:17: note: in expansion of macro ‘XFM_COMMON_REG_LIST_DCE60’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce60/dce60_resource.c:189:17: note: in expansion of macro ‘transform_regs’ + drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_6_0_d.h:722:43: note: (near initialization for ‘xfm_regs[2].DCFE_MEM_LIGHT_SLEEP_CN + +[100 lines snipped for brevity] + +Fixes: ceb3cf476a441 ("drm/amd/display/dc/dce60/Makefile: Ignore -Woverride-init warning") +Cc: Harry Wentland +Cc: Leo Li +Cc: Rodrigo Siqueira +Cc: Alex Deucher +Cc: "Christian König" +Cc: "Pan, Xinhui" +Cc: David Airlie +Cc: Daniel Vetter +Cc: Mauro Rossi +Cc: amd-gfx@lists.freedesktop.org +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Lee Jones +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce60/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce60/Makefile b/drivers/gpu/drm/amd/display/dc/dce60/Makefile +index dda596fa1cd76..fee331accc0e7 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce60/Makefile ++++ b/drivers/gpu/drm/amd/display/dc/dce60/Makefile +@@ -23,7 +23,7 @@ + # Makefile for the 'controller' sub-component of DAL. + # It provides the control and status of HW CRTC block. + +-CFLAGS_AMDDALPATH)/dc/dce60/dce60_resource.o = $(call cc-disable-warning, override-init) ++CFLAGS_$(AMDDALPATH)/dc/dce60/dce60_resource.o = $(call cc-disable-warning, override-init) + + DCE60 = dce60_timing_generator.o dce60_hw_sequencer.o \ + dce60_resource.o +-- +2.39.2 + diff --git a/queue-6.2/drm-amd-display-fix-potential-null-dereference.patch b/queue-6.2/drm-amd-display-fix-potential-null-dereference.patch new file mode 100644 index 00000000000..9171b96e965 --- /dev/null +++ b/queue-6.2/drm-amd-display-fix-potential-null-dereference.patch @@ -0,0 +1,42 @@ +From f1085847220fb00b5a714d29227e742dd9f1fa67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 16:10:37 +0300 +Subject: drm/amd/display: Fix potential null dereference + +From: Igor Artemiev + +[ Upstream commit 52f1783ff4146344342422c1cd94fcb4ce39b6fe ] + +The adev->dm.dc pointer can be NULL and dereferenced in amdgpu_dm_fini() +without checking. + +Add a NULL pointer check before calling dc_dmub_srv_destroy(). + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 9a71c7d31734 ("drm/amd/display: Register DMUB service with DC") +Signed-off-by: Igor Artemiev +Signed-off-by: Hamza Mahfooz +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 7fa1728384bfd..422909d1f352b 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1771,7 +1771,8 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev) + dc_deinit_callbacks(adev->dm.dc); + #endif + +- dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv); ++ if (adev->dm.dc) ++ dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv); + + if (dc_enable_dmub_notifications(adev->dm.dc)) { + kfree(adev->dm.dmub_notify); +-- +2.39.2 + diff --git a/queue-6.2/drm-amdgpu-register-a-vga_switcheroo-client-for-macb.patch b/queue-6.2/drm-amdgpu-register-a-vga_switcheroo-client-for-macb.patch new file mode 100644 index 00000000000..e3e2d0a2bfa --- /dev/null +++ b/queue-6.2/drm-amdgpu-register-a-vga_switcheroo-client-for-macb.patch @@ -0,0 +1,89 @@ +From 9e2ad25cb7e899a22a9ae8b1a8c3f1be669d1614 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 22:34:25 +1100 +Subject: drm/amdgpu: register a vga_switcheroo client for MacBooks with + apple-gmux + +From: Orlando Chamberlain + +[ Upstream commit d37a3929ca0363ed1dce02b2772cd5bc547ca66d ] + +Commit 3840c5bcc245 ("drm/amdgpu: disentangle runtime pm and +vga_switcheroo") made amdgpu only register a vga_switcheroo client for +GPU's with PX, however AMD GPUs in dual gpu Apple Macbooks do need to +register, but don't have PX. Instead of AMD's PX, they use apple-gmux. + +Use apple_gmux_detect() to identify these gpus, and +pci_is_thunderbolt_attached() to ensure eGPUs connected to Dual GPU +Macbooks don't register with vga_switcheroo. + +Fixes: 3840c5bcc245 ("drm/amdgpu: disentangle runtime pm and vga_switcheroo") +Link: https://lore.kernel.org/amd-gfx/20230210044826.9834-10-orlandoch.dev@gmail.com/ +Signed-off-by: Orlando Chamberlain +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 3dac1e139c5f3..533263d442657 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -3952,12 +3953,15 @@ int amdgpu_device_init(struct amdgpu_device *adev, + if ((adev->pdev->class >> 8) == PCI_CLASS_DISPLAY_VGA) + vga_client_register(adev->pdev, amdgpu_device_vga_set_decode); + +- if (amdgpu_device_supports_px(ddev)) { +- px = true; ++ px = amdgpu_device_supports_px(ddev); ++ ++ if (px || (!pci_is_thunderbolt_attached(adev->pdev) && ++ apple_gmux_detect(NULL, NULL))) + vga_switcheroo_register_client(adev->pdev, + &amdgpu_switcheroo_ops, px); ++ ++ if (px) + vga_switcheroo_init_domain_pm_ops(adev->dev, &adev->vga_pm_domain); +- } + + if (adev->gmc.xgmi.pending_reset) + queue_delayed_work(system_wq, &mgpu_info.delayed_reset_work, +@@ -4063,6 +4067,7 @@ void amdgpu_device_fini_hw(struct amdgpu_device *adev) + void amdgpu_device_fini_sw(struct amdgpu_device *adev) + { + int idx; ++ bool px; + + amdgpu_fence_driver_sw_fini(adev); + amdgpu_device_ip_fini(adev); +@@ -4082,10 +4087,16 @@ void amdgpu_device_fini_sw(struct amdgpu_device *adev) + + kfree(adev->bios); + adev->bios = NULL; +- if (amdgpu_device_supports_px(adev_to_drm(adev))) { ++ ++ px = amdgpu_device_supports_px(adev_to_drm(adev)); ++ ++ if (px || (!pci_is_thunderbolt_attached(adev->pdev) && ++ apple_gmux_detect(NULL, NULL))) + vga_switcheroo_unregister_client(adev->pdev); ++ ++ if (px) + vga_switcheroo_fini_domain_pm_ops(adev->dev); +- } ++ + if ((adev->pdev->class >> 8) == PCI_CLASS_DISPLAY_VGA) + vga_client_unregister(adev->pdev); + +-- +2.39.2 + diff --git a/queue-6.2/drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch b/queue-6.2/drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch new file mode 100644 index 00000000000..082c40df858 --- /dev/null +++ b/queue-6.2/drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch @@ -0,0 +1,70 @@ +From 54c9b49a6ff7cf24e826ee8f0eef0eea34699053 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Mar 2023 07:55:24 -0500 +Subject: drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535 + +From: Adam Ford + +[ Upstream commit ee0285e13455fdbce5de315bdbe91b5f198a2a06 ] + +When dynamically switching lanes was removed, the intent of the code +was to check to make sure that higher speed items used 4 lanes, but +it had the unintended consequence of removing the slower speeds for +4-lane users. + +This attempts to remedy this by doing a check to see that the +max frequency doesn't exceed the chip limit, and a second +check to make sure that the max bit-rate doesn't exceed the +number of lanes * max bit rate / lane. + +Fixes: 9a0cdcd6649b ("drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge") +Reviewed-by: Robert Foss +Signed-off-by: Adam Ford +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230319125524.58803-1-aford173@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7533.c | 25 +++++++++++------------- + 1 file changed, 11 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c +index fdfeadcefe805..7e3e56441aedc 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7533.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c +@@ -103,22 +103,19 @@ void adv7533_dsi_power_off(struct adv7511 *adv) + enum drm_mode_status adv7533_mode_valid(struct adv7511 *adv, + const struct drm_display_mode *mode) + { +- int lanes; ++ unsigned long max_lane_freq; + struct mipi_dsi_device *dsi = adv->dsi; ++ u8 bpp = mipi_dsi_pixel_format_to_bpp(dsi->format); + +- if (mode->clock > 80000) +- lanes = 4; +- else +- lanes = 3; +- +- /* +- * TODO: add support for dynamic switching of lanes +- * by using the bridge pre_enable() op . Till then filter +- * out the modes which shall need different number of lanes +- * than what was configured in the device tree. +- */ +- if (lanes != dsi->lanes) +- return MODE_BAD; ++ /* Check max clock for either 7533 or 7535 */ ++ if (mode->clock > (adv->type == ADV7533 ? 80000 : 148500)) ++ return MODE_CLOCK_HIGH; ++ ++ /* Check max clock for each lane */ ++ max_lane_freq = (adv->type == ADV7533 ? 800000 : 891000); ++ ++ if (mode->clock * bpp > max_lane_freq * adv->num_dsi_lanes) ++ return MODE_CLOCK_HIGH; + + return MODE_OK; + } +-- +2.39.2 + diff --git a/queue-6.2/drm-i915-dg2-drop-one-pci-id.patch b/queue-6.2/drm-i915-dg2-drop-one-pci-id.patch new file mode 100644 index 00000000000..30f4db58d92 --- /dev/null +++ b/queue-6.2/drm-i915-dg2-drop-one-pci-id.patch @@ -0,0 +1,37 @@ +From 80ce6a9e0a8149444d596518e5d87d90ea8ff95b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 12:09:05 -0800 +Subject: drm/i915/dg2: Drop one PCI ID + +From: Matt Roper + +[ Upstream commit 3a38be31ec82920a871963c086393bc0ba26a655 ] + +The bspec was recently updated to remove PCI ID 0x5698; this ID is +actually reserved for future use and should not be treated as DG2-G11. + +Bspec: 44477 +Fixes: 8618b8489ba6 ("drm/i915: DG2 and ATS-M device ID updates") +Signed-off-by: Matt Roper +Reviewed-by: Gustavo Sousa +Link: https://patchwork.freedesktop.org/patch/msgid/20230208200905.680865-1-matthew.d.roper@intel.com +Signed-off-by: Sasha Levin +--- + include/drm/i915_pciids.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h +index 4a4c190f76984..8f648c32a9657 100644 +--- a/include/drm/i915_pciids.h ++++ b/include/drm/i915_pciids.h +@@ -706,7 +706,6 @@ + INTEL_VGA_DEVICE(0x5693, info), \ + INTEL_VGA_DEVICE(0x5694, info), \ + INTEL_VGA_DEVICE(0x5695, info), \ +- INTEL_VGA_DEVICE(0x5698, info), \ + INTEL_VGA_DEVICE(0x56A5, info), \ + INTEL_VGA_DEVICE(0x56A6, info), \ + INTEL_VGA_DEVICE(0x56B0, info), \ +-- +2.39.2 + diff --git a/queue-6.2/drm-i915-hwmon-enable-pl1-power-limit.patch b/queue-6.2/drm-i915-hwmon-enable-pl1-power-limit.patch new file mode 100644 index 00000000000..5b163ae46cf --- /dev/null +++ b/queue-6.2/drm-i915-hwmon-enable-pl1-power-limit.patch @@ -0,0 +1,48 @@ +From 45abf2df92eab433d48738c4d71356c8a9e73d52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Feb 2023 07:53:09 -0800 +Subject: drm/i915/hwmon: Enable PL1 power limit + +From: Ashutosh Dixit + +[ Upstream commit 0349c41b05968befaffa5fbb7e73d0ee6004f610 ] + +Previous documentation suggested that PL1 power limit is always +enabled. However we now find this not to be the case on some +platforms (such as ATSM). Therefore enable PL1 power limit during hwmon +initialization. + +Bspec: 51864 + +v2: Add Bspec reference (Gwan-gyeong) +v3: Add Fixes tag + +Fixes: 99f55efb79114 ("drm/i915/hwmon: Power PL1 limit and TDP setting") +Signed-off-by: Ashutosh Dixit +Reviewed-by: Gwan-gyeong Mun +Signed-off-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/20230203155309.1042297-1-ashutosh.dixit@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/i915_hwmon.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/i915/i915_hwmon.c b/drivers/gpu/drm/i915/i915_hwmon.c +index c588a17f97e98..6ef7af7c17460 100644 +--- a/drivers/gpu/drm/i915/i915_hwmon.c ++++ b/drivers/gpu/drm/i915/i915_hwmon.c +@@ -656,6 +656,11 @@ hwm_get_preregistration_info(struct drm_i915_private *i915) + for_each_gt(gt, i915, i) + hwm_energy(&hwmon->ddat_gt[i], &energy); + } ++ ++ /* Enable PL1 power limit */ ++ if (i915_mmio_reg_valid(hwmon->rg.pkg_rapl_limit)) ++ hwm_locked_with_pm_intel_uncore_rmw(ddat, hwmon->rg.pkg_rapl_limit, ++ PKG_PWR_LIM_1_EN, PKG_PWR_LIM_1_EN); + } + + void i915_hwmon_register(struct drm_i915_private *i915) +-- +2.39.2 + diff --git a/queue-6.2/drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch b/queue-6.2/drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch new file mode 100644 index 00000000000..7c4414f02a8 --- /dev/null +++ b/queue-6.2/drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch @@ -0,0 +1,45 @@ +From f3789257a1a2512f09ef1abfbfd6edcbabdbf55d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 23:06:02 +0300 +Subject: drm/i915: Make intel_get_crtc_new_encoder() less oopsy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit 631420b06597a33c72b6dcef78d1c2dea17f452d ] + +The point of the WARN was to print something, not oops +straight up. Currently that is precisely what happens +if we can't find the connector for the crtc in the atomic +state. Get the dev pointer from the atomic state instead +of the potentially NULL encoder to avoid that. + +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230413200602.6037-2-ville.syrjala@linux.intel.com +Fixes: 3a47ae201e07 ("drm/i915/display: Make WARN* drm specific where encoder ptr is available") +Reviewed-by: Jani Nikula +(cherry picked from commit 3b6692357f70498f617ea1b31a0378070a0acf1c) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c +index 2d46dcf820a23..80eb4f92167cc 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -1090,7 +1090,7 @@ intel_get_crtc_new_encoder(const struct intel_atomic_state *state, + num_encoders++; + } + +- drm_WARN(encoder->base.dev, num_encoders != 1, ++ drm_WARN(state->base.dev, num_encoders != 1, + "%d encoders for pipe %c\n", + num_encoders, pipe_name(master_crtc->pipe)); + +-- +2.39.2 + diff --git a/queue-6.2/drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch b/queue-6.2/drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch new file mode 100644 index 00000000000..f041e641106 --- /dev/null +++ b/queue-6.2/drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch @@ -0,0 +1,45 @@ +From 975d80889ac3d3701ac91bb4bb3b89a4005ead96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 22:27:11 -0700 +Subject: drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe() + +From: Harshit Mogalapalli + +[ Upstream commit c5647cae2704e58d1c4e5fedbf63f11bca6376c9 ] + +Smatch reports: +drivers/gpu/drm/lima/lima_drv.c:396 lima_pdev_probe() warn: + missing unwind goto? + +Store return value in err and goto 'err_out0' which has +lima_sched_slab_fini() before returning. + +Fixes: a1d2a6339961 ("drm/lima: driver for ARM Mali4xx GPUs") +Signed-off-by: Harshit Mogalapalli +Signed-off-by: Qiang Yu +Link: https://patchwork.freedesktop.org/patch/msgid/20230314052711.4061652-1-harshit.m.mogalapalli@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/lima/lima_drv.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/lima/lima_drv.c b/drivers/gpu/drm/lima/lima_drv.c +index 7b8d7178d09aa..39cab4a55f572 100644 +--- a/drivers/gpu/drm/lima/lima_drv.c ++++ b/drivers/gpu/drm/lima/lima_drv.c +@@ -392,8 +392,10 @@ static int lima_pdev_probe(struct platform_device *pdev) + + /* Allocate and initialize the DRM device. */ + ddev = drm_dev_alloc(&lima_drm_driver, &pdev->dev); +- if (IS_ERR(ddev)) +- return PTR_ERR(ddev); ++ if (IS_ERR(ddev)) { ++ err = PTR_ERR(ddev); ++ goto err_out0; ++ } + + ddev->dev_private = ldev; + ldev->ddev = ddev; +-- +2.39.2 + diff --git a/queue-6.2/drm-mediatek-dp-change-the-aux-retries-times-when-re.patch b/queue-6.2/drm-mediatek-dp-change-the-aux-retries-times-when-re.patch new file mode 100644 index 00000000000..04cbfa36792 --- /dev/null +++ b/queue-6.2/drm-mediatek-dp-change-the-aux-retries-times-when-re.patch @@ -0,0 +1,77 @@ +From 9f3460ee41898898ba89e8dda02d499502191e75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 14:43:23 +0800 +Subject: drm/mediatek: dp: Change the aux retries times when receiving + AUX_DEFER + +From: Xinlei Lee + +[ Upstream commit 9243d70e05c5989f84f840612965f96b524da925 ] + +DP 1.4a Section 2.8.7.1.5.6.1: +A DP Source device shall retry at least seven times upon receiving +AUX_DEFER before giving up the AUX transaction. + +The drm_dp_i2c_do_msg() function in the drm_dp_helper.c file will +judge the status of the msg->reply parameter passed to aux_transfer +for different processing. + +Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver") +Signed-off-by: Xinlei Lee +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/1680072203-10394-1-git-send-email-xinlei.lee@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dp.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c +index d28326350ea93..007af69e5026f 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dp.c ++++ b/drivers/gpu/drm/mediatek/mtk_dp.c +@@ -806,10 +806,9 @@ static int mtk_dp_aux_wait_for_completion(struct mtk_dp *mtk_dp, bool is_read) + } + + static int mtk_dp_aux_do_transfer(struct mtk_dp *mtk_dp, bool is_read, u8 cmd, +- u32 addr, u8 *buf, size_t length) ++ u32 addr, u8 *buf, size_t length, u8 *reply_cmd) + { + int ret; +- u32 reply_cmd; + + if (is_read && (length > DP_AUX_MAX_PAYLOAD_BYTES || + (cmd == DP_AUX_NATIVE_READ && !length))) +@@ -841,10 +840,10 @@ static int mtk_dp_aux_do_transfer(struct mtk_dp *mtk_dp, bool is_read, u8 cmd, + /* Wait for feedback from sink device. */ + ret = mtk_dp_aux_wait_for_completion(mtk_dp, is_read); + +- reply_cmd = mtk_dp_read(mtk_dp, MTK_DP_AUX_P0_3624) & +- AUX_RX_REPLY_COMMAND_AUX_TX_P0_MASK; ++ *reply_cmd = mtk_dp_read(mtk_dp, MTK_DP_AUX_P0_3624) & ++ AUX_RX_REPLY_COMMAND_AUX_TX_P0_MASK; + +- if (ret || reply_cmd) { ++ if (ret) { + u32 phy_status = mtk_dp_read(mtk_dp, MTK_DP_AUX_P0_3628) & + AUX_RX_PHY_STATE_AUX_TX_P0_MASK; + if (phy_status != AUX_RX_PHY_STATE_AUX_TX_P0_RX_IDLE) { +@@ -2071,7 +2070,7 @@ static ssize_t mtk_dp_aux_transfer(struct drm_dp_aux *mtk_aux, + ret = mtk_dp_aux_do_transfer(mtk_dp, is_read, request, + msg->address + accessed_bytes, + msg->buffer + accessed_bytes, +- to_access); ++ to_access, &msg->reply); + + if (ret) { + drm_info(mtk_dp->drm_dev, +@@ -2081,7 +2080,6 @@ static ssize_t mtk_dp_aux_transfer(struct drm_dp_aux *mtk_aux, + accessed_bytes += to_access; + } while (accessed_bytes < msg->size); + +- msg->reply = DP_AUX_NATIVE_REPLY_ACK | DP_AUX_I2C_REPLY_ACK; + return msg->size; + err: + msg->reply = DP_AUX_NATIVE_REPLY_NACK | DP_AUX_I2C_REPLY_NACK; +-- +2.39.2 + diff --git a/queue-6.2/drm-mediatek-dp-only-trigger-drm-hpd-events-if-bridg.patch b/queue-6.2/drm-mediatek-dp-only-trigger-drm-hpd-events-if-bridg.patch new file mode 100644 index 00000000000..317a88bede9 --- /dev/null +++ b/queue-6.2/drm-mediatek-dp-only-trigger-drm-hpd-events-if-bridg.patch @@ -0,0 +1,47 @@ +From db2d8f8594f3e9ae62d9d4dc2cb9decad18cbc5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 12:57:34 +0800 +Subject: drm/mediatek: dp: Only trigger DRM HPD events if bridge is attached + +From: Chen-Yu Tsai + +[ Upstream commit 36b617f7e4ae663fcadd202ea061ca695ca75539 ] + +The MediaTek DisplayPort interface bridge driver starts its interrupts +as soon as its probed. However when the interrupts trigger the bridge +might not have been attached to a DRM device. As drm_helper_hpd_irq_event() +does not check whether the passed in drm_device is valid or not, a NULL +pointer passed in results in a kernel NULL pointer dereference in it. + +Check whether the bridge is attached and only trigger an HPD event if +it is. + +Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Guillaume Ranquet +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Matthias Brugger +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230202045734.2773503-1-wenst@chromium.org/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c +index 9d085c05c49c3..d28326350ea93 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dp.c ++++ b/drivers/gpu/drm/mediatek/mtk_dp.c +@@ -1823,7 +1823,8 @@ static irqreturn_t mtk_dp_hpd_event_thread(int hpd, void *dev) + spin_unlock_irqrestore(&mtk_dp->irq_thread_lock, flags); + + if (status & MTK_DP_THREAD_CABLE_STATE_CHG) { +- drm_helper_hpd_irq_event(mtk_dp->bridge.dev); ++ if (mtk_dp->bridge.dev) ++ drm_helper_hpd_irq_event(mtk_dp->bridge.dev); + + if (!mtk_dp->train_info.cable_plugged_in) { + mtk_dp_disable_sdp_aui(mtk_dp); +-- +2.39.2 + diff --git a/queue-6.2/drm-msm-adreno-disable-preemption-on-adreno-510.patch b/queue-6.2/drm-msm-adreno-disable-preemption-on-adreno-510.patch new file mode 100644 index 00000000000..4fb2ecb7a23 --- /dev/null +++ b/queue-6.2/drm-msm-adreno-disable-preemption-on-adreno-510.patch @@ -0,0 +1,54 @@ +From fd838523bc31d4f4deb2548b5afff0fce778af39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 23:17:17 +0100 +Subject: drm: msm: adreno: Disable preemption on Adreno 510 + +From: Adam Skladowski + +[ Upstream commit 010c8bbad2cb8c33c47963e29f051f1e917e45a5 ] + +Downstream driver appears to not support preemption on A510 target, +trying to use one make device slow and fill log with rings related errors. +Set num_rings to 1 to disable preemption. + +Suggested-by: Dmitry Baryshkov +Fixes: e20c9284c8f2 ("drm/msm/adreno: Add support for Adreno 510 GPU") +Signed-off-by: Adam Skladowski +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/526898/ +Link: https://lore.kernel.org/r/20230314221757.13096-1-a39.skl@gmail.com +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +index 047c5e8c87ff4..f21f1bb7f886d 100644 +--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +@@ -1743,6 +1743,7 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev) + struct a5xx_gpu *a5xx_gpu = NULL; + struct adreno_gpu *adreno_gpu; + struct msm_gpu *gpu; ++ unsigned int nr_rings; + int ret; + + if (!pdev) { +@@ -1763,7 +1764,12 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev) + + check_speed_bin(&pdev->dev); + +- ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 4); ++ nr_rings = 4; ++ ++ if (adreno_is_a510(adreno_gpu)) ++ nr_rings = 1; ++ ++ ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, nr_rings); + if (ret) { + a5xx_destroy(&(a5xx_gpu->base.base)); + return ERR_PTR(ret); +-- +2.39.2 + diff --git a/queue-6.2/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch b/queue-6.2/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch new file mode 100644 index 00000000000..3d1aa0a039c --- /dev/null +++ b/queue-6.2/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch @@ -0,0 +1,42 @@ +From 656fa6acd2f756c56c2cca7452e755168ed13e80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 17:48:06 +0100 +Subject: drm/msm/adreno: drop bogus pm_runtime_set_active() + +From: Johan Hovold + +[ Upstream commit db7662d076c973072d788bd0e8130e04430307a1 ] + +The runtime PM status can only be updated while runtime PM is disabled. + +Drop the bogus pm_runtime_set_active() call that was made after enabling +runtime PM and which (incidentally but correctly) left the runtime PM +status set to 'suspended'. + +Fixes: 2c087a336676 ("drm/msm/adreno: Load the firmware before bringing up the hardware") +Signed-off-by: Johan Hovold +Patchwork: https://patchwork.freedesktop.org/patch/524972/ +Link: https://lore.kernel.org/r/20230303164807.13124-4-johan+linaro@kernel.org +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_device.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c +index c5c4c93b3689c..cd009d56d35d5 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_device.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c +@@ -438,9 +438,6 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev) + */ + pm_runtime_enable(&pdev->dev); + +- /* Make sure pm runtime is active and reset any previous errors */ +- pm_runtime_set_active(&pdev->dev); +- + ret = pm_runtime_get_sync(&pdev->dev); + if (ret < 0) { + pm_runtime_put_sync(&pdev->dev); +-- +2.39.2 + diff --git a/queue-6.2/drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch b/queue-6.2/drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch new file mode 100644 index 00000000000..ae835727e0d --- /dev/null +++ b/queue-6.2/drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch @@ -0,0 +1,40 @@ +From d11c12b6ed2429080d90f0b91fdd047880798c3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Mar 2023 22:03:07 +0530 +Subject: drm/msm/disp/dpu: check for crtc enable rather than crtc active to + release shared resources + +From: Vinod Polimera + +[ Upstream commit b6975693846b562c4d3e0e60cc884affc5bdac00 ] + +According to KMS documentation, The driver must not release any shared +resources if active is set to false but enable still true. + +Fixes: ccc862b957c6 ("drm/msm/dpu: Fix reservation failures in modeset") +Signed-off-by: Vinod Polimera +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/524726/ +Link: https://lore.kernel.org/r/1677774797-31063-5-git-send-email-quic_vpolimer@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +index 9c6817b5a1943..547f9f2b9fcb5 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +@@ -654,7 +654,7 @@ static int dpu_encoder_virt_atomic_check( + if (drm_atomic_crtc_needs_modeset(crtc_state)) { + dpu_rm_release(global_state, drm_enc); + +- if (!crtc_state->active_changed || crtc_state->active) ++ if (!crtc_state->active_changed || crtc_state->enable) + ret = dpu_rm_reserve(&dpu_kms->rm, global_state, + drm_enc, crtc_state, topology); + } +-- +2.39.2 + diff --git a/queue-6.2/drm-panel-novatek-nt35950-improve-error-handling.patch b/queue-6.2/drm-panel-novatek-nt35950-improve-error-handling.patch new file mode 100644 index 00000000000..08aa07b5293 --- /dev/null +++ b/queue-6.2/drm-panel-novatek-nt35950-improve-error-handling.patch @@ -0,0 +1,57 @@ +From e4840c9d2815080b545afcc21e0b2b690bd83587 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Apr 2023 13:00:30 +0200 +Subject: drm/panel: novatek-nt35950: Improve error handling + +From: Konrad Dybcio + +[ Upstream commit 5dd45b66742a1f3cfa9a92dc0ac8714c7708ee6c ] + +In a very peculiar case when probing and registering with the secondary +DSI host succeeds, but the OF backlight or DSI attachment fails, the +primary DSI device is automatically cleaned up, but the secondary one +is not, leading to -EEXIST when the driver core tries to handle +-EPROBE_DEFER. + +Unregister the DSI1 device manually on failure to prevent that. + +Fixes: 623a3531e9cf ("drm/panel: Add driver for Novatek NT35950 DSI DriverIC panels") +Signed-off-by: Konrad Dybcio +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230415-konrad-longbois-next-v1-1-ce695dc9df84@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-novatek-nt35950.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35950.c b/drivers/gpu/drm/panel/panel-novatek-nt35950.c +index 3a844917da075..4359b02754aac 100644 +--- a/drivers/gpu/drm/panel/panel-novatek-nt35950.c ++++ b/drivers/gpu/drm/panel/panel-novatek-nt35950.c +@@ -593,8 +593,11 @@ static int nt35950_probe(struct mipi_dsi_device *dsi) + DRM_MODE_CONNECTOR_DSI); + + ret = drm_panel_of_backlight(&nt->panel); +- if (ret) ++ if (ret) { ++ mipi_dsi_device_unregister(nt->dsi[1]); ++ + return dev_err_probe(dev, ret, "Failed to get backlight\n"); ++ } + + drm_panel_add(&nt->panel); + +@@ -610,6 +613,9 @@ static int nt35950_probe(struct mipi_dsi_device *dsi) + + ret = mipi_dsi_attach(nt->dsi[i]); + if (ret < 0) { ++ /* If we fail to attach to either host, we're done */ ++ mipi_dsi_device_unregister(nt->dsi[1]); ++ + return dev_err_probe(dev, ret, + "Cannot attach to DSI%d host.\n", i); + } +-- +2.39.2 + diff --git a/queue-6.2/drm-panel-novatek-nt35950-only-unregister-dsi1-if-it.patch b/queue-6.2/drm-panel-novatek-nt35950-only-unregister-dsi1-if-it.patch new file mode 100644 index 00000000000..aa76848d88b --- /dev/null +++ b/queue-6.2/drm-panel-novatek-nt35950-only-unregister-dsi1-if-it.patch @@ -0,0 +1,54 @@ +From 5a73f99844e474e94751f0d5459b6243e71b3faa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 17:41:08 +0200 +Subject: drm/panel: novatek-nt35950: Only unregister DSI1 if it exists + +From: Konrad Dybcio + +[ Upstream commit a50be876f4fe2349dc8b056a49d87f69c944570f ] + +Commit 5dd45b66742a ("drm/panel: novatek-nt35950: Improve error handling") +introduced logic to unregister DSI1 on any sort of probe failure, as +that's not done automatically by kernel APIs. + +It did not however account for cases where only one DSI host is used. +Fix that. + +Fixes: 5dd45b66742a ("drm/panel: novatek-nt35950: Improve error handling") +Reported-by: AngeloGioacchino Del Regno +Signed-off-by: Konrad Dybcio +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230417-topic-maple_panel_fixup-v1-1-07c8db606f5e@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-novatek-nt35950.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35950.c b/drivers/gpu/drm/panel/panel-novatek-nt35950.c +index 4359b02754aac..5d04957b1144f 100644 +--- a/drivers/gpu/drm/panel/panel-novatek-nt35950.c ++++ b/drivers/gpu/drm/panel/panel-novatek-nt35950.c +@@ -594,7 +594,8 @@ static int nt35950_probe(struct mipi_dsi_device *dsi) + + ret = drm_panel_of_backlight(&nt->panel); + if (ret) { +- mipi_dsi_device_unregister(nt->dsi[1]); ++ if (num_dsis == 2) ++ mipi_dsi_device_unregister(nt->dsi[1]); + + return dev_err_probe(dev, ret, "Failed to get backlight\n"); + } +@@ -614,7 +615,8 @@ static int nt35950_probe(struct mipi_dsi_device *dsi) + ret = mipi_dsi_attach(nt->dsi[i]); + if (ret < 0) { + /* If we fail to attach to either host, we're done */ +- mipi_dsi_device_unregister(nt->dsi[1]); ++ if (num_dsis == 2) ++ mipi_dsi_device_unregister(nt->dsi[1]); + + return dev_err_probe(dev, ret, + "Cannot attach to DSI%d host.\n", i); +-- +2.39.2 + diff --git a/queue-6.2/drm-probe-helper-cancel-previous-job-before-starting.patch b/queue-6.2/drm-probe-helper-cancel-previous-job-before-starting.patch new file mode 100644 index 00000000000..7bc6d5f2cce --- /dev/null +++ b/queue-6.2/drm-probe-helper-cancel-previous-job-before-starting.patch @@ -0,0 +1,52 @@ +From 380ad7694f50274cbbe80d76457bff8ec0713409 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 16:40:52 +0100 +Subject: drm/probe-helper: Cancel previous job before starting new one + +From: Dom Cobley + +[ Upstream commit a8e47884f1906cd7440fafa056adc8817568e73e ] + +Currently we schedule a call to output_poll_execute from +drm_kms_helper_poll_enable for 10s in future. Later we try to replace +that in drm_helper_probe_single_connector_modes with a 0s schedule with +delayed_event set. + +But as there is already a job in the queue this fails, and the immediate +job we wanted with delayed_event set doesn't occur until 10s later. + +And that call acts as if connector state has changed, reprobing modes. +This has a side effect of waking up a display that has been blanked. + +Make sure we cancel the old job before submitting the immediate one. + +Fixes: 162b6a57ac50 ("drm/probe-helper: don't lose hotplug event") +Acked-by: Daniel Vetter +Signed-off-by: Dom Cobley +[Maxime: Switched to mod_delayed_work] +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20230127154052.452524-1-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_probe_helper.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c +index bcd9611dabfd9..1a672747c83b8 100644 +--- a/drivers/gpu/drm/drm_probe_helper.c ++++ b/drivers/gpu/drm/drm_probe_helper.c +@@ -556,8 +556,9 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector, + */ + dev->mode_config.delayed_event = true; + if (dev->mode_config.poll_enabled) +- schedule_delayed_work(&dev->mode_config.output_poll_work, +- 0); ++ mod_delayed_work(system_wq, ++ &dev->mode_config.output_poll_work, ++ 0); + } + + /* Re-enable polling in case the global poll config changed. */ +-- +2.39.2 + diff --git a/queue-6.2/drm-rcar-du-fix-a-null-vs-is_err-bug.patch b/queue-6.2/drm-rcar-du-fix-a-null-vs-is_err-bug.patch new file mode 100644 index 00000000000..11db1f95a01 --- /dev/null +++ b/queue-6.2/drm-rcar-du-fix-a-null-vs-is_err-bug.patch @@ -0,0 +1,40 @@ +From 5fe76e2ca023f14c5c3ba7e32277107e85ac00a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 13:06:59 +0300 +Subject: drm: rcar-du: Fix a NULL vs IS_ERR() bug + +From: Dan Carpenter + +[ Upstream commit 40f43730f43699ce8557e4fe59622d4f4b69f44a ] + +The drmm_encoder_alloc() function returns error pointers. It never +returns NULL. Fix the check accordingly. + +Fixes: 7a1adbd23990 ("drm: rcar-du: Use drmm_encoder_alloc() to manage encoder") +Signed-off-by: Dan Carpenter +Reviewed-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rcar-du/rcar_du_encoder.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_encoder.c b/drivers/gpu/drm/rcar-du/rcar_du_encoder.c +index b1787be31e92c..7ecec7b04a8d0 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_encoder.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_encoder.c +@@ -109,8 +109,8 @@ int rcar_du_encoder_init(struct rcar_du_device *rcdu, + renc = drmm_encoder_alloc(&rcdu->ddev, struct rcar_du_encoder, base, + &rcar_du_encoder_funcs, DRM_MODE_ENCODER_NONE, + NULL); +- if (!renc) +- return -ENOMEM; ++ if (IS_ERR(renc)) ++ return PTR_ERR(renc); + + renc->output = output; + +-- +2.39.2 + diff --git a/queue-6.2/drm-rockchip-drop-unbalanced-obj-unref.patch b/queue-6.2/drm-rockchip-drop-unbalanced-obj-unref.patch new file mode 100644 index 00000000000..f15a9e032c8 --- /dev/null +++ b/queue-6.2/drm-rockchip-drop-unbalanced-obj-unref.patch @@ -0,0 +1,38 @@ +From 1e070d564e94e2a6095c7b301bc8eeb8c3015448 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 15:17:34 -0800 +Subject: drm/rockchip: Drop unbalanced obj unref + +From: Rob Clark + +[ Upstream commit 8ee3b0e85f6ccd9e6c527bc50eaba774c3bb18d0 ] + +In the error path, rockchip_drm_gem_object_mmap() is dropping an obj +reference that it doesn't own. + +Fixes: 41315b793e13 ("drm/rockchip: use drm_gem_mmap helpers") +Signed-off-by: Rob Clark +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20230119231734.2884543-1-robdclark@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +index 6edb7c52cb3dc..19b46c00dcbfd 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +@@ -262,9 +262,6 @@ static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj, + else + ret = rockchip_drm_gem_object_mmap_dma(obj, vma); + +- if (ret) +- drm_gem_vm_close(vma); +- + return ret; + } + +-- +2.39.2 + diff --git a/queue-6.2/drm-ttm-pool-fix-ttm_pool_alloc-error-path.patch b/queue-6.2/drm-ttm-pool-fix-ttm_pool_alloc-error-path.patch new file mode 100644 index 00000000000..aa61aed6835 --- /dev/null +++ b/queue-6.2/drm-ttm-pool-fix-ttm_pool_alloc-error-path.patch @@ -0,0 +1,195 @@ +From c89f99f0b97eabae552565177b09fdf6cc032da2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 22:06:48 +0200 +Subject: drm/ttm/pool: Fix ttm_pool_alloc error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Hellström + +[ Upstream commit 379989e7cbdc7aa7496a00ee286ec146c7599cf0 ] + +When hitting an error, the error path forgot to unmap dma mappings and +could call set_pages_wb() on already uncached pages. + +Fix this by introducing a common ttm_pool_free_range() function that +does the right thing. + +v2: +- Simplify that common function (Christian König) +v3: +- Rename that common function to ttm_pool_free_range() (Christian König) + +Fixes: d099fc8f540a ("drm/ttm: new TT backend allocation pool v3") +Cc: Christian König +Cc: Dave Airlie +Cc: Christian Koenig +Cc: Huang Rui +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Thomas Hellström +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/patch/msgid/20230404200650.11043-2-thomas.hellstrom@linux.intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_pool.c | 81 +++++++++++++++++++++------------- + 1 file changed, 51 insertions(+), 30 deletions(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_pool.c b/drivers/gpu/drm/ttm/ttm_pool.c +index 9f6764bf3b15d..86affe987a1cb 100644 +--- a/drivers/gpu/drm/ttm/ttm_pool.c ++++ b/drivers/gpu/drm/ttm/ttm_pool.c +@@ -366,6 +366,43 @@ static int ttm_pool_page_allocated(struct ttm_pool *pool, unsigned int order, + return 0; + } + ++/** ++ * ttm_pool_free_range() - Free a range of TTM pages ++ * @pool: The pool used for allocating. ++ * @tt: The struct ttm_tt holding the page pointers. ++ * @caching: The page caching mode used by the range. ++ * @start_page: index for first page to free. ++ * @end_page: index for last page to free + 1. ++ * ++ * During allocation the ttm_tt page-vector may be populated with ranges of ++ * pages with different attributes if allocation hit an error without being ++ * able to completely fulfill the allocation. This function can be used ++ * to free these individual ranges. ++ */ ++static void ttm_pool_free_range(struct ttm_pool *pool, struct ttm_tt *tt, ++ enum ttm_caching caching, ++ pgoff_t start_page, pgoff_t end_page) ++{ ++ struct page **pages = tt->pages; ++ unsigned int order; ++ pgoff_t i, nr; ++ ++ for (i = start_page; i < end_page; i += nr, pages += nr) { ++ struct ttm_pool_type *pt = NULL; ++ ++ order = ttm_pool_page_order(pool, *pages); ++ nr = (1UL << order); ++ if (tt->dma_address) ++ ttm_pool_unmap(pool, tt->dma_address[i], nr); ++ ++ pt = ttm_pool_select_type(pool, caching, order); ++ if (pt) ++ ttm_pool_type_give(pt, *pages); ++ else ++ ttm_pool_free_page(pool, caching, order, *pages); ++ } ++} ++ + /** + * ttm_pool_alloc - Fill a ttm_tt object + * +@@ -381,12 +418,14 @@ static int ttm_pool_page_allocated(struct ttm_pool *pool, unsigned int order, + int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt, + struct ttm_operation_ctx *ctx) + { +- unsigned long num_pages = tt->num_pages; ++ pgoff_t num_pages = tt->num_pages; + dma_addr_t *dma_addr = tt->dma_address; + struct page **caching = tt->pages; + struct page **pages = tt->pages; ++ enum ttm_caching page_caching; + gfp_t gfp_flags = GFP_USER; +- unsigned int i, order; ++ pgoff_t caching_divide; ++ unsigned int order; + struct page *p; + int r; + +@@ -409,6 +448,7 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt, + order = min_t(unsigned int, order, __fls(num_pages))) { + struct ttm_pool_type *pt; + ++ page_caching = tt->caching; + pt = ttm_pool_select_type(pool, tt->caching, order); + p = pt ? ttm_pool_type_take(pt) : NULL; + if (p) { +@@ -417,6 +457,7 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt, + if (r) + goto error_free_page; + ++ caching = pages; + do { + r = ttm_pool_page_allocated(pool, order, p, + &dma_addr, +@@ -425,14 +466,15 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt, + if (r) + goto error_free_page; + ++ caching = pages; + if (num_pages < (1 << order)) + break; + + p = ttm_pool_type_take(pt); + } while (p); +- caching = pages; + } + ++ page_caching = ttm_cached; + while (num_pages >= (1 << order) && + (p = ttm_pool_alloc_page(pool, gfp_flags, order))) { + +@@ -441,6 +483,7 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt, + tt->caching); + if (r) + goto error_free_page; ++ caching = pages; + } + r = ttm_pool_page_allocated(pool, order, p, &dma_addr, + &num_pages, &pages); +@@ -467,15 +510,13 @@ int ttm_pool_alloc(struct ttm_pool *pool, struct ttm_tt *tt, + return 0; + + error_free_page: +- ttm_pool_free_page(pool, tt->caching, order, p); ++ ttm_pool_free_page(pool, page_caching, order, p); + + error_free_all: + num_pages = tt->num_pages - num_pages; +- for (i = 0; i < num_pages; ) { +- order = ttm_pool_page_order(pool, tt->pages[i]); +- ttm_pool_free_page(pool, tt->caching, order, tt->pages[i]); +- i += 1 << order; +- } ++ caching_divide = caching - tt->pages; ++ ttm_pool_free_range(pool, tt, tt->caching, 0, caching_divide); ++ ttm_pool_free_range(pool, tt, ttm_cached, caching_divide, num_pages); + + return r; + } +@@ -491,27 +532,7 @@ EXPORT_SYMBOL(ttm_pool_alloc); + */ + void ttm_pool_free(struct ttm_pool *pool, struct ttm_tt *tt) + { +- unsigned int i; +- +- for (i = 0; i < tt->num_pages; ) { +- struct page *p = tt->pages[i]; +- unsigned int order, num_pages; +- struct ttm_pool_type *pt; +- +- order = ttm_pool_page_order(pool, p); +- num_pages = 1ULL << order; +- if (tt->dma_address) +- ttm_pool_unmap(pool, tt->dma_address[i], num_pages); +- +- pt = ttm_pool_select_type(pool, tt->caching, order); +- if (pt) +- ttm_pool_type_give(pt, tt->pages[i]); +- else +- ttm_pool_free_page(pool, tt->caching, order, +- tt->pages[i]); +- +- i += num_pages; +- } ++ ttm_pool_free_range(pool, tt, tt->caching, 0, tt->num_pages); + + while (atomic_long_read(&allocated_pages) > page_pool_size) + ttm_pool_shrink(); +-- +2.39.2 + diff --git a/queue-6.2/drm-vgem-add-missing-mutex_destroy.patch b/queue-6.2/drm-vgem-add-missing-mutex_destroy.patch new file mode 100644 index 00000000000..b2009d1bd49 --- /dev/null +++ b/queue-6.2/drm-vgem-add-missing-mutex_destroy.patch @@ -0,0 +1,42 @@ +From 6fdf392d0d782e6ac0262dd534661787d21282df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 09:55:17 -0300 +Subject: drm/vgem: add missing mutex_destroy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +[ Upstream commit 7c18189b14b33c1fbf76480b1bd217877c086e67 ] + +vgem_fence_open() instantiates a mutex for a particular fence +instance, but never destroys it by calling mutex_destroy() in +vgem_fence_close(). + +So, add the missing mutex_destroy() to guarantee proper resource +destruction. + +Fixes: 407779848445 ("drm/vgem: Attach sw fences to exported vGEM dma-buf (ioctl)") +Signed-off-by: Maíra Canal +Reviewed-by: Stanislaw Gruszka +Signed-off-by: Maíra Canal +Link: https://patchwork.freedesktop.org/patch/msgid/20230202125517.427976-1-mcanal@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vgem/vgem_fence.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/vgem/vgem_fence.c b/drivers/gpu/drm/vgem/vgem_fence.c +index c2a879734d407..e157541783959 100644 +--- a/drivers/gpu/drm/vgem/vgem_fence.c ++++ b/drivers/gpu/drm/vgem/vgem_fence.c +@@ -249,4 +249,5 @@ void vgem_fence_close(struct vgem_file *vfile) + { + idr_for_each(&vfile->fence_idr, __vgem_fence_idr_fini, vfile); + idr_destroy(&vfile->fence_idr); ++ mutex_destroy(&vfile->fence_mutex); + } +-- +2.39.2 + diff --git a/queue-6.2/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch b/queue-6.2/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch new file mode 100644 index 00000000000..2afe1675d83 --- /dev/null +++ b/queue-6.2/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch @@ -0,0 +1,55 @@ +From 886b2e71a59276382cc664923b7edd219e7d6819 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Feb 2023 09:17:28 +0800 +Subject: EDAC/skx: Fix overflows on the DRAM row address mapping arrays + +From: Qiuxu Zhuo + +[ Upstream commit 71b1e3ba3fed5a34c5fac6d3a15c2634b04c1eb7 ] + +The current DRAM row address mapping arrays skx_{open,close}_row[] +only support ranks with sizes up to 16G. Decoding a rank address +to a DRAM row address for a 32G rank by using either one of the +above arrays by the skx_edac driver, will result in an overflow on +the array. + +For a 32G rank, the most significant DRAM row address bit (the +bit17) is mapped from the bit34 of the rank address. Add this new +mapping item to both arrays to fix the overflow issue. + +Fixes: 4ec656bdf43a ("EDAC, skx_edac: Add EDAC driver for Skylake") +Reported-by: Feng Xu +Tested-by: Feng Xu +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/all/20230211011728.71764-1-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/skx_base.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/edac/skx_base.c b/drivers/edac/skx_base.c +index 9397abb42c498..0a862336a7ce8 100644 +--- a/drivers/edac/skx_base.c ++++ b/drivers/edac/skx_base.c +@@ -510,7 +510,7 @@ static bool skx_rir_decode(struct decoded_addr *res) + } + + static u8 skx_close_row[] = { +- 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33 ++ 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33, 34 + }; + + static u8 skx_close_column[] = { +@@ -518,7 +518,7 @@ static u8 skx_close_column[] = { + }; + + static u8 skx_open_row[] = { +- 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33 ++ 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33, 34 + }; + + static u8 skx_open_column[] = { +-- +2.39.2 + diff --git a/queue-6.2/erofs-fix-potential-overflow-calculating-xattr_isize.patch b/queue-6.2/erofs-fix-potential-overflow-calculating-xattr_isize.patch new file mode 100644 index 00000000000..5451364c185 --- /dev/null +++ b/queue-6.2/erofs-fix-potential-overflow-calculating-xattr_isize.patch @@ -0,0 +1,42 @@ +From 26fa8844f10fda76aec4db72508c8026050bbccb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 14:18:10 +0800 +Subject: erofs: fix potential overflow calculating xattr_isize + +From: Jingbo Xu + +[ Upstream commit 1b3567a1969b26f709d82a874498c0754ea841c3 ] + +Given on-disk i_xattr_icount is 16 bits and xattr_isize is calculated +from i_xattr_icount multiplying 4, xattr_isize has a theoretical maximum +of 256K (64K * 4). + +Thus declare xattr_isize as unsigned int to avoid the potential overflow. + +Fixes: bfb8674dc044 ("staging: erofs: add erofs in-memory stuffs") +Signed-off-by: Jingbo Xu +Reviewed-by: Gao Xiang +Reviewed-by: Chao Yu +Link: https://lore.kernel.org/r/20230414061810.6479-1-jefflexu@linux.alibaba.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/internal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h +index f246523dd7917..29b104754fb44 100644 +--- a/fs/erofs/internal.h ++++ b/fs/erofs/internal.h +@@ -310,7 +310,7 @@ struct erofs_inode { + + unsigned char datalayout; + unsigned char inode_isize; +- unsigned short xattr_isize; ++ unsigned int xattr_isize; + + unsigned int xattr_shared_count; + unsigned int *xattr_shared_xattrs; +-- +2.39.2 + diff --git a/queue-6.2/erofs-initialize-packed-inode-after-root-inode-is-as.patch b/queue-6.2/erofs-initialize-packed-inode-after-root-inode-is-as.patch new file mode 100644 index 00000000000..580912c172f --- /dev/null +++ b/queue-6.2/erofs-initialize-packed-inode-after-root-inode-is-as.patch @@ -0,0 +1,85 @@ +From 1de5b8f1ebc7497da73bbab470b55494d370b62d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 22:17:05 +0800 +Subject: erofs: initialize packed inode after root inode is assigned + +From: Jingbo Xu + +[ Upstream commit cb9bce79514392a9a216ff67148e05e2d72c28bd ] + +As commit 8f7acdae2cd4 ("staging: erofs: kill all failure handling in +fill_super()"), move the initialization of packed inode after root +inode is assigned, so that the iput() in .put_super() is adequate as +the failure handling. + +Otherwise, iput() is also needed in .kill_sb(), in case of the mounting +fails halfway. + +Signed-off-by: Jingbo Xu +Reviewed-by: Yue Hu +Fixes: b15b2e307c3a ("erofs: support on-disk compressed fragments data") +Reviewed-by: Gao Xiang +Acked-by: Chao Yu +Link: https://lore.kernel.org/r/20230407141710.113882-3-jefflexu@linux.alibaba.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/internal.h | 1 + + fs/erofs/super.c | 22 +++++++++++----------- + 2 files changed, 12 insertions(+), 11 deletions(-) + +diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h +index bb8501c0ff5b5..f246523dd7917 100644 +--- a/fs/erofs/internal.h ++++ b/fs/erofs/internal.h +@@ -154,6 +154,7 @@ struct erofs_sb_info { + + /* what we really care is nid, rather than ino.. */ + erofs_nid_t root_nid; ++ erofs_nid_t packed_nid; + /* used for statfs, f_files - f_favail */ + u64 inos; + +diff --git a/fs/erofs/super.c b/fs/erofs/super.c +index 626a615dafc2f..bd8bf8fc2f5df 100644 +--- a/fs/erofs/super.c ++++ b/fs/erofs/super.c +@@ -381,17 +381,7 @@ static int erofs_read_superblock(struct super_block *sb) + #endif + sbi->islotbits = ilog2(sizeof(struct erofs_inode_compact)); + sbi->root_nid = le16_to_cpu(dsb->root_nid); +-#ifdef CONFIG_EROFS_FS_ZIP +- sbi->packed_inode = NULL; +- if (erofs_sb_has_fragments(sbi) && dsb->packed_nid) { +- sbi->packed_inode = +- erofs_iget(sb, le64_to_cpu(dsb->packed_nid)); +- if (IS_ERR(sbi->packed_inode)) { +- ret = PTR_ERR(sbi->packed_inode); +- goto out; +- } +- } +-#endif ++ sbi->packed_nid = le64_to_cpu(dsb->packed_nid); + sbi->inos = le64_to_cpu(dsb->inos); + + sbi->build_time = le64_to_cpu(dsb->build_time); +@@ -800,6 +790,16 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc) + + erofs_shrinker_register(sb); + /* sb->s_umount is already locked, SB_ACTIVE and SB_BORN are not set */ ++#ifdef CONFIG_EROFS_FS_ZIP ++ if (erofs_sb_has_fragments(sbi) && sbi->packed_nid) { ++ sbi->packed_inode = erofs_iget(sb, sbi->packed_nid); ++ if (IS_ERR(sbi->packed_inode)) { ++ err = PTR_ERR(sbi->packed_inode); ++ sbi->packed_inode = NULL; ++ return err; ++ } ++ } ++#endif + err = erofs_init_managed_cache(sb); + if (err) + return err; +-- +2.39.2 + diff --git a/queue-6.2/erofs-stop-parsing-non-compact-head-index-if-cluster.patch b/queue-6.2/erofs-stop-parsing-non-compact-head-index-if-cluster.patch new file mode 100644 index 00000000000..695cee4dcc4 --- /dev/null +++ b/queue-6.2/erofs-stop-parsing-non-compact-head-index-if-cluster.patch @@ -0,0 +1,65 @@ +From 4909f94d8a316ee0766c9effdeb8a43c2cbb91a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 01:37:14 +0800 +Subject: erofs: stop parsing non-compact HEAD index if clusterofs is invalid + +From: Gao Xiang + +[ Upstream commit cc4efd3dd2ac9f89143e5d881609747ecff04164 ] + +Syzbot generated a crafted image [1] with a non-compact HEAD index of +clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1, +which causes the following unexpected behavior as below: + + BUG: unable to handle page fault for address: fffff52101a3fff9 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 23ffed067 P4D 23ffed067 PUD 0 + Oops: 0000 [#1] PREEMPT SMP KASAN + CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 + Workqueue: erofs_worker z_erofs_decompressqueue_work + RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40 + ... + Call Trace: + + z_erofs_decompressqueue_work+0x99/0xe0 + process_one_work+0x8f6/0x1170 + worker_thread+0xa63/0x1210 + kthread+0x270/0x300 + ret_from_fork+0x1f/0x30 + +Note that normal images or images using compact indexes are not +impacted. Let's fix this now. + +[1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com + +Reported-and-tested-by: syzbot+aafb3f37cfeb6534c4ac@syzkaller.appspotmail.com +Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter") +Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support") +Signed-off-by: Gao Xiang +Reviewed-by: Chao Yu +Link: https://lore.kernel.org/r/20230410173714.104604-1-hsiangkao@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + fs/erofs/zmap.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c +index 98fb90b9af715..91733f8ecdffc 100644 +--- a/fs/erofs/zmap.c ++++ b/fs/erofs/zmap.c +@@ -211,6 +211,10 @@ static int legacy_load_cluster_from_disk(struct z_erofs_maprecorder *m, + if (advise & Z_EROFS_VLE_DI_PARTIAL_REF) + m->partialref = true; + m->clusterofs = le16_to_cpu(di->di_clusterofs); ++ if (m->clusterofs >= 1 << vi->z_logical_clusterbits) { ++ DBG_BUGON(1); ++ return -EFSCORRUPTED; ++ } + m->pblk = le32_to_cpu(di->di_u.blkaddr); + break; + default: +-- +2.39.2 + diff --git a/queue-6.2/ext4-fix-i_disksize-exceeding-i_size-problem-in-pari.patch b/queue-6.2/ext4-fix-i_disksize-exceeding-i_size-problem-in-pari.patch new file mode 100644 index 00000000000..4899bc25b1f --- /dev/null +++ b/queue-6.2/ext4-fix-i_disksize-exceeding-i_size-problem-in-pari.patch @@ -0,0 +1,81 @@ +From 1b9aec0f87864658c413f497e1f826825a630d91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 09:37:21 +0800 +Subject: ext4: fix i_disksize exceeding i_size problem in paritally written + case + +From: Zhihao Cheng + +[ Upstream commit 1dedde690303c05ef732b7c5c8356fdf60a4ade3 ] + +It is possible for i_disksize can exceed i_size, triggering a warning. + +generic_perform_write + copied = iov_iter_copy_from_user_atomic(len) // copied < len + ext4_da_write_end + | ext4_update_i_disksize + | new_i_size = pos + copied; + | WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize + | generic_write_end + | copied = block_write_end(copied, len) // copied = 0 + | if (unlikely(copied < len)) + | if (!PageUptodate(page)) + | copied = 0; + | if (pos + copied > inode->i_size) // return false + if (unlikely(copied == 0)) + goto again; + if (unlikely(iov_iter_fault_in_readable(i, bytes))) { + status = -EFAULT; + break; + } + +We get i_disksize greater than i_size here, which could trigger WARNING +check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio: + +ext4_dio_write_iter + iomap_dio_rw + __iomap_dio_rw // return err, length is not aligned to 512 + ext4_handle_inode_extension + WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops + + WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319 + CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2 + RIP: 0010:ext4_file_write_iter+0xbc7 + Call Trace: + vfs_write+0x3b1 + ksys_write+0x77 + do_syscall_64+0x39 + +Fix it by updating 'copied' value before updating i_disksize just like +ext4_write_inline_data_end() does. + +A reproducer can be found in the buganizer link below. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217209 +Fixes: 64769240bd07 ("ext4: Add delayed allocation support in data=writeback mode") +Signed-off-by: Zhihao Cheng +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230321013721.89818-1-chengzhihao1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/inode.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 96517785a9f89..0b87665aaff13 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -3149,6 +3149,9 @@ static int ext4_da_write_end(struct file *file, + ext4_has_inline_data(inode)) + return ext4_write_inline_data_end(inode, pos, len, copied, page); + ++ if (unlikely(copied < len) && !PageUptodate(page)) ++ copied = 0; ++ + start = pos & (PAGE_SIZE - 1); + end = start + copied - 1; + +-- +2.39.2 + diff --git a/queue-6.2/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch b/queue-6.2/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch new file mode 100644 index 00000000000..aa3a29e229d --- /dev/null +++ b/queue-6.2/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch @@ -0,0 +1,94 @@ +From de7473ad8a945308072ec19920b619ac867ac31e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 11:16:27 +0000 +Subject: ext4: fix use-after-free read in ext4_find_extent for bigalloc + + inline + +From: Ye Bin + +[ Upstream commit 835659598c67907b98cd2aa57bb951dfaf675c69 ] + +Syzbot found the following issue: +loop0: detected capacity change from 0 to 2048 +EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none. +================================================================== +BUG: KASAN: use-after-free in ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline] +BUG: KASAN: use-after-free in ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931 +Read of size 4 at addr ffff888073644750 by task syz-executor420/5067 + +CPU: 0 PID: 5067 Comm: syz-executor420 Not tainted 6.2.0-rc1-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 + print_address_description+0x74/0x340 mm/kasan/report.c:306 + print_report+0x107/0x1f0 mm/kasan/report.c:417 + kasan_report+0xcd/0x100 mm/kasan/report.c:517 + ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline] + ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931 + ext4_clu_mapped+0x117/0x970 fs/ext4/extents.c:5809 + ext4_insert_delayed_block fs/ext4/inode.c:1696 [inline] + ext4_da_map_blocks fs/ext4/inode.c:1806 [inline] + ext4_da_get_block_prep+0x9e8/0x13c0 fs/ext4/inode.c:1870 + ext4_block_write_begin+0x6a8/0x2290 fs/ext4/inode.c:1098 + ext4_da_write_begin+0x539/0x760 fs/ext4/inode.c:3082 + generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772 + ext4_buffered_write_iter+0x122/0x3a0 fs/ext4/file.c:285 + ext4_file_write_iter+0x1d0/0x18f0 + call_write_iter include/linux/fs.h:2186 [inline] + new_sync_write fs/read_write.c:491 [inline] + vfs_write+0x7dc/0xc50 fs/read_write.c:584 + ksys_write+0x177/0x2a0 fs/read_write.c:637 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f4b7a9737b9 +RSP: 002b:00007ffc5cac3668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4b7a9737b9 +RDX: 00000000175d9003 RSI: 0000000020000200 RDI: 0000000000000004 +RBP: 00007f4b7a933050 R08: 0000000000000000 R09: 0000000000000000 +R10: 000000000000079f R11: 0000000000000246 R12: 00007f4b7a9330e0 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + + +Above issue is happens when enable bigalloc and inline data feature. As +commit 131294c35ed6 fixed delayed allocation bug in ext4_clu_mapped for +bigalloc + inline. But it only resolved issue when has inline data, if +inline data has been converted to extent(ext4_da_convert_inline_data_to_extent) +before writepages, there is no EXT4_STATE_MAY_INLINE_DATA flag. However +i_data is still store inline data in this scene. Then will trigger UAF +when find extent. +To resolve above issue, there is need to add judge "ext4_has_inline_data(inode)" +in ext4_clu_mapped(). + +Fixes: 131294c35ed6 ("ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline") +Reported-by: syzbot+bf4bb7731ef73b83a3b4@syzkaller.appspotmail.com +Reviewed-by: Jan Kara +Reviewed-by: Ye Bin +Reviewed-by: Tudor Ambarus +Tested-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20230406111627.1916759-1-tudor.ambarus@linaro.org +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 9de1c9d1a13d3..ee5acf2bd5e67 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -5802,7 +5802,8 @@ int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu) + * mapped - no physical clusters have been allocated, and the + * file has no extents + */ +- if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) ++ if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) || ++ ext4_has_inline_data(inode)) + return 0; + + /* search for the extent closest to the first block in the cluster */ +-- +2.39.2 + diff --git a/queue-6.2/f2fs-apply-zone-capacity-to-all-zone-type.patch b/queue-6.2/f2fs-apply-zone-capacity-to-all-zone-type.patch new file mode 100644 index 00000000000..9f214c65b63 --- /dev/null +++ b/queue-6.2/f2fs-apply-zone-capacity-to-all-zone-type.patch @@ -0,0 +1,140 @@ +From 1c223db0c2fb55cdd73385ee65c5ded911a4d1b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 15:58:04 -0700 +Subject: f2fs: apply zone capacity to all zone type + +From: Jaegeuk Kim + +[ Upstream commit 0b37ed21e3367539b79284e0b0af2246ffcf0dca ] + +If we manage the zone capacity per zone type, it'll break the GC assumption. +And, the current logic complains valid block count mismatch. +Let's apply zone capacity to all zone type, if specified. + +Fixes: de881df97768 ("f2fs: support zone capacity less than zone size") +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/segment.c | 65 +++-------------------------------------------- + fs/f2fs/segment.h | 3 +++ + 2 files changed, 7 insertions(+), 61 deletions(-) + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 269f89d202c61..2822b04082eec 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -4951,48 +4951,6 @@ int f2fs_check_write_pointer(struct f2fs_sb_info *sbi) + return 0; + } + +-static bool is_conv_zone(struct f2fs_sb_info *sbi, unsigned int zone_idx, +- unsigned int dev_idx) +-{ +- if (!bdev_is_zoned(FDEV(dev_idx).bdev)) +- return true; +- return !test_bit(zone_idx, FDEV(dev_idx).blkz_seq); +-} +- +-/* Return the zone index in the given device */ +-static unsigned int get_zone_idx(struct f2fs_sb_info *sbi, unsigned int secno, +- int dev_idx) +-{ +- block_t sec_start_blkaddr = START_BLOCK(sbi, GET_SEG_FROM_SEC(sbi, secno)); +- +- return (sec_start_blkaddr - FDEV(dev_idx).start_blk) >> +- sbi->log_blocks_per_blkz; +-} +- +-/* +- * Return the usable segments in a section based on the zone's +- * corresponding zone capacity. Zone is equal to a section. +- */ +-static inline unsigned int f2fs_usable_zone_segs_in_sec( +- struct f2fs_sb_info *sbi, unsigned int segno) +-{ +- unsigned int dev_idx, zone_idx; +- +- dev_idx = f2fs_target_device_index(sbi, START_BLOCK(sbi, segno)); +- zone_idx = get_zone_idx(sbi, GET_SEC_FROM_SEG(sbi, segno), dev_idx); +- +- /* Conventional zone's capacity is always equal to zone size */ +- if (is_conv_zone(sbi, zone_idx, dev_idx)) +- return sbi->segs_per_sec; +- +- if (!sbi->unusable_blocks_per_sec) +- return sbi->segs_per_sec; +- +- /* Get the segment count beyond zone capacity block */ +- return sbi->segs_per_sec - (sbi->unusable_blocks_per_sec >> +- sbi->log_blocks_per_seg); +-} +- + /* + * Return the number of usable blocks in a segment. The number of blocks + * returned is always equal to the number of blocks in a segment for +@@ -5005,23 +4963,13 @@ static inline unsigned int f2fs_usable_zone_blks_in_seg( + struct f2fs_sb_info *sbi, unsigned int segno) + { + block_t seg_start, sec_start_blkaddr, sec_cap_blkaddr; +- unsigned int zone_idx, dev_idx, secno; +- +- secno = GET_SEC_FROM_SEG(sbi, segno); +- seg_start = START_BLOCK(sbi, segno); +- dev_idx = f2fs_target_device_index(sbi, seg_start); +- zone_idx = get_zone_idx(sbi, secno, dev_idx); +- +- /* +- * Conventional zone's capacity is always equal to zone size, +- * so, blocks per segment is unchanged. +- */ +- if (is_conv_zone(sbi, zone_idx, dev_idx)) +- return sbi->blocks_per_seg; ++ unsigned int secno; + + if (!sbi->unusable_blocks_per_sec) + return sbi->blocks_per_seg; + ++ secno = GET_SEC_FROM_SEG(sbi, segno); ++ seg_start = START_BLOCK(sbi, segno); + sec_start_blkaddr = START_BLOCK(sbi, GET_SEG_FROM_SEC(sbi, secno)); + sec_cap_blkaddr = sec_start_blkaddr + CAP_BLKS_PER_SEC(sbi); + +@@ -5055,11 +5003,6 @@ static inline unsigned int f2fs_usable_zone_blks_in_seg(struct f2fs_sb_info *sbi + return 0; + } + +-static inline unsigned int f2fs_usable_zone_segs_in_sec(struct f2fs_sb_info *sbi, +- unsigned int segno) +-{ +- return 0; +-} + #endif + unsigned int f2fs_usable_blks_in_seg(struct f2fs_sb_info *sbi, + unsigned int segno) +@@ -5074,7 +5017,7 @@ unsigned int f2fs_usable_segs_in_sec(struct f2fs_sb_info *sbi, + unsigned int segno) + { + if (f2fs_sb_has_blkzoned(sbi)) +- return f2fs_usable_zone_segs_in_sec(sbi, segno); ++ return CAP_SEGS_PER_SEC(sbi); + + return sbi->segs_per_sec; + } +diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h +index 6eb5922a25361..822c47fdc6e35 100644 +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -104,6 +104,9 @@ static inline void sanity_check_seg_type(struct f2fs_sb_info *sbi, + #define CAP_BLKS_PER_SEC(sbi) \ + ((sbi)->segs_per_sec * (sbi)->blocks_per_seg - \ + (sbi)->unusable_blocks_per_sec) ++#define CAP_SEGS_PER_SEC(sbi) \ ++ ((sbi)->segs_per_sec - ((sbi)->unusable_blocks_per_sec >>\ ++ (sbi)->log_blocks_per_seg)) + #define GET_SEC_FROM_SEG(sbi, segno) \ + (((segno) == -1) ? -1: (segno) / (sbi)->segs_per_sec) + #define GET_SEG_FROM_SEC(sbi, secno) \ +-- +2.39.2 + diff --git a/queue-6.2/f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch b/queue-6.2/f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch new file mode 100644 index 00000000000..7f28fedc644 --- /dev/null +++ b/queue-6.2/f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch @@ -0,0 +1,99 @@ +From a75e077bee20523c3e6099f126e92941a9339cd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 01:22:18 +0800 +Subject: f2fs: compress: fix to call f2fs_wait_on_page_writeback() in + f2fs_write_raw_pages() + +From: Yangtao Li + +[ Upstream commit babedcbac164cec970872b8097401ca913a80e61 ] + +BUG_ON() will be triggered when writing files concurrently, +because the same page is writtenback multiple times. + +1597 void folio_end_writeback(struct folio *folio) +1598 { + ...... +1618 if (!__folio_end_writeback(folio)) +1619 BUG(); + ...... +1625 } + +kernel BUG at mm/filemap.c:1619! +Call Trace: + + f2fs_write_end_io+0x1a0/0x370 + blk_update_request+0x6c/0x410 + blk_mq_end_request+0x15/0x130 + blk_complete_reqs+0x3c/0x50 + __do_softirq+0xb8/0x29b + ? sort_range+0x20/0x20 + run_ksoftirqd+0x19/0x20 + smpboot_thread_fn+0x10b/0x1d0 + kthread+0xde/0x110 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x22/0x30 + + +Below is the concurrency scenario: + +[Process A] [Process B] [Process C] +f2fs_write_raw_pages() + - redirty_page_for_writepage() + - unlock page() + f2fs_do_write_data_page() + - lock_page() + - clear_page_dirty_for_io() + - set_page_writeback() [1st writeback] + ..... + - unlock page() + + generic_perform_write() + - f2fs_write_begin() + - wait_for_stable_page() + + - f2fs_write_end() + - set_page_dirty() + + - lock_page() + - f2fs_do_write_data_page() + - set_page_writeback() [2st writeback] + +This problem was introduced by the previous commit 7377e853967b ("f2fs: +compress: fix potential deadlock of compress file"). All pagelocks were +released in f2fs_write_raw_pages(), but whether the page was +in the writeback state was ignored in the subsequent writing process. +Let's fix it by waiting for the page to writeback before writing. + +Cc: Christoph Hellwig +Fixes: 4c8ff7095bef ("f2fs: support data compression") +Fixes: 7377e853967b ("f2fs: compress: fix potential deadlock of compress file") +Signed-off-by: Qi Han +Signed-off-by: Yangtao Li +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 2532f369cb10f..2628c347f44fd 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -1459,6 +1459,12 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc, + if (!PageDirty(cc->rpages[i])) + goto continue_unlock; + ++ if (PageWriteback(cc->rpages[i])) { ++ if (wbc->sync_mode == WB_SYNC_NONE) ++ goto continue_unlock; ++ f2fs_wait_on_page_writeback(cc->rpages[i], DATA, true, true); ++ } ++ + if (!clear_page_dirty_for_io(cc->rpages[i])) + goto continue_unlock; + +-- +2.39.2 + diff --git a/queue-6.2/f2fs-fix-iostat-lock-protection.patch b/queue-6.2/f2fs-fix-iostat-lock-protection.patch new file mode 100644 index 00000000000..45dc47e4a6e --- /dev/null +++ b/queue-6.2/f2fs-fix-iostat-lock-protection.patch @@ -0,0 +1,52 @@ +From 8d8b4fd1e3902a3d47ddac0067a4a7c83c80bc20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Mar 2023 17:26:56 +0800 +Subject: f2fs: fix iostat lock protection + +From: Qilin Tan + +[ Upstream commit 144f1cd40bf91fb3ac1d41806470756ce774f389 ] + +Made iostat lock irq safe to avoid potentinal deadlock. + +Deadlock scenario: +f2fs_attr_store + -> f2fs_sbi_store + -> _sbi_store + -> spin_lock(sbi->iostat_lock) + + -> scsi_end_request + -> bio_endio + -> f2fs_dio_read_end_io + -> f2fs_update_iostat + -> spin_lock_irqsave(sbi->iostat_lock) ===> Dead lock here + +Fixes: 61803e984307 ("f2fs: fix iostat related lock protection") +Fixes: a1e09b03e6f5 ("f2fs: use iomap for direct I/O") +Signed-off-by: Qilin Tan +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/sysfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c +index 088b816127ecb..2884efe5269ed 100644 +--- a/fs/f2fs/sysfs.c ++++ b/fs/f2fs/sysfs.c +@@ -564,9 +564,9 @@ static ssize_t __sbi_store(struct f2fs_attr *a, + if (!strcmp(a->attr.name, "iostat_period_ms")) { + if (t < MIN_IOSTAT_PERIOD_MS || t > MAX_IOSTAT_PERIOD_MS) + return -EINVAL; +- spin_lock(&sbi->iostat_lock); ++ spin_lock_irq(&sbi->iostat_lock); + sbi->iostat_period_ms = (unsigned int)t; +- spin_unlock(&sbi->iostat_lock); ++ spin_unlock_irq(&sbi->iostat_lock); + return count; + } + #endif +-- +2.39.2 + diff --git a/queue-6.2/f2fs-fix-scheduling-while-atomic-in-decompression-pa.patch b/queue-6.2/f2fs-fix-scheduling-while-atomic-in-decompression-pa.patch new file mode 100644 index 00000000000..c3e35d5851b --- /dev/null +++ b/queue-6.2/f2fs-fix-scheduling-while-atomic-in-decompression-pa.patch @@ -0,0 +1,110 @@ +From 55053c0308b588f66503c18e7980d3ac94bc9613 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 15:37:54 -0700 +Subject: f2fs: fix scheduling while atomic in decompression path + +From: Jaegeuk Kim + +[ Upstream commit 1aa161e43106d46ca8e9a86f4aa28d420258134b ] + +[ 16.945668][ C0] Call trace: +[ 16.945678][ C0] dump_backtrace+0x110/0x204 +[ 16.945706][ C0] dump_stack_lvl+0x84/0xbc +[ 16.945735][ C0] __schedule_bug+0xb8/0x1ac +[ 16.945756][ C0] __schedule+0x724/0xbdc +[ 16.945778][ C0] schedule+0x154/0x258 +[ 16.945793][ C0] bit_wait_io+0x48/0xa4 +[ 16.945808][ C0] out_of_line_wait_on_bit+0x114/0x198 +[ 16.945824][ C0] __sync_dirty_buffer+0x1f8/0x2e8 +[ 16.945853][ C0] __f2fs_commit_super+0x140/0x1f4 +[ 16.945881][ C0] f2fs_commit_super+0x110/0x28c +[ 16.945898][ C0] f2fs_handle_error+0x1f4/0x2f4 +[ 16.945917][ C0] f2fs_decompress_cluster+0xc4/0x450 +[ 16.945942][ C0] f2fs_end_read_compressed_page+0xc0/0xfc +[ 16.945959][ C0] f2fs_handle_step_decompress+0x118/0x1cc +[ 16.945978][ C0] f2fs_read_end_io+0x168/0x2b0 +[ 16.945993][ C0] bio_endio+0x25c/0x2c8 +[ 16.946015][ C0] dm_io_dec_pending+0x3e8/0x57c +[ 16.946052][ C0] clone_endio+0x134/0x254 +[ 16.946069][ C0] bio_endio+0x25c/0x2c8 +[ 16.946084][ C0] blk_update_request+0x1d4/0x478 +[ 16.946103][ C0] scsi_end_request+0x38/0x4cc +[ 16.946129][ C0] scsi_io_completion+0x94/0x184 +[ 16.946147][ C0] scsi_finish_command+0xe8/0x154 +[ 16.946164][ C0] scsi_complete+0x90/0x1d8 +[ 16.946181][ C0] blk_done_softirq+0xa4/0x11c +[ 16.946198][ C0] _stext+0x184/0x614 +[ 16.946214][ C0] __irq_exit_rcu+0x78/0x144 +[ 16.946234][ C0] handle_domain_irq+0xd4/0x154 +[ 16.946260][ C0] gic_handle_irq.33881+0x5c/0x27c +[ 16.946281][ C0] call_on_irq_stack+0x40/0x70 +[ 16.946298][ C0] do_interrupt_handler+0x48/0xa4 +[ 16.946313][ C0] el1_interrupt+0x38/0x68 +[ 16.946346][ C0] el1h_64_irq_handler+0x20/0x30 +[ 16.946362][ C0] el1h_64_irq+0x78/0x7c +[ 16.946377][ C0] finish_task_switch+0xc8/0x3d8 +[ 16.946394][ C0] __schedule+0x600/0xbdc +[ 16.946408][ C0] preempt_schedule_common+0x34/0x5c +[ 16.946423][ C0] preempt_schedule+0x44/0x48 +[ 16.946438][ C0] process_one_work+0x30c/0x550 +[ 16.946456][ C0] worker_thread+0x414/0x8bc +[ 16.946472][ C0] kthread+0x16c/0x1e0 +[ 16.946486][ C0] ret_from_fork+0x10/0x20 + +Fixes: bff139b49d9f ("f2fs: handle decompress only post processing in softirq") +Fixes: 95fa90c9e5a7 ("f2fs: support recording errors into superblock") +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 7 ++++++- + fs/f2fs/f2fs.h | 1 + + fs/f2fs/super.c | 2 +- + 3 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 2628c347f44fd..07c96fea76fe1 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -759,7 +759,12 @@ void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task) + + if (dic->clen > PAGE_SIZE * dic->nr_cpages - COMPRESS_HEADER_SIZE) { + ret = -EFSCORRUPTED; +- f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION); ++ ++ /* Avoid f2fs_commit_super in irq context */ ++ if (in_task) ++ f2fs_save_errors(sbi, ERROR_FAIL_DECOMPRESSION); ++ else ++ f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION); + goto out_release; + } + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index e8953c3dc81ab..42962ee0a1179 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -3576,6 +3576,7 @@ int f2fs_quota_sync(struct super_block *sb, int type); + loff_t max_file_blocks(struct inode *inode); + void f2fs_quota_off_umount(struct super_block *sb); + void f2fs_handle_stop(struct f2fs_sb_info *sbi, unsigned char reason); ++void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag); + void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error); + int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover); + int f2fs_sync_fs(struct super_block *sb, int sync); +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 551468dad3275..3711445a2489b 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -3895,7 +3895,7 @@ void f2fs_handle_stop(struct f2fs_sb_info *sbi, unsigned char reason) + f2fs_up_write(&sbi->sb_lock); + } + +-static void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag) ++void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag) + { + spin_lock(&sbi->error_lock); + if (!test_bit(flag, (unsigned long *)sbi->errors)) { +-- +2.39.2 + diff --git a/queue-6.2/f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch b/queue-6.2/f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch new file mode 100644 index 00000000000..cdb704ba675 --- /dev/null +++ b/queue-6.2/f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch @@ -0,0 +1,76 @@ +From 23dd47a86fda8b8d50f9fa704085e9f458954212 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 10:14:02 +0800 +Subject: f2fs: fix to avoid use-after-free for cached IPU bio + +From: Chao Yu + +[ Upstream commit 5cdb422c839134273866208dad5360835ddb9794 ] + +xfstest generic/019 reports a bug: + +kernel BUG at mm/filemap.c:1619! +RIP: 0010:folio_end_writeback+0x8a/0x90 +Call Trace: + end_page_writeback+0x1c/0x60 + f2fs_write_end_io+0x199/0x420 + bio_endio+0x104/0x180 + submit_bio_noacct+0xa5/0x510 + submit_bio+0x48/0x80 + f2fs_submit_write_bio+0x35/0x300 + f2fs_submit_merged_ipu_write+0x2a0/0x2b0 + f2fs_write_single_data_page+0x838/0x8b0 + f2fs_write_cache_pages+0x379/0xa30 + f2fs_write_data_pages+0x30c/0x340 + do_writepages+0xd8/0x1b0 + __writeback_single_inode+0x44/0x370 + writeback_sb_inodes+0x233/0x4d0 + __writeback_inodes_wb+0x56/0xf0 + wb_writeback+0x1dd/0x2d0 + wb_workfn+0x367/0x4a0 + process_one_work+0x21d/0x430 + worker_thread+0x4e/0x3c0 + kthread+0x103/0x130 + ret_from_fork+0x2c/0x50 + +The root cause is: after cp_error is set, f2fs_submit_merged_ipu_write() +in f2fs_write_single_data_page() tries to flush IPU bio in cache, however +f2fs_submit_merged_ipu_write() missed to check validity of @bio parameter, +result in submitting random cached bio which belong to other IO context, +then it will cause use-after-free issue, fix it by adding additional +validity check. + +Fixes: 0b20fcec8651 ("f2fs: cache global IPU bio") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index a28d05895f5c7..75e59e7016590 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -873,6 +873,8 @@ void f2fs_submit_merged_ipu_write(struct f2fs_sb_info *sbi, + bool found = false; + struct bio *target = bio ? *bio : NULL; + ++ f2fs_bug_on(sbi, !target && !page); ++ + for (temp = HOT; temp < NR_TEMP_TYPE && !found; temp++) { + struct f2fs_bio_info *io = sbi->write_io[DATA] + temp; + struct list_head *head = &io->bio_list; +@@ -2899,7 +2901,8 @@ int f2fs_write_single_data_page(struct page *page, int *submitted, + + if (unlikely(f2fs_cp_error(sbi))) { + f2fs_submit_merged_write(sbi, DATA); +- f2fs_submit_merged_ipu_write(sbi, bio, NULL); ++ if (bio && *bio) ++ f2fs_submit_merged_ipu_write(sbi, bio, NULL); + submitted = NULL; + } + +-- +2.39.2 + diff --git a/queue-6.2/f2fs-fix-to-check-return-value-of-f2fs_do_truncate_b.patch b/queue-6.2/f2fs-fix-to-check-return-value-of-f2fs_do_truncate_b.patch new file mode 100644 index 00000000000..a41165399cd --- /dev/null +++ b/queue-6.2/f2fs-fix-to-check-return-value-of-f2fs_do_truncate_b.patch @@ -0,0 +1,41 @@ +From 07dc016afb7459fb1ebd0b14a19c126a6bf2c8a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 22:44:53 +0800 +Subject: f2fs: fix to check return value of f2fs_do_truncate_blocks() + +From: Chao Yu + +[ Upstream commit b851ee6ba3cc212641e622ebcf92b950c7bafa07 ] + +Otherwise, if truncation on cow_inode failed, remained data may +pollute current transaction of atomic write. + +Cc: Daeho Jeong +Fixes: a46bebd502fe ("f2fs: synchronize atomic write aborts") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 23fb9861dba40..de92279a80020 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2117,7 +2117,11 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate) + clear_inode_flag(fi->cow_inode, FI_INLINE_DATA); + } else { + /* Reuse the already created COW inode */ +- f2fs_do_truncate_blocks(fi->cow_inode, 0, true); ++ ret = f2fs_do_truncate_blocks(fi->cow_inode, 0, true); ++ if (ret) { ++ f2fs_up_write(&fi->i_gc_rwsem[WRITE]); ++ goto out; ++ } + } + + f2fs_write_inode(inode, NULL); +-- +2.39.2 + diff --git a/queue-6.2/f2fs-fix-to-check-return-value-of-inc_valid_block_co.patch b/queue-6.2/f2fs-fix-to-check-return-value-of-inc_valid_block_co.patch new file mode 100644 index 00000000000..c46e7bbf6ee --- /dev/null +++ b/queue-6.2/f2fs-fix-to-check-return-value-of-inc_valid_block_co.patch @@ -0,0 +1,48 @@ +From d4afbac79f4dad4e884170a5a9060f013d8bf035 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 22:45:36 +0800 +Subject: f2fs: fix to check return value of inc_valid_block_count() + +From: Chao Yu + +[ Upstream commit 935fc6fa6466cf18dd72dd1518ebc7bfc4cd58a4 ] + +In __replace_atomic_write_block(), we missed to check return value +of inc_valid_block_count(), for extreme testcase that f2fs image is +run out of space, it may cause inconsistent status in between SIT +table and total valid block count. + +Cc: Daeho Jeong +Fixes: 3db1de0e582c ("f2fs: change the current atomic write way") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/segment.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 2822b04082eec..06991cf643296 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -246,10 +246,16 @@ static int __replace_atomic_write_block(struct inode *inode, pgoff_t index, + } else { + blkcnt_t count = 1; + ++ err = inc_valid_block_count(sbi, inode, &count); ++ if (err) { ++ f2fs_put_dnode(&dn); ++ return err; ++ } ++ + *old_addr = dn.data_blkaddr; + f2fs_truncate_data_blocks_range(&dn, 1); + dec_valid_block_count(sbi, F2FS_I(inode)->cow_inode, count); +- inc_valid_block_count(sbi, inode, &count); ++ + f2fs_replace_block(sbi, &dn, dn.data_blkaddr, new_addr, + ni.version, true, false); + } +-- +2.39.2 + diff --git a/queue-6.2/f2fs-fix-uninitialized-skipped_gc_rwsem.patch b/queue-6.2/f2fs-fix-uninitialized-skipped_gc_rwsem.patch new file mode 100644 index 00000000000..a0c02df64b4 --- /dev/null +++ b/queue-6.2/f2fs-fix-uninitialized-skipped_gc_rwsem.patch @@ -0,0 +1,40 @@ +From c24daa942d6aefd216b7e50d364b41ea2e573490 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 16:13:50 +0900 +Subject: f2fs: fix uninitialized skipped_gc_rwsem + +From: Yonggil Song + +[ Upstream commit c17caf0ba3aa3411b96c71b4ce24be1040b8f3e8 ] + +When f2fs skipped a gc round during victim migration, there was a bug which +would skip all upcoming gc rounds unconditionally because skipped_gc_rwsem +was not initialized. It fixes the bug by correctly initializing the +skipped_gc_rwsem inside the gc loop. + +Fixes: 6f8d4455060d ("f2fs: avoid fi->i_gc_rwsem[WRITE] lock in f2fs_gc") +Signed-off-by: Yonggil Song +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/gc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 6e2cae3d2e717..72cda2f9380f2 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -1795,8 +1795,8 @@ int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control) + prefree_segments(sbi)); + + cpc.reason = __get_cp_reason(sbi); +- sbi->skipped_gc_rwsem = 0; + gc_more: ++ sbi->skipped_gc_rwsem = 0; + if (unlikely(!(sbi->sb->s_flags & SB_ACTIVE))) { + ret = -EINVAL; + goto stop; +-- +2.39.2 + diff --git a/queue-6.2/f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch b/queue-6.2/f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch new file mode 100644 index 00000000000..048bfce36c3 --- /dev/null +++ b/queue-6.2/f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch @@ -0,0 +1,50 @@ +From 77a33e5748b47425a98517bf620848e5c2310cff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Feb 2023 22:45:50 +0800 +Subject: f2fs: handle dqget error in f2fs_transfer_project_quota() + +From: Yangtao Li + +[ Upstream commit 8051692f5f23260215bfe9a72e712d93606acc5f ] + +We should set the error code when dqget() failed. + +Fixes: 2c1d03056991 ("f2fs: support F2FS_IOC_FS{GET,SET}XATTR") +Signed-off-by: Yangtao Li +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 05297427552ac..23fb9861dba40 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -3013,15 +3013,16 @@ int f2fs_transfer_project_quota(struct inode *inode, kprojid_t kprojid) + struct dquot *transfer_to[MAXQUOTAS] = {}; + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct super_block *sb = sbi->sb; +- int err = 0; ++ int err; + + transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid)); +- if (!IS_ERR(transfer_to[PRJQUOTA])) { +- err = __dquot_transfer(inode, transfer_to); +- if (err) +- set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR); +- dqput(transfer_to[PRJQUOTA]); +- } ++ if (IS_ERR(transfer_to[PRJQUOTA])) ++ return PTR_ERR(transfer_to[PRJQUOTA]); ++ ++ err = __dquot_transfer(inode, transfer_to); ++ if (err) ++ set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR); ++ dqput(transfer_to[PRJQUOTA]); + return err; + } + +-- +2.39.2 + diff --git a/queue-6.2/fbdev-mmp-fix-deferred-clk-handling-in-mmphw_probe.patch b/queue-6.2/fbdev-mmp-fix-deferred-clk-handling-in-mmphw_probe.patch new file mode 100644 index 00000000000..49e8e5eec00 --- /dev/null +++ b/queue-6.2/fbdev-mmp-fix-deferred-clk-handling-in-mmphw_probe.patch @@ -0,0 +1,43 @@ +From 073ea445eb0fb923dc98a44a7456022a20668f90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 21:33:17 +0200 +Subject: fbdev: mmp: Fix deferred clk handling in mmphw_probe() + +From: Christophe JAILLET + +[ Upstream commit b3a7a9ab65ae2f2626c7222fb79cdd433f8c5252 ] + +When dev_err_probe() is called, 'ret' holds the value of the previous +successful devm_request_irq() call. +'ret' should be assigned with a meaningful value before being used in +dev_err_probe(). + +While at it, use and return "PTR_ERR(ctrl->clk)" instead of a hard-coded +"-ENOENT" so that -EPROBE_DEFER is handled and propagated correctly. + +Fixes: 81b63420564d ("fbdev: mmp: Make use of the helper function dev_err_probe()") +Signed-off-by: Christophe JAILLET +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c +index a9df8ee798102..51fbf02a03430 100644 +--- a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c ++++ b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c +@@ -514,9 +514,9 @@ static int mmphw_probe(struct platform_device *pdev) + /* get clock */ + ctrl->clk = devm_clk_get(ctrl->dev, mi->clk_name); + if (IS_ERR(ctrl->clk)) { ++ ret = PTR_ERR(ctrl->clk); + dev_err_probe(ctrl->dev, ret, + "unable to get clk %s\n", mi->clk_name); +- ret = -ENOENT; + goto failed; + } + clk_prepare_enable(ctrl->clk); +-- +2.39.2 + diff --git a/queue-6.2/firmware-arm_scmi-fix-xfers-allocation-on-rx-channel.patch b/queue-6.2/firmware-arm_scmi-fix-xfers-allocation-on-rx-channel.patch new file mode 100644 index 00000000000..b0ae538a11c --- /dev/null +++ b/queue-6.2/firmware-arm_scmi-fix-xfers-allocation-on-rx-channel.patch @@ -0,0 +1,48 @@ +From d03c8b0eb62539eb992a6c41682f05559505c5e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 21:34:49 +0100 +Subject: firmware: arm_scmi: Fix xfers allocation on Rx channel + +From: Cristian Marussi + +[ Upstream commit b2ccba9e8cdc6fb3985cc227844e7c6af309ffb1 ] + +Two distinct pools of xfer descriptors are allocated at initialization +time: one (Tx) used to provide xfers to track commands and their replies +(or delayed replies) and another (Rx) to pick xfers from to be used for +processing notifications. + +Such pools, though, are allocated globally to be used by the whole SCMI +instance, they are not allocated per-channel and as such the allocation of +notifications xfers cannot be simply skipped if no Rx channel was found for +the base protocol common channel, because there could be defined more +optional per-protocol dedicated channels that instead support Rx channels. + +Change the conditional check to skip allocation for the notification pool +only if no Rx channel has been detected on any per-channel protocol at all. + +Fixes: 4ebd8f6dea81 ("firmware: arm_scmi: Add receive buffer support for notifications") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20230326203449.3492948-1-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c +index ffdad59ec81fc..fe06dc1936896 100644 +--- a/drivers/firmware/arm_scmi/driver.c ++++ b/drivers/firmware/arm_scmi/driver.c +@@ -1981,7 +1981,7 @@ static int scmi_xfer_info_init(struct scmi_info *sinfo) + return ret; + + ret = __scmi_xfer_info_init(sinfo, &sinfo->tx_minfo); +- if (!ret && idr_find(&sinfo->rx_idr, SCMI_PROTOCOL_BASE)) ++ if (!ret && !idr_is_empty(&sinfo->rx_idr)) + ret = __scmi_xfer_info_init(sinfo, &sinfo->rx_minfo); + + return ret; +-- +2.39.2 + diff --git a/queue-6.2/firmware-qcom_scm-clear-download-bit-during-reboot.patch b/queue-6.2/firmware-qcom_scm-clear-download-bit-during-reboot.patch new file mode 100644 index 00000000000..a1cf566cab5 --- /dev/null +++ b/queue-6.2/firmware-qcom_scm-clear-download-bit-during-reboot.patch @@ -0,0 +1,39 @@ +From 34cbdb5fbc2ed4fcbbbe5987703b4272c4b2d233 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 20:44:26 +0530 +Subject: firmware: qcom_scm: Clear download bit during reboot + +From: Mukesh Ojha + +[ Upstream commit 781d32d1c9709fd25655c4e3e3e15370ae4ae4db ] + +During normal restart of a system download bit should +be cleared irrespective of whether download mode is +set or not. + +Fixes: 8c1b7dc9ba22 ("firmware: qcom: scm: Expose download-mode control") +Signed-off-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1678979666-551-1-git-send-email-quic_mojha@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom_scm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c +index cdbfe54c81467..51eb85354c058 100644 +--- a/drivers/firmware/qcom_scm.c ++++ b/drivers/firmware/qcom_scm.c +@@ -1418,8 +1418,7 @@ static int qcom_scm_probe(struct platform_device *pdev) + static void qcom_scm_shutdown(struct platform_device *pdev) + { + /* Clean shutdown, disable download mode to allow normal restart */ +- if (download_mode) +- qcom_scm_set_download_mode(false); ++ qcom_scm_set_download_mode(false); + } + + static const struct of_device_id qcom_scm_dt_match[] = { +-- +2.39.2 + diff --git a/queue-6.2/firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch b/queue-6.2/firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch new file mode 100644 index 00000000000..5ec60f8a245 --- /dev/null +++ b/queue-6.2/firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch @@ -0,0 +1,39 @@ +From bf5338d6381c6402f3359a1f9071b48bfecec58e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 17:27:03 +0300 +Subject: firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe + +From: Dan Carpenter + +[ Upstream commit e1d6ca042e62c2a69513235f8629eb6e62ca79c5 ] + +The svc_create_memory_pool() function returns error pointers. It never +returns NULL. Fix the check. + +Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/5f9a8cb4-5a4f-460b-9cdc-2fae6c5b7922@kili.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/firmware/stratix10-svc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c +index bde1f543f5298..80f4e2d14e046 100644 +--- a/drivers/firmware/stratix10-svc.c ++++ b/drivers/firmware/stratix10-svc.c +@@ -1133,8 +1133,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) + return ret; + + genpool = svc_create_memory_pool(pdev, sh_memory); +- if (!genpool) +- return -ENOMEM; ++ if (IS_ERR(genpool)) ++ return PTR_ERR(genpool); + + /* allocate service controller and supporting channel */ + controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL); +-- +2.39.2 + diff --git a/queue-6.2/fpga-bridge-fix-kernel-doc-parameter-description.patch b/queue-6.2/fpga-bridge-fix-kernel-doc-parameter-description.patch new file mode 100644 index 00000000000..96de213c5cd --- /dev/null +++ b/queue-6.2/fpga-bridge-fix-kernel-doc-parameter-description.patch @@ -0,0 +1,39 @@ +From 6293df28123dab9e528843b4d08a94642d59a9a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 15:03:08 +0100 +Subject: fpga: bridge: fix kernel-doc parameter description + +From: Marco Pagani + +[ Upstream commit 7ef1a2c1c9dffa177ecc3ea50b7f5ee63a621137 ] + +Fix the kernel-doc description for the "struct fpga_image_info *info" +parameter of the fpga_bridge_get() function. + +Fixes: 060ac5c8fa7b ("fpga: bridge: kernel-doc fixes") +Signed-off-by: Marco Pagani +Reviewed-by: Tom Rix +Acked-by: Xu Yilun +Link: https://lore.kernel.org/r/20230301140309.512578-1-marpagan@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/fpga/fpga-bridge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/fpga/fpga-bridge.c b/drivers/fpga/fpga-bridge.c +index 13918c8c839ea..833ce13ff6f86 100644 +--- a/drivers/fpga/fpga-bridge.c ++++ b/drivers/fpga/fpga-bridge.c +@@ -115,7 +115,7 @@ static int fpga_bridge_dev_match(struct device *dev, const void *data) + /** + * fpga_bridge_get - get an exclusive reference to an fpga bridge + * @dev: parent device that fpga bridge was registered with +- * @info: fpga manager info ++ * @info: fpga image specific information + * + * Given a device, get an exclusive reference to an fpga bridge. + * +-- +2.39.2 + diff --git a/queue-6.2/fs-ntfs3-add-check-for-kmemdup.patch b/queue-6.2/fs-ntfs3-add-check-for-kmemdup.patch new file mode 100644 index 00000000000..1b278e69ae2 --- /dev/null +++ b/queue-6.2/fs-ntfs3-add-check-for-kmemdup.patch @@ -0,0 +1,39 @@ +From 15bfb84d2eebb752bd0a4f1f6ec8919992defdfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 16:48:46 +0800 +Subject: fs/ntfs3: Add check for kmemdup + +From: Jiasheng Jiang + +[ Upstream commit e6c3cef24cb0d045f99d5cb039b344874e3cfd74 ] + +Since the kmemdup may return NULL pointer, +it should be better to add check for the return value +in order to avoid NULL pointer dereference. + +Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fslog.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c +index c6eb371a36951..dc723f03d6bb2 100644 +--- a/fs/ntfs3/fslog.c ++++ b/fs/ntfs3/fslog.c +@@ -4256,6 +4256,10 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + rec_len -= t32; + + attr_names = kmemdup(Add2Ptr(lrh, t32), rec_len, GFP_NOFS); ++ if (!attr_names) { ++ err = -ENOMEM; ++ goto out; ++ } + + lcb_put(lcb); + lcb = NULL; +-- +2.39.2 + diff --git a/queue-6.2/fs-ntfs3-fix-memory-leak-if-ntfs_read_mft-failed.patch b/queue-6.2/fs-ntfs3-fix-memory-leak-if-ntfs_read_mft-failed.patch new file mode 100644 index 00000000000..694e0351025 --- /dev/null +++ b/queue-6.2/fs-ntfs3-fix-memory-leak-if-ntfs_read_mft-failed.patch @@ -0,0 +1,71 @@ +From 1ae3bd4c0e820dade6826c789911d398496f6e0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 17:24:14 +0800 +Subject: fs/ntfs3: Fix memory leak if ntfs_read_mft failed + +From: Chen Zhongjin + +[ Upstream commit bfa434c60157c9793e9b12c9b68ade02aff9f803 ] + +Label ATTR_ROOT in ntfs_read_mft() sets is_root = true and +ni->ni_flags |= NI_FLAG_DIR, then next attr will goto label ATTR_ALLOC +and alloc ni->dir.alloc_run. However two states are not always +consistent and can make memory leak. + + 1) attr_name in ATTR_ROOT does not fit the condition it will set + is_root = true but NI_FLAG_DIR is not set. + 2) next attr_name in ATTR_ALLOC fits the condition and alloc + ni->dir.alloc_run + 3) in cleanup function ni_clear(), when NI_FLAG_DIR is set, it frees + ni->dir.alloc_run, otherwise it frees ni->file.run + 4) because NI_FLAG_DIR is not set in this case, ni->dir.alloc_run is + leaked as kmemleak reported: + +unreferenced object 0xffff888003bc5480 (size 64): + backtrace: + [<000000003d42e6b0>] __kmalloc_node+0x4e/0x1c0 + [<00000000d8e19b8a>] kvmalloc_node+0x39/0x1f0 + [<00000000fc3eb5b8>] run_add_entry+0x18a/0xa40 [ntfs3] + [<0000000011c9f978>] run_unpack+0x75d/0x8e0 [ntfs3] + [<00000000e7cf1819>] run_unpack_ex+0xbc/0x500 [ntfs3] + [<00000000bbf0a43d>] ntfs_iget5+0xb25/0x2dd0 [ntfs3] + [<00000000a6e50693>] ntfs_fill_super+0x218d/0x3580 [ntfs3] + [<00000000b9170608>] get_tree_bdev+0x3fb/0x710 + [<000000004833798a>] vfs_get_tree+0x8e/0x280 + [<000000006e20b8e6>] path_mount+0xf3c/0x1930 + [<000000007bf15a5f>] do_mount+0xf3/0x110 + ... + +Fix this by always setting is_root and NI_FLAG_DIR together. + +Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") +Signed-off-by: Chen Zhongjin +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index 20b953871574b..33494a67bf063 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -259,7 +259,6 @@ static struct inode *ntfs_read_mft(struct inode *inode, + goto out; + + root = Add2Ptr(attr, roff); +- is_root = true; + + if (attr->name_len != ARRAY_SIZE(I30_NAME) || + memcmp(attr_name(attr), I30_NAME, sizeof(I30_NAME))) +@@ -272,6 +271,7 @@ static struct inode *ntfs_read_mft(struct inode *inode, + if (!is_dir) + goto next_attr; + ++ is_root = true; + ni->ni_flags |= NI_FLAG_DIR; + + err = indx_init(&ni->dir, sbi, attr, INDEX_MUTEX_I30); +-- +2.39.2 + diff --git a/queue-6.2/fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lo.patch b/queue-6.2/fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lo.patch new file mode 100644 index 00000000000..98ea352b87d --- /dev/null +++ b/queue-6.2/fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lo.patch @@ -0,0 +1,80 @@ +From f09d735877b129e78bd67ad77fcb4a065491096f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 10:21:59 +0000 +Subject: fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup() + +From: ZhangPeng + +[ Upstream commit 254e69f284d7270e0abdc023ee53b71401c3ba0c ] + +Syzbot reported a null-ptr-deref bug: + +ntfs3: loop0: Different NTFS' sector size (1024) and media sector size +(512) +ntfs3: loop0: Mark volume as dirty due to NTFS errors +general protection fault, probably for non-canonical address +0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] +RIP: 0010:d_flags_for_inode fs/dcache.c:1980 [inline] +RIP: 0010:__d_add+0x5ce/0x800 fs/dcache.c:2796 +Call Trace: + + d_splice_alias+0x122/0x3b0 fs/dcache.c:3191 + lookup_open fs/namei.c:3391 [inline] + open_last_lookups fs/namei.c:3481 [inline] + path_openat+0x10e6/0x2df0 fs/namei.c:3688 + do_filp_open+0x264/0x4f0 fs/namei.c:3718 + do_sys_openat2+0x124/0x4e0 fs/open.c:1310 + do_sys_open fs/open.c:1326 [inline] + __do_sys_open fs/open.c:1334 [inline] + __se_sys_open fs/open.c:1330 [inline] + __x64_sys_open+0x221/0x270 fs/open.c:1330 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +If the MFT record of ntfs inode is not a base record, inode->i_op can be +NULL. And a null-ptr-deref may happen: + +ntfs_lookup() + dir_search_u() # inode->i_op is set to NULL + d_splice_alias() + __d_add() + d_flags_for_inode() # inode->i_op->get_link null-ptr-deref + +Fix this by adding a Check on inode->i_op before calling the +d_splice_alias() function. + +Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") +Reported-by: syzbot+a8f26a403c169b7593fe@syzkaller.appspotmail.com +Signed-off-by: ZhangPeng +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/namei.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c +index c8db35e2ae172..3db34d5c03dc7 100644 +--- a/fs/ntfs3/namei.c ++++ b/fs/ntfs3/namei.c +@@ -88,6 +88,16 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry, + __putname(uni); + } + ++ /* ++ * Check for a null pointer ++ * If the MFT record of ntfs inode is not a base record, inode->i_op can be NULL. ++ * This causes null pointer dereference in d_splice_alias(). ++ */ ++ if (!IS_ERR(inode) && inode->i_op == NULL) { ++ iput(inode); ++ inode = ERR_PTR(-EINVAL); ++ } ++ + return d_splice_alias(inode, dentry); + } + +-- +2.39.2 + diff --git a/queue-6.2/fs-ntfs3-fix-oob-read-in-indx_insert_into_buffer.patch b/queue-6.2/fs-ntfs3-fix-oob-read-in-indx_insert_into_buffer.patch new file mode 100644 index 00000000000..4ec397ac7e7 --- /dev/null +++ b/queue-6.2/fs-ntfs3-fix-oob-read-in-indx_insert_into_buffer.patch @@ -0,0 +1,60 @@ +From 9ed23e873943baad359c23aa656b66b14e24c721 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 09:46:10 +0000 +Subject: fs/ntfs3: Fix OOB read in indx_insert_into_buffer + +From: ZhangPeng + +[ Upstream commit b8c44949044e5f7f864525fdffe8e95135ce9ce5 ] + +Syzbot reported a OOB read bug: + +BUG: KASAN: slab-out-of-bounds in indx_insert_into_buffer+0xaa3/0x13b0 +fs/ntfs3/index.c:1755 +Read of size 17168 at addr ffff8880255e06c0 by task syz-executor308/3630 + +Call Trace: + + memmove+0x25/0x60 mm/kasan/shadow.c:54 + indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755 + indx_insert_entry+0x446/0x6b0 fs/ntfs3/index.c:1863 + ntfs_create_inode+0x1d3f/0x35c0 fs/ntfs3/inode.c:1548 + ntfs_create+0x3e/0x60 fs/ntfs3/namei.c:100 + lookup_open fs/namei.c:3413 [inline] + +If the member struct INDEX_BUFFER *index of struct indx_node is +incorrect, that is, the value of __le32 used is greater than the value +of __le32 total in struct INDEX_HDR. Therefore, OOB read occurs when +memmove is called in indx_insert_into_buffer(). +Fix this by adding a check in hdr_find_e(). + +Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") +Reported-by: syzbot+d882d57193079e379309@syzkaller.appspotmail.com +Signed-off-by: ZhangPeng +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 51ab759546403..ae9616becec15 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -725,9 +725,13 @@ static struct NTFS_DE *hdr_find_e(const struct ntfs_index *indx, + u32 e_size, e_key_len; + u32 end = le32_to_cpu(hdr->used); + u32 off = le32_to_cpu(hdr->de_off); ++ u32 total = le32_to_cpu(hdr->total); + u16 offs[128]; + + fill_table: ++ if (end > total) ++ return NULL; ++ + if (off + sizeof(struct NTFS_DE) > end) + return NULL; + +-- +2.39.2 + diff --git a/queue-6.2/fs-ntfs3-fix-slab-out-of-bounds-read-in-hdr_delete_d.patch b/queue-6.2/fs-ntfs3-fix-slab-out-of-bounds-read-in-hdr_delete_d.patch new file mode 100644 index 00000000000..008db752c68 --- /dev/null +++ b/queue-6.2/fs-ntfs3-fix-slab-out-of-bounds-read-in-hdr_delete_d.patch @@ -0,0 +1,81 @@ +From cf6d6a7b1a303160260f260ed4fbc9d45fa8d715 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 09:31:34 +0800 +Subject: fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de() + +From: Zeng Heng + +[ Upstream commit ab84eee4c7ab929996602eda7832854c35a6dda2 ] + +Here is a BUG report from syzbot: + +BUG: KASAN: slab-out-of-bounds in hdr_delete_de+0xe0/0x150 fs/ntfs3/index.c:806 +Read of size 16842960 at addr ffff888079cc0600 by task syz-executor934/3631 + +Call Trace: + memmove+0x25/0x60 mm/kasan/shadow.c:54 + hdr_delete_de+0xe0/0x150 fs/ntfs3/index.c:806 + indx_delete_entry+0x74f/0x3670 fs/ntfs3/index.c:2193 + ni_remove_name+0x27a/0x980 fs/ntfs3/frecord.c:2910 + ntfs_unlink_inode+0x3d4/0x720 fs/ntfs3/inode.c:1712 + ntfs_rename+0x41a/0xcb0 fs/ntfs3/namei.c:276 + +Before using the meta-data in struct INDEX_HDR, we need to +check index header valid or not. Otherwise, the corruptedi +(or malicious) fs image can cause out-of-bounds access which +could make kernel panic. + +Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") +Reported-by: syzbot+9c2811fd56591639ff5f@syzkaller.appspotmail.com +Signed-off-by: Zeng Heng +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fslog.c | 2 +- + fs/ntfs3/index.c | 4 ++++ + fs/ntfs3/ntfs_fs.h | 1 + + 3 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c +index dc723f03d6bb2..bf73964472845 100644 +--- a/fs/ntfs3/fslog.c ++++ b/fs/ntfs3/fslog.c +@@ -2575,7 +2575,7 @@ static int read_next_log_rec(struct ntfs_log *log, struct lcb *lcb, u64 *lsn) + return find_log_rec(log, *lsn, lcb); + } + +-static inline bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes) ++bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes) + { + __le16 mask; + u32 min_de, de_off, used, total; +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index ae9616becec15..7a1e01a2ed9ae 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -848,6 +848,10 @@ static inline struct NTFS_DE *hdr_delete_de(struct INDEX_HDR *hdr, + u32 off = PtrOffset(hdr, re); + int bytes = used - (off + esize); + ++ /* check INDEX_HDR valid before using INDEX_HDR */ ++ if (!check_index_header(hdr, le32_to_cpu(hdr->total))) ++ return NULL; ++ + if (off >= used || esize < sizeof(struct NTFS_DE) || + bytes < sizeof(struct NTFS_DE)) + return NULL; +diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h +index 0e051c5595a21..2050eb3f6a5a6 100644 +--- a/fs/ntfs3/ntfs_fs.h ++++ b/fs/ntfs3/ntfs_fs.h +@@ -579,6 +579,7 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni, + bool ni_is_dirty(struct inode *inode); + + /* Globals from fslog.c */ ++bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes); + int log_replay(struct ntfs_inode *ni, bool *initialized); + + /* Globals from fsntfs.c */ +-- +2.39.2 + diff --git a/queue-6.2/gpu-host1x-fix-memory-leak-of-device-names.patch b/queue-6.2/gpu-host1x-fix-memory-leak-of-device-names.patch new file mode 100644 index 00000000000..218602981c2 --- /dev/null +++ b/queue-6.2/gpu-host1x-fix-memory-leak-of-device-names.patch @@ -0,0 +1,113 @@ +From bd4b02c3dfa0d4752de1305babb94860189ec84f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Nov 2022 15:33:15 +0800 +Subject: gpu: host1x: Fix memory leak of device names + +From: Yang Yingliang + +[ Upstream commit 55879dad0f3ae8468444b42f785ad79eac05fe5b ] + +The device names allocated by dev_set_name() need be freed +before module unloading, but they can not be freed because +the kobject's refcount which was set in device_initialize() +has not be decreased to 0. + +As comment of device_add() says, if it fails, use only +put_device() drop the refcount, then the name will be +freed in kobejct_cleanup(). + +device_del() and put_device() can be replaced with +device_unregister(), so call it to unregister the added +successfully devices, and just call put_device() to the +not added device. + +Add a release() function to device to avoid null release() +function WARNING in device_release(), it's empty, because +the context devices are freed together in +host1x_memory_context_list_free(). + +Fixes: 8aa5bcb61612 ("gpu: host1x: Add context device management code") +Signed-off-by: Yang Yingliang +Reviewed-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/host1x/context.c | 23 +++++++++++++++-------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/host1x/context.c b/drivers/gpu/host1x/context.c +index 3be0d6d02f1a4..84b23d36bcef4 100644 +--- a/drivers/gpu/host1x/context.c ++++ b/drivers/gpu/host1x/context.c +@@ -13,6 +13,11 @@ + #include "context.h" + #include "dev.h" + ++static void host1x_memory_context_release(struct device *dev) ++{ ++ /* context device is freed in host1x_memory_context_list_free() */ ++} ++ + int host1x_memory_context_list_init(struct host1x *host1x) + { + struct host1x_memory_context_list *cdl = &host1x->context_list; +@@ -53,28 +58,30 @@ int host1x_memory_context_list_init(struct host1x *host1x) + dev_set_name(&ctx->dev, "host1x-ctx.%d", i); + ctx->dev.bus = &host1x_context_device_bus_type; + ctx->dev.parent = host1x->dev; ++ ctx->dev.release = host1x_memory_context_release; + + dma_set_max_seg_size(&ctx->dev, UINT_MAX); + + err = device_add(&ctx->dev); + if (err) { + dev_err(host1x->dev, "could not add context device %d: %d\n", i, err); +- goto del_devices; ++ put_device(&ctx->dev); ++ goto unreg_devices; + } + + err = of_dma_configure_id(&ctx->dev, node, true, &i); + if (err) { + dev_err(host1x->dev, "IOMMU configuration failed for context device %d: %d\n", + i, err); +- device_del(&ctx->dev); +- goto del_devices; ++ device_unregister(&ctx->dev); ++ goto unreg_devices; + } + + fwspec = dev_iommu_fwspec_get(&ctx->dev); + if (!fwspec || !device_iommu_mapped(&ctx->dev)) { + dev_err(host1x->dev, "Context device %d has no IOMMU!\n", i); +- device_del(&ctx->dev); +- goto del_devices; ++ device_unregister(&ctx->dev); ++ goto unreg_devices; + } + + ctx->stream_id = fwspec->ids[0] & 0xffff; +@@ -82,9 +89,9 @@ int host1x_memory_context_list_init(struct host1x *host1x) + + return 0; + +-del_devices: ++unreg_devices: + while (i--) +- device_del(&cdl->devs[i].dev); ++ device_unregister(&cdl->devs[i].dev); + + kfree(cdl->devs); + cdl->devs = NULL; +@@ -98,7 +105,7 @@ void host1x_memory_context_list_free(struct host1x_memory_context_list *cdl) + unsigned int i; + + for (i = 0; i < cdl->len; i++) +- device_del(&cdl->devs[i].dev); ++ device_unregister(&cdl->devs[i].dev); + + kfree(cdl->devs); + cdl->len = 0; +-- +2.39.2 + diff --git a/queue-6.2/gpu-host1x-fix-potential-double-free-if-iommu-is-dis.patch b/queue-6.2/gpu-host1x-fix-potential-double-free-if-iommu-is-dis.patch new file mode 100644 index 00000000000..1649a2f8e54 --- /dev/null +++ b/queue-6.2/gpu-host1x-fix-potential-double-free-if-iommu-is-dis.patch @@ -0,0 +1,40 @@ +From 622cae63ef0a44e129f8c460be47da8085bd2daf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Nov 2022 15:33:14 +0800 +Subject: gpu: host1x: Fix potential double free if IOMMU is disabled + +From: Yang Yingliang + +[ Upstream commit 8466ff24a37a9a18fb935e90dda64f049131ae28 ] + +If context device has no IOMMU, the 'cdl->devs' is freed in +error path, but host1x_memory_context_list_init() doesn't +return an error code, so the module can be loaded successfully, +when it's unloading, the host1x_memory_context_list_free() is +called in host1x_remove(), it will cause double free. Set the +'cdl->devs' to NULL after freeing it to avoid double free. + +Fixes: 8aa5bcb61612 ("gpu: host1x: Add context device management code") +Signed-off-by: Yang Yingliang +Reviewed-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/host1x/context.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/host1x/context.c b/drivers/gpu/host1x/context.c +index c8e7994c2c9cd..3be0d6d02f1a4 100644 +--- a/drivers/gpu/host1x/context.c ++++ b/drivers/gpu/host1x/context.c +@@ -87,6 +87,7 @@ int host1x_memory_context_list_init(struct host1x *host1x) + device_del(&cdl->devs[i].dev); + + kfree(cdl->devs); ++ cdl->devs = NULL; + cdl->len = 0; + + return err; +-- +2.39.2 + diff --git a/queue-6.2/hid-amd_sfh-add-support-for-shutdown-operation.patch b/queue-6.2/hid-amd_sfh-add-support-for-shutdown-operation.patch new file mode 100644 index 00000000000..d5b48ad1cdb --- /dev/null +++ b/queue-6.2/hid-amd_sfh-add-support-for-shutdown-operation.patch @@ -0,0 +1,51 @@ +From b06b0a72b641caa4195ad28fc6acd013c3e6e307 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 21:40:27 +0530 +Subject: HID: amd_sfh: Add support for shutdown operation + +From: Basavaraj Natikar + +[ Upstream commit 1353ecaf1830d6d1b74f3225378a9498b4e14fdd ] + +As soon as the system is booted after shutdown, the sensors may remain in +a weird state and fail to initialize. Therefore, all sensors should be +turned off during shutdown. + +Fixes: 4f567b9f8141 ("SFH: PCIe driver to add support of AMD sensor fusion hub") +Signed-off-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c +index 47774b9ab3de0..c936d6a51c0cd 100644 +--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c ++++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c +@@ -367,6 +367,14 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i + return devm_add_action_or_reset(&pdev->dev, privdata->mp2_ops->remove, privdata); + } + ++static void amd_sfh_shutdown(struct pci_dev *pdev) ++{ ++ struct amd_mp2_dev *mp2 = pci_get_drvdata(pdev); ++ ++ if (mp2 && mp2->mp2_ops) ++ mp2->mp2_ops->stop_all(mp2); ++} ++ + static int __maybe_unused amd_mp2_pci_resume(struct device *dev) + { + struct amd_mp2_dev *mp2 = dev_get_drvdata(dev); +@@ -401,6 +409,7 @@ static struct pci_driver amd_mp2_pci_driver = { + .id_table = amd_mp2_pci_tbl, + .probe = amd_mp2_pci_probe, + .driver.pm = &amd_mp2_pm_ops, ++ .shutdown = amd_sfh_shutdown, + }; + module_pci_driver(amd_mp2_pci_driver); + +-- +2.39.2 + diff --git a/queue-6.2/hid-amd_sfh-correct-the-sensor-enable-and-disable-co.patch b/queue-6.2/hid-amd_sfh-correct-the-sensor-enable-and-disable-co.patch new file mode 100644 index 00000000000..0c15cf0162c --- /dev/null +++ b/queue-6.2/hid-amd_sfh-correct-the-sensor-enable-and-disable-co.patch @@ -0,0 +1,44 @@ +From da7dedf18a1d6b3fadfaf67be357dc2884515401 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 21:40:25 +0530 +Subject: HID: amd_sfh: Correct the sensor enable and disable command + +From: Basavaraj Natikar + +[ Upstream commit 0b9255bf11baa61cd526e6bd24d6c8e6d1eabf8d ] + +In order to start or stop sensors, the firmware command needs to be +changed to add an additional default subcommand value. For this reason, +add a subcommand value to enable or disable sensors accordingly. + +Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality") +Signed-off-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c +index c6df959ec7252..6e19ccc124508 100644 +--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c ++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c +@@ -33,6 +33,7 @@ static void amd_start_sensor(struct amd_mp2_dev *privdata, struct amd_mp2_sensor + cmd_base.ul = 0; + cmd_base.cmd.cmd_id = ENABLE_SENSOR; + cmd_base.cmd.intr_disable = 0; ++ cmd_base.cmd.sub_cmd_value = 1; + cmd_base.cmd.sensor_id = info.sensor_idx; + + writel(cmd_base.ul, privdata->mmio + AMD_C2P_MSG(0)); +@@ -45,6 +46,7 @@ static void amd_stop_sensor(struct amd_mp2_dev *privdata, u16 sensor_idx) + cmd_base.ul = 0; + cmd_base.cmd.cmd_id = DISABLE_SENSOR; + cmd_base.cmd.intr_disable = 0; ++ cmd_base.cmd.sub_cmd_value = 1; + cmd_base.cmd.sensor_id = sensor_idx; + + writeq(0x0, privdata->mmio + AMD_C2P_MSG(1)); +-- +2.39.2 + diff --git a/queue-6.2/hid-amd_sfh-correct-the-stop-all-command.patch b/queue-6.2/hid-amd_sfh-correct-the-stop-all-command.patch new file mode 100644 index 00000000000..e78affd54d5 --- /dev/null +++ b/queue-6.2/hid-amd_sfh-correct-the-stop-all-command.patch @@ -0,0 +1,40 @@ +From 0923c0a76209d66e7ccc6a512f6ee3a930b3a088 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 21:40:28 +0530 +Subject: HID: amd_sfh: Correct the stop all command + +From: Basavaraj Natikar + +[ Upstream commit 82c2a0d137794f5ef47982231593a00aee26ce3b ] + +Misinterpreted the stop all command in SHF1.1 firmware. Therefore, it is +necessary to update the stop all command accordingly to disable all +sensors. + +Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality") +Signed-off-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c +index 6e19ccc124508..6f6047f7f12e9 100644 +--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c ++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c +@@ -58,8 +58,10 @@ static void amd_stop_all_sensor(struct amd_mp2_dev *privdata) + struct sfh_cmd_base cmd_base; + + cmd_base.ul = 0; +- cmd_base.cmd.cmd_id = STOP_ALL_SENSORS; ++ cmd_base.cmd.cmd_id = DISABLE_SENSOR; + cmd_base.cmd.intr_disable = 0; ++ /* 0xf indicates all sensors */ ++ cmd_base.cmd.sensor_id = 0xf; + + writel(cmd_base.ul, privdata->mmio + AMD_C2P_MSG(0)); + } +-- +2.39.2 + diff --git a/queue-6.2/hid-amd_sfh-correct-the-structure-fields.patch b/queue-6.2/hid-amd_sfh-correct-the-structure-fields.patch new file mode 100644 index 00000000000..7154aa66f95 --- /dev/null +++ b/queue-6.2/hid-amd_sfh-correct-the-structure-fields.patch @@ -0,0 +1,40 @@ +From 641674c4c0fe8a32aa2454e7e734caf16bf55928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 21:40:24 +0530 +Subject: HID: amd_sfh: Correct the structure fields + +From: Basavaraj Natikar + +[ Upstream commit 7e7fdab79899f62de39c9280fb78f3d3b02ac207 ] + +Misinterpreted sfh_cmd_base structure member fields. Therefore, adjust +the structure member fields accordingly to reflect functionality. + +Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality") +Signed-off-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h +index ae47a369dc05a..a3e0ec289e3f9 100644 +--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h ++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h +@@ -33,9 +33,9 @@ struct sfh_cmd_base { + struct { + u32 sensor_id : 4; + u32 cmd_id : 4; +- u32 sub_cmd_id : 6; +- u32 length : 12; +- u32 rsvd : 5; ++ u32 sub_cmd_id : 8; ++ u32 sub_cmd_value : 12; ++ u32 rsvd : 3; + u32 intr_disable : 1; + } cmd; + }; +-- +2.39.2 + diff --git a/queue-6.2/hid-amd_sfh-fix-illuminance-value.patch b/queue-6.2/hid-amd_sfh-fix-illuminance-value.patch new file mode 100644 index 00000000000..238f4aa67e0 --- /dev/null +++ b/queue-6.2/hid-amd_sfh-fix-illuminance-value.patch @@ -0,0 +1,51 @@ +From b19e2693b33a76680bcf2e6851cf67f578c2aaa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 21:40:26 +0530 +Subject: HID: amd_sfh: Fix illuminance value + +From: Basavaraj Natikar + +[ Upstream commit a33e5e393171ae8384d3381db5cd159ba877cfcb ] + +Illuminance value is actually 32 bits, but is incorrectly trancated to +16 bits. Hence convert to integer illuminace accordingly to reflect +correct values. + +Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality") +Signed-off-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c | 2 +- + drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c +index 0609fea581c96..6f0d332ccf51c 100644 +--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c ++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c +@@ -218,7 +218,7 @@ static u8 get_input_rep(u8 current_index, int sensor_idx, int report_id, + OFFSET_SENSOR_DATA_DEFAULT; + memcpy_fromio(&als_data, sensoraddr, sizeof(struct sfh_als_data)); + get_common_inputs(&als_input.common_property, report_id); +- als_input.illuminance_value = als_data.lux; ++ als_input.illuminance_value = float_to_int(als_data.lux); + report_size = sizeof(als_input); + memcpy(input_report, &als_input, sizeof(als_input)); + break; +diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h +index a3e0ec289e3f9..9d31d5b510eb4 100644 +--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h ++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h +@@ -133,7 +133,7 @@ struct sfh_mag_data { + + struct sfh_als_data { + struct sfh_common_data commondata; +- u16 lux; ++ u32 lux; + }; + + struct hpd_status { +-- +2.39.2 + diff --git a/queue-6.2/hid-amd_sfh-handle-no-sensors-enabled-for-sfh1.1.patch b/queue-6.2/hid-amd_sfh-handle-no-sensors-enabled-for-sfh1.1.patch new file mode 100644 index 00000000000..060d6625f3b --- /dev/null +++ b/queue-6.2/hid-amd_sfh-handle-no-sensors-enabled-for-sfh1.1.patch @@ -0,0 +1,70 @@ +From 095ceed9eaf14865d0e42e5c364a945f9b5ca085 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 21:40:30 +0530 +Subject: HID: amd_sfh: Handle "no sensors" enabled for SFH1.1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Basavaraj Natikar + +[ Upstream commit 8455cbb25927013b3417ab619dced1c0e87708af ] + +Based on num_hid_devices, each sensor device is initialized. If +"no sensors" is initialized, amd_sfh work initialization and scheduling +doesn’t make sense and returns EOPNOTSUPP to stop driver probe. Hence, +add a check for "no sensors" enabled to handle the special case. + +Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality") +Signed-off-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c +index a1d6e08fab7d4..bb8bd7892b674 100644 +--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c ++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c +@@ -112,6 +112,7 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata) + cl_data->num_hid_devices = amd_sfh_get_sensor_num(privdata, &cl_data->sensor_idx[0]); + if (cl_data->num_hid_devices == 0) + return -ENODEV; ++ cl_data->is_any_sensor_enabled = false; + + INIT_DELAYED_WORK(&cl_data->work, amd_sfh_work); + INIT_DELAYED_WORK(&cl_data->work_buffer, amd_sfh_work_buffer); +@@ -170,6 +171,7 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata) + status = (status == 0) ? SENSOR_ENABLED : SENSOR_DISABLED; + + if (status == SENSOR_ENABLED) { ++ cl_data->is_any_sensor_enabled = true; + cl_data->sensor_sts[i] = SENSOR_ENABLED; + rc = amdtp_hid_probe(i, cl_data); + if (rc) { +@@ -186,12 +188,21 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata) + cl_data->sensor_sts[i]); + goto cleanup; + } ++ } else { ++ cl_data->sensor_sts[i] = SENSOR_DISABLED; + } + dev_dbg(dev, "sid 0x%x (%s) status 0x%x\n", + cl_data->sensor_idx[i], get_sensor_name(cl_data->sensor_idx[i]), + cl_data->sensor_sts[i]); + } + ++ if (!cl_data->is_any_sensor_enabled) { ++ dev_warn(dev, "Failed to discover, sensors not enabled is %d\n", ++ cl_data->is_any_sensor_enabled); ++ rc = -EOPNOTSUPP; ++ goto cleanup; ++ } ++ + schedule_delayed_work(&cl_data->work_buffer, msecs_to_jiffies(AMD_SFH_IDLE_LOOP)); + return 0; + +-- +2.39.2 + diff --git a/queue-6.2/hid-amd_sfh-increase-sensor-command-timeout-for-sfh1.patch b/queue-6.2/hid-amd_sfh-increase-sensor-command-timeout-for-sfh1.patch new file mode 100644 index 00000000000..46de2c943d9 --- /dev/null +++ b/queue-6.2/hid-amd_sfh-increase-sensor-command-timeout-for-sfh1.patch @@ -0,0 +1,42 @@ +From a068ad0dfa00ee4e8bbe51836fef4767d99be971 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 21:40:29 +0530 +Subject: HID: amd_sfh: Increase sensor command timeout for SFH1.1 + +From: Basavaraj Natikar + +[ Upstream commit 571dc8f59dd477037bb5a029e8d1b5a4a4d9dd63 ] + +The initialization of SFH1.1 sensors may take some time. Hence, increase +sensor command timeouts in order to obtain status responses within a +maximum timeout. + +Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality") +Signed-off-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c +index 6f6047f7f12e9..4f81ef2d4f56e 100644 +--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c ++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c +@@ -16,11 +16,11 @@ static int amd_sfh_wait_response(struct amd_mp2_dev *mp2, u8 sid, u32 cmd_id) + { + struct sfh_cmd_response cmd_resp; + +- /* Get response with status within a max of 1600 ms timeout */ ++ /* Get response with status within a max of 10000 ms timeout */ + if (!readl_poll_timeout(mp2->mmio + AMD_P2C_MSG(0), cmd_resp.resp, + (cmd_resp.response.response == 0 && + cmd_resp.response.cmd_id == cmd_id && (sid == 0xff || +- cmd_resp.response.sensor_id == sid)), 500, 1600000)) ++ cmd_resp.response.sensor_id == sid)), 500, 10000000)) + return cmd_resp.response.response; + + return -1; +-- +2.39.2 + diff --git a/queue-6.2/hte-tegra-194-fix-off-by-one-in-tegra_hte_map_to_lin.patch b/queue-6.2/hte-tegra-194-fix-off-by-one-in-tegra_hte_map_to_lin.patch new file mode 100644 index 00000000000..f5f1359e875 --- /dev/null +++ b/queue-6.2/hte-tegra-194-fix-off-by-one-in-tegra_hte_map_to_lin.patch @@ -0,0 +1,38 @@ +From a1d66c5ea7eb20670c50dc36244f206e78d80056 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 17:30:00 +0300 +Subject: hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id() + +From: Dan Carpenter + +[ Upstream commit e078180d66848a6a890daf0a3ce28dc43cc66790 ] + +The "map_sz" is the number of elements in the "m" array so the > +comparison needs to be changed to >= to prevent an out of bounds +read. + +Fixes: 09574cca6ad6 ("hte: Add Tegra194 HTE kernel provider") +Signed-off-by: Dan Carpenter +Acked-by: Dipen Patel +Signed-off-by: Dipen Patel +Signed-off-by: Sasha Levin +--- + drivers/hte/hte-tegra194.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hte/hte-tegra194.c b/drivers/hte/hte-tegra194.c +index 49a27af22742b..d1b579c822797 100644 +--- a/drivers/hte/hte-tegra194.c ++++ b/drivers/hte/hte-tegra194.c +@@ -251,7 +251,7 @@ static int tegra_hte_map_to_line_id(u32 eid, + { + + if (m) { +- if (eid > map_sz) ++ if (eid >= map_sz) + return -EINVAL; + if (m[eid].slice == NV_AON_SLICE_INVALID) + return -EINVAL; +-- +2.39.2 + diff --git a/queue-6.2/hte-tegra-fix-struct-of_device_id-build-error.patch b/queue-6.2/hte-tegra-fix-struct-of_device_id-build-error.patch new file mode 100644 index 00000000000..64466d8454d --- /dev/null +++ b/queue-6.2/hte-tegra-fix-struct-of_device_id-build-error.patch @@ -0,0 +1,39 @@ +From 49168c8731de937c9006053dcd118cd651c90cfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 17:46:19 +0100 +Subject: hte: tegra: fix 'struct of_device_id' build error + +From: Arnd Bergmann + +[ Upstream commit 6680c835ada1b34e882d0a32612f7294c62e27e0 ] + +Without the extra #include, this driver produces a build failure +in some configurations. + +drivers/hte/hte-tegra194-test.c:96:34: error: array type has incomplete element type 'struct of_device_id' + 96 | static const struct of_device_id tegra_hte_test_of_match[] = { + +Fixes: 9a75a7cd03c9 ("hte: Add Tegra HTE test driver") +Signed-off-by: Arnd Bergmann +Acked-by: Dipen Patel +Signed-off-by: Dipen Patel +Signed-off-by: Sasha Levin +--- + drivers/hte/hte-tegra194-test.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hte/hte-tegra194-test.c b/drivers/hte/hte-tegra194-test.c +index 5d776a185bd62..ce8c44e792213 100644 +--- a/drivers/hte/hte-tegra194-test.c ++++ b/drivers/hte/hte-tegra194-test.c +@@ -6,6 +6,7 @@ + */ + + #include ++#include + #include + #include + #include +-- +2.39.2 + diff --git a/queue-6.2/hwmon-pmbus-fsp-3y-fix-functionality-bitmask-in-fsp-.patch b/queue-6.2/hwmon-pmbus-fsp-3y-fix-functionality-bitmask-in-fsp-.patch new file mode 100644 index 00000000000..cf4b0ad6b52 --- /dev/null +++ b/queue-6.2/hwmon-pmbus-fsp-3y-fix-functionality-bitmask-in-fsp-.patch @@ -0,0 +1,49 @@ +From fbb9d0b482c1bd8daa2f6abfe854c899296f7af6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 19:19:39 +0200 +Subject: hwmon: (pmbus/fsp-3y) Fix functionality bitmask in FSP-3Y YM-2151E +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tomáš Pecka + +[ Upstream commit 93822f5161a2dc57a60b95b35b3cb8589f53413e ] + +The bit flags in pmbus_driver_info functionality for YM-2151E chip were +joined with a comma operator instead of a bitwise OR. This means that +the last constant PMBUS_HAVE_IIN was not OR-ed with the other +PM_BUS_HAVE_* constants for this page but it initialized the next element +of the func array (which was not accessed from anywhere because of the +number of pages). + +However, there is no need for setting PMBUS_HAVE_IIN in the 5Vsb page +because this command does not seem to be paged. Obviously, the device +only has one IIN sensor, so it doesn't make sense to query it again from +the second page. + +Fixes: 1734b4135a62 ("hwmon: Add driver for fsp-3y PSUs and PDUs") +Signed-off-by: Jan Kundrát +Signed-off-by: Tomáš Pecka +Link: https://lore.kernel.org/r/20230420171939.212040-1-tomas.pecka@cesnet.cz +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/fsp-3y.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/hwmon/pmbus/fsp-3y.c b/drivers/hwmon/pmbus/fsp-3y.c +index aec294cc72d1f..c7469d2cdedcf 100644 +--- a/drivers/hwmon/pmbus/fsp-3y.c ++++ b/drivers/hwmon/pmbus/fsp-3y.c +@@ -180,7 +180,6 @@ static struct pmbus_driver_info fsp3y_info[] = { + PMBUS_HAVE_FAN12, + .func[YM2151_PAGE_5VSB_LOG] = + PMBUS_HAVE_VOUT | PMBUS_HAVE_IOUT, +- PMBUS_HAVE_IIN, + .read_word_data = fsp3y_read_word_data, + .read_byte_data = fsp3y_read_byte_data, + }, +-- +2.39.2 + diff --git a/queue-6.2/i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch b/queue-6.2/i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch new file mode 100644 index 00000000000..e66bf6d8843 --- /dev/null +++ b/queue-6.2/i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch @@ -0,0 +1,46 @@ +From bde731b78f44cc15a33b0501974c4a511af5d0a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 19:10:21 -0700 +Subject: i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error + path + +From: Lars-Peter Clausen + +[ Upstream commit ae1664f04f504a998737f5bb563f16b44357bcca ] + +The cdns_i2c_master_xfer() function gets a runtime PM reference when the +function is entered. This reference is released when the function is +exited. There is currently one error path where the function exits +directly, which leads to a leak of the runtime PM reference. + +Make sure that this error path also releases the runtime PM reference. + +Fixes: 1a351b10b967 ("i2c: cadence: Added slave support") +Signed-off-by: Lars-Peter Clausen +Reviewed-by: Michal Simek +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-cadence.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index f58943cb13414..8a5fdb150c446 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -833,8 +833,10 @@ static int cdns_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, + #if IS_ENABLED(CONFIG_I2C_SLAVE) + /* Check i2c operating mode and switch if possible */ + if (id->dev_mode == CDNS_I2C_MODE_SLAVE) { +- if (id->slave_state != CDNS_I2C_SLAVE_STATE_IDLE) +- return -EAGAIN; ++ if (id->slave_state != CDNS_I2C_SLAVE_STATE_IDLE) { ++ ret = -EAGAIN; ++ goto out; ++ } + + /* Set mode to master */ + cdns_i2c_set_mode(CDNS_I2C_MODE_MASTER, id); +-- +2.39.2 + diff --git a/queue-6.2/i2c-xiic-xiic_xfer-fix-runtime-pm-leak-on-error-path.patch b/queue-6.2/i2c-xiic-xiic_xfer-fix-runtime-pm-leak-on-error-path.patch new file mode 100644 index 00000000000..6cc70a409c8 --- /dev/null +++ b/queue-6.2/i2c-xiic-xiic_xfer-fix-runtime-pm-leak-on-error-path.patch @@ -0,0 +1,50 @@ +From 16d74c6d31b43c82f9a4a725b92750286578dce8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 19:10:22 -0700 +Subject: i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path + +From: Lars-Peter Clausen + +[ Upstream commit d663d93bb47e7ab45602b227701022d8aa16040a ] + +The xiic_xfer() function gets a runtime PM reference when the function is +entered. This reference is released when the function is exited. There is +currently one error path where the function exits directly, which leads to +a leak of the runtime PM reference. + +Make sure that this error path also releases the runtime PM reference. + +Fixes: fdacc3c7405d ("i2c: xiic: Switch from waitqueue to completion") +Signed-off-by: Lars-Peter Clausen +Reviewed-by: Michal Simek +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index bee5a2ef1f229..2bf3713b1969d 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -704,7 +704,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + err = xiic_start_xfer(i2c, msgs, num); + if (err < 0) { + dev_err(adap->dev.parent, "Error xiic_start_xfer\n"); +- return err; ++ goto out; + } + + err = wait_for_completion_timeout(&i2c->completion, XIIC_XFER_TIMEOUT); +@@ -722,6 +722,8 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + err = (i2c->state == STATE_DONE) ? num : -EIO; + } + mutex_unlock(&i2c->lock); ++ ++out: + pm_runtime_mark_last_busy(i2c->dev); + pm_runtime_put_autosuspend(i2c->dev); + return err; +-- +2.39.2 + diff --git a/queue-6.2/ia64-mm-contig-fix-section-mismatch-warning-error.patch b/queue-6.2/ia64-mm-contig-fix-section-mismatch-warning-error.patch new file mode 100644 index 00000000000..a6faf9e30bb --- /dev/null +++ b/queue-6.2/ia64-mm-contig-fix-section-mismatch-warning-error.patch @@ -0,0 +1,41 @@ +From f0a72d7c2553b37bc83e5f3a891dfd3da9961aa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 19:42:58 -0800 +Subject: ia64: mm/contig: fix section mismatch warning/error + +From: Randy Dunlap + +[ Upstream commit 58deeb4ef3b054498747d0929d94ac53ab90981f ] + +alloc_per_cpu_data() is called by find_memory(), which is marked as +__init. Therefore alloc_per_cpu_data() can also be marked as __init to +remedy this modpost problem. + +WARNING: modpost: vmlinux.o: section mismatch in reference: alloc_per_cpu_data (section: .text) -> memblock_alloc_try_nid (section: .init.text) + +Link: https://lkml.kernel.org/r/20230223034258.12917-1-rdunlap@infradead.org +Fixes: 4b9ddc7cf272 ("[IA64] Fix section mismatch in contig.c version of per_cpu_init()") +Signed-off-by: Randy Dunlap +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/ia64/mm/contig.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c +index 24901d8093015..1e9eaa107eb73 100644 +--- a/arch/ia64/mm/contig.c ++++ b/arch/ia64/mm/contig.c +@@ -77,7 +77,7 @@ void *per_cpu_init(void) + return __per_cpu_start + __per_cpu_offset[smp_processor_id()]; + } + +-static inline void ++static inline __init void + alloc_per_cpu_data(void) + { + size_t size = PERCPU_PAGE_SIZE * num_possible_cpus(); +-- +2.39.2 + diff --git a/queue-6.2/ia64-salinfo-placate-defined-but-not-used-warning.patch b/queue-6.2/ia64-salinfo-placate-defined-but-not-used-warning.patch new file mode 100644 index 00000000000..868b1ac135a --- /dev/null +++ b/queue-6.2/ia64-salinfo-placate-defined-but-not-used-warning.patch @@ -0,0 +1,42 @@ +From 46b1c507349cdad3dfe52400de6334493913a934 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 19:43:09 -0800 +Subject: ia64: salinfo: placate defined-but-not-used warning + +From: Randy Dunlap + +[ Upstream commit 0de155752b152d6bcd96b5b5bf20af336abd183a ] + +When CONFIG_PROC_FS is not set, proc_salinfo_show() is not used. Mark the +function as __maybe_unused to quieten the warning message. + +../arch/ia64/kernel/salinfo.c:584:12: warning: 'proc_salinfo_show' defined but not used [-Wunused-function] + 584 | static int proc_salinfo_show(struct seq_file *m, void *v) + | ^~~~~~~~~~~~~~~~~ + +Link: https://lkml.kernel.org/r/20230223034309.13375-1-rdunlap@infradead.org +Fixes: 3f3942aca6da ("proc: introduce proc_create_single{,_data}") +Signed-off-by: Randy Dunlap +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/ia64/kernel/salinfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/ia64/kernel/salinfo.c b/arch/ia64/kernel/salinfo.c +index bd3ba276e69c3..03b632c568995 100644 +--- a/arch/ia64/kernel/salinfo.c ++++ b/arch/ia64/kernel/salinfo.c +@@ -581,7 +581,7 @@ static int salinfo_cpu_pre_down(unsigned int cpu) + * 'data' contains an integer that corresponds to the feature we're + * testing + */ +-static int proc_salinfo_show(struct seq_file *m, void *v) ++static int __maybe_unused proc_salinfo_show(struct seq_file *m, void *v) + { + unsigned long data = (unsigned long)v; + seq_puts(m, (sal_platform_features & data) ? "1\n" : "0\n"); +-- +2.39.2 + diff --git a/queue-6.2/ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch b/queue-6.2/ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch new file mode 100644 index 00000000000..c6a8a16773c --- /dev/null +++ b/queue-6.2/ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch @@ -0,0 +1,1148 @@ +From 03ced17ba318546ffb1369ce83ac93eecd7d803c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 12:52:44 -0400 +Subject: IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA + requests + +From: Patrick Kelsey + +[ Upstream commit 00cbce5cbf88459cd1aa1d60d0f1df15477df127 ] + +hfi1 user SDMA request processing has two bugs that can cause data +corruption for user SDMA requests that have multiple payload iovecs +where an iovec other than the tail iovec does not run up to the page +boundary for the buffer pointed to by that iovec.a + +Here are the specific bugs: +1. user_sdma_txadd() does not use struct user_sdma_iovec->iov.iov_len. + Rather, user_sdma_txadd() will add up to PAGE_SIZE bytes from iovec + to the packet, even if some of those bytes are past + iovec->iov.iov_len and are thus not intended to be in the packet. +2. user_sdma_txadd() and user_sdma_send_pkts() fail to advance to the + next iovec in user_sdma_request->iovs when the current iovec + is not PAGE_SIZE and does not contain enough data to complete the + packet. The transmitted packet will contain the wrong data from the + iovec pages. + +This has not been an issue with SDMA packets from hfi1 Verbs or PSM2 +because they only produce iovecs that end short of PAGE_SIZE as the tail +iovec of an SDMA request. + +Fixing these bugs exposes other bugs with the SDMA pin cache +(struct mmu_rb_handler) that get in way of supporting user SDMA requests +with multiple payload iovecs whose buffers do not end at PAGE_SIZE. So +this commit fixes those issues as well. + +Here are the mmu_rb_handler bugs that non-PAGE_SIZE-end multi-iovec +payload user SDMA requests can hit: +1. Overlapping memory ranges in mmu_rb_handler will result in duplicate + pinnings. +2. When extending an existing mmu_rb_handler entry (struct mmu_rb_node), + the mmu_rb code (1) removes the existing entry under a lock, (2) + releases that lock, pins the new pages, (3) then reacquires the lock + to insert the extended mmu_rb_node. + + If someone else comes in and inserts an overlapping entry between (2) + and (3), insert in (3) will fail. + + The failure path code in this case unpins _all_ pages in either the + original mmu_rb_node or the new mmu_rb_node that was inserted between + (2) and (3). +3. In hfi1_mmu_rb_remove_unless_exact(), mmu_rb_node->refcount is + incremented outside of mmu_rb_handler->lock. As a result, mmu_rb_node + could be evicted by another thread that gets mmu_rb_handler->lock and + checks mmu_rb_node->refcount before mmu_rb_node->refcount is + incremented. +4. Related to #2 above, SDMA request submission failure path does not + check mmu_rb_node->refcount before freeing mmu_rb_node object. + + If there are other SDMA requests in progress whose iovecs have + pointers to the now-freed mmu_rb_node(s), those pointers to the + now-freed mmu_rb nodes will be dereferenced when those SDMA requests + complete. + +Fixes: 7be85676f1d1 ("IB/hfi1: Don't remove RB entry when not needed.") +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Signed-off-by: Brendan Cunningham +Signed-off-by: Patrick Kelsey +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/168088636445.3027109.10054635277810177889.stgit@252.162.96.66.static.eigbox.net +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/ipoib_tx.c | 1 + + drivers/infiniband/hw/hfi1/mmu_rb.c | 66 +-- + drivers/infiniband/hw/hfi1/mmu_rb.h | 8 +- + drivers/infiniband/hw/hfi1/sdma.c | 21 +- + drivers/infiniband/hw/hfi1/sdma.h | 16 +- + drivers/infiniband/hw/hfi1/sdma_txreq.h | 1 + + drivers/infiniband/hw/hfi1/trace_mmu.h | 4 - + drivers/infiniband/hw/hfi1/user_sdma.c | 600 +++++++++++++++--------- + drivers/infiniband/hw/hfi1/user_sdma.h | 5 - + drivers/infiniband/hw/hfi1/verbs.c | 4 +- + drivers/infiniband/hw/hfi1/vnic_sdma.c | 1 + + 11 files changed, 423 insertions(+), 304 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c +index 349eb41391368..8973a081d641e 100644 +--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c ++++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c +@@ -215,6 +215,7 @@ static int hfi1_ipoib_build_ulp_payload(struct ipoib_txreq *tx, + const skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; + + ret = sdma_txadd_page(dd, ++ NULL, + txreq, + skb_frag_page(frag), + frag->bv_offset, +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c +index af46ff2033426..71b9ac0188875 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -126,7 +126,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + spin_lock_irqsave(&handler->lock, flags); + node = __mmu_rb_search(handler, mnode->addr, mnode->len); + if (node) { +- ret = -EINVAL; ++ ret = -EEXIST; + goto unlock; + } + __mmu_int_rb_insert(mnode, &handler->root); +@@ -143,6 +143,19 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + return ret; + } + ++/* Caller must hold handler lock */ ++struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler, ++ unsigned long addr, unsigned long len) ++{ ++ struct mmu_rb_node *node; ++ ++ trace_hfi1_mmu_rb_search(addr, len); ++ node = __mmu_int_rb_iter_first(&handler->root, addr, (addr + len) - 1); ++ if (node) ++ list_move_tail(&node->list, &handler->lru_list); ++ return node; ++} ++ + /* Caller must hold handler lock */ + static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler, + unsigned long addr, +@@ -167,34 +180,6 @@ static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler, + return node; + } + +-bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler, +- unsigned long addr, unsigned long len, +- struct mmu_rb_node **rb_node) +-{ +- struct mmu_rb_node *node; +- unsigned long flags; +- bool ret = false; +- +- if (current->mm != handler->mn.mm) +- return ret; +- +- spin_lock_irqsave(&handler->lock, flags); +- node = __mmu_rb_search(handler, addr, len); +- if (node) { +- if (node->addr == addr && node->len == len) { +- list_move_tail(&node->list, &handler->lru_list); +- goto unlock; +- } +- __mmu_int_rb_remove(node, &handler->root); +- list_del(&node->list); /* remove from LRU list */ +- ret = true; +- } +-unlock: +- spin_unlock_irqrestore(&handler->lock, flags); +- *rb_node = node; +- return ret; +-} +- + void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + { + struct mmu_rb_node *rbnode, *ptr; +@@ -225,29 +210,6 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + } + } + +-/* +- * It is up to the caller to ensure that this function does not race with the +- * mmu invalidate notifier which may be calling the users remove callback on +- * 'node'. +- */ +-void hfi1_mmu_rb_remove(struct mmu_rb_handler *handler, +- struct mmu_rb_node *node) +-{ +- unsigned long flags; +- +- if (current->mm != handler->mn.mm) +- return; +- +- /* Validity of handler and node pointers has been checked by caller. */ +- trace_hfi1_mmu_rb_remove(node->addr, node->len); +- spin_lock_irqsave(&handler->lock, flags); +- __mmu_int_rb_remove(node, &handler->root); +- list_del(&node->list); /* remove from LRU list */ +- spin_unlock_irqrestore(&handler->lock, flags); +- +- handler->ops->remove(handler->ops_arg, node); +-} +- + static int mmu_notifier_range_start(struct mmu_notifier *mn, + const struct mmu_notifier_range *range) + { +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.h b/drivers/infiniband/hw/hfi1/mmu_rb.h +index 7417be2b9dc8a..ed75acdb7b839 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.h ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.h +@@ -52,10 +52,8 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler); + int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + struct mmu_rb_node *mnode); + void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg); +-void hfi1_mmu_rb_remove(struct mmu_rb_handler *handler, +- struct mmu_rb_node *mnode); +-bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler, +- unsigned long addr, unsigned long len, +- struct mmu_rb_node **rb_node); ++struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler, ++ unsigned long addr, ++ unsigned long len); + + #endif /* _HFI1_MMU_RB_H */ +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index 8ed20392e9f0d..bb2552dd29c1e 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -1593,22 +1593,7 @@ static inline void sdma_unmap_desc( + struct hfi1_devdata *dd, + struct sdma_desc *descp) + { +- switch (sdma_mapping_type(descp)) { +- case SDMA_MAP_SINGLE: +- dma_unmap_single( +- &dd->pcidev->dev, +- sdma_mapping_addr(descp), +- sdma_mapping_len(descp), +- DMA_TO_DEVICE); +- break; +- case SDMA_MAP_PAGE: +- dma_unmap_page( +- &dd->pcidev->dev, +- sdma_mapping_addr(descp), +- sdma_mapping_len(descp), +- DMA_TO_DEVICE); +- break; +- } ++ system_descriptor_complete(dd, descp); + } + + /* +@@ -3128,7 +3113,7 @@ int ext_coal_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx, + + /* Add descriptor for coalesce buffer */ + tx->desc_limit = MAX_DESC; +- return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, tx, ++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, + addr, tx->tlen); + } + +@@ -3167,10 +3152,12 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + return rval; + } + } ++ + /* finish the one just added */ + make_tx_sdma_desc( + tx, + SDMA_MAP_NONE, ++ NULL, + dd->sdma_pad_phys, + sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1))); + tx->num_desc++; +diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h +index b023fc461bd51..95aaec14c6c28 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.h ++++ b/drivers/infiniband/hw/hfi1/sdma.h +@@ -594,6 +594,7 @@ static inline dma_addr_t sdma_mapping_addr(struct sdma_desc *d) + static inline void make_tx_sdma_desc( + struct sdma_txreq *tx, + int type, ++ void *pinning_ctx, + dma_addr_t addr, + size_t len) + { +@@ -612,6 +613,7 @@ static inline void make_tx_sdma_desc( + << SDMA_DESC0_PHY_ADDR_SHIFT) | + (((u64)len & SDMA_DESC0_BYTE_COUNT_MASK) + << SDMA_DESC0_BYTE_COUNT_SHIFT); ++ desc->pinning_ctx = pinning_ctx; + } + + /* helper to extend txreq */ +@@ -643,6 +645,7 @@ static inline void _sdma_close_tx(struct hfi1_devdata *dd, + static inline int _sdma_txadd_daddr( + struct hfi1_devdata *dd, + int type, ++ void *pinning_ctx, + struct sdma_txreq *tx, + dma_addr_t addr, + u16 len) +@@ -652,6 +655,7 @@ static inline int _sdma_txadd_daddr( + make_tx_sdma_desc( + tx, + type, ++ pinning_ctx, + addr, len); + WARN_ON(len > tx->tlen); + tx->num_desc++; +@@ -672,6 +676,7 @@ static inline int _sdma_txadd_daddr( + /** + * sdma_txadd_page() - add a page to the sdma_txreq + * @dd: the device to use for mapping ++ * @pinning_ctx: context to be released at descriptor retirement + * @tx: tx request to which the page is added + * @page: page to map + * @offset: offset within the page +@@ -687,6 +692,7 @@ static inline int _sdma_txadd_daddr( + */ + static inline int sdma_txadd_page( + struct hfi1_devdata *dd, ++ void *pinning_ctx, + struct sdma_txreq *tx, + struct page *page, + unsigned long offset, +@@ -714,8 +720,7 @@ static inline int sdma_txadd_page( + return -ENOSPC; + } + +- return _sdma_txadd_daddr( +- dd, SDMA_MAP_PAGE, tx, addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_PAGE, pinning_ctx, tx, addr, len); + } + + /** +@@ -749,7 +754,8 @@ static inline int sdma_txadd_daddr( + return rval; + } + +- return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, tx, addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, NULL, tx, ++ addr, len); + } + + /** +@@ -795,8 +801,7 @@ static inline int sdma_txadd_kvaddr( + return -ENOSPC; + } + +- return _sdma_txadd_daddr( +- dd, SDMA_MAP_SINGLE, tx, addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, addr, len); + } + + struct iowait_work; +@@ -1030,4 +1035,5 @@ extern uint mod_num_sdma; + + void sdma_update_lmc(struct hfi1_devdata *dd, u64 mask, u32 lid); + ++void system_descriptor_complete(struct hfi1_devdata *dd, struct sdma_desc *descp); + #endif +diff --git a/drivers/infiniband/hw/hfi1/sdma_txreq.h b/drivers/infiniband/hw/hfi1/sdma_txreq.h +index e262fb5c5ec61..fad946cb5e0d8 100644 +--- a/drivers/infiniband/hw/hfi1/sdma_txreq.h ++++ b/drivers/infiniband/hw/hfi1/sdma_txreq.h +@@ -19,6 +19,7 @@ + struct sdma_desc { + /* private: don't use directly */ + u64 qw[2]; ++ void *pinning_ctx; + }; + + /** +diff --git a/drivers/infiniband/hw/hfi1/trace_mmu.h b/drivers/infiniband/hw/hfi1/trace_mmu.h +index 187e9244fe5ed..57900ebb7702e 100644 +--- a/drivers/infiniband/hw/hfi1/trace_mmu.h ++++ b/drivers/infiniband/hw/hfi1/trace_mmu.h +@@ -37,10 +37,6 @@ DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_rb_search, + TP_PROTO(unsigned long addr, unsigned long len), + TP_ARGS(addr, len)); + +-DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_rb_remove, +- TP_PROTO(unsigned long addr, unsigned long len), +- TP_ARGS(addr, len)); +- + DEFINE_EVENT(hfi1_mmu_rb_template, hfi1_mmu_mem_invalidate, + TP_PROTO(unsigned long addr, unsigned long len), + TP_ARGS(addr, len)); +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c +index a71c5a36cebab..ae58b48afe074 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -24,7 +24,6 @@ + + #include "hfi.h" + #include "sdma.h" +-#include "mmu_rb.h" + #include "user_sdma.h" + #include "verbs.h" /* for the headers */ + #include "common.h" /* for struct hfi1_tid_info */ +@@ -39,11 +38,7 @@ static unsigned initial_pkt_count = 8; + static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts); + static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status); + static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq); +-static void user_sdma_free_request(struct user_sdma_request *req, bool unpin); +-static int pin_vector_pages(struct user_sdma_request *req, +- struct user_sdma_iovec *iovec); +-static void unpin_vector_pages(struct mm_struct *mm, struct page **pages, +- unsigned start, unsigned npages); ++static void user_sdma_free_request(struct user_sdma_request *req); + static int check_header_template(struct user_sdma_request *req, + struct hfi1_pkt_header *hdr, u32 lrhlen, + u32 datalen); +@@ -81,6 +76,11 @@ static struct mmu_rb_ops sdma_rb_ops = { + .invalidate = sdma_rb_invalidate + }; + ++static int add_system_pages_to_sdma_packet(struct user_sdma_request *req, ++ struct user_sdma_txreq *tx, ++ struct user_sdma_iovec *iovec, ++ u32 *pkt_remaining); ++ + static int defer_packet_queue( + struct sdma_engine *sde, + struct iowait_work *wait, +@@ -410,6 +410,7 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + ret = -EINVAL; + goto free_req; + } ++ + /* Copy the header from the user buffer */ + ret = copy_from_user(&req->hdr, iovec[idx].iov_base + sizeof(info), + sizeof(req->hdr)); +@@ -484,9 +485,8 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + memcpy(&req->iovs[i].iov, + iovec + idx++, + sizeof(req->iovs[i].iov)); +- ret = pin_vector_pages(req, &req->iovs[i]); +- if (ret) { +- req->data_iovs = i; ++ if (req->iovs[i].iov.iov_len == 0) { ++ ret = -EINVAL; + goto free_req; + } + req->data_len += req->iovs[i].iov.iov_len; +@@ -584,7 +584,7 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, + if (req->seqsubmitted) + wait_event(pq->busy.wait_dma, + (req->seqcomp == req->seqsubmitted - 1)); +- user_sdma_free_request(req, true); ++ user_sdma_free_request(req); + pq_update(pq); + set_comp_state(pq, cq, info.comp_idx, ERROR, ret); + } +@@ -696,48 +696,6 @@ static int user_sdma_txadd_ahg(struct user_sdma_request *req, + return ret; + } + +-static int user_sdma_txadd(struct user_sdma_request *req, +- struct user_sdma_txreq *tx, +- struct user_sdma_iovec *iovec, u32 datalen, +- u32 *queued_ptr, u32 *data_sent_ptr, +- u64 *iov_offset_ptr) +-{ +- int ret; +- unsigned int pageidx, len; +- unsigned long base, offset; +- u64 iov_offset = *iov_offset_ptr; +- u32 queued = *queued_ptr, data_sent = *data_sent_ptr; +- struct hfi1_user_sdma_pkt_q *pq = req->pq; +- +- base = (unsigned long)iovec->iov.iov_base; +- offset = offset_in_page(base + iovec->offset + iov_offset); +- pageidx = (((iovec->offset + iov_offset + base) - (base & PAGE_MASK)) >> +- PAGE_SHIFT); +- len = offset + req->info.fragsize > PAGE_SIZE ? +- PAGE_SIZE - offset : req->info.fragsize; +- len = min((datalen - queued), len); +- ret = sdma_txadd_page(pq->dd, &tx->txreq, iovec->pages[pageidx], +- offset, len); +- if (ret) { +- SDMA_DBG(req, "SDMA txreq add page failed %d\n", ret); +- return ret; +- } +- iov_offset += len; +- queued += len; +- data_sent += len; +- if (unlikely(queued < datalen && pageidx == iovec->npages && +- req->iov_idx < req->data_iovs - 1)) { +- iovec->offset += iov_offset; +- iovec = &req->iovs[++req->iov_idx]; +- iov_offset = 0; +- } +- +- *queued_ptr = queued; +- *data_sent_ptr = data_sent; +- *iov_offset_ptr = iov_offset; +- return ret; +-} +- + static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts) + { + int ret = 0; +@@ -769,8 +727,7 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts) + maxpkts = req->info.npkts - req->seqnum; + + while (npkts < maxpkts) { +- u32 datalen = 0, queued = 0, data_sent = 0; +- u64 iov_offset = 0; ++ u32 datalen = 0; + + /* + * Check whether any of the completions have come back +@@ -863,27 +820,17 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts) + goto free_txreq; + } + +- /* +- * If the request contains any data vectors, add up to +- * fragsize bytes to the descriptor. +- */ +- while (queued < datalen && +- (req->sent + data_sent) < req->data_len) { +- ret = user_sdma_txadd(req, tx, iovec, datalen, +- &queued, &data_sent, &iov_offset); +- if (ret) +- goto free_txreq; +- } +- /* +- * The txreq was submitted successfully so we can update +- * the counters. +- */ + req->koffset += datalen; + if (req_opcode(req->info.ctrl) == EXPECTED) + req->tidoffset += datalen; +- req->sent += data_sent; +- if (req->data_len) +- iovec->offset += iov_offset; ++ req->sent += datalen; ++ while (datalen) { ++ ret = add_system_pages_to_sdma_packet(req, tx, iovec, ++ &datalen); ++ if (ret) ++ goto free_txreq; ++ iovec = &req->iovs[req->iov_idx]; ++ } + list_add_tail(&tx->txreq.list, &req->txps); + /* + * It is important to increment this here as it is used to +@@ -920,133 +867,14 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, u16 maxpkts) + static u32 sdma_cache_evict(struct hfi1_user_sdma_pkt_q *pq, u32 npages) + { + struct evict_data evict_data; ++ struct mmu_rb_handler *handler = pq->handler; + + evict_data.cleared = 0; + evict_data.target = npages; +- hfi1_mmu_rb_evict(pq->handler, &evict_data); ++ hfi1_mmu_rb_evict(handler, &evict_data); + return evict_data.cleared; + } + +-static int pin_sdma_pages(struct user_sdma_request *req, +- struct user_sdma_iovec *iovec, +- struct sdma_mmu_node *node, +- int npages) +-{ +- int pinned, cleared; +- struct page **pages; +- struct hfi1_user_sdma_pkt_q *pq = req->pq; +- +- pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL); +- if (!pages) +- return -ENOMEM; +- memcpy(pages, node->pages, node->npages * sizeof(*pages)); +- +- npages -= node->npages; +-retry: +- if (!hfi1_can_pin_pages(pq->dd, current->mm, +- atomic_read(&pq->n_locked), npages)) { +- cleared = sdma_cache_evict(pq, npages); +- if (cleared >= npages) +- goto retry; +- } +- pinned = hfi1_acquire_user_pages(current->mm, +- ((unsigned long)iovec->iov.iov_base + +- (node->npages * PAGE_SIZE)), npages, 0, +- pages + node->npages); +- if (pinned < 0) { +- kfree(pages); +- return pinned; +- } +- if (pinned != npages) { +- unpin_vector_pages(current->mm, pages, node->npages, pinned); +- return -EFAULT; +- } +- kfree(node->pages); +- node->rb.len = iovec->iov.iov_len; +- node->pages = pages; +- atomic_add(pinned, &pq->n_locked); +- return pinned; +-} +- +-static void unpin_sdma_pages(struct sdma_mmu_node *node) +-{ +- if (node->npages) { +- unpin_vector_pages(mm_from_sdma_node(node), node->pages, 0, +- node->npages); +- atomic_sub(node->npages, &node->pq->n_locked); +- } +-} +- +-static int pin_vector_pages(struct user_sdma_request *req, +- struct user_sdma_iovec *iovec) +-{ +- int ret = 0, pinned, npages; +- struct hfi1_user_sdma_pkt_q *pq = req->pq; +- struct sdma_mmu_node *node = NULL; +- struct mmu_rb_node *rb_node; +- struct iovec *iov; +- bool extracted; +- +- extracted = +- hfi1_mmu_rb_remove_unless_exact(pq->handler, +- (unsigned long) +- iovec->iov.iov_base, +- iovec->iov.iov_len, &rb_node); +- if (rb_node) { +- node = container_of(rb_node, struct sdma_mmu_node, rb); +- if (!extracted) { +- atomic_inc(&node->refcount); +- iovec->pages = node->pages; +- iovec->npages = node->npages; +- iovec->node = node; +- return 0; +- } +- } +- +- if (!node) { +- node = kzalloc(sizeof(*node), GFP_KERNEL); +- if (!node) +- return -ENOMEM; +- +- node->rb.addr = (unsigned long)iovec->iov.iov_base; +- node->pq = pq; +- atomic_set(&node->refcount, 0); +- } +- +- iov = &iovec->iov; +- npages = num_user_pages((unsigned long)iov->iov_base, iov->iov_len); +- if (node->npages < npages) { +- pinned = pin_sdma_pages(req, iovec, node, npages); +- if (pinned < 0) { +- ret = pinned; +- goto bail; +- } +- node->npages += pinned; +- npages = node->npages; +- } +- iovec->pages = node->pages; +- iovec->npages = npages; +- iovec->node = node; +- +- ret = hfi1_mmu_rb_insert(req->pq->handler, &node->rb); +- if (ret) { +- iovec->node = NULL; +- goto bail; +- } +- return 0; +-bail: +- unpin_sdma_pages(node); +- kfree(node); +- return ret; +-} +- +-static void unpin_vector_pages(struct mm_struct *mm, struct page **pages, +- unsigned start, unsigned npages) +-{ +- hfi1_release_user_pages(mm, pages + start, npages, false); +- kfree(pages); +-} +- + static int check_header_template(struct user_sdma_request *req, + struct hfi1_pkt_header *hdr, u32 lrhlen, + u32 datalen) +@@ -1388,7 +1216,7 @@ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status) + if (req->seqcomp != req->info.npkts - 1) + return; + +- user_sdma_free_request(req, false); ++ user_sdma_free_request(req); + set_comp_state(pq, cq, req->info.comp_idx, state, status); + pq_update(pq); + } +@@ -1399,10 +1227,8 @@ static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq) + wake_up(&pq->wait); + } + +-static void user_sdma_free_request(struct user_sdma_request *req, bool unpin) ++static void user_sdma_free_request(struct user_sdma_request *req) + { +- int i; +- + if (!list_empty(&req->txps)) { + struct sdma_txreq *t, *p; + +@@ -1415,21 +1241,6 @@ static void user_sdma_free_request(struct user_sdma_request *req, bool unpin) + } + } + +- for (i = 0; i < req->data_iovs; i++) { +- struct sdma_mmu_node *node = req->iovs[i].node; +- +- if (!node) +- continue; +- +- req->iovs[i].node = NULL; +- +- if (unpin) +- hfi1_mmu_rb_remove(req->pq->handler, +- &node->rb); +- else +- atomic_dec(&node->refcount); +- } +- + kfree(req->tids); + clear_bit(req->info.comp_idx, req->pq->req_in_use); + } +@@ -1447,6 +1258,368 @@ static inline void set_comp_state(struct hfi1_user_sdma_pkt_q *pq, + idx, state, ret); + } + ++static void unpin_vector_pages(struct mm_struct *mm, struct page **pages, ++ unsigned int start, unsigned int npages) ++{ ++ hfi1_release_user_pages(mm, pages + start, npages, false); ++ kfree(pages); ++} ++ ++static void free_system_node(struct sdma_mmu_node *node) ++{ ++ if (node->npages) { ++ unpin_vector_pages(mm_from_sdma_node(node), node->pages, 0, ++ node->npages); ++ atomic_sub(node->npages, &node->pq->n_locked); ++ } ++ kfree(node); ++} ++ ++static inline void acquire_node(struct sdma_mmu_node *node) ++{ ++ atomic_inc(&node->refcount); ++ WARN_ON(atomic_read(&node->refcount) < 0); ++} ++ ++static inline void release_node(struct mmu_rb_handler *handler, ++ struct sdma_mmu_node *node) ++{ ++ atomic_dec(&node->refcount); ++ WARN_ON(atomic_read(&node->refcount) < 0); ++} ++ ++static struct sdma_mmu_node *find_system_node(struct mmu_rb_handler *handler, ++ unsigned long start, ++ unsigned long end) ++{ ++ struct mmu_rb_node *rb_node; ++ struct sdma_mmu_node *node; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&handler->lock, flags); ++ rb_node = hfi1_mmu_rb_get_first(handler, start, (end - start)); ++ if (!rb_node) { ++ spin_unlock_irqrestore(&handler->lock, flags); ++ return NULL; ++ } ++ node = container_of(rb_node, struct sdma_mmu_node, rb); ++ acquire_node(node); ++ spin_unlock_irqrestore(&handler->lock, flags); ++ ++ return node; ++} ++ ++static int pin_system_pages(struct user_sdma_request *req, ++ uintptr_t start_address, size_t length, ++ struct sdma_mmu_node *node, int npages) ++{ ++ struct hfi1_user_sdma_pkt_q *pq = req->pq; ++ int pinned, cleared; ++ struct page **pages; ++ ++ pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL); ++ if (!pages) ++ return -ENOMEM; ++ ++retry: ++ if (!hfi1_can_pin_pages(pq->dd, current->mm, atomic_read(&pq->n_locked), ++ npages)) { ++ SDMA_DBG(req, "Evicting: nlocked %u npages %u", ++ atomic_read(&pq->n_locked), npages); ++ cleared = sdma_cache_evict(pq, npages); ++ if (cleared >= npages) ++ goto retry; ++ } ++ ++ SDMA_DBG(req, "Acquire user pages start_address %lx node->npages %u npages %u", ++ start_address, node->npages, npages); ++ pinned = hfi1_acquire_user_pages(current->mm, start_address, npages, 0, ++ pages); ++ ++ if (pinned < 0) { ++ kfree(pages); ++ SDMA_DBG(req, "pinned %d", pinned); ++ return pinned; ++ } ++ if (pinned != npages) { ++ unpin_vector_pages(current->mm, pages, node->npages, pinned); ++ SDMA_DBG(req, "npages %u pinned %d", npages, pinned); ++ return -EFAULT; ++ } ++ node->rb.addr = start_address; ++ node->rb.len = length; ++ node->pages = pages; ++ node->npages = npages; ++ atomic_add(pinned, &pq->n_locked); ++ SDMA_DBG(req, "done. pinned %d", pinned); ++ return 0; ++} ++ ++static int add_system_pinning(struct user_sdma_request *req, ++ struct sdma_mmu_node **node_p, ++ unsigned long start, unsigned long len) ++ ++{ ++ struct hfi1_user_sdma_pkt_q *pq = req->pq; ++ struct sdma_mmu_node *node; ++ int ret; ++ ++ node = kzalloc(sizeof(*node), GFP_KERNEL); ++ if (!node) ++ return -ENOMEM; ++ ++ node->pq = pq; ++ ret = pin_system_pages(req, start, len, node, PFN_DOWN(len)); ++ if (ret == 0) { ++ ret = hfi1_mmu_rb_insert(pq->handler, &node->rb); ++ if (ret) ++ free_system_node(node); ++ else ++ *node_p = node; ++ ++ return ret; ++ } ++ ++ kfree(node); ++ return ret; ++} ++ ++static int get_system_cache_entry(struct user_sdma_request *req, ++ struct sdma_mmu_node **node_p, ++ size_t req_start, size_t req_len) ++{ ++ struct hfi1_user_sdma_pkt_q *pq = req->pq; ++ u64 start = ALIGN_DOWN(req_start, PAGE_SIZE); ++ u64 end = PFN_ALIGN(req_start + req_len); ++ struct mmu_rb_handler *handler = pq->handler; ++ int ret; ++ ++ if ((end - start) == 0) { ++ SDMA_DBG(req, ++ "Request for empty cache entry req_start %lx req_len %lx start %llx end %llx", ++ req_start, req_len, start, end); ++ return -EINVAL; ++ } ++ ++ SDMA_DBG(req, "req_start %lx req_len %lu", req_start, req_len); ++ ++ while (1) { ++ struct sdma_mmu_node *node = ++ find_system_node(handler, start, end); ++ u64 prepend_len = 0; ++ ++ SDMA_DBG(req, "node %p start %llx end %llu", node, start, end); ++ if (!node) { ++ ret = add_system_pinning(req, node_p, start, ++ end - start); ++ if (ret == -EEXIST) { ++ /* ++ * Another execution context has inserted a ++ * conficting entry first. ++ */ ++ continue; ++ } ++ return ret; ++ } ++ ++ if (node->rb.addr <= start) { ++ /* ++ * This entry covers at least part of the region. If it doesn't extend ++ * to the end, then this will be called again for the next segment. ++ */ ++ *node_p = node; ++ return 0; ++ } ++ ++ SDMA_DBG(req, "prepend: node->rb.addr %lx, node->refcount %d", ++ node->rb.addr, atomic_read(&node->refcount)); ++ prepend_len = node->rb.addr - start; ++ ++ /* ++ * This node will not be returned, instead a new node ++ * will be. So release the reference. ++ */ ++ release_node(handler, node); ++ ++ /* Prepend a node to cover the beginning of the allocation */ ++ ret = add_system_pinning(req, node_p, start, prepend_len); ++ if (ret == -EEXIST) { ++ /* Another execution context has inserted a conficting entry first. */ ++ continue; ++ } ++ return ret; ++ } ++} ++ ++static int add_mapping_to_sdma_packet(struct user_sdma_request *req, ++ struct user_sdma_txreq *tx, ++ struct sdma_mmu_node *cache_entry, ++ size_t start, ++ size_t from_this_cache_entry) ++{ ++ struct hfi1_user_sdma_pkt_q *pq = req->pq; ++ unsigned int page_offset; ++ unsigned int from_this_page; ++ size_t page_index; ++ void *ctx; ++ int ret; ++ ++ /* ++ * Because the cache may be more fragmented than the memory that is being accessed, ++ * it's not strictly necessary to have a descriptor per cache entry. ++ */ ++ ++ while (from_this_cache_entry) { ++ page_index = PFN_DOWN(start - cache_entry->rb.addr); ++ ++ if (page_index >= cache_entry->npages) { ++ SDMA_DBG(req, ++ "Request for page_index %zu >= cache_entry->npages %u", ++ page_index, cache_entry->npages); ++ return -EINVAL; ++ } ++ ++ page_offset = start - ALIGN_DOWN(start, PAGE_SIZE); ++ from_this_page = PAGE_SIZE - page_offset; ++ ++ if (from_this_page < from_this_cache_entry) { ++ ctx = NULL; ++ } else { ++ /* ++ * In the case they are equal the next line has no practical effect, ++ * but it's better to do a register to register copy than a conditional ++ * branch. ++ */ ++ from_this_page = from_this_cache_entry; ++ ctx = cache_entry; ++ } ++ ++ ret = sdma_txadd_page(pq->dd, ctx, &tx->txreq, ++ cache_entry->pages[page_index], ++ page_offset, from_this_page); ++ if (ret) { ++ /* ++ * When there's a failure, the entire request is freed by ++ * user_sdma_send_pkts(). ++ */ ++ SDMA_DBG(req, ++ "sdma_txadd_page failed %d page_index %lu page_offset %u from_this_page %u", ++ ret, page_index, page_offset, from_this_page); ++ return ret; ++ } ++ start += from_this_page; ++ from_this_cache_entry -= from_this_page; ++ } ++ return 0; ++} ++ ++static int add_system_iovec_to_sdma_packet(struct user_sdma_request *req, ++ struct user_sdma_txreq *tx, ++ struct user_sdma_iovec *iovec, ++ size_t from_this_iovec) ++{ ++ struct mmu_rb_handler *handler = req->pq->handler; ++ ++ while (from_this_iovec > 0) { ++ struct sdma_mmu_node *cache_entry; ++ size_t from_this_cache_entry; ++ size_t start; ++ int ret; ++ ++ start = (uintptr_t)iovec->iov.iov_base + iovec->offset; ++ ret = get_system_cache_entry(req, &cache_entry, start, ++ from_this_iovec); ++ if (ret) { ++ SDMA_DBG(req, "pin system segment failed %d", ret); ++ return ret; ++ } ++ ++ from_this_cache_entry = cache_entry->rb.len - (start - cache_entry->rb.addr); ++ if (from_this_cache_entry > from_this_iovec) ++ from_this_cache_entry = from_this_iovec; ++ ++ ret = add_mapping_to_sdma_packet(req, tx, cache_entry, start, ++ from_this_cache_entry); ++ if (ret) { ++ /* ++ * We're guaranteed that there will be no descriptor ++ * completion callback that releases this node ++ * because only the last descriptor referencing it ++ * has a context attached, and a failure means the ++ * last descriptor was never added. ++ */ ++ release_node(handler, cache_entry); ++ SDMA_DBG(req, "add system segment failed %d", ret); ++ return ret; ++ } ++ ++ iovec->offset += from_this_cache_entry; ++ from_this_iovec -= from_this_cache_entry; ++ } ++ ++ return 0; ++} ++ ++static int add_system_pages_to_sdma_packet(struct user_sdma_request *req, ++ struct user_sdma_txreq *tx, ++ struct user_sdma_iovec *iovec, ++ u32 *pkt_data_remaining) ++{ ++ size_t remaining_to_add = *pkt_data_remaining; ++ /* ++ * Walk through iovec entries, ensure the associated pages ++ * are pinned and mapped, add data to the packet until no more ++ * data remains to be added. ++ */ ++ while (remaining_to_add > 0) { ++ struct user_sdma_iovec *cur_iovec; ++ size_t from_this_iovec; ++ int ret; ++ ++ cur_iovec = iovec; ++ from_this_iovec = iovec->iov.iov_len - iovec->offset; ++ ++ if (from_this_iovec > remaining_to_add) { ++ from_this_iovec = remaining_to_add; ++ } else { ++ /* The current iovec entry will be consumed by this pass. */ ++ req->iov_idx++; ++ iovec++; ++ } ++ ++ ret = add_system_iovec_to_sdma_packet(req, tx, cur_iovec, ++ from_this_iovec); ++ if (ret) ++ return ret; ++ ++ remaining_to_add -= from_this_iovec; ++ } ++ *pkt_data_remaining = remaining_to_add; ++ ++ return 0; ++} ++ ++void system_descriptor_complete(struct hfi1_devdata *dd, ++ struct sdma_desc *descp) ++{ ++ switch (sdma_mapping_type(descp)) { ++ case SDMA_MAP_SINGLE: ++ dma_unmap_single(&dd->pcidev->dev, sdma_mapping_addr(descp), ++ sdma_mapping_len(descp), DMA_TO_DEVICE); ++ break; ++ case SDMA_MAP_PAGE: ++ dma_unmap_page(&dd->pcidev->dev, sdma_mapping_addr(descp), ++ sdma_mapping_len(descp), DMA_TO_DEVICE); ++ break; ++ } ++ ++ if (descp->pinning_ctx) { ++ struct sdma_mmu_node *node = descp->pinning_ctx; ++ ++ release_node(node->rb.handler, node); ++ } ++} ++ + static bool sdma_rb_filter(struct mmu_rb_node *node, unsigned long addr, + unsigned long len) + { +@@ -1493,8 +1666,7 @@ static void sdma_rb_remove(void *arg, struct mmu_rb_node *mnode) + struct sdma_mmu_node *node = + container_of(mnode, struct sdma_mmu_node, rb); + +- unpin_sdma_pages(node); +- kfree(node); ++ free_system_node(node); + } + + static int sdma_rb_invalidate(void *arg, struct mmu_rb_node *mnode) +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h +index ea56eb57e6568..a241836371dc1 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.h ++++ b/drivers/infiniband/hw/hfi1/user_sdma.h +@@ -112,16 +112,11 @@ struct sdma_mmu_node { + struct user_sdma_iovec { + struct list_head list; + struct iovec iov; +- /* number of pages in this vector */ +- unsigned int npages; +- /* array of pinned pages for this vector */ +- struct page **pages; + /* + * offset into the virtual address space of the vector at + * which we last left off. + */ + u64 offset; +- struct sdma_mmu_node *node; + }; + + /* evict operation argument */ +diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c +index e6e17984553c0..39ca32d9ae6a5 100644 +--- a/drivers/infiniband/hw/hfi1/verbs.c ++++ b/drivers/infiniband/hw/hfi1/verbs.c +@@ -778,8 +778,8 @@ static int build_verbs_tx_desc( + + /* add icrc, lt byte, and padding to flit */ + if (extra_bytes) +- ret = sdma_txadd_daddr(sde->dd, &tx->txreq, +- sde->dd->sdma_pad_phys, extra_bytes); ++ ret = sdma_txadd_daddr(sde->dd, &tx->txreq, sde->dd->sdma_pad_phys, ++ extra_bytes); + + bail_txadd: + return ret; +diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c +index c3f0f8d877c37..727eedfba332a 100644 +--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c ++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c +@@ -64,6 +64,7 @@ static noinline int build_vnic_ulp_payload(struct sdma_engine *sde, + + /* combine physically continuous fragments later? */ + ret = sdma_txadd_page(sde->dd, ++ NULL, + &tx->txreq, + skb_frag_page(frag), + skb_frag_off(frag), +-- +2.39.2 + diff --git a/queue-6.2/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch b/queue-6.2/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch new file mode 100644 index 00000000000..f6649624f77 --- /dev/null +++ b/queue-6.2/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch @@ -0,0 +1,93 @@ +From de14e07588e12c74bb23adf869c8871222f78b11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 12:52:39 -0400 +Subject: IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order + +From: Patrick Kelsey + +[ Upstream commit 9fe8fec5e43d5a80f43cbf61aaada1b047a1eb61 ] + +hfi1_mmu_rb_remove_unless_exact() did not move mmu_rb_node objects in +mmu_rb_handler->lru_list after getting a cache hit on an mmu_rb_node. + +As a result, hfi1_mmu_rb_evict() was not guaranteed to evict truly +least-recently used nodes. + +This could be a performance issue for an application when that +application: +- Uses some long-lived buffers frequently. +- Uses a large number of buffers once. +- Hits the mmu_rb_handler cache size or pinned-page limits, forcing + mmu_rb_handler cache entries to be evicted. + +In this case, the one-time use buffers cause the long-lived buffer +entries to eventually filter to the end of the LRU list where +hfi1_mmu_rb_evict() will consider evicting a frequently-used long-lived +entry instead of evicting one of the one-time use entries. + +Fix this by inserting new mmu_rb_node at the tail of +mmu_rb_handler->lru_list and move mmu_rb_ndoe to the tail of +mmu_rb_handler->lru_list when the mmu_rb_node is a hit in +hfi1_mmu_rb_remove_unless_exact(). Change hfi1_mmu_rb_evict() to evict +from the head of mmu_rb_handler->lru_list instead of the tail. + +Fixes: 0636e9ab8355 ("IB/hfi1: Add cache evict LRU list") +Signed-off-by: Brendan Cunningham +Signed-off-by: Patrick Kelsey +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/168088635931.3027109.10423156330761536044.stgit@252.162.96.66.static.eigbox.net +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/mmu_rb.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c +index 7333646021bb8..af46ff2033426 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -130,7 +130,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + goto unlock; + } + __mmu_int_rb_insert(mnode, &handler->root); +- list_add(&mnode->list, &handler->lru_list); ++ list_add_tail(&mnode->list, &handler->lru_list); + + ret = handler->ops->insert(handler->ops_arg, mnode); + if (ret) { +@@ -181,8 +181,10 @@ bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler, + spin_lock_irqsave(&handler->lock, flags); + node = __mmu_rb_search(handler, addr, len); + if (node) { +- if (node->addr == addr && node->len == len) ++ if (node->addr == addr && node->len == len) { ++ list_move_tail(&node->list, &handler->lru_list); + goto unlock; ++ } + __mmu_int_rb_remove(node, &handler->root); + list_del(&node->list); /* remove from LRU list */ + ret = true; +@@ -206,8 +208,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + INIT_LIST_HEAD(&del_list); + + spin_lock_irqsave(&handler->lock, flags); +- list_for_each_entry_safe_reverse(rbnode, ptr, &handler->lru_list, +- list) { ++ list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) { + if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg, + &stop)) { + __mmu_int_rb_remove(rbnode, &handler->root); +@@ -219,9 +220,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + } + spin_unlock_irqrestore(&handler->lock, flags); + +- while (!list_empty(&del_list)) { +- rbnode = list_first_entry(&del_list, struct mmu_rb_node, list); +- list_del(&rbnode->list); ++ list_for_each_entry_safe(rbnode, ptr, &del_list, list) { + handler->ops->remove(handler->ops_arg, rbnode); + } + } +-- +2.39.2 + diff --git a/queue-6.2/ib-hifi1-add-a-null-check-of-kzalloc_node-in-hfi1_ip.patch b/queue-6.2/ib-hifi1-add-a-null-check-of-kzalloc_node-in-hfi1_ip.patch new file mode 100644 index 00000000000..ed504a1c054 --- /dev/null +++ b/queue-6.2/ib-hifi1-add-a-null-check-of-kzalloc_node-in-hfi1_ip.patch @@ -0,0 +1,42 @@ +From 85d151da2ae8dfeec4c4ecd1139c143086614463 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 18:02:12 +0800 +Subject: IB/hifi1: add a null check of kzalloc_node in hfi1_ipoib_txreq_init + +From: Kang Chen + +[ Upstream commit c874ad879c2f29ebe040a34b974389875c0d81eb ] + +kzalloc_node may fails, check it and do the cleanup. + +Fixes: b1151b74ff68 ("IB/hfi1: Fix alloc failure with larger txqueuelen") +Signed-off-by: Kang Chen +Link: https://lore.kernel.org/r/20230227100212.910820-1-void0red@gmail.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/ipoib_tx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c +index 5d9a7b09ca37e..349eb41391368 100644 +--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c ++++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c +@@ -737,10 +737,13 @@ int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv) + txq->tx_ring.shift = ilog2(tx_item_size); + txq->tx_ring.avail = hfi1_ipoib_ring_hwat(txq); + tx_ring = &txq->tx_ring; +- for (j = 0; j < tx_ring_size; j++) ++ for (j = 0; j < tx_ring_size; j++) { + hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr = + kzalloc_node(sizeof(*tx->sdma_hdr), + GFP_KERNEL, priv->dd->node); ++ if (!hfi1_txreq_from_idx(tx_ring, j)->sdma_hdr) ++ goto free_txqs; ++ } + + netif_napi_add_tx(dev, &txq->napi, hfi1_ipoib_poll_tx_ring); + } +-- +2.39.2 + diff --git a/queue-6.2/iio-light-max44009-add-missing-of-device-matching.patch b/queue-6.2/iio-light-max44009-add-missing-of-device-matching.patch new file mode 100644 index 00000000000..9778848a6d4 --- /dev/null +++ b/queue-6.2/iio-light-max44009-add-missing-of-device-matching.patch @@ -0,0 +1,66 @@ +From d1b8e750c5adc8dbbfa5d0d99358133040f4c47b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 16:34:28 +0100 +Subject: iio: light: max44009: add missing OF device matching +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Kozlowski + +[ Upstream commit b29c49026c3c05a11f845dba17cad0b3ba06836d ] + +The driver currently matches only via i2c_device_id, but also has +of_device_id table: + + drivers/iio/light/max44009.c:545:34: error: ‘max44009_of_match’ defined but not used [-Werror=unused-const-variable=] + +Fixes: 6aef699a7d7e ("iio: light: add driver for MAX44009") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230312153429.371702-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/light/max44009.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/iio/light/max44009.c b/drivers/iio/light/max44009.c +index 801e5a0ad496b..f3648f20ef2c0 100644 +--- a/drivers/iio/light/max44009.c ++++ b/drivers/iio/light/max44009.c +@@ -528,6 +528,12 @@ static int max44009_probe(struct i2c_client *client, + return devm_iio_device_register(&client->dev, indio_dev); + } + ++static const struct of_device_id max44009_of_match[] = { ++ { .compatible = "maxim,max44009" }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, max44009_of_match); ++ + static const struct i2c_device_id max44009_id[] = { + { "max44009", 0 }, + { } +@@ -537,18 +543,13 @@ MODULE_DEVICE_TABLE(i2c, max44009_id); + static struct i2c_driver max44009_driver = { + .driver = { + .name = MAX44009_DRV_NAME, ++ .of_match_table = max44009_of_match, + }, + .probe = max44009_probe, + .id_table = max44009_id, + }; + module_i2c_driver(max44009_driver); + +-static const struct of_device_id max44009_of_match[] = { +- { .compatible = "maxim,max44009" }, +- { } +-}; +-MODULE_DEVICE_TABLE(of, max44009_of_match); +- + MODULE_AUTHOR("Robert Eshleman "); + MODULE_LICENSE("GPL v2"); + MODULE_DESCRIPTION("MAX44009 ambient light sensor driver"); +-- +2.39.2 + diff --git a/queue-6.2/input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch b/queue-6.2/input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch new file mode 100644 index 00000000000..4b0883a9b5d --- /dev/null +++ b/queue-6.2/input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch @@ -0,0 +1,48 @@ +From b1396768898321a5f82af56c19385c5fc18d6484 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 23:05:20 -0700 +Subject: Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe + +From: Miaoqian Lin + +[ Upstream commit 5bca3688bdbc3b58a2894b8671a8e2378efe28bd ] + +rpi_firmware_get() take reference, we need to release it in error paths +as well. Use devm_rpi_firmware_get() helper to handling the resources. +Also remove the existing rpi_firmware_put(). + +Fixes: 0b9f28fed3f7 ("Input: add official Raspberry Pi's touchscreen driver") +Fixes: 3b8ddff780b7 ("input: raspberrypi-ts: Release firmware handle when not needed") +Signed-off-by: Miaoqian Lin +Reviewed-by: Mattijs Korpershoek +Link: https://lore.kernel.org/r/20221223074657.810346-1-linmq006@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/raspberrypi-ts.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/input/touchscreen/raspberrypi-ts.c b/drivers/input/touchscreen/raspberrypi-ts.c +index 5000f5fd9ec38..45c575df994e0 100644 +--- a/drivers/input/touchscreen/raspberrypi-ts.c ++++ b/drivers/input/touchscreen/raspberrypi-ts.c +@@ -134,7 +134,7 @@ static int rpi_ts_probe(struct platform_device *pdev) + return -ENOENT; + } + +- fw = rpi_firmware_get(fw_node); ++ fw = devm_rpi_firmware_get(&pdev->dev, fw_node); + of_node_put(fw_node); + if (!fw) + return -EPROBE_DEFER; +@@ -160,7 +160,6 @@ static int rpi_ts_probe(struct platform_device *pdev) + touchbuf = (u32)ts->fw_regs_phys; + error = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF, + &touchbuf, sizeof(touchbuf)); +- rpi_firmware_put(fw); + if (error || touchbuf != 0) { + dev_warn(dev, "Failed to set touchbuf, %d\n", error); + return error; +-- +2.39.2 + diff --git a/queue-6.2/interconnect-qcom-drop-obsolete-osm_l3-epss-defines.patch b/queue-6.2/interconnect-qcom-drop-obsolete-osm_l3-epss-defines.patch new file mode 100644 index 00000000000..05abf1719b4 --- /dev/null +++ b/queue-6.2/interconnect-qcom-drop-obsolete-osm_l3-epss-defines.patch @@ -0,0 +1,104 @@ +From fd4ef4f0ae387df26fa3d245cd2cc710385fcad6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jan 2023 06:57:17 +0200 +Subject: interconnect: qcom: drop obsolete OSM_L3/EPSS defines + +From: Dmitry Baryshkov + +[ Upstream commit 4c4161b4c81b632fc29002c324e996cbb79894e7 ] + +Since Qualcomm platforms have switched to the separate OSM_L3/EPSS +driver, old related defines became unused. Drop them now. + +Suggested-by: Bjorn Andersson +Fixes: 4529992c9474 ("interconnect: qcom: osm-l3: Use platform-independent node ids") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230103045717.1079067-1-dmitry.baryshkov@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/sc7180.h | 2 -- + drivers/interconnect/qcom/sc7280.h | 2 -- + drivers/interconnect/qcom/sc8180x.h | 2 -- + drivers/interconnect/qcom/sdm845.h | 2 -- + drivers/interconnect/qcom/sm8150.h | 2 -- + drivers/interconnect/qcom/sm8250.h | 2 -- + 6 files changed, 12 deletions(-) + +diff --git a/drivers/interconnect/qcom/sc7180.h b/drivers/interconnect/qcom/sc7180.h +index c6212a10c2f61..c2d8388bb8809 100644 +--- a/drivers/interconnect/qcom/sc7180.h ++++ b/drivers/interconnect/qcom/sc7180.h +@@ -145,7 +145,5 @@ + #define SC7180_SLAVE_SERVICE_SNOC 134 + #define SC7180_SLAVE_QDSS_STM 135 + #define SC7180_SLAVE_TCU 136 +-#define SC7180_MASTER_OSM_L3_APPS 137 +-#define SC7180_SLAVE_OSM_L3 138 + + #endif +diff --git a/drivers/interconnect/qcom/sc7280.h b/drivers/interconnect/qcom/sc7280.h +index 1fb9839b2c14b..175e400305c51 100644 +--- a/drivers/interconnect/qcom/sc7280.h ++++ b/drivers/interconnect/qcom/sc7280.h +@@ -150,7 +150,5 @@ + #define SC7280_SLAVE_PCIE_1 139 + #define SC7280_SLAVE_QDSS_STM 140 + #define SC7280_SLAVE_TCU 141 +-#define SC7280_MASTER_EPSS_L3_APPS 142 +-#define SC7280_SLAVE_EPSS_L3 143 + + #endif +diff --git a/drivers/interconnect/qcom/sc8180x.h b/drivers/interconnect/qcom/sc8180x.h +index 2eafd35543c78..ce32295af8f3a 100644 +--- a/drivers/interconnect/qcom/sc8180x.h ++++ b/drivers/interconnect/qcom/sc8180x.h +@@ -168,8 +168,6 @@ + #define SC8180X_SLAVE_EBI_CH0_DISPLAY 158 + #define SC8180X_SLAVE_MNOC_SF_MEM_NOC_DISPLAY 159 + #define SC8180X_SLAVE_MNOC_HF_MEM_NOC_DISPLAY 160 +-#define SC8180X_MASTER_OSM_L3_APPS 161 +-#define SC8180X_SLAVE_OSM_L3 162 + + #define SC8180X_MASTER_QUP_CORE_0 163 + #define SC8180X_MASTER_QUP_CORE_1 164 +diff --git a/drivers/interconnect/qcom/sdm845.h b/drivers/interconnect/qcom/sdm845.h +index 776e9c2acb278..bc7e425ce9852 100644 +--- a/drivers/interconnect/qcom/sdm845.h ++++ b/drivers/interconnect/qcom/sdm845.h +@@ -136,7 +136,5 @@ + #define SDM845_SLAVE_SERVICE_SNOC 128 + #define SDM845_SLAVE_QDSS_STM 129 + #define SDM845_SLAVE_TCU 130 +-#define SDM845_MASTER_OSM_L3_APPS 131 +-#define SDM845_SLAVE_OSM_L3 132 + + #endif /* __DRIVERS_INTERCONNECT_QCOM_SDM845_H__ */ +diff --git a/drivers/interconnect/qcom/sm8150.h b/drivers/interconnect/qcom/sm8150.h +index 97996f64d799c..3e01ac76ae1db 100644 +--- a/drivers/interconnect/qcom/sm8150.h ++++ b/drivers/interconnect/qcom/sm8150.h +@@ -148,7 +148,5 @@ + #define SM8150_SLAVE_VSENSE_CTRL_CFG 137 + #define SM8150_SNOC_CNOC_MAS 138 + #define SM8150_SNOC_CNOC_SLV 139 +-#define SM8150_MASTER_OSM_L3_APPS 140 +-#define SM8150_SLAVE_OSM_L3 141 + + #endif +diff --git a/drivers/interconnect/qcom/sm8250.h b/drivers/interconnect/qcom/sm8250.h +index b31fb431a20fc..7eb6c709c30d1 100644 +--- a/drivers/interconnect/qcom/sm8250.h ++++ b/drivers/interconnect/qcom/sm8250.h +@@ -158,7 +158,5 @@ + #define SM8250_SLAVE_VSENSE_CTRL_CFG 147 + #define SM8250_SNOC_CNOC_MAS 148 + #define SM8250_SNOC_CNOC_SLV 149 +-#define SM8250_MASTER_EPSS_L3_APPS 150 +-#define SM8250_SLAVE_EPSS_L3 151 + + #endif +-- +2.39.2 + diff --git a/queue-6.2/interconnect-qcom-osm-l3-drop-unuserd-header-inclusi.patch b/queue-6.2/interconnect-qcom-osm-l3-drop-unuserd-header-inclusi.patch new file mode 100644 index 00000000000..a1df85233ee --- /dev/null +++ b/queue-6.2/interconnect-qcom-osm-l3-drop-unuserd-header-inclusi.patch @@ -0,0 +1,45 @@ +From ef7c39eb3c22c85343303194e9fa49ad89b341bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jan 2023 05:11:59 +0200 +Subject: interconnect: qcom: osm-l3: drop unuserd header inclusion + +From: Dmitry Baryshkov + +[ Upstream commit f730038fe6a6de170268fd779b2c029aa70a928b ] + +The commit 4529992c9474 ("interconnect: qcom: osm-l3: Use +platform-independent node ids") made osm-l3 driver use +platform-independent IDs, removing the need to include platform headers. + +Fixes: 4529992c9474 ("interconnect: qcom: osm-l3: Use platform-independent node ids") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Bjorn Andersson +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230103031159.1060075-1-dmitry.baryshkov@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/osm-l3.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/drivers/interconnect/qcom/osm-l3.c b/drivers/interconnect/qcom/osm-l3.c +index 1bafb54f14329..a1f4f918b9116 100644 +--- a/drivers/interconnect/qcom/osm-l3.c ++++ b/drivers/interconnect/qcom/osm-l3.c +@@ -14,13 +14,6 @@ + + #include + +-#include "sc7180.h" +-#include "sc7280.h" +-#include "sc8180x.h" +-#include "sdm845.h" +-#include "sm8150.h" +-#include "sm8250.h" +- + #define LUT_MAX_ENTRIES 40U + #define LUT_SRC GENMASK(31, 30) + #define LUT_L_VAL GENMASK(7, 0) +-- +2.39.2 + diff --git a/queue-6.2/interconnect-qcom-rpm-drop-bogus-pm-domain-attach.patch b/queue-6.2/interconnect-qcom-rpm-drop-bogus-pm-domain-attach.patch new file mode 100644 index 00000000000..bc786c2716e --- /dev/null +++ b/queue-6.2/interconnect-qcom-rpm-drop-bogus-pm-domain-attach.patch @@ -0,0 +1,82 @@ +From 0e4e3bf97297b5847e7f1c9b6a84d594ac8eed52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 09:49:53 +0100 +Subject: interconnect: qcom: rpm: drop bogus pm domain attach + +From: Johan Hovold + +[ Upstream commit 72b2720c18ecde92e6a36c4ac897dd5848e3f379 ] + +Any power domain would already have been attached by the platform bus +code so drop the bogus power domain attach which always succeeds from +probe. + +This effectively reverts commit 7de109c0abe9 ("interconnect: icc-rpm: +Add support for bus power domain"). + +Fixes: 7de109c0abe9 ("interconnect: icc-rpm: Add support for bus power domain") +Cc: Yassine Oudjana +Signed-off-by: Johan Hovold +Tested-by: Konrad Dybcio # MSM8996 Sony Kagura +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230313084953.24088-3-johan+linaro@kernel.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/icc-rpm.c | 7 ------- + drivers/interconnect/qcom/icc-rpm.h | 1 - + drivers/interconnect/qcom/msm8996.c | 1 - + 3 files changed, 9 deletions(-) + +diff --git a/drivers/interconnect/qcom/icc-rpm.c b/drivers/interconnect/qcom/icc-rpm.c +index 4180a06681b2b..c80819557923e 100644 +--- a/drivers/interconnect/qcom/icc-rpm.c ++++ b/drivers/interconnect/qcom/icc-rpm.c +@@ -11,7 +11,6 @@ + #include + #include + #include +-#include + #include + #include + +@@ -496,12 +495,6 @@ int qnoc_probe(struct platform_device *pdev) + if (ret) + return ret; + +- if (desc->has_bus_pd) { +- ret = dev_pm_domain_attach(dev, true); +- if (ret) +- return ret; +- } +- + provider = &qp->provider; + provider->dev = dev; + provider->set = qcom_icc_set; +diff --git a/drivers/interconnect/qcom/icc-rpm.h b/drivers/interconnect/qcom/icc-rpm.h +index a49af844ab13e..02257b0d3d5c6 100644 +--- a/drivers/interconnect/qcom/icc-rpm.h ++++ b/drivers/interconnect/qcom/icc-rpm.h +@@ -91,7 +91,6 @@ struct qcom_icc_desc { + size_t num_nodes; + const char * const *clocks; + size_t num_clocks; +- bool has_bus_pd; + enum qcom_icc_type type; + const struct regmap_config *regmap_cfg; + unsigned int qos_offset; +diff --git a/drivers/interconnect/qcom/msm8996.c b/drivers/interconnect/qcom/msm8996.c +index 25a1a32bc611f..14efd2761b7ab 100644 +--- a/drivers/interconnect/qcom/msm8996.c ++++ b/drivers/interconnect/qcom/msm8996.c +@@ -1823,7 +1823,6 @@ static const struct qcom_icc_desc msm8996_a0noc = { + .num_nodes = ARRAY_SIZE(a0noc_nodes), + .clocks = bus_a0noc_clocks, + .num_clocks = ARRAY_SIZE(bus_a0noc_clocks), +- .has_bus_pd = true, + .regmap_cfg = &msm8996_a0noc_regmap_config + }; + +-- +2.39.2 + diff --git a/queue-6.2/io_uring-rsrc-use-nospec-ed-indexes.patch b/queue-6.2/io_uring-rsrc-use-nospec-ed-indexes.patch new file mode 100644 index 00000000000..bab9ad7bef6 --- /dev/null +++ b/queue-6.2/io_uring-rsrc-use-nospec-ed-indexes.patch @@ -0,0 +1,37 @@ +From 0748441f179cf0c61bdd27362d8358c0316d76f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 15:28:05 +0100 +Subject: io_uring/rsrc: use nospec'ed indexes + +From: Pavel Begunkov + +[ Upstream commit 953c37e066f05a3dca2d74643574b8dfe8a83983 ] + +We use array_index_nospec() for registered buffer indexes, but don't use +it while poking into rsrc tags, fix that. + +Fixes: 634d00df5e1cf ("io_uring: add full-fledged dynamic buffers support") +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/f02fafc5a9c0dd69be2b0618c38831c078232ff0.1681395792.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/rsrc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c +index 4ccfc29216269..e100f040371b5 100644 +--- a/io_uring/rsrc.c ++++ b/io_uring/rsrc.c +@@ -577,7 +577,7 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx, + } + + ctx->user_bufs[i] = imu; +- *io_get_tag_slot(ctx->buf_data, offset) = tag; ++ *io_get_tag_slot(ctx->buf_data, i) = tag; + } + + if (needs_switch) +-- +2.39.2 + diff --git a/queue-6.2/iommu-amd-set-page-size-bitmap-during-v2-domain-allo.patch b/queue-6.2/iommu-amd-set-page-size-bitmap-during-v2-domain-allo.patch new file mode 100644 index 00000000000..4ff7071bb9c --- /dev/null +++ b/queue-6.2/iommu-amd-set-page-size-bitmap-during-v2-domain-allo.patch @@ -0,0 +1,84 @@ +From f04f289ecd8c89b803860d6222c26d123004b646 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 00:27:42 -0700 +Subject: iommu/amd: Set page size bitmap during V2 domain allocation + +From: Jerry Snitselaar + +[ Upstream commit 8f880d19e6ad645a4b8066d5ff091c980b3231e7 ] + +With the addition of the V2 page table support, the domain page size +bitmap needs to be set prior to iommu core setting up direct mappings +for reserved regions. When reserved regions are mapped, if this is not +done, it will be looking at the V1 page size bitmap when determining +the page size to use in iommu_pgsize(). When it gets into the actual +amd mapping code, a check of see if the page size is supported can +fail, because at that point it is checking it against the V2 page size +bitmap which only supports 4K, 2M, and 1G. + +Add a check to __iommu_domain_alloc() to not override the +bitmap if it was already set by the iommu ops domain_alloc() code path. + +Cc: Vasant Hegde +Cc: Suravee Suthikulpanit +Cc: Robin Murphy +Cc: Will Deacon +Cc: Joerg Roedel +Fixes: 4db6c41f0946 ("iommu/amd: Add support for using AMD IOMMU v2 page table for DMA-API") +Signed-off-by: Jerry Snitselaar +Reviewed-by: Vasant Hegde +Link: https://lore.kernel.org/r/20230404072742.1895252-1-jsnitsel@redhat.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/iommu.c | 6 ++---- + drivers/iommu/iommu.c | 9 +++++++-- + 2 files changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index ff4f3d4da3402..e108280fdaa0e 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -1656,10 +1656,6 @@ static void do_attach(struct iommu_dev_data *dev_data, + domain->dev_iommu[iommu->index] += 1; + domain->dev_cnt += 1; + +- /* Override supported page sizes */ +- if (domain->flags & PD_GIOV_MASK) +- domain->domain.pgsize_bitmap = AMD_IOMMU_PGSIZES_V2; +- + /* Update device table */ + set_dte_entry(iommu, dev_data->devid, domain, + ats, dev_data->iommu_v2); +@@ -2038,6 +2034,8 @@ static int protection_domain_init_v2(struct protection_domain *domain) + + domain->flags |= PD_GIOV_MASK; + ++ domain->domain.pgsize_bitmap = AMD_IOMMU_PGSIZES_V2; ++ + if (domain_enable_v2(domain, 1)) { + domain_id_free(domain->id); + return -ENOMEM; +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index f8100067502fb..e6f2a0bc9f0be 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -1940,8 +1940,13 @@ static struct iommu_domain *__iommu_domain_alloc(struct bus_type *bus, + return NULL; + + domain->type = type; +- /* Assume all sizes by default; the driver may override this later */ +- domain->pgsize_bitmap = bus->iommu_ops->pgsize_bitmap; ++ /* ++ * If not already set, assume all sizes by default; the driver ++ * may override this later ++ */ ++ if (!domain->pgsize_bitmap) ++ domain->pgsize_bitmap = bus->iommu_ops->pgsize_bitmap; ++ + if (!domain->ops) + domain->ops = bus->iommu_ops->default_domain_ops; + +-- +2.39.2 + diff --git a/queue-6.2/iommu-mediatek-set-dma_mask-for-pgtable_pa_35_en.patch b/queue-6.2/iommu-mediatek-set-dma_mask-for-pgtable_pa_35_en.patch new file mode 100644 index 00000000000..352d72e841f --- /dev/null +++ b/queue-6.2/iommu-mediatek-set-dma_mask-for-pgtable_pa_35_en.patch @@ -0,0 +1,45 @@ +From cdc93e95ce8714cdadd703f0826f7243b720fcfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 18:14:45 +0800 +Subject: iommu/mediatek: Set dma_mask for PGTABLE_PA_35_EN + +From: Yong Wu + +[ Upstream commit f045e9df6537175d02565f21616ac1a9dd59b61c ] + +When we enable PGTABLE_PA_35_EN, the PA for pgtable may be 35bits. +Thus add dma_mask for it. + +Fixes: 301c3ca12576 ("iommu/mediatek: Allow page table PA up to 35bit") +Signed-off-by: Chengci.Xu +Signed-off-by: Yong Wu +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230316101445.12443-1-yong.wu@mediatek.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/mtk_iommu.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c +index 2badd6acfb23d..4ef71afb9525a 100644 +--- a/drivers/iommu/mtk_iommu.c ++++ b/drivers/iommu/mtk_iommu.c +@@ -1267,6 +1267,14 @@ static int mtk_iommu_probe(struct platform_device *pdev) + return PTR_ERR(data->bclk); + } + ++ if (MTK_IOMMU_HAS_FLAG(data->plat_data, PGTABLE_PA_35_EN)) { ++ ret = dma_set_mask(dev, DMA_BIT_MASK(35)); ++ if (ret) { ++ dev_err(dev, "Failed to set dma_mask 35.\n"); ++ return ret; ++ } ++ } ++ + pm_runtime_enable(dev); + + if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) { +-- +2.39.2 + diff --git a/queue-6.2/iommufd-selftest-catch-overflow-of-uptr-and-length.patch b/queue-6.2/iommufd-selftest-catch-overflow-of-uptr-and-length.patch new file mode 100644 index 00000000000..df71d073293 --- /dev/null +++ b/queue-6.2/iommufd-selftest-catch-overflow-of-uptr-and-length.patch @@ -0,0 +1,82 @@ +From cb7326206513887d7faeb9f32caad615a524cc81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 13:27:04 -0400 +Subject: iommufd/selftest: Catch overflow of uptr and length + +From: Jason Gunthorpe + +[ Upstream commit fd8c1a4aee973e87d890a5861e106625a33b2c4e ] + +syzkaller hits a WARN_ON when trying to have a uptr close to UINTPTR_MAX: + + WARNING: CPU: 1 PID: 393 at drivers/iommu/iommufd/selftest.c:403 iommufd_test+0xb19/0x16f0 + Modules linked in: + CPU: 1 PID: 393 Comm: repro Not tainted 6.2.0-c9c3395d5e3d #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 + RIP: 0010:iommufd_test+0xb19/0x16f0 + Code: 94 c4 31 ff 44 89 e6 e8 a5 54 17 ff 45 84 e4 0f 85 bb 0b 00 00 41 be fb ff ff ff e8 31 53 17 ff e9 a0 f7 ff ff e8 27 53 17 ff <0f> 0b 41 be 8 + RSP: 0018:ffffc90000eabdc0 EFLAGS: 00010246 + RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8214c487 + RDX: 0000000000000000 RSI: ffff88800f5c8000 RDI: 0000000000000002 + RBP: ffffc90000eabe48 R08: 0000000000000000 R09: 0000000000000001 + R10: 0000000000000001 R11: 0000000000000000 R12: 00000000cd2b0000 + R13: 00000000cd2af000 R14: 0000000000000000 R15: ffffc90000eabe68 + FS: 00007f94d76d5740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000020000043 CR3: 0000000006880006 CR4: 0000000000770ee0 + PKRU: 55555554 + Call Trace: + + ? write_comp_data+0x2f/0x90 + iommufd_fops_ioctl+0x1ef/0x310 + __x64_sys_ioctl+0x10e/0x160 + ? __pfx_iommufd_fops_ioctl+0x10/0x10 + do_syscall_64+0x3b/0x90 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Check that the user memory range doesn't overflow. + +Fixes: f4b20bb34c83 ("iommufd: Add kernel support for testing iommufd") +Link: https://lore.kernel.org/r/0-v1-95390ed1df8d+8f-iommufd_mock_overflow_jgg@nvidia.com +Reviewed-by: Kevin Tian +Reported-by: Pengfei Xu +Link: https://lore.kernel.org/r/Y/hOiilV1wJvu/Hv@xpf.sh.intel.com +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommufd/selftest.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c +index cfb5fe9a5e0ee..76c46847dc494 100644 +--- a/drivers/iommu/iommufd/selftest.c ++++ b/drivers/iommu/iommufd/selftest.c +@@ -339,10 +339,12 @@ static int iommufd_test_md_check_pa(struct iommufd_ucmd *ucmd, + { + struct iommufd_hw_pagetable *hwpt; + struct mock_iommu_domain *mock; ++ uintptr_t end; + int rc; + + if (iova % MOCK_IO_PAGE_SIZE || length % MOCK_IO_PAGE_SIZE || +- (uintptr_t)uptr % MOCK_IO_PAGE_SIZE) ++ (uintptr_t)uptr % MOCK_IO_PAGE_SIZE || ++ check_add_overflow((uintptr_t)uptr, (uintptr_t)length, &end)) + return -EINVAL; + + hwpt = get_md_pagetable(ucmd, mockpt_id, &mock); +@@ -390,7 +392,10 @@ static int iommufd_test_md_check_refs(struct iommufd_ucmd *ucmd, + void __user *uptr, size_t length, + unsigned int refs) + { +- if (length % PAGE_SIZE || (uintptr_t)uptr % PAGE_SIZE) ++ uintptr_t end; ++ ++ if (length % PAGE_SIZE || (uintptr_t)uptr % PAGE_SIZE || ++ check_add_overflow((uintptr_t)uptr, (uintptr_t)length, &end)) + return -EINVAL; + + for (; length; length -= PAGE_SIZE) { +-- +2.39.2 + diff --git a/queue-6.2/ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch b/queue-6.2/ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch new file mode 100644 index 00000000000..b40f3b233cf --- /dev/null +++ b/queue-6.2/ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch @@ -0,0 +1,51 @@ +From c4e8c5b05bb2c21dc2fa7e290ed90072483a447b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Feb 2023 21:39:46 -0800 +Subject: ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on + it + +From: Randy Dunlap + +[ Upstream commit 2a587b9ad052e7e92e508aea90c1e2ae433c1908 ] + +REGMAP is a hidden (not user visible) symbol. Users cannot set it +directly thru "make *config", so drivers should select it instead of +depending on it if they need it. + +Consistently using "select" or "depends on" can also help reduce +Kconfig circular dependency issues. + +Therefore, change the use of "depends on REGMAP_MMIO" to +"select REGMAP_MMIO", which will also set REGMAP. + +Fixes: eb994594bc22 ("ipmi: bt-bmc: Use a regmap for register access") +Signed-off-by: Randy Dunlap +Cc: Andrew Jeffery +Cc: Corey Minyard +Cc: openipmi-developer@lists.sourceforge.net +Cc: Arnd Bergmann +Cc: Greg Kroah-Hartman +Message-Id: <20230226053953.4681-2-rdunlap@infradead.org> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/char/ipmi/Kconfig b/drivers/char/ipmi/Kconfig +index b6c0d35fc1a5f..f4adc6feb3b22 100644 +--- a/drivers/char/ipmi/Kconfig ++++ b/drivers/char/ipmi/Kconfig +@@ -162,7 +162,8 @@ config IPMI_KCS_BMC_SERIO + + config ASPEED_BT_IPMI_BMC + depends on ARCH_ASPEED || COMPILE_TEST +- depends on REGMAP && REGMAP_MMIO && MFD_SYSCON ++ depends on MFD_SYSCON ++ select REGMAP_MMIO + tristate "BT IPMI bmc driver" + help + Provides a driver for the BT (Block Transfer) IPMI interface +-- +2.39.2 + diff --git a/queue-6.2/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch b/queue-6.2/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch new file mode 100644 index 00000000000..6211bb45ff6 --- /dev/null +++ b/queue-6.2/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch @@ -0,0 +1,56 @@ +From 205e193aa209b4e4c681addb6838ab435e5e7cb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 20:40:35 +0800 +Subject: ipv4: Fix potential uninit variable access bug in __ip_make_skb() + +From: Ziyang Xuan + +[ Upstream commit 99e5acae193e369b71217efe6f1dad42f3f18815 ] + +Like commit ea30388baebc ("ipv6: Fix an uninit variable access bug in +__ip6_make_skb()"). icmphdr does not in skb linear region under the +scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will +trigger the uninit variable access bug. + +Use a local variable icmp_type to carry the correct value in different +scenarios. + +Fixes: 96793b482540 ("[IPV4]: Add ICMPMsgStats MIB (RFC 4293)") +Reviewed-by: Willem de Bruijn +Signed-off-by: Ziyang Xuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_output.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index 922c87ef1ab58..2a07588265c70 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1570,9 +1570,19 @@ struct sk_buff *__ip_make_skb(struct sock *sk, + cork->dst = NULL; + skb_dst_set(skb, &rt->dst); + +- if (iph->protocol == IPPROTO_ICMP) +- icmp_out_count(net, ((struct icmphdr *) +- skb_transport_header(skb))->type); ++ if (iph->protocol == IPPROTO_ICMP) { ++ u8 icmp_type; ++ ++ /* For such sockets, transhdrlen is zero when do ip_append_data(), ++ * so icmphdr does not in skb linear region and can not get icmp_type ++ * by icmp_hdr(skb)->type. ++ */ ++ if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl) ++ icmp_type = fl4->fl4_icmp_type; ++ else ++ icmp_type = icmp_hdr(skb)->type; ++ icmp_out_count(net, icmp_type); ++ } + + ip_cork_release(cork); + out: +-- +2.39.2 + diff --git a/queue-6.2/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch b/queue-6.2/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch new file mode 100644 index 00000000000..1987d8fac69 --- /dev/null +++ b/queue-6.2/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch @@ -0,0 +1,68 @@ +From 2d1619d867381b2a8cad312f6bd38607ddb1c083 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 19:12:22 +0000 +Subject: ixgbe: Allow flow hash to be set via ethtool + +From: Joe Damato + +[ Upstream commit 4f3ed1293feb9502dc254b05802faf1ad3317ac6 ] + +ixgbe currently returns `EINVAL` whenever the flowhash it set by ethtool +because the ethtool code in the kernel passes a non-zero value for hfunc +that ixgbe should allow. + +When ethtool is called with `ETHTOOL_SRXFHINDIR`, +`ethtool_set_rxfh_indir` will call ixgbe's set_rxfh function +with `ETH_RSS_HASH_NO_CHANGE`. This value should be accepted. + +When ethtool is called with `ETHTOOL_SRSSH`, `ethtool_set_rxfh` will +call ixgbe's set_rxfh function with `rxfh.hfunc`, which appears to be +hardcoded in ixgbe to always be `ETH_RSS_HASH_TOP`. This value should +also be accepted. + +Before this patch: + +$ sudo ethtool -L eth1 combined 10 +$ sudo ethtool -X eth1 default +Cannot set RX flow hash configuration: Invalid argument + +After this patch: + +$ sudo ethtool -L eth1 combined 10 +$ sudo ethtool -X eth1 default +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 10 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 0 1 2 3 4 5 + 16: 6 7 8 9 0 1 2 3 + 24: 4 5 6 7 8 9 0 1 + ... + +Fixes: 1c7cf0784e4d ("ixgbe: support for ethtool set_rxfh") +Signed-off-by: Joe Damato +Reviewed-by: Sridhar Samudrala +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +index 6cfc9dc165378..821dfd323fa9a 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +@@ -3131,8 +3131,8 @@ static int ixgbe_set_rxfh(struct net_device *netdev, const u32 *indir, + int i; + u32 reta_entries = ixgbe_rss_indir_tbl_entries(adapter); + +- if (hfunc) +- return -EINVAL; ++ if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP) ++ return -EOPNOTSUPP; + + /* Fill out the redirection table */ + if (indir) { +-- +2.39.2 + diff --git a/queue-6.2/ixgbe-enable-setting-rss-table-to-default-values.patch b/queue-6.2/ixgbe-enable-setting-rss-table-to-default-values.patch new file mode 100644 index 00000000000..9ccbd11ba42 --- /dev/null +++ b/queue-6.2/ixgbe-enable-setting-rss-table-to-default-values.patch @@ -0,0 +1,147 @@ +From cc669d8e2681b1e4ab88bba076a59ef71dea0566 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 19:12:23 +0000 +Subject: ixgbe: Enable setting RSS table to default values + +From: Joe Damato + +[ Upstream commit e85d3d55875f7a1079edfbc4e4e98d6f8aea9ac7 ] + +ethtool uses `ETHTOOL_GRXRINGS` to compute how many queues are supported +by RSS. The driver should return the smaller of either: + - The maximum number of RSS queues the device supports, OR + - The number of RX queues configured + +Prior to this change, running `ethtool -X $iface default` fails if the +number of queues configured is larger than the number supported by RSS, +even though changing the queue count correctly resets the flowhash to +use all supported queues. + +Other drivers (for example, i40e) will succeed but the flow hash will +reset to support the maximum number of queues supported by RSS, even if +that amount is smaller than the configured amount. + +Prior to this change: + +$ sudo ethtool -L eth1 combined 20 +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 20 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 10 11 12 13 14 15 + 16: 0 1 2 3 4 5 6 7 + 24: 8 9 10 11 12 13 14 15 + 32: 0 1 2 3 4 5 6 7 +... + +You can see that the flowhash was correctly set to use the maximum +number of queues supported by the driver (16). + +However, asking the NIC to reset to "default" fails: + +$ sudo ethtool -X eth1 default +Cannot set RX flow hash configuration: Invalid argument + +After this change, the flowhash can be reset to default which will use +all of the available RSS queues (16) or the configured queue count, +whichever is smaller. + +Starting with eth1 which has 10 queues and a flowhash distributing to +all 10 queues: + +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 10 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 0 1 2 3 4 5 + 16: 6 7 8 9 0 1 2 3 +... + +Increasing the queue count to 48 resets the flowhash to distribute to 16 +queues, as it did before this patch: + +$ sudo ethtool -L eth1 combined 48 +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 16 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 10 11 12 13 14 15 + 16: 0 1 2 3 4 5 6 7 +... + +Due to the other bugfix in this series, the flowhash can be set to use +queues 0-5: + +$ sudo ethtool -X eth1 equal 5 +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 16 RX ring(s): + 0: 0 1 2 3 4 0 1 2 + 8: 3 4 0 1 2 3 4 0 + 16: 1 2 3 4 0 1 2 3 +... + +Due to this bugfix, the flowhash can be reset to default and use 16 +queues: + +$ sudo ethtool -X eth1 default +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 16 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 10 11 12 13 14 15 + 16: 0 1 2 3 4 5 6 7 +... + +Fixes: 91cd94bfe4f0 ("ixgbe: add basic support for setting and getting nfc controls") +Signed-off-by: Joe Damato +Reviewed-by: Sridhar Samudrala +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +index 821dfd323fa9a..0bbad4a5cc2f5 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +@@ -2665,6 +2665,14 @@ static int ixgbe_get_rss_hash_opts(struct ixgbe_adapter *adapter, + return 0; + } + ++static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter) ++{ ++ if (adapter->hw.mac.type < ixgbe_mac_X550) ++ return 16; ++ else ++ return 64; ++} ++ + static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd, + u32 *rule_locs) + { +@@ -2673,7 +2681,8 @@ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd, + + switch (cmd->cmd) { + case ETHTOOL_GRXRINGS: +- cmd->data = adapter->num_rx_queues; ++ cmd->data = min_t(int, adapter->num_rx_queues, ++ ixgbe_rss_indir_tbl_max(adapter)); + ret = 0; + break; + case ETHTOOL_GRXCLSRLCNT: +@@ -3075,14 +3084,6 @@ static int ixgbe_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd) + return ret; + } + +-static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter) +-{ +- if (adapter->hw.mac.type < ixgbe_mac_X550) +- return 16; +- else +- return 64; +-} +- + static u32 ixgbe_get_rxfh_key_size(struct net_device *netdev) + { + return IXGBE_RSS_KEY_SIZE; +-- +2.39.2 + diff --git a/queue-6.2/jdb2-don-t-refuse-invalidation-of-already-invalidate.patch b/queue-6.2/jdb2-don-t-refuse-invalidation-of-already-invalidate.patch new file mode 100644 index 00000000000..e47eed6e197 --- /dev/null +++ b/queue-6.2/jdb2-don-t-refuse-invalidation-of-already-invalidate.patch @@ -0,0 +1,44 @@ +From 62812d3eed389738d0cac0fdde9ab77cbda84d1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 17:49:32 +0200 +Subject: jdb2: Don't refuse invalidation of already invalidated buffers + +From: Jan Kara + +[ Upstream commit bd159398a2d2234de07d310132865706964aaaa7 ] + +When invalidating buffers under the partial tail page, +jbd2_journal_invalidate_folio() returns -EBUSY if the buffer is part of +the committing transaction as we cannot safely modify buffer state. +However if the buffer is already invalidated (due to previous +invalidation attempts from ext4_wait_for_tail_page_commit()), there's +nothing to do and there's no point in returning -EBUSY. This fixes +occasional warnings from ext4_journalled_invalidate_folio() triggered by +generic/051 fstest when blocksize < pagesize. + +Fixes: 53e872681fed ("ext4: fix deadlock in journal_unmap_buffer()") +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20230329154950.19720-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/transaction.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index 15de1385012eb..18611241f4513 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -2387,6 +2387,9 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh, + spin_unlock(&jh->b_state_lock); + write_unlock(&journal->j_state_lock); + jbd2_journal_put_journal_head(jh); ++ /* Already zapped buffer? Nothing to do... */ ++ if (!bh->b_bdev) ++ return 0; + return -EBUSY; + } + /* +-- +2.39.2 + diff --git a/queue-6.2/kunit-fix-bug-in-the-order-of-lines-in-debugfs-logs.patch b/queue-6.2/kunit-fix-bug-in-the-order-of-lines-in-debugfs-logs.patch new file mode 100644 index 00000000000..f6dc271a409 --- /dev/null +++ b/queue-6.2/kunit-fix-bug-in-the-order-of-lines-in-debugfs-logs.patch @@ -0,0 +1,129 @@ +From 78d4c81550d2abf3aacebdb481a3f8e5e115e70b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 20:39:51 +0000 +Subject: kunit: fix bug in the order of lines in debugfs logs + +From: Rae Moar + +[ Upstream commit f9a301c3317daa921375da0aec82462ddf019928 ] + +Fix bug in debugfs logs that causes an incorrect order of lines in the +debugfs log. + +Currently, the test counts lines that show the number of tests passed, +failed, and skipped, as well as any suite diagnostic lines, +appear prior to the individual results, which is a bug. + +Ensure the order of printing for the debugfs log is correct. Additionally, +add a KTAP header to so the debugfs logs can be valid KTAP. + +This is an example of a log prior to these fixes: + + KTAP version 1 + + # Subtest: kunit_status + 1..2 + # kunit_status: pass:2 fail:0 skip:0 total:2 + # Totals: pass:2 fail:0 skip:0 total:2 + ok 1 kunit_status_set_failure_test + ok 2 kunit_status_mark_skipped_test + ok 1 kunit_status + +Note the two lines with stats are out of order. This is the same debugfs +log after the fixes (in combination with the third patch to remove the +extra line): + + KTAP version 1 + 1..1 + KTAP version 1 + # Subtest: kunit_status + 1..2 + ok 1 kunit_status_set_failure_test + ok 2 kunit_status_mark_skipped_test + # kunit_status: pass:2 fail:0 skip:0 total:2 + # Totals: pass:2 fail:0 skip:0 total:2 + ok 1 kunit_status + +Signed-off-by: Rae Moar +Reviewed-by: David Gow +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + lib/kunit/debugfs.c | 14 ++++++++++++-- + lib/kunit/test.c | 21 ++++++++++++++------- + 2 files changed, 26 insertions(+), 9 deletions(-) + +diff --git a/lib/kunit/debugfs.c b/lib/kunit/debugfs.c +index de0ee2e03ed60..b08bb1fba106d 100644 +--- a/lib/kunit/debugfs.c ++++ b/lib/kunit/debugfs.c +@@ -55,14 +55,24 @@ static int debugfs_print_results(struct seq_file *seq, void *v) + enum kunit_status success = kunit_suite_has_succeeded(suite); + struct kunit_case *test_case; + +- if (!suite || !suite->log) ++ if (!suite) + return 0; + +- seq_printf(seq, "%s", suite->log); ++ /* Print KTAP header so the debugfs log can be parsed as valid KTAP. */ ++ seq_puts(seq, "KTAP version 1\n"); ++ seq_puts(seq, "1..1\n"); ++ ++ /* Print suite header because it is not stored in the test logs. */ ++ seq_puts(seq, KUNIT_SUBTEST_INDENT "KTAP version 1\n"); ++ seq_printf(seq, KUNIT_SUBTEST_INDENT "# Subtest: %s\n", suite->name); ++ seq_printf(seq, KUNIT_SUBTEST_INDENT "1..%zd\n", kunit_suite_num_test_cases(suite)); + + kunit_suite_for_each_test_case(suite, test_case) + debugfs_print_result(seq, suite, test_case); + ++ if (suite->log) ++ seq_printf(seq, "%s", suite->log); ++ + seq_printf(seq, "%s %d %s\n", + kunit_status_to_ok_not_ok(success), 1, suite->name); + return 0; +diff --git a/lib/kunit/test.c b/lib/kunit/test.c +index 890ba5b3a9819..820f867e35f40 100644 +--- a/lib/kunit/test.c ++++ b/lib/kunit/test.c +@@ -152,10 +152,18 @@ EXPORT_SYMBOL_GPL(kunit_suite_num_test_cases); + + static void kunit_print_suite_start(struct kunit_suite *suite) + { +- kunit_log(KERN_INFO, suite, KUNIT_SUBTEST_INDENT "KTAP version 1\n"); +- kunit_log(KERN_INFO, suite, KUNIT_SUBTEST_INDENT "# Subtest: %s", ++ /* ++ * We do not log the test suite header as doing so would ++ * mean debugfs display would consist of the test suite ++ * header prior to individual test results. ++ * Hence directly printk the suite status, and we will ++ * separately seq_printf() the suite header for the debugfs ++ * representation. ++ */ ++ pr_info(KUNIT_SUBTEST_INDENT "KTAP version 1\n"); ++ pr_info(KUNIT_SUBTEST_INDENT "# Subtest: %s\n", + suite->name); +- kunit_log(KERN_INFO, suite, KUNIT_SUBTEST_INDENT "1..%zd", ++ pr_info(KUNIT_SUBTEST_INDENT "1..%zd\n", + kunit_suite_num_test_cases(suite)); + } + +@@ -172,10 +180,9 @@ static void kunit_print_ok_not_ok(void *test_or_suite, + + /* + * We do not log the test suite results as doing so would +- * mean debugfs display would consist of the test suite +- * description and status prior to individual test results. +- * Hence directly printk the suite status, and we will +- * separately seq_printf() the suite status for the debugfs ++ * mean debugfs display would consist of an incorrect test ++ * number. Hence directly printk the suite result, and we will ++ * separately seq_printf() the suite results for the debugfs + * representation. + */ + if (suite) +-- +2.39.2 + diff --git a/queue-6.2/leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch b/queue-6.2/leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch new file mode 100644 index 00000000000..0673c9d5126 --- /dev/null +++ b/queue-6.2/leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch @@ -0,0 +1,62 @@ +From e723fafc0eedcaaf98eb1aebd3516ea4332f42a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Apr 2023 13:12:59 +0200 +Subject: leds: tca6507: Fix error handling of using + fwnode_property_read_string +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: H. Nikolaus Schaller + +[ Upstream commit c1087c29e96a48e9080377e168d35dcb52fb068b ] + +Commit 96f524105b9c ("leds: tca6507: use fwnode API instead of OF") + +changed to fwnode API but did not take into account that a missing property +"linux,default-trigger" now seems to return an error and as a side effect +sets value to -1. This seems to be different from of_get_property() which +always returned NULL in any case of error. + +Neglecting this side-effect leads to + +[ 11.201965] Unable to handle kernel paging request at virtual address ffffffff when read + +in the strcmp() of led_trigger_set_default() if there is no led-trigger +defined in the DTS. + +I don't know if this was recently introduced somewhere in the fwnode lib +or if the effect was missed in initial testing. Anyways it seems to be a +bug to ignore the error return value of an optional value here in the +driver. + +Fixes: 96f524105b9c ("leds: tca6507: use fwnode API instead of OF") +Signed-off-by: H. Nikolaus Schaller +Acked-by: Pavel Machek +Reviewed-by: Marek Behún +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/cbae7617db83113de726fcc423a805ebaa1bfca6.1680433978.git.hns@goldelico.com +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-tca6507.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/leds/leds-tca6507.c b/drivers/leds/leds-tca6507.c +index 161bef65c6b7b..62a968613cc37 100644 +--- a/drivers/leds/leds-tca6507.c ++++ b/drivers/leds/leds-tca6507.c +@@ -691,8 +691,9 @@ tca6507_led_dt_init(struct device *dev) + if (fwnode_property_read_string(child, "label", &led.name)) + led.name = fwnode_get_name(child); + +- fwnode_property_read_string(child, "linux,default-trigger", +- &led.default_trigger); ++ if (fwnode_property_read_string(child, "linux,default-trigger", ++ &led.default_trigger)) ++ led.default_trigger = NULL; + + led.flags = 0; + if (fwnode_property_match_string(child, "compatible", +-- +2.39.2 + diff --git a/queue-6.2/leds-ti_lmu_common-select-regmap-instead-of-dependin.patch b/queue-6.2/leds-ti_lmu_common-select-regmap-instead-of-dependin.patch new file mode 100644 index 00000000000..05e10321861 --- /dev/null +++ b/queue-6.2/leds-ti_lmu_common-select-regmap-instead-of-dependin.patch @@ -0,0 +1,44 @@ +From 6669ad8a2cd342e88e67cced73d6f483425c6f16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Feb 2023 21:39:49 -0800 +Subject: leds: TI_LMU_COMMON: select REGMAP instead of depending on it + +From: Randy Dunlap + +[ Upstream commit a61079efc87888587e463afaed82417b162fbd69 ] + +REGMAP is a hidden (not user visible) symbol. Users cannot set it +directly thru "make *config", so drivers should select it instead of +depending on it if they need it. + +Consistently using "select" or "depends on" can also help reduce +Kconfig circular dependency issues. + +Therefore, change the use of "depends on REGMAP" to "select REGMAP". + +Fixes: 3fce8e1eb994 ("leds: TI LMU: Add common code for TI LMU devices") +Signed-off-by: Randy Dunlap +Acked-by: Pavel Machek +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230226053953.4681-5-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + drivers/leds/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig +index 499d0f215a8bf..2378cfb7443e4 100644 +--- a/drivers/leds/Kconfig ++++ b/drivers/leds/Kconfig +@@ -814,7 +814,7 @@ config LEDS_SPI_BYTE + config LEDS_TI_LMU_COMMON + tristate "LED driver for TI LMU" + depends on LEDS_CLASS +- depends on REGMAP ++ select REGMAP + help + Say Y to enable the LED driver for TI LMU devices. + This supports common features between the TI LM3532, LM3631, LM3632, +-- +2.39.2 + diff --git a/queue-6.2/libbpf-fix-ld_imm64-copy-logic-for-ksym-in-light-ske.patch b/queue-6.2/libbpf-fix-ld_imm64-copy-logic-for-ksym-in-light-ske.patch new file mode 100644 index 00000000000..717ed2d8155 --- /dev/null +++ b/queue-6.2/libbpf-fix-ld_imm64-copy-logic-for-ksym-in-light-ske.patch @@ -0,0 +1,61 @@ +From cf58560cf648ffc188426dd93252c400827d5b61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Mar 2023 13:30:13 -0700 +Subject: libbpf: Fix ld_imm64 copy logic for ksym in light skeleton. + +From: Alexei Starovoitov + +[ Upstream commit a506d6ce1dd184051037dc9d26c3eb187c9fe625 ] + +Unlike normal libbpf the light skeleton 'loader' program is doing +btf_find_by_name_kind() call at run-time to find ksym in the kernel and +populate its {btf_id, btf_obj_fd} pair in ld_imm64 insn. To avoid doing the +search multiple times for the same ksym it remembers the first patched ld_imm64 +insn and copies {btf_id, btf_obj_fd} from it into subsequent ld_imm64 insn. +Fix a bug in copying logic, since it may incorrectly clear BPF_PSEUDO_BTF_ID flag. + +Also replace always true if (btf_obj_fd >= 0) check with unconditional JMP_JA +to clarify the code. + +Fixes: d995816b77eb ("libbpf: Avoid reload of imm for weak, unresolved, repeating ksym") +Signed-off-by: Alexei Starovoitov +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20230319203014.55866-1-alexei.starovoitov@gmail.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/gen_loader.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/bpf/gen_loader.c b/tools/lib/bpf/gen_loader.c +index 23f5c46708f8f..b74c82bb831e6 100644 +--- a/tools/lib/bpf/gen_loader.c ++++ b/tools/lib/bpf/gen_loader.c +@@ -804,11 +804,13 @@ static void emit_relo_ksym_btf(struct bpf_gen *gen, struct ksym_relo_desc *relo, + return; + /* try to copy from existing ldimm64 insn */ + if (kdesc->ref > 1) { +- move_blob2blob(gen, insn + offsetof(struct bpf_insn, imm), 4, +- kdesc->insn + offsetof(struct bpf_insn, imm)); + move_blob2blob(gen, insn + sizeof(struct bpf_insn) + offsetof(struct bpf_insn, imm), 4, + kdesc->insn + sizeof(struct bpf_insn) + offsetof(struct bpf_insn, imm)); +- /* jump over src_reg adjustment if imm is not 0, reuse BPF_REG_0 from move_blob2blob */ ++ move_blob2blob(gen, insn + offsetof(struct bpf_insn, imm), 4, ++ kdesc->insn + offsetof(struct bpf_insn, imm)); ++ /* jump over src_reg adjustment if imm (btf_id) is not 0, reuse BPF_REG_0 from move_blob2blob ++ * If btf_id is zero, clear BPF_PSEUDO_BTF_ID flag in src_reg of ld_imm64 insn ++ */ + emit(gen, BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3)); + goto clear_src_reg; + } +@@ -831,7 +833,7 @@ static void emit_relo_ksym_btf(struct bpf_gen *gen, struct ksym_relo_desc *relo, + emit(gen, BPF_STX_MEM(BPF_W, BPF_REG_8, BPF_REG_7, + sizeof(struct bpf_insn) + offsetof(struct bpf_insn, imm))); + /* skip src_reg adjustment */ +- emit(gen, BPF_JMP_IMM(BPF_JSGE, BPF_REG_7, 0, 3)); ++ emit(gen, BPF_JMP_IMM(BPF_JA, 0, 0, 3)); + clear_src_reg: + /* clear bpf_object__relocate_data's src_reg assignment, otherwise we get a verifier failure */ + reg_mask = src_reg_mask(); +-- +2.39.2 + diff --git a/queue-6.2/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch b/queue-6.2/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch new file mode 100644 index 00000000000..067c1f61087 --- /dev/null +++ b/queue-6.2/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch @@ -0,0 +1,58 @@ +From 5d4efc675ae8117e7567e045e18e17b0d7b73fe4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 19:15:29 -0700 +Subject: linux/vt_buffer.h: allow either builtin or modular for macros + +From: Randy Dunlap + +[ Upstream commit 2b76ffe81e32afd6d318dc4547e2ba8c46207b77 ] + +Fix build errors on ARCH=alpha when CONFIG_MDA_CONSOLE=m. +This allows the ARCH macros to be the only ones defined. + +In file included from ../drivers/video/console/mdacon.c:37: +../arch/alpha/include/asm/vga.h:17:40: error: expected identifier or '(' before 'volatile' + 17 | static inline void scr_writew(u16 val, volatile u16 *addr) + | ^~~~~~~~ +../include/linux/vt_buffer.h:24:34: note: in definition of macro 'scr_writew' + 24 | #define scr_writew(val, addr) (*(addr) = (val)) + | ^~~~ +../include/linux/vt_buffer.h:24:40: error: expected ')' before '=' token + 24 | #define scr_writew(val, addr) (*(addr) = (val)) + | ^ +../arch/alpha/include/asm/vga.h:17:20: note: in expansion of macro 'scr_writew' + 17 | static inline void scr_writew(u16 val, volatile u16 *addr) + | ^~~~~~~~~~ +../arch/alpha/include/asm/vga.h:25:29: error: expected identifier or '(' before 'volatile' + 25 | static inline u16 scr_readw(volatile const u16 *addr) + | ^~~~~~~~ + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Randy Dunlap +Cc: Greg Kroah-Hartman +Cc: Jiri Slaby +Cc: dri-devel@lists.freedesktop.org +Cc: linux-fbdev@vger.kernel.org +Link: https://lore.kernel.org/r/20230329021529.16188-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/vt_buffer.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/vt_buffer.h b/include/linux/vt_buffer.h +index 848db1b1569ff..919d999a8c1db 100644 +--- a/include/linux/vt_buffer.h ++++ b/include/linux/vt_buffer.h +@@ -16,7 +16,7 @@ + + #include + +-#if defined(CONFIG_VGA_CONSOLE) || defined(CONFIG_MDA_CONSOLE) ++#if IS_ENABLED(CONFIG_VGA_CONSOLE) || IS_ENABLED(CONFIG_MDA_CONSOLE) + #include + #endif + +-- +2.39.2 + diff --git a/queue-6.2/macintosh-via-pmu-led-requires-ata-to-be-set.patch b/queue-6.2/macintosh-via-pmu-led-requires-ata-to-be-set.patch new file mode 100644 index 00000000000..91d7b191b6d --- /dev/null +++ b/queue-6.2/macintosh-via-pmu-led-requires-ata-to-be-set.patch @@ -0,0 +1,45 @@ +From 78eff2739f87450936f5d87b54e35f99b133ede2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 17:42:41 -0800 +Subject: macintosh: via-pmu-led: requires ATA to be set + +From: Randy Dunlap + +[ Upstream commit 05dce4ba125336875cd3eed3c1503fa81cd2f691 ] + +LEDS_TRIGGER_DISK depends on ATA, so selecting LEDS_TRIGGER_DISK +when ATA is not set/enabled causes a Kconfig warning: + +WARNING: unmet direct dependencies detected for LEDS_TRIGGER_DISK + Depends on [n]: NEW_LEDS [=y] && LEDS_TRIGGERS [=y] && ATA [=n] + Selected by [y]: + - ADB_PMU_LED_DISK [=y] && MACINTOSH_DRIVERS [=y] && ADB_PMU_LED [=y] && LEDS_CLASS [=y] + +Fix this by making ADB_PMU_LED_DISK depend on ATA. + +Seen on both PPC32 and PPC64. + +Fixes: 0e865a80c135 ("macintosh: Remove dependency on IDE_GD_ATA if ADB_PMU_LED_DISK is selected") +Signed-off-by: Randy Dunlap +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223014241.20878-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + drivers/macintosh/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig +index 539a2ed4e13dc..a0e717a986dcb 100644 +--- a/drivers/macintosh/Kconfig ++++ b/drivers/macintosh/Kconfig +@@ -86,6 +86,7 @@ config ADB_PMU_LED + + config ADB_PMU_LED_DISK + bool "Use front LED as DISK LED by default" ++ depends on ATA + depends on ADB_PMU_LED + depends on LEDS_CLASS + select LEDS_TRIGGERS +-- +2.39.2 + diff --git a/queue-6.2/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch b/queue-6.2/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch new file mode 100644 index 00000000000..f7a1f99bd00 --- /dev/null +++ b/queue-6.2/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch @@ -0,0 +1,36 @@ +From d60b450c078b7b3d629141b6476e558d85436140 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 11:35:58 +0800 +Subject: macintosh/windfarm_smu_sat: Add missing of_node_put() + +From: Liang He + +[ Upstream commit 631cf002826007ab7415258ee647dcaf8845ad5a ] + +We call of_node_get() in wf_sat_probe() after sat is created, +so we need the of_node_put() before *kfree(sat)*. + +Fixes: ac171c46667c ("[PATCH] powerpc: Thermal control for dual core G5s") +Signed-off-by: Liang He +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230330033558.2562778-1-windhl@126.com +Signed-off-by: Sasha Levin +--- + drivers/macintosh/windfarm_smu_sat.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c +index ebc4256a9e4a0..089f2743a070d 100644 +--- a/drivers/macintosh/windfarm_smu_sat.c ++++ b/drivers/macintosh/windfarm_smu_sat.c +@@ -171,6 +171,7 @@ static void wf_sat_release(struct kref *ref) + + if (sat->nr >= 0) + sats[sat->nr] = NULL; ++ of_node_put(sat->node); + kfree(sat); + } + +-- +2.39.2 + diff --git a/queue-6.2/mailbox-mpfs-switch-to-txdone_poll.patch b/queue-6.2/mailbox-mpfs-switch-to-txdone_poll.patch new file mode 100644 index 00000000000..0f732cf020e --- /dev/null +++ b/queue-6.2/mailbox-mpfs-switch-to-txdone_poll.patch @@ -0,0 +1,73 @@ +From 9c5c9aea357620110c8038c41023e390e78f1f0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 20:22:52 +0000 +Subject: mailbox: mpfs: switch to txdone_poll + +From: Conor Dooley + +[ Upstream commit b5984a9844fc45cd301a28fb56f3de95f7e20f3c ] + +The system controller on PolarFire SoC has no interrupt to signify that +the TX has been completed. The interrupt instead signals that a service +requested by the mailbox client has succeeded. If a service fails, there +will be no interrupt delivered. + +Switch to polling the busy register to determine whether transmission +has completed. + +Fixes: 83d7b1560810 ("mbox: add polarfire soc system controller mailbox") +Acked-by: Jassi Brar +Tested-by: Valentina Fernandez +Signed-off-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mailbox-mpfs.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/mailbox/mailbox-mpfs.c b/drivers/mailbox/mailbox-mpfs.c +index 853901acaeec2..08aa840cccaca 100644 +--- a/drivers/mailbox/mailbox-mpfs.c ++++ b/drivers/mailbox/mailbox-mpfs.c +@@ -79,6 +79,13 @@ static bool mpfs_mbox_busy(struct mpfs_mbox *mbox) + return status & SCB_STATUS_BUSY_MASK; + } + ++static bool mpfs_mbox_last_tx_done(struct mbox_chan *chan) ++{ ++ struct mpfs_mbox *mbox = (struct mpfs_mbox *)chan->con_priv; ++ ++ return !mpfs_mbox_busy(mbox); ++} ++ + static int mpfs_mbox_send_data(struct mbox_chan *chan, void *data) + { + struct mpfs_mbox *mbox = (struct mpfs_mbox *)chan->con_priv; +@@ -182,7 +189,6 @@ static irqreturn_t mpfs_mbox_inbox_isr(int irq, void *data) + + mpfs_mbox_rx_data(chan); + +- mbox_chan_txdone(chan, 0); + return IRQ_HANDLED; + } + +@@ -212,6 +218,7 @@ static const struct mbox_chan_ops mpfs_mbox_ops = { + .send_data = mpfs_mbox_send_data, + .startup = mpfs_mbox_startup, + .shutdown = mpfs_mbox_shutdown, ++ .last_tx_done = mpfs_mbox_last_tx_done, + }; + + static int mpfs_mbox_probe(struct platform_device *pdev) +@@ -247,7 +254,8 @@ static int mpfs_mbox_probe(struct platform_device *pdev) + mbox->controller.num_chans = 1; + mbox->controller.chans = mbox->chans; + mbox->controller.ops = &mpfs_mbox_ops; +- mbox->controller.txdone_irq = true; ++ mbox->controller.txdone_poll = true; ++ mbox->controller.txpoll_period = 10u; + + ret = devm_mbox_controller_register(&pdev->dev, &mbox->controller); + if (ret) { +-- +2.39.2 + diff --git a/queue-6.2/md-raid10-don-t-call-bio_start_io_acct-twice-for-bio.patch b/queue-6.2/md-raid10-don-t-call-bio_start_io_acct-twice-for-bio.patch new file mode 100644 index 00000000000..e996669a034 --- /dev/null +++ b/queue-6.2/md-raid10-don-t-call-bio_start_io_acct-twice-for-bio.patch @@ -0,0 +1,51 @@ +From d97d53f54e7aaf29425fbed2330ecbf2d24f8d47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 09:22:58 +0800 +Subject: md/raid10: don't call bio_start_io_acct twice for bio which + experienced read error + +From: Yu Kuai + +[ Upstream commit 7cddb055bfda5f7b0be931e8ea750fc28bc18a27 ] + +handle_read_error() will resumit r10_bio by raid10_read_request(), which +will call bio_start_io_acct() again, while bio_end_io_acct() will only +be called once. + +Fix the problem by don't account io again from handle_read_error(). + +Fixes: 528bc2cf2fcc ("md/raid10: enable io accounting") +Suggested-by: Song Liu +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230314012258.2395894-1-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 20522af894e0d..0193cc7a6c8e1 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1248,7 +1248,8 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, + } + slot = r10_bio->read_slot; + +- if (blk_queue_io_stat(bio->bi_bdev->bd_disk->queue)) ++ if (!r10_bio->start_time && ++ blk_queue_io_stat(bio->bi_bdev->bd_disk->queue)) + r10_bio->start_time = bio_start_io_acct(bio); + read_bio = bio_alloc_clone(rdev->bdev, bio, gfp, &mddev->bio_set); + +@@ -1578,6 +1579,7 @@ static void __make_request(struct mddev *mddev, struct bio *bio, int sectors) + r10_bio->sector = bio->bi_iter.bi_sector; + r10_bio->state = 0; + r10_bio->read_slot = -1; ++ r10_bio->start_time = 0; + memset(r10_bio->devs, 0, sizeof(r10_bio->devs[0]) * + conf->geo.raid_disks); + +-- +2.39.2 + diff --git a/queue-6.2/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch b/queue-6.2/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch new file mode 100644 index 00000000000..969c52b72b6 --- /dev/null +++ b/queue-6.2/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch @@ -0,0 +1,73 @@ +From 865b24c151245324347b9e555fbcd3450d85684b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:38:53 +0800 +Subject: md/raid10: fix leak of 'r10bio->remaining' for recovery + +From: Yu Kuai + +[ Upstream commit 26208a7cffd0c7cbf14237ccd20c7270b3ffeb7e ] + +raid10_sync_request() will add 'r10bio->remaining' for both rdev and +replacement rdev. However, if the read io fails, recovery_request_write() +returns without issuing the write io, in this case, end_sync_request() +is only called once and 'remaining' is leaked, cause an io hang. + +Fix the problem by decreasing 'remaining' according to if 'bio' and +'repl_bio' is valid. + +Fixes: 24afd80d99f8 ("md/raid10: handle recovery of replacement devices.") +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230310073855.1337560-5-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index db9ee3b637d6f..b1c575859218a 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2613,11 +2613,22 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio) + { + struct r10conf *conf = mddev->private; + int d; +- struct bio *wbio, *wbio2; ++ struct bio *wbio = r10_bio->devs[1].bio; ++ struct bio *wbio2 = r10_bio->devs[1].repl_bio; ++ ++ /* Need to test wbio2->bi_end_io before we call ++ * submit_bio_noacct as if the former is NULL, ++ * the latter is free to free wbio2. ++ */ ++ if (wbio2 && !wbio2->bi_end_io) ++ wbio2 = NULL; + + if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) { + fix_recovery_read_error(r10_bio); +- end_sync_request(r10_bio); ++ if (wbio->bi_end_io) ++ end_sync_request(r10_bio); ++ if (wbio2) ++ end_sync_request(r10_bio); + return; + } + +@@ -2626,14 +2637,6 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio) + * and submit the write request + */ + d = r10_bio->devs[1].devnum; +- wbio = r10_bio->devs[1].bio; +- wbio2 = r10_bio->devs[1].repl_bio; +- /* Need to test wbio2->bi_end_io before we call +- * submit_bio_noacct as if the former is NULL, +- * the latter is free to free wbio2. +- */ +- if (wbio2 && !wbio2->bi_end_io) +- wbio2 = NULL; + if (wbio->bi_end_io) { + atomic_inc(&conf->mirrors[d].rdev->nr_pending); + md_sync_acct(conf->mirrors[d].rdev->bdev, bio_sectors(wbio)); +-- +2.39.2 + diff --git a/queue-6.2/md-raid10-fix-memleak-for-conf-bio_split.patch b/queue-6.2/md-raid10-fix-memleak-for-conf-bio_split.patch new file mode 100644 index 00000000000..757bbc7ef80 --- /dev/null +++ b/queue-6.2/md-raid10-fix-memleak-for-conf-bio_split.patch @@ -0,0 +1,96 @@ +From d0b89e8f307acef97e9b8e27b1991fde8edafc46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:38:54 +0800 +Subject: md/raid10: fix memleak for 'conf->bio_split' + +From: Yu Kuai + +[ Upstream commit c9ac2acde53f5385de185bccf6aaa91cf9ac1541 ] + +In the error path of raid10_run(), 'conf' need be freed, however, +'conf->bio_split' is missed and memory will be leaked. + +Since there are 3 places to free 'conf', factor out a helper to fix the +problem. + +Fixes: fc9977dd069e ("md/raid10: simplify the splitting of requests.") +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230310073855.1337560-6-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 37 +++++++++++++++++-------------------- + 1 file changed, 17 insertions(+), 20 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index b1c575859218a..5736ba5932c7f 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -4015,6 +4015,20 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new) + return nc*fc; + } + ++static void raid10_free_conf(struct r10conf *conf) ++{ ++ if (!conf) ++ return; ++ ++ mempool_exit(&conf->r10bio_pool); ++ kfree(conf->mirrors); ++ kfree(conf->mirrors_old); ++ kfree(conf->mirrors_new); ++ safe_put_page(conf->tmppage); ++ bioset_exit(&conf->bio_split); ++ kfree(conf); ++} ++ + static struct r10conf *setup_conf(struct mddev *mddev) + { + struct r10conf *conf = NULL; +@@ -4097,13 +4111,7 @@ static struct r10conf *setup_conf(struct mddev *mddev) + return conf; + + out: +- if (conf) { +- mempool_exit(&conf->r10bio_pool); +- kfree(conf->mirrors); +- safe_put_page(conf->tmppage); +- bioset_exit(&conf->bio_split); +- kfree(conf); +- } ++ raid10_free_conf(conf); + return ERR_PTR(err); + } + +@@ -4294,10 +4302,7 @@ static int raid10_run(struct mddev *mddev) + + out_free_conf: + md_unregister_thread(&mddev->thread); +- mempool_exit(&conf->r10bio_pool); +- safe_put_page(conf->tmppage); +- kfree(conf->mirrors); +- kfree(conf); ++ raid10_free_conf(conf); + mddev->private = NULL; + out: + return -EIO; +@@ -4305,15 +4310,7 @@ static int raid10_run(struct mddev *mddev) + + static void raid10_free(struct mddev *mddev, void *priv) + { +- struct r10conf *conf = priv; +- +- mempool_exit(&conf->r10bio_pool); +- safe_put_page(conf->tmppage); +- kfree(conf->mirrors); +- kfree(conf->mirrors_old); +- kfree(conf->mirrors_new); +- bioset_exit(&conf->bio_split); +- kfree(conf); ++ raid10_free_conf(priv); + } + + static void raid10_quiesce(struct mddev *mddev, int quiesce) +-- +2.39.2 + diff --git a/queue-6.2/md-raid10-fix-memleak-of-md-thread.patch b/queue-6.2/md-raid10-fix-memleak-of-md-thread.patch new file mode 100644 index 00000000000..6258cd62062 --- /dev/null +++ b/queue-6.2/md-raid10-fix-memleak-of-md-thread.patch @@ -0,0 +1,51 @@ +From 417dede310e62fcb218287446883d51382c88090 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:38:55 +0800 +Subject: md/raid10: fix memleak of md thread + +From: Yu Kuai + +[ Upstream commit f0ddb83da3cbbf8a1f9087a642c448ff52ee9abd ] + +In raid10_run(), if setup_conf() succeed and raid10_run() failed before +setting 'mddev->thread', then in the error path 'conf->thread' is not +freed. + +Fix the problem by setting 'mddev->thread' right after setup_conf(). + +Fixes: 43a521238aca ("md-cluster: choose correct label when clustered layout is not supported") +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230310073855.1337560-7-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 5736ba5932c7f..20522af894e0d 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -4148,6 +4148,9 @@ static int raid10_run(struct mddev *mddev) + if (!conf) + goto out; + ++ mddev->thread = conf->thread; ++ conf->thread = NULL; ++ + if (mddev_is_clustered(conf->mddev)) { + int fc, fo; + +@@ -4160,9 +4163,6 @@ static int raid10_run(struct mddev *mddev) + } + } + +- mddev->thread = conf->thread; +- conf->thread = NULL; +- + if (mddev->queue) { + blk_queue_max_write_zeroes_sectors(mddev->queue, 0); + blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9); +-- +2.39.2 + diff --git a/queue-6.2/md-raid10-fix-task-hung-in-raid10d.patch b/queue-6.2/md-raid10-fix-task-hung-in-raid10d.patch new file mode 100644 index 00000000000..723943ac085 --- /dev/null +++ b/queue-6.2/md-raid10-fix-task-hung-in-raid10d.patch @@ -0,0 +1,115 @@ +From 58491d052144e13b1d17e50ba3a8b5cd72c72017 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 12:09:59 +0800 +Subject: md/raid10: fix task hung in raid10d + +From: Li Nan + +[ Upstream commit 72c215ed8731c88b2d7e09afc51fffc207ae47b8 ] + +commit fe630de009d0 ("md/raid10: avoid deadlock on recovery.") allowed +normal io and sync io to exist at the same time. Task hung will occur as +below: + +T1 T2 T3 T4 +raid10d + handle_read_error + allow_barrier + conf->nr_pending-- + -> 0 + //submit sync io + raid10_sync_request + raise_barrier + ->will not be blocked + ... + //submit to drivers + raid10_read_request + wait_barrier + conf->nr_pending++ + -> 1 + //retry read fail + raid10_end_read_request + reschedule_retry + add to retry_list + conf->nr_queued++ + -> 1 + //sync io fail + end_sync_read + __end_sync_read + reschedule_retry + add to retry_list + conf->nr_queued++ + -> 2 + ... + handle_read_error + get form retry_list + conf->nr_queued-- + freeze_array + wait nr_pending == nr_queued+1 + ->1 ->2 + //task hung + +retry read and sync io will be added to retry_list(nr_queued->2) if they +fails. raid10d() called handle_read_error() and hung in freeze_array(). +nr_queued will not decrease because raid10d is blocked, nr_pending will +not increase because conf->barrier is not released. + +Fix it by moving allow_barrier() after raid10_read_request(). +raise_barrier() will wait for nr_waiting to become 0. Therefore, sync io +and regular io will not be issued at the same time. + +Also remove the check of nr_queued in stop_waiting_barrier. It can be 0 +but don't need to be blocking. Remove the check for MD_RECOVERY_RUNNING as +the check is redundent. + +Fixes: fe630de009d0 ("md/raid10: avoid deadlock on recovery.") +Signed-off-by: Li Nan +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230222041000.3341651-2-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 6c66357f92f55..db9ee3b637d6f 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -995,11 +995,15 @@ static bool stop_waiting_barrier(struct r10conf *conf) + (!bio_list_empty(&bio_list[0]) || !bio_list_empty(&bio_list[1]))) + return true; + +- /* move on if recovery thread is blocked by us */ +- if (conf->mddev->thread->tsk == current && +- test_bit(MD_RECOVERY_RUNNING, &conf->mddev->recovery) && +- conf->nr_queued > 0) ++ /* ++ * move on if io is issued from raid10d(), nr_pending is not released ++ * from original io(see handle_read_error()). All raise barrier is ++ * blocked until this io is done. ++ */ ++ if (conf->mddev->thread->tsk == current) { ++ WARN_ON_ONCE(atomic_read(&conf->nr_pending) == 0); + return true; ++ } + + return false; + } +@@ -2978,9 +2982,13 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio) + md_error(mddev, rdev); + + rdev_dec_pending(rdev, mddev); +- allow_barrier(conf); + r10_bio->state = 0; + raid10_read_request(mddev, r10_bio->master_bio, r10_bio); ++ /* ++ * allow_barrier after re-submit to ensure no sync io ++ * can be issued while regular io pending. ++ */ ++ allow_barrier(conf); + } + + static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio) +-- +2.39.2 + diff --git a/queue-6.2/media-amphion-decoder-implement-display-delay-enable.patch b/queue-6.2/media-amphion-decoder-implement-display-delay-enable.patch new file mode 100644 index 00000000000..fb31be02e22 --- /dev/null +++ b/queue-6.2/media-amphion-decoder-implement-display-delay-enable.patch @@ -0,0 +1,108 @@ +From 6d9e1f163433a6c57b3820c6115d95837e9c8ad4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Mar 2023 06:34:10 +0100 +Subject: media: amphion: decoder implement display delay enable + +From: Ming Qian + +[ Upstream commit ffa331d9bf9407655fc4c4d57dcc92ed2868e326 ] + +amphion vpu support a low latency mode, +when V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE is enabled, +decoder can display frame immediately after it's decoded. +Only h264 is support yet. + +Fixes: 6de8d628df6e ("media: amphion: add v4l2 m2m vpu decoder stateful driver") +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vdec.c | 32 +++++++++++++++++++++ + drivers/media/platform/amphion/vpu_codec.h | 3 +- + drivers/media/platform/amphion/vpu_malone.c | 4 ++- + 3 files changed, 37 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c +index 87f9f8e90ab13..70633530d23a1 100644 +--- a/drivers/media/platform/amphion/vdec.c ++++ b/drivers/media/platform/amphion/vdec.c +@@ -168,7 +168,31 @@ static const struct vpu_format vdec_formats[] = { + {0, 0, 0, 0}, + }; + ++static int vdec_op_s_ctrl(struct v4l2_ctrl *ctrl) ++{ ++ struct vpu_inst *inst = ctrl_to_inst(ctrl); ++ struct vdec_t *vdec = inst->priv; ++ int ret = 0; ++ ++ vpu_inst_lock(inst); ++ switch (ctrl->id) { ++ case V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE: ++ vdec->params.display_delay_enable = ctrl->val; ++ break; ++ case V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY: ++ vdec->params.display_delay = ctrl->val; ++ break; ++ default: ++ ret = -EINVAL; ++ break; ++ } ++ vpu_inst_unlock(inst); ++ ++ return ret; ++} ++ + static const struct v4l2_ctrl_ops vdec_ctrl_ops = { ++ .s_ctrl = vdec_op_s_ctrl, + .g_volatile_ctrl = vpu_helper_g_volatile_ctrl, + }; + +@@ -181,6 +205,14 @@ static int vdec_ctrl_init(struct vpu_inst *inst) + if (ret) + return ret; + ++ v4l2_ctrl_new_std(&inst->ctrl_handler, &vdec_ctrl_ops, ++ V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY, ++ 0, 0, 1, 0); ++ ++ v4l2_ctrl_new_std(&inst->ctrl_handler, &vdec_ctrl_ops, ++ V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE, ++ 0, 1, 1, 0); ++ + ctrl = v4l2_ctrl_new_std(&inst->ctrl_handler, &vdec_ctrl_ops, + V4L2_CID_MIN_BUFFERS_FOR_CAPTURE, 1, 32, 1, 2); + if (ctrl) +diff --git a/drivers/media/platform/amphion/vpu_codec.h b/drivers/media/platform/amphion/vpu_codec.h +index 528a93f08ecd4..bac6d0d94f8a5 100644 +--- a/drivers/media/platform/amphion/vpu_codec.h ++++ b/drivers/media/platform/amphion/vpu_codec.h +@@ -55,7 +55,8 @@ struct vpu_encode_params { + struct vpu_decode_params { + u32 codec_format; + u32 output_format; +- u32 b_dis_reorder; ++ u32 display_delay_enable; ++ u32 display_delay; + u32 b_non_frame; + u32 frame_count; + u32 end_flag; +diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c +index 2c9bfc6a5a72e..feb5c25e31044 100644 +--- a/drivers/media/platform/amphion/vpu_malone.c ++++ b/drivers/media/platform/amphion/vpu_malone.c +@@ -641,7 +641,9 @@ static int vpu_malone_set_params(struct vpu_shared_addr *shared, + hc->jpg[instance].jpg_mjpeg_interlaced = 0; + } + +- hc->codec_param[instance].disp_imm = params->b_dis_reorder ? 1 : 0; ++ hc->codec_param[instance].disp_imm = params->display_delay_enable ? 1 : 0; ++ if (malone_format != MALONE_FMT_AVC) ++ hc->codec_param[instance].disp_imm = 0; + hc->codec_param[instance].dbglog_enable = 0; + iface->dbglog_desc.level = 0; + +-- +2.39.2 + diff --git a/queue-6.2/media-av7110-prevent-underflow-in-write_ts_to_decode.patch b/queue-6.2/media-av7110-prevent-underflow-in-write_ts_to_decode.patch new file mode 100644 index 00000000000..4d247c30f46 --- /dev/null +++ b/queue-6.2/media-av7110-prevent-underflow-in-write_ts_to_decode.patch @@ -0,0 +1,47 @@ +From 300fcaace963460816ecdad380dd0d526d8b246e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 11:00:23 +0100 +Subject: media: av7110: prevent underflow in write_ts_to_decoder() + +From: Dan Carpenter + +[ Upstream commit eed9496a0501357aa326ddd6b71408189ed872eb ] + +The buf[4] value comes from the user via ts_play(). It is a value in +the u8 range. The final length we pass to av7110_ipack_instant_repack() +is "len - (buf[4] + 1) - 4" so add a check to ensure that the length is +not negative. It's not clear that passing a negative len value does +anything bad necessarily, but it's not best practice. + +With the new bounds checking the "if (!len)" condition is no longer +possible or required so remove that. + +Fixes: fd46d16d602a ("V4L/DVB (11759): dvb-ttpci: Add TS replay capability") +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/deprecated/saa7146/av7110/av7110_av.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/media/deprecated/saa7146/av7110/av7110_av.c b/drivers/staging/media/deprecated/saa7146/av7110/av7110_av.c +index 0bf513c26b6b5..a5c5bebad3061 100644 +--- a/drivers/staging/media/deprecated/saa7146/av7110/av7110_av.c ++++ b/drivers/staging/media/deprecated/saa7146/av7110/av7110_av.c +@@ -823,10 +823,10 @@ static int write_ts_to_decoder(struct av7110 *av7110, int type, const u8 *buf, s + av7110_ipack_flush(ipack); + + if (buf[3] & ADAPT_FIELD) { ++ if (buf[4] > len - 1 - 4) ++ return 0; + len -= buf[4] + 1; + buf += buf[4] + 1; +- if (!len) +- return 0; + } + + av7110_ipack_instant_repack(buf + 4, len - 4, ipack); +-- +2.39.2 + diff --git a/queue-6.2/media-bdisp-add-missing-check-for-create_workqueue.patch b/queue-6.2/media-bdisp-add-missing-check-for-create_workqueue.patch new file mode 100644 index 00000000000..87f65acd6ba --- /dev/null +++ b/queue-6.2/media-bdisp-add-missing-check-for-create_workqueue.patch @@ -0,0 +1,37 @@ +From 4c78e403beef21046ff1efd370b3f08e15f25689 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 08:14:42 +0100 +Subject: media: bdisp: Add missing check for create_workqueue + +From: Jiasheng Jiang + +[ Upstream commit 2371adeab717d8fe32144a84f3491a03c5838cfb ] + +Add the check for the return value of the create_workqueue +in order to avoid NULL pointer dereference. + +Fixes: 28ffeebbb7bd ("[media] bdisp: 2D blitter driver using v4l2 mem2mem framework") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c +index dd74cc43920d3..080da254b9109 100644 +--- a/drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c ++++ b/drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c +@@ -1309,6 +1309,8 @@ static int bdisp_probe(struct platform_device *pdev) + init_waitqueue_head(&bdisp->irq_queue); + INIT_DELAYED_WORK(&bdisp->timeout_work, bdisp_irq_timeout); + bdisp->work_queue = create_workqueue(BDISP_NAME); ++ if (!bdisp->work_queue) ++ return -ENOMEM; + + spin_lock_init(&bdisp->slock); + mutex_init(&bdisp->lock); +-- +2.39.2 + diff --git a/queue-6.2/media-cedrus-fix-use-after-free-bug-in-cedrus_remove.patch b/queue-6.2/media-cedrus-fix-use-after-free-bug-in-cedrus_remove.patch new file mode 100644 index 00000000000..c3abf3b9db3 --- /dev/null +++ b/queue-6.2/media-cedrus-fix-use-after-free-bug-in-cedrus_remove.patch @@ -0,0 +1,52 @@ +From 0448f6c3462150cfc1533662c2c8f4ad0769da28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 16:31:20 +0000 +Subject: media: cedrus: fix use after free bug in cedrus_remove due to race + condition + +From: Zheng Wang + +[ Upstream commit 50d0a7aea4809cef87979d4669911276aa23b71f ] + +In cedrus_probe, dev->watchdog_work is bound with cedrus_watchdog function. +In cedrus_device_run, it will started by schedule_delayed_work. If there is +an unfinished work in cedrus_remove, there may be a race condition and +trigger UAF bug. + +CPU0 CPU1 + + |cedrus_watchdog +cedrus_remove | + v4l2_m2m_release | + kfree(m2m_dev) | + | + | v4l2_m2m_get_curr_priv + | m2m_dev //use + +Fix it by canceling the worker in cedrus_remove. + +Fixes: 7c38a551bda1 ("media: cedrus: Add watchdog for job completion") +Signed-off-by: Zheng Wang +Acked-by: Jernej Skrabec +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/sunxi/cedrus/cedrus.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c +index a43d5ff667163..a50a4d0a8f715 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c +@@ -547,6 +547,7 @@ static int cedrus_remove(struct platform_device *pdev) + { + struct cedrus_dev *dev = platform_get_drvdata(pdev); + ++ cancel_delayed_work_sync(&dev->watchdog_work); + if (media_devnode_is_registered(dev->mdev.devnode)) { + media_device_unregister(&dev->mdev); + v4l2_m2m_unregister_media_controller(dev->m2m_dev); +-- +2.39.2 + diff --git a/queue-6.2/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch b/queue-6.2/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch new file mode 100644 index 00000000000..0356db7270d --- /dev/null +++ b/queue-6.2/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch @@ -0,0 +1,56 @@ +From df847d9ab7d24ffea26ac9ea027d7550a0decde0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 16:15:06 +0800 +Subject: media: dm1105: Fix use after free bug in dm1105_remove due to race + condition + +From: Zheng Wang + +[ Upstream commit 5abda7a16698d4d1f47af1168d8fa2c640116b4a ] + +In dm1105_probe, it called dm1105_ir_init and bound +&dm1105->ir.work with dm1105_emit_key. +When it handles IRQ request with dm1105_irq, +it may call schedule_work to start the work. + +When we call dm1105_remove to remove the driver, there +may be a sequence as follows: + +Fix it by finishing the work before cleanup in dm1105_remove + +CPU0 CPU1 + + |dm1105_emit_key +dm1105_remove | + dm1105_ir_exit | + rc_unregister_device | + rc_free_device | + rc_dev_release | + kfree(dev); | + | + | rc_keydown + | //use + +Fixes: 34d2f9bf189c ("V4L/DVB: dm1105: use dm1105_dev & dev instead of dm1105dvb") +Signed-off-by: Zheng Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/dm1105/dm1105.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c +index 4ac645a56c14e..9e9c7c071accc 100644 +--- a/drivers/media/pci/dm1105/dm1105.c ++++ b/drivers/media/pci/dm1105/dm1105.c +@@ -1176,6 +1176,7 @@ static void dm1105_remove(struct pci_dev *pdev) + struct dvb_demux *dvbdemux = &dev->demux; + struct dmx_demux *dmx = &dvbdemux->dmx; + ++ cancel_work_sync(&dev->ir.work); + dm1105_ir_exit(dev); + dmx->close(dmx); + dvb_net_release(&dev->dvbnet); +-- +2.39.2 + diff --git a/queue-6.2/media-hi846-fix-memleak-in-hi846_init_controls.patch b/queue-6.2/media-hi846-fix-memleak-in-hi846_init_controls.patch new file mode 100644 index 00000000000..f2ec39ed569 --- /dev/null +++ b/queue-6.2/media-hi846-fix-memleak-in-hi846_init_controls.patch @@ -0,0 +1,60 @@ +From 225a281eb6d8af6ea962615b4e399f7f4a127b11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Mar 2023 11:58:09 +0000 +Subject: media: hi846: Fix memleak in hi846_init_controls() + +From: Wei Chen + +[ Upstream commit 2649c1a20e8e399ee955d0e22192f9992662c3d2 ] + +hi846_init_controls doesn't clean the allocated ctrl_hdlr +in case there is a failure, which causes memleak. Add +v4l2_ctrl_handler_free to free the resource properly. + +Fixes: e8c0882685f9 ("media: i2c: add driver for the SK Hynix Hi-846 8M pixel camera") +Signed-off-by: Wei Chen +Reviewed-by: Martin Kepplinger +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/hi846.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/hi846.c b/drivers/media/i2c/hi846.c +index 7c61873b71981..306dc35e925fd 100644 +--- a/drivers/media/i2c/hi846.c ++++ b/drivers/media/i2c/hi846.c +@@ -1472,21 +1472,26 @@ static int hi846_init_controls(struct hi846 *hi846) + if (ctrl_hdlr->error) { + dev_err(&client->dev, "v4l ctrl handler error: %d\n", + ctrl_hdlr->error); +- return ctrl_hdlr->error; ++ ret = ctrl_hdlr->error; ++ goto error; + } + + ret = v4l2_fwnode_device_parse(&client->dev, &props); + if (ret) +- return ret; ++ goto error; + + ret = v4l2_ctrl_new_fwnode_properties(ctrl_hdlr, &hi846_ctrl_ops, + &props); + if (ret) +- return ret; ++ goto error; + + hi846->sd.ctrl_handler = ctrl_hdlr; + + return 0; ++ ++error: ++ v4l2_ctrl_handler_free(ctrl_hdlr); ++ return ret; + } + + static int hi846_set_video_mode(struct hi846 *hi846, int fps) +-- +2.39.2 + diff --git a/queue-6.2/media-max9286-free-control-handler.patch b/queue-6.2/media-max9286-free-control-handler.patch new file mode 100644 index 00000000000..5b6f4e059ae --- /dev/null +++ b/queue-6.2/media-max9286-free-control-handler.patch @@ -0,0 +1,41 @@ +From a91f3f4483ac9944b7bd21106a5d29421b49b4d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jan 2023 22:46:50 +0100 +Subject: media: max9286: Free control handler +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Laurent Pinchart + +[ Upstream commit bfce6a12e5ba1edde95126aa06778027f16115d4 ] + +The control handler is leaked in some probe-time error paths, as well as +in the remove path. Fix it. + +Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver") +Signed-off-by: Laurent Pinchart +Reviewed-by: Niklas Söderlund +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/max9286.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c +index d034a67042e35..892cd97b7cab7 100644 +--- a/drivers/media/i2c/max9286.c ++++ b/drivers/media/i2c/max9286.c +@@ -941,6 +941,7 @@ static int max9286_v4l2_register(struct max9286_priv *priv) + static void max9286_v4l2_unregister(struct max9286_priv *priv) + { + fwnode_handle_put(priv->sd.fwnode); ++ v4l2_ctrl_handler_free(&priv->ctrls); + v4l2_async_unregister_subdev(&priv->sd); + max9286_v4l2_notifier_unregister(priv); + } +-- +2.39.2 + diff --git a/queue-6.2/media-mediatek-vcodec-add-core-decode-done-event.patch b/queue-6.2/media-mediatek-vcodec-add-core-decode-done-event.patch new file mode 100644 index 00000000000..7d7bed2e898 --- /dev/null +++ b/queue-6.2/media-mediatek-vcodec-add-core-decode-done-event.patch @@ -0,0 +1,74 @@ +From 79a02fd8fb2ab7baeca071441ddf930607227040 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 07:33:13 +0000 +Subject: media: mediatek: vcodec: add core decode done event + +From: Yunfei Dong + +[ Upstream commit d227af847ac2d7d90350124a1b2451e4fc1f050c ] + +Need to make sure core decode done before current instance is free. + +Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode") +Signed-off-by: Yunfei Dong +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c | 4 +++- + drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h | 2 ++ + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +index 0da6e3e2ef0b3..ce7c82e38103a 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +@@ -196,7 +196,7 @@ bool vdec_msg_queue_wait_lat_buf_full(struct vdec_msg_queue *msg_queue) + spin_unlock(&core_ctx->ready_lock); + + timeout_jiff = msecs_to_jiffies(1000 * (NUM_BUFFER_COUNT + 2)); +- ret = wait_event_timeout(msg_queue->lat_ctx.ready_to_use, ++ ret = wait_event_timeout(msg_queue->ctx->msg_queue.core_dec_done, + msg_queue->lat_ctx.ready_num == NUM_BUFFER_COUNT, + timeout_jiff); + if (ret) { +@@ -257,6 +257,7 @@ static void vdec_msg_queue_core_work(struct work_struct *work) + mtk_vcodec_dec_disable_hardware(ctx, MTK_VDEC_CORE); + vdec_msg_queue_qbuf(&ctx->msg_queue.lat_ctx, lat_buf); + ++ wake_up_all(&ctx->msg_queue.core_dec_done); + if (atomic_read(&lat_buf->ctx->msg_queue.core_list_cnt)) { + mtk_v4l2_debug(3, "re-schedule to decode for core: %d", + dev->msg_queue_core_ctx.ready_num); +@@ -281,6 +282,7 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue, + + atomic_set(&msg_queue->lat_list_cnt, 0); + atomic_set(&msg_queue->core_list_cnt, 0); ++ init_waitqueue_head(&msg_queue->core_dec_done); + + msg_queue->wdma_addr.size = + vde_msg_queue_get_trans_size(ctx->picinfo.buf_w, +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h +index 56280d6682c5a..a75c04418f52e 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h +@@ -76,6 +76,7 @@ struct vdec_lat_buf { + * + * @lat_list_cnt: used to record each instance lat list count + * @core_list_cnt: used to record each instance core list count ++ * @core_dec_done: core work queue decode done event + */ + struct vdec_msg_queue { + struct vdec_lat_buf lat_buf[NUM_BUFFER_COUNT]; +@@ -90,6 +91,7 @@ struct vdec_msg_queue { + + atomic_t lat_list_cnt; + atomic_t core_list_cnt; ++ wait_queue_head_t core_dec_done; + }; + + /** +-- +2.39.2 + diff --git a/queue-6.2/media-mediatek-vcodec-add-params-to-record-lat-and-c.patch b/queue-6.2/media-mediatek-vcodec-add-params-to-record-lat-and-c.patch new file mode 100644 index 00000000000..3904d7f0125 --- /dev/null +++ b/queue-6.2/media-mediatek-vcodec-add-params-to-record-lat-and-c.patch @@ -0,0 +1,109 @@ +From 4ed09e843eded0f3062a0413dd4a955d85c76707 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 07:33:10 +0000 +Subject: media: mediatek: vcodec: add params to record lat and core lat_buf + count + +From: Yunfei Dong + +[ Upstream commit 5bbb6e2ca67477ab41163b32e6b3444faea74a5e ] + +Using lat_buf to share decoder information between lat and core work +queue, adding params to record the buf count. + +Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode") +Signed-off-by: Yunfei Dong +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/vdec_msg_queue.c | 23 ++++++++++++++++++- + .../platform/mediatek/vcodec/vdec_msg_queue.h | 6 +++++ + 2 files changed, 28 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +index dc2004790a472..3f016c87d722c 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +@@ -52,6 +52,22 @@ static struct list_head *vdec_get_buf_list(int hardware_index, struct vdec_lat_b + } + } + ++static void vdec_msg_queue_inc(struct vdec_msg_queue *msg_queue, int hardware_index) ++{ ++ if (hardware_index == MTK_VDEC_CORE) ++ atomic_inc(&msg_queue->core_list_cnt); ++ else ++ atomic_inc(&msg_queue->lat_list_cnt); ++} ++ ++static void vdec_msg_queue_dec(struct vdec_msg_queue *msg_queue, int hardware_index) ++{ ++ if (hardware_index == MTK_VDEC_CORE) ++ atomic_dec(&msg_queue->core_list_cnt); ++ else ++ atomic_dec(&msg_queue->lat_list_cnt); ++} ++ + int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf *buf) + { + struct list_head *head; +@@ -66,6 +82,7 @@ int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf + list_add_tail(head, &msg_ctx->ready_queue); + msg_ctx->ready_num++; + ++ vdec_msg_queue_inc(&buf->ctx->msg_queue, msg_ctx->hardware_index); + if (msg_ctx->hardware_index != MTK_VDEC_CORE) + wake_up_all(&msg_ctx->ready_to_use); + else +@@ -127,6 +144,7 @@ struct vdec_lat_buf *vdec_msg_queue_dqbuf(struct vdec_msg_queue_ctx *msg_ctx) + return NULL; + } + list_del(head); ++ vdec_msg_queue_dec(&buf->ctx->msg_queue, msg_ctx->hardware_index); + + msg_ctx->ready_num--; + mtk_v4l2_debug(3, "dqueue buf type:%d addr: 0x%p num: %d", +@@ -241,10 +259,13 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue, + + vdec_msg_queue_init_ctx(&msg_queue->lat_ctx, MTK_VDEC_LAT0); + INIT_WORK(&msg_queue->core_work, vdec_msg_queue_core_work); ++ ++ atomic_set(&msg_queue->lat_list_cnt, 0); ++ atomic_set(&msg_queue->core_list_cnt, 0); ++ + msg_queue->wdma_addr.size = + vde_msg_queue_get_trans_size(ctx->picinfo.buf_w, + ctx->picinfo.buf_h); +- + err = mtk_vcodec_mem_alloc(ctx, &msg_queue->wdma_addr); + if (err) { + mtk_v4l2_err("failed to allocate wdma_addr buf"); +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h +index c43d427f5f544..b1aa5572ba49f 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h +@@ -72,6 +72,9 @@ struct vdec_lat_buf { + * @wdma_wptr_addr: ube write point + * @core_work: core hardware work + * @lat_ctx: used to store lat buffer list ++ * ++ * @lat_list_cnt: used to record each instance lat list count ++ * @core_list_cnt: used to record each instance core list count + */ + struct vdec_msg_queue { + struct vdec_lat_buf lat_buf[NUM_BUFFER_COUNT]; +@@ -82,6 +85,9 @@ struct vdec_msg_queue { + + struct work_struct core_work; + struct vdec_msg_queue_ctx lat_ctx; ++ ++ atomic_t lat_list_cnt; ++ atomic_t core_list_cnt; + }; + + /** +-- +2.39.2 + diff --git a/queue-6.2/media-mediatek-vcodec-add-remove-function-for-decode.patch b/queue-6.2/media-mediatek-vcodec-add-remove-function-for-decode.patch new file mode 100644 index 00000000000..0dd0b9f4754 --- /dev/null +++ b/queue-6.2/media-mediatek-vcodec-add-remove-function-for-decode.patch @@ -0,0 +1,46 @@ +From 38aa194a0a18f2ee7d670e11c3b831e8a449a8d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 10:14:50 +0100 +Subject: media: mediatek: vcodec: add remove function for decoder platform + driver + +From: Yunfei Dong + +[ Upstream commit e2a10b3801061d05d3e3415b9b824251451cfd6c ] + +Need to disable decoder power when remove decoder hardware driver, adding +remove callback function in the definition of platform driver. + +Fixes: c05bada35f01 ("media: mtk-vcodec: Add to support multi hardware decode") +Signed-off-by: Yunfei Dong +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../media/platform/mediatek/vcodec/mtk_vcodec_dec_hw.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_hw.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_hw.c +index 376db0e433d75..b753bf54ebd90 100644 +--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_hw.c ++++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_hw.c +@@ -193,8 +193,16 @@ static int mtk_vdec_hw_probe(struct platform_device *pdev) + return ret; + } + ++static int mtk_vdec_hw_remove(struct platform_device *pdev) ++{ ++ pm_runtime_disable(&pdev->dev); ++ ++ return 0; ++} ++ + static struct platform_driver mtk_vdec_driver = { + .probe = mtk_vdec_hw_probe, ++ .remove = mtk_vdec_hw_remove, + .driver = { + .name = "mtk-vdec-comp", + .of_match_table = mtk_vdec_hw_match, +-- +2.39.2 + diff --git a/queue-6.2/media-mediatek-vcodec-change-lat-thread-decode-error.patch b/queue-6.2/media-mediatek-vcodec-change-lat-thread-decode-error.patch new file mode 100644 index 00000000000..8e2a56fc122 --- /dev/null +++ b/queue-6.2/media-mediatek-vcodec-change-lat-thread-decode-error.patch @@ -0,0 +1,70 @@ +From 6109b3119cc69c5e4501c16eeebb950b4cfe0548 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 07:33:16 +0000 +Subject: media: mediatek: vcodec: change lat thread decode error condition + +From: Yunfei Dong + +[ Upstream commit 960badda95f10fb0c60f6f64978b19eafa9507a7 ] + +If lat thread can't get lat buffer, it should be that current instance +don't be schedulded, the driver can't free the src buffer directly. + +Fixes: 7b182b8d9c85 ("media: mediatek: vcodec: Refactor get and put capture buffer flow") +Signed-off-by: Yunfei Dong +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c | 6 ++++-- + .../platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c | 2 +- + .../platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c | 2 +- + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c +index ab8f642d1e5b0..3000db975e5f5 100644 +--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c ++++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c +@@ -258,8 +258,10 @@ static void mtk_vdec_worker(struct work_struct *work) + if (src_buf_req) + v4l2_ctrl_request_complete(src_buf_req, &ctx->ctrl_hdl); + } else { +- v4l2_m2m_src_buf_remove(ctx->m2m_ctx); +- v4l2_m2m_buf_done(vb2_v4l2_src, state); ++ if (ret != -EAGAIN) { ++ v4l2_m2m_src_buf_remove(ctx->m2m_ctx); ++ v4l2_m2m_buf_done(vb2_v4l2_src, state); ++ } + v4l2_m2m_job_finish(dev->m2m_dev_dec, ctx->m2m_ctx); + } + } +diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c +index 955b2d0c8f53f..999ce7ee5fdc2 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c ++++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c +@@ -597,7 +597,7 @@ static int vdec_h264_slice_lat_decode(void *h_vdec, struct mtk_vcodec_mem *bs, + lat_buf = vdec_msg_queue_dqbuf(&inst->ctx->msg_queue.lat_ctx); + if (!lat_buf) { + mtk_vcodec_err(inst, "failed to get lat buffer"); +- return -EINVAL; ++ return -EAGAIN; + } + share_info = lat_buf->private_data; + src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer); +diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c +index cbb6728b8a40b..cf16cf2807f07 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c ++++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c +@@ -2070,7 +2070,7 @@ static int vdec_vp9_slice_lat_decode(void *h_vdec, struct mtk_vcodec_mem *bs, + lat_buf = vdec_msg_queue_dqbuf(&instance->ctx->msg_queue.lat_ctx); + if (!lat_buf) { + mtk_vcodec_err(instance, "Failed to get VP9 lat buf\n"); +- return -EBUSY; ++ return -EAGAIN; + } + pfc = (struct vdec_vp9_slice_pfc *)lat_buf->private_data; + if (!pfc) { +-- +2.39.2 + diff --git a/queue-6.2/media-mediatek-vcodec-fix-decoder-disable-pm-crash.patch b/queue-6.2/media-mediatek-vcodec-fix-decoder-disable-pm-crash.patch new file mode 100644 index 00000000000..4b1aa7ab7e4 --- /dev/null +++ b/queue-6.2/media-mediatek-vcodec-fix-decoder-disable-pm-crash.patch @@ -0,0 +1,65 @@ +From 5a2ea48677af8af4b802b4122d81f0a78c2c5b56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 10:14:49 +0100 +Subject: media: mediatek: vcodec: fix decoder disable pm crash + +From: Yunfei Dong + +[ Upstream commit 9d2f13fb47dcab6d094f34ecfd6a879a409722b3 ] + +Can't call pm_runtime_disable when the architecture support sub device for +'dev->pm.dev' is NUll, or will get below crash log. + +[ 10.771551] pc : _raw_spin_lock_irq+0x4c/0xa0 +[ 10.771556] lr : __pm_runtime_disable+0x30/0x130 +[ 10.771558] sp : ffffffc01e4cb800 +[ 10.771559] x29: ffffffc01e4cb800 x28: ffffffdf082108a8 +[ 10.771563] x27: ffffffc01e4cbd70 x26: ffffff8605df55f0 +[ 10.771567] x25: 0000000000000002 x24: 0000000000000002 +[ 10.771570] x23: ffffff85c0dc9c00 x22: 0000000000000001 +[ 10.771573] x21: 0000000000000001 x20: 0000000000000000 +[ 10.771577] x19: 00000000000000f4 x18: ffffffdf2e9fbe18 +[ 10.771580] x17: 0000000000000000 x16: ffffffdf2df13c74 +[ 10.771583] x15: 00000000000002ea x14: 0000000000000058 +[ 10.771587] x13: ffffffdf2de1b62c x12: ffffffdf2e9e30e4 +[ 10.771590] x11: 0000000000000000 x10: 0000000000000001 +[ 10.771593] x9 : 0000000000000000 x8 : 00000000000000f4 +[ 10.771596] x7 : 6bff6264632c6264 x6 : 0000000000008000 +[ 10.771600] x5 : 0080000000000000 x4 : 0000000000000001 +[ 10.771603] x3 : 0000000000000008 x2 : 0000000000000001 +[ 10.771608] x1 : 0000000000000000 x0 : 00000000000000f4 +[ 10.771613] Call trace: +[ 10.771617] _raw_spin_lock_irq+0x4c/0xa0 +[ 10.771620] __pm_runtime_disable+0x30/0x130 +[ 10.771657] mtk_vcodec_probe+0x69c/0x728 [mtk_vcodec_dec 800cc929d6631f79f9b273254c8db94d0d3500dc] +[ 10.771662] platform_drv_probe+0x9c/0xbc +[ 10.771665] really_probe+0x13c/0x3a0 +[ 10.771668] driver_probe_device+0x84/0xc0 +[ 10.771671] device_driver_attach+0x54/0x78 + +Fixes: ba31a5b39400 ("media: mtk-vcodec: Remove mtk_vcodec_release_dec_pm") +Signed-off-by: Yunfei Dong +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c +index 174a6eec2f549..42df901e8beb4 100644 +--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c ++++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c +@@ -451,7 +451,8 @@ static int mtk_vcodec_probe(struct platform_device *pdev) + if (IS_VDEC_LAT_ARCH(dev->vdec_pdata->hw_arch)) + destroy_workqueue(dev->core_workqueue); + err_res: +- pm_runtime_disable(dev->pm.dev); ++ if (!dev->vdec_pdata->is_subdev_supported) ++ pm_runtime_disable(dev->pm.dev); + err_dec_pm: + mtk_vcodec_fw_release(dev->fw_handler); + return ret; +-- +2.39.2 + diff --git a/queue-6.2/media-mediatek-vcodec-force-capture-queue-format-to-.patch b/queue-6.2/media-mediatek-vcodec-force-capture-queue-format-to-.patch new file mode 100644 index 00000000000..3271992a9a1 --- /dev/null +++ b/queue-6.2/media-mediatek-vcodec-force-capture-queue-format-to-.patch @@ -0,0 +1,79 @@ +From 1600038fbc2a38ffefc2616bfab0892285a2205a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 03:56:51 +0000 +Subject: media: mediatek: vcodec: Force capture queue format to MM21 + +From: Yunfei Dong + +[ Upstream commit 68c7df527657a9e962da7b5b9c0308557357d8dc ] + +While the decoder can produce frames in both MM21 and MT21C formats, only +MM21 is currently supported by userspace tools (like gstreamer and libyuv). +In order to ensure userspace keeps working after the SCP firmware is +updated to support both MM21 and MT21C formats, force the MM21 format for +the capture queue. + +This is meant as a stopgap solution while dynamic format switching between +MM21 and MT21C isn't implemented in the driver. + +Fixes: 7501edef6b1f ("media: mediatek: vcodec: Different codec using different capture format") +Signed-off-by: Yunfei Dong +Reviewed-by: Nicolas F. R. A. Prado +Tested-by: Nicolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/mtk_vcodec_dec.c | 24 +++---------------- + 1 file changed, 3 insertions(+), 21 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c +index 641f533c417fd..c99705681a03e 100644 +--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c ++++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c +@@ -39,10 +39,9 @@ static bool mtk_vdec_get_cap_fmt(struct mtk_vcodec_ctx *ctx, int format_index) + { + const struct mtk_vcodec_dec_pdata *dec_pdata = ctx->dev->vdec_pdata; + const struct mtk_video_fmt *fmt; +- struct mtk_q_data *q_data; + int num_frame_count = 0, i; +- bool ret = true; + ++ fmt = &dec_pdata->vdec_formats[format_index]; + for (i = 0; i < *dec_pdata->num_formats; i++) { + if (dec_pdata->vdec_formats[i].type != MTK_FMT_FRAME) + continue; +@@ -50,27 +49,10 @@ static bool mtk_vdec_get_cap_fmt(struct mtk_vcodec_ctx *ctx, int format_index) + num_frame_count++; + } + +- if (num_frame_count == 1) ++ if (num_frame_count == 1 || fmt->fourcc == V4L2_PIX_FMT_MM21) + return true; + +- fmt = &dec_pdata->vdec_formats[format_index]; +- q_data = &ctx->q_data[MTK_Q_DATA_SRC]; +- switch (q_data->fmt->fourcc) { +- case V4L2_PIX_FMT_VP8_FRAME: +- if (fmt->fourcc == V4L2_PIX_FMT_MM21) +- ret = true; +- break; +- case V4L2_PIX_FMT_H264_SLICE: +- case V4L2_PIX_FMT_VP9_FRAME: +- if (fmt->fourcc == V4L2_PIX_FMT_MM21) +- ret = false; +- break; +- default: +- ret = true; +- break; +- } +- +- return ret; ++ return false; + } + + static struct mtk_q_data *mtk_vdec_get_q_data(struct mtk_vcodec_ctx *ctx, +-- +2.39.2 + diff --git a/queue-6.2/media-mediatek-vcodec-make-mm21-the-default-capture-.patch b/queue-6.2/media-mediatek-vcodec-make-mm21-the-default-capture-.patch new file mode 100644 index 00000000000..41bb430f575 --- /dev/null +++ b/queue-6.2/media-mediatek-vcodec-make-mm21-the-default-capture-.patch @@ -0,0 +1,62 @@ +From 004d06bd7c97a139257ad9f4f296d8a36b8b0d8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 03:56:50 +0000 +Subject: media: mediatek: vcodec: Make MM21 the default capture format + +From: Yunfei Dong + +[ Upstream commit 6d020d81b91af80a977061e82de25cafa4456af5 ] + +Given that only the MM21 capture format is supported by userspace tools +(like gstreamer and libyuv), make it the default capture format. + +This allows us to force the MM21 format even when a MM21 and MT21C capable +firmware is available (which is needed while dynamic format switching isn't +implemented in the driver), without causing the following regressions on +v4l2-compliance: + + fail: v4l2-test-formats.cpp(478): pixelformat 3132544d (MT21) for buftype 9 not reported by ENUM_FMT + test VIDIOC_G_FMT: FAIL + fail: v4l2-test-formats.cpp(478): pixelformat 3132544d (MT21) for buftype 9 not reported by ENUM_FMT + test VIDIOC_TRY_FMT: FAIL + fail: v4l2-test-formats.cpp(478): pixelformat 3132544d (MT21) for buftype 9 not reported by ENUM_FMT + test VIDIOC_S_FMT: FAIL + +Fixes: 7501edef6b1f ("media: mediatek: vcodec: Different codec using different capture format") +Signed-off-by: Yunfei Dong +Reviewed-by: Nicolas F. R. A. Prado +Tested-by: Nicolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c +index ffbcee04dc26f..ab8f642d1e5b0 100644 +--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c ++++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c +@@ -390,14 +390,14 @@ static void mtk_vcodec_get_supported_formats(struct mtk_vcodec_ctx *ctx) + if (num_formats) + return; + +- if (ctx->dev->dec_capability & MTK_VDEC_FORMAT_MM21) { +- mtk_vcodec_add_formats(V4L2_PIX_FMT_MM21, ctx); +- cap_format_count++; +- } + if (ctx->dev->dec_capability & MTK_VDEC_FORMAT_MT21C) { + mtk_vcodec_add_formats(V4L2_PIX_FMT_MT21C, ctx); + cap_format_count++; + } ++ if (ctx->dev->dec_capability & MTK_VDEC_FORMAT_MM21) { ++ mtk_vcodec_add_formats(V4L2_PIX_FMT_MM21, ctx); ++ cap_format_count++; ++ } + if (ctx->dev->dec_capability & MTK_VDEC_FORMAT_H264_SLICE) { + mtk_vcodec_add_formats(V4L2_PIX_FMT_H264_SLICE, ctx); + out_format_count++; +-- +2.39.2 + diff --git a/queue-6.2/media-mediatek-vcodec-making-sure-queue_work-success.patch b/queue-6.2/media-mediatek-vcodec-making-sure-queue_work-success.patch new file mode 100644 index 00000000000..3bd2ec7aca6 --- /dev/null +++ b/queue-6.2/media-mediatek-vcodec-making-sure-queue_work-success.patch @@ -0,0 +1,119 @@ +From 3f1b2e03b2ba4d59642a56e6447b0f979398a801 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 07:33:15 +0000 +Subject: media: mediatek: vcodec: making sure queue_work successfully + +From: Yunfei Dong + +[ Upstream commit 2e0ef56d81cb2569624d288b7e95a8a2734a7c74 ] + +Putting core work to work queue using queue_work maybe fail, call +queue_work again when the count of core work in work queue is less +than core_list_cnt, making sure all the buffer in core list can be +scheduled. + +Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode") +Signed-off-by: Yunfei Dong +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/vdec_msg_queue.c | 31 ++++++++++++++----- + .../platform/mediatek/vcodec/vdec_msg_queue.h | 2 ++ + 2 files changed, 25 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +index cdc539a46cb95..f3073d1e7f420 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +@@ -71,6 +71,7 @@ static void vdec_msg_queue_dec(struct vdec_msg_queue *msg_queue, int hardware_in + int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf *buf) + { + struct list_head *head; ++ int status; + + head = vdec_get_buf_list(msg_ctx->hardware_index, buf); + if (!head) { +@@ -83,11 +84,17 @@ int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf + msg_ctx->ready_num++; + + vdec_msg_queue_inc(&buf->ctx->msg_queue, msg_ctx->hardware_index); +- if (msg_ctx->hardware_index != MTK_VDEC_CORE) ++ if (msg_ctx->hardware_index != MTK_VDEC_CORE) { + wake_up_all(&msg_ctx->ready_to_use); +- else +- queue_work(buf->ctx->dev->core_workqueue, +- &buf->ctx->msg_queue.core_work); ++ } else { ++ if (buf->ctx->msg_queue.core_work_cnt < ++ atomic_read(&buf->ctx->msg_queue.core_list_cnt)) { ++ status = queue_work(buf->ctx->dev->core_workqueue, ++ &buf->ctx->msg_queue.core_work); ++ if (status) ++ buf->ctx->msg_queue.core_work_cnt++; ++ } ++ } + + mtk_v4l2_debug(3, "enqueue buf type: %d addr: 0x%p num: %d", + msg_ctx->hardware_index, buf, msg_ctx->ready_num); +@@ -254,6 +261,7 @@ static void vdec_msg_queue_core_work(struct work_struct *work) + container_of(msg_queue, struct mtk_vcodec_ctx, msg_queue); + struct mtk_vcodec_dev *dev = ctx->dev; + struct vdec_lat_buf *lat_buf; ++ int status; + + lat_buf = vdec_msg_queue_dqbuf(&dev->msg_queue_core_ctx); + if (!lat_buf) +@@ -270,11 +278,17 @@ static void vdec_msg_queue_core_work(struct work_struct *work) + vdec_msg_queue_qbuf(&ctx->msg_queue.lat_ctx, lat_buf); + + wake_up_all(&ctx->msg_queue.core_dec_done); +- if (atomic_read(&lat_buf->ctx->msg_queue.core_list_cnt)) { +- mtk_v4l2_debug(3, "re-schedule to decode for core: %d", +- dev->msg_queue_core_ctx.ready_num); +- queue_work(dev->core_workqueue, &msg_queue->core_work); ++ spin_lock(&dev->msg_queue_core_ctx.ready_lock); ++ lat_buf->ctx->msg_queue.core_work_cnt--; ++ ++ if (lat_buf->ctx->msg_queue.core_work_cnt < ++ atomic_read(&lat_buf->ctx->msg_queue.core_list_cnt)) { ++ status = queue_work(lat_buf->ctx->dev->core_workqueue, ++ &lat_buf->ctx->msg_queue.core_work); ++ if (status) ++ lat_buf->ctx->msg_queue.core_work_cnt++; + } ++ spin_unlock(&dev->msg_queue_core_ctx.ready_lock); + } + + int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue, +@@ -289,6 +303,7 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue, + return 0; + + msg_queue->ctx = ctx; ++ msg_queue->core_work_cnt = 0; + vdec_msg_queue_init_ctx(&msg_queue->lat_ctx, MTK_VDEC_LAT0); + INIT_WORK(&msg_queue->core_work, vdec_msg_queue_core_work); + +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h +index a75c04418f52e..a5d44bc97c16b 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h +@@ -77,6 +77,7 @@ struct vdec_lat_buf { + * @lat_list_cnt: used to record each instance lat list count + * @core_list_cnt: used to record each instance core list count + * @core_dec_done: core work queue decode done event ++ * @core_work_cnt: the number of core work in work queue + */ + struct vdec_msg_queue { + struct vdec_lat_buf lat_buf[NUM_BUFFER_COUNT]; +@@ -92,6 +93,7 @@ struct vdec_msg_queue { + atomic_t lat_list_cnt; + atomic_t core_list_cnt; + wait_queue_head_t core_dec_done; ++ int core_work_cnt; + }; + + /** +-- +2.39.2 + diff --git a/queue-6.2/media-mediatek-vcodec-move-lat_buf-to-the-top-of-cor.patch b/queue-6.2/media-mediatek-vcodec-move-lat_buf-to-the-top-of-cor.patch new file mode 100644 index 00000000000..e5577a5b54e --- /dev/null +++ b/queue-6.2/media-mediatek-vcodec-move-lat_buf-to-the-top-of-cor.patch @@ -0,0 +1,87 @@ +From f4b602a075dc970caabcc2f1959fd1054e5f2c14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 07:33:12 +0000 +Subject: media: mediatek: vcodec: move lat_buf to the top of core list + +From: Yunfei Dong + +[ Upstream commit 2cfca6c1bf8074175ea7a3b6b47f77ebdef8f701 ] + +Current instance will decode done when begin to wait lat buf full, +move the lat_buf of current instance to the top of core list to make +sure current instance's lat_buf will be used firstly. + +Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode") +Signed-off-by: Yunfei Dong +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/vdec_msg_queue.c | 21 ++++++++++++++++++- + .../platform/mediatek/vcodec/vdec_msg_queue.h | 2 ++ + 2 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +index ad5002ca953e0..0da6e3e2ef0b3 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +@@ -174,8 +174,26 @@ void vdec_msg_queue_update_ube_wptr(struct vdec_msg_queue *msg_queue, uint64_t u + + bool vdec_msg_queue_wait_lat_buf_full(struct vdec_msg_queue *msg_queue) + { ++ struct vdec_lat_buf *buf, *tmp; ++ struct list_head *list_core[3]; ++ struct vdec_msg_queue_ctx *core_ctx; ++ int ret, i, in_core_count = 0; + long timeout_jiff; +- int ret; ++ ++ core_ctx = &msg_queue->ctx->dev->msg_queue_core_ctx; ++ spin_lock(&core_ctx->ready_lock); ++ list_for_each_entry_safe(buf, tmp, &core_ctx->ready_queue, core_list) { ++ if (buf && buf->ctx == msg_queue->ctx) { ++ list_core[in_core_count++] = &buf->core_list; ++ list_del(&buf->core_list); ++ } ++ } ++ ++ for (i = 0; i < in_core_count; i++) { ++ list_add(list_core[in_core_count - (1 + i)], &core_ctx->ready_queue); ++ queue_work(msg_queue->ctx->dev->core_workqueue, &msg_queue->core_work); ++ } ++ spin_unlock(&core_ctx->ready_lock); + + timeout_jiff = msecs_to_jiffies(1000 * (NUM_BUFFER_COUNT + 2)); + ret = wait_event_timeout(msg_queue->lat_ctx.ready_to_use, +@@ -257,6 +275,7 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue, + if (msg_queue->wdma_addr.size) + return 0; + ++ msg_queue->ctx = ctx; + vdec_msg_queue_init_ctx(&msg_queue->lat_ctx, MTK_VDEC_LAT0); + INIT_WORK(&msg_queue->core_work, vdec_msg_queue_core_work); + +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h +index b1aa5572ba49f..56280d6682c5a 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h +@@ -72,6 +72,7 @@ struct vdec_lat_buf { + * @wdma_wptr_addr: ube write point + * @core_work: core hardware work + * @lat_ctx: used to store lat buffer list ++ * @ctx: point to mtk_vcodec_ctx + * + * @lat_list_cnt: used to record each instance lat list count + * @core_list_cnt: used to record each instance core list count +@@ -85,6 +86,7 @@ struct vdec_msg_queue { + + struct work_struct core_work; + struct vdec_msg_queue_ctx lat_ctx; ++ struct mtk_vcodec_ctx *ctx; + + atomic_t lat_list_cnt; + atomic_t core_list_cnt; +-- +2.39.2 + diff --git a/queue-6.2/media-mediatek-vcodec-remove-unused-lat_buf.patch b/queue-6.2/media-mediatek-vcodec-remove-unused-lat_buf.patch new file mode 100644 index 00000000000..5987b837fb4 --- /dev/null +++ b/queue-6.2/media-mediatek-vcodec-remove-unused-lat_buf.patch @@ -0,0 +1,61 @@ +From 2fd721a3398ba0aabab3885b0159723547f20e5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 07:33:14 +0000 +Subject: media: mediatek: vcodec: remove unused lat_buf + +From: Yunfei Dong + +[ Upstream commit af50b13dd3d7d5dbc1f08add1c462398e926a053 ] + +Remove unused lat_buf from core list, or leading to core list access +NULL point. + +Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode") +Signed-off-by: Yunfei Dong +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/vdec_msg_queue.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +index ce7c82e38103a..cdc539a46cb95 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +@@ -177,7 +177,7 @@ bool vdec_msg_queue_wait_lat_buf_full(struct vdec_msg_queue *msg_queue) + struct vdec_lat_buf *buf, *tmp; + struct list_head *list_core[3]; + struct vdec_msg_queue_ctx *core_ctx; +- int ret, i, in_core_count = 0; ++ int ret, i, in_core_count = 0, count = 0; + long timeout_jiff; + + core_ctx = &msg_queue->ctx->dev->msg_queue_core_ctx; +@@ -204,8 +204,20 @@ bool vdec_msg_queue_wait_lat_buf_full(struct vdec_msg_queue *msg_queue) + msg_queue->lat_ctx.ready_num); + return true; + } +- mtk_v4l2_err("failed with lat buf isn't full: %d", +- msg_queue->lat_ctx.ready_num); ++ ++ spin_lock(&core_ctx->ready_lock); ++ list_for_each_entry_safe(buf, tmp, &core_ctx->ready_queue, core_list) { ++ if (buf && buf->ctx == msg_queue->ctx) { ++ count++; ++ list_del(&buf->core_list); ++ } ++ } ++ spin_unlock(&core_ctx->ready_lock); ++ ++ mtk_v4l2_err("failed with lat buf isn't full: list(%d %d) count:%d", ++ atomic_read(&msg_queue->lat_list_cnt), ++ atomic_read(&msg_queue->core_list_cnt), count); ++ + return false; + } + +-- +2.39.2 + diff --git a/queue-6.2/media-mediatek-vcodec-use-4k-frame-size-when-support.patch b/queue-6.2/media-mediatek-vcodec-use-4k-frame-size-when-support.patch new file mode 100644 index 00000000000..f187e17200d --- /dev/null +++ b/queue-6.2/media-mediatek-vcodec-use-4k-frame-size-when-support.patch @@ -0,0 +1,61 @@ +From 43c5224114ee6d22c5708ea0f13ae878aaa8d1b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 10:22:41 +0000 +Subject: media: mediatek: vcodec: Use 4K frame size when supported by stateful + decoder + +From: Pin-yen Lin + +[ Upstream commit e25528e1dbe52784ac250071653104a8adc848e2 ] + +After commit b018be06f3c7 ("media: mediatek: vcodec: Read max resolution +from dec_capability"), the stateful video decoder driver never really +sets its output frame size to 4K. + +Parse the decoder capability reported by the firmware, and update the +output frame size in mtk_init_vdec_params to enable 4K frame size when +available. + +Fixes: b018be06f3c7 ("media: mediatek: vcodec: Read max resolution from dec_capability") +Signed-off-by: Pin-yen Lin +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../mediatek/vcodec/mtk_vcodec_dec_stateful.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateful.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateful.c +index 035c86e7809fd..29991551cf614 100644 +--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateful.c ++++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateful.c +@@ -11,7 +11,7 @@ + #include "mtk_vcodec_dec_pm.h" + #include "vdec_drv_if.h" + +-static const struct mtk_video_fmt mtk_video_formats[] = { ++static struct mtk_video_fmt mtk_video_formats[] = { + { + .fourcc = V4L2_PIX_FMT_H264, + .type = MTK_FMT_DEC, +@@ -580,6 +580,16 @@ static int mtk_vcodec_dec_ctrls_setup(struct mtk_vcodec_ctx *ctx) + + static void mtk_init_vdec_params(struct mtk_vcodec_ctx *ctx) + { ++ unsigned int i; ++ ++ if (!(ctx->dev->dec_capability & VCODEC_CAPABILITY_4K_DISABLED)) { ++ for (i = 0; i < num_supported_formats; i++) { ++ mtk_video_formats[i].frmsize.max_width = ++ VCODEC_DEC_4K_CODED_WIDTH; ++ mtk_video_formats[i].frmsize.max_height = ++ VCODEC_DEC_4K_CODED_HEIGHT; ++ } ++ } + } + + static struct vb2_ops mtk_vdec_frame_vb2_ops = { +-- +2.39.2 + diff --git a/queue-6.2/media-mediatek-vcodec-using-each-instance-lat_buf-co.patch b/queue-6.2/media-mediatek-vcodec-using-each-instance-lat_buf-co.patch new file mode 100644 index 00000000000..0b8ea930c79 --- /dev/null +++ b/queue-6.2/media-mediatek-vcodec-using-each-instance-lat_buf-co.patch @@ -0,0 +1,40 @@ +From cf8fbeb11c2beef97acfa7e1ef28b94864dc9c0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 07:33:11 +0000 +Subject: media: mediatek: vcodec: using each instance lat_buf count replace + core ready list + +From: Yunfei Dong + +[ Upstream commit f7a3780cf96925670736582b9a623a2c9ffb4166 ] + +Core Hardware decoder depends on each instance lat_buf count, +calling queue_work decode again when the lat_buf count of each instance +isn't zero. + +Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode") +Signed-off-by: Yunfei Dong +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +index 3f016c87d722c..ad5002ca953e0 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +@@ -239,7 +239,7 @@ static void vdec_msg_queue_core_work(struct work_struct *work) + mtk_vcodec_dec_disable_hardware(ctx, MTK_VDEC_CORE); + vdec_msg_queue_qbuf(&ctx->msg_queue.lat_ctx, lat_buf); + +- if (!list_empty(&dev->msg_queue_core_ctx.ready_queue)) { ++ if (atomic_read(&lat_buf->ctx->msg_queue.core_list_cnt)) { + mtk_v4l2_debug(3, "re-schedule to decode for core: %d", + dev->msg_queue_core_ctx.ready_num); + queue_work(dev->core_workqueue, &msg_queue->core_work); +-- +2.39.2 + diff --git a/queue-6.2/media-mtk-jpeg-fixes-jpeg-enc-dec-worker-sw-flow.patch b/queue-6.2/media-mtk-jpeg-fixes-jpeg-enc-dec-worker-sw-flow.patch new file mode 100644 index 00000000000..8f282fac138 --- /dev/null +++ b/queue-6.2/media-mtk-jpeg-fixes-jpeg-enc-dec-worker-sw-flow.patch @@ -0,0 +1,99 @@ +From 881e0747fb512894aa8d163ad519782a2389181c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 06:23:51 +0000 +Subject: media: mtk-jpeg: Fixes jpeg enc&dec worker sw flow + +From: kyrie wu + +[ Upstream commit 86379bd9d399e2c5fd638a869af223d4910725c3 ] + +1. Move removing buffer after sw setting and before hw setting +in enc&dec worker to prevents the operation of removing +the buffer twice if the sw setting fails. +2. Remove the redundant operation of queue work in the +jpegenc irq handler because the jpegenc worker has called +v4l2_m2m_job_finish to do it. + +Fixes: 5fb1c2361e56 ("mtk-jpegenc: add jpeg encode worker interface") +Fixes: dedc21500334 ("media: mtk-jpegdec: add jpeg decode worker interface") +Signed-off-by: kyrie wu +Signed-off-by: irui wang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 14 +++++++------- + .../media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c | 4 ---- + 2 files changed, 7 insertions(+), 11 deletions(-) + +diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +index 6d052747a15e8..d9584fe5033eb 100644 +--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c ++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +@@ -1025,9 +1025,6 @@ static void mtk_jpegenc_worker(struct work_struct *work) + if (!dst_buf) + goto getbuf_fail; + +- v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx); +- v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); +- + v4l2_m2m_buf_copy_metadata(src_buf, dst_buf, true); + + mtk_jpegenc_set_hw_param(ctx, hw_id, src_buf, dst_buf); +@@ -1045,6 +1042,9 @@ static void mtk_jpegenc_worker(struct work_struct *work) + goto enc_end; + } + ++ v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx); ++ v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); ++ + schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work, + msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); + +@@ -1220,9 +1220,6 @@ static void mtk_jpegdec_worker(struct work_struct *work) + if (!dst_buf) + goto getbuf_fail; + +- v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx); +- v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); +- + v4l2_m2m_buf_copy_metadata(src_buf, dst_buf, true); + jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf); + jpeg_dst_buf = mtk_jpeg_vb2_to_srcbuf(&dst_buf->vb2_buf); +@@ -1231,7 +1228,7 @@ static void mtk_jpegdec_worker(struct work_struct *work) + &jpeg_src_buf->dec_param)) { + mtk_jpeg_queue_src_chg_event(ctx); + ctx->state = MTK_JPEG_SOURCE_CHANGE; +- goto dec_end; ++ goto getbuf_fail; + } + + jpeg_src_buf->curr_ctx = ctx; +@@ -1254,6 +1251,9 @@ static void mtk_jpegdec_worker(struct work_struct *work) + goto clk_end; + } + ++ v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx); ++ v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); ++ + schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work, + msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); + +diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c +index 1bbb712d78d0e..867f4c1a09fa6 100644 +--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c ++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c +@@ -286,10 +286,6 @@ static irqreturn_t mtk_jpegenc_hw_irq_handler(int irq, void *priv) + mtk_jpegenc_put_buf(jpeg); + pm_runtime_put(ctx->jpeg->dev); + clk_disable_unprepare(jpeg->venc_clk.clks->clk); +- if (!list_empty(&ctx->fh.m2m_ctx->out_q_ctx.rdy_queue) || +- !list_empty(&ctx->fh.m2m_ctx->cap_q_ctx.rdy_queue)) { +- queue_work(master_jpeg->workqueue, &ctx->jpeg_work); +- } + + jpeg->hw_state = MTK_JPEG_HW_IDLE; + wake_up(&master_jpeg->enc_hw_wq); +-- +2.39.2 + diff --git a/queue-6.2/media-mtk-jpeg-fixes-jpeghw-multi-core-judgement.patch b/queue-6.2/media-mtk-jpeg-fixes-jpeghw-multi-core-judgement.patch new file mode 100644 index 00000000000..615883b1eda --- /dev/null +++ b/queue-6.2/media-mtk-jpeg-fixes-jpeghw-multi-core-judgement.patch @@ -0,0 +1,84 @@ +From a49bfa521602c356ce23fbc1756278b06c2d7065 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 06:23:49 +0000 +Subject: media: mtk-jpeg: Fixes jpeghw multi-core judgement + +From: kyrie wu + +[ Upstream commit 75c38caf66a10983acc5a59069bfc9492c43d682 ] + +some chips have multi-hw, but others have only one, +modify the condition of multi-hw judgement + +Fixes: 934e8bccac95 ("mtk-jpegenc: support jpegenc multi-hardware") +Signed-off-by: kyrie wu +Signed-off-by: irui wang +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 5 ++++- + drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.h | 2 ++ + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +index 969516a940ba7..6d052747a15e8 100644 +--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c ++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +@@ -1692,7 +1692,7 @@ static int mtk_jpeg_probe(struct platform_device *pdev) + return -EINVAL; + } + +- if (list_empty(&pdev->dev.devres_head)) { ++ if (!jpeg->variant->multi_core) { + INIT_DELAYED_WORK(&jpeg->job_timeout_work, + mtk_jpeg_job_timeout_work); + +@@ -1874,6 +1874,7 @@ static const struct mtk_jpeg_variant mtk_jpeg_drvdata = { + .ioctl_ops = &mtk_jpeg_enc_ioctl_ops, + .out_q_default_fourcc = V4L2_PIX_FMT_YUYV, + .cap_q_default_fourcc = V4L2_PIX_FMT_JPEG, ++ .multi_core = false, + }; + + static struct mtk_jpeg_variant mtk8195_jpegenc_drvdata = { +@@ -1885,6 +1886,7 @@ static struct mtk_jpeg_variant mtk8195_jpegenc_drvdata = { + .ioctl_ops = &mtk_jpeg_enc_ioctl_ops, + .out_q_default_fourcc = V4L2_PIX_FMT_YUYV, + .cap_q_default_fourcc = V4L2_PIX_FMT_JPEG, ++ .multi_core = true, + }; + + static const struct mtk_jpeg_variant mtk8195_jpegdec_drvdata = { +@@ -1896,6 +1898,7 @@ static const struct mtk_jpeg_variant mtk8195_jpegdec_drvdata = { + .ioctl_ops = &mtk_jpeg_dec_ioctl_ops, + .out_q_default_fourcc = V4L2_PIX_FMT_JPEG, + .cap_q_default_fourcc = V4L2_PIX_FMT_YUV420M, ++ .multi_core = true, + }; + + #if defined(CONFIG_OF) +diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.h b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.h +index b9126476be8fa..f87358cc9f47f 100644 +--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.h ++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.h +@@ -60,6 +60,7 @@ enum mtk_jpeg_ctx_state { + * @ioctl_ops: the callback of jpeg v4l2_ioctl_ops + * @out_q_default_fourcc: output queue default fourcc + * @cap_q_default_fourcc: capture queue default fourcc ++ * @multi_core: mark jpeg hw is multi_core or not + */ + struct mtk_jpeg_variant { + struct clk_bulk_data *clks; +@@ -74,6 +75,7 @@ struct mtk_jpeg_variant { + const struct v4l2_ioctl_ops *ioctl_ops; + u32 out_q_default_fourcc; + u32 cap_q_default_fourcc; ++ bool multi_core; + }; + + struct mtk_jpeg_src_buf { +-- +2.39.2 + diff --git a/queue-6.2/media-platform-mtk-mdp3-add-missing-check-and-free-f.patch b/queue-6.2/media-platform-mtk-mdp3-add-missing-check-and-free-f.patch new file mode 100644 index 00000000000..832e84d4969 --- /dev/null +++ b/queue-6.2/media-platform-mtk-mdp3-add-missing-check-and-free-f.patch @@ -0,0 +1,53 @@ +From 696de45196157c6d61683840a8d906854c0a4b07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 14:52:45 +0100 +Subject: media: platform: mtk-mdp3: Add missing check and free for ida_alloc + +From: Jiasheng Jiang + +[ Upstream commit d00f592250782538cda87745607695b0fe27dcd4 ] + +Add the check for the return value of the ida_alloc in order to avoid +NULL pointer dereference. +Moreover, free allocated "ctx->id" if mdp_m2m_open fails later in order +to avoid memory leak. + +Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") +Signed-off-by: Jiasheng Jiang +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mediatek/mdp3/mtk-mdp3-m2m.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-m2m.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-m2m.c +index 5f74ea3b7a524..8612a48bde10f 100644 +--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-m2m.c ++++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-m2m.c +@@ -566,7 +566,11 @@ static int mdp_m2m_open(struct file *file) + goto err_free_ctx; + } + +- ctx->id = ida_alloc(&mdp->mdp_ida, GFP_KERNEL); ++ ret = ida_alloc(&mdp->mdp_ida, GFP_KERNEL); ++ if (ret < 0) ++ goto err_unlock_mutex; ++ ctx->id = ret; ++ + ctx->mdp_dev = mdp; + + v4l2_fh_init(&ctx->fh, vdev); +@@ -617,6 +621,8 @@ static int mdp_m2m_open(struct file *file) + v4l2_fh_del(&ctx->fh); + err_exit_fh: + v4l2_fh_exit(&ctx->fh); ++ ida_free(&mdp->mdp_ida, ctx->id); ++err_unlock_mutex: + mutex_unlock(&mdp->m2m_lock); + err_free_ctx: + kfree(ctx); +-- +2.39.2 + diff --git a/queue-6.2/media-platform-mtk-mdp3-fix-potential-frame-size-ove.patch b/queue-6.2/media-platform-mtk-mdp3-fix-potential-frame-size-ove.patch new file mode 100644 index 00000000000..1a88f3b4126 --- /dev/null +++ b/queue-6.2/media-platform-mtk-mdp3-fix-potential-frame-size-ove.patch @@ -0,0 +1,60 @@ +From 8681b0f0397d4ae5118e361e95490bbebd14957e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Mar 2023 11:13:24 +0800 +Subject: media: platform: mtk-mdp3: fix potential frame size overflow in + mdp_try_fmt_mplane() + +From: Moudy Ho + +[ Upstream commit 4168720753ce6c14c5d3a35302fc2e1841383443 ] + +Fix overflow risk when setting certain formats whose frame size exceeds +a RGB24 with 7723x7723 resolution. + +For example, a 7723x7724 RGB24 frame: + 1. bpl (byte per line) = 7723 * 3. + 2. Overflow occurs when bpl * 7724 * depth. + +Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") +Signed-off-by: Moudy Ho +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c +index 4e84a37ecdfc1..36336d169bd91 100644 +--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c ++++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c +@@ -4,6 +4,7 @@ + * Author: Ping-Hsun Wu + */ + ++#include + #include + #include + #include +@@ -428,14 +429,15 @@ const struct mdp_format *mdp_try_fmt_mplane(struct v4l2_format *f, + u32 bpl = pix_mp->plane_fmt[i].bytesperline; + u32 min_si, max_si; + u32 si = pix_mp->plane_fmt[i].sizeimage; ++ u64 di; + + bpl = clamp(bpl, min_bpl, max_bpl); + pix_mp->plane_fmt[i].bytesperline = bpl; + +- min_si = (bpl * pix_mp->height * fmt->depth[i]) / +- fmt->row_depth[i]; +- max_si = (bpl * s.max_height * fmt->depth[i]) / +- fmt->row_depth[i]; ++ di = (u64)bpl * pix_mp->height * fmt->depth[i]; ++ min_si = (u32)div_u64(di, fmt->row_depth[i]); ++ di = (u64)bpl * s.max_height * fmt->depth[i]; ++ max_si = (u32)div_u64(di, fmt->row_depth[i]); + + si = clamp(si, min_si, max_si); + pix_mp->plane_fmt[i].sizeimage = si; +-- +2.39.2 + diff --git a/queue-6.2/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch b/queue-6.2/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch new file mode 100644 index 00000000000..51c3ec3cda6 --- /dev/null +++ b/queue-6.2/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch @@ -0,0 +1,43 @@ +From fd79d686d77b071c165af7d97dffa8bbd7f6bbd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 13:38:33 -0700 +Subject: media: rc: gpio-ir-recv: Fix support for wake-up + +From: Florian Fainelli + +[ Upstream commit 9c592f8ab114875fdb3b2040f01818e53de44991 ] + +The driver was intended from the start to be a wake-up source for the +system, however due to the absence of a suitable call to +device_set_wakeup_capable(), the device_may_wakeup() call used to decide +whether to enable the GPIO interrupt as a wake-up source would never +happen. Lookup the DT standard "wakeup-source" property and call +device_init_wakeup() to ensure the device is flagged as being wakeup +capable. + +Reported-by: Matthew Lear +Fixes: fd0f6851eb46 ("[media] rc: Add support for GPIO based IR Receiver driver") +Signed-off-by: Florian Fainelli +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/rc/gpio-ir-recv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/rc/gpio-ir-recv.c b/drivers/media/rc/gpio-ir-recv.c +index 8dbe780dae4e7..41ef8cdba28c4 100644 +--- a/drivers/media/rc/gpio-ir-recv.c ++++ b/drivers/media/rc/gpio-ir-recv.c +@@ -103,6 +103,8 @@ static int gpio_ir_recv_probe(struct platform_device *pdev) + rcdev->map_name = RC_MAP_EMPTY; + + gpio_dev->rcdev = rcdev; ++ if (of_property_read_bool(np, "wakeup-source")) ++ device_init_wakeup(dev, true); + + rc = devm_rc_register_device(dev, rcdev); + if (rc < 0) { +-- +2.39.2 + diff --git a/queue-6.2/media-rcar_fdp1-convert-to-platform-remove-callback-.patch b/queue-6.2/media-rcar_fdp1-convert-to-platform-remove-callback-.patch new file mode 100644 index 00000000000..e94bad432d6 --- /dev/null +++ b/queue-6.2/media-rcar_fdp1-convert-to-platform-remove-callback-.patch @@ -0,0 +1,66 @@ +From 022cf4bd82ca01fb2a5062e5c78896910c7a00b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 16:31:19 +0200 +Subject: media: rcar_fdp1: Convert to platform remove callback returning void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 0e82d3715fd208de567b8e4307fbf91ae5e57db4 ] + +The .remove() callback for a platform driver returns an int which makes +many driver authors wrongly assume it's possible to do error handling by +returning an error code. However the value returned is (mostly) ignored +and this typically results in resource leaks. To improve here there is a +quest to make the remove callback return void. In the first step of this +quest all drivers are converted to .remove_new() which already returns +void. + +Trivially convert this driver from always returning zero in the remove +callback to the void returning variant. + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Hans Verkuil +Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function") +Signed-off-by: Sasha Levin +--- + drivers/media/platform/renesas/rcar_fdp1.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/renesas/rcar_fdp1.c b/drivers/media/platform/renesas/rcar_fdp1.c +index 37ecf489d112e..d80b3214dfae1 100644 +--- a/drivers/media/platform/renesas/rcar_fdp1.c ++++ b/drivers/media/platform/renesas/rcar_fdp1.c +@@ -2396,7 +2396,7 @@ static int fdp1_probe(struct platform_device *pdev) + return ret; + } + +-static int fdp1_remove(struct platform_device *pdev) ++static void fdp1_remove(struct platform_device *pdev) + { + struct fdp1_dev *fdp1 = platform_get_drvdata(pdev); + +@@ -2404,8 +2404,6 @@ static int fdp1_remove(struct platform_device *pdev) + video_unregister_device(&fdp1->vfd); + v4l2_device_unregister(&fdp1->v4l2_dev); + pm_runtime_disable(&pdev->dev); +- +- return 0; + } + + static int __maybe_unused fdp1_pm_runtime_suspend(struct device *dev) +@@ -2441,7 +2439,7 @@ MODULE_DEVICE_TABLE(of, fdp1_dt_ids); + + static struct platform_driver fdp1_pdrv = { + .probe = fdp1_probe, +- .remove = fdp1_remove, ++ .remove_new = fdp1_remove, + .driver = { + .name = DRIVER_NAME, + .of_match_table = fdp1_dt_ids, +-- +2.39.2 + diff --git a/queue-6.2/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch b/queue-6.2/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch new file mode 100644 index 00000000000..546ae512a62 --- /dev/null +++ b/queue-6.2/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch @@ -0,0 +1,70 @@ +From 2fe30dc3069d145a2cbb135f22c62c93ef3fb4e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 11:58:09 +0400 +Subject: media: rcar_fdp1: Fix refcount leak in probe and remove function + +From: Miaoqian Lin + +[ Upstream commit c766c90faf93897b77c9c5daa603cffab85ba907 ] + +rcar_fcp_get() take reference, which should be balanced with +rcar_fcp_put(). Add missing rcar_fcp_put() in fdp1_remove and +the error paths of fdp1_probe() to fix this. + +Fixes: 4710b752e029 ("[media] v4l: Add Renesas R-Car FDP1 Driver") +Signed-off-by: Miaoqian Lin +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +[hverkuil: resolve merge conflict, remove() is now void] +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/renesas/rcar_fdp1.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/renesas/rcar_fdp1.c b/drivers/media/platform/renesas/rcar_fdp1.c +index d80b3214dfae1..c548cb01957b0 100644 +--- a/drivers/media/platform/renesas/rcar_fdp1.c ++++ b/drivers/media/platform/renesas/rcar_fdp1.c +@@ -2313,8 +2313,10 @@ static int fdp1_probe(struct platform_device *pdev) + + /* Determine our clock rate */ + clk = clk_get(&pdev->dev, NULL); +- if (IS_ERR(clk)) +- return PTR_ERR(clk); ++ if (IS_ERR(clk)) { ++ ret = PTR_ERR(clk); ++ goto put_dev; ++ } + + fdp1->clk_rate = clk_get_rate(clk); + clk_put(clk); +@@ -2323,7 +2325,7 @@ static int fdp1_probe(struct platform_device *pdev) + ret = v4l2_device_register(&pdev->dev, &fdp1->v4l2_dev); + if (ret) { + v4l2_err(&fdp1->v4l2_dev, "Failed to register video device\n"); +- return ret; ++ goto put_dev; + } + + /* M2M registration */ +@@ -2393,6 +2395,8 @@ static int fdp1_probe(struct platform_device *pdev) + unreg_dev: + v4l2_device_unregister(&fdp1->v4l2_dev); + ++put_dev: ++ rcar_fcp_put(fdp1->fcp); + return ret; + } + +@@ -2404,6 +2408,7 @@ static void fdp1_remove(struct platform_device *pdev) + video_unregister_device(&fdp1->vfd); + v4l2_device_unregister(&fdp1->v4l2_dev); + pm_runtime_disable(&pdev->dev); ++ rcar_fcp_put(fdp1->fcp); + } + + static int __maybe_unused fdp1_pm_runtime_suspend(struct device *dev) +-- +2.39.2 + diff --git a/queue-6.2/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch b/queue-6.2/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch new file mode 100644 index 00000000000..a472cb9733d --- /dev/null +++ b/queue-6.2/media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch @@ -0,0 +1,56 @@ +From cbffaeb2da854ad0102b0dcb942d9d80e514f690 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 16:42:20 +0000 +Subject: media: rkvdec: fix use after free bug in rkvdec_remove + +From: Zheng Wang + +[ Upstream commit 3228cec23b8b29215e18090c6ba635840190993d ] + +In rkvdec_probe, rkvdec->watchdog_work is bound with +rkvdec_watchdog_func. Then rkvdec_vp9_run may +be called to start the work. + +If we remove the module which will call rkvdec_remove + to make cleanup, there may be a unfinished work. + The possible sequence is as follows, which will + cause a typical UAF bug. + +Fix it by canceling the work before cleanup in rkvdec_remove. + +CPU0 CPU1 + + |rkvdec_watchdog_func +rkvdec_remove | + rkvdec_v4l2_cleanup| + v4l2_m2m_release | + kfree(m2m_dev); | + | + | v4l2_m2m_get_curr_priv + | m2m_dev->curr_ctx //use + +Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver") +Signed-off-by: Zheng Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/rkvdec/rkvdec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c +index 7bab7586918c1..82806f198074a 100644 +--- a/drivers/staging/media/rkvdec/rkvdec.c ++++ b/drivers/staging/media/rkvdec/rkvdec.c +@@ -1066,6 +1066,8 @@ static int rkvdec_remove(struct platform_device *pdev) + { + struct rkvdec_dev *rkvdec = platform_get_drvdata(pdev); + ++ cancel_delayed_work_sync(&rkvdec->watchdog_work); ++ + rkvdec_v4l2_cleanup(rkvdec); + pm_runtime_disable(&pdev->dev); + pm_runtime_dont_use_autosuspend(&pdev->dev); +-- +2.39.2 + diff --git a/queue-6.2/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch b/queue-6.2/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch new file mode 100644 index 00000000000..83a9a786be4 --- /dev/null +++ b/queue-6.2/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch @@ -0,0 +1,86 @@ +From 0001565df8dba53014bba9124fb1475b52c0d804 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 16:50:23 +0800 +Subject: media: saa7134: fix use after free bug in saa7134_finidev due to race + condition + +From: Zheng Wang + +[ Upstream commit 30cf57da176cca80f11df0d9b7f71581fe601389 ] + +In saa7134_initdev, it will call saa7134_hwinit1. There are three +function invoking here: saa7134_video_init1, saa7134_ts_init1 +and saa7134_vbi_init1. + +All of them will init a timer with same function. Take +saa7134_video_init1 as an example. It'll bound &dev->video_q.timeout +with saa7134_buffer_timeout. + +In buffer_activate, the timer funtcion is started. + +If we remove the module or device which will call saa7134_finidev +to make cleanup, there may be a unfinished work. The +possible sequence is as follows, which will cause a +typical UAF bug. + +Fix it by canceling the timer works accordingly before cleanup in +saa7134_finidev. + +CPU0 CPU1 + + |saa7134_buffer_timeout +saa7134_finidev | + kfree(dev); | + | + | saa7134_buffer_next + | //use dev + +Fixes: 1e7126b4a86a ("media: saa7134: Convert timers to use timer_setup()") +Signed-off-by: Zheng Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-ts.c | 1 + + drivers/media/pci/saa7134/saa7134-vbi.c | 1 + + drivers/media/pci/saa7134/saa7134-video.c | 1 + + 3 files changed, 3 insertions(+) + +diff --git a/drivers/media/pci/saa7134/saa7134-ts.c b/drivers/media/pci/saa7134/saa7134-ts.c +index 6a5053126237f..437dbe5e75e29 100644 +--- a/drivers/media/pci/saa7134/saa7134-ts.c ++++ b/drivers/media/pci/saa7134/saa7134-ts.c +@@ -300,6 +300,7 @@ int saa7134_ts_start(struct saa7134_dev *dev) + + int saa7134_ts_fini(struct saa7134_dev *dev) + { ++ del_timer_sync(&dev->ts_q.timeout); + saa7134_pgtable_free(dev->pci, &dev->ts_q.pt); + return 0; + } +diff --git a/drivers/media/pci/saa7134/saa7134-vbi.c b/drivers/media/pci/saa7134/saa7134-vbi.c +index 3f0b0933eed69..3e773690468bd 100644 +--- a/drivers/media/pci/saa7134/saa7134-vbi.c ++++ b/drivers/media/pci/saa7134/saa7134-vbi.c +@@ -185,6 +185,7 @@ int saa7134_vbi_init1(struct saa7134_dev *dev) + int saa7134_vbi_fini(struct saa7134_dev *dev) + { + /* nothing */ ++ del_timer_sync(&dev->vbi_q.timeout); + return 0; + } + +diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c +index 4d8974c9fcc98..29124756a62bc 100644 +--- a/drivers/media/pci/saa7134/saa7134-video.c ++++ b/drivers/media/pci/saa7134/saa7134-video.c +@@ -2146,6 +2146,7 @@ int saa7134_video_init1(struct saa7134_dev *dev) + + void saa7134_video_fini(struct saa7134_dev *dev) + { ++ del_timer_sync(&dev->video_q.timeout); + /* free stuff */ + saa7134_pgtable_free(dev->pci, &dev->video_q.pt); + saa7134_pgtable_free(dev->pci, &dev->vbi_q.pt); +-- +2.39.2 + diff --git a/queue-6.2/media-v4l-async-return-async-sub-devices-to-subnotif.patch b/queue-6.2/media-v4l-async-return-async-sub-devices-to-subnotif.patch new file mode 100644 index 00000000000..9a7a3bec144 --- /dev/null +++ b/queue-6.2/media-v4l-async-return-async-sub-devices-to-subnotif.patch @@ -0,0 +1,80 @@ +From 2cfe02f1c37e4d694979c57ccf92e231dc6cf017 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 15:49:44 +0200 +Subject: media: v4l: async: Return async sub-devices to subnotifier list + +From: Sakari Ailus + +[ Upstream commit 5276c9df9c2ab9a43b534bfb56bdb10899cd3a22 ] + +When an async notifier is unregistered, the async sub-devices in the +notifier's done list will disappear with the notifier. However this is +currently also done to the sub-notifiers that remain registered. Their +sub-devices only need to be unbound while the async sub-devices themselves +need to be returned to the sub-notifier's waiting list. Do this now. + +Fixes: 2cab00bb076b ("media: v4l: async: Allow binding notifiers to sub-devices") +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-async.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c +index 2f1b718a91893..008a2a3e312e0 100644 +--- a/drivers/media/v4l2-core/v4l2-async.c ++++ b/drivers/media/v4l2-core/v4l2-async.c +@@ -414,7 +414,8 @@ static void v4l2_async_cleanup(struct v4l2_subdev *sd) + + /* Unbind all sub-devices in the notifier tree. */ + static void +-v4l2_async_nf_unbind_all_subdevs(struct v4l2_async_notifier *notifier) ++v4l2_async_nf_unbind_all_subdevs(struct v4l2_async_notifier *notifier, ++ bool readd) + { + struct v4l2_subdev *sd, *tmp; + +@@ -423,9 +424,11 @@ v4l2_async_nf_unbind_all_subdevs(struct v4l2_async_notifier *notifier) + v4l2_async_find_subdev_notifier(sd); + + if (subdev_notifier) +- v4l2_async_nf_unbind_all_subdevs(subdev_notifier); ++ v4l2_async_nf_unbind_all_subdevs(subdev_notifier, true); + + v4l2_async_nf_call_unbind(notifier, sd, sd->asd); ++ if (readd) ++ list_add_tail(&sd->asd->list, ¬ifier->waiting); + v4l2_async_cleanup(sd); + + list_move(&sd->async_list, &subdev_list); +@@ -557,7 +560,7 @@ static int __v4l2_async_nf_register(struct v4l2_async_notifier *notifier) + /* + * On failure, unbind all sub-devices registered through this notifier. + */ +- v4l2_async_nf_unbind_all_subdevs(notifier); ++ v4l2_async_nf_unbind_all_subdevs(notifier, false); + + err_unlock: + mutex_unlock(&list_lock); +@@ -607,7 +610,7 @@ __v4l2_async_nf_unregister(struct v4l2_async_notifier *notifier) + if (!notifier || (!notifier->v4l2_dev && !notifier->sd)) + return; + +- v4l2_async_nf_unbind_all_subdevs(notifier); ++ v4l2_async_nf_unbind_all_subdevs(notifier, false); + + notifier->sd = NULL; + notifier->v4l2_dev = NULL; +@@ -805,7 +808,7 @@ int v4l2_async_register_subdev(struct v4l2_subdev *sd) + */ + subdev_notifier = v4l2_async_find_subdev_notifier(sd); + if (subdev_notifier) +- v4l2_async_nf_unbind_all_subdevs(subdev_notifier); ++ v4l2_async_nf_unbind_all_subdevs(subdev_notifier, false); + + if (sd->asd) + v4l2_async_nf_call_unbind(notifier, sd, sd->asd); +-- +2.39.2 + diff --git a/queue-6.2/media-venus-dec-fix-capture-formats-enumeration-orde.patch b/queue-6.2/media-venus-dec-fix-capture-formats-enumeration-orde.patch new file mode 100644 index 00000000000..9c61e595ac2 --- /dev/null +++ b/queue-6.2/media-venus-dec-fix-capture-formats-enumeration-orde.patch @@ -0,0 +1,77 @@ +From a7cfc928d569d024c5366cb00276dc6449270d72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Feb 2023 09:18:35 +0100 +Subject: media: venus: dec: Fix capture formats enumeration order + +From: Javier Martinez Canillas + +[ Upstream commit a9d45ec74c8e68aaafe90191928eddbf79f4644f ] + +Commit 9593126dae3e ("media: venus: Add a handling of QC08C compressed +format") and commit cef92b14e653 ("media: venus: Add a handling of QC10C +compressed format") added support for the QC08C and QC10C compressed +formats respectively. + +But these also caused a regression, because the new formats where added +at the beginning of the vdec_formats[] array and the vdec_inst_init() +function sets the default format output and capture using fixed indexes +of that array: + +static void vdec_inst_init(struct venus_inst *inst) +{ +... + inst->fmt_out = &vdec_formats[8]; + inst->fmt_cap = &vdec_formats[0]; +... +} + +Since now V4L2_PIX_FMT_NV12 is not the first entry in the array anymore, +the default capture format is not set to that as it was done before. + +Both commits changed the first index to keep inst->fmt_out default format +set to V4L2_PIX_FMT_H264, but did not update the latter to keep .fmt_out +default format set to V4L2_PIX_FMT_NV12. + +Rather than updating the index to the current V4L2_PIX_FMT_NV12 position, +let's reorder the entries so that this format is the first entry again. + +This would also make VIDIOC_ENUM_FMT report the V4L2_PIX_FMT_NV12 format +with an index 0 as it did before the QC08C and QC10C formats were added. + +Fixes: 9593126dae3e ("media: venus: Add a handling of QC08C compressed format") +Fixes: cef92b14e653 ("media: venus: Add a handling of QC10C compressed format") +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Stanimir Varbanov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/vdec.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c +index 9d26587716bf6..1a52c2ea2da5b 100644 +--- a/drivers/media/platform/qcom/venus/vdec.c ++++ b/drivers/media/platform/qcom/venus/vdec.c +@@ -31,15 +31,15 @@ + */ + static const struct venus_format vdec_formats[] = { + { +- .pixfmt = V4L2_PIX_FMT_QC08C, ++ .pixfmt = V4L2_PIX_FMT_NV12, + .num_planes = 1, + .type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE, + }, { +- .pixfmt = V4L2_PIX_FMT_QC10C, ++ .pixfmt = V4L2_PIX_FMT_QC08C, + .num_planes = 1, + .type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE, +- },{ +- .pixfmt = V4L2_PIX_FMT_NV12, ++ }, { ++ .pixfmt = V4L2_PIX_FMT_QC10C, + .num_planes = 1, + .type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE, + }, { +-- +2.39.2 + diff --git a/queue-6.2/media-venus-dec-fix-handling-of-the-start-cmd.patch b/queue-6.2/media-venus-dec-fix-handling-of-the-start-cmd.patch new file mode 100644 index 00000000000..09c58f34943 --- /dev/null +++ b/queue-6.2/media-venus-dec-fix-handling-of-the-start-cmd.patch @@ -0,0 +1,61 @@ +From cf9744d5d517717924fa49f407481f54cad9d2b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 13:54:18 +0000 +Subject: media: venus: dec: Fix handling of the start cmd +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Krawczyk + +[ Upstream commit 50248ad9f190d527cbd578190ca769729518b703 ] + +The decoder driver should clear the last_buffer_dequeued flag of the +capture queue upon receiving V4L2_DEC_CMD_START. + +The last_buffer_dequeued flag is set upon receiving EOS (which always +happens upon receiving V4L2_DEC_CMD_STOP). + +Without this patch, after issuing the V4L2_DEC_CMD_STOP and +V4L2_DEC_CMD_START, the vb2_dqbuf() function will always fail, even if +the buffers are completed by the hardware. + +Fixes: beac82904a87 ("media: venus: make decoder compliant with stateful codec API") + +Signed-off-by: Michał Krawczyk +Signed-off-by: Stanimir Varbanov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/vdec.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c +index 4ceaba37e2e57..9d26587716bf6 100644 +--- a/drivers/media/platform/qcom/venus/vdec.c ++++ b/drivers/media/platform/qcom/venus/vdec.c +@@ -526,6 +526,7 @@ static int + vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd) + { + struct venus_inst *inst = to_inst(file); ++ struct vb2_queue *dst_vq; + struct hfi_frame_data fdata = {0}; + int ret; + +@@ -556,6 +557,13 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd) + inst->codec_state = VENUS_DEC_STATE_DRAIN; + inst->drain_active = true; + } ++ } else if (cmd->cmd == V4L2_DEC_CMD_START && ++ inst->codec_state == VENUS_DEC_STATE_STOPPED) { ++ dst_vq = v4l2_m2m_get_vq(inst->fh.m2m_ctx, ++ V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE); ++ vb2_clear_last_buffer_dequeued(dst_vq); ++ ++ inst->codec_state = VENUS_DEC_STATE_DECODING; + } + + unlock: +-- +2.39.2 + diff --git a/queue-6.2/media-vsp1-replace-vb2_is_streaming-with-vb2_start_s.patch b/queue-6.2/media-vsp1-replace-vb2_is_streaming-with-vb2_start_s.patch new file mode 100644 index 00000000000..8b58c3fa3e5 --- /dev/null +++ b/queue-6.2/media-vsp1-replace-vb2_is_streaming-with-vb2_start_s.patch @@ -0,0 +1,116 @@ +From 192a6df08c19a873e1e5b511e03b50708251a156 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 22:20:31 +0200 +Subject: media: vsp1: Replace vb2_is_streaming() with + vb2_start_streaming_called() + +From: Laurent Pinchart + +[ Upstream commit 52d8caca3d533cc499f1255be25576ffd936ec95 ] + +The vsp1 driver uses the vb2_is_streaming() function in its .buf_queue() +handler to check if the .start_streaming() operation has been called, +and decide whether to just add the buffer to an internal queue, or also +trigger a hardware run. vb2_is_streaming() relies on the vb2_queue +structure's streaming field, which used to be set only after calling the +.start_streaming() operation. + +Commit a10b21532574 ("media: vb2: add (un)prepare_streaming queue ops") +changed this, setting the .streaming field in vb2_core_streamon() before +enqueuing buffers to the driver and calling .start_streaming(). This +broke the vsp1 driver which now believes that .start_streaming() has +been called when it hasn't, leading to a crash: + +[ 881.058705] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 +[ 881.067495] Mem abort info: +[ 881.070290] ESR = 0x0000000096000006 +[ 881.074042] EC = 0x25: DABT (current EL), IL = 32 bits +[ 881.079358] SET = 0, FnV = 0 +[ 881.082414] EA = 0, S1PTW = 0 +[ 881.085558] FSC = 0x06: level 2 translation fault +[ 881.090439] Data abort info: +[ 881.093320] ISV = 0, ISS = 0x00000006 +[ 881.097157] CM = 0, WnR = 0 +[ 881.100126] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004fa51000 +[ 881.106573] [0000000000000020] pgd=080000004f36e003, p4d=080000004f36e003, pud=080000004f7ec003, pmd=0000000000000000 +[ 881.117217] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP +[ 881.123494] Modules linked in: rcar_fdp1 v4l2_mem2mem +[ 881.128572] CPU: 0 PID: 1271 Comm: yavta Tainted: G B 6.2.0-rc1-00023-g6c94e2e99343 #556 +[ 881.138061] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) +[ 881.145981] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 881.152951] pc : vsp1_dl_list_add_body+0xa8/0xe0 +[ 881.157580] lr : vsp1_dl_list_add_body+0x34/0xe0 +[ 881.162206] sp : ffff80000c267710 +[ 881.165522] x29: ffff80000c267710 x28: ffff000010938ae8 x27: ffff000013a8dd98 +[ 881.172683] x26: ffff000010938098 x25: ffff000013a8dc00 x24: ffff000010ed6ba8 +[ 881.179841] x23: ffff00000faa4000 x22: 0000000000000000 x21: 0000000000000020 +[ 881.186998] x20: ffff00000faa4000 x19: 0000000000000000 x18: 0000000000000000 +[ 881.194154] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 +[ 881.201309] x14: 0000000000000000 x13: 746e696174206c65 x12: ffff70000157043d +[ 881.208465] x11: 1ffff0000157043c x10: ffff70000157043c x9 : dfff800000000000 +[ 881.215622] x8 : ffff80000ab821e7 x7 : 00008ffffea8fbc4 x6 : 0000000000000001 +[ 881.222779] x5 : ffff80000ab821e0 x4 : ffff70000157043d x3 : 0000000000000020 +[ 881.229936] x2 : 0000000000000020 x1 : ffff00000e4f6400 x0 : 0000000000000000 +[ 881.237092] Call trace: +[ 881.239542] vsp1_dl_list_add_body+0xa8/0xe0 +[ 881.243822] vsp1_video_pipeline_run+0x270/0x2a0 +[ 881.248449] vsp1_video_buffer_queue+0x1c0/0x1d0 +[ 881.253076] __enqueue_in_driver+0xbc/0x260 +[ 881.257269] vb2_start_streaming+0x48/0x200 +[ 881.261461] vb2_core_streamon+0x13c/0x280 +[ 881.265565] vb2_streamon+0x3c/0x90 +[ 881.269064] vsp1_video_streamon+0x2fc/0x3e0 +[ 881.273344] v4l_streamon+0x50/0x70 +[ 881.276844] __video_do_ioctl+0x2bc/0x5d0 +[ 881.280861] video_usercopy+0x2a8/0xc80 +[ 881.284704] video_ioctl2+0x20/0x40 +[ 881.288201] v4l2_ioctl+0xa4/0xc0 +[ 881.291525] __arm64_sys_ioctl+0xe8/0x110 +[ 881.295543] invoke_syscall+0x68/0x190 +[ 881.299303] el0_svc_common.constprop.0+0x88/0x170 +[ 881.304105] do_el0_svc+0x4c/0xf0 +[ 881.307430] el0_svc+0x4c/0xa0 +[ 881.310494] el0t_64_sync_handler+0xbc/0x140 +[ 881.314773] el0t_64_sync+0x190/0x194 +[ 881.318450] Code: d50323bf d65f03c0 91008263 f9800071 (885f7c60) +[ 881.324551] ---[ end trace 0000000000000000 ]--- +[ 881.329173] note: yavta[1271] exited with preempt_count 1 + +A different regression report sent to the linux-media mailing list ([1]) +was answered with a claim that the vb2_is_streaming() function has never +been meant for this purpose. The document of the function, as well as of +the struct vb2_queue streaming field, is sparse, so this claim may be +hard to verify. + +The information needed by the vsp1 driver to decide how to process +queued buffers is also available from the vb2_start_streaming_called() +function. Use it instead of vb2_is_streaming() to fix the problem. + +[1] https://lore.kernel.org/linux-media/545610e7-3446-2b82-60dc-7385fea3774f@redhat.com/ + +Fixes: a10b21532574 ("media: vb2: add (un)prepare_streaming queue ops") +Signed-off-by: Laurent Pinchart +Reviewed-by: Hans Verkuil +Tested-by: Duy Nguyen +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/renesas/vsp1/vsp1_video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/renesas/vsp1/vsp1_video.c b/drivers/media/platform/renesas/vsp1/vsp1_video.c +index 9d24647c8f324..0cea5e5acf82b 100644 +--- a/drivers/media/platform/renesas/vsp1/vsp1_video.c ++++ b/drivers/media/platform/renesas/vsp1/vsp1_video.c +@@ -776,7 +776,7 @@ static void vsp1_video_buffer_queue(struct vb2_buffer *vb) + video->rwpf->mem = buf->mem; + pipe->buffers_ready |= 1 << video->pipe_index; + +- if (vb2_is_streaming(&video->queue) && ++ if (vb2_start_streaming_called(&video->queue) && + vsp1_pipeline_ready(pipe)) + vsp1_video_pipeline_run(pipe); + +-- +2.39.2 + diff --git a/queue-6.2/mfd-arizona-spi-add-missing-module_device_table.patch b/queue-6.2/mfd-arizona-spi-add-missing-module_device_table.patch new file mode 100644 index 00000000000..c197c27dcb7 --- /dev/null +++ b/queue-6.2/mfd-arizona-spi-add-missing-module_device_table.patch @@ -0,0 +1,37 @@ +From 7289f7cb9f9103abdd1aae260894401aed19465a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 13:41:38 +0000 +Subject: mfd: arizona-spi: Add missing MODULE_DEVICE_TABLE + +From: Charles Keepax + +[ Upstream commit 972c91fd7beddc3f19c8c855f6e60e7dbd435cbd ] + +This patch adds missing MODULE_DEVICE_TABLE definition +which generates correct modalias for automatic loading +of this driver when it is built as a module. + +Fixes: 3f65555c417c ("mfd: arizona: Split of_match table into I2C and SPI versions") +Signed-off-by: Charles Keepax +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230323134138.834369-1-ckeepax@opensource.cirrus.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/arizona-spi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mfd/arizona-spi.c b/drivers/mfd/arizona-spi.c +index da05b966d48c6..02cf4f3e91d76 100644 +--- a/drivers/mfd/arizona-spi.c ++++ b/drivers/mfd/arizona-spi.c +@@ -277,6 +277,7 @@ static const struct of_device_id arizona_spi_of_match[] = { + { .compatible = "cirrus,cs47l24", .data = (void *)CS47L24 }, + {}, + }; ++MODULE_DEVICE_TABLE(of, arizona_spi_of_match); + #endif + + static struct spi_driver arizona_spi_driver = { +-- +2.39.2 + diff --git a/queue-6.2/mfd-ocelot-spi-fix-unsupported-bulk-read.patch b/queue-6.2/mfd-ocelot-spi-fix-unsupported-bulk-read.patch new file mode 100644 index 00000000000..51c01dbf837 --- /dev/null +++ b/queue-6.2/mfd-ocelot-spi-fix-unsupported-bulk-read.patch @@ -0,0 +1,83 @@ +From 166cc2406fbbfdfa9a8543aef0ec38e9a1905298 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 07:11:30 -0700 +Subject: mfd: ocelot-spi: Fix unsupported bulk read + +From: Colin Foster + +[ Upstream commit f0484d2f80a72022b7fac72bcb406392900ef1eb ] + +Ocelot chips (VSC7511, VSC7512, VSC7513, VSC7514) don't support bulk read +operations over SPI. + +Many SPI buses have hardware that can optimize consecutive reads. +Essentially an address is written to the chip, and if the SPI controller +continues to toggle the clock, subsequent register values are reported. +This can lead to significant optimizations, because the time between +"address is written to the chip" and "chip starts to report data" can often +take a fixed amount of time. + +When support for Ocelot chips were added in commit f3e893626abe ("mfd: +ocelot: Add support for the vsc7512 chip via spi") it was believed that +this optimization was supported. However it is not. + +Most register transactions with the Ocelot chips are not done in bulk, so +this bug could go unnoticed. The one scenario where bulk register +operations _are_ performed is when polling port statistics counters, which +was added in commit d87b1c08f38a ("net: mscc: ocelot: use bulk reads for +stats"). + +Things get slightly more complicated here... + +A bug was introduced in commit d4c367650704 ("net: mscc: ocelot: keep +ocelot_stat_layout by reg address, not offset") that broke the optimization +of bulk reads. This means that when Ethernet support for the VSC7512 chip +was added in commit 3d7316ac81ac ("net: dsa: ocelot: add external ocelot +switch control") things were actually working "as expected". + +The bulk read opmtimization was discovered, and fixed in commit +6acc72a43eac ("net: mscc: ocelot: fix stats region batching") and the +timing optimizations for SPI were noticed. A bulk read went from ~14ms to +~2ms. But this timing improvement came at the cost of every register +reading zero due the fact that bulk reads don't work. + +The read timings increase back to 13-14ms, but that's a price worth paying +in order to receive valid data. This is verified in a DSA setup (cpsw-new +switch tied to port 0 on the VSC7512, after having been running overnight) + + Rx Octets: 16222055 # Counters from CPSW switch + Tx Octets: 12034702 + Net Octets: 28256757 + p00_rx_octets: 12034702 # Counters from Ocelot switch + p00_rx_frames_below_65_octets: 0 + p00_rx_frames_65_to_127_octets: 88188 + p00_rx_frames_128_to_255_octets: 13 + p00_rx_frames_256_to_511_octets: 0 + p00_rx_frames_512_to_1023_octets: 0 + p00_rx_frames_over_1526_octets: 3306 + p00_tx_octets: 16222055 + +Fixes: f3e893626abe ("mfd: ocelot: Add support for the vsc7512 chip via spi") +Signed-off-by: Colin Foster +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230322141130.2531256-1-colin.foster@in-advantage.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/ocelot-spi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mfd/ocelot-spi.c b/drivers/mfd/ocelot-spi.c +index 2ecd271de2fb9..85021f94e5874 100644 +--- a/drivers/mfd/ocelot-spi.c ++++ b/drivers/mfd/ocelot-spi.c +@@ -130,6 +130,7 @@ static const struct regmap_config ocelot_spi_regmap_config = { + + .write_flag_mask = 0x80, + ++ .use_single_read = true, + .use_single_write = true, + .can_multi_write = false, + +-- +2.39.2 + diff --git a/queue-6.2/mfd-tqmx86-correct-board-names-for-tqmxe39x.patch b/queue-6.2/mfd-tqmx86-correct-board-names-for-tqmxe39x.patch new file mode 100644 index 00000000000..db714026825 --- /dev/null +++ b/queue-6.2/mfd-tqmx86-correct-board-names-for-tqmxe39x.patch @@ -0,0 +1,119 @@ +From 3f8b3242732a3639ecf37036ca117bcb405ed129 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Feb 2023 12:25:46 +0100 +Subject: mfd: tqmx86: Correct board names for TQMxE39x + +From: Matthias Schiffer + +[ Upstream commit f376c479668557bcc2fd9e9fbc0f53e7819a11cd ] + +It seems that this driver was developed based on preliminary documentation. +Report the correct names for all TQMxE39x variants, as they are used by +the released hardware revisions: + +- Fix names for TQMxE39C1/C2 board IDs +- Distinguish TQMxE39M and TQMxE39S, which use the same board ID + +The TQMxE39M/S are distinguished using the SAUC (Sanctioned Alternate +Uses Configuration) register of the GPIO controller. This also prepares +for the correct handling of the differences between the GPIO controllers +of our COMe and SMARC modules. + +Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO") +Signed-off-by: Matthias Schiffer +Reviewed-by: Andrew Lunn +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/aca9a7cb42a85181bcb456c437554d2728e708ec.1676892223.git.matthias.schiffer@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/tqmx86.c | 32 +++++++++++++++++--------------- + 1 file changed, 17 insertions(+), 15 deletions(-) + +diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c +index 958334f14eb00..fac02875fe7d9 100644 +--- a/drivers/mfd/tqmx86.c ++++ b/drivers/mfd/tqmx86.c +@@ -30,9 +30,9 @@ + #define TQMX86_REG_BOARD_ID_50UC 2 + #define TQMX86_REG_BOARD_ID_E38C 3 + #define TQMX86_REG_BOARD_ID_60EB 4 +-#define TQMX86_REG_BOARD_ID_E39M 5 +-#define TQMX86_REG_BOARD_ID_E39C 6 +-#define TQMX86_REG_BOARD_ID_E39x 7 ++#define TQMX86_REG_BOARD_ID_E39MS 5 ++#define TQMX86_REG_BOARD_ID_E39C1 6 ++#define TQMX86_REG_BOARD_ID_E39C2 7 + #define TQMX86_REG_BOARD_ID_70EB 8 + #define TQMX86_REG_BOARD_ID_80UC 9 + #define TQMX86_REG_BOARD_ID_110EB 11 +@@ -48,6 +48,7 @@ + #define TQMX86_REG_IO_EXT_INT_12 3 + #define TQMX86_REG_IO_EXT_INT_MASK 0x3 + #define TQMX86_REG_IO_EXT_INT_GPIO_SHIFT 4 ++#define TQMX86_REG_SAUC 0x17 + + #define TQMX86_REG_I2C_DETECT 0x1a7 + #define TQMX86_REG_I2C_DETECT_SOFT 0xa5 +@@ -110,7 +111,7 @@ static const struct mfd_cell tqmx86_devs[] = { + }, + }; + +-static const char *tqmx86_board_id_to_name(u8 board_id) ++static const char *tqmx86_board_id_to_name(u8 board_id, u8 sauc) + { + switch (board_id) { + case TQMX86_REG_BOARD_ID_E38M: +@@ -121,12 +122,12 @@ static const char *tqmx86_board_id_to_name(u8 board_id) + return "TQMxE38C"; + case TQMX86_REG_BOARD_ID_60EB: + return "TQMx60EB"; +- case TQMX86_REG_BOARD_ID_E39M: +- return "TQMxE39M"; +- case TQMX86_REG_BOARD_ID_E39C: +- return "TQMxE39C"; +- case TQMX86_REG_BOARD_ID_E39x: +- return "TQMxE39x"; ++ case TQMX86_REG_BOARD_ID_E39MS: ++ return (sauc == 0xff) ? "TQMxE39M" : "TQMxE39S"; ++ case TQMX86_REG_BOARD_ID_E39C1: ++ return "TQMxE39C1"; ++ case TQMX86_REG_BOARD_ID_E39C2: ++ return "TQMxE39C2"; + case TQMX86_REG_BOARD_ID_70EB: + return "TQMx70EB"; + case TQMX86_REG_BOARD_ID_80UC: +@@ -159,9 +160,9 @@ static int tqmx86_board_id_to_clk_rate(struct device *dev, u8 board_id) + case TQMX86_REG_BOARD_ID_E40C1: + case TQMX86_REG_BOARD_ID_E40C2: + return 24000; +- case TQMX86_REG_BOARD_ID_E39M: +- case TQMX86_REG_BOARD_ID_E39C: +- case TQMX86_REG_BOARD_ID_E39x: ++ case TQMX86_REG_BOARD_ID_E39MS: ++ case TQMX86_REG_BOARD_ID_E39C1: ++ case TQMX86_REG_BOARD_ID_E39C2: + return 25000; + case TQMX86_REG_BOARD_ID_E38M: + case TQMX86_REG_BOARD_ID_E38C: +@@ -175,7 +176,7 @@ static int tqmx86_board_id_to_clk_rate(struct device *dev, u8 board_id) + + static int tqmx86_probe(struct platform_device *pdev) + { +- u8 board_id, rev, i2c_det, io_ext_int_val; ++ u8 board_id, sauc, rev, i2c_det, io_ext_int_val; + struct device *dev = &pdev->dev; + u8 gpio_irq_cfg, readback; + const char *board_name; +@@ -205,7 +206,8 @@ static int tqmx86_probe(struct platform_device *pdev) + return -ENOMEM; + + board_id = ioread8(io_base + TQMX86_REG_BOARD_ID); +- board_name = tqmx86_board_id_to_name(board_id); ++ sauc = ioread8(io_base + TQMX86_REG_SAUC); ++ board_name = tqmx86_board_id_to_name(board_id, sauc); + rev = ioread8(io_base + TQMX86_REG_BOARD_REV); + + dev_info(dev, +-- +2.39.2 + diff --git a/queue-6.2/mfd-tqmx86-do-not-access-i2c_detect-register-through.patch b/queue-6.2/mfd-tqmx86-do-not-access-i2c_detect-register-through.patch new file mode 100644 index 00000000000..7e85dfec160 --- /dev/null +++ b/queue-6.2/mfd-tqmx86-do-not-access-i2c_detect-register-through.patch @@ -0,0 +1,61 @@ +From c0e798e8386bd032d30623634de59e5ac1cfbc3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Feb 2023 12:25:44 +0100 +Subject: mfd: tqmx86: Do not access I2C_DETECT register through io_base + +From: Matthias Schiffer + +[ Upstream commit 1be1b23696b3d4b0231c694f5e0767b4471d33a9 ] + +The I2C_DETECT register is at IO port 0x1a7, which is outside the range +passed to devm_ioport_map() for io_base, and was only working because +there aren't actually any bounds checks for IO port accesses. + +Extending the range does not seem like a good solution here, as it would +then conflict with the IO resource assigned to the I2C controller. As +this is just a one-off access during probe, use a simple inb() instead. + +While we're at it, drop the unused define TQMX86_REG_I2C_INT_EN. + +Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO") +Signed-off-by: Matthias Schiffer +Reviewed-by: Andrew Lunn +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/e8300a30f0791afb67d79db8089fb6004855f378.1676892223.git.matthias.schiffer@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/tqmx86.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c +index 7ae906ff8e353..31d0efb5aacf8 100644 +--- a/drivers/mfd/tqmx86.c ++++ b/drivers/mfd/tqmx86.c +@@ -49,9 +49,8 @@ + #define TQMX86_REG_IO_EXT_INT_MASK 0x3 + #define TQMX86_REG_IO_EXT_INT_GPIO_SHIFT 4 + +-#define TQMX86_REG_I2C_DETECT 0x47 ++#define TQMX86_REG_I2C_DETECT 0x1a7 + #define TQMX86_REG_I2C_DETECT_SOFT 0xa5 +-#define TQMX86_REG_I2C_INT_EN 0x49 + + static uint gpio_irq; + module_param(gpio_irq, uint, 0); +@@ -213,7 +212,12 @@ static int tqmx86_probe(struct platform_device *pdev) + "Found %s - Board ID %d, PCB Revision %d, PLD Revision %d\n", + board_name, board_id, rev >> 4, rev & 0xf); + +- i2c_det = ioread8(io_base + TQMX86_REG_I2C_DETECT); ++ /* ++ * The I2C_DETECT register is in the range assigned to the I2C driver ++ * later, so we don't extend TQMX86_IOSIZE. Use inb() for this one-off ++ * access instead of ioport_map + unmap. ++ */ ++ i2c_det = inb(TQMX86_REG_I2C_DETECT); + + if (gpio_irq_cfg) { + io_ext_int_val = +-- +2.39.2 + diff --git a/queue-6.2/mfd-tqmx86-specify-io-port-register-range-more-preci.patch b/queue-6.2/mfd-tqmx86-specify-io-port-register-range-more-preci.patch new file mode 100644 index 00000000000..b294e159eeb --- /dev/null +++ b/queue-6.2/mfd-tqmx86-specify-io-port-register-range-more-preci.patch @@ -0,0 +1,64 @@ +From 2861e719e9b0ac20fade2898de0a0ba2fd1bb36a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Feb 2023 12:25:45 +0100 +Subject: mfd: tqmx86: Specify IO port register range more precisely + +From: Matthias Schiffer + +[ Upstream commit 051c69ff4f607aa114c7bbdd7c41ed881367aeee ] + +Registers 0x160..0x17f are unassigned. Use 0x180 as base register and +update offets accordingly. + +Also change the size of the range to include 0x19f. While 0x19f is +currently reserved for future extensions, so are several of the previous +registers up to 0x19e, and it is weird to leave out just the last one. + +Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO") +Signed-off-by: Matthias Schiffer +Reviewed-by: Andrew Lunn +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/db4677ac318b1283c8956f637f409995a30a31c3.1676892223.git.matthias.schiffer@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/tqmx86.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c +index 31d0efb5aacf8..958334f14eb00 100644 +--- a/drivers/mfd/tqmx86.c ++++ b/drivers/mfd/tqmx86.c +@@ -16,8 +16,8 @@ + #include + #include + +-#define TQMX86_IOBASE 0x160 +-#define TQMX86_IOSIZE 0x3f ++#define TQMX86_IOBASE 0x180 ++#define TQMX86_IOSIZE 0x20 + #define TQMX86_IOBASE_I2C 0x1a0 + #define TQMX86_IOSIZE_I2C 0xa + #define TQMX86_IOBASE_WATCHDOG 0x18b +@@ -25,7 +25,7 @@ + #define TQMX86_IOBASE_GPIO 0x18d + #define TQMX86_IOSIZE_GPIO 0x4 + +-#define TQMX86_REG_BOARD_ID 0x20 ++#define TQMX86_REG_BOARD_ID 0x00 + #define TQMX86_REG_BOARD_ID_E38M 1 + #define TQMX86_REG_BOARD_ID_50UC 2 + #define TQMX86_REG_BOARD_ID_E38C 3 +@@ -40,8 +40,8 @@ + #define TQMX86_REG_BOARD_ID_E40S 13 + #define TQMX86_REG_BOARD_ID_E40C1 14 + #define TQMX86_REG_BOARD_ID_E40C2 15 +-#define TQMX86_REG_BOARD_REV 0x21 +-#define TQMX86_REG_IO_EXT_INT 0x26 ++#define TQMX86_REG_BOARD_REV 0x01 ++#define TQMX86_REG_IO_EXT_INT 0x06 + #define TQMX86_REG_IO_EXT_INT_NONE 0 + #define TQMX86_REG_IO_EXT_INT_7 1 + #define TQMX86_REG_IO_EXT_INT_9 2 +-- +2.39.2 + diff --git a/queue-6.2/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch b/queue-6.2/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch new file mode 100644 index 00000000000..479b8e438b0 --- /dev/null +++ b/queue-6.2/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch @@ -0,0 +1,82 @@ +From 593a2d721651460b46926c08533ea9cb474db6bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 23:37:15 +0300 +Subject: mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data + +From: Georgii Kruglov + +[ Upstream commit 0dd8316037a2a6d85b2be208bef9991de7b42170 ] + +If spec_reg is equal to 'SDHCI_PRESENT_STATE', esdhc_readl_fixup() +fixes up register value and returns it immediately. As a result, the +further block +(spec_reg == SDHCI_PRESENT_STATE) + &&(esdhc->quirk_ignore_data_inhibit == true), +is never executed. + +The patch merges the second block into the first one. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 1f1929f3f2fa ("mmc: sdhci-of-esdhc: add quirk to ignore command inhibit for data") +Signed-off-by: Georgii Kruglov +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20230321203715.3975-1-georgy.kruglov@yandex.ru +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-of-esdhc.c | 24 +++++++++++------------- + 1 file changed, 11 insertions(+), 13 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 4712adac7f7c0..48ca1cf15b199 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -133,6 +133,7 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host, + return ret; + } + } ++ + /* + * The DAT[3:0] line signal levels and the CMD line signal level are + * not compatible with standard SDHC register. The line signal levels +@@ -144,6 +145,16 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host, + ret = value & 0x000fffff; + ret |= (value >> 4) & SDHCI_DATA_LVL_MASK; + ret |= (value << 1) & SDHCI_CMD_LVL; ++ ++ /* ++ * Some controllers have unreliable Data Line Active ++ * bit for commands with busy signal. This affects ++ * Command Inhibit (data) bit. Just ignore it since ++ * MMC core driver has already polled card status ++ * with CMD13 after any command with busy siganl. ++ */ ++ if (esdhc->quirk_ignore_data_inhibit) ++ ret &= ~SDHCI_DATA_INHIBIT; + return ret; + } + +@@ -158,19 +169,6 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host, + return ret; + } + +- /* +- * Some controllers have unreliable Data Line Active +- * bit for commands with busy signal. This affects +- * Command Inhibit (data) bit. Just ignore it since +- * MMC core driver has already polled card status +- * with CMD13 after any command with busy siganl. +- */ +- if ((spec_reg == SDHCI_PRESENT_STATE) && +- (esdhc->quirk_ignore_data_inhibit == true)) { +- ret = value & ~SDHCI_DATA_INHIBIT; +- return ret; +- } +- + ret = value; + return ret; + } +-- +2.39.2 + diff --git a/queue-6.2/module-decompress-never-use-kunmap-for-local-un-mapp.patch b/queue-6.2/module-decompress-never-use-kunmap-for-local-un-mapp.patch new file mode 100644 index 00000000000..dc5b5b3fb49 --- /dev/null +++ b/queue-6.2/module-decompress-never-use-kunmap-for-local-un-mapp.patch @@ -0,0 +1,50 @@ +From 8ceaedad8ada6b62d7dcdb3ed286719805e70337 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 13:52:56 +0100 +Subject: module/decompress: Never use kunmap() for local un-mappings + +From: Fabio M. De Francesco + +[ Upstream commit 3c17655ab13704582fe25e8ea3200a9b2f8bf20a ] + +Use kunmap_local() to unmap pages locally mapped with kmap_local_page(). + +kunmap_local() must be called on the kernel virtual address returned by +kmap_local_page(), differently from how we use kunmap() which instead +expects the mapped page as its argument. + +In module_zstd_decompress() we currently map with kmap_local_page() and +unmap with kunmap(). This breaks the code and so it should be fixed. + +Cc: Piotr Gorski +Cc: Dmitry Torokhov +Cc: Luis Chamberlain +Cc: Stephen Boyd +Cc: Ira Weiny +Fixes: 169a58ad824d ("module/decompress: Support zstd in-kernel decompression") +Signed-off-by: Fabio M. De Francesco +Reviewed-by: Stephen Boyd +Reviewed-by: Ira Weiny +Reviewed-by: Piotr Gorski +Signed-off-by: Luis Chamberlain +Signed-off-by: Sasha Levin +--- + kernel/module/decompress.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/module/decompress.c b/kernel/module/decompress.c +index bb79ac1a6d8f7..7ddc87bee2741 100644 +--- a/kernel/module/decompress.c ++++ b/kernel/module/decompress.c +@@ -267,7 +267,7 @@ static ssize_t module_zstd_decompress(struct load_info *info, + zstd_dec.size = PAGE_SIZE; + + ret = zstd_decompress_stream(dstream, &zstd_dec, &zstd_buf); +- kunmap(page); ++ kunmap_local(zstd_dec.dst); + retval = zstd_get_error_code(ret); + if (retval) + break; +-- +2.39.2 + diff --git a/queue-6.2/mt76-mt7921-fix-kernel-panic-by-accessing-unallocate.patch b/queue-6.2/mt76-mt7921-fix-kernel-panic-by-accessing-unallocate.patch new file mode 100644 index 00000000000..52e3e0eab02 --- /dev/null +++ b/queue-6.2/mt76-mt7921-fix-kernel-panic-by-accessing-unallocate.patch @@ -0,0 +1,95 @@ +From 5e404cb1f46a8f58c0f74144ba0e4803ac37ac2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 05:23:11 +0800 +Subject: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data + +From: Sean Wang + +[ Upstream commit 12db28c3ef31f719bd18fa186a40bb152e6a527c ] + +The MT7921 driver no longer uses eeprom.data, but the relevant code has not +been removed completely since +commit 16d98b548365 ("mt76: mt7921: rely on mcu_get_nic_capability"). +This could result in potential invalid memory access. + +To fix the kernel panic issue in mt7921, it is necessary to avoid accessing +unallocated eeprom.data which can lead to invalid memory access. + +Furthermore, it is possible to entirely eliminate the +mt7921_mcu_parse_eeprom function and solely depend on +mt7921_mcu_parse_response to divide the RxD header. + +[2.702735] BUG: kernel NULL pointer dereference, address: 0000000000000550 +[2.702740] #PF: supervisor write access in kernel mode +[2.702741] #PF: error_code(0x0002) - not-present page +[2.702743] PGD 0 P4D 0 +[2.702747] Oops: 0002 [#1] PREEMPT SMP NOPTI +[2.702755] RIP: 0010:mt7921_mcu_parse_response+0x147/0x170 [mt7921_common] +[2.702758] RSP: 0018:ffffae7c00fef828 EFLAGS: 00010286 +[2.702760] RAX: ffffa367f57be024 RBX: ffffa367cc7bf500 RCX: 0000000000000000 +[2.702762] RDX: 0000000000000550 RSI: 0000000000000000 RDI: ffffa367cc7bf500 +[2.702763] RBP: ffffae7c00fef840 R08: ffffa367cb167000 R09: 0000000000000005 +[2.702764] R10: 0000000000000000 R11: ffffffffc04702e4 R12: ffffa367e8329f40 +[2.702766] R13: 0000000000000000 R14: 0000000000000001 R15: ffffa367e8329f40 +[2.702768] FS: 000079ee6cf20c40(0000) GS:ffffa36b2f940000(0000) knlGS:0000000000000000 +[2.702769] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[2.702775] CR2: 0000000000000550 CR3: 00000001233c6004 CR4: 0000000000770ee0 +[2.702776] PKRU: 55555554 +[2.702777] Call Trace: +[2.702782] mt76_mcu_skb_send_and_get_msg+0xc3/0x11e [mt76 ] +[2.702785] mt7921_run_firmware+0x241/0x853 [mt7921_common ] +[2.702789] mt7921e_mcu_init+0x2b/0x56 [mt7921e ] +[2.702792] mt7921_register_device+0x2eb/0x5a5 [mt7921_common ] +[2.702795] ? mt7921_irq_tasklet+0x1d4/0x1d4 [mt7921e ] +[2.702797] mt7921_pci_probe+0x2d6/0x319 [mt7921e ] +[2.702799] pci_device_probe+0x9f/0x12a + +Fixes: 16d98b548365 ("mt76: mt7921: rely on mcu_get_nic_capability") +Signed-off-by: Sean Wang +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7921/mcu.c | 20 ------------------- + 1 file changed, 20 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +index 7253ce90234ef..087a5dc2593db 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +@@ -16,24 +16,6 @@ static bool mt7921_disable_clc; + module_param_named(disable_clc, mt7921_disable_clc, bool, 0644); + MODULE_PARM_DESC(disable_clc, "disable CLC support"); + +-static int +-mt7921_mcu_parse_eeprom(struct mt76_dev *dev, struct sk_buff *skb) +-{ +- struct mt7921_mcu_eeprom_info *res; +- u8 *buf; +- +- if (!skb) +- return -EINVAL; +- +- skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd)); +- +- res = (struct mt7921_mcu_eeprom_info *)skb->data; +- buf = dev->eeprom.data + le32_to_cpu(res->addr); +- memcpy(buf, res->data, 16); +- +- return 0; +-} +- + int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd, + struct sk_buff *skb, int seq) + { +@@ -60,8 +42,6 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd, + } else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) { + skb_pull(skb, sizeof(*rxd) + 4); + ret = le32_to_cpu(*(__le32 *)skb->data); +- } else if (cmd == MCU_EXT_CMD(EFUSE_ACCESS)) { +- ret = mt7921_mcu_parse_eeprom(mdev, skb); + } else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) || + cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) || + cmd == MCU_UNI_CMD(STA_REC_UPDATE) || +-- +2.39.2 + diff --git a/queue-6.2/net-amd-fix-link-leak-when-verifying-config-failed.patch b/queue-6.2/net-amd-fix-link-leak-when-verifying-config-failed.patch new file mode 100644 index 00000000000..e4e389edb87 --- /dev/null +++ b/queue-6.2/net-amd-fix-link-leak-when-verifying-config-failed.patch @@ -0,0 +1,47 @@ +From 0f7d9153cf6c365a67d9a54fe20f7a90f293c536 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 23:28:01 +0800 +Subject: net: amd: Fix link leak when verifying config failed + +From: Gencen Gan + +[ Upstream commit d325c34d9e7e38d371c0a299d415e9b07f66a1fb ] + +After failing to verify configuration, it returns directly without +releasing link, which may cause memory leak. + +Paolo Abeni thinks that the whole code of this driver is quite +"suboptimal" and looks unmainatained since at least ~15y, so he +suggests that we could simply remove the whole driver, please +take it into consideration. + +Simon Horman suggests that the fix label should be set to +"Linux-2.6.12-rc2" considering that the problem has existed +since the driver was introduced and the commit above doesn't +seem to exist in net/net-next. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Gan Gecen +Reviewed-by: Dongliang Mu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/nmclan_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/nmclan_cs.c b/drivers/net/ethernet/amd/nmclan_cs.c +index 823a329a921f4..0dd391c84c138 100644 +--- a/drivers/net/ethernet/amd/nmclan_cs.c ++++ b/drivers/net/ethernet/amd/nmclan_cs.c +@@ -651,7 +651,7 @@ static int nmclan_config(struct pcmcia_device *link) + } else { + pr_notice("mace id not found: %x %x should be 0x40 0x?9\n", + sig[0], sig[1]); +- return -ENODEV; ++ goto failed; + } + } + +-- +2.39.2 + diff --git a/queue-6.2/net-dpaa-fix-uninitialized-variable-in-dpaa_stop.patch b/queue-6.2/net-dpaa-fix-uninitialized-variable-in-dpaa_stop.patch new file mode 100644 index 00000000000..6d687005b43 --- /dev/null +++ b/queue-6.2/net-dpaa-fix-uninitialized-variable-in-dpaa_stop.patch @@ -0,0 +1,39 @@ +From bf08dd66231e67d65d8ddb7622dbc9a31e269b95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 15:36:07 +0300 +Subject: net: dpaa: Fix uninitialized variable in dpaa_stop() + +From: Dan Carpenter + +[ Upstream commit 461bb5b97049a149278f2c27a3aa12af16da6a2e ] + +The return value is not initialized on the success path. + +Fixes: 901bdff2f529 ("net: fman: Change return type of disable to void") +Signed-off-by: Dan Carpenter +Acked-by: Madalin Bucur +Reviewed-by: Sean Anderson +Link: https://lore.kernel.org/r/8c9dc377-8495-495f-a4e5-4d2d0ee12f0c@kili.mountain +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index 027fff9f7db07..48ec323e0a920 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -295,7 +295,8 @@ static int dpaa_stop(struct net_device *net_dev) + { + struct mac_device *mac_dev; + struct dpaa_priv *priv; +- int i, err, error; ++ int i, error; ++ int err = 0; + + priv = netdev_priv(net_dev); + mac_dev = priv->mac_dev; +-- +2.39.2 + diff --git a/queue-6.2/net-dsa-qca8k-remove-assignment-of-an_enabled-in-pcs.patch b/queue-6.2/net-dsa-qca8k-remove-assignment-of-an_enabled-in-pcs.patch new file mode 100644 index 00000000000..af3545373d1 --- /dev/null +++ b/queue-6.2/net-dsa-qca8k-remove-assignment-of-an_enabled-in-pcs.patch @@ -0,0 +1,36 @@ +From 95284335dab97b4757fc159901ab82d466f57dcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Mar 2023 12:33:29 +0000 +Subject: net: dsa: qca8k: remove assignment of an_enabled in pcs_get_state() + +From: Russell King (Oracle) + +[ Upstream commit 9ef70d0130f282638b28cfce24222f71ada00c9c ] + +pcs_get_state() implementations are not supposed to alter an_enabled. +Remove this assignment. + +Fixes: b3591c2a3661 ("net: dsa: qca8k: Switch to PHYLINK instead of PHYLIB") +Signed-off-by: Russell King (Oracle) +Link: https://lore.kernel.org/r/E1pdsE5-00Dl2l-8F@rmk-PC.armlinux.org.uk +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/qca/qca8k-8xxx.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c +index 2f224b166bbb3..f7944fe2e0ba7 100644 +--- a/drivers/net/dsa/qca/qca8k-8xxx.c ++++ b/drivers/net/dsa/qca/qca8k-8xxx.c +@@ -1427,7 +1427,6 @@ static void qca8k_pcs_get_state(struct phylink_pcs *pcs, + + state->link = !!(reg & QCA8K_PORT_STATUS_LINK_UP); + state->an_complete = state->link; +- state->an_enabled = !!(reg & QCA8K_PORT_STATUS_LINK_AUTO); + state->duplex = (reg & QCA8K_PORT_STATUS_DUPLEX) ? DUPLEX_FULL : + DUPLEX_HALF; + +-- +2.39.2 + diff --git a/queue-6.2/net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch b/queue-6.2/net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch new file mode 100644 index 00000000000..53f7c1dff9c --- /dev/null +++ b/queue-6.2/net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch @@ -0,0 +1,64 @@ +From 8dc63c24c694c14355b41341d5e65e44e53b44fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 18:11:29 +0200 +Subject: net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling + +From: Sebastian Reichel + +[ Upstream commit db21973263f8c56750cb610f1d5e8bee00a513b9 ] + +The usual devm_regulator_get() call already handles "optional" +regulators by returning a valid dummy and printing a warning +that the dummy regulator should be described properly. This +code open coded the same behaviour, but masked any errors that +are not -EPROBE_DEFER and is quite noisy. + +This change effectively unmasks and propagates regulators errors +not involving -ENODEV, downgrades the error print to warning level +if no regulator is specified and captures the probe defer message +for /sys/kernel/debug/devices_deferred. + +Fixes: 2e12f536635f ("net: stmmac: dwmac-rk: Use standard devicetree property for phy regulator") +Signed-off-by: Sebastian Reichel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 14 ++++---------- + 1 file changed, 4 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +index 21954b3d825c6..cf682a9e3fff2 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +@@ -1586,9 +1586,6 @@ static int phy_power_on(struct rk_priv_data *bsp_priv, bool enable) + int ret; + struct device *dev = &bsp_priv->pdev->dev; + +- if (!ldo) +- return 0; +- + if (enable) { + ret = regulator_enable(ldo); + if (ret) +@@ -1636,14 +1633,11 @@ static struct rk_priv_data *rk_gmac_setup(struct platform_device *pdev, + } + } + +- bsp_priv->regulator = devm_regulator_get_optional(dev, "phy"); ++ bsp_priv->regulator = devm_regulator_get(dev, "phy"); + if (IS_ERR(bsp_priv->regulator)) { +- if (PTR_ERR(bsp_priv->regulator) == -EPROBE_DEFER) { +- dev_err(dev, "phy regulator is not available yet, deferred probing\n"); +- return ERR_PTR(-EPROBE_DEFER); +- } +- dev_err(dev, "no regulator found\n"); +- bsp_priv->regulator = NULL; ++ ret = PTR_ERR(bsp_priv->regulator); ++ dev_err_probe(dev, ret, "failed to get phy regulator\n"); ++ return ERR_PTR(ret); + } + + ret = of_property_read_string(dev->of_node, "clock_in_out", &strings); +-- +2.39.2 + diff --git a/queue-6.2/net-ethernet-stmmac-dwmac-rk-rework-optional-clock-h.patch b/queue-6.2/net-ethernet-stmmac-dwmac-rk-rework-optional-clock-h.patch new file mode 100644 index 00000000000..297e55aa11f --- /dev/null +++ b/queue-6.2/net-ethernet-stmmac-dwmac-rk-rework-optional-clock-h.patch @@ -0,0 +1,344 @@ +From 88f647c0e270858ed58dc31e1cb257899448f487 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 18:11:28 +0200 +Subject: net: ethernet: stmmac: dwmac-rk: rework optional clock handling + +From: Sebastian Reichel + +[ Upstream commit ea449f7fa0bf3fcd02e04a770b9ff707bf5e8f96 ] + +The clock requesting code is quite repetitive. Fix this by requesting +the clocks via devm_clk_bulk_get_optional. The optional variant has been +used, since this is effectively what the old code did. The exact clocks +required depend on the platform and configuration. As a side effect +this change adds correct -EPROBE_DEFER handling. + +Suggested-by: Jakub Kicinski +Suggested-by: Andrew Lunn +Fixes: 7ad269ea1a2b ("GMAC: add driver for Rockchip RK3288 SoCs integrated GMAC") +Signed-off-by: Sebastian Reichel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/stmicro/stmmac/dwmac-rk.c | 183 +++++++----------- + 1 file changed, 70 insertions(+), 113 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +index 6656d76b6766b..21954b3d825c6 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +@@ -39,6 +39,24 @@ struct rk_gmac_ops { + u32 regs[]; + }; + ++static const char * const rk_clocks[] = { ++ "aclk_mac", "pclk_mac", "mac_clk_tx", "clk_mac_speed", ++}; ++ ++static const char * const rk_rmii_clocks[] = { ++ "mac_clk_rx", "clk_mac_ref", "clk_mac_refout", ++}; ++ ++enum rk_clocks_index { ++ RK_ACLK_MAC = 0, ++ RK_PCLK_MAC, ++ RK_MAC_CLK_TX, ++ RK_CLK_MAC_SPEED, ++ RK_MAC_CLK_RX, ++ RK_CLK_MAC_REF, ++ RK_CLK_MAC_REFOUT, ++}; ++ + struct rk_priv_data { + struct platform_device *pdev; + phy_interface_t phy_iface; +@@ -51,15 +69,9 @@ struct rk_priv_data { + bool clock_input; + bool integrated_phy; + ++ struct clk_bulk_data *clks; ++ int num_clks; + struct clk *clk_mac; +- struct clk *gmac_clkin; +- struct clk *mac_clk_rx; +- struct clk *mac_clk_tx; +- struct clk *clk_mac_ref; +- struct clk *clk_mac_refout; +- struct clk *clk_mac_speed; +- struct clk *aclk_mac; +- struct clk *pclk_mac; + struct clk *clk_phy; + + struct reset_control *phy_reset; +@@ -104,10 +116,11 @@ static void px30_set_to_rmii(struct rk_priv_data *bsp_priv) + + static void px30_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed) + { ++ struct clk *clk_mac_speed = bsp_priv->clks[RK_CLK_MAC_SPEED].clk; + struct device *dev = &bsp_priv->pdev->dev; + int ret; + +- if (IS_ERR(bsp_priv->clk_mac_speed)) { ++ if (!clk_mac_speed) { + dev_err(dev, "%s: Missing clk_mac_speed clock\n", __func__); + return; + } +@@ -116,7 +129,7 @@ static void px30_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed) + regmap_write(bsp_priv->grf, PX30_GRF_GMAC_CON1, + PX30_GMAC_SPEED_10M); + +- ret = clk_set_rate(bsp_priv->clk_mac_speed, 2500000); ++ ret = clk_set_rate(clk_mac_speed, 2500000); + if (ret) + dev_err(dev, "%s: set clk_mac_speed rate 2500000 failed: %d\n", + __func__, ret); +@@ -124,7 +137,7 @@ static void px30_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed) + regmap_write(bsp_priv->grf, PX30_GRF_GMAC_CON1, + PX30_GMAC_SPEED_100M); + +- ret = clk_set_rate(bsp_priv->clk_mac_speed, 25000000); ++ ret = clk_set_rate(clk_mac_speed, 25000000); + if (ret) + dev_err(dev, "%s: set clk_mac_speed rate 25000000 failed: %d\n", + __func__, ret); +@@ -1066,6 +1079,7 @@ static void rk3568_set_to_rmii(struct rk_priv_data *bsp_priv) + + static void rk3568_set_gmac_speed(struct rk_priv_data *bsp_priv, int speed) + { ++ struct clk *clk_mac_speed = bsp_priv->clks[RK_CLK_MAC_SPEED].clk; + struct device *dev = &bsp_priv->pdev->dev; + unsigned long rate; + int ret; +@@ -1085,7 +1099,7 @@ static void rk3568_set_gmac_speed(struct rk_priv_data *bsp_priv, int speed) + return; + } + +- ret = clk_set_rate(bsp_priv->clk_mac_speed, rate); ++ ret = clk_set_rate(clk_mac_speed, rate); + if (ret) + dev_err(dev, "%s: set clk_mac_speed rate %ld failed %d\n", + __func__, rate, ret); +@@ -1371,6 +1385,7 @@ static void rv1126_set_to_rmii(struct rk_priv_data *bsp_priv) + + static void rv1126_set_rgmii_speed(struct rk_priv_data *bsp_priv, int speed) + { ++ struct clk *clk_mac_speed = bsp_priv->clks[RK_CLK_MAC_SPEED].clk; + struct device *dev = &bsp_priv->pdev->dev; + unsigned long rate; + int ret; +@@ -1390,7 +1405,7 @@ static void rv1126_set_rgmii_speed(struct rk_priv_data *bsp_priv, int speed) + return; + } + +- ret = clk_set_rate(bsp_priv->clk_mac_speed, rate); ++ ret = clk_set_rate(clk_mac_speed, rate); + if (ret) + dev_err(dev, "%s: set clk_mac_speed rate %ld failed %d\n", + __func__, rate, ret); +@@ -1398,6 +1413,7 @@ static void rv1126_set_rgmii_speed(struct rk_priv_data *bsp_priv, int speed) + + static void rv1126_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed) + { ++ struct clk *clk_mac_speed = bsp_priv->clks[RK_CLK_MAC_SPEED].clk; + struct device *dev = &bsp_priv->pdev->dev; + unsigned long rate; + int ret; +@@ -1414,7 +1430,7 @@ static void rv1126_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed) + return; + } + +- ret = clk_set_rate(bsp_priv->clk_mac_speed, rate); ++ ret = clk_set_rate(clk_mac_speed, rate); + if (ret) + dev_err(dev, "%s: set clk_mac_speed rate %ld failed %d\n", + __func__, rate, ret); +@@ -1475,68 +1491,50 @@ static int rk_gmac_clk_init(struct plat_stmmacenet_data *plat) + { + struct rk_priv_data *bsp_priv = plat->bsp_priv; + struct device *dev = &bsp_priv->pdev->dev; +- int ret; ++ int phy_iface = bsp_priv->phy_iface; ++ int i, j, ret; + + bsp_priv->clk_enabled = false; + +- bsp_priv->mac_clk_rx = devm_clk_get(dev, "mac_clk_rx"); +- if (IS_ERR(bsp_priv->mac_clk_rx)) +- dev_err(dev, "cannot get clock %s\n", +- "mac_clk_rx"); +- +- bsp_priv->mac_clk_tx = devm_clk_get(dev, "mac_clk_tx"); +- if (IS_ERR(bsp_priv->mac_clk_tx)) +- dev_err(dev, "cannot get clock %s\n", +- "mac_clk_tx"); ++ bsp_priv->num_clks = ARRAY_SIZE(rk_clocks); ++ if (phy_iface == PHY_INTERFACE_MODE_RMII) ++ bsp_priv->num_clks += ARRAY_SIZE(rk_rmii_clocks); + +- bsp_priv->aclk_mac = devm_clk_get(dev, "aclk_mac"); +- if (IS_ERR(bsp_priv->aclk_mac)) +- dev_err(dev, "cannot get clock %s\n", +- "aclk_mac"); ++ bsp_priv->clks = devm_kcalloc(dev, bsp_priv->num_clks, ++ sizeof(*bsp_priv->clks), GFP_KERNEL); ++ if (!bsp_priv->clks) ++ return -ENOMEM; + +- bsp_priv->pclk_mac = devm_clk_get(dev, "pclk_mac"); +- if (IS_ERR(bsp_priv->pclk_mac)) +- dev_err(dev, "cannot get clock %s\n", +- "pclk_mac"); ++ for (i = 0; i < ARRAY_SIZE(rk_clocks); i++) ++ bsp_priv->clks[i].id = rk_clocks[i]; + +- bsp_priv->clk_mac = devm_clk_get(dev, "stmmaceth"); +- if (IS_ERR(bsp_priv->clk_mac)) +- dev_err(dev, "cannot get clock %s\n", +- "stmmaceth"); +- +- if (bsp_priv->phy_iface == PHY_INTERFACE_MODE_RMII) { +- bsp_priv->clk_mac_ref = devm_clk_get(dev, "clk_mac_ref"); +- if (IS_ERR(bsp_priv->clk_mac_ref)) +- dev_err(dev, "cannot get clock %s\n", +- "clk_mac_ref"); +- +- if (!bsp_priv->clock_input) { +- bsp_priv->clk_mac_refout = +- devm_clk_get(dev, "clk_mac_refout"); +- if (IS_ERR(bsp_priv->clk_mac_refout)) +- dev_err(dev, "cannot get clock %s\n", +- "clk_mac_refout"); +- } ++ if (phy_iface == PHY_INTERFACE_MODE_RMII) { ++ for (j = 0; j < ARRAY_SIZE(rk_rmii_clocks); j++) ++ bsp_priv->clks[i++].id = rk_rmii_clocks[j]; + } + +- bsp_priv->clk_mac_speed = devm_clk_get(dev, "clk_mac_speed"); +- if (IS_ERR(bsp_priv->clk_mac_speed)) +- dev_err(dev, "cannot get clock %s\n", "clk_mac_speed"); ++ ret = devm_clk_bulk_get_optional(dev, bsp_priv->num_clks, ++ bsp_priv->clks); ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to get clocks\n"); ++ ++ /* "stmmaceth" will be enabled by the core */ ++ bsp_priv->clk_mac = devm_clk_get(dev, "stmmaceth"); ++ ret = PTR_ERR_OR_ZERO(bsp_priv->clk_mac); ++ if (ret) ++ return dev_err_probe(dev, ret, "Cannot get stmmaceth clock\n"); + + if (bsp_priv->clock_input) { + dev_info(dev, "clock input from PHY\n"); +- } else { +- if (bsp_priv->phy_iface == PHY_INTERFACE_MODE_RMII) +- clk_set_rate(bsp_priv->clk_mac, 50000000); ++ } else if (phy_iface == PHY_INTERFACE_MODE_RMII) { ++ clk_set_rate(bsp_priv->clk_mac, 50000000); + } + + if (plat->phy_node && bsp_priv->integrated_phy) { + bsp_priv->clk_phy = of_clk_get(plat->phy_node, 0); +- if (IS_ERR(bsp_priv->clk_phy)) { +- ret = PTR_ERR(bsp_priv->clk_phy); +- dev_err(dev, "Cannot get PHY clock: %d\n", ret); +- return -EINVAL; +- } ++ ret = PTR_ERR_OR_ZERO(bsp_priv->clk_phy); ++ if (ret) ++ return dev_err_probe(dev, ret, "Cannot get PHY clock\n"); + clk_set_rate(bsp_priv->clk_phy, 50000000); + } + +@@ -1545,77 +1543,36 @@ static int rk_gmac_clk_init(struct plat_stmmacenet_data *plat) + + static int gmac_clk_enable(struct rk_priv_data *bsp_priv, bool enable) + { +- int phy_iface = bsp_priv->phy_iface; ++ int ret; + + if (enable) { + if (!bsp_priv->clk_enabled) { +- if (phy_iface == PHY_INTERFACE_MODE_RMII) { +- if (!IS_ERR(bsp_priv->mac_clk_rx)) +- clk_prepare_enable( +- bsp_priv->mac_clk_rx); +- +- if (!IS_ERR(bsp_priv->clk_mac_ref)) +- clk_prepare_enable( +- bsp_priv->clk_mac_ref); +- +- if (!IS_ERR(bsp_priv->clk_mac_refout)) +- clk_prepare_enable( +- bsp_priv->clk_mac_refout); +- } +- +- if (!IS_ERR(bsp_priv->clk_phy)) +- clk_prepare_enable(bsp_priv->clk_phy); +- +- if (!IS_ERR(bsp_priv->aclk_mac)) +- clk_prepare_enable(bsp_priv->aclk_mac); +- +- if (!IS_ERR(bsp_priv->pclk_mac)) +- clk_prepare_enable(bsp_priv->pclk_mac); +- +- if (!IS_ERR(bsp_priv->mac_clk_tx)) +- clk_prepare_enable(bsp_priv->mac_clk_tx); ++ ret = clk_bulk_prepare_enable(bsp_priv->num_clks, ++ bsp_priv->clks); ++ if (ret) ++ return ret; + +- if (!IS_ERR(bsp_priv->clk_mac_speed)) +- clk_prepare_enable(bsp_priv->clk_mac_speed); ++ ret = clk_prepare_enable(bsp_priv->clk_phy); ++ if (ret) ++ return ret; + + if (bsp_priv->ops && bsp_priv->ops->set_clock_selection) + bsp_priv->ops->set_clock_selection(bsp_priv, + bsp_priv->clock_input, true); + +- /** +- * if (!IS_ERR(bsp_priv->clk_mac)) +- * clk_prepare_enable(bsp_priv->clk_mac); +- */ + mdelay(5); + bsp_priv->clk_enabled = true; + } + } else { + if (bsp_priv->clk_enabled) { +- if (phy_iface == PHY_INTERFACE_MODE_RMII) { +- clk_disable_unprepare(bsp_priv->mac_clk_rx); +- +- clk_disable_unprepare(bsp_priv->clk_mac_ref); +- +- clk_disable_unprepare(bsp_priv->clk_mac_refout); +- } +- ++ clk_bulk_disable_unprepare(bsp_priv->num_clks, ++ bsp_priv->clks); + clk_disable_unprepare(bsp_priv->clk_phy); + +- clk_disable_unprepare(bsp_priv->aclk_mac); +- +- clk_disable_unprepare(bsp_priv->pclk_mac); +- +- clk_disable_unprepare(bsp_priv->mac_clk_tx); +- +- clk_disable_unprepare(bsp_priv->clk_mac_speed); +- + if (bsp_priv->ops && bsp_priv->ops->set_clock_selection) + bsp_priv->ops->set_clock_selection(bsp_priv, + bsp_priv->clock_input, false); +- /** +- * if (!IS_ERR(bsp_priv->clk_mac)) +- * clk_disable_unprepare(bsp_priv->clk_mac); +- */ ++ + bsp_priv->clk_enabled = false; + } + } +-- +2.39.2 + diff --git a/queue-6.2/net-mlx5-e-switch-create-per-vport-table-based-on-de.patch b/queue-6.2/net-mlx5-e-switch-create-per-vport-table-based-on-de.patch new file mode 100644 index 00000000000..59e71d41ecd --- /dev/null +++ b/queue-6.2/net-mlx5-e-switch-create-per-vport-table-based-on-de.patch @@ -0,0 +1,117 @@ +From 277b206004c8c89bf728bc6ff26d46ad17282e0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 11:06:48 +0200 +Subject: net/mlx5: E-switch, Create per vport table based on devlink encap + mode + +From: Chris Mi + +[ Upstream commit fd745f4c0abe41ebb09d11bf622b054a0f3e7b49 ] + +Currently when creating per vport table, create flags are hardcoded. +Devlink encap mode is set based on user input and HW capability. +Create per vport table based on devlink encap mode. + +Fixes: c796bb7cd230 ("net/mlx5: E-switch, Generalize per vport table API") +Signed-off-by: Chris Mi +Reviewed-by: Roi Dayan +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/en/tc/sample.c | 4 ++-- + .../net/ethernet/mellanox/mlx5/core/esw/vporttbl.c | 12 +++++++++++- + drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 2 +- + .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 +- + 4 files changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c +index f2c2c752bd1c3..c57b097275241 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c +@@ -14,10 +14,10 @@ + + #define MLX5_ESW_VPORT_TBL_SIZE_SAMPLE (64 * 1024) + +-static const struct esw_vport_tbl_namespace mlx5_esw_vport_tbl_sample_ns = { ++static struct esw_vport_tbl_namespace mlx5_esw_vport_tbl_sample_ns = { + .max_fte = MLX5_ESW_VPORT_TBL_SIZE_SAMPLE, + .max_num_groups = 0, /* default num of groups */ +- .flags = MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT | MLX5_FLOW_TABLE_TUNNEL_EN_DECAP, ++ .flags = 0, + }; + + struct mlx5e_tc_psample { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/vporttbl.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/vporttbl.c +index 9e72118f2e4c0..749c3957a1280 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/vporttbl.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/vporttbl.c +@@ -11,7 +11,7 @@ struct mlx5_vport_key { + u16 prio; + u16 vport; + u16 vhca_id; +- const struct esw_vport_tbl_namespace *vport_ns; ++ struct esw_vport_tbl_namespace *vport_ns; + } __packed; + + struct mlx5_vport_table { +@@ -21,6 +21,14 @@ struct mlx5_vport_table { + struct mlx5_vport_key key; + }; + ++static void ++esw_vport_tbl_init(struct mlx5_eswitch *esw, struct esw_vport_tbl_namespace *ns) ++{ ++ if (esw->offloads.encap != DEVLINK_ESWITCH_ENCAP_MODE_NONE) ++ ns->flags |= (MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT | ++ MLX5_FLOW_TABLE_TUNNEL_EN_DECAP); ++} ++ + static struct mlx5_flow_table * + esw_vport_tbl_create(struct mlx5_eswitch *esw, struct mlx5_flow_namespace *ns, + const struct esw_vport_tbl_namespace *vport_ns) +@@ -80,6 +88,7 @@ mlx5_esw_vporttbl_get(struct mlx5_eswitch *esw, struct mlx5_vport_tbl_attr *attr + u32 hkey; + + mutex_lock(&esw->fdb_table.offloads.vports.lock); ++ esw_vport_tbl_init(esw, attr->vport_ns); + hkey = flow_attr_to_vport_key(esw, attr, &skey); + e = esw_vport_tbl_lookup(esw, &skey, hkey); + if (e) { +@@ -127,6 +136,7 @@ mlx5_esw_vporttbl_put(struct mlx5_eswitch *esw, struct mlx5_vport_tbl_attr *attr + u32 hkey; + + mutex_lock(&esw->fdb_table.offloads.vports.lock); ++ esw_vport_tbl_init(esw, attr->vport_ns); + hkey = flow_attr_to_vport_key(esw, attr, &key); + e = esw_vport_tbl_lookup(esw, &key, hkey); + if (!e || --e->num_rules) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +index 92644fbb50816..ceb6722c84e2c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +@@ -677,7 +677,7 @@ struct mlx5_vport_tbl_attr { + u32 chain; + u16 prio; + u16 vport; +- const struct esw_vport_tbl_namespace *vport_ns; ++ struct esw_vport_tbl_namespace *vport_ns; + }; + + struct mlx5_flow_table * +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index 0facc709f0e74..f9dfd9f3f9512 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -73,7 +73,7 @@ + + #define MLX5_ESW_FT_OFFLOADS_DROP_RULE (1) + +-static const struct esw_vport_tbl_namespace mlx5_esw_vport_tbl_mirror_ns = { ++static struct esw_vport_tbl_namespace mlx5_esw_vport_tbl_mirror_ns = { + .max_fte = MLX5_ESW_VPORT_TBL_SIZE, + .max_num_groups = MLX5_ESW_VPORT_TBL_NUM_GROUPS, + .flags = 0, +-- +2.39.2 + diff --git a/queue-6.2/net-mlx5-e-switch-don-t-destroy-indirect-table-in-sp.patch b/queue-6.2/net-mlx5-e-switch-don-t-destroy-indirect-table-in-sp.patch new file mode 100644 index 00000000000..dc8f452f384 --- /dev/null +++ b/queue-6.2/net-mlx5-e-switch-don-t-destroy-indirect-table-in-sp.patch @@ -0,0 +1,51 @@ +From bdc245f0a5d0e2ce675d493bc1e551fb2c8fa626 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 09:56:08 +0200 +Subject: net/mlx5: E-switch, Don't destroy indirect table in split rule + +From: Chris Mi + +[ Upstream commit 4c8189302567f75099a336b0efcff8291ec86ff4 ] + +Source port rewrite (forward to ovs internal port or statck device) isn't +supported in the rule of split action. So there is no indirect table in +split rule. The cited commit destroyes indirect table in split rule. The +indirect table for other rules will be destroyed wrongly. It will cause +traffic loss. + +Fix it by removing the destroy function in split rule. And also remove +the destroy function in error flow. + +Fixes: 10742efc20a4 ("net/mlx5e: VF tunnel TX traffic offloading") +Signed-off-by: Chris Mi +Reviewed-by: Roi Dayan +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index f9dfd9f3f9512..6561b6b505568 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -763,7 +763,6 @@ mlx5_eswitch_add_fwd_rule(struct mlx5_eswitch *esw, + kfree(dest); + return rule; + err_chain_src_rewrite: +- esw_put_dest_tables_loop(esw, attr, 0, i); + mlx5_esw_vporttbl_put(esw, &fwd_attr); + err_get_fwd: + mlx5_chains_put_table(chains, attr->chain, attr->prio, 0); +@@ -806,7 +805,6 @@ __mlx5_eswitch_del_rule(struct mlx5_eswitch *esw, + if (fwd_rule) { + mlx5_esw_vporttbl_put(esw, &fwd_attr); + mlx5_chains_put_table(chains, attr->chain, attr->prio, 0); +- esw_put_dest_tables_loop(esw, attr, 0, esw_attr->split_count); + } else { + if (split) + mlx5_esw_vporttbl_put(esw, &fwd_attr); +-- +2.39.2 + diff --git a/queue-6.2/net-mlx5-remove-recovery-arg-from-mlx5_load_one-func.patch b/queue-6.2/net-mlx5-remove-recovery-arg-from-mlx5_load_one-func.patch new file mode 100644 index 00000000000..0e7b3d57913 --- /dev/null +++ b/queue-6.2/net-mlx5-remove-recovery-arg-from-mlx5_load_one-func.patch @@ -0,0 +1,91 @@ +From 2af721f68fbe1947da729a0cd8f02e09e38e1f0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 13:23:17 +0100 +Subject: net/mlx5: Remove "recovery" arg from mlx5_load_one() function + +From: Jiri Pirko + +[ Upstream commit 5977ac3910f1cbaf44dca48179118b25c206ac29 ] + +mlx5_load_one() is always called with recovery==false, so remove the +unneeded function arg. + +Signed-off-by: Jiri Pirko +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Stable-dep-of: dfad99750c0f ("net/mlx5: Use recovery timeout on sync reset flow") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 2 +- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 9 ++++----- + drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h | 2 +- + 3 files changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +index 1e46f9afa40e0..a1f460c9d3cde 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +@@ -154,7 +154,7 @@ static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev) + if (mlx5_health_wait_pci_up(dev)) + mlx5_core_err(dev, "reset reload flow aborted, PCI reads still not working\n"); + else +- mlx5_load_one(dev, false); ++ mlx5_load_one(dev); + devlink_remote_reload_actions_performed(priv_to_devlink(dev), 0, + BIT(DEVLINK_RELOAD_ACTION_DRIVER_REINIT) | + BIT(DEVLINK_RELOAD_ACTION_FW_ACTIVATE)); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index f4e0431da55b4..2772005be741a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1491,13 +1491,13 @@ int mlx5_load_one_devl_locked(struct mlx5_core_dev *dev, bool recovery) + return err; + } + +-int mlx5_load_one(struct mlx5_core_dev *dev, bool recovery) ++int mlx5_load_one(struct mlx5_core_dev *dev) + { + struct devlink *devlink = priv_to_devlink(dev); + int ret; + + devl_lock(devlink); +- ret = mlx5_load_one_devl_locked(dev, recovery); ++ ret = mlx5_load_one_devl_locked(dev, false); + devl_unlock(devlink); + return ret; + } +@@ -1891,8 +1891,7 @@ static void mlx5_pci_resume(struct pci_dev *pdev) + + mlx5_pci_trace(dev, "Enter, loading driver..\n"); + +- err = mlx5_load_one(dev, false); +- ++ err = mlx5_load_one(dev); + if (!err) + devlink_health_reporter_state_update(dev->priv.health.fw_fatal_reporter, + DEVLINK_HEALTH_REPORTER_STATE_HEALTHY); +@@ -1983,7 +1982,7 @@ static int mlx5_resume(struct pci_dev *pdev) + { + struct mlx5_core_dev *dev = pci_get_drvdata(pdev); + +- return mlx5_load_one(dev, false); ++ return mlx5_load_one(dev); + } + + static const struct pci_device_id mlx5_core_pci_table[] = { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h +index 029305a8b80a8..d670b28a73236 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h +@@ -321,7 +321,7 @@ int mlx5_init_one(struct mlx5_core_dev *dev); + void mlx5_uninit_one(struct mlx5_core_dev *dev); + void mlx5_unload_one(struct mlx5_core_dev *dev); + void mlx5_unload_one_devl_locked(struct mlx5_core_dev *dev); +-int mlx5_load_one(struct mlx5_core_dev *dev, bool recovery); ++int mlx5_load_one(struct mlx5_core_dev *dev); + int mlx5_load_one_devl_locked(struct mlx5_core_dev *dev, bool recovery); + + int mlx5_vport_set_other_func_cap(struct mlx5_core_dev *dev, const void *hca_cap, u16 function_id, +-- +2.39.2 + diff --git a/queue-6.2/net-mlx5-suspend-auxiliary-devices-only-in-case-of-p.patch b/queue-6.2/net-mlx5-suspend-auxiliary-devices-only-in-case-of-p.patch new file mode 100644 index 00000000000..96d8e08a296 --- /dev/null +++ b/queue-6.2/net-mlx5-suspend-auxiliary-devices-only-in-case-of-p.patch @@ -0,0 +1,222 @@ +From 99ef2721e5a0218afcdc5f87f37eec368518aa05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 13:39:09 +0100 +Subject: net/mlx5: Suspend auxiliary devices only in case of PCI device + suspend + +From: Jiri Pirko + +[ Upstream commit 72ed5d5624af384eaf74d84915810d54486a75e2 ] + +The original behavior introduced by commit c6acd629eec7 ("net/mlx5e: Add +support for devlink-port in non-representors mode") correctly +re-instantiated uplink devlink port and related netdevice during devlink +reload. However with migration to auxiliary devices, this behaviour +changed. + +Restore the original behaviour and tear down auxiliary devices +completely during devlink reload. + +Signed-off-by: Jiri Pirko +Signed-off-by: Saeed Mahameed +Stable-dep-of: dfad99750c0f ("net/mlx5: Use recovery timeout on sync reset flow") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/dev.c | 4 ++-- + .../net/ethernet/mellanox/mlx5/core/devlink.c | 4 ++-- + .../net/ethernet/mellanox/mlx5/core/fw_reset.c | 4 ++-- + drivers/net/ethernet/mellanox/mlx5/core/health.c | 2 +- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 16 ++++++++-------- + .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 6 +++--- + .../ethernet/mellanox/mlx5/core/sf/dev/driver.c | 2 +- + 7 files changed, 19 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c +index 0571e40c6ee5f..02bb9d43ff9c4 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c +@@ -396,7 +396,7 @@ int mlx5_attach_device(struct mlx5_core_dev *dev) + return ret; + } + +-void mlx5_detach_device(struct mlx5_core_dev *dev) ++void mlx5_detach_device(struct mlx5_core_dev *dev, bool suspend) + { + struct mlx5_priv *priv = &dev->priv; + struct auxiliary_device *adev; +@@ -426,7 +426,7 @@ void mlx5_detach_device(struct mlx5_core_dev *dev) + + adrv = to_auxiliary_drv(adev->dev.driver); + +- if (adrv->suspend) { ++ if (adrv->suspend && suspend) { + adrv->suspend(adev, pm); + continue; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c +index 5bd83c0275f82..31ce591f527fa 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c +@@ -104,7 +104,7 @@ static int mlx5_devlink_reload_fw_activate(struct devlink *devlink, struct netli + if (err) + return err; + +- mlx5_unload_one_devl_locked(dev); ++ mlx5_unload_one_devl_locked(dev, true); + err = mlx5_health_wait_pci_up(dev); + if (err) + NL_SET_ERR_MSG_MOD(extack, "FW activate aborted, PCI reads fail after reset"); +@@ -162,7 +162,7 @@ static int mlx5_devlink_reload_down(struct devlink *devlink, bool netns_change, + + switch (action) { + case DEVLINK_RELOAD_ACTION_DRIVER_REINIT: +- mlx5_unload_one_devl_locked(dev); ++ mlx5_unload_one_devl_locked(dev, false); + break; + case DEVLINK_RELOAD_ACTION_FW_ACTIVATE: + if (limit == DEVLINK_RELOAD_LIMIT_NO_RESET) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +index a1f460c9d3cde..2ef42d76ac6a3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +@@ -150,7 +150,7 @@ static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev) + if (test_bit(MLX5_FW_RESET_FLAGS_PENDING_COMP, &fw_reset->reset_flags)) { + complete(&fw_reset->done); + } else { +- mlx5_unload_one(dev); ++ mlx5_unload_one(dev, false); + if (mlx5_health_wait_pci_up(dev)) + mlx5_core_err(dev, "reset reload flow aborted, PCI reads still not working\n"); + else +@@ -484,7 +484,7 @@ int mlx5_fw_reset_wait_reset_done(struct mlx5_core_dev *dev) + } + err = fw_reset->ret; + if (test_and_clear_bit(MLX5_FW_RESET_FLAGS_RELOAD_REQUIRED, &fw_reset->reset_flags)) { +- mlx5_unload_one_devl_locked(dev); ++ mlx5_unload_one_devl_locked(dev, false); + mlx5_load_one_devl_locked(dev, false); + } + out: +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c +index 879555ba847dd..e42e4ac231c64 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c +@@ -699,7 +699,7 @@ static void mlx5_fw_fatal_reporter_err_work(struct work_struct *work) + * requests from the kernel. + */ + mlx5_core_err(dev, "Driver is in error state. Unloading\n"); +- mlx5_unload_one(dev); ++ mlx5_unload_one(dev, false); + } + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 2772005be741a..d5d4f499a2a15 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1502,12 +1502,12 @@ int mlx5_load_one(struct mlx5_core_dev *dev) + return ret; + } + +-void mlx5_unload_one_devl_locked(struct mlx5_core_dev *dev) ++void mlx5_unload_one_devl_locked(struct mlx5_core_dev *dev, bool suspend) + { + devl_assert_locked(priv_to_devlink(dev)); + mutex_lock(&dev->intf_state_mutex); + +- mlx5_detach_device(dev); ++ mlx5_detach_device(dev, suspend); + + if (!test_bit(MLX5_INTERFACE_STATE_UP, &dev->intf_state)) { + mlx5_core_warn(dev, "%s: interface is down, NOP\n", +@@ -1522,12 +1522,12 @@ void mlx5_unload_one_devl_locked(struct mlx5_core_dev *dev) + mutex_unlock(&dev->intf_state_mutex); + } + +-void mlx5_unload_one(struct mlx5_core_dev *dev) ++void mlx5_unload_one(struct mlx5_core_dev *dev, bool suspend) + { + struct devlink *devlink = priv_to_devlink(dev); + + devl_lock(devlink); +- mlx5_unload_one_devl_locked(dev); ++ mlx5_unload_one_devl_locked(dev, suspend); + devl_unlock(devlink); + } + +@@ -1809,7 +1809,7 @@ static pci_ers_result_t mlx5_pci_err_detected(struct pci_dev *pdev, + + mlx5_enter_error_state(dev, false); + mlx5_error_sw_reset(dev); +- mlx5_unload_one(dev); ++ mlx5_unload_one(dev, true); + mlx5_drain_health_wq(dev); + mlx5_pci_disable_device(dev); + +@@ -1965,7 +1965,7 @@ static void shutdown(struct pci_dev *pdev) + set_bit(MLX5_BREAK_FW_WAIT, &dev->intf_state); + err = mlx5_try_fast_unload(dev); + if (err) +- mlx5_unload_one(dev); ++ mlx5_unload_one(dev, false); + mlx5_pci_disable_device(dev); + } + +@@ -1973,7 +1973,7 @@ static int mlx5_suspend(struct pci_dev *pdev, pm_message_t state) + { + struct mlx5_core_dev *dev = pci_get_drvdata(pdev); + +- mlx5_unload_one(dev); ++ mlx5_unload_one(dev, true); + + return 0; + } +@@ -2016,7 +2016,7 @@ MODULE_DEVICE_TABLE(pci, mlx5_core_pci_table); + void mlx5_disable_device(struct mlx5_core_dev *dev) + { + mlx5_error_sw_reset(dev); +- mlx5_unload_one_devl_locked(dev); ++ mlx5_unload_one_devl_locked(dev, false); + } + + int mlx5_recover_device(struct mlx5_core_dev *dev) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h +index d670b28a73236..be0785f83083a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h +@@ -236,7 +236,7 @@ void mlx5_adev_cleanup(struct mlx5_core_dev *dev); + int mlx5_adev_init(struct mlx5_core_dev *dev); + + int mlx5_attach_device(struct mlx5_core_dev *dev); +-void mlx5_detach_device(struct mlx5_core_dev *dev); ++void mlx5_detach_device(struct mlx5_core_dev *dev, bool suspend); + int mlx5_register_device(struct mlx5_core_dev *dev); + void mlx5_unregister_device(struct mlx5_core_dev *dev); + struct mlx5_core_dev *mlx5_get_next_phys_dev_lag(struct mlx5_core_dev *dev); +@@ -319,8 +319,8 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int profile_idx); + void mlx5_mdev_uninit(struct mlx5_core_dev *dev); + int mlx5_init_one(struct mlx5_core_dev *dev); + void mlx5_uninit_one(struct mlx5_core_dev *dev); +-void mlx5_unload_one(struct mlx5_core_dev *dev); +-void mlx5_unload_one_devl_locked(struct mlx5_core_dev *dev); ++void mlx5_unload_one(struct mlx5_core_dev *dev, bool suspend); ++void mlx5_unload_one_devl_locked(struct mlx5_core_dev *dev, bool suspend); + int mlx5_load_one(struct mlx5_core_dev *dev); + int mlx5_load_one_devl_locked(struct mlx5_core_dev *dev, bool recovery); + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c +index 7b4783ce213e2..a7377619ba6f2 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c +@@ -74,7 +74,7 @@ static void mlx5_sf_dev_shutdown(struct auxiliary_device *adev) + { + struct mlx5_sf_dev *sf_dev = container_of(adev, struct mlx5_sf_dev, adev); + +- mlx5_unload_one(sf_dev->mdev); ++ mlx5_unload_one(sf_dev->mdev, false); + } + + static const struct auxiliary_device_id mlx5_sf_dev_id_table[] = { +-- +2.39.2 + diff --git a/queue-6.2/net-mlx5-use-recovery-timeout-on-sync-reset-flow.patch b/queue-6.2/net-mlx5-use-recovery-timeout-on-sync-reset-flow.patch new file mode 100644 index 00000000000..e46413ab3a2 --- /dev/null +++ b/queue-6.2/net-mlx5-use-recovery-timeout-on-sync-reset-flow.patch @@ -0,0 +1,63 @@ +From 97cf0bcd782075b3ea99dfe0e006ff1d83043dc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Apr 2023 06:49:53 +0300 +Subject: net/mlx5: Use recovery timeout on sync reset flow + +From: Moshe Shemesh + +[ Upstream commit dfad99750c0f83b0242572a573afa2c055f85b36 ] + +Use the same timeout for sync reset flow and health recovery flow, since +the former involves driver's recovery from firmware reset, which is +similar to health recovery. Otherwise, in some cases, such as a firmware +upgrade on the DPU, the firmware pre-init bit may not be ready within +current timeout and the driver will abort loading back after reset. + +Signed-off-by: Moshe Shemesh +Fixes: 37ca95e62ee2 ("net/mlx5: Increase FW pre-init timeout for health recovery") +Reviewed-by: Maher Sanalla +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 +- + drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c +index 31ce591f527fa..2370e9ad52ea9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c +@@ -196,7 +196,7 @@ static int mlx5_devlink_reload_up(struct devlink *devlink, enum devlink_reload_a + break; + /* On fw_activate action, also driver is reloaded and reinit performed */ + *actions_performed |= BIT(DEVLINK_RELOAD_ACTION_DRIVER_REINIT); +- ret = mlx5_load_one_devl_locked(dev, false); ++ ret = mlx5_load_one_devl_locked(dev, true); + break; + default: + /* Unsupported action should not get to this function */ +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +index 2b74729180394..d219f8417d93a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +@@ -154,7 +154,7 @@ static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev) + if (mlx5_health_wait_pci_up(dev)) + mlx5_core_err(dev, "reset reload flow aborted, PCI reads still not working\n"); + else +- mlx5_load_one(dev, false); ++ mlx5_load_one(dev, true); + devlink_remote_reload_actions_performed(priv_to_devlink(dev), 0, + BIT(DEVLINK_RELOAD_ACTION_DRIVER_REINIT) | + BIT(DEVLINK_RELOAD_ACTION_FW_ACTIVATE)); +@@ -485,7 +485,7 @@ int mlx5_fw_reset_wait_reset_done(struct mlx5_core_dev *dev) + err = fw_reset->ret; + if (test_and_clear_bit(MLX5_FW_RESET_FLAGS_RELOAD_REQUIRED, &fw_reset->reset_flags)) { + mlx5_unload_one_devl_locked(dev, false); +- mlx5_load_one_devl_locked(dev, false); ++ mlx5_load_one_devl_locked(dev, true); + } + out: + clear_bit(MLX5_FW_RESET_FLAGS_PENDING_COMP, &fw_reset->reset_flags); +-- +2.39.2 + diff --git a/queue-6.2/net-mlx5e-don-t-clone-flow-post-action-attributes-se.patch b/queue-6.2/net-mlx5e-don-t-clone-flow-post-action-attributes-se.patch new file mode 100644 index 00000000000..3d22834c840 --- /dev/null +++ b/queue-6.2/net-mlx5e-don-t-clone-flow-post-action-attributes-se.patch @@ -0,0 +1,143 @@ +From 7876a53ded9a387420eb76ab70ea930936b67bfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 09:52:26 +0100 +Subject: net/mlx5e: Don't clone flow post action attributes second time + +From: Vlad Buslov + +[ Upstream commit e9fce818fe003b6c527f25517b9ac08eb4661b5d ] + +The code already clones post action attributes in +mlx5e_clone_flow_attr_for_post_act(). Creating another copy in +mlx5e_tc_post_act_add() is a erroneous leftover from original +implementation. Instead, assign handle->attribute to post_attr provided by +the caller. Note that cloning the attribute second time is not just +wasteful but also causes issues like second copy not being properly updated +in neigh update code which leads to following use-after-free: + +Feb 21 09:02:00 c-237-177-40-045 kernel: BUG: KASAN: use-after-free in mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0 +Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 +Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 +Feb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90 +Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 +Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 +Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_free_info+0x2a/0x40 +Feb 21 09:02:00 c-237-177-40-045 kernel: ____kasan_slab_free+0x11a/0x1b0 +Feb 21 09:02:00 c-237-177-40-045 kernel: page dumped because: kasan: bad access detected +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 8833): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0xf2ff71), err(-22) +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0 enp8s0f0: Failed to add post action rule +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5e_tc_encap_flows_add:190:(pid 8833): Failed to update flow post acts, -22 +Feb 21 09:02:00 c-237-177-40-045 kernel: Call Trace: +Feb 21 09:02:00 c-237-177-40-045 kernel: +Feb 21 09:02:00 c-237-177-40-045 kernel: dump_stack_lvl+0x57/0x7d +Feb 21 09:02:00 c-237-177-40-045 kernel: print_report+0x170/0x471 +Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0 +Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: ? __module_address.part.0+0x62/0x200 +Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_stub_create_flow_table+0xd0/0xd0 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: ? __raw_spin_lock_init+0x3b/0x110 +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_cmd_create_fte+0x80/0xb0 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: add_rule_fg+0xe80/0x19c0 [mlx5_core] +-- +Feb 21 09:02:00 c-237-177-40-045 kernel: Allocated by task 13476: +Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 +Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 +Feb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90 +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_packet_reformat_alloc+0x7b/0x230 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_tc_tun_create_header_ipv4+0x977/0xf10 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_attach_encap+0x15b4/0x1e10 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: post_process_attr+0x305/0xa30 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_tc_add_fdb_flow+0x4c0/0xcf0 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: __mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_configure_flower+0xcaa/0x4b90 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_setup_tc_cls_flower+0x99/0x1b0 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_setup_tc_cb+0x133/0x1e0 [mlx5_core] +-- +Feb 21 09:02:00 c-237-177-40-045 kernel: Freed by task 8833: +Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 +Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 +Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_free_info+0x2a/0x40 +Feb 21 09:02:00 c-237-177-40-045 kernel: ____kasan_slab_free+0x11a/0x1b0 +Feb 21 09:02:00 c-237-177-40-045 kernel: __kmem_cache_free+0x1de/0x400 +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_packet_reformat_dealloc+0xad/0x100 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_tc_encap_flows_del+0x3c0/0x500 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_update_flows+0x40c/0xa80 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5e_rep_neigh_update+0x473/0x7a0 [mlx5_core] +Feb 21 09:02:00 c-237-177-40-045 kernel: process_one_work+0x7c2/0x1310 +Feb 21 09:02:00 c-237-177-40-045 kernel: worker_thread+0x59d/0xec0 +Feb 21 09:02:00 c-237-177-40-045 kernel: kthread+0x28f/0x330 + +Fixes: 8300f225268b ("net/mlx5e: Create new flow attr for multi table actions") +Signed-off-by: Vlad Buslov +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/en/tc/post_act.c | 11 ++--------- + .../net/ethernet/mellanox/mlx5/core/en/tc/post_act.h | 2 +- + 2 files changed, 3 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c +index 4e48946c4c2ac..0290e0dea5390 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.c +@@ -106,22 +106,17 @@ mlx5e_tc_post_act_offload(struct mlx5e_post_act *post_act, + } + + struct mlx5e_post_act_handle * +-mlx5e_tc_post_act_add(struct mlx5e_post_act *post_act, struct mlx5_flow_attr *attr) ++mlx5e_tc_post_act_add(struct mlx5e_post_act *post_act, struct mlx5_flow_attr *post_attr) + { +- u32 attr_sz = ns_to_attr_sz(post_act->ns_type); + struct mlx5e_post_act_handle *handle; +- struct mlx5_flow_attr *post_attr; + int err; + + handle = kzalloc(sizeof(*handle), GFP_KERNEL); +- post_attr = mlx5_alloc_flow_attr(post_act->ns_type); +- if (!handle || !post_attr) { +- kfree(post_attr); ++ if (!handle) { + kfree(handle); + return ERR_PTR(-ENOMEM); + } + +- memcpy(post_attr, attr, attr_sz); + post_attr->chain = 0; + post_attr->prio = 0; + post_attr->ft = post_act->ft; +@@ -145,7 +140,6 @@ mlx5e_tc_post_act_add(struct mlx5e_post_act *post_act, struct mlx5_flow_attr *at + return handle; + + err_xarray: +- kfree(post_attr); + kfree(handle); + return ERR_PTR(err); + } +@@ -164,7 +158,6 @@ mlx5e_tc_post_act_del(struct mlx5e_post_act *post_act, struct mlx5e_post_act_han + if (!IS_ERR_OR_NULL(handle->rule)) + mlx5e_tc_post_act_unoffload(post_act, handle); + xa_erase(&post_act->ids, handle->id); +- kfree(handle->attr); + kfree(handle); + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h +index f476774c0b75d..40b8df184af51 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/post_act.h +@@ -19,7 +19,7 @@ void + mlx5e_tc_post_act_destroy(struct mlx5e_post_act *post_act); + + struct mlx5e_post_act_handle * +-mlx5e_tc_post_act_add(struct mlx5e_post_act *post_act, struct mlx5_flow_attr *attr); ++mlx5e_tc_post_act_add(struct mlx5e_post_act *post_act, struct mlx5_flow_attr *post_attr); + + void + mlx5e_tc_post_act_del(struct mlx5e_post_act *post_act, struct mlx5e_post_act_handle *handle); +-- +2.39.2 + diff --git a/queue-6.2/net-mlx5e-fix-error-flow-in-representor-failing-to-a.patch b/queue-6.2/net-mlx5e-fix-error-flow-in-representor-failing-to-a.patch new file mode 100644 index 00000000000..6cdc2355b70 --- /dev/null +++ b/queue-6.2/net-mlx5e-fix-error-flow-in-representor-failing-to-a.patch @@ -0,0 +1,74 @@ +From 125bb6cf81b6f3ce3a43002d0fb5592cab6016b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 15:24:32 +0300 +Subject: net/mlx5e: Fix error flow in representor failing to add vport rx rule + +From: Roi Dayan + +[ Upstream commit 0a6b069cc60d68d33b4f6e7dd7f1adc3ec749766 ] + +On representor init rx error flow the flow steering pointer is being +released so mlx5e_attach_netdev() doesn't have a valid fs pointer +in its error flow. Make sure the pointer is nullified when released +and add a check in mlx5e_fs_cleanup() to verify fs is not null +as representor cleanup callback would be called anyway. + +Fixes: af8bbf730068 ("net/mlx5e: Convert mlx5e_flow_steering member of mlx5e_priv to pointer") +Signed-off-by: Roi Dayan +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 2 ++ + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 1 + + drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 ++ + 3 files changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +index 7cd36f4ac3efc..edbe22d93c992 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +@@ -1471,6 +1471,8 @@ struct mlx5e_flow_steering *mlx5e_fs_init(const struct mlx5e_profile *profile, + + void mlx5e_fs_cleanup(struct mlx5e_flow_steering *fs) + { ++ if (!fs) ++ return; + mlx5e_fs_ethtool_free(fs); + mlx5e_fs_tc_free(fs); + mlx5e_fs_vlan_free(fs); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 1f4233b2842f7..53eba076c53fc 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -5208,6 +5208,7 @@ static void mlx5e_nic_cleanup(struct mlx5e_priv *priv) + mlx5e_health_destroy_reporters(priv); + mlx5e_ktls_cleanup(priv); + mlx5e_fs_cleanup(priv->fs); ++ priv->fs = NULL; + } + + static int mlx5e_init_nic_rx(struct mlx5e_priv *priv) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index 301a734b7c6a7..21426decc4bde 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -822,6 +822,7 @@ static int mlx5e_init_ul_rep(struct mlx5_core_dev *mdev, + static void mlx5e_cleanup_rep(struct mlx5e_priv *priv) + { + mlx5e_fs_cleanup(priv->fs); ++ priv->fs = NULL; + } + + static int mlx5e_create_rep_ttc_table(struct mlx5e_priv *priv) +@@ -988,6 +989,7 @@ static int mlx5e_init_rep_rx(struct mlx5e_priv *priv) + priv->rx_res = NULL; + err_free_fs: + mlx5e_fs_cleanup(priv->fs); ++ priv->fs = NULL; + return err; + } + +-- +2.39.2 + diff --git a/queue-6.2/net-mlx5e-nullify-table-pointer-when-failing-to-crea.patch b/queue-6.2/net-mlx5e-nullify-table-pointer-when-failing-to-crea.patch new file mode 100644 index 00000000000..31c371c7fe7 --- /dev/null +++ b/queue-6.2/net-mlx5e-nullify-table-pointer-when-failing-to-crea.patch @@ -0,0 +1,51 @@ +From b7741e000bdb530c09434094a5b57fd13072090d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 16:37:36 +0200 +Subject: net/mlx5e: Nullify table pointer when failing to create + +From: Aya Levin + +[ Upstream commit 1b540decd03acd736693aabb6cb46c71fca38ae6 ] + +On failing to create promisc flow steering table, the pointer is +returned with an error. Nullify it so unloading the driver won't try to +destroy a non existing table. + +Failing to create promisc table may happen over BF devices when the ARM +side is going through a firmware tear down. The host side start a +reload flow. While the driver unloads, it tries to remove the promisc +table. Remove WARN in this state as it is a valid error flow. + +Fixes: 1c46d7409f30 ("net/mlx5e: Optimize promiscuous mode") +Signed-off-by: Aya Levin +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +index edbe22d93c992..eba601487eb79 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +@@ -776,6 +776,7 @@ static int mlx5e_create_promisc_table(struct mlx5e_flow_steering *fs) + ft->t = mlx5_create_auto_grouped_flow_table(fs->ns, &ft_attr); + if (IS_ERR(ft->t)) { + err = PTR_ERR(ft->t); ++ ft->t = NULL; + fs_err(fs, "fail to create promisc table err=%d\n", err); + return err; + } +@@ -803,7 +804,7 @@ static void mlx5e_del_promisc_rule(struct mlx5e_flow_steering *fs) + + static void mlx5e_destroy_promisc_table(struct mlx5e_flow_steering *fs) + { +- if (WARN(!fs->promisc.ft.t, "Trying to remove non-existing promiscuous table")) ++ if (!fs->promisc.ft.t) + return; + mlx5e_del_promisc_rule(fs); + mlx5_destroy_flow_table(fs->promisc.ft.t); +-- +2.39.2 + diff --git a/queue-6.2/net-packet-annotate-accesses-to-po-xmit.patch b/queue-6.2/net-packet-annotate-accesses-to-po-xmit.patch new file mode 100644 index 00000000000..bb35b92e7f8 --- /dev/null +++ b/queue-6.2/net-packet-annotate-accesses-to-po-xmit.patch @@ -0,0 +1,70 @@ +From ad253978c1814e1c62e1af79bb5b8078afb1115f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 01:10:06 +0000 +Subject: net/packet: annotate accesses to po->xmit + +From: Eric Dumazet + +[ Upstream commit b9d83ab8a708f23a4001d60e9d8d0b3be3d9f607 ] + +po->xmit can be set from setsockopt(PACKET_QDISC_BYPASS), +while read locklessly. + +Use READ_ONCE()/WRITE_ONCE() to avoid potential load/store +tearing issues. + +Fixes: d346a3fae3ff ("packet: introduce PACKET_QDISC_BYPASS socket option") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index b5ab98ca2511b..bc034de000fc4 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -307,7 +307,8 @@ static void packet_cached_dev_reset(struct packet_sock *po) + + static bool packet_use_direct_xmit(const struct packet_sock *po) + { +- return po->xmit == packet_direct_xmit; ++ /* Paired with WRITE_ONCE() in packet_setsockopt() */ ++ return READ_ONCE(po->xmit) == packet_direct_xmit; + } + + static u16 packet_pick_tx_queue(struct sk_buff *skb) +@@ -2867,7 +2868,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) + packet_inc_pending(&po->tx_ring); + + status = TP_STATUS_SEND_REQUEST; +- err = po->xmit(skb); ++ /* Paired with WRITE_ONCE() in packet_setsockopt() */ ++ err = READ_ONCE(po->xmit)(skb); + if (unlikely(err != 0)) { + if (err > 0) + err = net_xmit_errno(err); +@@ -3070,7 +3072,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) + virtio_net_hdr_set_proto(skb, &vnet_hdr); + } + +- err = po->xmit(skb); ++ /* Paired with WRITE_ONCE() in packet_setsockopt() */ ++ err = READ_ONCE(po->xmit)(skb); + if (unlikely(err != 0)) { + if (err > 0) + err = net_xmit_errno(err); +@@ -4007,7 +4010,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, + if (copy_from_sockptr(&val, optval, sizeof(val))) + return -EFAULT; + +- po->xmit = val ? packet_direct_xmit : dev_queue_xmit; ++ /* Paired with all lockless reads of po->xmit */ ++ WRITE_ONCE(po->xmit, val ? packet_direct_xmit : dev_queue_xmit); + return 0; + } + default: +-- +2.39.2 + diff --git a/queue-6.2/net-packet-convert-po-auxdata-to-an-atomic-flag.patch b/queue-6.2/net-packet-convert-po-auxdata-to-an-atomic-flag.patch new file mode 100644 index 00000000000..e9674efcf90 --- /dev/null +++ b/queue-6.2/net-packet-convert-po-auxdata-to-an-atomic-flag.patch @@ -0,0 +1,95 @@ +From 1ce9c6d24b62bd872870c52ef4548edb608159a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 01:10:08 +0000 +Subject: net/packet: convert po->auxdata to an atomic flag + +From: Eric Dumazet + +[ Upstream commit fd53c297aa7b077ae98a3d3d2d3aa278a1686ba6 ] + +po->auxdata can be read while another thread +is changing its value, potentially raising KCSAN splat. + +Convert it to PACKET_SOCK_AUXDATA flag. + +Fixes: 8dc419447415 ("[PACKET]: Add optional checksum computation for recvmsg") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 8 +++----- + net/packet/diag.c | 2 +- + net/packet/internal.h | 4 ++-- + 3 files changed, 6 insertions(+), 8 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 1cda640d84ffa..1259b34a28ebe 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3516,7 +3516,7 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len); + } + +- if (pkt_sk(sk)->auxdata) { ++ if (packet_sock_flag(pkt_sk(sk), PACKET_SOCK_AUXDATA)) { + struct tpacket_auxdata aux; + + aux.tp_status = TP_STATUS_USER; +@@ -3900,9 +3900,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, + if (copy_from_sockptr(&val, optval, sizeof(val))) + return -EFAULT; + +- lock_sock(sk); +- po->auxdata = !!val; +- release_sock(sk); ++ packet_sock_flag_set(po, PACKET_SOCK_AUXDATA, val); + return 0; + } + case PACKET_ORIGDEV: +@@ -4060,7 +4058,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, + + break; + case PACKET_AUXDATA: +- val = po->auxdata; ++ val = packet_sock_flag(po, PACKET_SOCK_AUXDATA); + break; + case PACKET_ORIGDEV: + val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV); +diff --git a/net/packet/diag.c b/net/packet/diag.c +index e1ac9bb375b31..d704c7bf51b20 100644 +--- a/net/packet/diag.c ++++ b/net/packet/diag.c +@@ -23,7 +23,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb) + pinfo.pdi_flags = 0; + if (po->running) + pinfo.pdi_flags |= PDI_RUNNING; +- if (po->auxdata) ++ if (packet_sock_flag(po, PACKET_SOCK_AUXDATA)) + pinfo.pdi_flags |= PDI_AUXDATA; + if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV)) + pinfo.pdi_flags |= PDI_ORIGDEV; +diff --git a/net/packet/internal.h b/net/packet/internal.h +index 178cd1852238d..3bae8ea7a36f5 100644 +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -118,8 +118,7 @@ struct packet_sock { + struct mutex pg_vec_lock; + unsigned long flags; + unsigned int running; /* bind_lock must be held */ +- unsigned int auxdata:1, /* writer must hold sock lock */ +- has_vnet_hdr:1, ++ unsigned int has_vnet_hdr:1, /* writer must hold sock lock */ + tp_loss:1, + tp_tx_has_off:1; + int pressure; +@@ -146,6 +145,7 @@ static inline struct packet_sock *pkt_sk(struct sock *sk) + + enum packet_sock_flags { + PACKET_SOCK_ORIGDEV, ++ PACKET_SOCK_AUXDATA, + }; + + static inline void packet_sock_flag_set(struct packet_sock *po, +-- +2.39.2 + diff --git a/queue-6.2/net-packet-convert-po-origdev-to-an-atomic-flag.patch b/queue-6.2/net-packet-convert-po-origdev-to-an-atomic-flag.patch new file mode 100644 index 00000000000..d3d4a260333 --- /dev/null +++ b/queue-6.2/net-packet-convert-po-origdev-to-an-atomic-flag.patch @@ -0,0 +1,126 @@ +From 2a4a56f2920933321dcaeb520f7429df8f8edad1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 01:10:07 +0000 +Subject: net/packet: convert po->origdev to an atomic flag + +From: Eric Dumazet + +[ Upstream commit ee5675ecdf7a4e713ed21d98a70c2871d6ebed01 ] + +syzbot/KCAN reported that po->origdev can be read +while another thread is changing its value. + +We can avoid this splat by converting this field +to an actual bit. + +Following patches will convert remaining 1bit fields. + +Fixes: 80feaacb8a64 ("[AF_PACKET]: Add option to return orig_dev to userspace.") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 10 ++++------ + net/packet/diag.c | 2 +- + net/packet/internal.h | 22 +++++++++++++++++++++- + 3 files changed, 26 insertions(+), 8 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index bc034de000fc4..1cda640d84ffa 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2186,7 +2186,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, + sll = &PACKET_SKB_CB(skb)->sa.ll; + sll->sll_hatype = dev->type; + sll->sll_pkttype = skb->pkt_type; +- if (unlikely(po->origdev)) ++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV))) + sll->sll_ifindex = orig_dev->ifindex; + else + sll->sll_ifindex = dev->ifindex; +@@ -2461,7 +2461,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + sll->sll_hatype = dev->type; + sll->sll_protocol = skb->protocol; + sll->sll_pkttype = skb->pkt_type; +- if (unlikely(po->origdev)) ++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV))) + sll->sll_ifindex = orig_dev->ifindex; + else + sll->sll_ifindex = dev->ifindex; +@@ -3914,9 +3914,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, + if (copy_from_sockptr(&val, optval, sizeof(val))) + return -EFAULT; + +- lock_sock(sk); +- po->origdev = !!val; +- release_sock(sk); ++ packet_sock_flag_set(po, PACKET_SOCK_ORIGDEV, val); + return 0; + } + case PACKET_VNET_HDR: +@@ -4065,7 +4063,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, + val = po->auxdata; + break; + case PACKET_ORIGDEV: +- val = po->origdev; ++ val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV); + break; + case PACKET_VNET_HDR: + val = po->has_vnet_hdr; +diff --git a/net/packet/diag.c b/net/packet/diag.c +index 07812ae5ca073..e1ac9bb375b31 100644 +--- a/net/packet/diag.c ++++ b/net/packet/diag.c +@@ -25,7 +25,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb) + pinfo.pdi_flags |= PDI_RUNNING; + if (po->auxdata) + pinfo.pdi_flags |= PDI_AUXDATA; +- if (po->origdev) ++ if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV)) + pinfo.pdi_flags |= PDI_ORIGDEV; + if (po->has_vnet_hdr) + pinfo.pdi_flags |= PDI_VNETHDR; +diff --git a/net/packet/internal.h b/net/packet/internal.h +index 48af35b1aed25..178cd1852238d 100644 +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -116,9 +116,9 @@ struct packet_sock { + int copy_thresh; + spinlock_t bind_lock; + struct mutex pg_vec_lock; ++ unsigned long flags; + unsigned int running; /* bind_lock must be held */ + unsigned int auxdata:1, /* writer must hold sock lock */ +- origdev:1, + has_vnet_hdr:1, + tp_loss:1, + tp_tx_has_off:1; +@@ -144,4 +144,24 @@ static inline struct packet_sock *pkt_sk(struct sock *sk) + return (struct packet_sock *)sk; + } + ++enum packet_sock_flags { ++ PACKET_SOCK_ORIGDEV, ++}; ++ ++static inline void packet_sock_flag_set(struct packet_sock *po, ++ enum packet_sock_flags flag, ++ bool val) ++{ ++ if (val) ++ set_bit(flag, &po->flags); ++ else ++ clear_bit(flag, &po->flags); ++} ++ ++static inline bool packet_sock_flag(const struct packet_sock *po, ++ enum packet_sock_flags flag) ++{ ++ return test_bit(flag, &po->flags); ++} ++ + #endif +-- +2.39.2 + diff --git a/queue-6.2/net-pcs-xpcs-remove-double-read-of-link-state-when-u.patch b/queue-6.2/net-pcs-xpcs-remove-double-read-of-link-state-when-u.patch new file mode 100644 index 00000000000..27438254596 --- /dev/null +++ b/queue-6.2/net-pcs-xpcs-remove-double-read-of-link-state-when-u.patch @@ -0,0 +1,68 @@ +From f9bccb0870feae97ee9d35d15bea763beb26cc2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 14:46:43 +0000 +Subject: net: pcs: xpcs: remove double-read of link state when using AN + +From: Russell King (Oracle) + +[ Upstream commit ef63461caf427a77a04620d74ba90035a712af9c ] + +Phylink does not want the current state of the link when reading the +PCS link state - it wants the latched state. Don't double-read the +MII status register. Phylink will re-read as necessary to capture +transient link-down events as of dbae3388ea9c ("net: phylink: Force +retrigger in case of latched link-fail indicator"). + +The above referenced commit is a dependency for this change, and thus +this change should not be backported to any kernel that does not +contain the above referenced commit. + +Fixes: fcb26bd2b6ca ("net: phy: Add Synopsys DesignWare XPCS MDIO module") +Signed-off-by: Russell King (Oracle) +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/pcs/pcs-xpcs.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/pcs/pcs-xpcs.c b/drivers/net/pcs/pcs-xpcs.c +index f6a038a1d51e4..c70b27c4c1d5e 100644 +--- a/drivers/net/pcs/pcs-xpcs.c ++++ b/drivers/net/pcs/pcs-xpcs.c +@@ -323,7 +323,7 @@ static int xpcs_read_fault_c73(struct dw_xpcs *xpcs, + return 0; + } + +-static int xpcs_read_link_c73(struct dw_xpcs *xpcs, bool an) ++static int xpcs_read_link_c73(struct dw_xpcs *xpcs) + { + bool link = true; + int ret; +@@ -335,15 +335,6 @@ static int xpcs_read_link_c73(struct dw_xpcs *xpcs, bool an) + if (!(ret & MDIO_STAT1_LSTATUS)) + link = false; + +- if (an) { +- ret = xpcs_read(xpcs, MDIO_MMD_AN, MDIO_STAT1); +- if (ret < 0) +- return ret; +- +- if (!(ret & MDIO_STAT1_LSTATUS)) +- link = false; +- } +- + return link; + } + +@@ -937,7 +928,7 @@ static int xpcs_get_state_c73(struct dw_xpcs *xpcs, + int ret; + + /* Link needs to be read first ... */ +- state->link = xpcs_read_link_c73(xpcs, state->an_enabled) > 0 ? 1 : 0; ++ state->link = xpcs_read_link_c73(xpcs) > 0 ? 1 : 0; + + /* ... and then we check the faults. */ + ret = xpcs_read_fault_c73(xpcs, state); +-- +2.39.2 + diff --git a/queue-6.2/net-qrtr-correct-types-of-trace-event-parameters.patch b/queue-6.2/net-qrtr-correct-types-of-trace-event-parameters.patch new file mode 100644 index 00000000000..cce14018d04 --- /dev/null +++ b/queue-6.2/net-qrtr-correct-types-of-trace-event-parameters.patch @@ -0,0 +1,108 @@ +From 1a01b03131c25c4c30dcc75fce2d895401b7d217 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 17:43:16 +0200 +Subject: net: qrtr: correct types of trace event parameters + +From: Simon Horman + +[ Upstream commit 054fbf7ff8143d35ca7d3bb5414bb44ee1574194 ] + +The arguments passed to the trace events are of type unsigned int, +however the signature of the events used __le32 parameters. + +I may be missing the point here, but sparse flagged this and it +does seem incorrect to me. + + net/qrtr/ns.c: note: in included file (through include/trace/trace_events.h, include/trace/define_trace.h, include/trace/events/qrtr.h): + ./include/trace/events/qrtr.h:11:1: warning: cast to restricted __le32 + ./include/trace/events/qrtr.h:11:1: warning: restricted __le32 degrades to integer + ./include/trace/events/qrtr.h:11:1: warning: restricted __le32 degrades to integer + ... (a lot more similar warnings) + net/qrtr/ns.c:115:47: expected restricted __le32 [usertype] service + net/qrtr/ns.c:115:47: got unsigned int service + net/qrtr/ns.c:115:61: warning: incorrect type in argument 2 (different base types) + ... (a lot more similar warnings) + +Fixes: dfddb54043f0 ("net: qrtr: Add tracepoint support") +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Simon Horman +Link: https://lore.kernel.org/r/20230402-qrtr-trace-types-v1-1-92ad55008dd3@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/trace/events/qrtr.h | 33 ++++++++++++++++++--------------- + 1 file changed, 18 insertions(+), 15 deletions(-) + +diff --git a/include/trace/events/qrtr.h b/include/trace/events/qrtr.h +index b1de14c3bb934..441132c67133f 100644 +--- a/include/trace/events/qrtr.h ++++ b/include/trace/events/qrtr.h +@@ -10,15 +10,16 @@ + + TRACE_EVENT(qrtr_ns_service_announce_new, + +- TP_PROTO(__le32 service, __le32 instance, __le32 node, __le32 port), ++ TP_PROTO(unsigned int service, unsigned int instance, ++ unsigned int node, unsigned int port), + + TP_ARGS(service, instance, node, port), + + TP_STRUCT__entry( +- __field(__le32, service) +- __field(__le32, instance) +- __field(__le32, node) +- __field(__le32, port) ++ __field(unsigned int, service) ++ __field(unsigned int, instance) ++ __field(unsigned int, node) ++ __field(unsigned int, port) + ), + + TP_fast_assign( +@@ -36,15 +37,16 @@ TRACE_EVENT(qrtr_ns_service_announce_new, + + TRACE_EVENT(qrtr_ns_service_announce_del, + +- TP_PROTO(__le32 service, __le32 instance, __le32 node, __le32 port), ++ TP_PROTO(unsigned int service, unsigned int instance, ++ unsigned int node, unsigned int port), + + TP_ARGS(service, instance, node, port), + + TP_STRUCT__entry( +- __field(__le32, service) +- __field(__le32, instance) +- __field(__le32, node) +- __field(__le32, port) ++ __field(unsigned int, service) ++ __field(unsigned int, instance) ++ __field(unsigned int, node) ++ __field(unsigned int, port) + ), + + TP_fast_assign( +@@ -62,15 +64,16 @@ TRACE_EVENT(qrtr_ns_service_announce_del, + + TRACE_EVENT(qrtr_ns_server_add, + +- TP_PROTO(__le32 service, __le32 instance, __le32 node, __le32 port), ++ TP_PROTO(unsigned int service, unsigned int instance, ++ unsigned int node, unsigned int port), + + TP_ARGS(service, instance, node, port), + + TP_STRUCT__entry( +- __field(__le32, service) +- __field(__le32, instance) +- __field(__le32, node) +- __field(__le32, port) ++ __field(unsigned int, service) ++ __field(unsigned int, instance) ++ __field(unsigned int, node) ++ __field(unsigned int, port) + ), + + TP_fast_assign( +-- +2.39.2 + diff --git a/queue-6.2/net-sched-sch_fq-fix-integer-overflow-of-credit.patch b/queue-6.2/net-sched-sch_fq-fix-integer-overflow-of-credit.patch new file mode 100644 index 00000000000..8181f6c3136 --- /dev/null +++ b/queue-6.2/net-sched-sch_fq-fix-integer-overflow-of-credit.patch @@ -0,0 +1,92 @@ +From 67952403ab1a8ef89eba142ee73f312189b96a63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 16:59:46 +0200 +Subject: net/sched: sch_fq: fix integer overflow of "credit" + +From: Davide Caratti + +[ Upstream commit 7041101ff6c3073fd8f2e99920f535b111c929cb ] + +if sch_fq is configured with "initial quantum" having values greater than +INT_MAX, the first assignment of "credit" does signed integer overflow to +a very negative value. +In this situation, the syzkaller script provided by Cristoph triggers the +CPU soft-lockup warning even with few sockets. It's not an infinite loop, +but "credit" wasn't probably meant to be minus 2Gb for each new flow. +Capping "initial quantum" to INT_MAX proved to fix the issue. + +v2: validation of "initial quantum" is done in fq_policy, instead of open + coding in fq_change() _ suggested by Jakub Kicinski + +Reported-by: Christoph Paasch +Link: https://github.com/multipath-tcp/mptcp_net-next/issues/377 +Fixes: afe4fd062416 ("pkt_sched: fq: Fair Queue packet scheduler") +Reviewed-by: Eric Dumazet +Signed-off-by: Davide Caratti +Link: https://lore.kernel.org/r/7b3a3c7e36d03068707a021760a194a8eb5ad41a.1682002300.git.dcaratti@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_fq.c | 6 ++++- + .../tc-testing/tc-tests/qdiscs/fq.json | 22 +++++++++++++++++++ + 2 files changed, 27 insertions(+), 1 deletion(-) + +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index 48d14fb90ba02..f59a2cb2c803d 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -779,13 +779,17 @@ static int fq_resize(struct Qdisc *sch, u32 log) + return 0; + } + ++static struct netlink_range_validation iq_range = { ++ .max = INT_MAX, ++}; ++ + static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = { + [TCA_FQ_UNSPEC] = { .strict_start_type = TCA_FQ_TIMER_SLACK }, + + [TCA_FQ_PLIMIT] = { .type = NLA_U32 }, + [TCA_FQ_FLOW_PLIMIT] = { .type = NLA_U32 }, + [TCA_FQ_QUANTUM] = { .type = NLA_U32 }, +- [TCA_FQ_INITIAL_QUANTUM] = { .type = NLA_U32 }, ++ [TCA_FQ_INITIAL_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &iq_range), + [TCA_FQ_RATE_ENABLE] = { .type = NLA_U32 }, + [TCA_FQ_FLOW_DEFAULT_RATE] = { .type = NLA_U32 }, + [TCA_FQ_FLOW_MAX_RATE] = { .type = NLA_U32 }, +diff --git a/tools/testing/selftests/tc-testing/tc-tests/qdiscs/fq.json b/tools/testing/selftests/tc-testing/tc-tests/qdiscs/fq.json +index 8acb904d14193..3593fb8f79ad3 100644 +--- a/tools/testing/selftests/tc-testing/tc-tests/qdiscs/fq.json ++++ b/tools/testing/selftests/tc-testing/tc-tests/qdiscs/fq.json +@@ -114,6 +114,28 @@ + "$IP link del dev $DUMMY type dummy" + ] + }, ++ { ++ "id": "10f7", ++ "name": "Create FQ with invalid initial_quantum setting", ++ "category": [ ++ "qdisc", ++ "fq" ++ ], ++ "plugins": { ++ "requires": "nsPlugin" ++ }, ++ "setup": [ ++ "$IP link add dev $DUMMY type dummy || /bin/true" ++ ], ++ "cmdUnderTest": "$TC qdisc add dev $DUMMY handle 1: root fq initial_quantum 0x80000000", ++ "expExitCode": "2", ++ "verifyCmd": "$TC qdisc show dev $DUMMY", ++ "matchPattern": "qdisc fq 1: root.*initial_quantum 2048Mb", ++ "matchCount": "0", ++ "teardown": [ ++ "$IP link del dev $DUMMY type dummy" ++ ] ++ }, + { + "id": "9398", + "name": "Create FQ with maxrate setting", +-- +2.39.2 + diff --git a/queue-6.2/net-stmmac-fix-system-hang-when-setting-up-tag_8021q.patch b/queue-6.2/net-stmmac-fix-system-hang-when-setting-up-tag_8021q.patch new file mode 100644 index 00000000000..0961acb0272 --- /dev/null +++ b/queue-6.2/net-stmmac-fix-system-hang-when-setting-up-tag_8021q.patch @@ -0,0 +1,77 @@ +From ad87aef082787b60ddb4e345573ecd369d3f6666 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 22:13:46 +0800 +Subject: net: stmmac:fix system hang when setting up tag_8021q VLAN for DSA + ports + +From: Yan Wang + +[ Upstream commit 35226750f7ab9d49140d95bc7d38a2a9b0f4fdfc ] + +The system hang because of dsa_tag_8021q_port_setup()-> + stmmac_vlan_rx_add_vid(). + +I found in stmmac_drv_probe() that cailing pm_runtime_put() +disabled the clock. + +First, when the kernel is compiled with CONFIG_PM=y,The stmmac's +resume/suspend is active. + +Secondly,stmmac as DSA master,the dsa_tag_8021q_port_setup() function +will callback stmmac_vlan_rx_add_vid when DSA dirver starts. However, +The system is hanged for the stmmac_vlan_rx_add_vid() accesses its +registers after stmmac's clock is closed. + +I would suggest adding the pm_runtime_resume_and_get() to the +stmmac_vlan_rx_add_vid().This guarantees that resuming clock output +while in use. + +Fixes: b3dcb3127786 ("net: stmmac: correct clocks enabled in stmmac_vlan_rx_kill_vid()") +Reviewed-by: Jacob Keller +Signed-off-by: Yan Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 014ce97f96b15..d0e64c1ab9a55 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -6348,6 +6348,10 @@ static int stmmac_vlan_rx_add_vid(struct net_device *ndev, __be16 proto, u16 vid + bool is_double = false; + int ret; + ++ ret = pm_runtime_resume_and_get(priv->device); ++ if (ret < 0) ++ return ret; ++ + if (be16_to_cpu(proto) == ETH_P_8021AD) + is_double = true; + +@@ -6355,16 +6359,18 @@ static int stmmac_vlan_rx_add_vid(struct net_device *ndev, __be16 proto, u16 vid + ret = stmmac_vlan_update(priv, is_double); + if (ret) { + clear_bit(vid, priv->active_vlans); +- return ret; ++ goto err_pm_put; + } + + if (priv->hw->num_vlan) { + ret = stmmac_add_hw_vlan_rx_fltr(priv, ndev, priv->hw, proto, vid); + if (ret) +- return ret; ++ goto err_pm_put; + } ++err_pm_put: ++ pm_runtime_put(priv->device); + +- return 0; ++ return ret; + } + + static int stmmac_vlan_rx_kill_vid(struct net_device *ndev, __be16 proto, u16 vid) +-- +2.39.2 + diff --git a/queue-6.2/net-sunhme-fix-uninitialized-return-code.patch b/queue-6.2/net-sunhme-fix-uninitialized-return-code.patch new file mode 100644 index 00000000000..b6fce10a20f --- /dev/null +++ b/queue-6.2/net-sunhme-fix-uninitialized-return-code.patch @@ -0,0 +1,39 @@ +From 8cc569ab1460eae08758b2309e3e564e68771fac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 13:51:27 -0400 +Subject: net: sunhme: Fix uninitialized return code + +From: Sean Anderson + +[ Upstream commit d61157414d0a591d10d27d0ce5873916614e5e31 ] + +Fix an uninitialized return code if we never found a qfe slot. It would be +a bug if we ever got into this situation, but it's good to return something +tracable. + +Fixes: acb3f35f920b ("sunhme: forward the error code from pci_enable_device()") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Sean Anderson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sun/sunhme.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c +index b0c7ab74a82ed..7cf8210ebbec3 100644 +--- a/drivers/net/ethernet/sun/sunhme.c ++++ b/drivers/net/ethernet/sun/sunhme.c +@@ -2834,7 +2834,7 @@ static int happy_meal_pci_probe(struct pci_dev *pdev, + int i, qfe_slot = -1; + char prom_name[64]; + u8 addr[ETH_ALEN]; +- int err; ++ int err = -ENODEV; + + /* Now make sure pci_dev cookie is there. */ + #ifdef CONFIG_SPARC +-- +2.39.2 + diff --git a/queue-6.2/netfilter-conntrack-fix-wrong-ct-timeout-value.patch b/queue-6.2/netfilter-conntrack-fix-wrong-ct-timeout-value.patch new file mode 100644 index 00000000000..b574bcccd40 --- /dev/null +++ b/queue-6.2/netfilter-conntrack-fix-wrong-ct-timeout-value.patch @@ -0,0 +1,116 @@ +From d08c7284f53a57434f4331425dfd9be084d76dca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 13:15:26 +0800 +Subject: netfilter: conntrack: fix wrong ct->timeout value + +From: Tzung-Bi Shih + +[ Upstream commit 73db1b8f2bb6725b7391e85aab41fdf592b3c0c1 ] + +(struct nf_conn)->timeout is an interval before the conntrack +confirmed. After confirmed, it becomes a timestamp. + +It is observed that timeout of an unconfirmed conntrack: +- Set by calling ctnetlink_change_timeout(). As a result, + `nfct_time_stamp` was wrongly added to `ct->timeout` twice. +- Get by calling ctnetlink_dump_timeout(). As a result, + `nfct_time_stamp` was wrongly subtracted. + +Call Trace: + + dump_stack_lvl + ctnetlink_dump_timeout + __ctnetlink_glue_build + ctnetlink_glue_build + __nfqnl_enqueue_packet + nf_queue + nf_hook_slow + ip_mc_output + ? __pfx_ip_finish_output + ip_send_skb + ? __pfx_dst_output + udp_send_skb + udp_sendmsg + ? __pfx_ip_generic_getfrag + sock_sendmsg + +Separate the 2 cases in: +- Setting `ct->timeout` in __nf_ct_set_timeout(). +- Getting `ct->timeout` in ctnetlink_dump_timeout(). + +Pablo appends: + +Update ctnetlink to set up the timeout _after_ the IPS_CONFIRMED flag is +set on, otherwise conntrack creation via ctnetlink breaks. + +Note that the problem described in this patch occurs since the +introduction of the nfnetlink_queue conntrack support, select a +sufficiently old Fixes: tag for -stable kernel to pick up this fix. + +Fixes: a4b4766c3ceb ("netfilter: nfnetlink_queue: rename related to nfqueue attaching conntrack info") +Signed-off-by: Tzung-Bi Shih +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_conntrack_core.h | 6 +++++- + net/netfilter/nf_conntrack_netlink.c | 13 +++++++++---- + 2 files changed, 14 insertions(+), 5 deletions(-) + +diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h +index 71d1269fe4d4f..3384859a89210 100644 +--- a/include/net/netfilter/nf_conntrack_core.h ++++ b/include/net/netfilter/nf_conntrack_core.h +@@ -89,7 +89,11 @@ static inline void __nf_ct_set_timeout(struct nf_conn *ct, u64 timeout) + { + if (timeout > INT_MAX) + timeout = INT_MAX; +- WRITE_ONCE(ct->timeout, nfct_time_stamp + (u32)timeout); ++ ++ if (nf_ct_is_confirmed(ct)) ++ WRITE_ONCE(ct->timeout, nfct_time_stamp + (u32)timeout); ++ else ++ ct->timeout = (u32)timeout; + } + + int __nf_ct_change_timeout(struct nf_conn *ct, u64 cta_timeout); +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index a68391e228f0e..cb4325b8ebb11 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -176,7 +176,12 @@ static int ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct) + static int ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct, + bool skip_zero) + { +- long timeout = nf_ct_expires(ct) / HZ; ++ long timeout; ++ ++ if (nf_ct_is_confirmed(ct)) ++ timeout = nf_ct_expires(ct) / HZ; ++ else ++ timeout = ct->timeout / HZ; + + if (skip_zero && timeout == 0) + return 0; +@@ -2253,9 +2258,6 @@ ctnetlink_create_conntrack(struct net *net, + if (!cda[CTA_TIMEOUT]) + goto err1; + +- timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ; +- __nf_ct_set_timeout(ct, timeout); +- + rcu_read_lock(); + if (cda[CTA_HELP]) { + char *helpname = NULL; +@@ -2319,6 +2321,9 @@ ctnetlink_create_conntrack(struct net *net, + /* we must add conntrack extensions before confirmation. */ + ct->status |= IPS_CONFIRMED; + ++ timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ; ++ __nf_ct_set_timeout(ct, timeout); ++ + if (cda[CTA_STATUS]) { + err = ctnetlink_change_status(ct, cda); + if (err < 0) +-- +2.39.2 + diff --git a/queue-6.2/netfilter-conntrack-restore-ips_confirmed-out-of-nf_.patch b/queue-6.2/netfilter-conntrack-restore-ips_confirmed-out-of-nf_.patch new file mode 100644 index 00000000000..3d3f865f3aa --- /dev/null +++ b/queue-6.2/netfilter-conntrack-restore-ips_confirmed-out-of-nf_.patch @@ -0,0 +1,75 @@ +From c2ee310f465d0b361531cdd09201627ad8688ae1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 23:31:26 +0200 +Subject: netfilter: conntrack: restore IPS_CONFIRMED out of + nf_conntrack_hash_check_insert() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pablo Neira Ayuso + +[ Upstream commit 2cdaa3eefed83082923cf219c8b6a314e622da74 ] + +e6d57e9ff0ae ("netfilter: conntrack: fix rmmod double-free race") +consolidates IPS_CONFIRMED bit set in nf_conntrack_hash_check_insert(). +However, this breaks ctnetlink: + + # conntrack -I -p tcp --timeout 123 --src 1.2.3.4 --dst 5.6.7.8 --state ESTABLISHED --sport 1 --dport 4 -u SEEN_REPLY + conntrack v1.4.6 (conntrack-tools): Operation failed: Device or resource busy + +This is a partial revert of the aforementioned commit to restore +IPS_CONFIRMED. + +Fixes: e6d57e9ff0ae ("netfilter: conntrack: fix rmmod double-free race") +Reported-by: Stéphane Graber +Tested-by: Stéphane Graber +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_bpf.c | 1 + + net/netfilter/nf_conntrack_core.c | 1 - + net/netfilter/nf_conntrack_netlink.c | 3 +++ + 3 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_bpf.c b/net/netfilter/nf_conntrack_bpf.c +index e1af14e3b63c5..24002bc61e07e 100644 +--- a/net/netfilter/nf_conntrack_bpf.c ++++ b/net/netfilter/nf_conntrack_bpf.c +@@ -381,6 +381,7 @@ struct nf_conn *bpf_ct_insert_entry(struct nf_conn___init *nfct_i) + struct nf_conn *nfct = (struct nf_conn *)nfct_i; + int err; + ++ nfct->status |= IPS_CONFIRMED; + err = nf_conntrack_hash_check_insert(nfct); + if (err < 0) { + nf_conntrack_free(nfct); +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 19e3afb23fdaf..cf731546e865b 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -934,7 +934,6 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct) + goto out; + } + +- ct->status |= IPS_CONFIRMED; + smp_wmb(); + /* The caller holds a reference to this object */ + refcount_set(&ct->ct_general.use, 2); +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index d095d3c1ceca6..a68391e228f0e 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -2316,6 +2316,9 @@ ctnetlink_create_conntrack(struct net *net, + nfct_seqadj_ext_add(ct); + nfct_synproxy_ext_add(ct); + ++ /* we must add conntrack extensions before confirmation. */ ++ ct->status |= IPS_CONFIRMED; ++ + if (cda[CTA_STATUS]) { + err = ctnetlink_change_status(ct, cda); + if (err < 0) +-- +2.39.2 + diff --git a/queue-6.2/netfilter-keep-conntrack-reference-until-ipsecv6-pol.patch b/queue-6.2/netfilter-keep-conntrack-reference-until-ipsecv6-pol.patch new file mode 100644 index 00000000000..d7803991b6e --- /dev/null +++ b/queue-6.2/netfilter-keep-conntrack-reference-until-ipsecv6-pol.patch @@ -0,0 +1,132 @@ +From 2f998938971d6d57d663818c51a521cf605ac273 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 21:28:44 +0530 +Subject: netfilter: keep conntrack reference until IPsecv6 policy checks are + done + +From: Madhu Koriginja + +[ Upstream commit b0e214d212030fe497d4d150bb3474e50ad5d093 ] + +Keep the conntrack reference until policy checks have been performed for +IPsec V6 NAT support, just like ipv4. + +The reference needs to be dropped before a packet is +queued to avoid having the conntrack module unloadable. + +Fixes: 58a317f1061c ("netfilter: ipv6: add IPv6 NAT support") +Signed-off-by: Madhu Koriginja +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/dccp/ipv6.c | 1 + + net/ipv6/ip6_input.c | 14 ++++++-------- + net/ipv6/raw.c | 5 ++--- + net/ipv6/tcp_ipv6.c | 2 ++ + net/ipv6/udp.c | 2 ++ + 5 files changed, 13 insertions(+), 11 deletions(-) + +diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c +index b9d7c3dd1cb39..c0fd8f5f3b94e 100644 +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -783,6 +783,7 @@ static int dccp_v6_rcv(struct sk_buff *skb) + + if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) + goto discard_and_relse; ++ nf_reset_ct(skb); + + return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4, + refcounted) ? -1 : 0; +diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c +index e1ebf5e42ebe9..d94041bb42872 100644 +--- a/net/ipv6/ip6_input.c ++++ b/net/ipv6/ip6_input.c +@@ -404,10 +404,6 @@ void ip6_protocol_deliver_rcu(struct net *net, struct sk_buff *skb, int nexthdr, + /* Only do this once for first final protocol */ + have_final = true; + +- /* Free reference early: we don't need it any more, +- and it may hold ip_conntrack module loaded +- indefinitely. */ +- nf_reset_ct(skb); + + skb_postpull_rcsum(skb, skb_network_header(skb), + skb_network_header_len(skb)); +@@ -430,10 +426,12 @@ void ip6_protocol_deliver_rcu(struct net *net, struct sk_buff *skb, int nexthdr, + goto discard; + } + } +- if (!(ipprot->flags & INET6_PROTO_NOPOLICY) && +- !xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) { +- SKB_DR_SET(reason, XFRM_POLICY); +- goto discard; ++ if (!(ipprot->flags & INET6_PROTO_NOPOLICY)) { ++ if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) { ++ SKB_DR_SET(reason, XFRM_POLICY); ++ goto discard; ++ } ++ nf_reset_ct(skb); + } + + ret = INDIRECT_CALL_2(ipprot->handler, tcp_v6_rcv, udpv6_rcv, +diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c +index 4fc511bdf176c..f44b99f7ecdcc 100644 +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -193,10 +193,8 @@ static bool ipv6_raw_deliver(struct sk_buff *skb, int nexthdr) + struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC); + + /* Not releasing hash table! */ +- if (clone) { +- nf_reset_ct(clone); ++ if (clone) + rawv6_rcv(sk, clone); +- } + } + } + rcu_read_unlock(); +@@ -387,6 +385,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb) + kfree_skb(skb); + return NET_RX_DROP; + } ++ nf_reset_ct(skb); + + if (!rp->checksum) + skb->ip_summed = CHECKSUM_UNNECESSARY; +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index a52a4f12f1467..e4da7267ed4bd 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1721,6 +1721,8 @@ INDIRECT_CALLABLE_SCOPE int tcp_v6_rcv(struct sk_buff *skb) + if (drop_reason) + goto discard_and_relse; + ++ nf_reset_ct(skb); ++ + if (tcp_filter(sk, skb)) { + drop_reason = SKB_DROP_REASON_SOCKET_FILTER; + goto discard_and_relse; +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index a675acfb901d1..c519f21632656 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -704,6 +704,7 @@ static int udpv6_queue_rcv_one_skb(struct sock *sk, struct sk_buff *skb) + drop_reason = SKB_DROP_REASON_XFRM_POLICY; + goto drop; + } ++ nf_reset_ct(skb); + + if (static_branch_unlikely(&udpv6_encap_needed_key) && up->encap_type) { + int (*encap_rcv)(struct sock *sk, struct sk_buff *skb); +@@ -1027,6 +1028,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + + if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) + goto discard; ++ nf_reset_ct(skb); + + if (udp_lib_checksum_complete(skb)) + goto csum_error; +-- +2.39.2 + diff --git a/queue-6.2/netfilter-nf_tables-don-t-write-table-validation-sta.patch b/queue-6.2/netfilter-nf_tables-don-t-write-table-validation-sta.patch new file mode 100644 index 00000000000..2066c98bbd5 --- /dev/null +++ b/queue-6.2/netfilter-nf_tables-don-t-write-table-validation-sta.patch @@ -0,0 +1,87 @@ +From bd31cadf1b510aa2b0ad75194cccfc4992c54a12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 17:13:19 +0200 +Subject: netfilter: nf_tables: don't write table validation state without + mutex + +From: Florian Westphal + +[ Upstream commit 9a32e9850686599ed194ccdceb6cd3dd56b2d9b9 ] + +The ->cleanup callback needs to be removed, this doesn't work anymore as +the transaction mutex is already released in the ->abort function. + +Just do it after a successful validation pass, this either happens +from commit or abort phases where transaction mutex is held. + +Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/nfnetlink.h | 1 - + net/netfilter/nf_tables_api.c | 8 ++------ + net/netfilter/nfnetlink.c | 2 -- + 3 files changed, 2 insertions(+), 9 deletions(-) + +diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h +index 241e005f290ad..e9a9ab34a7ccc 100644 +--- a/include/linux/netfilter/nfnetlink.h ++++ b/include/linux/netfilter/nfnetlink.h +@@ -45,7 +45,6 @@ struct nfnetlink_subsystem { + int (*commit)(struct net *net, struct sk_buff *skb); + int (*abort)(struct net *net, struct sk_buff *skb, + enum nfnl_abort_action action); +- void (*cleanup)(struct net *net); + bool (*valid_genid)(struct net *net, u32 genid); + }; + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index ce8a047ef8306..09057a58b121a 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -8571,6 +8571,8 @@ static int nf_tables_validate(struct net *net) + if (nft_table_validate(net, table) < 0) + return -EAGAIN; + } ++ ++ nft_validate_state_update(net, NFT_VALIDATE_SKIP); + break; + } + +@@ -9491,11 +9493,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) + return 0; + } + +-static void nf_tables_cleanup(struct net *net) +-{ +- nft_validate_state_update(net, NFT_VALIDATE_SKIP); +-} +- + static int nf_tables_abort(struct net *net, struct sk_buff *skb, + enum nfnl_abort_action action) + { +@@ -9529,7 +9526,6 @@ static const struct nfnetlink_subsystem nf_tables_subsys = { + .cb = nf_tables_cb, + .commit = nf_tables_commit, + .abort = nf_tables_abort, +- .cleanup = nf_tables_cleanup, + .valid_genid = nf_tables_valid_genid, + .owner = THIS_MODULE, + }; +diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c +index 81c7737c803a6..ae7146475d17a 100644 +--- a/net/netfilter/nfnetlink.c ++++ b/net/netfilter/nfnetlink.c +@@ -590,8 +590,6 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, + goto replay_abort; + } + } +- if (ss->cleanup) +- ss->cleanup(net); + + nfnl_err_deliver(&err_list, oskb); + kfree_skb(skb); +-- +2.39.2 + diff --git a/queue-6.2/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch b/queue-6.2/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch new file mode 100644 index 00000000000..a811947f6dd --- /dev/null +++ b/queue-6.2/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch @@ -0,0 +1,171 @@ +From b644c5e6d5b696776090de4ca14ba2e04307aa6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 11:52:55 -0700 +Subject: netlink: Use copy_to_user() for optval in netlink_getsockopt(). + +From: Kuniyuki Iwashima + +[ Upstream commit d913d32cc2707e9cd24fe6fa6d7d470e9c728980 ] + +Brad Spencer provided a detailed report [0] that when calling getsockopt() +for AF_NETLINK, some SOL_NETLINK options set only 1 byte even though such +options require at least sizeof(int) as length. + +The options return a flag value that fits into 1 byte, but such behaviour +confuses users who do not initialise the variable before calling +getsockopt() and do not strictly check the returned value as char. + +Currently, netlink_getsockopt() uses put_user() to copy data to optlen and +optval, but put_user() casts the data based on the pointer, char *optval. +As a result, only 1 byte is set to optval. + +To avoid this behaviour, we need to use copy_to_user() or cast optval for +put_user(). + +Note that this changes the behaviour on big-endian systems, but we document +that the size of optval is int in the man page. + + $ man 7 netlink + ... + Socket options + To set or get a netlink socket option, call getsockopt(2) to read + or setsockopt(2) to write the option with the option level argument + set to SOL_NETLINK. Unless otherwise noted, optval is a pointer to + an int. + +Fixes: 9a4595bc7e67 ("[NETLINK]: Add set/getsockopt options to support more than 32 groups") +Fixes: be0c22a46cfb ("netlink: add NETLINK_BROADCAST_ERROR socket option") +Fixes: 38938bfe3489 ("netlink: add NETLINK_NO_ENOBUFS socket flag") +Fixes: 0a6a3a23ea6e ("netlink: add NETLINK_CAP_ACK socket option") +Fixes: 2d4bc93368f5 ("netlink: extended ACK reporting") +Fixes: 89d35528d17d ("netlink: Add new socket option to enable strict checking on dumps") +Reported-by: Brad Spencer +Link: https://lore.kernel.org/netdev/ZD7VkNWFfp22kTDt@datsun.rim.net/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Johannes Berg +Link: https://lore.kernel.org/r/20230421185255.94606-1-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/netlink/af_netlink.c | 75 ++++++++++++---------------------------- + 1 file changed, 23 insertions(+), 52 deletions(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index f365dfdd672d7..9b6eb28e6e94f 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1742,7 +1742,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, + { + struct sock *sk = sock->sk; + struct netlink_sock *nlk = nlk_sk(sk); +- int len, val, err; ++ unsigned int flag; ++ int len, val; + + if (level != SOL_NETLINK) + return -ENOPROTOOPT; +@@ -1754,39 +1755,17 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, + + switch (optname) { + case NETLINK_PKTINFO: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_RECV_PKTINFO; + break; + case NETLINK_BROADCAST_ERROR: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_BROADCAST_SEND_ERROR; + break; + case NETLINK_NO_ENOBUFS: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_RECV_NO_ENOBUFS; + break; + case NETLINK_LIST_MEMBERSHIPS: { +- int pos, idx, shift; ++ int pos, idx, shift, err = 0; + +- err = 0; + netlink_lock_table(); + for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) { + if (len - pos < sizeof(u32)) +@@ -1803,40 +1782,32 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, + if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen)) + err = -EFAULT; + netlink_unlock_table(); +- break; ++ return err; + } + case NETLINK_CAP_ACK: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_CAP_ACK; + break; + case NETLINK_EXT_ACK: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_EXT_ACK ? 1 : 0; +- if (put_user(len, optlen) || put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_EXT_ACK; + break; + case NETLINK_GET_STRICT_CHK: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_STRICT_CHK ? 1 : 0; +- if (put_user(len, optlen) || put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_STRICT_CHK; + break; + default: +- err = -ENOPROTOOPT; ++ return -ENOPROTOOPT; + } +- return err; ++ ++ if (len < sizeof(int)) ++ return -EINVAL; ++ ++ len = sizeof(int); ++ val = nlk->flags & flag ? 1 : 0; ++ ++ if (put_user(len, optlen) || ++ copy_to_user(optval, &val, len)) ++ return -EFAULT; ++ ++ return 0; + } + + static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb) +-- +2.39.2 + diff --git a/queue-6.2/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch b/queue-6.2/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch new file mode 100644 index 00000000000..2203fb09dd1 --- /dev/null +++ b/queue-6.2/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch @@ -0,0 +1,45 @@ +From 1d5ba148931de6ee70dcdcfdfa540b910733141a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 18:45:53 -0400 +Subject: NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease + +From: Trond Myklebust + +[ Upstream commit 40882deb83c29d8df4470d4e5e7f137b6acf7ad1 ] + +The spec requires that we always at least send a RECLAIM_COMPLETE when +we're done establishing the lease and recovering any state. + +Fixes: fce5c838e133 ("nfs41: RECLAIM_COMPLETE functionality") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4state.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 2a0ca5c7f082a..660ccfaf463e4 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -67,6 +67,8 @@ + + #define OPENOWNER_POOL_SIZE 8 + ++static void nfs4_state_start_reclaim_reboot(struct nfs_client *clp); ++ + const nfs4_stateid zero_stateid = { + { .data = { 0 } }, + .type = NFS4_SPECIAL_STATEID_TYPE, +@@ -330,6 +332,8 @@ int nfs41_init_clientid(struct nfs_client *clp, const struct cred *cred) + status = nfs4_proc_create_session(clp, cred); + if (status != 0) + goto out; ++ if (!(clp->cl_exchange_flags & EXCHGID4_FLAG_CONFIRMED_R)) ++ nfs4_state_start_reclaim_reboot(clp); + nfs41_finish_session_reset(clp); + nfs_mark_client_ready(clp, NFS_CS_READY); + out: +-- +2.39.2 + diff --git a/queue-6.2/nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch b/queue-6.2/nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch new file mode 100644 index 00000000000..8b4b1c058d3 --- /dev/null +++ b/queue-6.2/nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch @@ -0,0 +1,206 @@ +From e4bc87119c04e3ecdaa988a29e9706e00a8ea636 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 16:49:04 +0800 +Subject: nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} + usage" + +From: Ming Lei + +[ Upstream commit 4f86a6ff6fbd891232dda3ca97fd1b9630b59809 ] + +fcloop_fcp_op() could be called from flush request's ->end_io(flush_end_io) in +which the spinlock of fq->mq_flush_lock is grabbed with irq saved/disabled. + +So fcloop_fcp_op() can't call spin_unlock_irq(&tfcp_req->reqlock) simply +which enables irq unconditionally. + +Fixes the warning by switching to spin_lock_irqsave()/spin_unlock_irqrestore() + +Fixes: c38dbbfab1bc ("nvme-fcloop: fix inconsistent lock state warnings") +Reported-by: Yi Zhang +Signed-off-by: Ming Lei +Reviewed-by: Ewan D. Milne +Tested-by: Yi Zhang +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fcloop.c | 48 ++++++++++++++++++++---------------- + 1 file changed, 27 insertions(+), 21 deletions(-) + +diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c +index 5c16372f3b533..c780af36c1d4a 100644 +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -614,10 +614,11 @@ fcloop_fcp_recv_work(struct work_struct *work) + struct fcloop_fcpreq *tfcp_req = + container_of(work, struct fcloop_fcpreq, fcp_rcv_work); + struct nvmefc_fcp_req *fcpreq = tfcp_req->fcpreq; ++ unsigned long flags; + int ret = 0; + bool aborted = false; + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + switch (tfcp_req->inistate) { + case INI_IO_START: + tfcp_req->inistate = INI_IO_ACTIVE; +@@ -626,11 +627,11 @@ fcloop_fcp_recv_work(struct work_struct *work) + aborted = true; + break; + default: +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + WARN_ON(1); + return; + } +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + if (unlikely(aborted)) + ret = -ECANCELED; +@@ -655,8 +656,9 @@ fcloop_fcp_abort_recv_work(struct work_struct *work) + container_of(work, struct fcloop_fcpreq, abort_rcv_work); + struct nvmefc_fcp_req *fcpreq; + bool completed = false; ++ unsigned long flags; + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + fcpreq = tfcp_req->fcpreq; + switch (tfcp_req->inistate) { + case INI_IO_ABORTED: +@@ -665,11 +667,11 @@ fcloop_fcp_abort_recv_work(struct work_struct *work) + completed = true; + break; + default: +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + WARN_ON(1); + return; + } +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + if (unlikely(completed)) { + /* remove reference taken in original abort downcall */ +@@ -681,9 +683,9 @@ fcloop_fcp_abort_recv_work(struct work_struct *work) + nvmet_fc_rcv_fcp_abort(tfcp_req->tport->targetport, + &tfcp_req->tgt_fcp_req); + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + tfcp_req->fcpreq = NULL; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + fcloop_call_host_done(fcpreq, tfcp_req, -ECANCELED); + /* call_host_done releases reference for abort downcall */ +@@ -699,11 +701,12 @@ fcloop_tgt_fcprqst_done_work(struct work_struct *work) + struct fcloop_fcpreq *tfcp_req = + container_of(work, struct fcloop_fcpreq, tio_done_work); + struct nvmefc_fcp_req *fcpreq; ++ unsigned long flags; + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + fcpreq = tfcp_req->fcpreq; + tfcp_req->inistate = INI_IO_COMPLETED; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + fcloop_call_host_done(fcpreq, tfcp_req, tfcp_req->status); + } +@@ -807,13 +810,14 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport, + u32 rsplen = 0, xfrlen = 0; + int fcp_err = 0, active, aborted; + u8 op = tgt_fcpreq->op; ++ unsigned long flags; + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + fcpreq = tfcp_req->fcpreq; + active = tfcp_req->active; + aborted = tfcp_req->aborted; + tfcp_req->active = true; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + if (unlikely(active)) + /* illegal - call while i/o active */ +@@ -821,9 +825,9 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport, + + if (unlikely(aborted)) { + /* target transport has aborted i/o prior */ +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + tfcp_req->active = false; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + tgt_fcpreq->transferred_length = 0; + tgt_fcpreq->fcp_error = -ECANCELED; + tgt_fcpreq->done(tgt_fcpreq); +@@ -880,9 +884,9 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport, + break; + } + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + tfcp_req->active = false; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + tgt_fcpreq->transferred_length = xfrlen; + tgt_fcpreq->fcp_error = fcp_err; +@@ -896,15 +900,16 @@ fcloop_tgt_fcp_abort(struct nvmet_fc_target_port *tgtport, + struct nvmefc_tgt_fcp_req *tgt_fcpreq) + { + struct fcloop_fcpreq *tfcp_req = tgt_fcp_req_to_fcpreq(tgt_fcpreq); ++ unsigned long flags; + + /* + * mark aborted only in case there were 2 threads in transport + * (one doing io, other doing abort) and only kills ops posted + * after the abort request + */ +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + tfcp_req->aborted = true; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + tfcp_req->status = NVME_SC_INTERNAL; + +@@ -946,6 +951,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, + struct fcloop_ini_fcpreq *inireq = fcpreq->private; + struct fcloop_fcpreq *tfcp_req; + bool abortio = true; ++ unsigned long flags; + + spin_lock(&inireq->inilock); + tfcp_req = inireq->tfcp_req; +@@ -958,7 +964,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, + return; + + /* break initiator/target relationship for io */ +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + switch (tfcp_req->inistate) { + case INI_IO_START: + case INI_IO_ACTIVE: +@@ -968,11 +974,11 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, + abortio = false; + break; + default: +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + WARN_ON(1); + return; + } +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + if (abortio) + /* leave the reference while the work item is scheduled */ +-- +2.39.2 + diff --git a/queue-6.2/nvme-fix-async-event-trace-event.patch b/queue-6.2/nvme-fix-async-event-trace-event.patch new file mode 100644 index 00000000000..d4dfd836616 --- /dev/null +++ b/queue-6.2/nvme-fix-async-event-trace-event.patch @@ -0,0 +1,92 @@ +From 0523406559b8d24e5dbe0b9f5d38dd9a016d72f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 14:57:20 -0700 +Subject: nvme: fix async event trace event + +From: Keith Busch + +[ Upstream commit 6622b76fe922b94189499a90ccdb714a4a8d0773 ] + +Mixing AER Event Type and Event Info has masking clashes. Just print the +event type, but also include the event info of the AER result in the +trace. + +Fixes: 09bd1ff4b15143b ("nvme-core: add async event trace helper") +Reported-by: Nate Thornton +Reviewed-by: Sagi Grimberg +Reviewed-by: Minwoo Im +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 5 +---- + drivers/nvme/host/trace.h | 15 ++++++--------- + 2 files changed, 7 insertions(+), 13 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index c0429f9f50920..d567762545b05 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4808,8 +4808,6 @@ static bool nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result) + u32 aer_notice_type = nvme_aer_subtype(result); + bool requeue = true; + +- trace_nvme_async_event(ctrl, aer_notice_type); +- + switch (aer_notice_type) { + case NVME_AER_NOTICE_NS_CHANGED: + set_bit(NVME_AER_NOTICE_NS_CHANGED, &ctrl->events); +@@ -4845,7 +4843,6 @@ static bool nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result) + + static void nvme_handle_aer_persistent_error(struct nvme_ctrl *ctrl) + { +- trace_nvme_async_event(ctrl, NVME_AER_ERROR); + dev_warn(ctrl->device, "resetting controller due to AER\n"); + nvme_reset_ctrl(ctrl); + } +@@ -4861,6 +4858,7 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status, + if (le16_to_cpu(status) >> 1 != NVME_SC_SUCCESS) + return; + ++ trace_nvme_async_event(ctrl, result); + switch (aer_type) { + case NVME_AER_NOTICE: + requeue = nvme_handle_aen_notice(ctrl, result); +@@ -4878,7 +4876,6 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status, + case NVME_AER_SMART: + case NVME_AER_CSS: + case NVME_AER_VS: +- trace_nvme_async_event(ctrl, aer_type); + ctrl->aen_result = result; + break; + default: +diff --git a/drivers/nvme/host/trace.h b/drivers/nvme/host/trace.h +index 6f0eaf6a15282..4fb5922ffdac5 100644 +--- a/drivers/nvme/host/trace.h ++++ b/drivers/nvme/host/trace.h +@@ -127,15 +127,12 @@ TRACE_EVENT(nvme_async_event, + ), + TP_printk("nvme%d: NVME_AEN=%#08x [%s]", + __entry->ctrl_id, __entry->result, +- __print_symbolic(__entry->result, +- aer_name(NVME_AER_NOTICE_NS_CHANGED), +- aer_name(NVME_AER_NOTICE_ANA), +- aer_name(NVME_AER_NOTICE_FW_ACT_STARTING), +- aer_name(NVME_AER_NOTICE_DISC_CHANGED), +- aer_name(NVME_AER_ERROR), +- aer_name(NVME_AER_SMART), +- aer_name(NVME_AER_CSS), +- aer_name(NVME_AER_VS)) ++ __print_symbolic(__entry->result & 0x7, ++ aer_name(NVME_AER_ERROR), ++ aer_name(NVME_AER_SMART), ++ aer_name(NVME_AER_NOTICE), ++ aer_name(NVME_AER_CSS), ++ aer_name(NVME_AER_VS)) + ) + ); + +-- +2.39.2 + diff --git a/queue-6.2/nvmet-fix-error-handling-in-nvmet_execute_identify_c.patch b/queue-6.2/nvmet-fix-error-handling-in-nvmet_execute_identify_c.patch new file mode 100644 index 00000000000..e76f1a7759c --- /dev/null +++ b/queue-6.2/nvmet-fix-error-handling-in-nvmet_execute_identify_c.patch @@ -0,0 +1,86 @@ +From 7d8a220de6eca6ed37ae2ba2c00e200b7f385bf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 15:20:36 +0900 +Subject: nvmet: fix error handling in nvmet_execute_identify_cns_cs_ns() + +From: Damien Le Moal + +[ Upstream commit ab76e7206b672b2e8818cb121a04506956d6b223 ] + +Nvme specifications state that: + +If the I/O Command Set associated with the namespace identified by the +NSID field does not support the Identify Namespace data structure +specified by the CSI field, the controller shall abort the command with +a status code of Invalid Field in Command. + +In other words, if nvmet_execute_identify_cns_cs_ns() is called for a +target with a block device that is not zoned, we should not return any +data and set the status to NVME_SC_INVALID_FIELD. + +While at it, it is also better to revalidate the ns block devie *before* +checking if the block device is zoned, to ensure that +nvmet_execute_identify_cns_cs_ns() operates against updated device +characteristics. + +Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support") +Signed-off-by: Damien Le Moal +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/zns.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c +index 1254cf57e008d..017c13f8bef14 100644 +--- a/drivers/nvme/target/zns.c ++++ b/drivers/nvme/target/zns.c +@@ -97,7 +97,7 @@ void nvmet_execute_identify_cns_cs_ctrl(struct nvmet_req *req) + + void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req) + { +- struct nvme_id_ns_zns *id_zns; ++ struct nvme_id_ns_zns *id_zns = NULL; + u64 zsze; + u16 status; + u32 mar, mor; +@@ -118,16 +118,18 @@ void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req) + if (status) + goto done; + +- if (!bdev_is_zoned(req->ns->bdev)) { +- req->error_loc = offsetof(struct nvme_identify, nsid); +- goto done; +- } +- + if (nvmet_ns_revalidate(req->ns)) { + mutex_lock(&req->ns->subsys->lock); + nvmet_ns_changed(req->ns->subsys, req->ns->nsid); + mutex_unlock(&req->ns->subsys->lock); + } ++ ++ if (!bdev_is_zoned(req->ns->bdev)) { ++ status = NVME_SC_INVALID_FIELD | NVME_SC_DNR; ++ req->error_loc = offsetof(struct nvme_identify, nsid); ++ goto out; ++ } ++ + zsze = (bdev_zone_sectors(req->ns->bdev) << 9) >> + req->ns->blksize_shift; + id_zns->lbafe[0].zsze = cpu_to_le64(zsze); +@@ -148,8 +150,8 @@ void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req) + + done: + status = nvmet_copy_to_sgl(req, 0, id_zns, sizeof(*id_zns)); +- kfree(id_zns); + out: ++ kfree(id_zns); + nvmet_req_complete(req, status); + } + +-- +2.39.2 + diff --git a/queue-6.2/nvmet-fix-i-o-command-set-specific-identify-controll.patch b/queue-6.2/nvmet-fix-i-o-command-set-specific-identify-controll.patch new file mode 100644 index 00000000000..0df421dab9b --- /dev/null +++ b/queue-6.2/nvmet-fix-i-o-command-set-specific-identify-controll.patch @@ -0,0 +1,115 @@ +From cf4b0f6cc0778b21c5bc4546e3855a943058612b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 19:59:38 +0900 +Subject: nvmet: fix I/O Command Set specific Identify Controller + +From: Damien Le Moal + +[ Upstream commit a5a6ab0950b46ab1ef4a5c83c80234018b81b38a ] + +For an identify command with cns set to NVME_ID_CNS_CS_CTRL, the NVMe +2.0 specification states that: + +If the I/O Command Set specified by the CSI field does not have an +Identify Controller data structure, then the controller shall return +a zero filled data structure. If the host requests a data structure for +an I/O Command Set that the controller does not support, the controller +shall abort the command with a status code of Invalid Field in Command. + +However, the current implementation of this identify command in +nvmet_execute_identify() only handles the ZNS command set, returning an +error for the NVM command set, which is not compliant with the +specifications as we do support this command set. + +Fix this by: +1) Renaming nvmet_execute_identify_cns_cs_ctrl() to + nvmet_execute_identify_ctrl_zns() to continue handling the + ZNS command set as is. +2) Introduce a nvmet_execute_identify_ctrl_ns() helper to handle the + NVM command set, returning a zero filled nvme_id_ctrl_nvm data + structure. +3) Modify nvmet_execute_identify() to call these helpers based on + the csi specified, returning an error for unsupported command sets. + +Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support") +Signed-off-by: Damien Le Moal +Reviewed-by: Chaitanya Kulkarni +Tested-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/admin-cmd.c | 22 ++++++++++++++++------ + drivers/nvme/target/nvmet.h | 2 +- + drivers/nvme/target/zns.c | 2 +- + 3 files changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c +index 8c375cdaa63fc..29b73e6581d73 100644 +--- a/drivers/nvme/target/admin-cmd.c ++++ b/drivers/nvme/target/admin-cmd.c +@@ -685,6 +685,13 @@ static bool nvmet_handle_identify_desclist(struct nvmet_req *req) + } + } + ++static void nvmet_execute_identify_ctrl_nvm(struct nvmet_req *req) ++{ ++ /* Not supported: return zeroes */ ++ nvmet_req_complete(req, ++ nvmet_zero_sgl(req, 0, sizeof(struct nvme_id_ctrl_nvm))); ++} ++ + static void nvmet_execute_identify(struct nvmet_req *req) + { + if (!nvmet_check_transfer_len(req, NVME_IDENTIFY_DATA_SIZE)) +@@ -708,13 +715,16 @@ static void nvmet_execute_identify(struct nvmet_req *req) + nvmet_execute_identify_ctrl(req); + return; + case NVME_ID_CNS_CS_CTRL: +- if (IS_ENABLED(CONFIG_BLK_DEV_ZONED)) { +- switch (req->cmd->identify.csi) { +- case NVME_CSI_ZNS: +- return nvmet_execute_identify_cns_cs_ctrl(req); +- default: +- break; ++ switch (req->cmd->identify.csi) { ++ case NVME_CSI_NVM: ++ nvmet_execute_identify_ctrl_nvm(req); ++ return; ++ case NVME_CSI_ZNS: ++ if (IS_ENABLED(CONFIG_BLK_DEV_ZONED)) { ++ nvmet_execute_identify_ctrl_zns(req); ++ return; + } ++ break; + } + break; + case NVME_ID_CNS_NS_ACTIVE_LIST: +diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h +index 89bedfcd974c4..ed3786140965f 100644 +--- a/drivers/nvme/target/nvmet.h ++++ b/drivers/nvme/target/nvmet.h +@@ -581,7 +581,7 @@ bool nvmet_ns_revalidate(struct nvmet_ns *ns); + u16 blk_to_nvme_status(struct nvmet_req *req, blk_status_t blk_sts); + + bool nvmet_bdev_zns_enable(struct nvmet_ns *ns); +-void nvmet_execute_identify_cns_cs_ctrl(struct nvmet_req *req); ++void nvmet_execute_identify_ctrl_zns(struct nvmet_req *req); + void nvmet_execute_identify_cns_cs_ns(struct nvmet_req *req); + void nvmet_bdev_execute_zone_mgmt_recv(struct nvmet_req *req); + void nvmet_bdev_execute_zone_mgmt_send(struct nvmet_req *req); +diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c +index 017c13f8bef14..d93ee4ae19454 100644 +--- a/drivers/nvme/target/zns.c ++++ b/drivers/nvme/target/zns.c +@@ -70,7 +70,7 @@ bool nvmet_bdev_zns_enable(struct nvmet_ns *ns) + return true; + } + +-void nvmet_execute_identify_cns_cs_ctrl(struct nvmet_req *req) ++void nvmet_execute_identify_ctrl_zns(struct nvmet_req *req) + { + u8 zasl = req->sq->ctrl->subsys->zasl; + struct nvmet_ctrl *ctrl = req->sq->ctrl; +-- +2.39.2 + diff --git a/queue-6.2/nvmet-fix-identify-active-namespace-id-list-handling.patch b/queue-6.2/nvmet-fix-identify-active-namespace-id-list-handling.patch new file mode 100644 index 00000000000..b14e3fb1866 --- /dev/null +++ b/queue-6.2/nvmet-fix-identify-active-namespace-id-list-handling.patch @@ -0,0 +1,48 @@ +From 314ac4202d4ec8b3864f697d2bd9c57727777896 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 19:59:37 +0900 +Subject: nvmet: fix Identify Active Namespace ID list handling + +From: Damien Le Moal + +[ Upstream commit 97416f67d55fb8b866ff1815ca7ef26b6dfa6a5e ] + +The identify command with cns set to NVME_ID_CNS_NS_ACTIVE_LIST does +not depend on the command set. The execution of this command should +thus not look at the csi field specified in the command. Simplify +nvmet_execute_identify() to directly call +nvmet_execute_identify_nslist() without the csi switch-case. + +Fixes: ab5d0b38c047 ("nvmet: add Command Set Identifier support") +Signed-off-by: Damien Le Moal +Reviewed-by: Chaitanya Kulkarni +Tested-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/admin-cmd.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c +index 3d01d7fde33a9..8c375cdaa63fc 100644 +--- a/drivers/nvme/target/admin-cmd.c ++++ b/drivers/nvme/target/admin-cmd.c +@@ -718,13 +718,8 @@ static void nvmet_execute_identify(struct nvmet_req *req) + } + break; + case NVME_ID_CNS_NS_ACTIVE_LIST: +- switch (req->cmd->identify.csi) { +- case NVME_CSI_NVM: +- return nvmet_execute_identify_nslist(req); +- default: +- break; +- } +- break; ++ nvmet_execute_identify_nslist(req); ++ return; + case NVME_ID_CNS_NS_DESC_LIST: + if (nvmet_handle_identify_desclist(req) == true) + return; +-- +2.39.2 + diff --git a/queue-6.2/nvmet-fix-identify-controller-handling.patch b/queue-6.2/nvmet-fix-identify-controller-handling.patch new file mode 100644 index 00000000000..5fa6ecf7b91 --- /dev/null +++ b/queue-6.2/nvmet-fix-identify-controller-handling.patch @@ -0,0 +1,45 @@ +From 32dea32bcc6d97aaf6a7b56b473fb17618a5ead1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 19:59:36 +0900 +Subject: nvmet: fix Identify Controller handling + +From: Damien Le Moal + +[ Upstream commit 62904b3b333e7f3c0f879dc3513295eee5765c9f ] + +The identify command with cns set to NVME_ID_CNS_CTRL does not depend on +the command set. The execution of this command should thus not look at +the csi specified in the command. Simplify nvmet_execute_identify() to +directly call nvmet_execute_identify_ctrl() without the csi switch-case. + +Fixes: ab5d0b38c047 ("nvmet: add Command Set Identifier support") +Signed-off-by: Damien Le Moal +Reviewed-by: Chaitanya Kulkarni +Tested-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/admin-cmd.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c +index e9b4812930711..3d01d7fde33a9 100644 +--- a/drivers/nvme/target/admin-cmd.c ++++ b/drivers/nvme/target/admin-cmd.c +@@ -705,11 +705,8 @@ static void nvmet_execute_identify(struct nvmet_req *req) + } + break; + case NVME_ID_CNS_CTRL: +- switch (req->cmd->identify.csi) { +- case NVME_CSI_NVM: +- return nvmet_execute_identify_ctrl(req); +- } +- break; ++ nvmet_execute_identify_ctrl(req); ++ return; + case NVME_ID_CNS_CS_CTRL: + if (IS_ENABLED(CONFIG_BLK_DEV_ZONED)) { + switch (req->cmd->identify.csi) { +-- +2.39.2 + diff --git a/queue-6.2/nvmet-fix-identify-namespace-handling.patch b/queue-6.2/nvmet-fix-identify-namespace-handling.patch new file mode 100644 index 00000000000..fd5e7633c69 --- /dev/null +++ b/queue-6.2/nvmet-fix-identify-namespace-handling.patch @@ -0,0 +1,56 @@ +From 7b17c29dc6c5df22d1434ec3271094169cdd7854 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 19:59:35 +0900 +Subject: nvmet: fix Identify Namespace handling + +From: Damien Le Moal + +[ Upstream commit 8c098aa00118c35108f0c19bd3cdc45e11574948 ] + +The identify command with cns set to NVME_ID_CNS_NS does not directly +depend on the command set. The NVMe specifications is rather confusing +here as it appears that this command only applies to the NVM command +set. However, footnote 8 of Figure 273 in the NVMe 2.0 base +specifications clearly state that this command applies to NVM command +sets that support logical blocks, that is, NVM and ZNS. Both the NVM and +ZNS command set specifications also list this identify as mandatory. + +The command handling should thus not look at the csi field since it is +defined as unused for this command. Given that we do not support the +KV command set, simply remove the csi switch-case for that command +handling and call directly nvmet_execute_identify_ns() in +nvmet_execute_identify(). + +Fixes: ab5d0b38c047 ("nvmet: add Command Set Identifier support") +Signed-off-by: Damien Le Moal +Reviewed-by: Chaitanya Kulkarni +Tested-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/admin-cmd.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c +index 6a54ed6fb1214..e9b4812930711 100644 +--- a/drivers/nvme/target/admin-cmd.c ++++ b/drivers/nvme/target/admin-cmd.c +@@ -692,13 +692,8 @@ static void nvmet_execute_identify(struct nvmet_req *req) + + switch (req->cmd->identify.cns) { + case NVME_ID_CNS_NS: +- switch (req->cmd->identify.csi) { +- case NVME_CSI_NVM: +- return nvmet_execute_identify_ns(req); +- default: +- break; +- } +- break; ++ nvmet_execute_identify_ns(req); ++ return; + case NVME_ID_CNS_CS_NS: + if (IS_ENABLED(CONFIG_BLK_DEV_ZONED)) { + switch (req->cmd->identify.csi) { +-- +2.39.2 + diff --git a/queue-6.2/of-fix-modalias-string-generation.patch b/queue-6.2/of-fix-modalias-string-generation.patch new file mode 100644 index 00000000000..a3563fe011d --- /dev/null +++ b/queue-6.2/of-fix-modalias-string-generation.patch @@ -0,0 +1,80 @@ +From 307b5a565232e3a6c9b55dd339b80272e3e3ad42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 18:21:09 +0100 +Subject: of: Fix modalias string generation + +From: Miquel Raynal + +[ Upstream commit b19a4266c52de78496fe40f0b37580a3b762e67d ] + +The helper generating an OF based modalias (of_device_get_modalias()) +works fine, but due to the use of snprintf() internally it needs a +buffer one byte longer than what should be needed just for the entire +string (excluding the '\0'). Most users of this helper are sysfs hooks +providing the modalias string to users. They all provide a PAGE_SIZE +buffer which is way above the number of bytes required to fit the +modalias string and hence do not suffer from this issue. + +There is another user though, of_device_request_module(), which is only +called by drivers/usb/common/ulpi.c. This request module function is +faulty, but maybe because in most cases there is an alternative, ULPI +driver users have not noticed it. + +In this function, of_device_get_modalias() is called twice. The first +time without buffer just to get the number of bytes required by the +modalias string (excluding the null byte), and a second time, after +buffer allocation, to fill the buffer. The allocation asks for an +additional byte, in order to store the trailing '\0'. However, the +buffer *length* provided to of_device_get_modalias() excludes this extra +byte. The internal use of snprintf() with a length that is exactly the +number of bytes to be written has the effect of using the last available +byte to store a '\0', which then smashes the last character of the +modalias string. + +Provide the actual size of the buffer to of_device_get_modalias() to fix +this issue. + +Note: the "str[size - 1] = '\0';" line is not really needed as snprintf +will anyway end the string with a null byte, but there is a possibility +that this function might be called on a struct device_node without +compatible, in this case snprintf() would not be executed. So we keep it +just to avoid possible unbounded strings. + +Cc: Stephen Boyd +Cc: Peter Chen +Fixes: 9c829c097f2f ("of: device: Support loading a module with OF based modalias") +Signed-off-by: Miquel Raynal +Reviewed-by: Rob Herring +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230404172148.82422-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/of/device.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/of/device.c b/drivers/of/device.c +index c674a13c30558..877f50379fab5 100644 +--- a/drivers/of/device.c ++++ b/drivers/of/device.c +@@ -297,12 +297,15 @@ int of_device_request_module(struct device *dev) + if (size < 0) + return size; + +- str = kmalloc(size + 1, GFP_KERNEL); ++ /* Reserve an additional byte for the trailing '\0' */ ++ size++; ++ ++ str = kmalloc(size, GFP_KERNEL); + if (!str) + return -ENOMEM; + + of_device_get_modalias(dev, str, size); +- str[size] = '\0'; ++ str[size - 1] = '\0'; + ret = request_module(str); + kfree(str); + +-- +2.39.2 + diff --git a/queue-6.2/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch b/queue-6.2/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch new file mode 100644 index 00000000000..43b84c07dc6 --- /dev/null +++ b/queue-6.2/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch @@ -0,0 +1,56 @@ +From 84e9525940260d264ca2242a37d79dab9533ab5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Feb 2023 19:14:06 +0900 +Subject: openrisc: Properly store r31 to pt_regs on unhandled exceptions + +From: Stafford Horne + +[ Upstream commit 812489ac4dd91144a74ce65ecf232252a2e406fb ] + +In commit 91993c8c2ed5 ("openrisc: use shadow registers to save regs on +exception") the unhandled exception path was changed to do an early +store of r30 instead of r31. The entry code was not updated and r31 is +not getting stored to pt_regs. + +This patch updates the entry handler to store r31 instead of r30. We +also remove some misleading commented out store r30 and r31 +instructrions. + +I noticed this while working on adding floating point exception +handling, This issue probably would never impact anything since we kill +the process or Oops right away on unhandled exceptions. + +Fixes: 91993c8c2ed5 ("openrisc: use shadow registers to save regs on exception") +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/kernel/entry.S | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S +index 54a87bba35caa..a130c4dac48d3 100644 +--- a/arch/openrisc/kernel/entry.S ++++ b/arch/openrisc/kernel/entry.S +@@ -173,7 +173,6 @@ handler: ;\ + l.sw PT_GPR28(r1),r28 ;\ + l.sw PT_GPR29(r1),r29 ;\ + /* r30 already save */ ;\ +-/* l.sw PT_GPR30(r1),r30*/ ;\ + l.sw PT_GPR31(r1),r31 ;\ + TRACE_IRQS_OFF_ENTRY ;\ + /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\ +@@ -211,9 +210,8 @@ handler: ;\ + l.sw PT_GPR27(r1),r27 ;\ + l.sw PT_GPR28(r1),r28 ;\ + l.sw PT_GPR29(r1),r29 ;\ +- /* r31 already saved */ ;\ +- l.sw PT_GPR30(r1),r30 ;\ +-/* l.sw PT_GPR31(r1),r31 */ ;\ ++ /* r30 already saved */ ;\ ++ l.sw PT_GPR31(r1),r31 ;\ + /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\ + l.addi r30,r0,-1 ;\ + l.sw PT_ORIG_GPR11(r1),r30 ;\ +-- +2.39.2 + diff --git a/queue-6.2/pci-edr-clear-device-status-after-edr-error-recovery.patch b/queue-6.2/pci-edr-clear-device-status-after-edr-error-recovery.patch new file mode 100644 index 00000000000..2b9012c8232 --- /dev/null +++ b/queue-6.2/pci-edr-clear-device-status-after-edr-error-recovery.patch @@ -0,0 +1,56 @@ +From 5a371e3251ff923e22946a8e7c9ec9b8af52ee86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 16:54:49 -0700 +Subject: PCI/EDR: Clear Device Status after EDR error recovery + +From: Kuppuswamy Sathyanarayanan + +[ Upstream commit c441b1e03da6c680a3e12da59c554f454f2ccf5e ] + +During EDR recovery, the OS must clear error status of the port that +triggered DPC even if firmware retains control of DPC and AER (see the +implementation note in the PCI Firmware spec r3.3, sec 4.6.12). + +Prior to 068c29a248b6 ("PCI/ERR: Clear PCIe Device Status errors only if +OS owns AER"), the port Device Status was cleared in this path: + + edr_handle_event + dpc_process_error(dev) # "dev" triggered DPC + pcie_do_recovery(dev, dpc_reset_link) + dpc_reset_link # exit DPC + pcie_clear_device_status(dev) # clear Device Status + +After 068c29a248b6, pcie_do_recovery() no longer clears Device Status when +firmware controls AER, so the error bit remains set even after recovery. + +Per the "Downstream Port Containment configuration control" bit in the +returned _OSC Control Field (sec 4.5.1), the OS is allowed to clear error +status until it evaluates _OST, so clear Device Status in +edr_handle_event() if the error recovery was successful. + +[bhelgaas: commit log] +Fixes: 068c29a248b6 ("PCI/ERR: Clear PCIe Device Status errors only if OS owns AER") +Link: https://lore.kernel.org/r/20230315235449.1279209-1-sathyanarayanan.kuppuswamy@linux.intel.com +Reported-by: Tsaur Erwin +Signed-off-by: Kuppuswamy Sathyanarayanan +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/edr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/pcie/edr.c b/drivers/pci/pcie/edr.c +index a6b9b479b97ad..87734e4c3c204 100644 +--- a/drivers/pci/pcie/edr.c ++++ b/drivers/pci/pcie/edr.c +@@ -193,6 +193,7 @@ static void edr_handle_event(acpi_handle handle, u32 event, void *data) + */ + if (estate == PCI_ERS_RESULT_RECOVERED) { + pci_dbg(edev, "DPC port successfully recovered\n"); ++ pcie_clear_device_status(edev); + acpi_send_edr_status(pdev, edev, EDR_OST_SUCCESS); + } else { + pci_dbg(edev, "DPC port recovery failed\n"); +-- +2.39.2 + diff --git a/queue-6.2/pci-imx6-install-the-fault-handler-only-on-compatibl.patch b/queue-6.2/pci-imx6-install-the-fault-handler-only-on-compatibl.patch new file mode 100644 index 00000000000..4c7b3a09f02 --- /dev/null +++ b/queue-6.2/pci-imx6-install-the-fault-handler-only-on-compatibl.patch @@ -0,0 +1,78 @@ +From afe1bf386cd6f516087f50cb08e8f4ab918edfc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 17:56:31 +0100 +Subject: PCI: imx6: Install the fault handler only on compatible match + +From: H. Nikolaus Schaller + +[ Upstream commit 5f5ac460dfe7f4e11f99de9870f240e39189cf72 ] + +commit bb38919ec56e ("PCI: imx6: Add support for i.MX6 PCIe controller") +added a fault hook to this driver in the probe function. So it was only +installed if needed. + +commit bde4a5a00e76 ("PCI: imx6: Allow probe deferral by reset GPIO") +moved it from probe to driver init which installs the hook unconditionally +as soon as the driver is compiled into a kernel. + +When this driver is compiled as a module, the hook is not registered +until after the driver has been matched with a .compatible and +loaded. + +commit 415b6185c541 ("PCI: imx6: Fix config read timeout handling") +extended the fault handling code. + +commit 2d8ed461dbc9 ("PCI: imx6: Add support for i.MX8MQ") +added some protection for non-ARM architectures, but this does not +protect non-i.MX ARM architectures. + +Since fault handlers can be triggered on any architecture for different +reasons, there is no guarantee that they will be triggered only for the +assumed situation, leading to improper error handling (i.MX6-specific +imx6q_pcie_abort_handler) on foreign systems. + +I had seen strange L3 imprecise external abort messages several times on +OMAP4 and OMAP5 devices and couldn't make sense of them until I realized +they were related to this unused imx6q driver because I had +CONFIG_PCI_IMX6=y. + +Note that CONFIG_PCI_IMX6=y is useful for kernel binaries that are designed +to run on different ARM SoC and be differentiated only by device tree +binaries. So turning off CONFIG_PCI_IMX6 is not a solution. + +Therefore we check the compatible in the init function before registering +the fault handler. + +Link: https://lore.kernel.org/r/e1bcfc3078c82b53aa9b78077a89955abe4ea009.1678380991.git.hns@goldelico.com +Fixes: bde4a5a00e76 ("PCI: imx6: Allow probe deferral by reset GPIO") +Fixes: 415b6185c541 ("PCI: imx6: Fix config read timeout handling") +Fixes: 2d8ed461dbc9 ("PCI: imx6: Add support for i.MX8MQ") +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Richard Zhu +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-imx6.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c +index 1dde5c579edc8..47db2d20568ef 100644 +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -1402,6 +1402,13 @@ DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_SYNOPSYS, 0xabcd, + static int __init imx6_pcie_init(void) + { + #ifdef CONFIG_ARM ++ struct device_node *np; ++ ++ np = of_find_matching_node(NULL, imx6_pcie_of_match); ++ if (!np) ++ return -ENODEV; ++ of_node_put(np); ++ + /* + * Since probe() can be deferred we need to make sure that + * hook_fault_code is not called after __init memory is freed +-- +2.39.2 + diff --git a/queue-6.2/pci-pm-extend-d3hot-delay-for-nvidia-hda-controllers.patch b/queue-6.2/pci-pm-extend-d3hot-delay-for-nvidia-hda-controllers.patch new file mode 100644 index 00000000000..71386a4edce --- /dev/null +++ b/queue-6.2/pci-pm-extend-d3hot-delay-for-nvidia-hda-controllers.patch @@ -0,0 +1,65 @@ +From a07d60c50c1701b70990297f66eec2191f3d9a57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 13:40:42 -0600 +Subject: PCI/PM: Extend D3hot delay for NVIDIA HDA controllers + +From: Alex Williamson + +[ Upstream commit a5a6dd2624698b6e3045c3a1450874d8c790d5d9 ] + +Assignment of NVIDIA Ampere-based GPUs have seen a regression since the +below referenced commit, where the reduced D3hot transition delay appears +to introduce a small window where a D3hot->D0 transition followed by a bus +reset can wedge the device. The entire device is subsequently unavailable, +returning -1 on config space read and is unrecoverable without a host +reset. + +This has been observed with RTX A2000 and A5000 GPU and audio functions +assigned to a Windows VM, where shutdown of the VM places the devices in +D3hot prior to vfio-pci performing a bus reset when userspace releases the +devices. The issue has roughly a 2-3% chance of occurring per shutdown. + +Restoring the HDA controller d3hot_delay to the effective value before the +below commit has been shown to resolve the issue. NVIDIA confirms this +change should be safe for all of their HDA controllers. + +Fixes: 3e347969a577 ("PCI/PM: Reduce D3hot delay with usleep_range()") +Link: https://lore.kernel.org/r/20230413194042.605768-1-alex.williamson@redhat.com +Reported-by: Zhiyi Guo +Signed-off-by: Alex Williamson +Signed-off-by: Bjorn Helgaas +Reviewed-by: Tarun Gupta +Cc: Abhishek Sahu +Cc: Tarun Gupta +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 494fa46f57671..8d32a3834688f 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1939,6 +1939,19 @@ static void quirk_radeon_pm(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6741, quirk_radeon_pm); + ++/* ++ * NVIDIA Ampere-based HDA controllers can wedge the whole device if a bus ++ * reset is performed too soon after transition to D0, extend d3hot_delay ++ * to previous effective default for all NVIDIA HDA controllers. ++ */ ++static void quirk_nvidia_hda_pm(struct pci_dev *dev) ++{ ++ quirk_d3hot_delay(dev, 20); ++} ++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, ++ PCI_CLASS_MULTIMEDIA_HD_AUDIO, 8, ++ quirk_nvidia_hda_pm); ++ + /* + * Ryzen5/7 XHCI controllers fail upon resume from runtime suspend or s2idle. + * https://bugzilla.kernel.org/show_bug.cgi?id=205587 +-- +2.39.2 + diff --git a/queue-6.2/perf-amlogic-fix-config1-config2-parsing-issue.patch b/queue-6.2/perf-amlogic-fix-config1-config2-parsing-issue.patch new file mode 100644 index 00000000000..a3aa02b9af9 --- /dev/null +++ b/queue-6.2/perf-amlogic-fix-config1-config2-parsing-issue.patch @@ -0,0 +1,44 @@ +From d7fe2d9678ddeacfb8b1f3b523293afd8ec31c6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 19:54:01 +0800 +Subject: perf/amlogic: Fix config1/config2 parsing issue + +From: Jiucheng Xu + +[ Upstream commit c61e5720f23273269cc67ffb2908cf9831c8ca9d ] + +The 3th argument of for_each_set_bit is incorrect, fix them. + +Fixes: 2016e2113d35 ("perf/amlogic: Add support for Amlogic meson G12 SoC DDR PMU driver") +Signed-off-by: Jiucheng Xu +Link: https://lore.kernel.org/r/20230209115403.521868-1-jiucheng.xu@amlogic.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/amlogic/meson_ddr_pmu_core.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/perf/amlogic/meson_ddr_pmu_core.c b/drivers/perf/amlogic/meson_ddr_pmu_core.c +index b84346dbac2ce..0b24dee1ed3cf 100644 +--- a/drivers/perf/amlogic/meson_ddr_pmu_core.c ++++ b/drivers/perf/amlogic/meson_ddr_pmu_core.c +@@ -156,10 +156,14 @@ static int meson_ddr_perf_event_add(struct perf_event *event, int flags) + u64 config2 = event->attr.config2; + int i; + +- for_each_set_bit(i, (const unsigned long *)&config1, sizeof(config1)) ++ for_each_set_bit(i, ++ (const unsigned long *)&config1, ++ BITS_PER_TYPE(config1)) + meson_ddr_set_axi_filter(event, i); + +- for_each_set_bit(i, (const unsigned long *)&config2, sizeof(config2)) ++ for_each_set_bit(i, ++ (const unsigned long *)&config2, ++ BITS_PER_TYPE(config2)) + meson_ddr_set_axi_filter(event, i + 64); + + if (flags & PERF_EF_START) +-- +2.39.2 + diff --git a/queue-6.2/perf-arm-cmn-fix-port-detection-for-cmn-700.patch b/queue-6.2/perf-arm-cmn-fix-port-detection-for-cmn-700.patch new file mode 100644 index 00000000000..bb1f9a58094 --- /dev/null +++ b/queue-6.2/perf-arm-cmn-fix-port-detection-for-cmn-700.patch @@ -0,0 +1,130 @@ +From 5d89b36148d9c9594fb02d023bb7a8be48ed7d37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 11:29:40 +0100 +Subject: perf/arm-cmn: Fix port detection for CMN-700 + +From: Robin Murphy + +[ Upstream commit 2ad91e44e6b0c7ef1ed151b3bb2242a2144e6085 ] + +When the "extra device ports" configuration was first added, the +additional mxp_device_port_connect_info registers were added around the +existing mxp_mesh_port_connect_info registers. What I missed about +CMN-700 is that it shuffled them around to remove this discontinuity. +As such, tweak the definitions and factor out a helper for reading these +registers so we can deal with this discrepancy easily, which does at +least allow nicely tidying up the callsites. With this we can then also +do the nice thing and skip accesses completely rather than relying on +RES0 behaviour where we know the extra registers aren't defined. + +Fixes: 23760a014417 ("perf/arm-cmn: Add CMN-700 support") +Reported-by: Jing Zhang +Signed-off-by: Robin Murphy +Link: https://lore.kernel.org/r/71d129241d4d7923cde72a0e5b4c8d2f6084525f.1681295193.git.robin.murphy@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 57 ++++++++++++++++++++++-------------------- + 1 file changed, 30 insertions(+), 27 deletions(-) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index bc4b1d1ba8fa2..ff86075edca48 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -57,14 +57,12 @@ + #define CMN_INFO_REQ_VC_NUM GENMASK_ULL(1, 0) + + /* XPs also have some local topology info which has uses too */ +-#define CMN_MXP__CONNECT_INFO_P0 0x0008 +-#define CMN_MXP__CONNECT_INFO_P1 0x0010 +-#define CMN_MXP__CONNECT_INFO_P2 0x0028 +-#define CMN_MXP__CONNECT_INFO_P3 0x0030 +-#define CMN_MXP__CONNECT_INFO_P4 0x0038 +-#define CMN_MXP__CONNECT_INFO_P5 0x0040 ++#define CMN_MXP__CONNECT_INFO(p) (0x0008 + 8 * (p)) + #define CMN__CONNECT_INFO_DEVICE_TYPE GENMASK_ULL(4, 0) + ++#define CMN_MAX_PORTS 6 ++#define CI700_CONNECT_INFO_P2_5_OFFSET 0x10 ++ + /* PMU registers occupy the 3rd 4KB page of each node's region */ + #define CMN_PMU_OFFSET 0x2000 + +@@ -396,6 +394,25 @@ static struct arm_cmn_node *arm_cmn_node(const struct arm_cmn *cmn, + return NULL; + } + ++static u32 arm_cmn_device_connect_info(const struct arm_cmn *cmn, ++ const struct arm_cmn_node *xp, int port) ++{ ++ int offset = CMN_MXP__CONNECT_INFO(port); ++ ++ if (port >= 2) { ++ if (cmn->model & (CMN600 | CMN650)) ++ return 0; ++ /* ++ * CI-700 may have extra ports, but still has the ++ * mesh_port_connect_info registers in the way. ++ */ ++ if (cmn->model == CI700) ++ offset += CI700_CONNECT_INFO_P2_5_OFFSET; ++ } ++ ++ return readl_relaxed(xp->pmu_base - CMN_PMU_OFFSET + offset); ++} ++ + static struct dentry *arm_cmn_debugfs; + + #ifdef CONFIG_DEBUG_FS +@@ -469,7 +486,7 @@ static int arm_cmn_map_show(struct seq_file *s, void *data) + y = cmn->mesh_y; + while (y--) { + int xp_base = cmn->mesh_x * y; +- u8 port[6][CMN_MAX_DIMENSION]; ++ u8 port[CMN_MAX_PORTS][CMN_MAX_DIMENSION]; + + for (x = 0; x < cmn->mesh_x; x++) + seq_puts(s, "--------+"); +@@ -477,14 +494,9 @@ static int arm_cmn_map_show(struct seq_file *s, void *data) + seq_printf(s, "\n%d |", y); + for (x = 0; x < cmn->mesh_x; x++) { + struct arm_cmn_node *xp = cmn->xps + xp_base + x; +- void __iomem *base = xp->pmu_base - CMN_PMU_OFFSET; +- +- port[0][x] = readl_relaxed(base + CMN_MXP__CONNECT_INFO_P0); +- port[1][x] = readl_relaxed(base + CMN_MXP__CONNECT_INFO_P1); +- port[2][x] = readl_relaxed(base + CMN_MXP__CONNECT_INFO_P2); +- port[3][x] = readl_relaxed(base + CMN_MXP__CONNECT_INFO_P3); +- port[4][x] = readl_relaxed(base + CMN_MXP__CONNECT_INFO_P4); +- port[5][x] = readl_relaxed(base + CMN_MXP__CONNECT_INFO_P5); ++ ++ for (p = 0; p < CMN_MAX_PORTS; p++) ++ port[p][x] = arm_cmn_device_connect_info(cmn, xp, p); + seq_printf(s, " XP #%-2d |", xp_base + x); + } + +@@ -2082,18 +2094,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) + * from this, since in that case we will see at least one XP + * with port 2 connected, for the HN-D. + */ +- if (readq_relaxed(xp_region + CMN_MXP__CONNECT_INFO_P0)) +- xp_ports |= BIT(0); +- if (readq_relaxed(xp_region + CMN_MXP__CONNECT_INFO_P1)) +- xp_ports |= BIT(1); +- if (readq_relaxed(xp_region + CMN_MXP__CONNECT_INFO_P2)) +- xp_ports |= BIT(2); +- if (readq_relaxed(xp_region + CMN_MXP__CONNECT_INFO_P3)) +- xp_ports |= BIT(3); +- if (readq_relaxed(xp_region + CMN_MXP__CONNECT_INFO_P4)) +- xp_ports |= BIT(4); +- if (readq_relaxed(xp_region + CMN_MXP__CONNECT_INFO_P5)) +- xp_ports |= BIT(5); ++ for (int p = 0; p < CMN_MAX_PORTS; p++) ++ if (arm_cmn_device_connect_info(cmn, xp, p)) ++ xp_ports |= BIT(p); + + if (cmn->multi_dtm && (xp_ports & 0xc)) + arm_cmn_init_dtm(dtm++, xp, 1); +-- +2.39.2 + diff --git a/queue-6.2/perf-arm-cmn-move-overlapping-wp_combine-field.patch b/queue-6.2/perf-arm-cmn-move-overlapping-wp_combine-field.patch new file mode 100644 index 00000000000..a06d38161f7 --- /dev/null +++ b/queue-6.2/perf-arm-cmn-move-overlapping-wp_combine-field.patch @@ -0,0 +1,37 @@ +From b0e2970950f751276672402f5d64c8eab81c898c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 09:55:40 -0800 +Subject: perf/arm-cmn: Move overlapping wp_combine field + +From: Ilkka Koskinen + +[ Upstream commit f87e9114b5e590c2c6658ca21d7b714ca240bdd0 ] + +As eventid field was expanded to support new mesh versions, it started to +overlap with wp_combine field. Move wp_combine to fix the issue. + +Fixes: 23760a014417 ("perf/arm-cmn: Add CMN-700 support") +Signed-off-by: Ilkka Koskinen +Link: https://lore.kernel.org/r/20230301175540.19891-1-ilkka@os.amperecomputing.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index 1deb61b22bc76..bc4b1d1ba8fa2 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -166,7 +166,7 @@ + #define CMN_EVENT_BYNODEID(event) FIELD_GET(CMN_CONFIG_BYNODEID, (event)->attr.config) + #define CMN_EVENT_NODEID(event) FIELD_GET(CMN_CONFIG_NODEID, (event)->attr.config) + +-#define CMN_CONFIG_WP_COMBINE GENMASK_ULL(27, 24) ++#define CMN_CONFIG_WP_COMBINE GENMASK_ULL(30, 27) + #define CMN_CONFIG_WP_DEV_SEL GENMASK_ULL(50, 48) + #define CMN_CONFIG_WP_CHN_SEL GENMASK_ULL(55, 51) + /* Note that we don't yet support the tertiary match group on newer IPs */ +-- +2.39.2 + diff --git a/queue-6.2/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch b/queue-6.2/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch new file mode 100644 index 00000000000..90f2f9237d9 --- /dev/null +++ b/queue-6.2/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch @@ -0,0 +1,51 @@ +From fd26df12b93afd00ce660248957d38f14c0e6e12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 10:35:08 +0800 +Subject: perf/core: Fix hardlockup failure caused by perf throttle + +From: Yang Jihong + +[ Upstream commit 15def34e2635ab7e0e96f1bc32e1b69609f14942 ] + +commit e050e3f0a71bf ("perf: Fix broken interrupt rate throttling") +introduces a change in throttling threshold judgment. Before this, +compare hwc->interrupts and max_samples_per_tick, then increase +hwc->interrupts by 1, but this commit reverses order of these two +behaviors, causing the semantics of max_samples_per_tick to change. +In literal sense of "max_samples_per_tick", if hwc->interrupts == +max_samples_per_tick, it should not be throttled, therefore, the judgment +condition should be changed to "hwc->interrupts > max_samples_per_tick". + +In fact, this may cause the hardlockup to fail, The minimum value of +max_samples_per_tick may be 1, in this case, the return value of +__perf_event_account_interrupt function is 1. +As a result, nmi_watchdog gets throttled, which would stop PMU (Use x86 +architecture as an example, see x86_pmu_handle_irq). + +Fixes: e050e3f0a71b ("perf: Fix broken interrupt rate throttling") +Signed-off-by: Yang Jihong +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20230227023508.102230-1-yangjihong1@huawei.com +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index daecb8c9126b0..2290d67ade41d 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -9408,8 +9408,8 @@ __perf_event_account_interrupt(struct perf_event *event, int throttle) + hwc->interrupts = 1; + } else { + hwc->interrupts++; +- if (unlikely(throttle +- && hwc->interrupts >= max_samples_per_tick)) { ++ if (unlikely(throttle && ++ hwc->interrupts > max_samples_per_tick)) { + __this_cpu_inc(perf_throttled_count); + tick_dep_set_cpu(smp_processor_id(), TICK_DEP_BIT_PERF_EVENTS); + hwc->interrupts = MAX_INTERRUPTS; +-- +2.39.2 + diff --git a/queue-6.2/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch b/queue-6.2/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch new file mode 100644 index 00000000000..214773d9e70 --- /dev/null +++ b/queue-6.2/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch @@ -0,0 +1,47 @@ +From 03d27246c03e645e70f8e4d83ff38768cca92bd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Nov 2022 19:16:34 +0800 +Subject: phy: tegra: xusb: Add missing tegra_xusb_port_unregister for + usb2_port and ulpi_port + +From: Gaosheng Cui + +[ Upstream commit e024854048e733391b31fe5a398704b31b9af803 ] + +The tegra_xusb_port_unregister should be called when usb2_port +and ulpi_port map fails in tegra_xusb_add_usb2_port() or in +tegra_xusb_add_ulpi_port(), fix it. + +Fixes: 53d2a715c240 ("phy: Add Tegra XUSB pad controller support") +Signed-off-by: Gaosheng Cui +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20221129111634.1547747-1-cuigaosheng1@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/tegra/xusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index ff4b930879f3c..58eeda573b677 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -782,6 +782,7 @@ static int tegra_xusb_add_usb2_port(struct tegra_xusb_padctl *padctl, + usb2->base.lane = usb2->base.ops->map(&usb2->base); + if (IS_ERR(usb2->base.lane)) { + err = PTR_ERR(usb2->base.lane); ++ tegra_xusb_port_unregister(&usb2->base); + goto out; + } + +@@ -848,6 +849,7 @@ static int tegra_xusb_add_ulpi_port(struct tegra_xusb_padctl *padctl, + ulpi->base.lane = ulpi->base.ops->map(&ulpi->base); + if (IS_ERR(ulpi->base.lane)) { + err = PTR_ERR(ulpi->base.lane); ++ tegra_xusb_port_unregister(&ulpi->base); + goto out; + } + +-- +2.39.2 + diff --git a/queue-6.2/phy-ti-j721e-wiz-fix-unreachable-code-in-wiz_mode_se.patch b/queue-6.2/phy-ti-j721e-wiz-fix-unreachable-code-in-wiz_mode_se.patch new file mode 100644 index 00000000000..e36be51ed51 --- /dev/null +++ b/queue-6.2/phy-ti-j721e-wiz-fix-unreachable-code-in-wiz_mode_se.patch @@ -0,0 +1,53 @@ +From 756197d85768d55d9a410c9e5d789ee3bc3b266d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 15:15:52 +0530 +Subject: phy: ti: j721e-wiz: Fix unreachable code in wiz_mode_select() + +From: Siddharth Vadapalli + +[ Upstream commit 57c0e1362fdd57d0cea7ab1e583b58abf4bd8c2d ] + +In the wiz_mode_select() function, the configuration performed for +PHY_TYPE_USXGMII is unreachable. Fix it. + +Fixes: b64a85fb8f53 ("phy: ti: phy-j721e-wiz.c: Add usxgmii support in wiz driver") +Signed-off-by: Siddharth Vadapalli +Reviewed-by: Roger Quadros +Link: https://lore.kernel.org/r/20230403094552.929108-1-s-vadapalli@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-j721e-wiz.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/phy/ti/phy-j721e-wiz.c b/drivers/phy/ti/phy-j721e-wiz.c +index ddce5ef7711c6..c21b193fb5498 100644 +--- a/drivers/phy/ti/phy-j721e-wiz.c ++++ b/drivers/phy/ti/phy-j721e-wiz.c +@@ -430,18 +430,17 @@ static int wiz_mode_select(struct wiz *wiz) + int i; + + for (i = 0; i < num_lanes; i++) { +- if (wiz->lane_phy_type[i] == PHY_TYPE_DP) ++ if (wiz->lane_phy_type[i] == PHY_TYPE_DP) { + mode = LANE_MODE_GEN1; +- else if (wiz->lane_phy_type[i] == PHY_TYPE_QSGMII) ++ } else if (wiz->lane_phy_type[i] == PHY_TYPE_QSGMII) { + mode = LANE_MODE_GEN2; +- else +- continue; +- +- if (wiz->lane_phy_type[i] == PHY_TYPE_USXGMII) { ++ } else if (wiz->lane_phy_type[i] == PHY_TYPE_USXGMII) { + ret = regmap_field_write(wiz->p0_mac_src_sel[i], 0x3); + ret = regmap_field_write(wiz->p0_rxfclk_sel[i], 0x3); + ret = regmap_field_write(wiz->p0_refclk_sel[i], 0x3); + mode = LANE_MODE_GEN1; ++ } else { ++ continue; + } + + ret = regmap_field_write(wiz->p_standard_mode[i], mode); +-- +2.39.2 + diff --git a/queue-6.2/pinctrl-bcm2835.c-fix-race-condition-when-setting-gp.patch b/queue-6.2/pinctrl-bcm2835.c-fix-race-condition-when-setting-gp.patch new file mode 100644 index 00000000000..0bc763e0368 --- /dev/null +++ b/queue-6.2/pinctrl-bcm2835.c-fix-race-condition-when-setting-gp.patch @@ -0,0 +1,85 @@ +From 7c264fe5662a6f98ed03a5bb2b60cb212af79549 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 14:47:05 +0200 +Subject: pinctrl-bcm2835.c: fix race condition when setting gpio dir + +From: Hans Verkuil + +[ Upstream commit b7badd752de05312fdb1aeb388480f706d0c087f ] + +In the past setting the pin direction called pinctrl_gpio_direction() +which uses a mutex to serialize this. That was changed to set the +direction directly in the pin controller driver, but that lost the +serialization mechanism. Since the direction of multiple pins are in +the same register you can have a race condition, something that was +in fact observed with the cec-gpio driver. + +Add a new spinlock to serialize writing to the FSEL registers. + +Signed-off-by: Hans Verkuil +Fixes: 1a4541b68e25 ("pinctrl-bcm2835: don't call pinctrl_gpio_direction()") +Link: https://lore.kernel.org/r/4302b66b-ca20-0f19-d2aa-ee8661118863@xs4all.nl +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/bcm/pinctrl-bcm2835.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +index c7cdccdb4332a..0f1ab0829ffe6 100644 +--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c ++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +@@ -90,6 +90,8 @@ struct bcm2835_pinctrl { + struct pinctrl_gpio_range gpio_range; + + raw_spinlock_t irq_lock[BCM2835_NUM_BANKS]; ++ /* Protect FSEL registers */ ++ spinlock_t fsel_lock; + }; + + /* pins are just named GPIO0..GPIO53 */ +@@ -284,14 +286,19 @@ static inline void bcm2835_pinctrl_fsel_set( + struct bcm2835_pinctrl *pc, unsigned pin, + enum bcm2835_fsel fsel) + { +- u32 val = bcm2835_gpio_rd(pc, FSEL_REG(pin)); +- enum bcm2835_fsel cur = (val >> FSEL_SHIFT(pin)) & BCM2835_FSEL_MASK; ++ u32 val; ++ enum bcm2835_fsel cur; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&pc->fsel_lock, flags); ++ val = bcm2835_gpio_rd(pc, FSEL_REG(pin)); ++ cur = (val >> FSEL_SHIFT(pin)) & BCM2835_FSEL_MASK; + + dev_dbg(pc->dev, "read %08x (%u => %s)\n", val, pin, +- bcm2835_functions[cur]); ++ bcm2835_functions[cur]); + + if (cur == fsel) +- return; ++ goto unlock; + + if (cur != BCM2835_FSEL_GPIO_IN && fsel != BCM2835_FSEL_GPIO_IN) { + /* always transition through GPIO_IN */ +@@ -309,6 +316,9 @@ static inline void bcm2835_pinctrl_fsel_set( + dev_dbg(pc->dev, "write %08x (%u <= %s)\n", val, pin, + bcm2835_functions[fsel]); + bcm2835_gpio_wr(pc, FSEL_REG(pin), val); ++ ++unlock: ++ spin_unlock_irqrestore(&pc->fsel_lock, flags); + } + + static int bcm2835_gpio_direction_input(struct gpio_chip *chip, unsigned offset) +@@ -1248,6 +1258,7 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) + pc->gpio_chip = *pdata->gpio_chip; + pc->gpio_chip.parent = dev; + ++ spin_lock_init(&pc->fsel_lock); + for (i = 0; i < BCM2835_NUM_BANKS; i++) { + unsigned long events; + unsigned offset; +-- +2.39.2 + diff --git a/queue-6.2/pinctrl-ralink-reintroduce-ralink-rt2880-pinmux-comp.patch b/queue-6.2/pinctrl-ralink-reintroduce-ralink-rt2880-pinmux-comp.patch new file mode 100644 index 00000000000..ad84d016bd4 --- /dev/null +++ b/queue-6.2/pinctrl-ralink-reintroduce-ralink-rt2880-pinmux-comp.patch @@ -0,0 +1,92 @@ +From d0760323787dc43c66e0fe7a3445895c5329a7b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 00:29:51 +0300 +Subject: pinctrl: ralink: reintroduce ralink,rt2880-pinmux compatible string +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit 7c19147d9cfc0f9328049d2e278279150d7de9ca ] + +There have been stable releases with the ralink,rt2880-pinmux compatible +string included. Having it removed breaks the ABI. Reintroduce it. + +Fixes: e5981cd46183 ("pinctrl: ralink: add new compatible strings for each pinctrl subdriver") +Signed-off-by: Arınç ÜNAL +Reviewed-by: Sergio Paracuellos +Link: https://lore.kernel.org/r/20230317213011.13656-2-arinc.unal@arinc9.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/ralink/pinctrl-mt7620.c | 1 + + drivers/pinctrl/ralink/pinctrl-mt7621.c | 1 + + drivers/pinctrl/ralink/pinctrl-rt2880.c | 1 + + drivers/pinctrl/ralink/pinctrl-rt305x.c | 1 + + drivers/pinctrl/ralink/pinctrl-rt3883.c | 1 + + 5 files changed, 5 insertions(+) + +diff --git a/drivers/pinctrl/ralink/pinctrl-mt7620.c b/drivers/pinctrl/ralink/pinctrl-mt7620.c +index 22ff16eff02ff..929a1ace56aeb 100644 +--- a/drivers/pinctrl/ralink/pinctrl-mt7620.c ++++ b/drivers/pinctrl/ralink/pinctrl-mt7620.c +@@ -372,6 +372,7 @@ static int mt7620_pinctrl_probe(struct platform_device *pdev) + + static const struct of_device_id mt7620_pinctrl_match[] = { + { .compatible = "ralink,mt7620-pinctrl" }, ++ { .compatible = "ralink,rt2880-pinmux" }, + {} + }; + MODULE_DEVICE_TABLE(of, mt7620_pinctrl_match); +diff --git a/drivers/pinctrl/ralink/pinctrl-mt7621.c b/drivers/pinctrl/ralink/pinctrl-mt7621.c +index b47968f40e0c2..0297cf455b3a0 100644 +--- a/drivers/pinctrl/ralink/pinctrl-mt7621.c ++++ b/drivers/pinctrl/ralink/pinctrl-mt7621.c +@@ -97,6 +97,7 @@ static int mt7621_pinctrl_probe(struct platform_device *pdev) + + static const struct of_device_id mt7621_pinctrl_match[] = { + { .compatible = "ralink,mt7621-pinctrl" }, ++ { .compatible = "ralink,rt2880-pinmux" }, + {} + }; + MODULE_DEVICE_TABLE(of, mt7621_pinctrl_match); +diff --git a/drivers/pinctrl/ralink/pinctrl-rt2880.c b/drivers/pinctrl/ralink/pinctrl-rt2880.c +index 811e12df11331..fd9af7c2ffd0e 100644 +--- a/drivers/pinctrl/ralink/pinctrl-rt2880.c ++++ b/drivers/pinctrl/ralink/pinctrl-rt2880.c +@@ -41,6 +41,7 @@ static int rt2880_pinctrl_probe(struct platform_device *pdev) + + static const struct of_device_id rt2880_pinctrl_match[] = { + { .compatible = "ralink,rt2880-pinctrl" }, ++ { .compatible = "ralink,rt2880-pinmux" }, + {} + }; + MODULE_DEVICE_TABLE(of, rt2880_pinctrl_match); +diff --git a/drivers/pinctrl/ralink/pinctrl-rt305x.c b/drivers/pinctrl/ralink/pinctrl-rt305x.c +index 5b204b7ca1f3c..13a012a65d1d8 100644 +--- a/drivers/pinctrl/ralink/pinctrl-rt305x.c ++++ b/drivers/pinctrl/ralink/pinctrl-rt305x.c +@@ -118,6 +118,7 @@ static int rt305x_pinctrl_probe(struct platform_device *pdev) + + static const struct of_device_id rt305x_pinctrl_match[] = { + { .compatible = "ralink,rt305x-pinctrl" }, ++ { .compatible = "ralink,rt2880-pinmux" }, + {} + }; + MODULE_DEVICE_TABLE(of, rt305x_pinctrl_match); +diff --git a/drivers/pinctrl/ralink/pinctrl-rt3883.c b/drivers/pinctrl/ralink/pinctrl-rt3883.c +index 44a66c3d2d2a1..b263764011e76 100644 +--- a/drivers/pinctrl/ralink/pinctrl-rt3883.c ++++ b/drivers/pinctrl/ralink/pinctrl-rt3883.c +@@ -88,6 +88,7 @@ static int rt3883_pinctrl_probe(struct platform_device *pdev) + + static const struct of_device_id rt3883_pinctrl_match[] = { + { .compatible = "ralink,rt3883-pinctrl" }, ++ { .compatible = "ralink,rt2880-pinmux" }, + {} + }; + MODULE_DEVICE_TABLE(of, rt3883_pinctrl_match); +-- +2.39.2 + diff --git a/queue-6.2/pinctrl-renesas-r8a779a0-remove-incorrect-avb-01-pin.patch b/queue-6.2/pinctrl-renesas-r8a779a0-remove-incorrect-avb-01-pin.patch new file mode 100644 index 00000000000..5b27c10d300 --- /dev/null +++ b/queue-6.2/pinctrl-renesas-r8a779a0-remove-incorrect-avb-01-pin.patch @@ -0,0 +1,50 @@ +From b5315ee91a3c91cb32d7162e3238101db404828d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 14:10:31 +0100 +Subject: pinctrl: renesas: r8a779a0: Remove incorrect AVB[01] pinmux + configuration + +From: Hai Pham + +[ Upstream commit a145c9a8674ac8fbfa1595276e1b6cbfc5139038 ] + +AVB[01]_{MAGIC,MDC,MDIO,TXCREFCLK} are registered as both +PINMUX_SINGLE(fn) and PINMUX_IPSR_GPSR(fn) in the pinmux_data array. + +The latter are correct, hence remove the former. +Without this fix, the Ethernet PHY is not operational on the MDIO bus. + +Signed-off-by: Hai Pham +Signed-off-by: LUU HOAI +Fixes: 741a7370fc3b8b54 ("pinctrl: renesas: Initial R8A779A0 (V3U) PFC support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/6fd217b71e83ba9a8157513ed671a1fa218b23b6.1674824958.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779a0.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779a0.c b/drivers/pinctrl/renesas/pfc-r8a779a0.c +index 760c83a8740bd..6069869353bb4 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779a0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779a0.c +@@ -696,16 +696,8 @@ static const u16 pinmux_data[] = { + PINMUX_SINGLE(PCIE0_CLKREQ_N), + + PINMUX_SINGLE(AVB0_PHY_INT), +- PINMUX_SINGLE(AVB0_MAGIC), +- PINMUX_SINGLE(AVB0_MDC), +- PINMUX_SINGLE(AVB0_MDIO), +- PINMUX_SINGLE(AVB0_TXCREFCLK), + + PINMUX_SINGLE(AVB1_PHY_INT), +- PINMUX_SINGLE(AVB1_MAGIC), +- PINMUX_SINGLE(AVB1_MDC), +- PINMUX_SINGLE(AVB1_MDIO), +- PINMUX_SINGLE(AVB1_TXCREFCLK), + + PINMUX_SINGLE(AVB2_AVTP_PPS), + PINMUX_SINGLE(AVB2_AVTP_CAPTURE), +-- +2.39.2 + diff --git a/queue-6.2/pinctrl-renesas-r8a779f0-fix-tsn1_avtp_pps-pin-group.patch b/queue-6.2/pinctrl-renesas-r8a779f0-fix-tsn1_avtp_pps-pin-group.patch new file mode 100644 index 00000000000..48155710126 --- /dev/null +++ b/queue-6.2/pinctrl-renesas-r8a779f0-fix-tsn1_avtp_pps-pin-group.patch @@ -0,0 +1,37 @@ +From 5cce9633edb324125b6a975891d8bbc6911e608d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 14:11:59 +0100 +Subject: pinctrl: renesas: r8a779f0: Fix tsn1_avtp_pps pin group + +From: Phong Hoang + +[ Upstream commit 60003351e99167d8cfa7c161e95856efc016f381 ] + +Correct a typo mistake in the definition of the tsn1_avtp_pps pin group +mux. + +Signed-off-by: Phong Hoang +Fixes: babe298e9caaa3d7 ("pinctrl: renesas: r8a779f0: Add Ethernet pins, groups, and functions") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/45ea6e87b91c36fd0b9706cf58ff50a4d1a99c44.1674825039.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779f0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779f0.c b/drivers/pinctrl/renesas/pfc-r8a779f0.c +index 417c357f16b19..65c141ce909ac 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779f0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779f0.c +@@ -1213,7 +1213,7 @@ static const unsigned int tsn1_avtp_pps_pins[] = { + RCAR_GP_PIN(3, 13), + }; + static const unsigned int tsn1_avtp_pps_mux[] = { +- TSN0_AVTP_PPS_MARK, ++ TSN1_AVTP_PPS_MARK, + }; + static const unsigned int tsn1_avtp_capture_a_pins[] = { + /* TSN1_AVTP_CAPTURE_A */ +-- +2.39.2 + diff --git a/queue-6.2/pinctrl-renesas-r8a779g0-fix-erroroutc-function-name.patch b/queue-6.2/pinctrl-renesas-r8a779g0-fix-erroroutc-function-name.patch new file mode 100644 index 00000000000..49a62429dba --- /dev/null +++ b/queue-6.2/pinctrl-renesas-r8a779g0-fix-erroroutc-function-name.patch @@ -0,0 +1,574 @@ +From 3615d9821ce4ebc568c68814e3edeb17d270a6ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 14:18:39 +0100 +Subject: pinctrl: renesas: r8a779g0: Fix ERROROUTC function names +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 9da805344d2a2d27a32cc9271230055d8818e887 ] + +According to R-Car V4H Series User’s Manual: Hardware Rev. 0.54, the +ERROROUTC signal is active-low. Hence add the missing "_N" suffix to +the pin function's names. + +Resize column 2 of all IPxSR* definitions to accomodate the longer +names. + +Fixes: b811062e5fd0343c ("pinctrl: renesas: r8a779g0: Add missing ERROROUTC_A") +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/1774303989e7d61f08fa81f1c2fa1b394505645f.1669036423.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 502 ++++++++++++------------- + 1 file changed, 251 insertions(+), 251 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index af7cfe32b1ecc..43a63a21a6fb5 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -268,271 +268,271 @@ + #define GPSR8_0 F_(SCL0, IP0SR8_3_0) + + /* SR0 */ +-/* IP0SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR0_3_0 F_(0, 0) FM(ERROROUTC_B) FM(TCLK2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_7_4 F_(0, 0) FM(MSIOF3_SS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_11_8 F_(0, 0) FM(MSIOF3_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_15_12 FM(IRQ3) FM(MSIOF3_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_19_16 FM(IRQ2) FM(MSIOF3_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_23_20 FM(IRQ1) FM(MSIOF3_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_27_24 FM(IRQ0) FM(MSIOF3_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_31_28 FM(MSIOF5_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP1SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR0_3_0 FM(MSIOF5_SS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_7_4 FM(MSIOF5_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_11_8 FM(MSIOF5_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_15_12 FM(MSIOF5_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_19_16 FM(MSIOF5_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1) FM(IRQ2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_27_24 FM(MSIOF2_SS1) FM(HTX1) FM(TX1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_31_28 FM(MSIOF2_SYNC) FM(HRX1) FM(RX1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP2SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP2SR0_3_0 FM(MSIOF2_TXD) FM(HCTS1_N) FM(CTS1_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR0_7_4 FM(MSIOF2_SCK) FM(HRTS1_N) FM(RTS1_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR0_11_8 FM(MSIOF2_RXD) FM(HSCK1) FM(SCK1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++/* IP0SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP0SR0_3_0 F_(0, 0) FM(ERROROUTC_N_B) FM(TCLK2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_7_4 F_(0, 0) FM(MSIOF3_SS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_11_8 F_(0, 0) FM(MSIOF3_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_15_12 FM(IRQ3) FM(MSIOF3_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_19_16 FM(IRQ2) FM(MSIOF3_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_23_20 FM(IRQ1) FM(MSIOF3_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_27_24 FM(IRQ0) FM(MSIOF3_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_31_28 FM(MSIOF5_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP1SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP1SR0_3_0 FM(MSIOF5_SS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_7_4 FM(MSIOF5_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_11_8 FM(MSIOF5_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_15_12 FM(MSIOF5_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_19_16 FM(MSIOF5_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1) FM(IRQ2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_27_24 FM(MSIOF2_SS1) FM(HTX1) FM(TX1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_31_28 FM(MSIOF2_SYNC) FM(HRX1) FM(RX1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP2SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP2SR0_3_0 FM(MSIOF2_TXD) FM(HCTS1_N) FM(CTS1_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR0_7_4 FM(MSIOF2_SCK) FM(HRTS1_N) FM(RTS1_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR0_11_8 FM(MSIOF2_RXD) FM(HSCK1) FM(SCK1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR1 */ +-/* IP0SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR1_3_0 FM(MSIOF1_SS2) FM(HTX3_A) FM(TX3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_7_4 FM(MSIOF1_SS1) FM(HCTS3_N_A) FM(RX3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_11_8 FM(MSIOF1_SYNC) FM(HRTS3_N_A) FM(RTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_15_12 FM(MSIOF1_SCK) FM(HSCK3_A) FM(CTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_19_16 FM(MSIOF1_TXD) FM(HRX3_A) FM(SCK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_23_20 FM(MSIOF1_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_27_24 FM(MSIOF0_SS2) FM(HTX1_X) FM(TX1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_31_28 FM(MSIOF0_SS1) FM(HRX1_X) FM(RX1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP1SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR1_3_0 FM(MSIOF0_SYNC) FM(HCTS1_N_X) FM(CTS1_N_X) FM(CANFD5_TX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_7_4 FM(MSIOF0_TXD) FM(HRTS1_N_X) FM(RTS1_N_X) FM(CANFD5_RX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_11_8 FM(MSIOF0_SCK) FM(HSCK1_X) FM(SCK1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_15_12 FM(MSIOF0_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_19_16 FM(HTX0) FM(TX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_23_20 FM(HCTS0_N) FM(CTS0_N) FM(PWM8_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_27_24 FM(HRTS0_N) FM(RTS0_N) FM(PWM9_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_31_28 FM(HSCK0) FM(SCK0) FM(PWM0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP2SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP2SR1_3_0 FM(HRX0) FM(RX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_7_4 FM(SCIF_CLK) FM(IRQ4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_11_8 FM(SSI_SCK) FM(TCLK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_15_12 FM(SSI_WS) FM(TCLK4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_19_16 FM(SSI_SD) FM(IRQ0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_23_20 FM(AUDIO_CLKOUT) FM(IRQ1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_27_24 FM(AUDIO_CLKIN) FM(PWM3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_31_28 F_(0, 0) FM(TCLK2) FM(MSIOF4_SS1) FM(IRQ3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP3SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP3SR1_3_0 FM(HRX3) FM(SCK3_A) FM(MSIOF4_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_7_4 FM(HSCK3) FM(CTS3_N_A) FM(MSIOF4_SCK) FM(TPU0TO0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_11_8 FM(HRTS3_N) FM(RTS3_N_A) FM(MSIOF4_TXD) FM(TPU0TO1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_15_12 FM(HCTS3_N) FM(RX3_A) FM(MSIOF4_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_19_16 FM(HTX3) FM(TX3_A) FM(MSIOF4_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++/* IP0SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP0SR1_3_0 FM(MSIOF1_SS2) FM(HTX3_A) FM(TX3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_7_4 FM(MSIOF1_SS1) FM(HCTS3_N_A) FM(RX3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_11_8 FM(MSIOF1_SYNC) FM(HRTS3_N_A) FM(RTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_15_12 FM(MSIOF1_SCK) FM(HSCK3_A) FM(CTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_19_16 FM(MSIOF1_TXD) FM(HRX3_A) FM(SCK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_23_20 FM(MSIOF1_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_27_24 FM(MSIOF0_SS2) FM(HTX1_X) FM(TX1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_31_28 FM(MSIOF0_SS1) FM(HRX1_X) FM(RX1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP1SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP1SR1_3_0 FM(MSIOF0_SYNC) FM(HCTS1_N_X) FM(CTS1_N_X) FM(CANFD5_TX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_7_4 FM(MSIOF0_TXD) FM(HRTS1_N_X) FM(RTS1_N_X) FM(CANFD5_RX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_11_8 FM(MSIOF0_SCK) FM(HSCK1_X) FM(SCK1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_15_12 FM(MSIOF0_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_19_16 FM(HTX0) FM(TX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_23_20 FM(HCTS0_N) FM(CTS0_N) FM(PWM8_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_27_24 FM(HRTS0_N) FM(RTS0_N) FM(PWM9_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_31_28 FM(HSCK0) FM(SCK0) FM(PWM0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP2SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP2SR1_3_0 FM(HRX0) FM(RX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_7_4 FM(SCIF_CLK) FM(IRQ4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_11_8 FM(SSI_SCK) FM(TCLK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_15_12 FM(SSI_WS) FM(TCLK4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_19_16 FM(SSI_SD) FM(IRQ0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_23_20 FM(AUDIO_CLKOUT) FM(IRQ1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_27_24 FM(AUDIO_CLKIN) FM(PWM3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_31_28 F_(0, 0) FM(TCLK2) FM(MSIOF4_SS1) FM(IRQ3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP3SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP3SR1_3_0 FM(HRX3) FM(SCK3_A) FM(MSIOF4_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_7_4 FM(HSCK3) FM(CTS3_N_A) FM(MSIOF4_SCK) FM(TPU0TO0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_11_8 FM(HRTS3_N) FM(RTS3_N_A) FM(MSIOF4_TXD) FM(TPU0TO1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_15_12 FM(HCTS3_N) FM(RX3_A) FM(MSIOF4_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_19_16 FM(HTX3) FM(TX3_A) FM(MSIOF4_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR2 */ +-/* IP0SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR2_3_0 FM(FXR_TXDA) FM(CANFD1_TX) FM(TPU0TO2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_7_4 FM(FXR_TXENA_N) FM(CANFD1_RX) FM(TPU0TO3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_11_8 FM(RXDA_EXTFXR) FM(CANFD5_TX) FM(IRQ5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_15_12 FM(CLK_EXTFXR) FM(CANFD5_RX) FM(IRQ4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_19_16 FM(RXDB_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_23_20 FM(FXR_TXENB_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_27_24 FM(FXR_TXDB) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_31_28 FM(TPU0TO1) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP1SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR2_3_0 FM(TPU0TO0) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_7_4 FM(CAN_CLK) FM(FXR_TXENA_N_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_11_8 FM(CANFD0_TX) FM(FXR_TXENB_N_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_15_12 FM(CANFD0_RX) FM(STPWT_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_27_24 FM(CANFD3_TX) F_(0, 0) FM(PWM2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_31_28 FM(CANFD3_RX) F_(0, 0) FM(PWM3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP2SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP2SR2_3_0 FM(CANFD4_TX) F_(0, 0) FM(PWM4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR2_7_4 FM(CANFD4_RX) F_(0, 0) FM(PWM5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR2_11_8 FM(CANFD7_TX) F_(0, 0) FM(PWM6) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR2_15_12 FM(CANFD7_RX) F_(0, 0) FM(PWM7) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++/* IP0SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP0SR2_3_0 FM(FXR_TXDA) FM(CANFD1_TX) FM(TPU0TO2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_7_4 FM(FXR_TXENA_N) FM(CANFD1_RX) FM(TPU0TO3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_11_8 FM(RXDA_EXTFXR) FM(CANFD5_TX) FM(IRQ5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_15_12 FM(CLK_EXTFXR) FM(CANFD5_RX) FM(IRQ4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_19_16 FM(RXDB_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_23_20 FM(FXR_TXENB_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_27_24 FM(FXR_TXDB) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_31_28 FM(TPU0TO1) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP1SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP1SR2_3_0 FM(TPU0TO0) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_7_4 FM(CAN_CLK) FM(FXR_TXENA_N_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_11_8 FM(CANFD0_TX) FM(FXR_TXENB_N_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_15_12 FM(CANFD0_RX) FM(STPWT_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_27_24 FM(CANFD3_TX) F_(0, 0) FM(PWM2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_31_28 FM(CANFD3_RX) F_(0, 0) FM(PWM3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP2SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP2SR2_3_0 FM(CANFD4_TX) F_(0, 0) FM(PWM4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR2_7_4 FM(CANFD4_RX) F_(0, 0) FM(PWM5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR2_11_8 FM(CANFD7_TX) F_(0, 0) FM(PWM6) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR2_15_12 FM(CANFD7_RX) F_(0, 0) FM(PWM7) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR3 */ +-/* IP0SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR3_3_0 FM(MMC_SD_D1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR3_7_4 FM(MMC_SD_D0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR3_11_8 FM(MMC_SD_D2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR3_15_12 FM(MMC_SD_CLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR3_19_16 FM(MMC_DS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR3_23_20 FM(MMC_SD_D3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR3_27_24 FM(MMC_D5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR3_31_28 FM(MMC_D4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP1SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR3_3_0 FM(MMC_D7) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR3_7_4 FM(MMC_D6) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR3_11_8 FM(MMC_SD_CMD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR3_15_12 FM(SD_CD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR3_19_16 FM(SD_WP) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR3_23_20 FM(IPC_CLKIN) FM(IPC_CLKEN_IN) FM(PWM1_A) FM(TCLK3_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR3_27_24 FM(IPC_CLKOUT) FM(IPC_CLKEN_OUT) FM(ERROROUTC_A) FM(TCLK4_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR3_31_28 FM(QSPI0_SSL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP2SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP2SR3_3_0 FM(QSPI0_IO3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR3_7_4 FM(QSPI0_IO2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR3_11_8 FM(QSPI0_MISO_IO1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR3_15_12 FM(QSPI0_MOSI_IO0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR3_19_16 FM(QSPI0_SPCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR3_23_20 FM(QSPI1_MOSI_IO0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR3_27_24 FM(QSPI1_SPCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR3_31_28 FM(QSPI1_MISO_IO1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP3SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP3SR3_3_0 FM(QSPI1_IO2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR3_7_4 FM(QSPI1_SSL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR3_11_8 FM(QSPI1_IO3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR3_15_12 FM(RPC_RESET_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR3_19_16 FM(RPC_WP_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR3_23_20 FM(RPC_INT_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++/* IP0SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP0SR3_3_0 FM(MMC_SD_D1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR3_7_4 FM(MMC_SD_D0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR3_11_8 FM(MMC_SD_D2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR3_15_12 FM(MMC_SD_CLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR3_19_16 FM(MMC_DS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR3_23_20 FM(MMC_SD_D3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR3_27_24 FM(MMC_D5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR3_31_28 FM(MMC_D4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP1SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP1SR3_3_0 FM(MMC_D7) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR3_7_4 FM(MMC_D6) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR3_11_8 FM(MMC_SD_CMD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR3_15_12 FM(SD_CD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR3_19_16 FM(SD_WP) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR3_23_20 FM(IPC_CLKIN) FM(IPC_CLKEN_IN) FM(PWM1_A) FM(TCLK3_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR3_27_24 FM(IPC_CLKOUT) FM(IPC_CLKEN_OUT) FM(ERROROUTC_N_A) FM(TCLK4_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR3_31_28 FM(QSPI0_SSL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP2SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP2SR3_3_0 FM(QSPI0_IO3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR3_7_4 FM(QSPI0_IO2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR3_11_8 FM(QSPI0_MISO_IO1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR3_15_12 FM(QSPI0_MOSI_IO0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR3_19_16 FM(QSPI0_SPCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR3_23_20 FM(QSPI1_MOSI_IO0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR3_27_24 FM(QSPI1_SPCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR3_31_28 FM(QSPI1_MISO_IO1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP3SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP3SR3_3_0 FM(QSPI1_IO2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR3_7_4 FM(QSPI1_SSL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR3_11_8 FM(QSPI1_IO3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR3_15_12 FM(RPC_RESET_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR3_19_16 FM(RPC_WP_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR3_23_20 FM(RPC_INT_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR4 */ +-/* IP0SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR4_3_0 FM(TSN0_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR4_7_4 FM(TSN0_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR4_11_8 FM(TSN0_AVTP_PPS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR4_15_12 FM(TSN0_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR4_19_16 FM(TSN0_LINK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR4_23_20 FM(TSN0_AVTP_MATCH) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR4_27_24 FM(TSN0_AVTP_CAPTURE) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR4_31_28 FM(TSN0_RX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP1SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR4_3_0 FM(TSN0_AVTP_PPS0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR4_7_4 FM(TSN0_TX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR4_11_8 FM(TSN0_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR4_15_12 FM(TSN0_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR4_19_16 FM(TSN0_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR4_23_20 FM(TSN0_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR4_27_24 FM(TSN0_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR4_31_28 FM(TSN0_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP2SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP2SR4_3_0 FM(TSN0_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR4_7_4 FM(TSN0_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR4_11_8 FM(TSN0_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR4_15_12 FM(TSN0_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR4_19_16 FM(TSN0_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR4_23_20 FM(PCIE0_CLKREQ_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR4_27_24 FM(PCIE1_CLKREQ_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR4_31_28 FM(AVS0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP3SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP3SR4_3_0 FM(AVS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++/* IP0SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP0SR4_3_0 FM(TSN0_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_7_4 FM(TSN0_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_11_8 FM(TSN0_AVTP_PPS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_15_12 FM(TSN0_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_19_16 FM(TSN0_LINK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_23_20 FM(TSN0_AVTP_MATCH) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_27_24 FM(TSN0_AVTP_CAPTURE) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_31_28 FM(TSN0_RX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP1SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP1SR4_3_0 FM(TSN0_AVTP_PPS0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_7_4 FM(TSN0_TX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_11_8 FM(TSN0_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_15_12 FM(TSN0_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_19_16 FM(TSN0_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_23_20 FM(TSN0_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_27_24 FM(TSN0_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_31_28 FM(TSN0_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP2SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP2SR4_3_0 FM(TSN0_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_7_4 FM(TSN0_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_11_8 FM(TSN0_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_15_12 FM(TSN0_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_19_16 FM(TSN0_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_23_20 FM(PCIE0_CLKREQ_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_27_24 FM(PCIE1_CLKREQ_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_31_28 FM(AVS0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP3SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP3SR4_3_0 FM(AVS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR5 */ +-/* IP0SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR5_3_0 FM(AVB2_AVTP_PPS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR5_7_4 FM(AVB2_AVTP_CAPTURE) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR5_11_8 FM(AVB2_AVTP_MATCH) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR5_15_12 FM(AVB2_LINK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR5_19_16 FM(AVB2_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR5_23_20 FM(AVB2_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR5_27_24 FM(AVB2_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR5_31_28 FM(AVB2_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP1SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR5_3_0 FM(AVB2_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR5_7_4 FM(AVB2_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR5_11_8 FM(AVB2_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR5_15_12 FM(AVB2_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR5_19_16 FM(AVB2_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR5_23_20 FM(AVB2_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR5_27_24 FM(AVB2_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR5_31_28 FM(AVB2_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP2SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP2SR5_3_0 FM(AVB2_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR5_7_4 FM(AVB2_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR5_11_8 FM(AVB2_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR5_15_12 FM(AVB2_TX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR5_19_16 FM(AVB2_RX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++/* IP0SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP0SR5_3_0 FM(AVB2_AVTP_PPS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_7_4 FM(AVB2_AVTP_CAPTURE) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_11_8 FM(AVB2_AVTP_MATCH) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_15_12 FM(AVB2_LINK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_19_16 FM(AVB2_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_23_20 FM(AVB2_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_27_24 FM(AVB2_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_31_28 FM(AVB2_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP1SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP1SR5_3_0 FM(AVB2_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_7_4 FM(AVB2_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_11_8 FM(AVB2_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_15_12 FM(AVB2_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_19_16 FM(AVB2_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_23_20 FM(AVB2_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_27_24 FM(AVB2_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_31_28 FM(AVB2_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP2SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP2SR5_3_0 FM(AVB2_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR5_7_4 FM(AVB2_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR5_11_8 FM(AVB2_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR5_15_12 FM(AVB2_TX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR5_19_16 FM(AVB2_RX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR6 */ +-/* IP0SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR6_3_0 FM(AVB1_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR6_7_4 FM(AVB1_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR6_11_8 FM(AVB1_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR6_15_12 FM(AVB1_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR6_19_16 FM(AVB1_LINK) FM(AVB1_MII_TX_ER) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR6_23_20 FM(AVB1_AVTP_MATCH) FM(AVB1_MII_RX_ER) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR6_27_24 FM(AVB1_TXC) FM(AVB1_MII_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR6_31_28 FM(AVB1_TX_CTL) FM(AVB1_MII_TX_EN) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP1SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR6_3_0 FM(AVB1_RXC) FM(AVB1_MII_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR6_7_4 FM(AVB1_RX_CTL) FM(AVB1_MII_RX_DV) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR6_11_8 FM(AVB1_AVTP_PPS) FM(AVB1_MII_COL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR6_15_12 FM(AVB1_AVTP_CAPTURE) FM(AVB1_MII_CRS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR6_19_16 FM(AVB1_TD1) FM(AVB1_MII_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR6_23_20 FM(AVB1_TD0) FM(AVB1_MII_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR6_27_24 FM(AVB1_RD1) FM(AVB1_MII_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR6_31_28 FM(AVB1_RD0) FM(AVB1_MII_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP2SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP2SR6_3_0 FM(AVB1_TD2) FM(AVB1_MII_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR6_7_4 FM(AVB1_RD2) FM(AVB1_MII_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR6_11_8 FM(AVB1_TD3) FM(AVB1_MII_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR6_15_12 FM(AVB1_RD3) FM(AVB1_MII_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR6_19_16 FM(AVB1_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++/* IP0SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP0SR6_3_0 FM(AVB1_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR6_7_4 FM(AVB1_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR6_11_8 FM(AVB1_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR6_15_12 FM(AVB1_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR6_19_16 FM(AVB1_LINK) FM(AVB1_MII_TX_ER) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR6_23_20 FM(AVB1_AVTP_MATCH) FM(AVB1_MII_RX_ER) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR6_27_24 FM(AVB1_TXC) FM(AVB1_MII_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR6_31_28 FM(AVB1_TX_CTL) FM(AVB1_MII_TX_EN) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP1SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP1SR6_3_0 FM(AVB1_RXC) FM(AVB1_MII_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR6_7_4 FM(AVB1_RX_CTL) FM(AVB1_MII_RX_DV) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR6_11_8 FM(AVB1_AVTP_PPS) FM(AVB1_MII_COL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR6_15_12 FM(AVB1_AVTP_CAPTURE) FM(AVB1_MII_CRS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR6_19_16 FM(AVB1_TD1) FM(AVB1_MII_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR6_23_20 FM(AVB1_TD0) FM(AVB1_MII_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR6_27_24 FM(AVB1_RD1) FM(AVB1_MII_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR6_31_28 FM(AVB1_RD0) FM(AVB1_MII_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP2SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP2SR6_3_0 FM(AVB1_TD2) FM(AVB1_MII_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR6_7_4 FM(AVB1_RD2) FM(AVB1_MII_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR6_11_8 FM(AVB1_TD3) FM(AVB1_MII_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR6_15_12 FM(AVB1_RD3) FM(AVB1_MII_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR6_19_16 FM(AVB1_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR7 */ +-/* IP0SR7 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR7_3_0 FM(AVB0_AVTP_PPS) FM(AVB0_MII_COL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR7_7_4 FM(AVB0_AVTP_CAPTURE) FM(AVB0_MII_CRS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR7_11_8 FM(AVB0_AVTP_MATCH) FM(AVB0_MII_RX_ER) FM(CC5_OSCOUT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR7_15_12 FM(AVB0_TD3) FM(AVB0_MII_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR7_19_16 FM(AVB0_LINK) FM(AVB0_MII_TX_ER) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR7_23_20 FM(AVB0_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR7_27_24 FM(AVB0_TD2) FM(AVB0_MII_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR7_31_28 FM(AVB0_TD1) FM(AVB0_MII_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP1SR7 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR7_3_0 FM(AVB0_RD3) FM(AVB0_MII_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR7_7_4 FM(AVB0_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR7_11_8 FM(AVB0_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR7_15_12 FM(AVB0_TD0) FM(AVB0_MII_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR7_19_16 FM(AVB0_RD2) FM(AVB0_MII_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR7_23_20 FM(AVB0_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR7_27_24 FM(AVB0_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR7_31_28 FM(AVB0_TXC) FM(AVB0_MII_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP2SR7 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP2SR7_3_0 FM(AVB0_TX_CTL) FM(AVB0_MII_TX_EN) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR7_7_4 FM(AVB0_RD1) FM(AVB0_MII_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR7_11_8 FM(AVB0_RD0) FM(AVB0_MII_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR7_15_12 FM(AVB0_RXC) FM(AVB0_MII_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR7_19_16 FM(AVB0_RX_CTL) FM(AVB0_MII_RX_DV) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++/* IP0SR7 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP0SR7_3_0 FM(AVB0_AVTP_PPS) FM(AVB0_MII_COL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR7_7_4 FM(AVB0_AVTP_CAPTURE) FM(AVB0_MII_CRS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR7_11_8 FM(AVB0_AVTP_MATCH) FM(AVB0_MII_RX_ER) FM(CC5_OSCOUT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR7_15_12 FM(AVB0_TD3) FM(AVB0_MII_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR7_19_16 FM(AVB0_LINK) FM(AVB0_MII_TX_ER) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR7_23_20 FM(AVB0_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR7_27_24 FM(AVB0_TD2) FM(AVB0_MII_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR7_31_28 FM(AVB0_TD1) FM(AVB0_MII_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP1SR7 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP1SR7_3_0 FM(AVB0_RD3) FM(AVB0_MII_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR7_7_4 FM(AVB0_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR7_11_8 FM(AVB0_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR7_15_12 FM(AVB0_TD0) FM(AVB0_MII_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR7_19_16 FM(AVB0_RD2) FM(AVB0_MII_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR7_23_20 FM(AVB0_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR7_27_24 FM(AVB0_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR7_31_28 FM(AVB0_TXC) FM(AVB0_MII_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP2SR7 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP2SR7_3_0 FM(AVB0_TX_CTL) FM(AVB0_MII_TX_EN) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR7_7_4 FM(AVB0_RD1) FM(AVB0_MII_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR7_11_8 FM(AVB0_RD0) FM(AVB0_MII_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR7_15_12 FM(AVB0_RXC) FM(AVB0_MII_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR7_19_16 FM(AVB0_RX_CTL) FM(AVB0_MII_RX_DV) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR8 */ +-/* IP0SR8 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR8_3_0 FM(SCL0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR8_7_4 FM(SDA0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR8_11_8 FM(SCL1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR8_15_12 FM(SDA1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR8_19_16 FM(SCL2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR8_23_20 FM(SDA2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR8_27_24 FM(SCL3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR8_31_28 FM(SDA3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +- +-/* IP1SR8 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR8_3_0 FM(SCL4) FM(HRX2) FM(SCK4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR8_7_4 FM(SDA4) FM(HTX2) FM(CTS4_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR8_11_8 FM(SCL5) FM(HRTS2_N) FM(RTS4_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR8_15_12 FM(SDA5) FM(SCIF_CLK2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR8_19_16 F_(0, 0) FM(HCTS2_N) FM(TX4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR8_23_20 F_(0, 0) FM(HSCK2) FM(RX4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++/* IP0SR8 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP0SR8_3_0 FM(SCL0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR8_7_4 FM(SDA0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR8_11_8 FM(SCL1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR8_15_12 FM(SDA1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR8_19_16 FM(SCL2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR8_23_20 FM(SDA2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR8_27_24 FM(SCL3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR8_31_28 FM(SDA3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP1SR8 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP1SR8_3_0 FM(SCL4) FM(HRX2) FM(SCK4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR8_7_4 FM(SDA4) FM(HTX2) FM(CTS4_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR8_11_8 FM(SCL5) FM(HRTS2_N) FM(RTS4_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR8_15_12 FM(SDA5) FM(SCIF_CLK2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR8_19_16 F_(0, 0) FM(HCTS2_N) FM(TX4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR8_23_20 F_(0, 0) FM(HSCK2) FM(RX4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + #define PINMUX_GPSR \ + GPSR3_29 \ +@@ -711,7 +711,7 @@ static const u16 pinmux_data[] = { + PINMUX_DATA_GP_ALL(), + + /* IP0SR0 */ +- PINMUX_IPSR_GPSR(IP0SR0_3_0, ERROROUTC_B), ++ PINMUX_IPSR_GPSR(IP0SR0_3_0, ERROROUTC_N_B), + PINMUX_IPSR_GPSR(IP0SR0_3_0, TCLK2_A), + + PINMUX_IPSR_GPSR(IP0SR0_7_4, MSIOF3_SS1), +@@ -977,7 +977,7 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP1SR3_27_24, IPC_CLKOUT), + PINMUX_IPSR_GPSR(IP1SR3_27_24, IPC_CLKEN_OUT), +- PINMUX_IPSR_GPSR(IP1SR3_27_24, ERROROUTC_A), ++ PINMUX_IPSR_GPSR(IP1SR3_27_24, ERROROUTC_N_A), + PINMUX_IPSR_GPSR(IP1SR3_27_24, TCLK4_X), + + PINMUX_IPSR_GPSR(IP1SR3_31_28, QSPI0_SSL), +-- +2.39.2 + diff --git a/queue-6.2/pinctrl-renesas-r8a779g0-fix-group-4-5-pin-functions.patch b/queue-6.2/pinctrl-renesas-r8a779g0-fix-group-4-5-pin-functions.patch new file mode 100644 index 00000000000..fe877553ee6 --- /dev/null +++ b/queue-6.2/pinctrl-renesas-r8a779g0-fix-group-4-5-pin-functions.patch @@ -0,0 +1,572 @@ +From 6d87d9e635428c6c3038095abe3207a156dfb29b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 14:18:37 +0100 +Subject: pinctrl: renesas: r8a779g0: Fix Group 4/5 pin functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 0a7a5226e7b177c68800985a19a80c1df9bceff6 ] + +According to R-Car V4H Series User’s Manual: Hardware Rev. 0.54, pin +groups 4 and 5 do not use Module Select Registers to configure pin +functions, but use Peripheral Function Select Registers instead. + +Hence: + - Remove the non-existent Module Select Registers (MODSEL[45]), + - Add the missing Peripheral Function Select Registers (IPxSR[45]), + - Correct the GPIO / Peripheral Function Select Register definitions + (GPSR]45_*), + - Correct the affected PINMUX definitions. + +Fixes: 36611d28f5130d8b ("pinctrl: renesas: r8a779g0: Add missing MODSELx for AVBx") +Fixes: 36fb7b8af55b83e0 ("pinctrl: renesas: r8a779g0: Add missing MODSELx for TSN0") +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/3d3833d1738f5e8fcc4c1002aa93832464d129a0.1669036423.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 467 +++++++++++++++---------- + 1 file changed, 279 insertions(+), 188 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index 5dd1c2c7708a8..9545adc84355e 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -156,54 +156,54 @@ + #define GPSR3_0 F_(MMC_SD_D1, IP0SR3_3_0) + + /* GPSR4 */ +-#define GPSR4_24 FM(AVS1) +-#define GPSR4_23 FM(AVS0) +-#define GPSR4_22 FM(PCIE1_CLKREQ_N) +-#define GPSR4_21 FM(PCIE0_CLKREQ_N) +-#define GPSR4_20 FM(TSN0_TXCREFCLK) +-#define GPSR4_19 FM(TSN0_TD2) +-#define GPSR4_18 FM(TSN0_TD3) +-#define GPSR4_17 FM(TSN0_RD2) +-#define GPSR4_16 FM(TSN0_RD3) +-#define GPSR4_15 FM(TSN0_TD0) +-#define GPSR4_14 FM(TSN0_TD1) +-#define GPSR4_13 FM(TSN0_RD1) +-#define GPSR4_12 FM(TSN0_TXC) +-#define GPSR4_11 FM(TSN0_RXC) +-#define GPSR4_10 FM(TSN0_RD0) +-#define GPSR4_9 FM(TSN0_TX_CTL) +-#define GPSR4_8 FM(TSN0_AVTP_PPS0) +-#define GPSR4_7 FM(TSN0_RX_CTL) +-#define GPSR4_6 FM(TSN0_AVTP_CAPTURE) +-#define GPSR4_5 FM(TSN0_AVTP_MATCH) +-#define GPSR4_4 FM(TSN0_LINK) +-#define GPSR4_3 FM(TSN0_PHY_INT) +-#define GPSR4_2 FM(TSN0_AVTP_PPS1) +-#define GPSR4_1 FM(TSN0_MDC) +-#define GPSR4_0 FM(TSN0_MDIO) ++#define GPSR4_24 F_(AVS1, IP3SR4_3_0) ++#define GPSR4_23 F_(AVS0, IP2SR4_31_28) ++#define GPSR4_22 F_(PCIE1_CLKREQ_N, IP2SR4_27_24) ++#define GPSR4_21 F_(PCIE0_CLKREQ_N, IP2SR4_23_20) ++#define GPSR4_20 F_(TSN0_TXCREFCLK, IP2SR4_19_16) ++#define GPSR4_19 F_(TSN0_TD2, IP2SR4_15_12) ++#define GPSR4_18 F_(TSN0_TD3, IP2SR4_11_8) ++#define GPSR4_17 F_(TSN0_RD2, IP2SR4_7_4) ++#define GPSR4_16 F_(TSN0_RD3, IP2SR4_3_0) ++#define GPSR4_15 F_(TSN0_TD0, IP1SR4_31_28) ++#define GPSR4_14 F_(TSN0_TD1, IP1SR4_27_24) ++#define GPSR4_13 F_(TSN0_RD1, IP1SR4_23_20) ++#define GPSR4_12 F_(TSN0_TXC, IP1SR4_19_16) ++#define GPSR4_11 F_(TSN0_RXC, IP1SR4_15_12) ++#define GPSR4_10 F_(TSN0_RD0, IP1SR4_11_8) ++#define GPSR4_9 F_(TSN0_TX_CTL, IP1SR4_7_4) ++#define GPSR4_8 F_(TSN0_AVTP_PPS0, IP1SR4_3_0) ++#define GPSR4_7 F_(TSN0_RX_CTL, IP0SR4_31_28) ++#define GPSR4_6 F_(TSN0_AVTP_CAPTURE, IP0SR4_27_24) ++#define GPSR4_5 F_(TSN0_AVTP_MATCH, IP0SR4_23_20) ++#define GPSR4_4 F_(TSN0_LINK, IP0SR4_19_16) ++#define GPSR4_3 F_(TSN0_PHY_INT, IP0SR4_15_12) ++#define GPSR4_2 F_(TSN0_AVTP_PPS1, IP0SR4_11_8) ++#define GPSR4_1 F_(TSN0_MDC, IP0SR4_7_4) ++#define GPSR4_0 F_(TSN0_MDIO, IP0SR4_3_0) + + /* GPSR 5 */ +-#define GPSR5_20 FM(AVB2_RX_CTL) +-#define GPSR5_19 FM(AVB2_TX_CTL) +-#define GPSR5_18 FM(AVB2_RXC) +-#define GPSR5_17 FM(AVB2_RD0) +-#define GPSR5_16 FM(AVB2_TXC) +-#define GPSR5_15 FM(AVB2_TD0) +-#define GPSR5_14 FM(AVB2_RD1) +-#define GPSR5_13 FM(AVB2_RD2) +-#define GPSR5_12 FM(AVB2_TD1) +-#define GPSR5_11 FM(AVB2_TD2) +-#define GPSR5_10 FM(AVB2_MDIO) +-#define GPSR5_9 FM(AVB2_RD3) +-#define GPSR5_8 FM(AVB2_TD3) +-#define GPSR5_7 FM(AVB2_TXCREFCLK) +-#define GPSR5_6 FM(AVB2_MDC) +-#define GPSR5_5 FM(AVB2_MAGIC) +-#define GPSR5_4 FM(AVB2_PHY_INT) +-#define GPSR5_3 FM(AVB2_LINK) +-#define GPSR5_2 FM(AVB2_AVTP_MATCH) +-#define GPSR5_1 FM(AVB2_AVTP_CAPTURE) +-#define GPSR5_0 FM(AVB2_AVTP_PPS) ++#define GPSR5_20 F_(AVB2_RX_CTL, IP2SR5_19_16) ++#define GPSR5_19 F_(AVB2_TX_CTL, IP2SR5_15_12) ++#define GPSR5_18 F_(AVB2_RXC, IP2SR5_11_8) ++#define GPSR5_17 F_(AVB2_RD0, IP2SR5_7_4) ++#define GPSR5_16 F_(AVB2_TXC, IP2SR5_3_0) ++#define GPSR5_15 F_(AVB2_TD0, IP1SR5_31_28) ++#define GPSR5_14 F_(AVB2_RD1, IP1SR5_27_24) ++#define GPSR5_13 F_(AVB2_RD2, IP1SR5_23_20) ++#define GPSR5_12 F_(AVB2_TD1, IP1SR5_19_16) ++#define GPSR5_11 F_(AVB2_TD2, IP1SR5_15_12) ++#define GPSR5_10 F_(AVB2_MDIO, IP1SR5_11_8) ++#define GPSR5_9 F_(AVB2_RD3, IP1SR5_7_4) ++#define GPSR5_8 F_(AVB2_TD3, IP1SR5_3_0) ++#define GPSR5_7 F_(AVB2_TXCREFCLK, IP0SR5_31_28) ++#define GPSR5_6 F_(AVB2_MDC, IP0SR5_27_24) ++#define GPSR5_5 F_(AVB2_MAGIC, IP0SR5_23_20) ++#define GPSR5_4 F_(AVB2_PHY_INT, IP0SR5_19_16) ++#define GPSR5_3 F_(AVB2_LINK, IP0SR5_15_12) ++#define GPSR5_2 F_(AVB2_AVTP_MATCH, IP0SR5_11_8) ++#define GPSR5_1 F_(AVB2_AVTP_CAPTURE, IP0SR5_7_4) ++#define GPSR5_0 F_(AVB2_AVTP_PPS, IP0SR5_3_0) + + /* GPSR 6 */ + #define GPSR6_20 F_(AVB1_TXCREFCLK, IP2SR6_19_16) +@@ -397,6 +397,68 @@ + #define IP3SR3_19_16 FM(RPC_WP_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP3SR3_23_20 FM(RPC_INT_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + ++/* SR4 */ ++/* IP0SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP0SR4_3_0 FM(TSN0_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_7_4 FM(TSN0_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_11_8 FM(TSN0_AVTP_PPS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_15_12 FM(TSN0_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_19_16 FM(TSN0_LINK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_23_20 FM(TSN0_AVTP_MATCH) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_27_24 FM(TSN0_AVTP_CAPTURE) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR4_31_28 FM(TSN0_RX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP1SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP1SR4_3_0 FM(TSN0_AVTP_PPS0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_7_4 FM(TSN0_TX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_11_8 FM(TSN0_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_15_12 FM(TSN0_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_19_16 FM(TSN0_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_23_20 FM(TSN0_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_27_24 FM(TSN0_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR4_31_28 FM(TSN0_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP2SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP2SR4_3_0 FM(TSN0_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_7_4 FM(TSN0_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_11_8 FM(TSN0_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_15_12 FM(TSN0_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_19_16 FM(TSN0_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_23_20 FM(PCIE0_CLKREQ_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_27_24 FM(PCIE1_CLKREQ_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR4_31_28 FM(AVS0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP3SR4 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP3SR4_3_0 FM(AVS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* SR5 */ ++/* IP0SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP0SR5_3_0 FM(AVB2_AVTP_PPS) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_7_4 FM(AVB2_AVTP_CAPTURE) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_11_8 FM(AVB2_AVTP_MATCH) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_15_12 FM(AVB2_LINK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_19_16 FM(AVB2_PHY_INT) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_23_20 FM(AVB2_MAGIC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_27_24 FM(AVB2_MDC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR5_31_28 FM(AVB2_TXCREFCLK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP1SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP1SR5_3_0 FM(AVB2_TD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_7_4 FM(AVB2_RD3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_11_8 FM(AVB2_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_15_12 FM(AVB2_TD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_19_16 FM(AVB2_TD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_23_20 FM(AVB2_RD2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_27_24 FM(AVB2_RD1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR5_31_28 FM(AVB2_TD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ ++/* IP2SR5 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ ++#define IP2SR5_3_0 FM(AVB2_TXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR5_7_4 FM(AVB2_RD0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR5_11_8 FM(AVB2_RXC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR5_15_12 FM(AVB2_TX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR5_19_16 FM(AVB2_RX_CTL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++ + /* SR6 */ + /* IP0SR6 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP0SR6_3_0 FM(AVB1_MDIO) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -542,6 +604,24 @@ FM(IP0SR3_23_20) IP0SR3_23_20 FM(IP1SR3_23_20) IP1SR3_23_20 FM(IP2SR3_23_20) IP2 + FM(IP0SR3_27_24) IP0SR3_27_24 FM(IP1SR3_27_24) IP1SR3_27_24 FM(IP2SR3_27_24) IP2SR3_27_24 \ + FM(IP0SR3_31_28) IP0SR3_31_28 FM(IP1SR3_31_28) IP1SR3_31_28 FM(IP2SR3_31_28) IP2SR3_31_28 \ + \ ++FM(IP0SR4_3_0) IP0SR4_3_0 FM(IP1SR4_3_0) IP1SR4_3_0 FM(IP2SR4_3_0) IP2SR4_3_0 FM(IP3SR4_3_0) IP3SR4_3_0 \ ++FM(IP0SR4_7_4) IP0SR4_7_4 FM(IP1SR4_7_4) IP1SR4_7_4 FM(IP2SR4_7_4) IP2SR4_7_4 \ ++FM(IP0SR4_11_8) IP0SR4_11_8 FM(IP1SR4_11_8) IP1SR4_11_8 FM(IP2SR4_11_8) IP2SR4_11_8 \ ++FM(IP0SR4_15_12) IP0SR4_15_12 FM(IP1SR4_15_12) IP1SR4_15_12 FM(IP2SR4_15_12) IP2SR4_15_12 \ ++FM(IP0SR4_19_16) IP0SR4_19_16 FM(IP1SR4_19_16) IP1SR4_19_16 FM(IP2SR4_19_16) IP2SR4_19_16 \ ++FM(IP0SR4_23_20) IP0SR4_23_20 FM(IP1SR4_23_20) IP1SR4_23_20 FM(IP2SR4_23_20) IP2SR4_23_20 \ ++FM(IP0SR4_27_24) IP0SR4_27_24 FM(IP1SR4_27_24) IP1SR4_27_24 FM(IP2SR4_27_24) IP2SR4_27_24 \ ++FM(IP0SR4_31_28) IP0SR4_31_28 FM(IP1SR4_31_28) IP1SR4_31_28 FM(IP2SR4_31_28) IP2SR4_31_28 \ ++\ ++FM(IP0SR5_3_0) IP0SR5_3_0 FM(IP1SR5_3_0) IP1SR5_3_0 FM(IP2SR5_3_0) IP2SR5_3_0 \ ++FM(IP0SR5_7_4) IP0SR5_7_4 FM(IP1SR5_7_4) IP1SR5_7_4 FM(IP2SR5_7_4) IP2SR5_7_4 \ ++FM(IP0SR5_11_8) IP0SR5_11_8 FM(IP1SR5_11_8) IP1SR5_11_8 FM(IP2SR5_11_8) IP2SR5_11_8 \ ++FM(IP0SR5_15_12) IP0SR5_15_12 FM(IP1SR5_15_12) IP1SR5_15_12 FM(IP2SR5_15_12) IP2SR5_15_12 \ ++FM(IP0SR5_19_16) IP0SR5_19_16 FM(IP1SR5_19_16) IP1SR5_19_16 FM(IP2SR5_19_16) IP2SR5_19_16 \ ++FM(IP0SR5_23_20) IP0SR5_23_20 FM(IP1SR5_23_20) IP1SR5_23_20 \ ++FM(IP0SR5_27_24) IP0SR5_27_24 FM(IP1SR5_27_24) IP1SR5_27_24 \ ++FM(IP0SR5_31_28) IP0SR5_31_28 FM(IP1SR5_31_28) IP1SR5_31_28 \ ++\ + FM(IP0SR6_3_0) IP0SR6_3_0 FM(IP1SR6_3_0) IP1SR6_3_0 FM(IP2SR6_3_0) IP2SR6_3_0 \ + FM(IP0SR6_7_4) IP0SR6_7_4 FM(IP1SR6_7_4) IP1SR6_7_4 FM(IP2SR6_7_4) IP2SR6_7_4 \ + FM(IP0SR6_11_8) IP0SR6_11_8 FM(IP1SR6_11_8) IP1SR6_11_8 FM(IP2SR6_11_8) IP2SR6_11_8 \ +@@ -569,30 +649,6 @@ FM(IP0SR8_23_20) IP0SR8_23_20 FM(IP1SR8_23_20) IP1SR8_23_20 \ + FM(IP0SR8_27_24) IP0SR8_27_24 \ + FM(IP0SR8_31_28) IP0SR8_31_28 + +-/* MOD_SEL4 */ /* 0 */ /* 1 */ +-#define MOD_SEL4_19 FM(SEL_TSN0_TD2_0) FM(SEL_TSN0_TD2_1) +-#define MOD_SEL4_18 FM(SEL_TSN0_TD3_0) FM(SEL_TSN0_TD3_1) +-#define MOD_SEL4_15 FM(SEL_TSN0_TD0_0) FM(SEL_TSN0_TD0_1) +-#define MOD_SEL4_14 FM(SEL_TSN0_TD1_0) FM(SEL_TSN0_TD1_1) +-#define MOD_SEL4_12 FM(SEL_TSN0_TXC_0) FM(SEL_TSN0_TXC_1) +-#define MOD_SEL4_9 FM(SEL_TSN0_TX_CTL_0) FM(SEL_TSN0_TX_CTL_1) +-#define MOD_SEL4_8 FM(SEL_TSN0_AVTP_PPS0_0) FM(SEL_TSN0_AVTP_PPS0_1) +-#define MOD_SEL4_5 FM(SEL_TSN0_AVTP_MATCH_0) FM(SEL_TSN0_AVTP_MATCH_1) +-#define MOD_SEL4_2 FM(SEL_TSN0_AVTP_PPS1_0) FM(SEL_TSN0_AVTP_PPS1_1) +-#define MOD_SEL4_1 FM(SEL_TSN0_MDC_0) FM(SEL_TSN0_MDC_1) +- +-/* MOD_SEL5 */ /* 0 */ /* 1 */ +-#define MOD_SEL5_19 FM(SEL_AVB2_TX_CTL_0) FM(SEL_AVB2_TX_CTL_1) +-#define MOD_SEL5_16 FM(SEL_AVB2_TXC_0) FM(SEL_AVB2_TXC_1) +-#define MOD_SEL5_15 FM(SEL_AVB2_TD0_0) FM(SEL_AVB2_TD0_1) +-#define MOD_SEL5_12 FM(SEL_AVB2_TD1_0) FM(SEL_AVB2_TD1_1) +-#define MOD_SEL5_11 FM(SEL_AVB2_TD2_0) FM(SEL_AVB2_TD2_1) +-#define MOD_SEL5_8 FM(SEL_AVB2_TD3_0) FM(SEL_AVB2_TD3_1) +-#define MOD_SEL5_6 FM(SEL_AVB2_MDC_0) FM(SEL_AVB2_MDC_1) +-#define MOD_SEL5_5 FM(SEL_AVB2_MAGIC_0) FM(SEL_AVB2_MAGIC_1) +-#define MOD_SEL5_2 FM(SEL_AVB2_AVTP_MATCH_0) FM(SEL_AVB2_AVTP_MATCH_1) +-#define MOD_SEL5_0 FM(SEL_AVB2_AVTP_PPS_0) FM(SEL_AVB2_AVTP_PPS_1) +- + /* MOD_SEL6 */ /* 0 */ /* 1 */ + #define MOD_SEL6_18 FM(SEL_AVB1_TD3_0) FM(SEL_AVB1_TD3_1) + #define MOD_SEL6_16 FM(SEL_AVB1_TD2_0) FM(SEL_AVB1_TD2_1) +@@ -633,26 +689,23 @@ FM(IP0SR8_31_28) IP0SR8_31_28 + + #define PINMUX_MOD_SELS \ + \ +-MOD_SEL4_19 MOD_SEL5_19 \ +-MOD_SEL4_18 MOD_SEL6_18 \ +- \ +- MOD_SEL5_16 MOD_SEL6_16 MOD_SEL7_16 \ +-MOD_SEL4_15 MOD_SEL5_15 MOD_SEL7_15 \ +-MOD_SEL4_14 \ +- MOD_SEL6_13 MOD_SEL7_13 \ +-MOD_SEL4_12 MOD_SEL5_12 MOD_SEL6_12 \ +- MOD_SEL5_11 MOD_SEL7_11 MOD_SEL8_11 \ +- MOD_SEL6_10 MOD_SEL7_10 MOD_SEL8_10 \ +-MOD_SEL4_9 MOD_SEL8_9 \ +-MOD_SEL4_8 MOD_SEL5_8 MOD_SEL8_8 \ +- MOD_SEL6_7 MOD_SEL7_7 MOD_SEL8_7 \ +- MOD_SEL5_6 MOD_SEL6_6 MOD_SEL7_6 MOD_SEL8_6 \ +-MOD_SEL4_5 MOD_SEL5_5 MOD_SEL6_5 MOD_SEL8_5 \ +- MOD_SEL8_4 \ +- MOD_SEL7_3 MOD_SEL8_3 \ +-MOD_SEL4_2 MOD_SEL5_2 MOD_SEL6_2 MOD_SEL7_2 MOD_SEL8_2 \ +-MOD_SEL4_1 MOD_SEL6_1 MOD_SEL8_1 \ +- MOD_SEL5_0 MOD_SEL7_0 MOD_SEL8_0 ++MOD_SEL6_18 \ ++MOD_SEL6_16 MOD_SEL7_16 \ ++ MOD_SEL7_15 \ ++MOD_SEL6_13 MOD_SEL7_13 \ ++MOD_SEL6_12 \ ++ MOD_SEL7_11 MOD_SEL8_11 \ ++MOD_SEL6_10 MOD_SEL7_10 MOD_SEL8_10 \ ++ MOD_SEL8_9 \ ++ MOD_SEL8_8 \ ++MOD_SEL6_7 MOD_SEL7_7 MOD_SEL8_7 \ ++MOD_SEL6_6 MOD_SEL7_6 MOD_SEL8_6 \ ++MOD_SEL6_5 MOD_SEL8_5 \ ++ MOD_SEL8_4 \ ++ MOD_SEL7_3 MOD_SEL8_3 \ ++MOD_SEL6_2 MOD_SEL7_2 MOD_SEL8_2 \ ++MOD_SEL6_1 MOD_SEL8_1 \ ++ MOD_SEL7_0 MOD_SEL8_0 + + enum { + PINMUX_RESERVED = 0, +@@ -686,59 +739,6 @@ enum { + static const u16 pinmux_data[] = { + PINMUX_DATA_GP_ALL(), + +- PINMUX_SINGLE(AVS1), +- PINMUX_SINGLE(AVS0), +- PINMUX_SINGLE(PCIE1_CLKREQ_N), +- PINMUX_SINGLE(PCIE0_CLKREQ_N), +- +- /* TSN0 without MODSEL4 */ +- PINMUX_SINGLE(TSN0_TXCREFCLK), +- PINMUX_SINGLE(TSN0_RD2), +- PINMUX_SINGLE(TSN0_RD3), +- PINMUX_SINGLE(TSN0_RD1), +- PINMUX_SINGLE(TSN0_RXC), +- PINMUX_SINGLE(TSN0_RD0), +- PINMUX_SINGLE(TSN0_RX_CTL), +- PINMUX_SINGLE(TSN0_AVTP_CAPTURE), +- PINMUX_SINGLE(TSN0_LINK), +- PINMUX_SINGLE(TSN0_PHY_INT), +- PINMUX_SINGLE(TSN0_MDIO), +- /* TSN0 with MODSEL4 */ +- PINMUX_IPSR_NOGM(0, TSN0_TD2, SEL_TSN0_TD2_1), +- PINMUX_IPSR_NOGM(0, TSN0_TD3, SEL_TSN0_TD3_1), +- PINMUX_IPSR_NOGM(0, TSN0_TD0, SEL_TSN0_TD0_1), +- PINMUX_IPSR_NOGM(0, TSN0_TD1, SEL_TSN0_TD1_1), +- PINMUX_IPSR_NOGM(0, TSN0_TXC, SEL_TSN0_TXC_1), +- PINMUX_IPSR_NOGM(0, TSN0_TX_CTL, SEL_TSN0_TX_CTL_1), +- PINMUX_IPSR_NOGM(0, TSN0_AVTP_PPS0, SEL_TSN0_AVTP_PPS0_1), +- PINMUX_IPSR_NOGM(0, TSN0_AVTP_MATCH, SEL_TSN0_AVTP_MATCH_1), +- PINMUX_IPSR_NOGM(0, TSN0_AVTP_PPS1, SEL_TSN0_AVTP_PPS1_1), +- PINMUX_IPSR_NOGM(0, TSN0_MDC, SEL_TSN0_MDC_1), +- +- /* TSN0 without MODSEL5 */ +- PINMUX_SINGLE(AVB2_RX_CTL), +- PINMUX_SINGLE(AVB2_RXC), +- PINMUX_SINGLE(AVB2_RD0), +- PINMUX_SINGLE(AVB2_RD1), +- PINMUX_SINGLE(AVB2_RD2), +- PINMUX_SINGLE(AVB2_MDIO), +- PINMUX_SINGLE(AVB2_RD3), +- PINMUX_SINGLE(AVB2_TXCREFCLK), +- PINMUX_SINGLE(AVB2_PHY_INT), +- PINMUX_SINGLE(AVB2_LINK), +- PINMUX_SINGLE(AVB2_AVTP_CAPTURE), +- /* TSN0 with MODSEL5 */ +- PINMUX_IPSR_NOGM(0, AVB2_TX_CTL, SEL_AVB2_TX_CTL_1), +- PINMUX_IPSR_NOGM(0, AVB2_TXC, SEL_AVB2_TXC_1), +- PINMUX_IPSR_NOGM(0, AVB2_TD0, SEL_AVB2_TD0_1), +- PINMUX_IPSR_NOGM(0, AVB2_TD1, SEL_AVB2_TD1_1), +- PINMUX_IPSR_NOGM(0, AVB2_TD2, SEL_AVB2_TD2_1), +- PINMUX_IPSR_NOGM(0, AVB2_TD3, SEL_AVB2_TD3_1), +- PINMUX_IPSR_NOGM(0, AVB2_MDC, SEL_AVB2_MDC_1), +- PINMUX_IPSR_NOGM(0, AVB2_MAGIC, SEL_AVB2_MAGIC_1), +- PINMUX_IPSR_NOGM(0, AVB2_AVTP_MATCH, SEL_AVB2_AVTP_MATCH_1), +- PINMUX_IPSR_NOGM(0, AVB2_AVTP_PPS, SEL_AVB2_AVTP_PPS_1), +- + /* IP0SR0 */ + PINMUX_IPSR_GPSR(IP0SR0_3_0, ERROROUTC_B), + PINMUX_IPSR_GPSR(IP0SR0_3_0, TCLK2_A), +@@ -1029,6 +1029,66 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP3SR3_19_16, RPC_WP_N), + PINMUX_IPSR_GPSR(IP3SR3_23_20, RPC_INT_N), + ++ /* IP0SR4 */ ++ PINMUX_IPSR_GPSR(IP0SR4_3_0, TSN0_MDIO), ++ PINMUX_IPSR_GPSR(IP0SR4_7_4, TSN0_MDC), ++ PINMUX_IPSR_GPSR(IP0SR4_11_8, TSN0_AVTP_PPS1), ++ PINMUX_IPSR_GPSR(IP0SR4_15_12, TSN0_PHY_INT), ++ PINMUX_IPSR_GPSR(IP0SR4_19_16, TSN0_LINK), ++ PINMUX_IPSR_GPSR(IP0SR4_23_20, TSN0_AVTP_MATCH), ++ PINMUX_IPSR_GPSR(IP0SR4_27_24, TSN0_AVTP_CAPTURE), ++ PINMUX_IPSR_GPSR(IP0SR4_31_28, TSN0_RX_CTL), ++ ++ /* IP1SR4 */ ++ PINMUX_IPSR_GPSR(IP1SR4_3_0, TSN0_AVTP_PPS0), ++ PINMUX_IPSR_GPSR(IP1SR4_7_4, TSN0_TX_CTL), ++ PINMUX_IPSR_GPSR(IP1SR4_11_8, TSN0_RD0), ++ PINMUX_IPSR_GPSR(IP1SR4_15_12, TSN0_RXC), ++ PINMUX_IPSR_GPSR(IP1SR4_19_16, TSN0_TXC), ++ PINMUX_IPSR_GPSR(IP1SR4_23_20, TSN0_RD1), ++ PINMUX_IPSR_GPSR(IP1SR4_27_24, TSN0_TD1), ++ PINMUX_IPSR_GPSR(IP1SR4_31_28, TSN0_TD0), ++ ++ /* IP2SR4 */ ++ PINMUX_IPSR_GPSR(IP2SR4_3_0, TSN0_RD3), ++ PINMUX_IPSR_GPSR(IP2SR4_7_4, TSN0_RD2), ++ PINMUX_IPSR_GPSR(IP2SR4_11_8, TSN0_TD3), ++ PINMUX_IPSR_GPSR(IP2SR4_15_12, TSN0_TD2), ++ PINMUX_IPSR_GPSR(IP2SR4_19_16, TSN0_TXCREFCLK), ++ PINMUX_IPSR_GPSR(IP2SR4_23_20, PCIE0_CLKREQ_N), ++ PINMUX_IPSR_GPSR(IP2SR4_27_24, PCIE1_CLKREQ_N), ++ PINMUX_IPSR_GPSR(IP2SR4_31_28, AVS0), ++ ++ /* IP3SR4 */ ++ PINMUX_IPSR_GPSR(IP3SR4_3_0, AVS1), ++ ++ /* IP0SR5 */ ++ PINMUX_IPSR_GPSR(IP0SR5_3_0, AVB2_AVTP_PPS), ++ PINMUX_IPSR_GPSR(IP0SR5_7_4, AVB2_AVTP_CAPTURE), ++ PINMUX_IPSR_GPSR(IP0SR5_11_8, AVB2_AVTP_MATCH), ++ PINMUX_IPSR_GPSR(IP0SR5_15_12, AVB2_LINK), ++ PINMUX_IPSR_GPSR(IP0SR5_19_16, AVB2_PHY_INT), ++ PINMUX_IPSR_GPSR(IP0SR5_23_20, AVB2_MAGIC), ++ PINMUX_IPSR_GPSR(IP0SR5_27_24, AVB2_MDC), ++ PINMUX_IPSR_GPSR(IP0SR5_31_28, AVB2_TXCREFCLK), ++ ++ /* IP1SR5 */ ++ PINMUX_IPSR_GPSR(IP1SR5_3_0, AVB2_TD3), ++ PINMUX_IPSR_GPSR(IP1SR5_7_4, AVB2_RD3), ++ PINMUX_IPSR_GPSR(IP1SR5_11_8, AVB2_MDIO), ++ PINMUX_IPSR_GPSR(IP1SR5_15_12, AVB2_TD2), ++ PINMUX_IPSR_GPSR(IP1SR5_19_16, AVB2_TD1), ++ PINMUX_IPSR_GPSR(IP1SR5_23_20, AVB2_RD2), ++ PINMUX_IPSR_GPSR(IP1SR5_27_24, AVB2_RD1), ++ PINMUX_IPSR_GPSR(IP1SR5_31_28, AVB2_TD0), ++ ++ /* IP2SR5 */ ++ PINMUX_IPSR_GPSR(IP2SR5_3_0, AVB2_TXC), ++ PINMUX_IPSR_GPSR(IP2SR5_7_4, AVB2_RD0), ++ PINMUX_IPSR_GPSR(IP2SR5_11_8, AVB2_RXC), ++ PINMUX_IPSR_GPSR(IP2SR5_15_12, AVB2_TX_CTL), ++ PINMUX_IPSR_GPSR(IP2SR5_19_16, AVB2_RX_CTL), ++ + /* IP0SR6 */ + PINMUX_IPSR_GPSR(IP0SR6_3_0, AVB1_MDIO), + +@@ -3419,6 +3479,82 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + IP3SR3_7_4 + IP3SR3_3_0)) + }, ++ { PINMUX_CFG_REG_VAR("IP0SR4", 0xE6060060, 32, ++ GROUP(4, 4, 4, 4, 4, 4, 4, 4), ++ GROUP( ++ IP0SR4_31_28 ++ IP0SR4_27_24 ++ IP0SR4_23_20 ++ IP0SR4_19_16 ++ IP0SR4_15_12 ++ IP0SR4_11_8 ++ IP0SR4_7_4 ++ IP0SR4_3_0)) ++ }, ++ { PINMUX_CFG_REG_VAR("IP1SR4", 0xE6060064, 32, ++ GROUP(4, 4, 4, 4, 4, 4, 4, 4), ++ GROUP( ++ IP1SR4_31_28 ++ IP1SR4_27_24 ++ IP1SR4_23_20 ++ IP1SR4_19_16 ++ IP1SR4_15_12 ++ IP1SR4_11_8 ++ IP1SR4_7_4 ++ IP1SR4_3_0)) ++ }, ++ { PINMUX_CFG_REG_VAR("IP2SR4", 0xE6060068, 32, ++ GROUP(4, 4, 4, 4, 4, 4, 4, 4), ++ GROUP( ++ IP2SR4_31_28 ++ IP2SR4_27_24 ++ IP2SR4_23_20 ++ IP2SR4_19_16 ++ IP2SR4_15_12 ++ IP2SR4_11_8 ++ IP2SR4_7_4 ++ IP2SR4_3_0)) ++ }, ++ { PINMUX_CFG_REG_VAR("IP3SR4", 0xE606006C, 32, ++ GROUP(-28, 4), ++ GROUP( ++ /* IP3SR4_31_4 RESERVED */ ++ IP3SR4_3_0)) ++ }, ++ { PINMUX_CFG_REG_VAR("IP0SR5", 0xE6060860, 32, ++ GROUP(4, 4, 4, 4, 4, 4, 4, 4), ++ GROUP( ++ IP0SR5_31_28 ++ IP0SR5_27_24 ++ IP0SR5_23_20 ++ IP0SR5_19_16 ++ IP0SR5_15_12 ++ IP0SR5_11_8 ++ IP0SR5_7_4 ++ IP0SR5_3_0)) ++ }, ++ { PINMUX_CFG_REG_VAR("IP1SR5", 0xE6060864, 32, ++ GROUP(4, 4, 4, 4, 4, 4, 4, 4), ++ GROUP( ++ IP1SR5_31_28 ++ IP1SR5_27_24 ++ IP1SR5_23_20 ++ IP1SR5_19_16 ++ IP1SR5_15_12 ++ IP1SR5_11_8 ++ IP1SR5_7_4 ++ IP1SR5_3_0)) ++ }, ++ { PINMUX_CFG_REG_VAR("IP2SR5", 0xE6060868, 32, ++ GROUP(-12, 4, 4, 4, 4, 4), ++ GROUP( ++ /* IP2SR5_31_20 RESERVED */ ++ IP2SR5_19_16 ++ IP2SR5_15_12 ++ IP2SR5_11_8 ++ IP2SR5_7_4 ++ IP2SR5_3_0)) ++ }, + { PINMUX_CFG_REG("IP0SR6", 0xE6061060, 32, 4, GROUP( + IP0SR6_31_28 + IP0SR6_27_24 +@@ -3505,51 +3641,6 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + + #define F_(x, y) x, + #define FM(x) FN_##x, +- { PINMUX_CFG_REG_VAR("MOD_SEL4", 0xE6060100, 32, +- GROUP(-12, 1, 1, -2, 1, 1, -1, 1, -2, 1, 1, -2, 1, +- -2, 1, 1, -1), +- GROUP( +- /* RESERVED 31-20 */ +- MOD_SEL4_19 +- MOD_SEL4_18 +- /* RESERVED 17-16 */ +- MOD_SEL4_15 +- MOD_SEL4_14 +- /* RESERVED 13 */ +- MOD_SEL4_12 +- /* RESERVED 11-10 */ +- MOD_SEL4_9 +- MOD_SEL4_8 +- /* RESERVED 7-6 */ +- MOD_SEL4_5 +- /* RESERVED 4-3 */ +- MOD_SEL4_2 +- MOD_SEL4_1 +- /* RESERVED 0 */ +- )) +- }, +- { PINMUX_CFG_REG_VAR("MOD_SEL5", 0xE6060900, 32, +- GROUP(-12, 1, -2, 1, 1, -2, 1, 1, -2, 1, -1, +- 1, 1, -2, 1, -1, 1), +- GROUP( +- /* RESERVED 31-20 */ +- MOD_SEL5_19 +- /* RESERVED 18-17 */ +- MOD_SEL5_16 +- MOD_SEL5_15 +- /* RESERVED 14-13 */ +- MOD_SEL5_12 +- MOD_SEL5_11 +- /* RESERVED 10-9 */ +- MOD_SEL5_8 +- /* RESERVED 7 */ +- MOD_SEL5_6 +- MOD_SEL5_5 +- /* RESERVED 4-3 */ +- MOD_SEL5_2 +- /* RESERVED 1 */ +- MOD_SEL5_0)) +- }, + { PINMUX_CFG_REG_VAR("MOD_SEL6", 0xE6061100, 32, + GROUP(-13, 1, -1, 1, -2, 1, 1, + -1, 1, -2, 1, 1, 1, -2, 1, 1, -1), +-- +2.39.2 + diff --git a/queue-6.2/pinctrl-renesas-r8a779g0-fix-group-6-7-pin-functions.patch b/queue-6.2/pinctrl-renesas-r8a779g0-fix-group-6-7-pin-functions.patch new file mode 100644 index 00000000000..5e7d8e5b075 --- /dev/null +++ b/queue-6.2/pinctrl-renesas-r8a779g0-fix-group-6-7-pin-functions.patch @@ -0,0 +1,303 @@ +From 3b48193e9f0dd9c559855695a7e49770fd100456 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 14:18:38 +0100 +Subject: pinctrl: renesas: r8a779g0: Fix Group 6/7 pin functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 203734a0419cade9c76016f66e2c7ba354c249b4 ] + +According to R-Car V4H Series User’s Manual: Hardware Rev. 0.54, pin +groups 6 and 7 do not use Module Select Registers to configure pin +functions. + +Hence: + - Remove the non-existent Module Select Registers (MODSEL[67]), + - Correct the affected PINMUX definitions. + +Fixes: 36611d28f5130d8b ("pinctrl: renesas: r8a779g0: Add missing MODSELx for AVBx") +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/06972cafd0efa4cfb395cfa76000a1bdae5e9e73.1669036423.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 171 +++++++------------------ + 1 file changed, 49 insertions(+), 122 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index 9545adc84355e..af7cfe32b1ecc 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -649,30 +649,6 @@ FM(IP0SR8_23_20) IP0SR8_23_20 FM(IP1SR8_23_20) IP1SR8_23_20 \ + FM(IP0SR8_27_24) IP0SR8_27_24 \ + FM(IP0SR8_31_28) IP0SR8_31_28 + +-/* MOD_SEL6 */ /* 0 */ /* 1 */ +-#define MOD_SEL6_18 FM(SEL_AVB1_TD3_0) FM(SEL_AVB1_TD3_1) +-#define MOD_SEL6_16 FM(SEL_AVB1_TD2_0) FM(SEL_AVB1_TD2_1) +-#define MOD_SEL6_13 FM(SEL_AVB1_TD0_0) FM(SEL_AVB1_TD0_1) +-#define MOD_SEL6_12 FM(SEL_AVB1_TD1_0) FM(SEL_AVB1_TD1_1) +-#define MOD_SEL6_10 FM(SEL_AVB1_AVTP_PPS_0) FM(SEL_AVB1_AVTP_PPS_1) +-#define MOD_SEL6_7 FM(SEL_AVB1_TX_CTL_0) FM(SEL_AVB1_TX_CTL_1) +-#define MOD_SEL6_6 FM(SEL_AVB1_TXC_0) FM(SEL_AVB1_TXC_1) +-#define MOD_SEL6_5 FM(SEL_AVB1_AVTP_MATCH_0) FM(SEL_AVB1_AVTP_MATCH_1) +-#define MOD_SEL6_2 FM(SEL_AVB1_MDC_0) FM(SEL_AVB1_MDC_1) +-#define MOD_SEL6_1 FM(SEL_AVB1_MAGIC_0) FM(SEL_AVB1_MAGIC_1) +- +-/* MOD_SEL7 */ /* 0 */ /* 1 */ +-#define MOD_SEL7_16 FM(SEL_AVB0_TX_CTL_0) FM(SEL_AVB0_TX_CTL_1) +-#define MOD_SEL7_15 FM(SEL_AVB0_TXC_0) FM(SEL_AVB0_TXC_1) +-#define MOD_SEL7_13 FM(SEL_AVB0_MDC_0) FM(SEL_AVB0_MDC_1) +-#define MOD_SEL7_11 FM(SEL_AVB0_TD0_0) FM(SEL_AVB0_TD0_1) +-#define MOD_SEL7_10 FM(SEL_AVB0_MAGIC_0) FM(SEL_AVB0_MAGIC_1) +-#define MOD_SEL7_7 FM(SEL_AVB0_TD1_0) FM(SEL_AVB0_TD1_1) +-#define MOD_SEL7_6 FM(SEL_AVB0_TD2_0) FM(SEL_AVB0_TD2_1) +-#define MOD_SEL7_3 FM(SEL_AVB0_TD3_0) FM(SEL_AVB0_TD3_1) +-#define MOD_SEL7_2 FM(SEL_AVB0_AVTP_MATCH_0) FM(SEL_AVB0_AVTP_MATCH_1) +-#define MOD_SEL7_0 FM(SEL_AVB0_AVTP_PPS_0) FM(SEL_AVB0_AVTP_PPS_1) +- + /* MOD_SEL8 */ /* 0 */ /* 1 */ + #define MOD_SEL8_11 FM(SEL_SDA5_0) FM(SEL_SDA5_1) + #define MOD_SEL8_10 FM(SEL_SCL5_0) FM(SEL_SCL5_1) +@@ -689,23 +665,18 @@ FM(IP0SR8_31_28) IP0SR8_31_28 + + #define PINMUX_MOD_SELS \ + \ +-MOD_SEL6_18 \ +-MOD_SEL6_16 MOD_SEL7_16 \ +- MOD_SEL7_15 \ +-MOD_SEL6_13 MOD_SEL7_13 \ +-MOD_SEL6_12 \ +- MOD_SEL7_11 MOD_SEL8_11 \ +-MOD_SEL6_10 MOD_SEL7_10 MOD_SEL8_10 \ +- MOD_SEL8_9 \ +- MOD_SEL8_8 \ +-MOD_SEL6_7 MOD_SEL7_7 MOD_SEL8_7 \ +-MOD_SEL6_6 MOD_SEL7_6 MOD_SEL8_6 \ +-MOD_SEL6_5 MOD_SEL8_5 \ +- MOD_SEL8_4 \ +- MOD_SEL7_3 MOD_SEL8_3 \ +-MOD_SEL6_2 MOD_SEL7_2 MOD_SEL8_2 \ +-MOD_SEL6_1 MOD_SEL8_1 \ +- MOD_SEL7_0 MOD_SEL8_0 ++MOD_SEL8_11 \ ++MOD_SEL8_10 \ ++MOD_SEL8_9 \ ++MOD_SEL8_8 \ ++MOD_SEL8_7 \ ++MOD_SEL8_6 \ ++MOD_SEL8_5 \ ++MOD_SEL8_4 \ ++MOD_SEL8_3 \ ++MOD_SEL8_2 \ ++MOD_SEL8_1 \ ++MOD_SEL8_0 + + enum { + PINMUX_RESERVED = 0, +@@ -1092,23 +1063,23 @@ static const u16 pinmux_data[] = { + /* IP0SR6 */ + PINMUX_IPSR_GPSR(IP0SR6_3_0, AVB1_MDIO), + +- PINMUX_IPSR_MSEL(IP0SR6_7_4, AVB1_MAGIC, SEL_AVB1_MAGIC_1), ++ PINMUX_IPSR_GPSR(IP0SR6_7_4, AVB1_MAGIC), + +- PINMUX_IPSR_MSEL(IP0SR6_11_8, AVB1_MDC, SEL_AVB1_MDC_1), ++ PINMUX_IPSR_GPSR(IP0SR6_11_8, AVB1_MDC), + + PINMUX_IPSR_GPSR(IP0SR6_15_12, AVB1_PHY_INT), + + PINMUX_IPSR_GPSR(IP0SR6_19_16, AVB1_LINK), + PINMUX_IPSR_GPSR(IP0SR6_19_16, AVB1_MII_TX_ER), + +- PINMUX_IPSR_MSEL(IP0SR6_23_20, AVB1_AVTP_MATCH, SEL_AVB1_AVTP_MATCH_1), +- PINMUX_IPSR_MSEL(IP0SR6_23_20, AVB1_MII_RX_ER, SEL_AVB1_AVTP_MATCH_0), ++ PINMUX_IPSR_GPSR(IP0SR6_23_20, AVB1_AVTP_MATCH), ++ PINMUX_IPSR_GPSR(IP0SR6_23_20, AVB1_MII_RX_ER), + +- PINMUX_IPSR_MSEL(IP0SR6_27_24, AVB1_TXC, SEL_AVB1_TXC_1), +- PINMUX_IPSR_MSEL(IP0SR6_27_24, AVB1_MII_TXC, SEL_AVB1_TXC_0), ++ PINMUX_IPSR_GPSR(IP0SR6_27_24, AVB1_TXC), ++ PINMUX_IPSR_GPSR(IP0SR6_27_24, AVB1_MII_TXC), + +- PINMUX_IPSR_MSEL(IP0SR6_31_28, AVB1_TX_CTL, SEL_AVB1_TX_CTL_1), +- PINMUX_IPSR_MSEL(IP0SR6_31_28, AVB1_MII_TX_EN, SEL_AVB1_TX_CTL_0), ++ PINMUX_IPSR_GPSR(IP0SR6_31_28, AVB1_TX_CTL), ++ PINMUX_IPSR_GPSR(IP0SR6_31_28, AVB1_MII_TX_EN), + + /* IP1SR6 */ + PINMUX_IPSR_GPSR(IP1SR6_3_0, AVB1_RXC), +@@ -1117,17 +1088,17 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR6_7_4, AVB1_RX_CTL), + PINMUX_IPSR_GPSR(IP1SR6_7_4, AVB1_MII_RX_DV), + +- PINMUX_IPSR_MSEL(IP1SR6_11_8, AVB1_AVTP_PPS, SEL_AVB1_AVTP_PPS_1), +- PINMUX_IPSR_MSEL(IP1SR6_11_8, AVB1_MII_COL, SEL_AVB1_AVTP_PPS_0), ++ PINMUX_IPSR_GPSR(IP1SR6_11_8, AVB1_AVTP_PPS), ++ PINMUX_IPSR_GPSR(IP1SR6_11_8, AVB1_MII_COL), + + PINMUX_IPSR_GPSR(IP1SR6_15_12, AVB1_AVTP_CAPTURE), + PINMUX_IPSR_GPSR(IP1SR6_15_12, AVB1_MII_CRS), + +- PINMUX_IPSR_MSEL(IP1SR6_19_16, AVB1_TD1, SEL_AVB1_TD1_1), +- PINMUX_IPSR_MSEL(IP1SR6_19_16, AVB1_MII_TD1, SEL_AVB1_TD1_0), ++ PINMUX_IPSR_GPSR(IP1SR6_19_16, AVB1_TD1), ++ PINMUX_IPSR_GPSR(IP1SR6_19_16, AVB1_MII_TD1), + +- PINMUX_IPSR_MSEL(IP1SR6_23_20, AVB1_TD0, SEL_AVB1_TD0_1), +- PINMUX_IPSR_MSEL(IP1SR6_23_20, AVB1_MII_TD0, SEL_AVB1_TD0_0), ++ PINMUX_IPSR_GPSR(IP1SR6_23_20, AVB1_TD0), ++ PINMUX_IPSR_GPSR(IP1SR6_23_20, AVB1_MII_TD0), + + PINMUX_IPSR_GPSR(IP1SR6_27_24, AVB1_RD1), + PINMUX_IPSR_GPSR(IP1SR6_27_24, AVB1_MII_RD1), +@@ -1136,14 +1107,14 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR6_31_28, AVB1_MII_RD0), + + /* IP2SR6 */ +- PINMUX_IPSR_MSEL(IP2SR6_3_0, AVB1_TD2, SEL_AVB1_TD2_1), +- PINMUX_IPSR_MSEL(IP2SR6_3_0, AVB1_MII_TD2, SEL_AVB1_TD2_0), ++ PINMUX_IPSR_GPSR(IP2SR6_3_0, AVB1_TD2), ++ PINMUX_IPSR_GPSR(IP2SR6_3_0, AVB1_MII_TD2), + + PINMUX_IPSR_GPSR(IP2SR6_7_4, AVB1_RD2), + PINMUX_IPSR_GPSR(IP2SR6_7_4, AVB1_MII_RD2), + +- PINMUX_IPSR_MSEL(IP2SR6_11_8, AVB1_TD3, SEL_AVB1_TD3_1), +- PINMUX_IPSR_MSEL(IP2SR6_11_8, AVB1_MII_TD3, SEL_AVB1_TD3_0), ++ PINMUX_IPSR_GPSR(IP2SR6_11_8, AVB1_TD3), ++ PINMUX_IPSR_GPSR(IP2SR6_11_8, AVB1_MII_TD3), + + PINMUX_IPSR_GPSR(IP2SR6_15_12, AVB1_RD3), + PINMUX_IPSR_GPSR(IP2SR6_15_12, AVB1_MII_RD3), +@@ -1151,29 +1122,29 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP2SR6_19_16, AVB1_TXCREFCLK), + + /* IP0SR7 */ +- PINMUX_IPSR_MSEL(IP0SR7_3_0, AVB0_AVTP_PPS, SEL_AVB0_AVTP_PPS_1), +- PINMUX_IPSR_MSEL(IP0SR7_3_0, AVB0_MII_COL, SEL_AVB0_AVTP_PPS_0), ++ PINMUX_IPSR_GPSR(IP0SR7_3_0, AVB0_AVTP_PPS), ++ PINMUX_IPSR_GPSR(IP0SR7_3_0, AVB0_MII_COL), + + PINMUX_IPSR_GPSR(IP0SR7_7_4, AVB0_AVTP_CAPTURE), + PINMUX_IPSR_GPSR(IP0SR7_7_4, AVB0_MII_CRS), + +- PINMUX_IPSR_MSEL(IP0SR7_11_8, AVB0_AVTP_MATCH, SEL_AVB0_AVTP_MATCH_1), +- PINMUX_IPSR_MSEL(IP0SR7_11_8, AVB0_MII_RX_ER, SEL_AVB0_AVTP_MATCH_0), +- PINMUX_IPSR_MSEL(IP0SR7_11_8, CC5_OSCOUT, SEL_AVB0_AVTP_MATCH_0), ++ PINMUX_IPSR_GPSR(IP0SR7_11_8, AVB0_AVTP_MATCH), ++ PINMUX_IPSR_GPSR(IP0SR7_11_8, AVB0_MII_RX_ER), ++ PINMUX_IPSR_GPSR(IP0SR7_11_8, CC5_OSCOUT), + +- PINMUX_IPSR_MSEL(IP0SR7_15_12, AVB0_TD3, SEL_AVB0_TD3_1), +- PINMUX_IPSR_MSEL(IP0SR7_15_12, AVB0_MII_TD3, SEL_AVB0_TD3_0), ++ PINMUX_IPSR_GPSR(IP0SR7_15_12, AVB0_TD3), ++ PINMUX_IPSR_GPSR(IP0SR7_15_12, AVB0_MII_TD3), + + PINMUX_IPSR_GPSR(IP0SR7_19_16, AVB0_LINK), + PINMUX_IPSR_GPSR(IP0SR7_19_16, AVB0_MII_TX_ER), + + PINMUX_IPSR_GPSR(IP0SR7_23_20, AVB0_PHY_INT), + +- PINMUX_IPSR_MSEL(IP0SR7_27_24, AVB0_TD2, SEL_AVB0_TD2_1), +- PINMUX_IPSR_MSEL(IP0SR7_27_24, AVB0_MII_TD2, SEL_AVB0_TD2_0), ++ PINMUX_IPSR_GPSR(IP0SR7_27_24, AVB0_TD2), ++ PINMUX_IPSR_GPSR(IP0SR7_27_24, AVB0_MII_TD2), + +- PINMUX_IPSR_MSEL(IP0SR7_31_28, AVB0_TD1, SEL_AVB0_TD1_1), +- PINMUX_IPSR_MSEL(IP0SR7_31_28, AVB0_MII_TD1, SEL_AVB0_TD1_0), ++ PINMUX_IPSR_GPSR(IP0SR7_31_28, AVB0_TD1), ++ PINMUX_IPSR_GPSR(IP0SR7_31_28, AVB0_MII_TD1), + + /* IP1SR7 */ + PINMUX_IPSR_GPSR(IP1SR7_3_0, AVB0_RD3), +@@ -1181,24 +1152,24 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP1SR7_7_4, AVB0_TXCREFCLK), + +- PINMUX_IPSR_MSEL(IP1SR7_11_8, AVB0_MAGIC, SEL_AVB0_MAGIC_1), ++ PINMUX_IPSR_GPSR(IP1SR7_11_8, AVB0_MAGIC), + +- PINMUX_IPSR_MSEL(IP1SR7_15_12, AVB0_TD0, SEL_AVB0_TD0_1), +- PINMUX_IPSR_MSEL(IP1SR7_15_12, AVB0_MII_TD0, SEL_AVB0_TD0_0), ++ PINMUX_IPSR_GPSR(IP1SR7_15_12, AVB0_TD0), ++ PINMUX_IPSR_GPSR(IP1SR7_15_12, AVB0_MII_TD0), + + PINMUX_IPSR_GPSR(IP1SR7_19_16, AVB0_RD2), + PINMUX_IPSR_GPSR(IP1SR7_19_16, AVB0_MII_RD2), + +- PINMUX_IPSR_MSEL(IP1SR7_23_20, AVB0_MDC, SEL_AVB0_MDC_1), ++ PINMUX_IPSR_GPSR(IP1SR7_23_20, AVB0_MDC), + + PINMUX_IPSR_GPSR(IP1SR7_27_24, AVB0_MDIO), + +- PINMUX_IPSR_MSEL(IP1SR7_31_28, AVB0_TXC, SEL_AVB0_TXC_1), +- PINMUX_IPSR_MSEL(IP1SR7_31_28, AVB0_MII_TXC, SEL_AVB0_TXC_0), ++ PINMUX_IPSR_GPSR(IP1SR7_31_28, AVB0_TXC), ++ PINMUX_IPSR_GPSR(IP1SR7_31_28, AVB0_MII_TXC), + + /* IP2SR7 */ +- PINMUX_IPSR_MSEL(IP2SR7_3_0, AVB0_TX_CTL, SEL_AVB0_TX_CTL_1), +- PINMUX_IPSR_MSEL(IP2SR7_3_0, AVB0_MII_TX_EN, SEL_AVB0_TX_CTL_0), ++ PINMUX_IPSR_GPSR(IP2SR7_3_0, AVB0_TX_CTL), ++ PINMUX_IPSR_GPSR(IP2SR7_3_0, AVB0_MII_TX_EN), + + PINMUX_IPSR_GPSR(IP2SR7_7_4, AVB0_RD1), + PINMUX_IPSR_GPSR(IP2SR7_7_4, AVB0_MII_RD1), +@@ -3641,50 +3612,6 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + + #define F_(x, y) x, + #define FM(x) FN_##x, +- { PINMUX_CFG_REG_VAR("MOD_SEL6", 0xE6061100, 32, +- GROUP(-13, 1, -1, 1, -2, 1, 1, +- -1, 1, -2, 1, 1, 1, -2, 1, 1, -1), +- GROUP( +- /* RESERVED 31-19 */ +- MOD_SEL6_18 +- /* RESERVED 17 */ +- MOD_SEL6_16 +- /* RESERVED 15-14 */ +- MOD_SEL6_13 +- MOD_SEL6_12 +- /* RESERVED 11 */ +- MOD_SEL6_10 +- /* RESERVED 9-8 */ +- MOD_SEL6_7 +- MOD_SEL6_6 +- MOD_SEL6_5 +- /* RESERVED 4-3 */ +- MOD_SEL6_2 +- MOD_SEL6_1 +- /* RESERVED 0 */ +- )) +- }, +- { PINMUX_CFG_REG_VAR("MOD_SEL7", 0xE6061900, 32, +- GROUP(-15, 1, 1, -1, 1, -1, 1, 1, -2, 1, 1, +- -2, 1, 1, -1, 1), +- GROUP( +- /* RESERVED 31-17 */ +- MOD_SEL7_16 +- MOD_SEL7_15 +- /* RESERVED 14 */ +- MOD_SEL7_13 +- /* RESERVED 12 */ +- MOD_SEL7_11 +- MOD_SEL7_10 +- /* RESERVED 9-8 */ +- MOD_SEL7_7 +- MOD_SEL7_6 +- /* RESERVED 5-4 */ +- MOD_SEL7_3 +- MOD_SEL7_2 +- /* RESERVED 1 */ +- MOD_SEL7_0)) +- }, + { PINMUX_CFG_REG_VAR("MOD_SEL8", 0xE6068100, 32, + GROUP(-20, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1), + GROUP( +-- +2.39.2 + diff --git a/queue-6.2/platform-chrome-cros_typec_switch-add-missing-fwnode.patch b/queue-6.2/platform-chrome-cros_typec_switch-add-missing-fwnode.patch new file mode 100644 index 00000000000..451aafb5746 --- /dev/null +++ b/queue-6.2/platform-chrome-cros_typec_switch-add-missing-fwnode.patch @@ -0,0 +1,37 @@ +From 9f929971597f1dd5ca041e4941daf69c0067bfd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 12:16:57 +0800 +Subject: platform/chrome: cros_typec_switch: Add missing fwnode_handle_put() + +From: Liang He + +[ Upstream commit dc70234c408c644505a24362b0f095f713e4697e ] + +In cros_typec_register_switches(), we should add fwnode_handle_put() +when break out of the iteration device_for_each_child_node() +as it will automatically increase and decrease the refcounter. + +Fixes: affc804c44c8 ("platform/chrome: cros_typec_switch: Add switch driver") +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20230322041657.1857001-1-windhl@126.com +Signed-off-by: Prashant Malani +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_typec_switch.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/chrome/cros_typec_switch.c b/drivers/platform/chrome/cros_typec_switch.c +index a26219e97c931..26af51952f7f1 100644 +--- a/drivers/platform/chrome/cros_typec_switch.c ++++ b/drivers/platform/chrome/cros_typec_switch.c +@@ -268,6 +268,7 @@ static int cros_typec_register_switches(struct cros_typec_switch_data *sdata) + + return 0; + err_switch: ++ fwnode_handle_put(fwnode); + cros_typec_unregister_switches(sdata); + return ret; + } +-- +2.39.2 + diff --git a/queue-6.2/platform-provide-a-remove-callback-that-returns-no-v.patch b/queue-6.2/platform-provide-a-remove-callback-that-returns-no-v.patch new file mode 100644 index 00000000000..8f74e2071e7 --- /dev/null +++ b/queue-6.2/platform-provide-a-remove-callback-that-returns-no-v.patch @@ -0,0 +1,86 @@ +From 45f22ae52663715080359693d6df9f592ff90997 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Dec 2022 16:09:14 +0100 +Subject: platform: Provide a remove callback that returns no value +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 5c5a7680e67ba6fbbb5f4d79fa41485450c1985c ] + +struct platform_driver::remove returning an integer made driver authors +expect that returning an error code was proper error handling. However +the driver core ignores the error and continues to remove the device +because there is nothing the core could do anyhow and reentering the +remove callback again is only calling for trouble. + +So this is an source for errors typically yielding resource leaks in the +error path. + +As there are too many platform drivers to neatly convert them all to +return void in a single go, do it in several steps after this patch: + + a) Convert all drivers to implement .remove_new() returning void instead + of .remove() returning int; + b) Change struct platform_driver::remove() to return void and so make + it identical to .remove_new(); + c) Change all drivers back to .remove() now with the better prototype; + d) drop struct platform_driver::remove_new(). + +While this touches all drivers eventually twice, steps a) and c) can be +done one driver after another and so reduces coordination efforts +immensely and simplifies review. + +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20221209150914.3557650-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function") +Signed-off-by: Sasha Levin +--- + drivers/base/platform.c | 4 +++- + include/linux/platform_device.h | 11 +++++++++++ + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/platform.c b/drivers/base/platform.c +index 968f3d71eeab2..a4938d1c8fe1d 100644 +--- a/drivers/base/platform.c ++++ b/drivers/base/platform.c +@@ -1416,7 +1416,9 @@ static void platform_remove(struct device *_dev) + struct platform_driver *drv = to_platform_driver(_dev->driver); + struct platform_device *dev = to_platform_device(_dev); + +- if (drv->remove) { ++ if (drv->remove_new) { ++ drv->remove_new(dev); ++ } else if (drv->remove) { + int ret = drv->remove(dev); + + if (ret) +diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h +index b0d5a253156ec..b845fd83f429b 100644 +--- a/include/linux/platform_device.h ++++ b/include/linux/platform_device.h +@@ -207,7 +207,18 @@ extern void platform_device_put(struct platform_device *pdev); + + struct platform_driver { + int (*probe)(struct platform_device *); ++ ++ /* ++ * Traditionally the remove callback returned an int which however is ++ * ignored by the driver core. This led to wrong expectations by driver ++ * authors who thought returning an error code was a valid error ++ * handling strategy. To convert to a callback returning void, new ++ * drivers should implement .remove_new() until the conversion it done ++ * that eventually makes .remove() return void. ++ */ + int (*remove)(struct platform_device *); ++ void (*remove_new)(struct platform_device *); ++ + void (*shutdown)(struct platform_device *); + int (*suspend)(struct platform_device *, pm_message_t state); + int (*resume)(struct platform_device *); +-- +2.39.2 + diff --git a/queue-6.2/platform-x86-amd-pmc-don-t-dump-data-after-resume-fr.patch b/queue-6.2/platform-x86-amd-pmc-don-t-dump-data-after-resume-fr.patch new file mode 100644 index 00000000000..2a364df8bdb --- /dev/null +++ b/queue-6.2/platform-x86-amd-pmc-don-t-dump-data-after-resume-fr.patch @@ -0,0 +1,55 @@ +From 331db576bf69427351d9f7b9396619950a77e295 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 00:23:43 +0530 +Subject: platform/x86/amd: pmc: Don't dump data after resume from s0i3 on + picasso + +From: Mario Limonciello + +[ Upstream commit 7abc3618b65304d409d9489d77e4a8f047842fb7 ] + +This command isn't supported on Picasso, so guard against running it +to avoid errors like `SMU cmd unknown. err: 0xfe` in the logs. + +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2449 +Fixes: 766205674962 ("platform/x86: amd-pmc: Add support for logging SMU metrics") +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20230409185348.556161-4-Shyam-sundar.S-k@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c +index bc8397635428e..976bd01644a5e 100644 +--- a/drivers/platform/x86/amd/pmc.c ++++ b/drivers/platform/x86/amd/pmc.c +@@ -809,6 +809,14 @@ static void amd_pmc_s2idle_check(void) + dev_err(pdev->dev, "error writing to STB: %d\n", rc); + } + ++static int amd_pmc_dump_data(struct amd_pmc_dev *pdev) ++{ ++ if (pdev->cpu_id == AMD_CPU_ID_PCO) ++ return -ENODEV; ++ ++ return amd_pmc_send_cmd(pdev, 0, NULL, SMU_MSG_LOG_DUMP_DATA, 0); ++} ++ + static void amd_pmc_s2idle_restore(void) + { + struct amd_pmc_dev *pdev = &pmc; +@@ -821,7 +829,7 @@ static void amd_pmc_s2idle_restore(void) + dev_err(pdev->dev, "resume failed: %d\n", rc); + + /* Let SMU know that we are looking for stats */ +- amd_pmc_send_cmd(pdev, 0, NULL, SMU_MSG_LOG_DUMP_DATA, 0); ++ amd_pmc_dump_data(pdev); + + rc = amd_pmc_write_stb(pdev, AMD_PMC_STB_S2IDLE_RESTORE); + if (rc) +-- +2.39.2 + diff --git a/queue-6.2/platform-x86-amd-pmc-don-t-try-to-read-smu-version-o.patch b/queue-6.2/platform-x86-amd-pmc-don-t-try-to-read-smu-version-o.patch new file mode 100644 index 00000000000..601903d472a --- /dev/null +++ b/queue-6.2/platform-x86-amd-pmc-don-t-try-to-read-smu-version-o.patch @@ -0,0 +1,40 @@ +From b6a8d8524b2994f1d9ebe92175b36dc5ee31cc26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 00:23:41 +0530 +Subject: platform/x86/amd: pmc: Don't try to read SMU version on Picasso + +From: Mario Limonciello + +[ Upstream commit b845772677ea19b8e4c032bc07393ef32de4ee39 ] + +Picasso doesn't support the command in the uPEP mailbox to try to +read the SMU version. + +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2449 +Fixes: f6045de1f532 ("platform/x86: amd-pmc: Export Idlemask values based on the APU") +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20230409185348.556161-2-Shyam-sundar.S-k@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c +index 3cbb01ec10e32..0553a6419bb90 100644 +--- a/drivers/platform/x86/amd/pmc.c ++++ b/drivers/platform/x86/amd/pmc.c +@@ -377,6 +377,9 @@ static int amd_pmc_get_smu_version(struct amd_pmc_dev *dev) + int rc; + u32 val; + ++ if (dev->cpu_id == AMD_CPU_ID_PCO) ++ return -ENODEV; ++ + rc = amd_pmc_send_cmd(dev, 0, &val, SMU_MSG_GETSMUVERSION, 1); + if (rc) + return rc; +-- +2.39.2 + diff --git a/queue-6.2/platform-x86-amd-pmc-hide-smu-version-and-program-at.patch b/queue-6.2/platform-x86-amd-pmc-hide-smu-version-and-program-at.patch new file mode 100644 index 00000000000..63ff5657990 --- /dev/null +++ b/queue-6.2/platform-x86-amd-pmc-hide-smu-version-and-program-at.patch @@ -0,0 +1,64 @@ +From 1a6ac61f64bc1fc287f4a8c16e817f56ba861f0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 00:23:42 +0530 +Subject: platform/x86/amd: pmc: Hide SMU version and program attributes for + Picasso + +From: Mario Limonciello + +[ Upstream commit 5ec9ee0d464750d72972d5685edf675824e259a1 ] + +As the command to get version isn't supported on Picasso, we shouldn't +be exposing this into sysfs either. + +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2449 +Fixes: 7f1ea75d499a ("platform/x86/amd: pmc: Add sysfs files for SMU") +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20230409185348.556161-3-Shyam-sundar.S-k@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c +index 0553a6419bb90..bc8397635428e 100644 +--- a/drivers/platform/x86/amd/pmc.c ++++ b/drivers/platform/x86/amd/pmc.c +@@ -426,12 +426,31 @@ static ssize_t smu_program_show(struct device *d, struct device_attribute *attr, + static DEVICE_ATTR_RO(smu_fw_version); + static DEVICE_ATTR_RO(smu_program); + ++static umode_t pmc_attr_is_visible(struct kobject *kobj, struct attribute *attr, int idx) ++{ ++ struct device *dev = kobj_to_dev(kobj); ++ struct amd_pmc_dev *pdev = dev_get_drvdata(dev); ++ ++ if (pdev->cpu_id == AMD_CPU_ID_PCO) ++ return 0; ++ return 0444; ++} ++ + static struct attribute *pmc_attrs[] = { + &dev_attr_smu_fw_version.attr, + &dev_attr_smu_program.attr, + NULL, + }; +-ATTRIBUTE_GROUPS(pmc); ++ ++static struct attribute_group pmc_attr_group = { ++ .attrs = pmc_attrs, ++ .is_visible = pmc_attr_is_visible, ++}; ++ ++static const struct attribute_group *pmc_groups[] = { ++ &pmc_attr_group, ++ NULL, ++}; + + static int smu_fw_info_show(struct seq_file *s, void *unused) + { +-- +2.39.2 + diff --git a/queue-6.2/platform-x86-amd-pmc-move-idlemask-check-into-amd_pm.patch b/queue-6.2/platform-x86-amd-pmc-move-idlemask-check-into-amd_pm.patch new file mode 100644 index 00000000000..5fd184da447 --- /dev/null +++ b/queue-6.2/platform-x86-amd-pmc-move-idlemask-check-into-amd_pm.patch @@ -0,0 +1,130 @@ +From f1231be71a81a7d242fe9fb53f574eeb5f45f2e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 00:23:44 +0530 +Subject: platform/x86/amd: pmc: Move idlemask check into + `amd_pmc_idlemask_read` + +From: Mario Limonciello + +[ Upstream commit 9217bd1d7699f34a01b26ba14ff38c1714ce1185 ] + +The version check requirement for idle mask support actually only +applies to RN/CZN/BRC platforms. + +So far no issues have happened because the PMFW version string is +bigger on other supported systems. This can be reset for any new platform +so move the check to only RN/CZN/BRC case. + +Fixes: f6045de1f532 ("platform/x86: amd-pmc: Export Idlemask values based on the APU") +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20230409185348.556161-5-Shyam-sundar.S-k@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc.c | 74 +++++++++++++++------------------- + 1 file changed, 33 insertions(+), 41 deletions(-) + +diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c +index 976bd01644a5e..52f5b54ba5d6f 100644 +--- a/drivers/platform/x86/amd/pmc.c ++++ b/drivers/platform/x86/amd/pmc.c +@@ -314,33 +314,6 @@ static int amd_pmc_setup_smu_logging(struct amd_pmc_dev *dev) + return 0; + } + +-static int amd_pmc_idlemask_read(struct amd_pmc_dev *pdev, struct device *dev, +- struct seq_file *s) +-{ +- u32 val; +- +- switch (pdev->cpu_id) { +- case AMD_CPU_ID_CZN: +- val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_CZN); +- break; +- case AMD_CPU_ID_YC: +- case AMD_CPU_ID_CB: +- case AMD_CPU_ID_PS: +- val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_YC); +- break; +- default: +- return -EINVAL; +- } +- +- if (dev) +- dev_dbg(pdev->dev, "SMU idlemask s0i3: 0x%x\n", val); +- +- if (s) +- seq_printf(s, "SMU idlemask : 0x%x\n", val); +- +- return 0; +-} +- + static int get_metrics_table(struct amd_pmc_dev *pdev, struct smu_metrics *table) + { + if (!pdev->smu_virt_addr) { +@@ -517,28 +490,47 @@ static int s0ix_stats_show(struct seq_file *s, void *unused) + } + DEFINE_SHOW_ATTRIBUTE(s0ix_stats); + +-static int amd_pmc_idlemask_show(struct seq_file *s, void *unused) ++static int amd_pmc_idlemask_read(struct amd_pmc_dev *pdev, struct device *dev, ++ struct seq_file *s) + { +- struct amd_pmc_dev *dev = s->private; ++ u32 val; + int rc; + +- /* we haven't yet read SMU version */ +- if (!dev->major) { +- rc = amd_pmc_get_smu_version(dev); +- if (rc) +- return rc; ++ switch (pdev->cpu_id) { ++ case AMD_CPU_ID_CZN: ++ /* we haven't yet read SMU version */ ++ if (!pdev->major) { ++ rc = amd_pmc_get_smu_version(pdev); ++ if (rc) ++ return rc; ++ } ++ if (pdev->major > 56 || (pdev->major >= 55 && pdev->minor >= 37)) ++ val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_CZN); ++ else ++ return -EINVAL; ++ break; ++ case AMD_CPU_ID_YC: ++ case AMD_CPU_ID_CB: ++ case AMD_CPU_ID_PS: ++ val = amd_pmc_reg_read(pdev, AMD_PMC_SCRATCH_REG_YC); ++ break; ++ default: ++ return -EINVAL; + } + +- if (dev->major > 56 || (dev->major >= 55 && dev->minor >= 37)) { +- rc = amd_pmc_idlemask_read(dev, NULL, s); +- if (rc) +- return rc; +- } else { +- seq_puts(s, "Unsupported SMU version for Idlemask\n"); +- } ++ if (dev) ++ dev_dbg(pdev->dev, "SMU idlemask s0i3: 0x%x\n", val); ++ ++ if (s) ++ seq_printf(s, "SMU idlemask : 0x%x\n", val); + + return 0; + } ++ ++static int amd_pmc_idlemask_show(struct seq_file *s, void *unused) ++{ ++ return amd_pmc_idlemask_read(s->private, NULL, s); ++} + DEFINE_SHOW_ATTRIBUTE(amd_pmc_idlemask); + + static void amd_pmc_dbgfs_unregister(struct amd_pmc_dev *dev) +-- +2.39.2 + diff --git a/queue-6.2/platform-x86-amd-pmc-move-out-of-bios-smn-pair-for-s.patch b/queue-6.2/platform-x86-amd-pmc-move-out-of-bios-smn-pair-for-s.patch new file mode 100644 index 00000000000..5ad6fd7aecd --- /dev/null +++ b/queue-6.2/platform-x86-amd-pmc-move-out-of-bios-smn-pair-for-s.patch @@ -0,0 +1,86 @@ +From 72c29f53e95ef7a6a99d4bc99628dfd7b3caa3e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 00:23:46 +0530 +Subject: platform/x86/amd: pmc: Move out of BIOS SMN pair for STB init + +From: Shyam Sundar S K + +[ Upstream commit 8d99129eef8f42377b41c1bacee9f8ce806e9f44 ] + +The current SMN index used for the driver probe seems to be meant +for the BIOS pair and there are potential concurrency problems that can +occur with an inopportune SMI. + +It is been advised to use SMN_INDEX_0 instead of SMN_INDEX_6, which is +what amd_nb.c provides and this function has protections to ensure that +only one caller can use it at a time. + +Fixes: 426c0ff27b83 ("platform/x86: amd-pmc: Add support for AMD Smart Trace Buffer") +Co-developed-by: Sanket Goswami +Signed-off-by: Sanket Goswami +Signed-off-by: Shyam Sundar S K +Link: https://lore.kernel.org/r/20230409185348.556161-7-Shyam-sundar.S-k@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc.c | 26 ++++---------------------- + 1 file changed, 4 insertions(+), 22 deletions(-) + +diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c +index f8ef1fa742718..45b0050dfbf7b 100644 +--- a/drivers/platform/x86/amd/pmc.c ++++ b/drivers/platform/x86/amd/pmc.c +@@ -38,8 +38,6 @@ + #define AMD_PMC_SCRATCH_REG_YC 0xD14 + + /* STB Registers */ +-#define AMD_PMC_STB_INDEX_ADDRESS 0xF8 +-#define AMD_PMC_STB_INDEX_DATA 0xFC + #define AMD_PMC_STB_PMI_0 0x03E30600 + #define AMD_PMC_STB_S2IDLE_PREPARE 0xC6000001 + #define AMD_PMC_STB_S2IDLE_RESTORE 0xC6000002 +@@ -901,17 +899,9 @@ static int amd_pmc_write_stb(struct amd_pmc_dev *dev, u32 data) + { + int err; + +- err = pci_write_config_dword(dev->rdev, AMD_PMC_STB_INDEX_ADDRESS, AMD_PMC_STB_PMI_0); ++ err = amd_smn_write(0, AMD_PMC_STB_PMI_0, data); + if (err) { +- dev_err(dev->dev, "failed to write addr in stb: 0x%X\n", +- AMD_PMC_STB_INDEX_ADDRESS); +- return pcibios_err_to_errno(err); +- } +- +- err = pci_write_config_dword(dev->rdev, AMD_PMC_STB_INDEX_DATA, data); +- if (err) { +- dev_err(dev->dev, "failed to write data in stb: 0x%X\n", +- AMD_PMC_STB_INDEX_DATA); ++ dev_err(dev->dev, "failed to write data in stb: 0x%X\n", AMD_PMC_STB_PMI_0); + return pcibios_err_to_errno(err); + } + +@@ -923,18 +913,10 @@ static int amd_pmc_read_stb(struct amd_pmc_dev *dev, u32 *buf) + { + int i, err; + +- err = pci_write_config_dword(dev->rdev, AMD_PMC_STB_INDEX_ADDRESS, AMD_PMC_STB_PMI_0); +- if (err) { +- dev_err(dev->dev, "error writing addr to stb: 0x%X\n", +- AMD_PMC_STB_INDEX_ADDRESS); +- return pcibios_err_to_errno(err); +- } +- + for (i = 0; i < FIFO_SIZE; i++) { +- err = pci_read_config_dword(dev->rdev, AMD_PMC_STB_INDEX_DATA, buf++); ++ err = amd_smn_read(0, AMD_PMC_STB_PMI_0, buf++); + if (err) { +- dev_err(dev->dev, "error reading data from stb: 0x%X\n", +- AMD_PMC_STB_INDEX_DATA); ++ dev_err(dev->dev, "error reading data from stb: 0x%X\n", AMD_PMC_STB_PMI_0); + return pcibios_err_to_errno(err); + } + } +-- +2.39.2 + diff --git a/queue-6.2/platform-x86-amd-pmc-utilize-smn-index-0-for-driver-.patch b/queue-6.2/platform-x86-amd-pmc-utilize-smn-index-0-for-driver-.patch new file mode 100644 index 00000000000..ce56618e141 --- /dev/null +++ b/queue-6.2/platform-x86-amd-pmc-utilize-smn-index-0-for-driver-.patch @@ -0,0 +1,102 @@ +From 9851341af34f85762dcbfdde46d8abdb83f3eebf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 00:23:45 +0530 +Subject: platform/x86/amd: pmc: Utilize SMN index 0 for driver probe + +From: Shyam Sundar S K + +[ Upstream commit 310e782a99c7f16fb533a45d8f9c16defefa5aab ] + +The current SMN index used for the driver probe seems to be meant +for the BIOS pair and there are potential concurrency problems that can +occur with an inopportune SMI. + +It is been advised to use SMN_INDEX_0 instead of SMN_INDEX_2, which is +what amd_nb.c provides and this function has protections to ensure that +only one caller can use it at a time. + +Fixes: 156ec4731cb2 ("platform/x86: amd-pmc: Add AMD platform support for S2Idle") +Co-developed-by: Sanket Goswami +Signed-off-by: Sanket Goswami +Signed-off-by: Shyam Sundar S K +Link: https://lore.kernel.org/r/20230409185348.556161-6-Shyam-sundar.S-k@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/Kconfig | 2 +- + drivers/platform/x86/amd/pmc.c | 23 +++++------------------ + 2 files changed, 6 insertions(+), 19 deletions(-) + +diff --git a/drivers/platform/x86/amd/Kconfig b/drivers/platform/x86/amd/Kconfig +index 2ce8cb2170dfc..d9685aef0887d 100644 +--- a/drivers/platform/x86/amd/Kconfig ++++ b/drivers/platform/x86/amd/Kconfig +@@ -7,7 +7,7 @@ source "drivers/platform/x86/amd/pmf/Kconfig" + + config AMD_PMC + tristate "AMD SoC PMC driver" +- depends on ACPI && PCI && RTC_CLASS ++ depends on ACPI && PCI && RTC_CLASS && AMD_NB + select SERIO + help + The driver provides support for AMD Power Management Controller +diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c +index 52f5b54ba5d6f..f8ef1fa742718 100644 +--- a/drivers/platform/x86/amd/pmc.c ++++ b/drivers/platform/x86/amd/pmc.c +@@ -10,6 +10,7 @@ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#include + #include + #include + #include +@@ -55,8 +56,6 @@ + #define S2D_TELEMETRY_DRAMBYTES_MAX 0x1000000 + + /* Base address of SMU for mapping physical address to virtual address */ +-#define AMD_PMC_SMU_INDEX_ADDRESS 0xB8 +-#define AMD_PMC_SMU_INDEX_DATA 0xBC + #define AMD_PMC_MAPPING_SIZE 0x01000 + #define AMD_PMC_BASE_ADDR_OFFSET 0x10000 + #define AMD_PMC_BASE_ADDR_LO 0x13B102E8 +@@ -962,30 +961,18 @@ static int amd_pmc_probe(struct platform_device *pdev) + + dev->cpu_id = rdev->device; + dev->rdev = rdev; +- err = pci_write_config_dword(rdev, AMD_PMC_SMU_INDEX_ADDRESS, AMD_PMC_BASE_ADDR_LO); +- if (err) { +- dev_err(dev->dev, "error writing to 0x%x\n", AMD_PMC_SMU_INDEX_ADDRESS); +- err = pcibios_err_to_errno(err); +- goto err_pci_dev_put; +- } +- +- err = pci_read_config_dword(rdev, AMD_PMC_SMU_INDEX_DATA, &val); ++ err = amd_smn_read(0, AMD_PMC_BASE_ADDR_LO, &val); + if (err) { ++ dev_err(dev->dev, "error reading 0x%x\n", AMD_PMC_BASE_ADDR_LO); + err = pcibios_err_to_errno(err); + goto err_pci_dev_put; + } + + base_addr_lo = val & AMD_PMC_BASE_ADDR_HI_MASK; + +- err = pci_write_config_dword(rdev, AMD_PMC_SMU_INDEX_ADDRESS, AMD_PMC_BASE_ADDR_HI); +- if (err) { +- dev_err(dev->dev, "error writing to 0x%x\n", AMD_PMC_SMU_INDEX_ADDRESS); +- err = pcibios_err_to_errno(err); +- goto err_pci_dev_put; +- } +- +- err = pci_read_config_dword(rdev, AMD_PMC_SMU_INDEX_DATA, &val); ++ err = amd_smn_read(0, AMD_PMC_BASE_ADDR_HI, &val); + if (err) { ++ dev_err(dev->dev, "error reading 0x%x\n", AMD_PMC_BASE_ADDR_HI); + err = pcibios_err_to_errno(err); + goto err_pci_dev_put; + } +-- +2.39.2 + diff --git a/queue-6.2/platform-x86-amd-pmf-move-out-of-bios-smn-pair-for-d.patch b/queue-6.2/platform-x86-amd-pmf-move-out-of-bios-smn-pair-for-d.patch new file mode 100644 index 00000000000..61f2834f441 --- /dev/null +++ b/queue-6.2/platform-x86-amd-pmf-move-out-of-bios-smn-pair-for-d.patch @@ -0,0 +1,101 @@ +From b4f84eed6d3d71a36cd5cb1f774a80bc4e0477f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 22:18:07 +0530 +Subject: platform/x86/amd/pmf: Move out of BIOS SMN pair for driver probe + +From: Shyam Sundar S K + +[ Upstream commit aec8298c093f052fc8a86f9411b69b23953b0edb ] + +The current SMN index used for the driver probe seems to be meant +for the BIOS pair and there are potential concurrency problems that can +occur with an inopportune SMI. + +It is been advised to use SMN_INDEX_0 instead of SMN_INDEX_2, which is +what amd_nb.c provides and this function has protections to ensure that +only one caller can use it at a time. + +Fixes: da5ce22df5fe ("platform/x86/amd/pmf: Add support for PMF core layer") +Co-developed-by: Patil Rajesh Reddy +Signed-off-by: Patil Rajesh Reddy +Signed-off-by: Shyam Sundar S K +Link: https://lore.kernel.org/r/20230406164807.50969-4-Shyam-sundar.S-k@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/Kconfig | 1 + + drivers/platform/x86/amd/pmf/core.c | 22 +++++----------------- + 2 files changed, 6 insertions(+), 17 deletions(-) + +diff --git a/drivers/platform/x86/amd/pmf/Kconfig b/drivers/platform/x86/amd/pmf/Kconfig +index 6d89528c31779..d87986adf91e1 100644 +--- a/drivers/platform/x86/amd/pmf/Kconfig ++++ b/drivers/platform/x86/amd/pmf/Kconfig +@@ -7,6 +7,7 @@ config AMD_PMF + tristate "AMD Platform Management Framework" + depends on ACPI && PCI + depends on POWER_SUPPLY ++ depends on AMD_NB + select ACPI_PLATFORM_PROFILE + help + This driver provides support for the AMD Platform Management Framework. +diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c +index da23639071d79..0acc0b6221290 100644 +--- a/drivers/platform/x86/amd/pmf/core.c ++++ b/drivers/platform/x86/amd/pmf/core.c +@@ -8,6 +8,7 @@ + * Author: Shyam Sundar S K + */ + ++#include + #include + #include + #include +@@ -22,8 +23,6 @@ + #define AMD_PMF_REGISTER_ARGUMENT 0xA58 + + /* Base address of SMU for mapping physical address to virtual address */ +-#define AMD_PMF_SMU_INDEX_ADDRESS 0xB8 +-#define AMD_PMF_SMU_INDEX_DATA 0xBC + #define AMD_PMF_MAPPING_SIZE 0x01000 + #define AMD_PMF_BASE_ADDR_OFFSET 0x10000 + #define AMD_PMF_BASE_ADDR_LO 0x13B102E8 +@@ -348,30 +347,19 @@ static int amd_pmf_probe(struct platform_device *pdev) + } + + dev->cpu_id = rdev->device; +- err = pci_write_config_dword(rdev, AMD_PMF_SMU_INDEX_ADDRESS, AMD_PMF_BASE_ADDR_LO); +- if (err) { +- dev_err(dev->dev, "error writing to 0x%x\n", AMD_PMF_SMU_INDEX_ADDRESS); +- pci_dev_put(rdev); +- return pcibios_err_to_errno(err); +- } + +- err = pci_read_config_dword(rdev, AMD_PMF_SMU_INDEX_DATA, &val); ++ err = amd_smn_read(0, AMD_PMF_BASE_ADDR_LO, &val); + if (err) { ++ dev_err(dev->dev, "error in reading from 0x%x\n", AMD_PMF_BASE_ADDR_LO); + pci_dev_put(rdev); + return pcibios_err_to_errno(err); + } + + base_addr_lo = val & AMD_PMF_BASE_ADDR_HI_MASK; + +- err = pci_write_config_dword(rdev, AMD_PMF_SMU_INDEX_ADDRESS, AMD_PMF_BASE_ADDR_HI); +- if (err) { +- dev_err(dev->dev, "error writing to 0x%x\n", AMD_PMF_SMU_INDEX_ADDRESS); +- pci_dev_put(rdev); +- return pcibios_err_to_errno(err); +- } +- +- err = pci_read_config_dword(rdev, AMD_PMF_SMU_INDEX_DATA, &val); ++ err = amd_smn_read(0, AMD_PMF_BASE_ADDR_HI, &val); + if (err) { ++ dev_err(dev->dev, "error in reading from 0x%x\n", AMD_PMF_BASE_ADDR_HI); + pci_dev_put(rdev); + return pcibios_err_to_errno(err); + } +-- +2.39.2 + diff --git a/queue-6.2/pm-hibernate-do-not-get-block-device-exclusively-in-.patch b/queue-6.2/pm-hibernate-do-not-get-block-device-exclusively-in-.patch new file mode 100644 index 00000000000..7907c4f6024 --- /dev/null +++ b/queue-6.2/pm-hibernate-do-not-get-block-device-exclusively-in-.patch @@ -0,0 +1,138 @@ +From 8778927a9203ecd2f737ae0e7d95be8d38a49843 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 20:10:42 +0800 +Subject: PM: hibernate: Do not get block device exclusively in test_resume + mode + +From: Chen Yu + +[ Upstream commit 5904de0d735bbb3b4afe9375c5b4f9748f882945 ] + +The system refused to do a test_resume because it found that the +swap device has already been taken by someone else. Specifically, +the swsusp_check()->blkdev_get_by_dev(FMODE_EXCL) is supposed to +do this check. + +Steps to reproduce: + dd if=/dev/zero of=/swapfile bs=$(cat /proc/meminfo | + awk '/MemTotal/ {print $2}') count=1024 conv=notrunc + mkswap /swapfile + swapon /swapfile + swap-offset /swapfile + echo 34816 > /sys/power/resume_offset + echo test_resume > /sys/power/disk + echo disk > /sys/power/state + + PM: Using 3 thread(s) for compression + PM: Compressing and saving image data (293150 pages)... + PM: Image saving progress: 0% + PM: Image saving progress: 10% + ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300) + ata1.00: configured for UDMA/100 + ata2: SATA link down (SStatus 0 SControl 300) + ata5: SATA link down (SStatus 0 SControl 300) + ata6: SATA link down (SStatus 0 SControl 300) + ata3: SATA link down (SStatus 0 SControl 300) + ata4: SATA link down (SStatus 0 SControl 300) + PM: Image saving progress: 20% + PM: Image saving progress: 30% + PM: Image saving progress: 40% + PM: Image saving progress: 50% + pcieport 0000:00:02.5: pciehp: Slot(0-5): No device found + PM: Image saving progress: 60% + PM: Image saving progress: 70% + PM: Image saving progress: 80% + PM: Image saving progress: 90% + PM: Image saving done + PM: hibernation: Wrote 1172600 kbytes in 2.70 seconds (434.29 MB/s) + PM: S| + PM: hibernation: Basic memory bitmaps freed + PM: Image not found (code -16) + +This is because when using the swapfile as the hibernation storage, +the block device where the swapfile is located has already been mounted +by the OS distribution(usually mounted as the rootfs). This is not +an issue for normal hibernation, because software_resume()->swsusp_check() +happens before the block device(rootfs) mount. But it is a problem for the +test_resume mode. Because when test_resume happens, the block device has +been mounted already. + +Thus remove the FMODE_EXCL for test_resume mode. This would not be a +problem because in test_resume stage, the processes have already been +frozen, and the race condition described in +Commit 39fbef4b0f77 ("PM: hibernate: Get block device exclusively in swsusp_check()") +is unlikely to happen. + +Fixes: 39fbef4b0f77 ("PM: hibernate: Get block device exclusively in swsusp_check()") +Reported-by: Yifan Li +Suggested-by: Pavankumar Kondeti +Tested-by: Pavankumar Kondeti +Tested-by: Wendy Wang +Signed-off-by: Chen Yu +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/hibernate.c | 8 ++++++-- + kernel/power/swap.c | 8 ++++++-- + 2 files changed, 12 insertions(+), 4 deletions(-) + +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index aa551b093c3f6..30d1274f03f62 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -688,18 +688,22 @@ static int load_image_and_restore(void) + { + int error; + unsigned int flags; ++ fmode_t mode = FMODE_READ; ++ ++ if (snapshot_test) ++ mode |= FMODE_EXCL; + + pm_pr_dbg("Loading hibernation image.\n"); + + lock_device_hotplug(); + error = create_basic_memory_bitmaps(); + if (error) { +- swsusp_close(FMODE_READ | FMODE_EXCL); ++ swsusp_close(mode); + goto Unlock; + } + + error = swsusp_read(&flags); +- swsusp_close(FMODE_READ | FMODE_EXCL); ++ swsusp_close(mode); + if (!error) + error = hibernation_restore(flags & SF_PLATFORM_MODE); + +diff --git a/kernel/power/swap.c b/kernel/power/swap.c +index 277434b6c0bfd..cc44c37699de6 100644 +--- a/kernel/power/swap.c ++++ b/kernel/power/swap.c +@@ -1518,9 +1518,13 @@ int swsusp_check(void) + { + int error; + void *holder; ++ fmode_t mode = FMODE_READ; ++ ++ if (snapshot_test) ++ mode |= FMODE_EXCL; + + hib_resume_bdev = blkdev_get_by_dev(swsusp_resume_device, +- FMODE_READ | FMODE_EXCL, &holder); ++ mode, &holder); + if (!IS_ERR(hib_resume_bdev)) { + set_blocksize(hib_resume_bdev, PAGE_SIZE); + clear_page(swsusp_header); +@@ -1547,7 +1551,7 @@ int swsusp_check(void) + + put: + if (error) +- blkdev_put(hib_resume_bdev, FMODE_READ | FMODE_EXCL); ++ blkdev_put(hib_resume_bdev, mode); + else + pr_debug("Image signature found, resuming\n"); + } else { +-- +2.39.2 + diff --git a/queue-6.2/pm-hibernate-turn-snapshot_test-into-global-variable.patch b/queue-6.2/pm-hibernate-turn-snapshot_test-into-global-variable.patch new file mode 100644 index 00000000000..9751e7eb49a --- /dev/null +++ b/queue-6.2/pm-hibernate-turn-snapshot_test-into-global-variable.patch @@ -0,0 +1,78 @@ +From 96d9608b00d792bd96bb42b167f114d471f4baa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 20:10:26 +0800 +Subject: PM: hibernate: Turn snapshot_test into global variable + +From: Chen Yu + +[ Upstream commit 08169a162f97819d3e5b4a342bb9cf5137787154 ] + +There is need to check snapshot_test and open block device +in different mode, so as to avoid the race condition. + +No functional changes intended. + +Suggested-by: Pavankumar Kondeti +Signed-off-by: Chen Yu +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: 5904de0d735b ("PM: hibernate: Do not get block device exclusively in test_resume mode") +Signed-off-by: Sasha Levin +--- + kernel/power/hibernate.c | 7 ++++++- + kernel/power/power.h | 1 + + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index 793c55a2becba..aa551b093c3f6 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -64,6 +64,7 @@ enum { + static int hibernation_mode = HIBERNATION_SHUTDOWN; + + bool freezer_test_done; ++bool snapshot_test; + + static const struct platform_hibernation_ops *hibernation_ops; + +@@ -716,7 +717,6 @@ static int load_image_and_restore(void) + */ + int hibernate(void) + { +- bool snapshot_test = false; + unsigned int sleep_flags; + int error; + +@@ -744,6 +744,9 @@ int hibernate(void) + if (error) + goto Exit; + ++ /* protected by system_transition_mutex */ ++ snapshot_test = false; ++ + lock_device_hotplug(); + /* Allocate memory management structures */ + error = create_basic_memory_bitmaps(); +@@ -940,6 +943,8 @@ static int software_resume(void) + */ + mutex_lock_nested(&system_transition_mutex, SINGLE_DEPTH_NESTING); + ++ snapshot_test = false; ++ + if (swsusp_resume_device) + goto Check_image; + +diff --git a/kernel/power/power.h b/kernel/power/power.h +index b4f4339432096..b83c8d5e188de 100644 +--- a/kernel/power/power.h ++++ b/kernel/power/power.h +@@ -59,6 +59,7 @@ asmlinkage int swsusp_save(void); + + /* kernel/power/hibernate.c */ + extern bool freezer_test_done; ++extern bool snapshot_test; + + extern int hibernation_snapshot(int platform_mode); + extern int hibernation_restore(int platform_mode); +-- +2.39.2 + diff --git a/queue-6.2/power-supply-generic-adc-battery-fix-unit-scaling.patch b/queue-6.2/power-supply-generic-adc-battery-fix-unit-scaling.patch new file mode 100644 index 00000000000..993814c5546 --- /dev/null +++ b/queue-6.2/power-supply-generic-adc-battery-fix-unit-scaling.patch @@ -0,0 +1,42 @@ +From bbc7218a8e5e4570064881bbfb8c6ce127436f42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 23:56:57 +0100 +Subject: power: supply: generic-adc-battery: fix unit scaling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sebastian Reichel + +[ Upstream commit 44263f50065969f2344808388bd589740f026167 ] + +power-supply properties are reported in µV, µA and µW. +The IIO API provides mV, mA, mW, so the values need to +be multiplied by 1000. + +Fixes: e60fea794e6e ("power: battery: Generic battery driver using IIO") +Reviewed-by: Linus Walleij +Reviewed-by: Matti Vaittinen +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/generic-adc-battery.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c +index 66039c665dd1e..0af536f4932f1 100644 +--- a/drivers/power/supply/generic-adc-battery.c ++++ b/drivers/power/supply/generic-adc-battery.c +@@ -135,6 +135,9 @@ static int read_channel(struct gab *adc_bat, enum power_supply_property psp, + result); + if (ret < 0) + pr_err("read channel error\n"); ++ else ++ *result *= 1000; ++ + return ret; + } + +-- +2.39.2 + diff --git a/queue-6.2/power-supply-rk817-fix-low-soc-bugs.patch b/queue-6.2/power-supply-rk817-fix-low-soc-bugs.patch new file mode 100644 index 00000000000..b86c4eaa093 --- /dev/null +++ b/queue-6.2/power-supply-rk817-fix-low-soc-bugs.patch @@ -0,0 +1,125 @@ +From 50a519985bce3d9e64ec8bff1487d47b24077ed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 11:18:27 -0500 +Subject: power: supply: rk817: Fix low SOC bugs + +From: Chris Morgan + +[ Upstream commit baba1315a74d12772d4940a05d58dc03e6ec0635 ] + +When the SOC approaches zero, an integer overflows in the columb +counter causing the driver to react poorly. This makes the driver +think it's at (above) the fully charged capacity when in fact it's +zero. It would then write this full capacity to NVRAM which would be +used on boot if the device remained off for less than 5 hours and +not plugged in. + +This can be fixed and guarded against by doing the following: + - Changing the type of tmp in rk817_read_or_set_full_charge_on_boot() + to be an int instead of a u32. That way we can account for negative + numbers. + - Guard against negative values for the full charge on boot by setting + the charge to 0 if the system charge reports less than 0. + - Catch scenarios where the battery voltage is below the design + minimum voltage and set the system SOC to 0 at that time and update + the columb counter with a charge level of 0. + - Change the off time value from 5 hours to 30 minutes before we + recalculate the current capacity based on the OCV tables. + +These changes allow the driver to operate better at low voltage/low +capacity conditions. + +Fixes: 3268a4d9b0b8 ("power: supply: rk817: Fix unsigned comparison with less than zero") +Fixes: 11cb8da0189b ("power: supply: Add charger driver for Rockchip RK817") +Signed-off-by: Chris Morgan +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/rk817_charger.c | 33 ++++++++++++++++++++++------ + 1 file changed, 26 insertions(+), 7 deletions(-) + +diff --git a/drivers/power/supply/rk817_charger.c b/drivers/power/supply/rk817_charger.c +index 36f807b5ec442..f1b431aa0e4f2 100644 +--- a/drivers/power/supply/rk817_charger.c ++++ b/drivers/power/supply/rk817_charger.c +@@ -335,6 +335,20 @@ static int rk817_bat_calib_cap(struct rk817_charger *charger) + charger->fcc_mah * 1000); + } + ++ /* ++ * Set the SOC to 0 if we are below the minimum system voltage. ++ */ ++ if (volt_avg <= charger->bat_voltage_min_design_uv) { ++ charger->soc = 0; ++ charge_now_adc = CHARGE_TO_ADC(0, charger->res_div); ++ put_unaligned_be32(charge_now_adc, bulk_reg); ++ regmap_bulk_write(rk808->regmap, ++ RK817_GAS_GAUGE_Q_INIT_H3, bulk_reg, 4); ++ dev_warn(charger->dev, ++ "Battery voltage %d below minimum voltage %d\n", ++ volt_avg, charger->bat_voltage_min_design_uv); ++ } ++ + rk817_record_battery_nvram_values(charger); + + return 0; +@@ -710,9 +724,10 @@ static int rk817_read_battery_nvram_values(struct rk817_charger *charger) + + /* + * Read the nvram for state of charge. Sanity check for values greater +- * than 100 (10000). If the value is off it should get corrected +- * automatically when the voltage drops to the min (soc is 0) or when +- * the battery is full (soc is 100). ++ * than 100 (10000) or less than 0, because other things (BSP kernels, ++ * U-Boot, or even i2cset) can write to this register. If the value is ++ * off it should get corrected automatically when the voltage drops to ++ * the min (soc is 0) or when the battery is full (soc is 100). + */ + ret = regmap_bulk_read(charger->rk808->regmap, + RK817_GAS_GAUGE_BAT_R1, bulk_reg, 3); +@@ -721,6 +736,8 @@ static int rk817_read_battery_nvram_values(struct rk817_charger *charger) + charger->soc = get_unaligned_le24(bulk_reg); + if (charger->soc > 10000) + charger->soc = 10000; ++ if (charger->soc < 0) ++ charger->soc = 0; + + return 0; + } +@@ -731,8 +748,8 @@ rk817_read_or_set_full_charge_on_boot(struct rk817_charger *charger, + { + struct rk808 *rk808 = charger->rk808; + u8 bulk_reg[4]; +- u32 boot_voltage, boot_charge_mah, tmp; +- int ret, reg, off_time; ++ u32 boot_voltage, boot_charge_mah; ++ int ret, reg, off_time, tmp; + bool first_boot; + + /* +@@ -785,10 +802,12 @@ rk817_read_or_set_full_charge_on_boot(struct rk817_charger *charger, + regmap_bulk_read(rk808->regmap, RK817_GAS_GAUGE_Q_PRES_H3, + bulk_reg, 4); + tmp = get_unaligned_be32(bulk_reg); ++ if (tmp < 0) ++ tmp = 0; + boot_charge_mah = ADC_TO_CHARGE_UAH(tmp, + charger->res_div) / 1000; + /* +- * Check if the columb counter has been off for more than 300 ++ * Check if the columb counter has been off for more than 30 + * minutes as it tends to drift downward. If so, re-init soc + * with the boot voltage instead. Note the unit values for the + * OFF_CNT register appear to be in decaminutes and stops +@@ -799,7 +818,7 @@ rk817_read_or_set_full_charge_on_boot(struct rk817_charger *charger, + * than 0 on a reboot anyway. + */ + regmap_read(rk808->regmap, RK817_GAS_GAUGE_OFF_CNT, &off_time); +- if (off_time >= 30) { ++ if (off_time >= 3) { + regmap_bulk_read(rk808->regmap, + RK817_GAS_GAUGE_PWRON_VOL_H, + bulk_reg, 2); +-- +2.39.2 + diff --git a/queue-6.2/powerpc-mpc512x-fix-resource-printk-format-warning.patch b/queue-6.2/powerpc-mpc512x-fix-resource-printk-format-warning.patch new file mode 100644 index 00000000000..77b14ac8560 --- /dev/null +++ b/queue-6.2/powerpc-mpc512x-fix-resource-printk-format-warning.patch @@ -0,0 +1,46 @@ +From 3654c7abb0acea369dc50e30b195332cb205b82b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 23:01:13 -0800 +Subject: powerpc/mpc512x: fix resource printk format warning + +From: Randy Dunlap + +[ Upstream commit 7538c97e2b80ff6b7a8ea2ecf16a04355461b439 ] + +Use "%pa" format specifier for resource_size_t to avoid a compiler +printk format warning. + +../arch/powerpc/platforms/512x/clock-commonclk.c: In function 'mpc5121_clk_provide_backwards_compat': +../arch/powerpc/platforms/512x/clock-commonclk.c:989:44: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] + 989 | snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \ + | ^~~~~~~~~ ~~~~~~~~~ + | | + | resource_size_t {aka long long unsigned int} + +Prevents 24 such warnings. + +Fixes: 01f25c371658 ("clk: mpc512x: add backwards compat to the CCF code") +Signed-off-by: Randy Dunlap +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223070116.660-2-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/512x/clock-commonclk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/512x/clock-commonclk.c b/arch/powerpc/platforms/512x/clock-commonclk.c +index 42abeba4f6983..079cb3627eacd 100644 +--- a/arch/powerpc/platforms/512x/clock-commonclk.c ++++ b/arch/powerpc/platforms/512x/clock-commonclk.c +@@ -986,7 +986,7 @@ static void __init mpc5121_clk_provide_migration_support(void) + + #define NODE_PREP do { \ + of_address_to_resource(np, 0, &res); \ +- snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \ ++ snprintf(devname, sizeof(devname), "%pa.%s", &res.start, np->name); \ + } while (0) + + #define NODE_CHK(clkname, clkitem, regnode, regflag) do { \ +-- +2.39.2 + diff --git a/queue-6.2/powerpc-perf-properly-detect-mpc7450-family.patch b/queue-6.2/powerpc-perf-properly-detect-mpc7450-family.patch new file mode 100644 index 00000000000..869bfffeb04 --- /dev/null +++ b/queue-6.2/powerpc-perf-properly-detect-mpc7450-family.patch @@ -0,0 +1,71 @@ +From 0bbddeec6511ac1648cab82539038763299e4d8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 16:54:45 +0100 +Subject: powerpc/perf: Properly detect mpc7450 family + +From: Christophe Leroy + +[ Upstream commit e7299f961fe5e4496db0bfaa9e819f5e97f3846b ] + +Unlike PVR_POWER8, etc ...., PVR_7450 represents a full PVR +value and not a family value. + +To avoid confusion, do like E500 family and define the relevant +PVR_VER_xxxx values for the 7450 family: + 0x8000 ==> 7450 + 0x8001 ==> 7455 + 0x8002 ==> 7447 + 0x8003 ==> 7447A + 0x8004 ==> 7448 + +And use them to detect 7450 family for perf events. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Link: https://lore.kernel.org/r/202302260657.7dM9Uwev-lkp@intel.com/ +Fixes: ec3eb9d941a9 ("powerpc/perf: Use PVR rather than oprofile field to determine CPU version") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/99ca1da2e5a6cf82a8abf4bc034918e500e31781.1677513277.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/reg.h | 5 +++++ + arch/powerpc/perf/mpc7450-pmu.c | 6 +++--- + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h +index 1e8b2e04e626a..8fda87af2fa5e 100644 +--- a/arch/powerpc/include/asm/reg.h ++++ b/arch/powerpc/include/asm/reg.h +@@ -1310,6 +1310,11 @@ + #define PVR_VER_E500MC 0x8023 + #define PVR_VER_E5500 0x8024 + #define PVR_VER_E6500 0x8040 ++#define PVR_VER_7450 0x8000 ++#define PVR_VER_7455 0x8001 ++#define PVR_VER_7447 0x8002 ++#define PVR_VER_7447A 0x8003 ++#define PVR_VER_7448 0x8004 + + /* + * For the 8xx processors, all of them report the same PVR family for +diff --git a/arch/powerpc/perf/mpc7450-pmu.c b/arch/powerpc/perf/mpc7450-pmu.c +index 552d51a925d37..db451b9aac35e 100644 +--- a/arch/powerpc/perf/mpc7450-pmu.c ++++ b/arch/powerpc/perf/mpc7450-pmu.c +@@ -417,9 +417,9 @@ struct power_pmu mpc7450_pmu = { + + static int __init init_mpc7450_pmu(void) + { +- unsigned int pvr = mfspr(SPRN_PVR); +- +- if (PVR_VER(pvr) != PVR_7450) ++ if (!pvr_version_is(PVR_VER_7450) && !pvr_version_is(PVR_VER_7455) && ++ !pvr_version_is(PVR_VER_7447) && !pvr_version_is(PVR_VER_7447A) && ++ !pvr_version_is(PVR_VER_7448)) + return -ENODEV; + + return register_power_pmu(&mpc7450_pmu); +-- +2.39.2 + diff --git a/queue-6.2/powerpc-rtas-use-memmove-for-potentially-overlapping.patch b/queue-6.2/powerpc-rtas-use-memmove-for-potentially-overlapping.patch new file mode 100644 index 00000000000..0d357fbb317 --- /dev/null +++ b/queue-6.2/powerpc-rtas-use-memmove-for-potentially-overlapping.patch @@ -0,0 +1,56 @@ +From 7968fcd50a577b6d37ab3463fcecafbbb6a4c902 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 15:33:41 -0600 +Subject: powerpc/rtas: use memmove for potentially overlapping buffer copy + +From: Nathan Lynch + +[ Upstream commit 271208ee5e335cb1ad280d22784940daf7ddf820 ] + +Using memcpy() isn't safe when buf is identical to rtas_err_buf, which +can happen during boot before slab is up. Full context which may not +be obvious from the diff: + + if (altbuf) { + buf = altbuf; + } else { + buf = rtas_err_buf; + if (slab_is_available()) + buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC); + } + if (buf) + memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX); + +This was found by inspection and I'm not aware of it causing problems +in practice. It appears to have been introduced by commit +033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel"); the +old ppc64 version of this code did not have this problem. + +Use memmove() instead. + +Fixes: 033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel") +Signed-off-by: Nathan Lynch +Reviewed-by: Andrew Donnellan +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230220-rtas-queue-for-6-4-v1-2-010e4416f13f@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/rtas.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index deded51a79784..333a239a30d62 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -425,7 +425,7 @@ static char *__fetch_rtas_last_error(char *altbuf) + buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC); + } + if (buf) +- memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX); ++ memmove(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX); + } + + return buf; +-- +2.39.2 + diff --git a/queue-6.2/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch b/queue-6.2/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch new file mode 100644 index 00000000000..1eda4174cc0 --- /dev/null +++ b/queue-6.2/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch @@ -0,0 +1,45 @@ +From 2b17839203bb4a1166491946c0e62f5ec82e79fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 23:01:16 -0800 +Subject: powerpc/sysdev/tsi108: fix resource printk format warnings + +From: Randy Dunlap + +[ Upstream commit 55d8bd02cc1b9f1063993b5c42c9cabf4af67dea ] + +Use "%pa" format specifier for resource_size_t to avoid a compiler +printk format warning. + + arch/powerpc/sysdev/tsi108_pci.c: In function 'tsi108_setup_pci': + include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' + +Fixes: c4342ff92bed ("[POWERPC] Update mpc7448hpc2 board irq support using device tree") +Fixes: 2b9d7467a6db ("[POWERPC] Add tsi108 pci and platform device data register function") +Signed-off-by: Randy Dunlap +[mpe: Use pr_info() and unsplit string] +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223070116.660-5-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/tsi108_pci.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/sysdev/tsi108_pci.c b/arch/powerpc/sysdev/tsi108_pci.c +index 5af4c35ff5842..0e42f7bad7db1 100644 +--- a/arch/powerpc/sysdev/tsi108_pci.c ++++ b/arch/powerpc/sysdev/tsi108_pci.c +@@ -217,9 +217,8 @@ int __init tsi108_setup_pci(struct device_node *dev, u32 cfg_phys, int primary) + + (hose)->ops = &tsi108_direct_pci_ops; + +- printk(KERN_INFO "Found tsi108 PCI host bridge at 0x%08x. " +- "Firmware bus number: %d->%d\n", +- rsrc.start, hose->first_busno, hose->last_busno); ++ pr_info("Found tsi108 PCI host bridge at 0x%pa. Firmware bus number: %d->%d\n", ++ &rsrc.start, hose->first_busno, hose->last_busno); + + /* Interpret the "ranges" property */ + /* This also maps the I/O region and sets isa_io/mem_base */ +-- +2.39.2 + diff --git a/queue-6.2/powerpc-wii-fix-resource-printk-format-warnings.patch b/queue-6.2/powerpc-wii-fix-resource-printk-format-warnings.patch new file mode 100644 index 00000000000..e977cd7ffc8 --- /dev/null +++ b/queue-6.2/powerpc-wii-fix-resource-printk-format-warnings.patch @@ -0,0 +1,87 @@ +From 9c775ebdb85675b1041f36861bfd532845c1c147 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 23:01:14 -0800 +Subject: powerpc/wii: fix resource printk format warnings + +From: Randy Dunlap + +[ Upstream commit 7b69600d4da0049244e9be2f5ef5a2f8e04fcd9a ] + +Use "%pa" format specifier for resource_size_t to avoid compiler +printk format warnings. + +../arch/powerpc/platforms/embedded6xx/flipper-pic.c: In function 'flipper_pic_init': +../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] +../arch/powerpc/platforms/embedded6xx/flipper-pic.c:148:9: note: in expansion of macro 'pr_info' + 148 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); + | ^~~~~~~ + +../arch/powerpc/platforms/embedded6xx/hlwd-pic.c: In function 'hlwd_pic_init': +../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] +../arch/powerpc/platforms/embedded6xx/hlwd-pic.c:174:9: note: in expansion of macro 'pr_info' + 174 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); + | ^~~~~~~ + +../arch/powerpc/platforms/embedded6xx/wii.c: In function 'wii_ioremap_hw_regs': +../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 3 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] +../arch/powerpc/platforms/embedded6xx/wii.c:77:17: note: in expansion of macro 'pr_info' + 77 | pr_info("%s at 0x%08x mapped to 0x%p\n", name, + | ^~~~~~~ + +Fixes: 028ee972f032 ("powerpc: gamecube/wii: flipper interrupt controller support") +Fixes: 9c21025c7845 ("powerpc: wii: hollywood interrupt controller support") +Fixes: 5a7ee3198dfa ("powerpc: wii: platform support") +Signed-off-by: Randy Dunlap +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223070116.660-3-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/embedded6xx/flipper-pic.c | 2 +- + arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 2 +- + arch/powerpc/platforms/embedded6xx/wii.c | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/platforms/embedded6xx/flipper-pic.c b/arch/powerpc/platforms/embedded6xx/flipper-pic.c +index 609bda2ad5dd2..4d9200bdba78c 100644 +--- a/arch/powerpc/platforms/embedded6xx/flipper-pic.c ++++ b/arch/powerpc/platforms/embedded6xx/flipper-pic.c +@@ -145,7 +145,7 @@ static struct irq_domain * __init flipper_pic_init(struct device_node *np) + } + io_base = ioremap(res.start, resource_size(&res)); + +- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); ++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base); + + __flipper_quiesce(io_base); + +diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +index 380b4285cce47..4d2d92de30afd 100644 +--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c ++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +@@ -171,7 +171,7 @@ static struct irq_domain *__init hlwd_pic_init(struct device_node *np) + return NULL; + } + +- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); ++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base); + + __hlwd_quiesce(io_base); + +diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c +index f4e654a9d4ff6..219659f2ede06 100644 +--- a/arch/powerpc/platforms/embedded6xx/wii.c ++++ b/arch/powerpc/platforms/embedded6xx/wii.c +@@ -74,8 +74,8 @@ static void __iomem *__init wii_ioremap_hw_regs(char *name, char *compatible) + + hw_regs = ioremap(res.start, resource_size(&res)); + if (hw_regs) { +- pr_info("%s at 0x%08x mapped to 0x%p\n", name, +- res.start, hw_regs); ++ pr_info("%s at 0x%pa mapped to 0x%p\n", name, ++ &res.start, hw_regs); + } + + out_put: +-- +2.39.2 + diff --git a/queue-6.2/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch b/queue-6.2/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch new file mode 100644 index 00000000000..635479eaeac --- /dev/null +++ b/queue-6.2/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch @@ -0,0 +1,100 @@ +From 5dd13550f3ec289e60639931449afc8292afadb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 20:40:43 +0000 +Subject: pstore: Revert pmsg_lock back to a normal mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: John Stultz + +[ Upstream commit 5239a89b06d6b199f133bf0ffea421683187f257 ] + +This reverts commit 76d62f24db07f22ccf9bc18ca793c27d4ebef721. + +So while priority inversion on the pmsg_lock is an occasional +problem that an rt_mutex would help with, in uses where logging +is writing to pmsg heavily from multiple threads, the pmsg_lock +can be heavily contended. + +After this change landed, it was reported that cases where the +mutex locking overhead was commonly adding on the order of 10s +of usecs delay had suddenly jumped to ~msec delay with rtmutex. + +It seems the slight differences in the locks under this level +of contention causes the normal mutexes to utilize the spinning +optimizations, while the rtmutexes end up in the sleeping +slowpath (which allows additional threads to pile on trying +to take the lock). + +In this case, it devolves to a worse case senerio where the lock +acquisition and scheduling overhead dominates, and each thread +is waiting on the order of ~ms to do ~us of work. + +Obviously, having tons of threads all contending on a single +lock for logging is non-optimal, so the proper fix is probably +reworking pstore pmsg to have per-cpu buffers so we don't have +contention. + +Additionally, Steven Rostedt has provided some furhter +optimizations for rtmutexes that improves the rtmutex spinning +path, but at least in my testing, I still see the test tripping +into the sleeping path on rtmutexes while utilizing the spinning +path with mutexes. + +But in the short term, lets revert the change to the rt_mutex +and go back to normal mutexes to avoid a potentially major +performance regression. And we can work on optimizations to both +rtmutexes and finer-grained locking for pstore pmsg in the +future. + +Cc: Wei Wang +Cc: Midas Chien +Cc: "Chunhui Li (李春辉)" +Cc: Steven Rostedt +Cc: Kees Cook +Cc: Anton Vorontsov +Cc: "Guilherme G. Piccoli" +Cc: Tony Luck +Cc: kernel-team@android.com +Fixes: 76d62f24db07 ("pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion") +Reported-by: "Chunhui Li (李春辉)" +Signed-off-by: John Stultz +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20230308204043.2061631-1-jstultz@google.com +Signed-off-by: Sasha Levin +--- + fs/pstore/pmsg.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/fs/pstore/pmsg.c b/fs/pstore/pmsg.c +index ab82e5f053464..b31c9c72d90b4 100644 +--- a/fs/pstore/pmsg.c ++++ b/fs/pstore/pmsg.c +@@ -7,10 +7,9 @@ + #include + #include + #include +-#include + #include "internal.h" + +-static DEFINE_RT_MUTEX(pmsg_lock); ++static DEFINE_MUTEX(pmsg_lock); + + static ssize_t write_pmsg(struct file *file, const char __user *buf, + size_t count, loff_t *ppos) +@@ -29,9 +28,9 @@ static ssize_t write_pmsg(struct file *file, const char __user *buf, + if (!access_ok(buf, count)) + return -EFAULT; + +- rt_mutex_lock(&pmsg_lock); ++ mutex_lock(&pmsg_lock); + ret = psinfo->write_user(&record, buf); +- rt_mutex_unlock(&pmsg_lock); ++ mutex_unlock(&pmsg_lock); + return ret ? ret : count; + } + +-- +2.39.2 + diff --git a/queue-6.2/pwm-mtk-disp-configure-double-buffering-before-readi.patch b/queue-6.2/pwm-mtk-disp-configure-double-buffering-before-readi.patch new file mode 100644 index 00000000000..8154f7939b8 --- /dev/null +++ b/queue-6.2/pwm-mtk-disp-configure-double-buffering-before-readi.patch @@ -0,0 +1,73 @@ +From 262dd1af9d5fcfeea8a16cd9bbf77d6413148ada Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 15:30:54 +0200 +Subject: pwm: mtk-disp: Configure double buffering before reading in + .get_state() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: AngeloGioacchino Del Regno + +[ Upstream commit b16c310115f2084b8826a35b77ef42bab6786d9f ] + +The DISP_PWM controller's default behavior is to always use register +double buffering: all reads/writes are then performed on shadow +registers instead of working registers and this becomes an issue +in case our chosen configuration in Linux is different from the +default (or from the one that was pre-applied by the bootloader). + +An example of broken behavior is when the controller is configured +to use shadow registers, but this driver wants to configure it +otherwise: what happens is that the .get_state() callback is called +right after registering the pwmchip and checks whether the PWM is +enabled by reading the DISP_PWM_EN register; +At this point, if shadow registers are enabled but their content +was not committed before booting Linux, we are *not* reading the +current PWM enablement status, leading to the kernel knowing that +the hardware is actually enabled when, in reality, it's not. + +The aforementioned issue emerged since this driver was fixed with +commit 0b5ef3429d8f ("pwm: mtk-disp: Fix the parameters calculated +by the enabled flag of disp_pwm") making it to read the enablement +status from the right register. + +Configure the controller in the .get_state() callback to avoid +this desync issue and get the backlight properly working again. + +Fixes: 3f2b16734914 ("pwm: mtk-disp: Implement atomic API .get_state()") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Nícolas F. R. A. Prado +Tested-by: Nícolas F. R. A. Prado +Reviewed-by: Alexandre Mergnat +Tested-by: Alexandre Mergnat +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-mtk-disp.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c +index 82b430d881a20..fe9593f968eeb 100644 +--- a/drivers/pwm/pwm-mtk-disp.c ++++ b/drivers/pwm/pwm-mtk-disp.c +@@ -196,6 +196,16 @@ static int mtk_disp_pwm_get_state(struct pwm_chip *chip, + return err; + } + ++ /* ++ * Apply DISP_PWM_DEBUG settings to choose whether to enable or disable ++ * registers double buffer and manual commit to working register before ++ * performing any read/write operation ++ */ ++ if (mdp->data->bls_debug) ++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, ++ mdp->data->bls_debug_mask, ++ mdp->data->bls_debug_mask); ++ + rate = clk_get_rate(mdp->clk_main); + con0 = readl(mdp->base + mdp->data->con0); + con1 = readl(mdp->base + mdp->data->con1); +-- +2.39.2 + diff --git a/queue-6.2/pwm-mtk-disp-disable-shadow-registers-before-setting.patch b/queue-6.2/pwm-mtk-disp-disable-shadow-registers-before-setting.patch new file mode 100644 index 00000000000..ad9b69b965a --- /dev/null +++ b/queue-6.2/pwm-mtk-disp-disable-shadow-registers-before-setting.patch @@ -0,0 +1,74 @@ +From 3cb84a794b367e81572b6a7e05442de53647dd99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 15:30:53 +0200 +Subject: pwm: mtk-disp: Disable shadow registers before setting backlight + values +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: AngeloGioacchino Del Regno + +[ Upstream commit 36dd7f530ae7d9ce9e853ffb8aa337de65c6600b ] + +If shadow registers usage is not desired, disable that before performing +any write to CON0/1 registers in the .apply() callback, otherwise we may +lose clkdiv or period/width updates. + +Fixes: cd4b45ac449a ("pwm: Add MediaTek MT2701 display PWM driver support") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Nícolas F. R. A. Prado +Tested-by: Nícolas F. R. A. Prado +Reviewed-by: Alexandre Mergnat +Tested-by: Alexandre Mergnat +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-mtk-disp.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c +index 692a06121b286..82b430d881a20 100644 +--- a/drivers/pwm/pwm-mtk-disp.c ++++ b/drivers/pwm/pwm-mtk-disp.c +@@ -138,6 +138,19 @@ static int mtk_disp_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + high_width = mul_u64_u64_div_u64(state->duty_cycle, rate, div); + value = period | (high_width << PWM_HIGH_WIDTH_SHIFT); + ++ if (mdp->data->bls_debug && !mdp->data->has_commit) { ++ /* ++ * For MT2701, disable double buffer before writing register ++ * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH. ++ */ ++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, ++ mdp->data->bls_debug_mask, ++ mdp->data->bls_debug_mask); ++ mtk_disp_pwm_update_bits(mdp, mdp->data->con0, ++ mdp->data->con0_sel, ++ mdp->data->con0_sel); ++ } ++ + mtk_disp_pwm_update_bits(mdp, mdp->data->con0, + PWM_CLKDIV_MASK, + clk_div << PWM_CLKDIV_SHIFT); +@@ -152,17 +165,6 @@ static int mtk_disp_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + mtk_disp_pwm_update_bits(mdp, mdp->data->commit, + mdp->data->commit_mask, + 0x0); +- } else { +- /* +- * For MT2701, disable double buffer before writing register +- * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH. +- */ +- mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, +- mdp->data->bls_debug_mask, +- mdp->data->bls_debug_mask); +- mtk_disp_pwm_update_bits(mdp, mdp->data->con0, +- mdp->data->con0_sel, +- mdp->data->con0_sel); + } + + mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask, +-- +2.39.2 + diff --git a/queue-6.2/rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch b/queue-6.2/rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch new file mode 100644 index 00000000000..13a5aab25aa --- /dev/null +++ b/queue-6.2/rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch @@ -0,0 +1,63 @@ +From 54ec094022a2e9c6a3ba5b744523ed1abb858063 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 22:16:25 +0800 +Subject: rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check + +From: Zqiang + +[ Upstream commit db7b464df9d820186e98a65aa6a10f0d51fbf8ce ] + +This commit adds checks for the TICK_DEP_MASK_RCU_EXP bit, thus enabling +RCU expedited grace periods to actually force-enable scheduling-clock +interrupts on holdout CPUs. + +Fixes: df1e849ae455 ("rcu: Enable tick for nohz_full CPUs slow to provide expedited QS") +Signed-off-by: Zqiang +Cc: Steven Rostedt +Cc: Masami Hiramatsu +Cc: Frederic Weisbecker +Cc: Thomas Gleixner +Cc: Ingo Molnar +Cc: Anna-Maria Behnsen +Acked-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Signed-off-by: Joel Fernandes (Google) +Signed-off-by: Sasha Levin +--- + include/trace/events/timer.h | 3 ++- + kernel/time/tick-sched.c | 5 +++++ + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h +index 2e713a7d9aa3a..3e8619c72f774 100644 +--- a/include/trace/events/timer.h ++++ b/include/trace/events/timer.h +@@ -371,7 +371,8 @@ TRACE_EVENT(itimer_expire, + tick_dep_name(PERF_EVENTS) \ + tick_dep_name(SCHED) \ + tick_dep_name(CLOCK_UNSTABLE) \ +- tick_dep_name_end(RCU) ++ tick_dep_name(RCU) \ ++ tick_dep_name_end(RCU_EXP) + + #undef tick_dep_name + #undef tick_dep_mask_name +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 68d81a4283c89..a46506f7ec6d0 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -281,6 +281,11 @@ static bool check_tick_dependency(atomic_t *dep) + return true; + } + ++ if (val & TICK_DEP_MASK_RCU_EXP) { ++ trace_tick_stop(0, TICK_DEP_MASK_RCU_EXP); ++ return true; ++ } ++ + return false; + } + +-- +2.39.2 + diff --git a/queue-6.2/rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch b/queue-6.2/rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch new file mode 100644 index 00000000000..6838fe0b463 --- /dev/null +++ b/queue-6.2/rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch @@ -0,0 +1,49 @@ +From ab43a7544ad7ed6625db8dda13656ea957aedeb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 10:23:51 +0300 +Subject: RDMA/cm: Trace icm_send_rej event before the cm state is reset + +From: Mark Zhang + +[ Upstream commit bd9de1badac7e4ff6780365d4aa38983f5e2a436 ] + +Trace icm_send_rej event before the cm state is reset to idle, so that +correct cm state will be logged. For example when an incoming request is +rejected, the old trace log was: + icm_send_rej: local_id=961102742 remote_id=3829151631 state=IDLE reason=REJ_CONSUMER_DEFINED +With this patch: + icm_send_rej: local_id=312971016 remote_id=3778819983 state=MRA_REQ_SENT reason=REJ_CONSUMER_DEFINED + +Fixes: 8dc105befe16 ("RDMA/cm: Add tracepoints to track MAD send operations") +Signed-off-by: Mark Zhang +Link: https://lore.kernel.org/r/20230330072351.481200-1-markzhang@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index 603c0aecc3614..ff58058aeadca 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -2912,6 +2912,8 @@ static int cm_send_rej_locked(struct cm_id_private *cm_id_priv, + (ari && ari_length > IB_CM_REJ_ARI_LENGTH)) + return -EINVAL; + ++ trace_icm_send_rej(&cm_id_priv->id, reason); ++ + switch (state) { + case IB_CM_REQ_SENT: + case IB_CM_MRA_REQ_RCVD: +@@ -2942,7 +2944,6 @@ static int cm_send_rej_locked(struct cm_id_private *cm_id_priv, + return -EINVAL; + } + +- trace_icm_send_rej(&cm_id_priv->id, reason); + ret = ib_post_send_mad(msg, NULL); + if (ret) { + cm_free_msg(msg); +-- +2.39.2 + diff --git a/queue-6.2/rdma-erdma-use-fixed-hardware-page-size.patch b/queue-6.2/rdma-erdma-use-fixed-hardware-page-size.patch new file mode 100644 index 00000000000..e510e7bd034 --- /dev/null +++ b/queue-6.2/rdma-erdma-use-fixed-hardware-page-size.patch @@ -0,0 +1,108 @@ +From e1647f0a070e1ad7a24efb5ef2fa5995eadf3137 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 18:29:23 +0800 +Subject: RDMA/erdma: Use fixed hardware page size + +From: Cheng Xu + +[ Upstream commit d649c638dc26f3501da510cf7fceb5c15ca54258 ] + +Hardware's page size is 4096, but the kernel's page size may vary. Driver +should use hardware's page size when communicating with hardware. + +Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation") +Link: https://lore.kernel.org/r/20230307102924.70577-2-chengyou@linux.alibaba.com +Signed-off-by: Cheng Xu +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/erdma/erdma_hw.h | 4 ++++ + drivers/infiniband/hw/erdma/erdma_verbs.c | 17 +++++++++-------- + 2 files changed, 13 insertions(+), 8 deletions(-) + +diff --git a/drivers/infiniband/hw/erdma/erdma_hw.h b/drivers/infiniband/hw/erdma/erdma_hw.h +index 8a8d4539a006b..51ab2058b03f1 100644 +--- a/drivers/infiniband/hw/erdma/erdma_hw.h ++++ b/drivers/infiniband/hw/erdma/erdma_hw.h +@@ -112,6 +112,10 @@ + + #define ERDMA_PAGE_SIZE_SUPPORT 0x7FFFF000 + ++/* Hardware page size definition */ ++#define ERDMA_HW_PAGE_SHIFT 12 ++#define ERDMA_HW_PAGE_SIZE 4096 ++ + /* WQE related. */ + #define EQE_SIZE 16 + #define EQE_SHIFT 4 +diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c +index 9c30d78730aa1..83e1b0d559771 100644 +--- a/drivers/infiniband/hw/erdma/erdma_verbs.c ++++ b/drivers/infiniband/hw/erdma/erdma_verbs.c +@@ -38,7 +38,7 @@ static int create_qp_cmd(struct erdma_dev *dev, struct erdma_qp *qp) + FIELD_PREP(ERDMA_CMD_CREATE_QP_PD_MASK, pd->pdn); + + if (rdma_is_kernel_res(&qp->ibqp.res)) { +- u32 pgsz_range = ilog2(SZ_1M) - PAGE_SHIFT; ++ u32 pgsz_range = ilog2(SZ_1M) - ERDMA_HW_PAGE_SHIFT; + + req.sq_cqn_mtt_cfg = + FIELD_PREP(ERDMA_CMD_CREATE_QP_PAGE_SIZE_MASK, +@@ -66,13 +66,13 @@ static int create_qp_cmd(struct erdma_dev *dev, struct erdma_qp *qp) + user_qp = &qp->user_qp; + req.sq_cqn_mtt_cfg = FIELD_PREP( + ERDMA_CMD_CREATE_QP_PAGE_SIZE_MASK, +- ilog2(user_qp->sq_mtt.page_size) - PAGE_SHIFT); ++ ilog2(user_qp->sq_mtt.page_size) - ERDMA_HW_PAGE_SHIFT); + req.sq_cqn_mtt_cfg |= + FIELD_PREP(ERDMA_CMD_CREATE_QP_CQN_MASK, qp->scq->cqn); + + req.rq_cqn_mtt_cfg = FIELD_PREP( + ERDMA_CMD_CREATE_QP_PAGE_SIZE_MASK, +- ilog2(user_qp->rq_mtt.page_size) - PAGE_SHIFT); ++ ilog2(user_qp->rq_mtt.page_size) - ERDMA_HW_PAGE_SHIFT); + req.rq_cqn_mtt_cfg |= + FIELD_PREP(ERDMA_CMD_CREATE_QP_CQN_MASK, qp->rcq->cqn); + +@@ -162,7 +162,7 @@ static int create_cq_cmd(struct erdma_dev *dev, struct erdma_cq *cq) + if (rdma_is_kernel_res(&cq->ibcq.res)) { + page_size = SZ_32M; + req.cfg0 |= FIELD_PREP(ERDMA_CMD_CREATE_CQ_PAGESIZE_MASK, +- ilog2(page_size) - PAGE_SHIFT); ++ ilog2(page_size) - ERDMA_HW_PAGE_SHIFT); + req.qbuf_addr_l = lower_32_bits(cq->kern_cq.qbuf_dma_addr); + req.qbuf_addr_h = upper_32_bits(cq->kern_cq.qbuf_dma_addr); + +@@ -175,8 +175,9 @@ static int create_cq_cmd(struct erdma_dev *dev, struct erdma_cq *cq) + cq->kern_cq.qbuf_dma_addr + (cq->depth << CQE_SHIFT); + } else { + mtt = &cq->user_cq.qbuf_mtt; +- req.cfg0 |= FIELD_PREP(ERDMA_CMD_CREATE_CQ_PAGESIZE_MASK, +- ilog2(mtt->page_size) - PAGE_SHIFT); ++ req.cfg0 |= ++ FIELD_PREP(ERDMA_CMD_CREATE_CQ_PAGESIZE_MASK, ++ ilog2(mtt->page_size) - ERDMA_HW_PAGE_SHIFT); + if (mtt->mtt_nents == 1) { + req.qbuf_addr_l = lower_32_bits(*(u64 *)mtt->mtt_buf); + req.qbuf_addr_h = upper_32_bits(*(u64 *)mtt->mtt_buf); +@@ -636,7 +637,7 @@ static int init_user_qp(struct erdma_qp *qp, struct erdma_ucontext *uctx, + u32 rq_offset; + int ret; + +- if (len < (PAGE_ALIGN(qp->attrs.sq_size * SQEBB_SIZE) + ++ if (len < (ALIGN(qp->attrs.sq_size * SQEBB_SIZE, ERDMA_HW_PAGE_SIZE) + + qp->attrs.rq_size * RQE_SIZE)) + return -EINVAL; + +@@ -646,7 +647,7 @@ static int init_user_qp(struct erdma_qp *qp, struct erdma_ucontext *uctx, + if (ret) + return ret; + +- rq_offset = PAGE_ALIGN(qp->attrs.sq_size << SQEBB_SHIFT); ++ rq_offset = ALIGN(qp->attrs.sq_size << SQEBB_SHIFT, ERDMA_HW_PAGE_SIZE); + qp->user_qp.rq_offset = rq_offset; + + ret = get_mtt_entries(qp->dev, &qp->user_qp.rq_mtt, va + rq_offset, +-- +2.39.2 + diff --git a/queue-6.2/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch b/queue-6.2/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch new file mode 100644 index 00000000000..fa34cf8b886 --- /dev/null +++ b/queue-6.2/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch @@ -0,0 +1,46 @@ +From e165a89260a0f84c69ee27cbeb61b465f3156c2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 12:51:27 +0300 +Subject: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() + +From: Dan Carpenter + +[ Upstream commit d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb ] + +The ucmd->log_sq_bb_count variable is controlled by the user so this +shift can wrap. Fix it by using check_shl_overflow() in the same way +that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined +behavior in hns_roce_set_user_sq_size()"). + +Fixes: 839041329fd3 ("IB/mlx4: Sanity check userspace send queue sizes") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/a8dfbd1d-c019-4556-930b-bab1ded73b10@kili.mountain +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/qp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index b17d6ebc5b705..488c906c0432c 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -412,9 +412,13 @@ static int set_user_sq_size(struct mlx4_ib_dev *dev, + struct mlx4_ib_qp *qp, + struct mlx4_ib_create_qp *ucmd) + { ++ u32 cnt; ++ + /* Sanity check SQ size before proceeding */ +- if ((1 << ucmd->log_sq_bb_count) > dev->dev->caps.max_wqes || +- ucmd->log_sq_stride > ++ if (check_shl_overflow(1, ucmd->log_sq_bb_count, &cnt) || ++ cnt > dev->dev->caps.max_wqes) ++ return -EINVAL; ++ if (ucmd->log_sq_stride > + ilog2(roundup_pow_of_two(dev->dev->caps.max_sq_desc_sz)) || + ucmd->log_sq_stride < MLX4_IB_MIN_SQ_STRIDE) + return -EINVAL; +-- +2.39.2 + diff --git a/queue-6.2/rdma-mlx5-check-pcie_relaxed_ordering_enabled-in-umr.patch b/queue-6.2/rdma-mlx5-check-pcie_relaxed_ordering_enabled-in-umr.patch new file mode 100644 index 00000000000..b8986cd2d5c --- /dev/null +++ b/queue-6.2/rdma-mlx5-check-pcie_relaxed_ordering_enabled-in-umr.patch @@ -0,0 +1,67 @@ +From 1bc1164d3c9bed791a2bc297789537e32c572db9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 16:07:51 +0300 +Subject: RDMA/mlx5: Check pcie_relaxed_ordering_enabled() in UMR + +From: Avihai Horon + +[ Upstream commit d43b020b0f82c088ef8ff3196ef00575a97d200e ] + +relaxed_ordering_read HCA capability is set if both the device supports +relaxed ordering (RO) read and RO is set in PCI config space. + +RO in PCI config space can change during runtime. This will change the +value of relaxed_ordering_read HCA capability in FW, but the driver will +not see it since it queries the capabilities only once. + +This can lead to the following scenario: +1. RO in PCI config space is enabled. +2. User creates MKey without RO. +3. RO in PCI config space is disabled. + As a result, relaxed_ordering_read HCA capability is turned off in FW + but remains on in driver copy of the capabilities. +4. User requests to reconfig the MKey with RO via UMR. +5. Driver will try to reconfig the MKey with RO read although it + shouldn't (as relaxed_ordering_read HCA capability is really off). + +To fix this, check pcie_relaxed_ordering_enabled() before setting RO +read in UMR. + +Fixes: 896ec9735336 ("RDMA/mlx5: Set mkey relaxed ordering by UMR with ConnectX-7") +Signed-off-by: Avihai Horon +Reviewed-by: Shay Drory +Link: https://lore.kernel.org/r/8d39eb8317e7bed1a354311a20ae707788fd94ed.1681131553.git.leon@kernel.org +Reviewed-by: Jacob Keller +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/umr.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/umr.c b/drivers/infiniband/hw/mlx5/umr.c +index 029e9536ec28f..8b674514818a1 100644 +--- a/drivers/infiniband/hw/mlx5/umr.c ++++ b/drivers/infiniband/hw/mlx5/umr.c +@@ -380,6 +380,9 @@ static void mlx5r_umr_set_access_flags(struct mlx5_ib_dev *dev, + struct mlx5_mkey_seg *seg, + unsigned int access_flags) + { ++ bool ro_read = (access_flags & IB_ACCESS_RELAXED_ORDERING) && ++ pcie_relaxed_ordering_enabled(dev->mdev->pdev); ++ + MLX5_SET(mkc, seg, a, !!(access_flags & IB_ACCESS_REMOTE_ATOMIC)); + MLX5_SET(mkc, seg, rw, !!(access_flags & IB_ACCESS_REMOTE_WRITE)); + MLX5_SET(mkc, seg, rr, !!(access_flags & IB_ACCESS_REMOTE_READ)); +@@ -387,8 +390,7 @@ static void mlx5r_umr_set_access_flags(struct mlx5_ib_dev *dev, + MLX5_SET(mkc, seg, lr, 1); + MLX5_SET(mkc, seg, relaxed_ordering_write, + !!(access_flags & IB_ACCESS_RELAXED_ORDERING)); +- MLX5_SET(mkc, seg, relaxed_ordering_read, +- !!(access_flags & IB_ACCESS_RELAXED_ORDERING)); ++ MLX5_SET(mkc, seg, relaxed_ordering_read, ro_read); + } + + int mlx5r_umr_rereg_pd_access(struct mlx5_ib_mr *mr, struct ib_pd *pd, +-- +2.39.2 + diff --git a/queue-6.2/rdma-mlx5-fix-flow-counter-query-via-devx.patch b/queue-6.2/rdma-mlx5-fix-flow-counter-query-via-devx.patch new file mode 100644 index 00000000000..92496e8ec68 --- /dev/null +++ b/queue-6.2/rdma-mlx5-fix-flow-counter-query-via-devx.patch @@ -0,0 +1,93 @@ +From fd82e9b0db0f4a5c3f71c3e249f9a0f4ce4c08e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 12:23:09 +0300 +Subject: RDMA/mlx5: Fix flow counter query via DEVX + +From: Mark Bloch + +[ Upstream commit 3e358ea8614ddfbc59ca7a3f5dff5dde2b350b2c ] + +Commit cited in "fixes" tag added bulk support for flow counters but it +didn't account that's also possible to query a counter using a non-base id +if the counter was allocated as bulk. + +When a user performs a query, validate the flow counter id given in the +mailbox is inside the valid range taking bulk value into account. + +Fixes: 208d70f562e5 ("IB/mlx5: Support flow counters offset for bulk counters") +Signed-off-by: Mark Bloch +Reviewed-by: Maor Gottlieb +Link: https://lore.kernel.org/r/79d7fbe291690128e44672418934256254d93115.1681377114.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/devx.c | 31 ++++++++++++++++++++++++++----- + include/linux/mlx5/mlx5_ifc.h | 3 ++- + 2 files changed, 28 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index 2211a0be16f36..f8e2baed27a5c 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -666,7 +666,21 @@ static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs, + obj_id; + + case MLX5_IB_OBJECT_DEVX_OBJ: +- return ((struct devx_obj *)uobj->object)->obj_id == obj_id; ++ { ++ u16 opcode = MLX5_GET(general_obj_in_cmd_hdr, in, opcode); ++ struct devx_obj *devx_uobj = uobj->object; ++ ++ if (opcode == MLX5_CMD_OP_QUERY_FLOW_COUNTER && ++ devx_uobj->flow_counter_bulk_size) { ++ u64 end; ++ ++ end = devx_uobj->obj_id + ++ devx_uobj->flow_counter_bulk_size; ++ return devx_uobj->obj_id <= obj_id && end > obj_id; ++ } ++ ++ return devx_uobj->obj_id == obj_id; ++ } + + default: + return false; +@@ -1517,10 +1531,17 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)( + goto obj_free; + + if (opcode == MLX5_CMD_OP_ALLOC_FLOW_COUNTER) { +- u8 bulk = MLX5_GET(alloc_flow_counter_in, +- cmd_in, +- flow_counter_bulk); +- obj->flow_counter_bulk_size = 128UL * bulk; ++ u32 bulk = MLX5_GET(alloc_flow_counter_in, ++ cmd_in, ++ flow_counter_bulk_log_size); ++ ++ if (bulk) ++ bulk = 1 << bulk; ++ else ++ bulk = 128UL * MLX5_GET(alloc_flow_counter_in, ++ cmd_in, ++ flow_counter_bulk); ++ obj->flow_counter_bulk_size = bulk; + } + + uobj->object = obj; +diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h +index a9ee7bc59c901..90ab0e31ecf46 100644 +--- a/include/linux/mlx5/mlx5_ifc.h ++++ b/include/linux/mlx5/mlx5_ifc.h +@@ -9144,7 +9144,8 @@ struct mlx5_ifc_alloc_flow_counter_in_bits { + u8 reserved_at_20[0x10]; + u8 op_mod[0x10]; + +- u8 reserved_at_40[0x38]; ++ u8 reserved_at_40[0x33]; ++ u8 flow_counter_bulk_log_size[0x5]; + u8 flow_counter_bulk[0x8]; + }; + +-- +2.39.2 + diff --git a/queue-6.2/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch b/queue-6.2/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch new file mode 100644 index 00000000000..a9454ddc3ca --- /dev/null +++ b/queue-6.2/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch @@ -0,0 +1,39 @@ +From b9007082bc1a2d0f6a6dd67a0a8ed367a3dedaaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 04:39:06 +0300 +Subject: RDMA/mlx5: Use correct device num_ports when modify DC + +From: Mark Zhang + +[ Upstream commit 746aa3c8cb1a650ff2583497ac646e505831b9b9 ] + +Just like other QP types, when modify DC, the port_num should be compared +with dev->num_ports, instead of HCA_CAP.num_ports. Otherwise Multi-port +vHCA on DC may not work. + +Fixes: 776a3906b692 ("IB/mlx5: Add support for DC target QP") +Link: https://lore.kernel.org/r/20230420013906.1244185-1-markzhang@nvidia.com +Signed-off-by: Mark Zhang +Reviewed-by: Maor Gottlieb +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/qp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index cf953d23d18da..f7d3643b08f50 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -4408,7 +4408,7 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr, + return -EINVAL; + + if (attr->port_num == 0 || +- attr->port_num > MLX5_CAP_GEN(dev->mdev, num_ports)) { ++ attr->port_num > dev->num_ports) { + mlx5_ib_dbg(dev, "invalid port number %d. number of ports is %d\n", + attr->port_num, dev->num_ports); + return -EINVAL; +-- +2.39.2 + diff --git a/queue-6.2/rdma-rdmavt-delete-unnecessary-null-check.patch b/queue-6.2/rdma-rdmavt-delete-unnecessary-null-check.patch new file mode 100644 index 00000000000..0c39aa8be0d --- /dev/null +++ b/queue-6.2/rdma-rdmavt-delete-unnecessary-null-check.patch @@ -0,0 +1,41 @@ +From 55c56bcbee304f684da677c0ad1de7c3f10b041c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 15:44:08 +0300 +Subject: RDMA/rdmavt: Delete unnecessary NULL check + +From: Natalia Petrova + +[ Upstream commit b73a0b80c69de77d8d4942abb37066531c0169b2 ] + +There is no need to check 'rdi->qp_dev' for NULL. The field 'qp_dev' +is created in rvt_register_device() which will fail if the 'qp_dev' +allocation fails in rvt_driver_qp_init(). Overwise this pointer +doesn't changed and passed to rvt_qp_exit() by the next step. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 0acb0cc7ecc1 ("IB/rdmavt: Initialize and teardown of qpn table") +Signed-off-by: Natalia Petrova +Link: https://lore.kernel.org/r/20230303124408.16685-1-n.petrova@fintech.ru +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rdmavt/qp.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c +index 3acab569fbb94..2bdc4486c3daa 100644 +--- a/drivers/infiniband/sw/rdmavt/qp.c ++++ b/drivers/infiniband/sw/rdmavt/qp.c +@@ -464,8 +464,6 @@ void rvt_qp_exit(struct rvt_dev_info *rdi) + if (qps_inuse) + rvt_pr_err(rdi, "QP memory leak! %u still in use\n", + qps_inuse); +- if (!rdi->qp_dev) +- return; + + kfree(rdi->qp_dev->qp_table); + free_qpn_table(&rdi->qp_dev->qpn_table); +-- +2.39.2 + diff --git a/queue-6.2/rdma-rxe-add-error-messages.patch b/queue-6.2/rdma-rxe-add-error-messages.patch new file mode 100644 index 00000000000..27985765810 --- /dev/null +++ b/queue-6.2/rdma-rxe-add-error-messages.patch @@ -0,0 +1,1446 @@ +From 036428f1dfbbe9833e79755c0c8e6b3caccb2abb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 16:16:24 -0600 +Subject: RDMA/rxe: Add error messages + +From: Bob Pearson + +[ Upstream commit 5bf944f24129cbc4b5828348bdce2db94ca9fbd6 ] + +This patch adds error and debug messages so that every interaction +with rdma-core through a verbs API call or a completion error return +will generate at least one error message backed up by debug messages +with more detail. + +With dynamic debugging one can follow up after seeing an error message +by turning on the appropriate debug messages. + +Link: https://lore.kernel.org/r/20230303221623.8053-5-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 78b26a335310 ("RDMA/rxe: Remove tasklet call from rxe_cq.c") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_comp.c | 4 + + drivers/infiniband/sw/rxe/rxe_loc.h | 1 - + drivers/infiniband/sw/rxe/rxe_mr.c | 13 - + drivers/infiniband/sw/rxe/rxe_resp.c | 4 + + drivers/infiniband/sw/rxe/rxe_verbs.c | 828 +++++++++++++++++++------- + 5 files changed, 609 insertions(+), 241 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c +index 20737fec392bf..876057e3ee3c1 100644 +--- a/drivers/infiniband/sw/rxe/rxe_comp.c ++++ b/drivers/infiniband/sw/rxe/rxe_comp.c +@@ -428,6 +428,10 @@ static void make_send_cqe(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + uwc->wc_flags = IB_WC_WITH_IMM; + uwc->byte_len = wqe->dma.length; + } ++ } else { ++ if (wqe->status != IB_WC_WR_FLUSH_ERR) ++ rxe_err_qp(qp, "non-flush error status = %d", ++ wqe->status); + } + } + +diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h +index 1bb0cb479eb12..839de34cf4c94 100644 +--- a/drivers/infiniband/sw/rxe/rxe_loc.h ++++ b/drivers/infiniband/sw/rxe/rxe_loc.h +@@ -80,7 +80,6 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length); + int advance_dma_data(struct rxe_dma_info *dma, unsigned int length); + int rxe_invalidate_mr(struct rxe_qp *qp, u32 key); + int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe); +-int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata); + void rxe_mr_cleanup(struct rxe_pool_elem *elem); + + /* rxe_mw.c */ +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index b10aa1580a644..1e17f8086d59a 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -722,19 +722,6 @@ int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe) + return 0; + } + +-int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata) +-{ +- struct rxe_mr *mr = to_rmr(ibmr); +- +- /* See IBA 10.6.7.2.6 */ +- if (atomic_read(&mr->num_mw) > 0) +- return -EINVAL; +- +- rxe_cleanup(mr); +- kfree_rcu(mr); +- return 0; +-} +- + void rxe_mr_cleanup(struct rxe_pool_elem *elem) + { + struct rxe_mr *mr = container_of(elem, typeof(*mr), elem); +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index 0cc1ba91d48cc..4217eec03a943 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -1151,6 +1151,10 @@ static enum resp_states do_complete(struct rxe_qp *qp, + + wc->port_num = qp->attr.port_num; + } ++ } else { ++ if (wc->status != IB_WC_WR_FLUSH_ERR) ++ rxe_err_qp(qp, "non-flush error status = %d", ++ wc->status); + } + + /* have copy for srq and reference for !srq */ +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index f178d0773ff20..84b53c070fc55 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -12,31 +12,48 @@ + #include "rxe_queue.h" + #include "rxe_hw_counters.h" + +-static int rxe_query_device(struct ib_device *dev, ++static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr); ++ ++/* dev */ ++static int rxe_query_device(struct ib_device *ibdev, + struct ib_device_attr *attr, +- struct ib_udata *uhw) ++ struct ib_udata *udata) + { +- struct rxe_dev *rxe = to_rdev(dev); ++ struct rxe_dev *rxe = to_rdev(ibdev); ++ int err; ++ ++ if (udata->inlen || udata->outlen) { ++ rxe_dbg_dev(rxe, "malformed udata"); ++ err = -EINVAL; ++ goto err_out; ++ } + +- if (uhw->inlen || uhw->outlen) +- return -EINVAL; ++ memcpy(attr, &rxe->attr, sizeof(*attr)); + +- *attr = rxe->attr; + return 0; ++ ++err_out: ++ rxe_err_dev(rxe, "returned err = %d", err); ++ return err; + } + +-static int rxe_query_port(struct ib_device *dev, ++static int rxe_query_port(struct ib_device *ibdev, + u32 port_num, struct ib_port_attr *attr) + { +- struct rxe_dev *rxe = to_rdev(dev); +- int rc; ++ struct rxe_dev *rxe = to_rdev(ibdev); ++ int err, ret; + +- /* *attr being zeroed by the caller, avoid zeroing it here */ +- *attr = rxe->port.attr; ++ if (port_num != 1) { ++ err = -EINVAL; ++ rxe_dbg_dev(rxe, "bad port_num = %d", port_num); ++ goto err_out; ++ } ++ ++ memcpy(attr, &rxe->port.attr, sizeof(*attr)); + + mutex_lock(&rxe->usdev_lock); +- rc = ib_get_eth_speed(dev, port_num, &attr->active_speed, +- &attr->active_width); ++ ret = ib_get_eth_speed(ibdev, port_num, &attr->active_speed, ++ &attr->active_width); + + if (attr->state == IB_PORT_ACTIVE) + attr->phys_state = IB_PORT_PHYS_STATE_LINK_UP; +@@ -47,27 +64,45 @@ static int rxe_query_port(struct ib_device *dev, + + mutex_unlock(&rxe->usdev_lock); + +- return rc; ++ return ret; ++ ++err_out: ++ rxe_err_dev(rxe, "returned err = %d", err); ++ return err; + } + +-static int rxe_query_pkey(struct ib_device *device, ++static int rxe_query_pkey(struct ib_device *ibdev, + u32 port_num, u16 index, u16 *pkey) + { +- if (index > 0) +- return -EINVAL; ++ struct rxe_dev *rxe = to_rdev(ibdev); ++ int err; ++ ++ if (index != 0) { ++ err = -EINVAL; ++ rxe_dbg_dev(rxe, "bad pkey index = %d", index); ++ goto err_out; ++ } + + *pkey = IB_DEFAULT_PKEY_FULL; + return 0; ++ ++err_out: ++ rxe_err_dev(rxe, "returned err = %d", err); ++ return err; + } + +-static int rxe_modify_device(struct ib_device *dev, ++static int rxe_modify_device(struct ib_device *ibdev, + int mask, struct ib_device_modify *attr) + { +- struct rxe_dev *rxe = to_rdev(dev); ++ struct rxe_dev *rxe = to_rdev(ibdev); ++ int err; + + if (mask & ~(IB_DEVICE_MODIFY_SYS_IMAGE_GUID | +- IB_DEVICE_MODIFY_NODE_DESC)) +- return -EOPNOTSUPP; ++ IB_DEVICE_MODIFY_NODE_DESC)) { ++ err = -EOPNOTSUPP; ++ rxe_dbg_dev(rxe, "unsupported mask = 0x%x", mask); ++ goto err_out; ++ } + + if (mask & IB_DEVICE_MODIFY_SYS_IMAGE_GUID) + rxe->attr.sys_image_guid = cpu_to_be64(attr->sys_image_guid); +@@ -78,16 +113,33 @@ static int rxe_modify_device(struct ib_device *dev, + } + + return 0; ++ ++err_out: ++ rxe_err_dev(rxe, "returned err = %d", err); ++ return err; + } + +-static int rxe_modify_port(struct ib_device *dev, +- u32 port_num, int mask, struct ib_port_modify *attr) ++static int rxe_modify_port(struct ib_device *ibdev, u32 port_num, ++ int mask, struct ib_port_modify *attr) + { +- struct rxe_dev *rxe = to_rdev(dev); ++ struct rxe_dev *rxe = to_rdev(ibdev); + struct rxe_port *port; ++ int err; + +- port = &rxe->port; ++ if (port_num != 1) { ++ err = -EINVAL; ++ rxe_dbg_dev(rxe, "bad port_num = %d", port_num); ++ goto err_out; ++ } + ++ //TODO is shutdown useful ++ if (mask & ~(IB_PORT_RESET_QKEY_CNTR)) { ++ err = -EOPNOTSUPP; ++ rxe_dbg_dev(rxe, "unsupported mask = 0x%x", mask); ++ goto err_out; ++ } ++ ++ port = &rxe->port; + port->attr.port_cap_flags |= attr->set_port_cap_mask; + port->attr.port_cap_flags &= ~attr->clr_port_cap_mask; + +@@ -95,73 +147,125 @@ static int rxe_modify_port(struct ib_device *dev, + port->attr.qkey_viol_cntr = 0; + + return 0; +-} + +-static enum rdma_link_layer rxe_get_link_layer(struct ib_device *dev, +- u32 port_num) +-{ +- return IB_LINK_LAYER_ETHERNET; ++err_out: ++ rxe_err_dev(rxe, "returned err = %d", err); ++ return err; + } + +-static int rxe_alloc_ucontext(struct ib_ucontext *ibuc, struct ib_udata *udata) ++static enum rdma_link_layer rxe_get_link_layer(struct ib_device *ibdev, ++ u32 port_num) + { +- struct rxe_dev *rxe = to_rdev(ibuc->device); +- struct rxe_ucontext *uc = to_ruc(ibuc); ++ struct rxe_dev *rxe = to_rdev(ibdev); ++ int err; + +- return rxe_add_to_pool(&rxe->uc_pool, uc); +-} ++ if (port_num != 1) { ++ err = -EINVAL; ++ rxe_dbg_dev(rxe, "bad port_num = %d", port_num); ++ goto err_out; ++ } + +-static void rxe_dealloc_ucontext(struct ib_ucontext *ibuc) +-{ +- struct rxe_ucontext *uc = to_ruc(ibuc); ++ return IB_LINK_LAYER_ETHERNET; + +- rxe_cleanup(uc); ++err_out: ++ rxe_err_dev(rxe, "returned err = %d", err); ++ return err; + } + +-static int rxe_port_immutable(struct ib_device *dev, u32 port_num, ++static int rxe_port_immutable(struct ib_device *ibdev, u32 port_num, + struct ib_port_immutable *immutable) + { ++ struct rxe_dev *rxe = to_rdev(ibdev); ++ struct ib_port_attr attr = {}; + int err; +- struct ib_port_attr attr; + +- immutable->core_cap_flags = RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP; ++ if (port_num != 1) { ++ err = -EINVAL; ++ rxe_dbg_dev(rxe, "bad port_num = %d", port_num); ++ goto err_out; ++ } + +- err = ib_query_port(dev, port_num, &attr); ++ err = ib_query_port(ibdev, port_num, &attr); + if (err) +- return err; ++ goto err_out; + ++ immutable->core_cap_flags = RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP; + immutable->pkey_tbl_len = attr.pkey_tbl_len; + immutable->gid_tbl_len = attr.gid_tbl_len; + immutable->max_mad_size = IB_MGMT_MAD_SIZE; + + return 0; ++ ++err_out: ++ rxe_err_dev(rxe, "returned err = %d", err); ++ return err; + } + ++/* uc */ ++static int rxe_alloc_ucontext(struct ib_ucontext *ibuc, struct ib_udata *udata) ++{ ++ struct rxe_dev *rxe = to_rdev(ibuc->device); ++ struct rxe_ucontext *uc = to_ruc(ibuc); ++ int err; ++ ++ err = rxe_add_to_pool(&rxe->uc_pool, uc); ++ if (err) ++ rxe_err_dev(rxe, "unable to create uc"); ++ ++ return err; ++} ++ ++static void rxe_dealloc_ucontext(struct ib_ucontext *ibuc) ++{ ++ struct rxe_ucontext *uc = to_ruc(ibuc); ++ int err; ++ ++ err = rxe_cleanup(uc); ++ if (err) ++ rxe_err_uc(uc, "cleanup failed, err = %d", err); ++} ++ ++/* pd */ + static int rxe_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata) + { + struct rxe_dev *rxe = to_rdev(ibpd->device); + struct rxe_pd *pd = to_rpd(ibpd); ++ int err; ++ ++ err = rxe_add_to_pool(&rxe->pd_pool, pd); ++ if (err) { ++ rxe_dbg_dev(rxe, "unable to alloc pd"); ++ goto err_out; ++ } + +- return rxe_add_to_pool(&rxe->pd_pool, pd); ++ return 0; ++ ++err_out: ++ rxe_err_dev(rxe, "returned err = %d", err); ++ return err; + } + + static int rxe_dealloc_pd(struct ib_pd *ibpd, struct ib_udata *udata) + { + struct rxe_pd *pd = to_rpd(ibpd); ++ int err; ++ ++ err = rxe_cleanup(pd); ++ if (err) ++ rxe_err_pd(pd, "cleanup failed, err = %d", err); + +- rxe_cleanup(pd); + return 0; + } + ++/* ah */ + static int rxe_create_ah(struct ib_ah *ibah, + struct rdma_ah_init_attr *init_attr, + struct ib_udata *udata) +- + { + struct rxe_dev *rxe = to_rdev(ibah->device); + struct rxe_ah *ah = to_rah(ibah); + struct rxe_create_ah_resp __user *uresp = NULL; +- int err; ++ int err, cleanup_err; + + if (udata) { + /* test if new user provider */ +@@ -174,16 +278,18 @@ static int rxe_create_ah(struct ib_ah *ibah, + + err = rxe_add_to_pool_ah(&rxe->ah_pool, ah, + init_attr->flags & RDMA_CREATE_AH_SLEEPABLE); +- if (err) +- return err; ++ if (err) { ++ rxe_dbg_dev(rxe, "unable to create ah"); ++ goto err_out; ++ } + + /* create index > 0 */ + ah->ah_num = ah->elem.index; + + err = rxe_ah_chk_attr(ah, init_attr->ah_attr); + if (err) { +- rxe_cleanup(ah); +- return err; ++ rxe_dbg_ah(ah, "bad attr"); ++ goto err_cleanup; + } + + if (uresp) { +@@ -191,8 +297,9 @@ static int rxe_create_ah(struct ib_ah *ibah, + err = copy_to_user(&uresp->ah_num, &ah->ah_num, + sizeof(uresp->ah_num)); + if (err) { +- rxe_cleanup(ah); +- return -EFAULT; ++ err = -EFAULT; ++ rxe_dbg_ah(ah, "unable to copy to user"); ++ goto err_cleanup; + } + } else if (ah->is_user) { + /* only if old user provider */ +@@ -203,19 +310,34 @@ static int rxe_create_ah(struct ib_ah *ibah, + rxe_finalize(ah); + + return 0; ++ ++err_cleanup: ++ cleanup_err = rxe_cleanup(ah); ++ if (cleanup_err) ++ rxe_err_ah(ah, "cleanup failed, err = %d", cleanup_err); ++err_out: ++ rxe_err_ah(ah, "returned err = %d", err); ++ return err; + } + + static int rxe_modify_ah(struct ib_ah *ibah, struct rdma_ah_attr *attr) + { +- int err; + struct rxe_ah *ah = to_rah(ibah); ++ int err; + + err = rxe_ah_chk_attr(ah, attr); +- if (err) +- return err; ++ if (err) { ++ rxe_dbg_ah(ah, "bad attr"); ++ goto err_out; ++ } + + rxe_init_av(attr, &ah->av); ++ + return 0; ++ ++err_out: ++ rxe_err_ah(ah, "returned err = %d", err); ++ return err; + } + + static int rxe_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *attr) +@@ -225,92 +347,77 @@ static int rxe_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *attr) + memset(attr, 0, sizeof(*attr)); + attr->type = ibah->type; + rxe_av_to_attr(&ah->av, attr); ++ + return 0; + } + + static int rxe_destroy_ah(struct ib_ah *ibah, u32 flags) + { + struct rxe_ah *ah = to_rah(ibah); ++ int err; + +- rxe_cleanup_ah(ah, flags & RDMA_DESTROY_AH_SLEEPABLE); +- +- return 0; +-} +- +-static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr) +-{ +- int i; +- u32 length; +- struct rxe_recv_wqe *recv_wqe; +- int num_sge = ibwr->num_sge; +- int full; +- +- full = queue_full(rq->queue, QUEUE_TYPE_FROM_ULP); +- if (unlikely(full)) +- return -ENOMEM; +- +- if (unlikely(num_sge > rq->max_sge)) +- return -EINVAL; +- +- length = 0; +- for (i = 0; i < num_sge; i++) +- length += ibwr->sg_list[i].length; +- +- recv_wqe = queue_producer_addr(rq->queue, QUEUE_TYPE_FROM_ULP); +- recv_wqe->wr_id = ibwr->wr_id; +- +- memcpy(recv_wqe->dma.sge, ibwr->sg_list, +- num_sge * sizeof(struct ib_sge)); +- +- recv_wqe->dma.length = length; +- recv_wqe->dma.resid = length; +- recv_wqe->dma.num_sge = num_sge; +- recv_wqe->dma.cur_sge = 0; +- recv_wqe->dma.sge_offset = 0; +- +- queue_advance_producer(rq->queue, QUEUE_TYPE_FROM_ULP); ++ err = rxe_cleanup_ah(ah, flags & RDMA_DESTROY_AH_SLEEPABLE); ++ if (err) ++ rxe_err_ah(ah, "cleanup failed, err = %d", err); + + return 0; + } + ++/* srq */ + static int rxe_create_srq(struct ib_srq *ibsrq, struct ib_srq_init_attr *init, + struct ib_udata *udata) + { +- int err; + struct rxe_dev *rxe = to_rdev(ibsrq->device); + struct rxe_pd *pd = to_rpd(ibsrq->pd); + struct rxe_srq *srq = to_rsrq(ibsrq); + struct rxe_create_srq_resp __user *uresp = NULL; ++ int err, cleanup_err; + + if (udata) { +- if (udata->outlen < sizeof(*uresp)) +- return -EINVAL; ++ if (udata->outlen < sizeof(*uresp)) { ++ err = -EINVAL; ++ rxe_err_dev(rxe, "malformed udata"); ++ goto err_out; ++ } + uresp = udata->outbuf; + } + +- if (init->srq_type != IB_SRQT_BASIC) +- return -EOPNOTSUPP; ++ if (init->srq_type != IB_SRQT_BASIC) { ++ err = -EOPNOTSUPP; ++ rxe_dbg_dev(rxe, "srq type = %d, not supported", ++ init->srq_type); ++ goto err_out; ++ } + + err = rxe_srq_chk_init(rxe, init); +- if (err) +- return err; ++ if (err) { ++ rxe_dbg_dev(rxe, "invalid init attributes"); ++ goto err_out; ++ } + + err = rxe_add_to_pool(&rxe->srq_pool, srq); +- if (err) +- return err; ++ if (err) { ++ rxe_dbg_dev(rxe, "unable to create srq, err = %d", err); ++ goto err_out; ++ } + + rxe_get(pd); + srq->pd = pd; + + err = rxe_srq_from_init(rxe, srq, init, udata, uresp); +- if (err) ++ if (err) { ++ rxe_dbg_srq(srq, "create srq failed, err = %d", err); + goto err_cleanup; ++ } + + return 0; + + err_cleanup: +- rxe_cleanup(srq); +- ++ cleanup_err = rxe_cleanup(srq); ++ if (cleanup_err) ++ rxe_err_srq(srq, "cleanup failed, err = %d", cleanup_err); ++err_out: ++ rxe_err_dev(rxe, "returned err = %d", err); + return err; + } + +@@ -318,46 +425,64 @@ static int rxe_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr, + enum ib_srq_attr_mask mask, + struct ib_udata *udata) + { +- int err; + struct rxe_srq *srq = to_rsrq(ibsrq); + struct rxe_dev *rxe = to_rdev(ibsrq->device); +- struct rxe_modify_srq_cmd ucmd = {}; ++ struct rxe_modify_srq_cmd cmd = {}; ++ int err; + + if (udata) { +- if (udata->inlen < sizeof(ucmd)) +- return -EINVAL; ++ if (udata->inlen < sizeof(cmd)) { ++ err = -EINVAL; ++ rxe_dbg_srq(srq, "malformed udata"); ++ goto err_out; ++ } + +- err = ib_copy_from_udata(&ucmd, udata, sizeof(ucmd)); +- if (err) +- return err; ++ err = ib_copy_from_udata(&cmd, udata, sizeof(cmd)); ++ if (err) { ++ err = -EFAULT; ++ rxe_dbg_srq(srq, "unable to read udata"); ++ goto err_out; ++ } + } + + err = rxe_srq_chk_attr(rxe, srq, attr, mask); +- if (err) +- return err; ++ if (err) { ++ rxe_dbg_srq(srq, "bad init attributes"); ++ goto err_out; ++ } ++ ++ err = rxe_srq_from_attr(rxe, srq, attr, mask, &cmd, udata); ++ if (err) { ++ rxe_dbg_srq(srq, "bad attr"); ++ goto err_out; ++ } ++ ++ return 0; + +- return rxe_srq_from_attr(rxe, srq, attr, mask, &ucmd, udata); ++err_out: ++ rxe_err_srq(srq, "returned err = %d", err); ++ return err; + } + + static int rxe_query_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr) + { + struct rxe_srq *srq = to_rsrq(ibsrq); ++ int err; + +- if (srq->error) +- return -EINVAL; ++ if (srq->error) { ++ err = -EINVAL; ++ rxe_dbg_srq(srq, "srq in error state"); ++ goto err_out; ++ } + + attr->max_wr = srq->rq.queue->buf->index_mask; + attr->max_sge = srq->rq.max_sge; + attr->srq_limit = srq->limit; + return 0; +-} +- +-static int rxe_destroy_srq(struct ib_srq *ibsrq, struct ib_udata *udata) +-{ +- struct rxe_srq *srq = to_rsrq(ibsrq); + +- rxe_cleanup(srq); +- return 0; ++err_out: ++ rxe_err_srq(srq, "returned err = %d", err); ++ return err; + } + + static int rxe_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, +@@ -378,76 +503,116 @@ static int rxe_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, + + spin_unlock_irqrestore(&srq->rq.producer_lock, flags); + +- if (err) ++ if (err) { + *bad_wr = wr; ++ rxe_err_srq(srq, "returned err = %d", err); ++ } + + return err; + } + ++static int rxe_destroy_srq(struct ib_srq *ibsrq, struct ib_udata *udata) ++{ ++ struct rxe_srq *srq = to_rsrq(ibsrq); ++ int err; ++ ++ err = rxe_cleanup(srq); ++ if (err) ++ rxe_err_srq(srq, "cleanup failed, err = %d", err); ++ ++ return 0; ++} ++ ++/* qp */ + static int rxe_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init, + struct ib_udata *udata) + { +- int err; + struct rxe_dev *rxe = to_rdev(ibqp->device); + struct rxe_pd *pd = to_rpd(ibqp->pd); + struct rxe_qp *qp = to_rqp(ibqp); + struct rxe_create_qp_resp __user *uresp = NULL; ++ int err, cleanup_err; + + if (udata) { +- if (udata->outlen < sizeof(*uresp)) +- return -EINVAL; +- uresp = udata->outbuf; +- } +- +- if (init->create_flags) +- return -EOPNOTSUPP; +- +- err = rxe_qp_chk_init(rxe, init); +- if (err) +- return err; ++ if (udata->inlen) { ++ err = -EINVAL; ++ rxe_dbg_dev(rxe, "malformed udata, err = %d", err); ++ goto err_out; ++ } + +- if (udata) { +- if (udata->inlen) +- return -EINVAL; ++ if (udata->outlen < sizeof(*uresp)) { ++ err = -EINVAL; ++ rxe_dbg_dev(rxe, "malformed udata, err = %d", err); ++ goto err_out; ++ } + + qp->is_user = true; ++ uresp = udata->outbuf; + } else { + qp->is_user = false; + } + ++ if (init->create_flags) { ++ err = -EOPNOTSUPP; ++ rxe_dbg_dev(rxe, "unsupported create_flags, err = %d", err); ++ goto err_out; ++ } ++ ++ err = rxe_qp_chk_init(rxe, init); ++ if (err) { ++ rxe_dbg_dev(rxe, "bad init attr, err = %d", err); ++ goto err_out; ++ } ++ + err = rxe_add_to_pool(&rxe->qp_pool, qp); +- if (err) +- return err; ++ if (err) { ++ rxe_dbg_dev(rxe, "unable to create qp, err = %d", err); ++ goto err_out; ++ } + + err = rxe_qp_from_init(rxe, qp, pd, init, uresp, ibqp->pd, udata); +- if (err) +- goto qp_init; ++ if (err) { ++ rxe_dbg_qp(qp, "create qp failed, err = %d", err); ++ goto err_cleanup; ++ } + + rxe_finalize(qp); + return 0; + +-qp_init: +- rxe_cleanup(qp); ++err_cleanup: ++ cleanup_err = rxe_cleanup(qp); ++ if (cleanup_err) ++ rxe_err_qp(qp, "cleanup failed, err = %d", cleanup_err); ++err_out: ++ rxe_err_dev(rxe, "returned err = %d", err); + return err; + } + + static int rxe_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, + int mask, struct ib_udata *udata) + { +- int err; + struct rxe_dev *rxe = to_rdev(ibqp->device); + struct rxe_qp *qp = to_rqp(ibqp); ++ int err; + +- if (mask & ~IB_QP_ATTR_STANDARD_BITS) +- return -EOPNOTSUPP; ++ if (mask & ~IB_QP_ATTR_STANDARD_BITS) { ++ err = -EOPNOTSUPP; ++ rxe_dbg_qp(qp, "unsupported mask = 0x%x, err = %d", ++ mask, err); ++ goto err_out; ++ } + + err = rxe_qp_chk_attr(rxe, qp, attr, mask); +- if (err) +- return err; ++ if (err) { ++ rxe_dbg_qp(qp, "bad mask/attr, err = %d", err); ++ goto err_out; ++ } + + err = rxe_qp_from_attr(qp, attr, mask, udata); +- if (err) +- return err; ++ if (err) { ++ rxe_dbg_qp(qp, "modify qp failed, err = %d", err); ++ goto err_out; ++ } + + if ((mask & IB_QP_AV) && (attr->ah_attr.ah_flags & IB_AH_GRH)) + qp->src_port = rdma_get_udp_sport(attr->ah_attr.grh.flow_label, +@@ -455,6 +620,10 @@ static int rxe_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, + qp->attr.dest_qp_num); + + return 0; ++ ++err_out: ++ rxe_err_qp(qp, "returned err = %d", err); ++ return err; + } + + static int rxe_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, +@@ -471,38 +640,59 @@ static int rxe_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, + static int rxe_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) + { + struct rxe_qp *qp = to_rqp(ibqp); +- int ret; ++ int err; ++ ++ err = rxe_qp_chk_destroy(qp); ++ if (err) { ++ rxe_dbg_qp(qp, "unable to destroy qp, err = %d", err); ++ goto err_out; ++ } + +- ret = rxe_qp_chk_destroy(qp); +- if (ret) +- return ret; ++ err = rxe_cleanup(qp); ++ if (err) ++ rxe_err_qp(qp, "cleanup failed, err = %d", err); + +- rxe_cleanup(qp); + return 0; ++ ++err_out: ++ rxe_err_qp(qp, "returned err = %d", err); ++ return err; + } + ++/* send wr */ + static int validate_send_wr(struct rxe_qp *qp, const struct ib_send_wr *ibwr, + unsigned int mask, unsigned int length) + { + int num_sge = ibwr->num_sge; + struct rxe_sq *sq = &qp->sq; + +- if (unlikely(num_sge > sq->max_sge)) +- return -EINVAL; ++ if (unlikely(num_sge > sq->max_sge)) { ++ rxe_dbg_qp(qp, "num_sge > max_sge"); ++ goto err_out; ++ } + + if (unlikely(mask & WR_ATOMIC_MASK)) { +- if (length < 8) +- return -EINVAL; ++ if (length != 8) { ++ rxe_dbg_qp(qp, "atomic length != 8"); ++ goto err_out; ++ } + +- if (atomic_wr(ibwr)->remote_addr & 0x7) +- return -EINVAL; ++ if (atomic_wr(ibwr)->remote_addr & 0x7) { ++ rxe_dbg_qp(qp, "misaligned atomic address"); ++ goto err_out; ++ } + } + + if (unlikely((ibwr->send_flags & IB_SEND_INLINE) && +- (length > sq->max_inline))) +- return -EINVAL; ++ (length > sq->max_inline))) { ++ rxe_dbg_qp(qp, "inline length too big"); ++ goto err_out; ++ } + + return 0; ++ ++err_out: ++ return -EINVAL; + } + + static void init_send_wr(struct rxe_qp *qp, struct rxe_send_wr *wr, +@@ -550,12 +740,12 @@ static void init_send_wr(struct rxe_qp *qp, struct rxe_send_wr *wr, + break; + case IB_WR_LOCAL_INV: + wr->ex.invalidate_rkey = ibwr->ex.invalidate_rkey; +- break; ++ break; + case IB_WR_REG_MR: + wr->wr.reg.mr = reg_wr(ibwr)->mr; + wr->wr.reg.key = reg_wr(ibwr)->key; + wr->wr.reg.access = reg_wr(ibwr)->access; +- break; ++ break; + default: + break; + } +@@ -624,9 +814,9 @@ static int post_one_send(struct rxe_qp *qp, const struct ib_send_wr *ibwr, + spin_lock_irqsave(&qp->sq.sq_lock, flags); + + full = queue_full(sq->queue, QUEUE_TYPE_FROM_ULP); +- + if (unlikely(full)) { + spin_unlock_irqrestore(&qp->sq.sq_lock, flags); ++ rxe_dbg_qp(qp, "queue full"); + return -ENOMEM; + } + +@@ -652,6 +842,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, + while (wr) { + mask = wr_opcode_mask(wr->opcode, qp); + if (unlikely(!mask)) { ++ rxe_dbg_qp(qp, "bad wr opcode for qp"); + err = -EINVAL; + *bad_wr = wr; + break; +@@ -659,6 +850,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, + + if (unlikely((wr->send_flags & IB_SEND_INLINE) && + !(mask & WR_INLINE_MASK))) { ++ rxe_dbg_qp(qp, "opcode doesn't support inline data"); + err = -EINVAL; + *bad_wr = wr; + break; +@@ -669,17 +861,26 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, + length = 0; + for (i = 0; i < wr->num_sge; i++) + length += wr->sg_list[i].length; ++ if (length > 1<<31) { ++ err = -EINVAL; ++ rxe_dbg_qp(qp, "message length too long"); ++ *bad_wr = wr; ++ break; ++ } + + err = post_one_send(qp, wr, mask, length); +- + if (err) { + *bad_wr = wr; + break; + } ++ + wr = next; + } + +- rxe_sched_task(&qp->req.task); ++ /* if we didn't post anything there's nothing to do */ ++ if (!err) ++ rxe_sched_task(&qp->req.task); ++ + if (unlikely(qp->req.state == QP_STATE_ERROR)) + rxe_sched_task(&qp->comp.task); + +@@ -690,23 +891,90 @@ static int rxe_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr, + const struct ib_send_wr **bad_wr) + { + struct rxe_qp *qp = to_rqp(ibqp); ++ int err; + + if (unlikely(!qp->valid)) { + *bad_wr = wr; +- return -EINVAL; ++ err = -EINVAL; ++ rxe_dbg_qp(qp, "qp destroyed"); ++ goto err_out; + } + + if (unlikely(qp->req.state < QP_STATE_READY)) { + *bad_wr = wr; +- return -EINVAL; ++ err = -EINVAL; ++ rxe_dbg_qp(qp, "qp not ready to send"); ++ goto err_out; + } + + if (qp->is_user) { + /* Utilize process context to do protocol processing */ + rxe_run_task(&qp->req.task); +- return 0; +- } else +- return rxe_post_send_kernel(qp, wr, bad_wr); ++ } else { ++ err = rxe_post_send_kernel(qp, wr, bad_wr); ++ if (err) ++ goto err_out; ++ } ++ ++ return 0; ++ ++err_out: ++ rxe_err_qp(qp, "returned err = %d", err); ++ return err; ++} ++ ++/* recv wr */ ++static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr) ++{ ++ int i; ++ unsigned long length; ++ struct rxe_recv_wqe *recv_wqe; ++ int num_sge = ibwr->num_sge; ++ int full; ++ int err; ++ ++ full = queue_full(rq->queue, QUEUE_TYPE_FROM_ULP); ++ if (unlikely(full)) { ++ err = -ENOMEM; ++ rxe_dbg("queue full"); ++ goto err_out; ++ } ++ ++ if (unlikely(num_sge > rq->max_sge)) { ++ err = -EINVAL; ++ rxe_dbg("bad num_sge > max_sge"); ++ goto err_out; ++ } ++ ++ length = 0; ++ for (i = 0; i < num_sge; i++) ++ length += ibwr->sg_list[i].length; ++ ++ /* IBA max message size is 2^31 */ ++ if (length >= (1UL<<31)) { ++ err = -EINVAL; ++ rxe_dbg("message length too long"); ++ goto err_out; ++ } ++ ++ recv_wqe = queue_producer_addr(rq->queue, QUEUE_TYPE_FROM_ULP); ++ ++ recv_wqe->wr_id = ibwr->wr_id; ++ recv_wqe->dma.length = length; ++ recv_wqe->dma.resid = length; ++ recv_wqe->dma.num_sge = num_sge; ++ recv_wqe->dma.cur_sge = 0; ++ recv_wqe->dma.sge_offset = 0; ++ memcpy(recv_wqe->dma.sge, ibwr->sg_list, ++ num_sge * sizeof(struct ib_sge)); ++ ++ queue_advance_producer(rq->queue, QUEUE_TYPE_FROM_ULP); ++ ++ return 0; ++ ++err_out: ++ rxe_dbg("returned err = %d", err); ++ return err; + } + + static int rxe_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *wr, +@@ -719,12 +987,16 @@ static int rxe_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *wr, + + if (unlikely((qp_state(qp) < IB_QPS_INIT) || !qp->valid)) { + *bad_wr = wr; +- return -EINVAL; ++ err = -EINVAL; ++ rxe_dbg_qp(qp, "qp destroyed or not ready to post recv"); ++ goto err_out; + } + + if (unlikely(qp->srq)) { + *bad_wr = wr; +- return -EINVAL; ++ err = -EINVAL; ++ rxe_dbg_qp(qp, "use post_srq_recv instead"); ++ goto err_out; + } + + spin_lock_irqsave(&rq->producer_lock, flags); +@@ -743,73 +1015,101 @@ static int rxe_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *wr, + if (qp->resp.state == QP_STATE_ERROR) + rxe_sched_task(&qp->resp.task); + ++err_out: ++ if (err) ++ rxe_err_qp(qp, "returned err = %d", err); ++ + return err; + } + ++/* cq */ + static int rxe_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata) + { +- int err; + struct ib_device *dev = ibcq->device; + struct rxe_dev *rxe = to_rdev(dev); + struct rxe_cq *cq = to_rcq(ibcq); + struct rxe_create_cq_resp __user *uresp = NULL; ++ int err, cleanup_err; + + if (udata) { +- if (udata->outlen < sizeof(*uresp)) +- return -EINVAL; ++ if (udata->outlen < sizeof(*uresp)) { ++ err = -EINVAL; ++ rxe_dbg_dev(rxe, "malformed udata, err = %d", err); ++ goto err_out; ++ } + uresp = udata->outbuf; + } + +- if (attr->flags) +- return -EOPNOTSUPP; ++ if (attr->flags) { ++ err = -EOPNOTSUPP; ++ rxe_dbg_dev(rxe, "bad attr->flags, err = %d", err); ++ goto err_out; ++ } + + err = rxe_cq_chk_attr(rxe, NULL, attr->cqe, attr->comp_vector); +- if (err) +- return err; ++ if (err) { ++ rxe_dbg_dev(rxe, "bad init attributes, err = %d", err); ++ goto err_out; ++ } ++ ++ err = rxe_add_to_pool(&rxe->cq_pool, cq); ++ if (err) { ++ rxe_dbg_dev(rxe, "unable to create cq, err = %d", err); ++ goto err_out; ++ } + + err = rxe_cq_from_init(rxe, cq, attr->cqe, attr->comp_vector, udata, + uresp); +- if (err) +- return err; +- +- return rxe_add_to_pool(&rxe->cq_pool, cq); +-} +- +-static int rxe_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) +-{ +- struct rxe_cq *cq = to_rcq(ibcq); +- +- /* See IBA C11-17: The CI shall return an error if this Verb is +- * invoked while a Work Queue is still associated with the CQ. +- */ +- if (atomic_read(&cq->num_wq)) +- return -EINVAL; +- +- rxe_cq_disable(cq); ++ if (err) { ++ rxe_dbg_cq(cq, "create cq failed, err = %d", err); ++ goto err_cleanup; ++ } + +- rxe_cleanup(cq); + return 0; ++ ++err_cleanup: ++ cleanup_err = rxe_cleanup(cq); ++ if (cleanup_err) ++ rxe_err_cq(cq, "cleanup failed, err = %d", cleanup_err); ++err_out: ++ rxe_err_dev(rxe, "returned err = %d", err); ++ return err; + } + + static int rxe_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata) + { +- int err; + struct rxe_cq *cq = to_rcq(ibcq); + struct rxe_dev *rxe = to_rdev(ibcq->device); + struct rxe_resize_cq_resp __user *uresp = NULL; ++ int err; + + if (udata) { +- if (udata->outlen < sizeof(*uresp)) +- return -EINVAL; ++ if (udata->outlen < sizeof(*uresp)) { ++ err = -EINVAL; ++ rxe_dbg_cq(cq, "malformed udata"); ++ goto err_out; ++ } + uresp = udata->outbuf; + } + + err = rxe_cq_chk_attr(rxe, cq, cqe, 0); +- if (err) +- return err; ++ if (err) { ++ rxe_dbg_cq(cq, "bad attr, err = %d", err); ++ goto err_out; ++ } + +- return rxe_cq_resize_queue(cq, cqe, uresp, udata); ++ err = rxe_cq_resize_queue(cq, cqe, uresp, udata); ++ if (err) { ++ rxe_dbg_cq(cq, "resize cq failed, err = %d", err); ++ goto err_out; ++ } ++ ++ return 0; ++ ++err_out: ++ rxe_err_cq(cq, "returned err = %d", err); ++ return err; + } + + static int rxe_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc) +@@ -823,7 +1123,7 @@ static int rxe_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc) + for (i = 0; i < num_entries; i++) { + cqe = queue_head(cq->queue, QUEUE_TYPE_TO_ULP); + if (!cqe) +- break; ++ break; /* queue empty */ + + memcpy(wc++, &cqe->ibwc, sizeof(*wc)); + queue_advance_consumer(cq->queue, QUEUE_TYPE_TO_ULP); +@@ -864,6 +1164,34 @@ static int rxe_req_notify_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags) + return ret; + } + ++static int rxe_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) ++{ ++ struct rxe_cq *cq = to_rcq(ibcq); ++ int err; ++ ++ /* See IBA C11-17: The CI shall return an error if this Verb is ++ * invoked while a Work Queue is still associated with the CQ. ++ */ ++ if (atomic_read(&cq->num_wq)) { ++ err = -EINVAL; ++ rxe_dbg_cq(cq, "still in use"); ++ goto err_out; ++ } ++ ++ rxe_cq_disable(cq); ++ ++ err = rxe_cleanup(cq); ++ if (err) ++ rxe_err_cq(cq, "cleanup failed, err = %d", err); ++ ++ return 0; ++ ++err_out: ++ rxe_err_cq(cq, "returned err = %d", err); ++ return err; ++} ++ ++/* mr */ + static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access) + { + struct rxe_dev *rxe = to_rdev(ibpd->device); +@@ -874,12 +1202,15 @@ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access) + mr = kzalloc(sizeof(*mr), GFP_KERNEL); + if (!mr) { + err = -ENOMEM; ++ rxe_dbg_dev(rxe, "no memory for mr"); + goto err_out; + } + + err = rxe_add_to_pool(&rxe->mr_pool, mr); +- if (err) ++ if (err) { ++ rxe_dbg_dev(rxe, "unable to create mr"); + goto err_free; ++ } + + rxe_get(pd); + mr->ibmr.pd = ibpd; +@@ -892,46 +1223,53 @@ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access) + err_free: + kfree(mr); + err_out: ++ rxe_err_pd(pd, "returned err = %d", err); + return ERR_PTR(err); + } + +-static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, +- u64 start, +- u64 length, +- u64 iova, +- int access, struct ib_udata *udata) ++static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, u64 start, ++ u64 length, u64 iova, int access, ++ struct ib_udata *udata) + { +- int err; + struct rxe_dev *rxe = to_rdev(ibpd->device); + struct rxe_pd *pd = to_rpd(ibpd); + struct rxe_mr *mr; ++ int err, cleanup_err; + + mr = kzalloc(sizeof(*mr), GFP_KERNEL); + if (!mr) { + err = -ENOMEM; ++ rxe_dbg_pd(pd, "no memory for mr"); + goto err_out; + } + + err = rxe_add_to_pool(&rxe->mr_pool, mr); +- if (err) ++ if (err) { ++ rxe_dbg_pd(pd, "unable to create mr"); + goto err_free; ++ } + + rxe_get(pd); + mr->ibmr.pd = ibpd; + mr->ibmr.device = ibpd->device; + + err = rxe_mr_init_user(rxe, start, length, iova, access, mr); +- if (err) ++ if (err) { ++ rxe_dbg_mr(mr, "reg_user_mr failed, err = %d", err); + goto err_cleanup; ++ } + + rxe_finalize(mr); + return &mr->ibmr; + + err_cleanup: +- rxe_cleanup(mr); ++ cleanup_err = rxe_cleanup(mr); ++ if (cleanup_err) ++ rxe_err_mr(mr, "cleanup failed, err = %d", cleanup_err); + err_free: + kfree(mr); + err_out: ++ rxe_err_pd(pd, "returned err = %d", err); + return ERR_PTR(err); + } + +@@ -941,40 +1279,76 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type, + struct rxe_dev *rxe = to_rdev(ibpd->device); + struct rxe_pd *pd = to_rpd(ibpd); + struct rxe_mr *mr; +- int err; ++ int err, cleanup_err; + +- if (mr_type != IB_MR_TYPE_MEM_REG) +- return ERR_PTR(-EINVAL); ++ if (mr_type != IB_MR_TYPE_MEM_REG) { ++ err = -EINVAL; ++ rxe_dbg_pd(pd, "mr type %d not supported, err = %d", ++ mr_type, err); ++ goto err_out; ++ } + + mr = kzalloc(sizeof(*mr), GFP_KERNEL); + if (!mr) { + err = -ENOMEM; ++ rxe_dbg_mr(mr, "no memory for mr"); + goto err_out; + } + + err = rxe_add_to_pool(&rxe->mr_pool, mr); +- if (err) ++ if (err) { ++ rxe_dbg_mr(mr, "unable to create mr, err = %d", err); + goto err_free; ++ } + + rxe_get(pd); + mr->ibmr.pd = ibpd; + mr->ibmr.device = ibpd->device; + + err = rxe_mr_init_fast(max_num_sg, mr); +- if (err) ++ if (err) { ++ rxe_dbg_mr(mr, "alloc_mr failed, err = %d", err); + goto err_cleanup; ++ } + + rxe_finalize(mr); + return &mr->ibmr; + + err_cleanup: +- rxe_cleanup(mr); ++ cleanup_err = rxe_cleanup(mr); ++ if (cleanup_err) ++ rxe_err_mr(mr, "cleanup failed, err = %d", err); + err_free: + kfree(mr); + err_out: ++ rxe_err_pd(pd, "returned err = %d", err); + return ERR_PTR(err); + } + ++static int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata) ++{ ++ struct rxe_mr *mr = to_rmr(ibmr); ++ int err, cleanup_err; ++ ++ /* See IBA 10.6.7.2.6 */ ++ if (atomic_read(&mr->num_mw) > 0) { ++ err = -EINVAL; ++ rxe_dbg_mr(mr, "mr has mw's bound"); ++ goto err_out; ++ } ++ ++ cleanup_err = rxe_cleanup(mr); ++ if (cleanup_err) ++ rxe_err_mr(mr, "cleanup failed, err = %d", cleanup_err); ++ ++ kfree_rcu(mr); ++ return 0; ++ ++err_out: ++ rxe_err_mr(mr, "returned err = %d", err); ++ return err; ++} ++ + static ssize_t parent_show(struct device *device, + struct device_attribute *attr, char *buf) + { +-- +2.39.2 + diff --git a/queue-6.2/rdma-rxe-change-rxe_dbg-to-rxe_dbg_dev.patch b/queue-6.2/rdma-rxe-change-rxe_dbg-to-rxe_dbg_dev.patch new file mode 100644 index 00000000000..5dde31440d4 --- /dev/null +++ b/queue-6.2/rdma-rxe-change-rxe_dbg-to-rxe_dbg_dev.patch @@ -0,0 +1,275 @@ +From b9ae89a1169d2759138ce6300d0c5bc2c0855bce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 16:16:22 -0600 +Subject: RDMA/rxe: Change rxe_dbg to rxe_dbg_dev + +From: Bob Pearson + +[ Upstream commit a9fb3287211e64b94ceb2b6b4791cc2b829d0d56 ] + +Replace the name rxe_dbg with rxe_dbg_dev which better matches +the remaining rxe_dbg_xxx macros for debug messages with a +rxe device parameter. Reuse the name rxe_dbg for debug messages +which do not have a rxe device parameter. + +Link: https://lore.kernel.org/r/20230303221623.8053-3-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 78b26a335310 ("RDMA/rxe: Remove tasklet call from rxe_cq.c") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe.c | 2 +- + drivers/infiniband/sw/rxe/rxe.h | 3 ++- + drivers/infiniband/sw/rxe/rxe_cq.c | 6 +++--- + drivers/infiniband/sw/rxe/rxe_icrc.c | 4 ++-- + drivers/infiniband/sw/rxe/rxe_mmap.c | 6 +++--- + drivers/infiniband/sw/rxe/rxe_net.c | 4 ++-- + drivers/infiniband/sw/rxe/rxe_qp.c | 16 ++++++++-------- + drivers/infiniband/sw/rxe/rxe_srq.c | 6 +++--- + drivers/infiniband/sw/rxe/rxe_verbs.c | 2 +- + 9 files changed, 25 insertions(+), 24 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c +index a3f05fdd9fac2..d57ba7a5964b9 100644 +--- a/drivers/infiniband/sw/rxe/rxe.c ++++ b/drivers/infiniband/sw/rxe/rxe.c +@@ -187,7 +187,7 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev) + rxe = rxe_get_dev_from_net(ndev); + if (rxe) { + ib_device_put(&rxe->ib_dev); +- rxe_dbg(rxe, "already configured on %s\n", ndev->name); ++ rxe_dbg_dev(rxe, "already configured on %s\n", ndev->name); + err = -EEXIST; + goto err; + } +diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h +index 2415f3704f576..0757acc381038 100644 +--- a/drivers/infiniband/sw/rxe/rxe.h ++++ b/drivers/infiniband/sw/rxe/rxe.h +@@ -38,7 +38,8 @@ + + #define RXE_ROCE_V2_SPORT (0xc000) + +-#define rxe_dbg(rxe, fmt, ...) ibdev_dbg(&(rxe)->ib_dev, \ ++#define rxe_dbg(fmt, ...) pr_debug("%s: " fmt "\n", __func__, ##__VA_ARGS__) ++#define rxe_dbg_dev(rxe, fmt, ...) ibdev_dbg(&(rxe)->ib_dev, \ + "%s: " fmt, __func__, ##__VA_ARGS__) + #define rxe_dbg_uc(uc, fmt, ...) ibdev_dbg((uc)->ibuc.device, \ + "uc#%d %s: " fmt, (uc)->elem.index, __func__, ##__VA_ARGS__) +diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c +index 1df186534639a..22fbc198e5d17 100644 +--- a/drivers/infiniband/sw/rxe/rxe_cq.c ++++ b/drivers/infiniband/sw/rxe/rxe_cq.c +@@ -14,12 +14,12 @@ int rxe_cq_chk_attr(struct rxe_dev *rxe, struct rxe_cq *cq, + int count; + + if (cqe <= 0) { +- rxe_dbg(rxe, "cqe(%d) <= 0\n", cqe); ++ rxe_dbg_dev(rxe, "cqe(%d) <= 0\n", cqe); + goto err1; + } + + if (cqe > rxe->attr.max_cqe) { +- rxe_dbg(rxe, "cqe(%d) > max_cqe(%d)\n", ++ rxe_dbg_dev(rxe, "cqe(%d) > max_cqe(%d)\n", + cqe, rxe->attr.max_cqe); + goto err1; + } +@@ -65,7 +65,7 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe, + cq->queue = rxe_queue_init(rxe, &cqe, + sizeof(struct rxe_cqe), type); + if (!cq->queue) { +- rxe_dbg(rxe, "unable to create cq\n"); ++ rxe_dbg_dev(rxe, "unable to create cq\n"); + return -ENOMEM; + } + +diff --git a/drivers/infiniband/sw/rxe/rxe_icrc.c b/drivers/infiniband/sw/rxe/rxe_icrc.c +index 71bc2c1895888..fdf5f08cd8f17 100644 +--- a/drivers/infiniband/sw/rxe/rxe_icrc.c ++++ b/drivers/infiniband/sw/rxe/rxe_icrc.c +@@ -21,7 +21,7 @@ int rxe_icrc_init(struct rxe_dev *rxe) + + tfm = crypto_alloc_shash("crc32", 0, 0); + if (IS_ERR(tfm)) { +- rxe_dbg(rxe, "failed to init crc32 algorithm err: %ld\n", ++ rxe_dbg_dev(rxe, "failed to init crc32 algorithm err: %ld\n", + PTR_ERR(tfm)); + return PTR_ERR(tfm); + } +@@ -51,7 +51,7 @@ static __be32 rxe_crc32(struct rxe_dev *rxe, __be32 crc, void *next, size_t len) + *(__be32 *)shash_desc_ctx(shash) = crc; + err = crypto_shash_update(shash, next, len); + if (unlikely(err)) { +- rxe_dbg(rxe, "failed crc calculation, err: %d\n", err); ++ rxe_dbg_dev(rxe, "failed crc calculation, err: %d\n", err); + return (__force __be32)crc32_le((__force u32)crc, next, len); + } + +diff --git a/drivers/infiniband/sw/rxe/rxe_mmap.c b/drivers/infiniband/sw/rxe/rxe_mmap.c +index a47d72dbc5376..6b7f2bd698799 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mmap.c ++++ b/drivers/infiniband/sw/rxe/rxe_mmap.c +@@ -79,7 +79,7 @@ int rxe_mmap(struct ib_ucontext *context, struct vm_area_struct *vma) + + /* Don't allow a mmap larger than the object. */ + if (size > ip->info.size) { +- rxe_dbg(rxe, "mmap region is larger than the object!\n"); ++ rxe_dbg_dev(rxe, "mmap region is larger than the object!\n"); + spin_unlock_bh(&rxe->pending_lock); + ret = -EINVAL; + goto done; +@@ -87,7 +87,7 @@ int rxe_mmap(struct ib_ucontext *context, struct vm_area_struct *vma) + + goto found_it; + } +- rxe_dbg(rxe, "unable to find pending mmap info\n"); ++ rxe_dbg_dev(rxe, "unable to find pending mmap info\n"); + spin_unlock_bh(&rxe->pending_lock); + ret = -EINVAL; + goto done; +@@ -98,7 +98,7 @@ int rxe_mmap(struct ib_ucontext *context, struct vm_area_struct *vma) + + ret = remap_vmalloc_range(vma, ip->obj, 0); + if (ret) { +- rxe_dbg(rxe, "err %d from remap_vmalloc_range\n", ret); ++ rxe_dbg_dev(rxe, "err %d from remap_vmalloc_range\n", ret); + goto done; + } + +diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c +index e02e1624bcf4d..a2ace42e95366 100644 +--- a/drivers/infiniband/sw/rxe/rxe_net.c ++++ b/drivers/infiniband/sw/rxe/rxe_net.c +@@ -596,7 +596,7 @@ static int rxe_notify(struct notifier_block *not_blk, + rxe_port_down(rxe); + break; + case NETDEV_CHANGEMTU: +- rxe_dbg(rxe, "%s changed mtu to %d\n", ndev->name, ndev->mtu); ++ rxe_dbg_dev(rxe, "%s changed mtu to %d\n", ndev->name, ndev->mtu); + rxe_set_mtu(rxe, ndev->mtu); + break; + case NETDEV_CHANGE: +@@ -608,7 +608,7 @@ static int rxe_notify(struct notifier_block *not_blk, + case NETDEV_CHANGENAME: + case NETDEV_FEAT_CHANGE: + default: +- rxe_dbg(rxe, "ignoring netdev event = %ld for %s\n", ++ rxe_dbg_dev(rxe, "ignoring netdev event = %ld for %s\n", + event, ndev->name); + break; + } +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index ab72db68b58f6..c954dd9394baf 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -19,33 +19,33 @@ static int rxe_qp_chk_cap(struct rxe_dev *rxe, struct ib_qp_cap *cap, + int has_srq) + { + if (cap->max_send_wr > rxe->attr.max_qp_wr) { +- rxe_dbg(rxe, "invalid send wr = %u > %d\n", ++ rxe_dbg_dev(rxe, "invalid send wr = %u > %d\n", + cap->max_send_wr, rxe->attr.max_qp_wr); + goto err1; + } + + if (cap->max_send_sge > rxe->attr.max_send_sge) { +- rxe_dbg(rxe, "invalid send sge = %u > %d\n", ++ rxe_dbg_dev(rxe, "invalid send sge = %u > %d\n", + cap->max_send_sge, rxe->attr.max_send_sge); + goto err1; + } + + if (!has_srq) { + if (cap->max_recv_wr > rxe->attr.max_qp_wr) { +- rxe_dbg(rxe, "invalid recv wr = %u > %d\n", ++ rxe_dbg_dev(rxe, "invalid recv wr = %u > %d\n", + cap->max_recv_wr, rxe->attr.max_qp_wr); + goto err1; + } + + if (cap->max_recv_sge > rxe->attr.max_recv_sge) { +- rxe_dbg(rxe, "invalid recv sge = %u > %d\n", ++ rxe_dbg_dev(rxe, "invalid recv sge = %u > %d\n", + cap->max_recv_sge, rxe->attr.max_recv_sge); + goto err1; + } + } + + if (cap->max_inline_data > rxe->max_inline_data) { +- rxe_dbg(rxe, "invalid max inline data = %u > %d\n", ++ rxe_dbg_dev(rxe, "invalid max inline data = %u > %d\n", + cap->max_inline_data, rxe->max_inline_data); + goto err1; + } +@@ -73,7 +73,7 @@ int rxe_qp_chk_init(struct rxe_dev *rxe, struct ib_qp_init_attr *init) + } + + if (!init->recv_cq || !init->send_cq) { +- rxe_dbg(rxe, "missing cq\n"); ++ rxe_dbg_dev(rxe, "missing cq\n"); + goto err1; + } + +@@ -82,14 +82,14 @@ int rxe_qp_chk_init(struct rxe_dev *rxe, struct ib_qp_init_attr *init) + + if (init->qp_type == IB_QPT_GSI) { + if (!rdma_is_port_valid(&rxe->ib_dev, port_num)) { +- rxe_dbg(rxe, "invalid port = %d\n", port_num); ++ rxe_dbg_dev(rxe, "invalid port = %d\n", port_num); + goto err1; + } + + port = &rxe->port; + + if (init->qp_type == IB_QPT_GSI && port->qp_gsi_index) { +- rxe_dbg(rxe, "GSI QP exists for port %d\n", port_num); ++ rxe_dbg_dev(rxe, "GSI QP exists for port %d\n", port_num); + goto err1; + } + } +diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rxe/rxe_srq.c +index 82e37a41ced40..27ca82ec0826b 100644 +--- a/drivers/infiniband/sw/rxe/rxe_srq.c ++++ b/drivers/infiniband/sw/rxe/rxe_srq.c +@@ -13,13 +13,13 @@ int rxe_srq_chk_init(struct rxe_dev *rxe, struct ib_srq_init_attr *init) + struct ib_srq_attr *attr = &init->attr; + + if (attr->max_wr > rxe->attr.max_srq_wr) { +- rxe_dbg(rxe, "max_wr(%d) > max_srq_wr(%d)\n", ++ rxe_dbg_dev(rxe, "max_wr(%d) > max_srq_wr(%d)\n", + attr->max_wr, rxe->attr.max_srq_wr); + goto err1; + } + + if (attr->max_wr <= 0) { +- rxe_dbg(rxe, "max_wr(%d) <= 0\n", attr->max_wr); ++ rxe_dbg_dev(rxe, "max_wr(%d) <= 0\n", attr->max_wr); + goto err1; + } + +@@ -27,7 +27,7 @@ int rxe_srq_chk_init(struct rxe_dev *rxe, struct ib_srq_init_attr *init) + attr->max_wr = RXE_MIN_SRQ_WR; + + if (attr->max_sge > rxe->attr.max_srq_sge) { +- rxe_dbg(rxe, "max_sge(%d) > max_srq_sge(%d)\n", ++ rxe_dbg_dev(rxe, "max_sge(%d) > max_srq_sge(%d)\n", + attr->max_sge, rxe->attr.max_srq_sge); + goto err1; + } +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index e14050a692766..f178d0773ff20 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -1095,7 +1095,7 @@ int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name) + + err = ib_register_device(dev, ibdev_name, NULL); + if (err) +- rxe_dbg(rxe, "failed with error %d\n", err); ++ rxe_dbg_dev(rxe, "failed with error %d\n", err); + + /* + * Note that rxe may be invalid at this point if another thread +-- +2.39.2 + diff --git a/queue-6.2/rdma-rxe-clean-kzalloc-failure-paths.patch b/queue-6.2/rdma-rxe-clean-kzalloc-failure-paths.patch new file mode 100644 index 00000000000..dddd85162b5 --- /dev/null +++ b/queue-6.2/rdma-rxe-clean-kzalloc-failure-paths.patch @@ -0,0 +1,124 @@ +From 8b9e9c0fd0e17166cb1df8471c0281d4d2cd63c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 21:14:01 +0300 +Subject: RDMA/rxe: Clean kzalloc failure paths + +From: Leon Romanovsky + +[ Upstream commit b6ba68555d75fd99f7daa9c5a5e476f8635cb155 ] + +There is no need to print any debug messages after failure to +allocate memory, because kernel will print OOM dumps anyway. + +Together with removal of these messages, remove useless goto jumps. + +Fixes: 5bf944f24129 ("RDMA/rxe: Add error messages") +Reported-by: Dan Carpenter +Link: https://lore.kernel.org/all/ea43486f-43dd-4054-b1d5-3a0d202be621@kili.mountain +Link: https://lore.kernel.org/r/d3cedf723b84e73e8062a67b7489d33802bafba2.1680113597.git.leon@kernel.org +Reviewed-by: Bob Pearson +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_queue.c | 5 ++--- + drivers/infiniband/sw/rxe/rxe_verbs.c | 27 +++++++-------------------- + 2 files changed, 9 insertions(+), 23 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_queue.c b/drivers/infiniband/sw/rxe/rxe_queue.c +index d6dbf5a0058dc..9611ee191a46d 100644 +--- a/drivers/infiniband/sw/rxe/rxe_queue.c ++++ b/drivers/infiniband/sw/rxe/rxe_queue.c +@@ -61,11 +61,11 @@ struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe, int *num_elem, + + /* num_elem == 0 is allowed, but uninteresting */ + if (*num_elem < 0) +- goto err1; ++ return NULL; + + q = kzalloc(sizeof(*q), GFP_KERNEL); + if (!q) +- goto err1; ++ return NULL; + + q->rxe = rxe; + q->type = type; +@@ -100,7 +100,6 @@ struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe, int *num_elem, + + err2: + kfree(q); +-err1: + return NULL; + } + +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index 090d5bfb1e18d..4e2db7c2e4ed7 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -1198,11 +1198,8 @@ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access) + int err; + + mr = kzalloc(sizeof(*mr), GFP_KERNEL); +- if (!mr) { +- err = -ENOMEM; +- rxe_dbg_dev(rxe, "no memory for mr"); +- goto err_out; +- } ++ if (!mr) ++ return ERR_PTR(-ENOMEM); + + err = rxe_add_to_pool(&rxe->mr_pool, mr); + if (err) { +@@ -1220,7 +1217,6 @@ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access) + + err_free: + kfree(mr); +-err_out: + rxe_err_pd(pd, "returned err = %d", err); + return ERR_PTR(err); + } +@@ -1235,11 +1231,8 @@ static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, u64 start, + int err, cleanup_err; + + mr = kzalloc(sizeof(*mr), GFP_KERNEL); +- if (!mr) { +- err = -ENOMEM; +- rxe_dbg_pd(pd, "no memory for mr"); +- goto err_out; +- } ++ if (!mr) ++ return ERR_PTR(-ENOMEM); + + err = rxe_add_to_pool(&rxe->mr_pool, mr); + if (err) { +@@ -1266,7 +1259,6 @@ static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, u64 start, + rxe_err_mr(mr, "cleanup failed, err = %d", cleanup_err); + err_free: + kfree(mr); +-err_out: + rxe_err_pd(pd, "returned err = %d", err); + return ERR_PTR(err); + } +@@ -1287,17 +1279,12 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type, + } + + mr = kzalloc(sizeof(*mr), GFP_KERNEL); +- if (!mr) { +- err = -ENOMEM; +- rxe_dbg_mr(mr, "no memory for mr"); +- goto err_out; +- } ++ if (!mr) ++ return ERR_PTR(-ENOMEM); + + err = rxe_add_to_pool(&rxe->mr_pool, mr); +- if (err) { +- rxe_dbg_mr(mr, "unable to create mr, err = %d", err); ++ if (err) + goto err_free; +- } + + rxe_get(pd); + mr->ibmr.pd = ibpd; +-- +2.39.2 + diff --git a/queue-6.2/rdma-rxe-convert-tasklet-args-to-queue-pairs.patch b/queue-6.2/rdma-rxe-convert-tasklet-args-to-queue-pairs.patch new file mode 100644 index 00000000000..271ffc6b405 --- /dev/null +++ b/queue-6.2/rdma-rxe-convert-tasklet-args-to-queue-pairs.patch @@ -0,0 +1,166 @@ +From 66273811b8380304d97de8edc1869e276b0eb0f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Mar 2023 11:45:27 -0600 +Subject: RDMA/rxe: Convert tasklet args to queue pairs + +From: Bob Pearson + +[ Upstream commit 3946fc2a42b18cf0b675121158a2625825ce27b5 ] + +Originally is was thought that the tasklet machinery in rxe_task.c would +be used in other applications but that has not happened for years. This +patch replaces the 'void *arg' by struct 'rxe_qp *qp' in the parameters to +the tasklet calls. This change will have no affect on performance but may +make the code a little clearer. + +Link: https://lore.kernel.org/r/20230304174533.11296-2-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: b2b1ddc45745 ("RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task"") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_comp.c | 3 +-- + drivers/infiniband/sw/rxe/rxe_loc.h | 6 +++--- + drivers/infiniband/sw/rxe/rxe_req.c | 3 +-- + drivers/infiniband/sw/rxe/rxe_resp.c | 3 +-- + drivers/infiniband/sw/rxe/rxe_task.c | 11 ++++++----- + drivers/infiniband/sw/rxe/rxe_task.h | 9 +++++---- + 6 files changed, 17 insertions(+), 18 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c +index 876057e3ee3c1..cbfa16b3a4902 100644 +--- a/drivers/infiniband/sw/rxe/rxe_comp.c ++++ b/drivers/infiniband/sw/rxe/rxe_comp.c +@@ -575,9 +575,8 @@ static void free_pkt(struct rxe_pkt_info *pkt) + ib_device_put(dev); + } + +-int rxe_completer(void *arg) ++int rxe_completer(struct rxe_qp *qp) + { +- struct rxe_qp *qp = (struct rxe_qp *)arg; + struct rxe_dev *rxe = to_rdev(qp->ibqp.device); + struct rxe_send_wqe *wqe = NULL; + struct sk_buff *skb = NULL; +diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h +index 839de34cf4c94..804b15e929dd9 100644 +--- a/drivers/infiniband/sw/rxe/rxe_loc.h ++++ b/drivers/infiniband/sw/rxe/rxe_loc.h +@@ -170,9 +170,9 @@ void rxe_srq_cleanup(struct rxe_pool_elem *elem); + + void rxe_dealloc(struct ib_device *ib_dev); + +-int rxe_completer(void *arg); +-int rxe_requester(void *arg); +-int rxe_responder(void *arg); ++int rxe_completer(struct rxe_qp *qp); ++int rxe_requester(struct rxe_qp *qp); ++int rxe_responder(struct rxe_qp *qp); + + /* rxe_icrc.c */ + int rxe_icrc_init(struct rxe_dev *rxe); +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index 899c8779f8001..f2dc2d191e16f 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -635,9 +635,8 @@ static int rxe_do_local_ops(struct rxe_qp *qp, struct rxe_send_wqe *wqe) + return 0; + } + +-int rxe_requester(void *arg) ++int rxe_requester(struct rxe_qp *qp) + { +- struct rxe_qp *qp = (struct rxe_qp *)arg; + struct rxe_dev *rxe = to_rdev(qp->ibqp.device); + struct rxe_pkt_info pkt; + struct sk_buff *skb; +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index 4217eec03a943..7cb1b962d6652 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -1443,9 +1443,8 @@ static void rxe_drain_req_pkts(struct rxe_qp *qp, bool notify) + queue_advance_consumer(q, q->type); + } + +-int rxe_responder(void *arg) ++int rxe_responder(struct rxe_qp *qp) + { +- struct rxe_qp *qp = (struct rxe_qp *)arg; + struct rxe_dev *rxe = to_rdev(qp->ibqp.device); + enum resp_states state; + struct rxe_pkt_info *pkt = NULL; +diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c +index 60b90e33a8849..959cc6229a34e 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.c ++++ b/drivers/infiniband/sw/rxe/rxe_task.c +@@ -11,7 +11,7 @@ int __rxe_do_task(struct rxe_task *task) + { + int ret; + +- while ((ret = task->func(task->arg)) == 0) ++ while ((ret = task->func(task->qp)) == 0) + ; + + task->ret = ret; +@@ -29,7 +29,7 @@ static void do_task(struct tasklet_struct *t) + int cont; + int ret; + struct rxe_task *task = from_tasklet(task, t, tasklet); +- struct rxe_qp *qp = (struct rxe_qp *)task->arg; ++ struct rxe_qp *qp = (struct rxe_qp *)task->qp; + unsigned int iterations = RXE_MAX_ITERATIONS; + + spin_lock_bh(&task->lock); +@@ -54,7 +54,7 @@ static void do_task(struct tasklet_struct *t) + + do { + cont = 0; +- ret = task->func(task->arg); ++ ret = task->func(task->qp); + + spin_lock_bh(&task->lock); + switch (task->state) { +@@ -91,9 +91,10 @@ static void do_task(struct tasklet_struct *t) + task->ret = ret; + } + +-int rxe_init_task(struct rxe_task *task, void *arg, int (*func)(void *)) ++int rxe_init_task(struct rxe_task *task, struct rxe_qp *qp, ++ int (*func)(struct rxe_qp *)) + { +- task->arg = arg; ++ task->qp = qp; + task->func = func; + task->destroyed = false; + +diff --git a/drivers/infiniband/sw/rxe/rxe_task.h b/drivers/infiniband/sw/rxe/rxe_task.h +index 7b88129702ac6..41efd5fd49b03 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.h ++++ b/drivers/infiniband/sw/rxe/rxe_task.h +@@ -22,18 +22,19 @@ struct rxe_task { + struct tasklet_struct tasklet; + int state; + spinlock_t lock; +- void *arg; +- int (*func)(void *arg); ++ struct rxe_qp *qp; ++ int (*func)(struct rxe_qp *qp); + int ret; + bool destroyed; + }; + + /* + * init rxe_task structure +- * arg => parameter to pass to fcn ++ * qp => parameter to pass to func + * func => function to call until it returns != 0 + */ +-int rxe_init_task(struct rxe_task *task, void *arg, int (*func)(void *)); ++int rxe_init_task(struct rxe_task *task, struct rxe_qp *qp, ++ int (*func)(struct rxe_qp *)); + + /* cleanup task */ + void rxe_cleanup_task(struct rxe_task *task); +-- +2.39.2 + diff --git a/queue-6.2/rdma-rxe-extend-dbg-log-messages-to-err-and-info.patch b/queue-6.2/rdma-rxe-extend-dbg-log-messages-to-err-and-info.patch new file mode 100644 index 00000000000..65cb33c4d5e --- /dev/null +++ b/queue-6.2/rdma-rxe-extend-dbg-log-messages-to-err-and-info.patch @@ -0,0 +1,118 @@ +From c5ef84e44c55d95b83ad936094e6d2e181d0f796 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 16:16:23 -0600 +Subject: RDMA/rxe: Extend dbg log messages to err and info + +From: Bob Pearson + +[ Upstream commit 9ac01f434a1eb56ea94611bd75cf62fa276b41f4 ] + +Extend the dbg log messages (e.g. rxe_dbg_xxx) to include +err and info types. rxe.c is modified to use these new log +messages as examples. + +Link: https://lore.kernel.org/r/20230303221623.8053-4-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 78b26a335310 ("RDMA/rxe: Remove tasklet call from rxe_cq.c") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe.c | 8 ++++--- + drivers/infiniband/sw/rxe/rxe.h | 42 +++++++++++++++++++++++++++++++++ + 2 files changed, 47 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c +index d57ba7a5964b9..7a7e713de52db 100644 +--- a/drivers/infiniband/sw/rxe/rxe.c ++++ b/drivers/infiniband/sw/rxe/rxe.c +@@ -160,6 +160,8 @@ void rxe_set_mtu(struct rxe_dev *rxe, unsigned int ndev_mtu) + + port->attr.active_mtu = mtu; + port->mtu_cap = ib_mtu_enum_to_int(mtu); ++ ++ rxe_info_dev(rxe, "Set mtu to %d", port->mtu_cap); + } + + /* called by ifc layer to create new rxe device. +@@ -179,7 +181,7 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev) + int err = 0; + + if (is_vlan_dev(ndev)) { +- pr_err("rxe creation allowed on top of a real device only\n"); ++ rxe_err("rxe creation allowed on top of a real device only"); + err = -EPERM; + goto err; + } +@@ -187,14 +189,14 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev) + rxe = rxe_get_dev_from_net(ndev); + if (rxe) { + ib_device_put(&rxe->ib_dev); +- rxe_dbg_dev(rxe, "already configured on %s\n", ndev->name); ++ rxe_err_dev(rxe, "already configured on %s", ndev->name); + err = -EEXIST; + goto err; + } + + err = rxe_net_add(ibdev_name, ndev); + if (err) { +- pr_debug("failed to add %s\n", ndev->name); ++ rxe_err("failed to add %s\n", ndev->name); + goto err; + } + err: +diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h +index 0757acc381038..bd8a8ea4ea8fd 100644 +--- a/drivers/infiniband/sw/rxe/rxe.h ++++ b/drivers/infiniband/sw/rxe/rxe.h +@@ -58,6 +58,48 @@ + #define rxe_dbg_mw(mw, fmt, ...) ibdev_dbg((mw)->ibmw.device, \ + "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__) + ++#define rxe_err(fmt, ...) pr_err_ratelimited("%s: " fmt "\n", __func__, \ ++ ##__VA_ARGS__) ++#define rxe_err_dev(rxe, fmt, ...) ibdev_err_ratelimited(&(rxe)->ib_dev, \ ++ "%s: " fmt, __func__, ##__VA_ARGS__) ++#define rxe_err_uc(uc, fmt, ...) ibdev_err_ratelimited((uc)->ibuc.device, \ ++ "uc#%d %s: " fmt, (uc)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_err_pd(pd, fmt, ...) ibdev_err_ratelimited((pd)->ibpd.device, \ ++ "pd#%d %s: " fmt, (pd)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_err_ah(ah, fmt, ...) ibdev_err_ratelimited((ah)->ibah.device, \ ++ "ah#%d %s: " fmt, (ah)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_err_srq(srq, fmt, ...) ibdev_err_ratelimited((srq)->ibsrq.device, \ ++ "srq#%d %s: " fmt, (srq)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_err_qp(qp, fmt, ...) ibdev_err_ratelimited((qp)->ibqp.device, \ ++ "qp#%d %s: " fmt, (qp)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_err_cq(cq, fmt, ...) ibdev_err_ratelimited((cq)->ibcq.device, \ ++ "cq#%d %s: " fmt, (cq)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_err_mr(mr, fmt, ...) ibdev_err_ratelimited((mr)->ibmr.device, \ ++ "mr#%d %s: " fmt, (mr)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_err_mw(mw, fmt, ...) ibdev_err_ratelimited((mw)->ibmw.device, \ ++ "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__) ++ ++#define rxe_info(fmt, ...) pr_info_ratelimited("%s: " fmt "\n", __func__, \ ++ ##__VA_ARGS__) ++#define rxe_info_dev(rxe, fmt, ...) ibdev_info_ratelimited(&(rxe)->ib_dev, \ ++ "%s: " fmt, __func__, ##__VA_ARGS__) ++#define rxe_info_uc(uc, fmt, ...) ibdev_info_ratelimited((uc)->ibuc.device, \ ++ "uc#%d %s: " fmt, (uc)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_info_pd(pd, fmt, ...) ibdev_info_ratelimited((pd)->ibpd.device, \ ++ "pd#%d %s: " fmt, (pd)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_info_ah(ah, fmt, ...) ibdev_info_ratelimited((ah)->ibah.device, \ ++ "ah#%d %s: " fmt, (ah)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_info_srq(srq, fmt, ...) ibdev_info_ratelimited((srq)->ibsrq.device, \ ++ "srq#%d %s: " fmt, (srq)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_info_qp(qp, fmt, ...) ibdev_info_ratelimited((qp)->ibqp.device, \ ++ "qp#%d %s: " fmt, (qp)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_info_cq(cq, fmt, ...) ibdev_info_ratelimited((cq)->ibcq.device, \ ++ "cq#%d %s: " fmt, (cq)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_info_mr(mr, fmt, ...) ibdev_info_ratelimited((mr)->ibmr.device, \ ++ "mr#%d %s: " fmt, (mr)->elem.index, __func__, ##__VA_ARGS__) ++#define rxe_info_mw(mw, fmt, ...) ibdev_info_ratelimited((mw)->ibmw.device, \ ++ "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__) ++ + /* responder states */ + enum resp_states { + RESPST_NONE, +-- +2.39.2 + diff --git a/queue-6.2/rdma-rxe-fix-the-error-trying-to-register-non-static.patch b/queue-6.2/rdma-rxe-fix-the-error-trying-to-register-non-static.patch new file mode 100644 index 00000000000..b2dc306d46e --- /dev/null +++ b/queue-6.2/rdma-rxe-fix-the-error-trying-to-register-non-static.patch @@ -0,0 +1,57 @@ +From 1832aa9ee8cec64ed1f73c7903d2b0f58235c24f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 18:11:15 +0800 +Subject: RDMA/rxe: Fix the error "trying to register non-static key in + rxe_cleanup_task" + +From: Zhu Yanjun + +[ Upstream commit b2b1ddc457458fecd1c6f385baa9fbda5f0c63ad ] + +In the function rxe_create_qp(), rxe_qp_from_init() is called to +initialize qp, internally things like rxe_init_task are not setup until +rxe_qp_init_req(). + +If an error occurred before this point then the unwind will call +rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task() +which will oops when trying to access the uninitialized spinlock. + +If rxe_init_task is not executed, rxe_cleanup_task will not be called. + +Reported-by: syzbot+cfcc1a3c85be15a40cba@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=fd85757b74b3eb59f904138486f755f71e090df8 +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Fixes: 2d4b21e0a291 ("IB/rxe: Prevent from completer to operate on non valid QP") +Signed-off-by: Zhu Yanjun +Link: https://lore.kernel.org/r/20230413101115.1366068-1-yanjun.zhu@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_qp.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 49891f8ed4e61..d5de5ba6940f1 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -761,9 +761,14 @@ static void rxe_qp_do_cleanup(struct work_struct *work) + del_timer_sync(&qp->rnr_nak_timer); + } + +- rxe_cleanup_task(&qp->resp.task); +- rxe_cleanup_task(&qp->req.task); +- rxe_cleanup_task(&qp->comp.task); ++ if (qp->resp.task.func) ++ rxe_cleanup_task(&qp->resp.task); ++ ++ if (qp->req.task.func) ++ rxe_cleanup_task(&qp->req.task); ++ ++ if (qp->comp.task.func) ++ rxe_cleanup_task(&qp->comp.task); + + /* flush out any receive wr's or pending requests */ + rxe_requester(qp); +-- +2.39.2 + diff --git a/queue-6.2/rdma-rxe-remove-__rxe_do_task.patch b/queue-6.2/rdma-rxe-remove-__rxe_do_task.patch new file mode 100644 index 00000000000..1fac5a8aed3 --- /dev/null +++ b/queue-6.2/rdma-rxe-remove-__rxe_do_task.patch @@ -0,0 +1,192 @@ +From 33266522a29a06dcec4b50b834bd07443433f907 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Mar 2023 11:45:32 -0600 +Subject: RDMA/rxe: Remove __rxe_do_task() + +From: Bob Pearson + +[ Upstream commit 960ebe97e5238565d15063c8f4d1b2108efe2e65 ] + +The subroutine __rxe_do_task is not thread safe and it has no way to +guarantee that the tasks, which are designed with the assumption that they +are non-reentrant, are not reentered. All of its uses are non-performance +critical. + +This patch replaces calls to __rxe_do_task with calls to +rxe_sched_task. It also removes irrelevant or unneeded if tests. + +Instead of calling the task machinery a single call to the tasklet +function (rxe_requester, etc.) is sufficient to draing the queues if task +execution has been disabled or stopped. + +Together these changes allow the removal of __rxe_do_task. + +Link: https://lore.kernel.org/r/20230304174533.11296-7-rpearsonhpe@gmail.com +Signed-off-by: Ian Ziemba +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: b2b1ddc45745 ("RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task"") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_qp.c | 56 +++++++++------------------- + drivers/infiniband/sw/rxe/rxe_task.c | 13 ------- + drivers/infiniband/sw/rxe/rxe_task.h | 6 --- + 3 files changed, 17 insertions(+), 58 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index c954dd9394baf..49891f8ed4e61 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -473,29 +473,23 @@ static void rxe_qp_reset(struct rxe_qp *qp) + { + /* stop tasks from running */ + rxe_disable_task(&qp->resp.task); +- +- /* stop request/comp */ +- if (qp->sq.queue) { +- if (qp_type(qp) == IB_QPT_RC) +- rxe_disable_task(&qp->comp.task); +- rxe_disable_task(&qp->req.task); +- } ++ rxe_disable_task(&qp->comp.task); ++ rxe_disable_task(&qp->req.task); + + /* move qp to the reset state */ + qp->req.state = QP_STATE_RESET; + qp->comp.state = QP_STATE_RESET; + qp->resp.state = QP_STATE_RESET; + +- /* let state machines reset themselves drain work and packet queues +- * etc. +- */ +- __rxe_do_task(&qp->resp.task); ++ /* drain work and packet queuesc */ ++ rxe_requester(qp); ++ rxe_completer(qp); ++ rxe_responder(qp); + +- if (qp->sq.queue) { +- __rxe_do_task(&qp->comp.task); +- __rxe_do_task(&qp->req.task); ++ if (qp->rq.queue) ++ rxe_queue_reset(qp->rq.queue); ++ if (qp->sq.queue) + rxe_queue_reset(qp->sq.queue); +- } + + /* cleanup attributes */ + atomic_set(&qp->ssn, 0); +@@ -518,13 +512,8 @@ static void rxe_qp_reset(struct rxe_qp *qp) + + /* reenable tasks */ + rxe_enable_task(&qp->resp.task); +- +- if (qp->sq.queue) { +- if (qp_type(qp) == IB_QPT_RC) +- rxe_enable_task(&qp->comp.task); +- +- rxe_enable_task(&qp->req.task); +- } ++ rxe_enable_task(&qp->comp.task); ++ rxe_enable_task(&qp->req.task); + } + + /* drain the send queue */ +@@ -533,10 +522,7 @@ static void rxe_qp_drain(struct rxe_qp *qp) + if (qp->sq.queue) { + if (qp->req.state != QP_STATE_DRAINED) { + qp->req.state = QP_STATE_DRAIN; +- if (qp_type(qp) == IB_QPT_RC) +- rxe_sched_task(&qp->comp.task); +- else +- __rxe_do_task(&qp->comp.task); ++ rxe_sched_task(&qp->comp.task); + rxe_sched_task(&qp->req.task); + } + } +@@ -552,11 +538,7 @@ void rxe_qp_error(struct rxe_qp *qp) + + /* drain work and packet queues */ + rxe_sched_task(&qp->resp.task); +- +- if (qp_type(qp) == IB_QPT_RC) +- rxe_sched_task(&qp->comp.task); +- else +- __rxe_do_task(&qp->comp.task); ++ rxe_sched_task(&qp->comp.task); + rxe_sched_task(&qp->req.task); + } + +@@ -773,24 +755,20 @@ static void rxe_qp_do_cleanup(struct work_struct *work) + + qp->valid = 0; + qp->qp_timeout_jiffies = 0; +- rxe_cleanup_task(&qp->resp.task); + + if (qp_type(qp) == IB_QPT_RC) { + del_timer_sync(&qp->retrans_timer); + del_timer_sync(&qp->rnr_nak_timer); + } + ++ rxe_cleanup_task(&qp->resp.task); + rxe_cleanup_task(&qp->req.task); + rxe_cleanup_task(&qp->comp.task); + + /* flush out any receive wr's or pending requests */ +- if (qp->req.task.func) +- __rxe_do_task(&qp->req.task); +- +- if (qp->sq.queue) { +- __rxe_do_task(&qp->comp.task); +- __rxe_do_task(&qp->req.task); +- } ++ rxe_requester(qp); ++ rxe_completer(qp); ++ rxe_responder(qp); + + if (qp->sq.queue) + rxe_queue_cleanup(qp->sq.queue); +diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c +index 959cc6229a34e..a67f485454436 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.c ++++ b/drivers/infiniband/sw/rxe/rxe_task.c +@@ -6,19 +6,6 @@ + + #include "rxe.h" + +-int __rxe_do_task(struct rxe_task *task) +- +-{ +- int ret; +- +- while ((ret = task->func(task->qp)) == 0) +- ; +- +- task->ret = ret; +- +- return ret; +-} +- + /* + * this locking is due to a potential race where + * a second caller finds the task already running +diff --git a/drivers/infiniband/sw/rxe/rxe_task.h b/drivers/infiniband/sw/rxe/rxe_task.h +index 41efd5fd49b03..99585e40cef92 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.h ++++ b/drivers/infiniband/sw/rxe/rxe_task.h +@@ -39,12 +39,6 @@ int rxe_init_task(struct rxe_task *task, struct rxe_qp *qp, + /* cleanup task */ + void rxe_cleanup_task(struct rxe_task *task); + +-/* +- * raw call to func in loop without any checking +- * can call when tasklets are disabled +- */ +-int __rxe_do_task(struct rxe_task *task); +- + void rxe_run_task(struct rxe_task *task); + + void rxe_sched_task(struct rxe_task *task); +-- +2.39.2 + diff --git a/queue-6.2/rdma-rxe-remove-rxe_alloc.patch b/queue-6.2/rdma-rxe-remove-rxe_alloc.patch new file mode 100644 index 00000000000..efaacfc3cd3 --- /dev/null +++ b/queue-6.2/rdma-rxe-remove-rxe_alloc.patch @@ -0,0 +1,251 @@ +From 331410a2122fb6497edde368205f3d369dfa8031 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 16:55:52 -0600 +Subject: RDMA/rxe: Remove rxe_alloc() + +From: Bob Pearson + +[ Upstream commit 72a03627443d5bc7032ab98bd784740cd8a76f8a ] + +Currently all the object types in the rxe driver are allocated in +rdma-core except for MRs. By moving tha kzalloc() call outside of +the pool code the rxe_alloc() subroutine can be eliminated and code +checking for MR as a special case can be removed. + +This patch moves the kzalloc() and kfree_rcu() calls into the mr +registration and destruction verbs. It removes that code from +rxe_pool.c including the rxe_alloc() subroutine which is no longer +used. + +Link: https://lore.kernel.org/r/20230213225551.12437-1-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Reviewed-by: Devesh Sharma +Reviewed-by: Devesh Sharma +Reviewed-by: Zhu Yanjun +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 78b26a335310 ("RDMA/rxe: Remove tasklet call from rxe_cq.c") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_mr.c | 2 +- + drivers/infiniband/sw/rxe/rxe_pool.c | 46 --------------------- + drivers/infiniband/sw/rxe/rxe_pool.h | 3 -- + drivers/infiniband/sw/rxe/rxe_verbs.c | 59 +++++++++++++++++++-------- + 4 files changed, 44 insertions(+), 66 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index 5e9a03831bf9f..b10aa1580a644 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -731,7 +731,7 @@ int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata) + return -EINVAL; + + rxe_cleanup(mr); +- ++ kfree_rcu(mr); + return 0; + } + +diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c +index 1151c0b5cceab..6215c6de3a840 100644 +--- a/drivers/infiniband/sw/rxe/rxe_pool.c ++++ b/drivers/infiniband/sw/rxe/rxe_pool.c +@@ -116,55 +116,12 @@ void rxe_pool_cleanup(struct rxe_pool *pool) + WARN_ON(!xa_empty(&pool->xa)); + } + +-void *rxe_alloc(struct rxe_pool *pool) +-{ +- struct rxe_pool_elem *elem; +- void *obj; +- int err; +- +- if (WARN_ON(!(pool->type == RXE_TYPE_MR))) +- return NULL; +- +- if (atomic_inc_return(&pool->num_elem) > pool->max_elem) +- goto err_cnt; +- +- obj = kzalloc(pool->elem_size, GFP_KERNEL); +- if (!obj) +- goto err_cnt; +- +- elem = (struct rxe_pool_elem *)((u8 *)obj + pool->elem_offset); +- +- elem->pool = pool; +- elem->obj = obj; +- kref_init(&elem->ref_cnt); +- init_completion(&elem->complete); +- +- /* allocate index in array but leave pointer as NULL so it +- * can't be looked up until rxe_finalize() is called +- */ +- err = xa_alloc_cyclic(&pool->xa, &elem->index, NULL, pool->limit, +- &pool->next, GFP_KERNEL); +- if (err < 0) +- goto err_free; +- +- return obj; +- +-err_free: +- kfree(obj); +-err_cnt: +- atomic_dec(&pool->num_elem); +- return NULL; +-} +- + int __rxe_add_to_pool(struct rxe_pool *pool, struct rxe_pool_elem *elem, + bool sleepable) + { + int err; + gfp_t gfp_flags; + +- if (WARN_ON(pool->type == RXE_TYPE_MR)) +- return -EINVAL; +- + if (atomic_inc_return(&pool->num_elem) > pool->max_elem) + goto err_cnt; + +@@ -275,9 +232,6 @@ int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable) + if (pool->cleanup) + pool->cleanup(elem); + +- if (pool->type == RXE_TYPE_MR) +- kfree_rcu(elem->obj); +- + atomic_dec(&pool->num_elem); + + return err; +diff --git a/drivers/infiniband/sw/rxe/rxe_pool.h b/drivers/infiniband/sw/rxe/rxe_pool.h +index 9d83cb32092ff..b42e26427a702 100644 +--- a/drivers/infiniband/sw/rxe/rxe_pool.h ++++ b/drivers/infiniband/sw/rxe/rxe_pool.h +@@ -54,9 +54,6 @@ void rxe_pool_init(struct rxe_dev *rxe, struct rxe_pool *pool, + /* free resources from object pool */ + void rxe_pool_cleanup(struct rxe_pool *pool); + +-/* allocate an object from pool */ +-void *rxe_alloc(struct rxe_pool *pool); +- + /* connect already allocated object to pool */ + int __rxe_add_to_pool(struct rxe_pool *pool, struct rxe_pool_elem *elem, + bool sleepable); +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index a3aee247aa157..e14050a692766 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -869,10 +869,17 @@ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access) + struct rxe_dev *rxe = to_rdev(ibpd->device); + struct rxe_pd *pd = to_rpd(ibpd); + struct rxe_mr *mr; ++ int err; + +- mr = rxe_alloc(&rxe->mr_pool); +- if (!mr) +- return ERR_PTR(-ENOMEM); ++ mr = kzalloc(sizeof(*mr), GFP_KERNEL); ++ if (!mr) { ++ err = -ENOMEM; ++ goto err_out; ++ } ++ ++ err = rxe_add_to_pool(&rxe->mr_pool, mr); ++ if (err) ++ goto err_free; + + rxe_get(pd); + mr->ibmr.pd = ibpd; +@@ -880,8 +887,12 @@ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access) + + rxe_mr_init_dma(access, mr); + rxe_finalize(mr); +- + return &mr->ibmr; ++ ++err_free: ++ kfree(mr); ++err_out: ++ return ERR_PTR(err); + } + + static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, +@@ -895,9 +906,15 @@ static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, + struct rxe_pd *pd = to_rpd(ibpd); + struct rxe_mr *mr; + +- mr = rxe_alloc(&rxe->mr_pool); +- if (!mr) +- return ERR_PTR(-ENOMEM); ++ mr = kzalloc(sizeof(*mr), GFP_KERNEL); ++ if (!mr) { ++ err = -ENOMEM; ++ goto err_out; ++ } ++ ++ err = rxe_add_to_pool(&rxe->mr_pool, mr); ++ if (err) ++ goto err_free; + + rxe_get(pd); + mr->ibmr.pd = ibpd; +@@ -905,14 +922,16 @@ static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, + + err = rxe_mr_init_user(rxe, start, length, iova, access, mr); + if (err) +- goto err1; ++ goto err_cleanup; + + rxe_finalize(mr); +- + return &mr->ibmr; + +-err1: ++err_cleanup: + rxe_cleanup(mr); ++err_free: ++ kfree(mr); ++err_out: + return ERR_PTR(err); + } + +@@ -927,9 +946,15 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type, + if (mr_type != IB_MR_TYPE_MEM_REG) + return ERR_PTR(-EINVAL); + +- mr = rxe_alloc(&rxe->mr_pool); +- if (!mr) +- return ERR_PTR(-ENOMEM); ++ mr = kzalloc(sizeof(*mr), GFP_KERNEL); ++ if (!mr) { ++ err = -ENOMEM; ++ goto err_out; ++ } ++ ++ err = rxe_add_to_pool(&rxe->mr_pool, mr); ++ if (err) ++ goto err_free; + + rxe_get(pd); + mr->ibmr.pd = ibpd; +@@ -937,14 +962,16 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type, + + err = rxe_mr_init_fast(max_num_sg, mr); + if (err) +- goto err1; ++ goto err_cleanup; + + rxe_finalize(mr); +- + return &mr->ibmr; + +-err1: ++err_cleanup: + rxe_cleanup(mr); ++err_free: ++ kfree(mr); ++err_out: + return ERR_PTR(err); + } + +-- +2.39.2 + diff --git a/queue-6.2/rdma-rxe-remove-tasklet-call-from-rxe_cq.c.patch b/queue-6.2/rdma-rxe-remove-tasklet-call-from-rxe_cq.c.patch new file mode 100644 index 00000000000..826a5662334 --- /dev/null +++ b/queue-6.2/rdma-rxe-remove-tasklet-call-from-rxe_cq.c.patch @@ -0,0 +1,130 @@ +From b08cdff2bf716dd2ab4b9f93ed67a6f1492fde13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Mar 2023 16:56:44 -0500 +Subject: RDMA/rxe: Remove tasklet call from rxe_cq.c + +From: Bob Pearson + +[ Upstream commit 78b26a335310a097d6b22581b706050db42f196c ] + +Remove the tasklet call in rxe_cq.c and also the is_dying in the +cq struct. There is no reason for the rxe driver to defer the call +to the cq completion handler by scheduling a tasklet. rxe_cq_post() +is not called in a hard irq context. + +The rxe driver currently is incorrect because the tasklet call is +made without protecting the cq pointer with a reference from having +the underlying memory freed before the deferred routine is called. +Executing the comp_handler inline fixes this problem. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Signed-off-by: Bob Pearson +Link: https://lore.kernel.org/r/20230327215643.10410-1-rpearsonhpe@gmail.com +Acked-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_cq.c | 32 +++------------------------ + drivers/infiniband/sw/rxe/rxe_verbs.c | 2 -- + drivers/infiniband/sw/rxe/rxe_verbs.h | 2 -- + 3 files changed, 3 insertions(+), 33 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c +index 22fbc198e5d17..519ddec29b4ba 100644 +--- a/drivers/infiniband/sw/rxe/rxe_cq.c ++++ b/drivers/infiniband/sw/rxe/rxe_cq.c +@@ -39,21 +39,6 @@ int rxe_cq_chk_attr(struct rxe_dev *rxe, struct rxe_cq *cq, + return -EINVAL; + } + +-static void rxe_send_complete(struct tasklet_struct *t) +-{ +- struct rxe_cq *cq = from_tasklet(cq, t, comp_task); +- unsigned long flags; +- +- spin_lock_irqsave(&cq->cq_lock, flags); +- if (cq->is_dying) { +- spin_unlock_irqrestore(&cq->cq_lock, flags); +- return; +- } +- spin_unlock_irqrestore(&cq->cq_lock, flags); +- +- cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context); +-} +- + int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe, + int comp_vector, struct ib_udata *udata, + struct rxe_create_cq_resp __user *uresp) +@@ -79,10 +64,6 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe, + + cq->is_user = uresp; + +- cq->is_dying = false; +- +- tasklet_setup(&cq->comp_task, rxe_send_complete); +- + spin_lock_init(&cq->cq_lock); + cq->ibcq.cqe = cqe; + return 0; +@@ -103,6 +84,7 @@ int rxe_cq_resize_queue(struct rxe_cq *cq, int cqe, + return err; + } + ++/* caller holds reference to cq */ + int rxe_cq_post(struct rxe_cq *cq, struct rxe_cqe *cqe, int solicited) + { + struct ib_event ev; +@@ -135,21 +117,13 @@ int rxe_cq_post(struct rxe_cq *cq, struct rxe_cqe *cqe, int solicited) + if ((cq->notify == IB_CQ_NEXT_COMP) || + (cq->notify == IB_CQ_SOLICITED && solicited)) { + cq->notify = 0; +- tasklet_schedule(&cq->comp_task); ++ ++ cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context); + } + + return 0; + } + +-void rxe_cq_disable(struct rxe_cq *cq) +-{ +- unsigned long flags; +- +- spin_lock_irqsave(&cq->cq_lock, flags); +- cq->is_dying = true; +- spin_unlock_irqrestore(&cq->cq_lock, flags); +-} +- + void rxe_cq_cleanup(struct rxe_pool_elem *elem) + { + struct rxe_cq *cq = container_of(elem, typeof(*cq), elem); +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index 84b53c070fc55..090d5bfb1e18d 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -1178,8 +1178,6 @@ static int rxe_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + goto err_out; + } + +- rxe_cq_disable(cq); +- + err = rxe_cleanup(cq); + if (err) + rxe_err_cq(cq, "cleanup failed, err = %d", err); +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h +index c269ae2a32243..d812093a39166 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.h ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h +@@ -63,9 +63,7 @@ struct rxe_cq { + struct rxe_queue *queue; + spinlock_t cq_lock; + u8 notify; +- bool is_dying; + bool is_user; +- struct tasklet_struct comp_task; + atomic_t num_wq; + }; + +-- +2.39.2 + diff --git a/queue-6.2/rdma-rxe-replace-exists-by-rxe-in-rxe.c.patch b/queue-6.2/rdma-rxe-replace-exists-by-rxe-in-rxe.c.patch new file mode 100644 index 00000000000..a3d6886ba3f --- /dev/null +++ b/queue-6.2/rdma-rxe-replace-exists-by-rxe-in-rxe.c.patch @@ -0,0 +1,64 @@ +From f8eab914b8869a73b04ca9e1775dcae6eaa73353 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 16:16:21 -0600 +Subject: RDMA/rxe: Replace exists by rxe in rxe.c + +From: Bob Pearson + +[ Upstream commit 9168d125ea032ad199275193493c13cb077da5cc ] + +'exists' looks like a boolean. This patch replaces it by the +normal name used for the rxe device, 'rxe', which should be a +little less confusing. The second rxe_dbg() message is +incorrect since rxe is known to be NULL and this will cause a +seg fault if this message were ever sent. Replace it by pr_debug +for the moment. + +Fixes: c6aba5ea0055 ("RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe.c") +Link: https://lore.kernel.org/r/20230303221623.8053-2-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c +index 136c2efe34660..a3f05fdd9fac2 100644 +--- a/drivers/infiniband/sw/rxe/rxe.c ++++ b/drivers/infiniband/sw/rxe/rxe.c +@@ -175,7 +175,7 @@ int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name) + + static int rxe_newlink(const char *ibdev_name, struct net_device *ndev) + { +- struct rxe_dev *exists; ++ struct rxe_dev *rxe; + int err = 0; + + if (is_vlan_dev(ndev)) { +@@ -184,17 +184,17 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev) + goto err; + } + +- exists = rxe_get_dev_from_net(ndev); +- if (exists) { +- ib_device_put(&exists->ib_dev); +- rxe_dbg(exists, "already configured on %s\n", ndev->name); ++ rxe = rxe_get_dev_from_net(ndev); ++ if (rxe) { ++ ib_device_put(&rxe->ib_dev); ++ rxe_dbg(rxe, "already configured on %s\n", ndev->name); + err = -EEXIST; + goto err; + } + + err = rxe_net_add(ibdev_name, ndev); + if (err) { +- rxe_dbg(exists, "failed to add %s\n", ndev->name); ++ pr_debug("failed to add %s\n", ndev->name); + goto err; + } + err: +-- +2.39.2 + diff --git a/queue-6.2/rdma-siw-fix-potential-page_array-out-of-range-acces.patch b/queue-6.2/rdma-siw-fix-potential-page_array-out-of-range-acces.patch new file mode 100644 index 00000000000..335f22dc05b --- /dev/null +++ b/queue-6.2/rdma-siw-fix-potential-page_array-out-of-range-acces.patch @@ -0,0 +1,39 @@ +From ceb0f8fe86efe623fa5d22da0790f6898c9868b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 01:17:51 -0800 +Subject: RDMA/siw: Fix potential page_array out of range access + +From: Daniil Dulov + +[ Upstream commit 271bfcfb83a9f77cbae3d6e1a16e3c14132922f0 ] + +When seg is equal to MAX_ARRAY, the loop should break, otherwise +it will result in out of range access. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: b9be6f18cf9e ("rdma/siw: transmit path") +Signed-off-by: Daniil Dulov +Link: https://lore.kernel.org/r/20230227091751.589612-1-d.dulov@aladdin.ru +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c +index 05052b49107f2..6bb9e9e81ff4c 100644 +--- a/drivers/infiniband/sw/siw/siw_qp_tx.c ++++ b/drivers/infiniband/sw/siw/siw_qp_tx.c +@@ -558,7 +558,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s) + data_len -= plen; + fp_off = 0; + +- if (++seg > (int)MAX_ARRAY) { ++ if (++seg >= (int)MAX_ARRAY) { + siw_dbg_qp(tx_qp(c_tx), "to many fragments\n"); + siw_unmap_pages(iov, kmap_mask, seg-1); + wqe->processed -= c_tx->bytes_unsent; +-- +2.39.2 + diff --git a/queue-6.2/rdma-siw-remove-namespace-check-from-siw_netdev_even.patch b/queue-6.2/rdma-siw-remove-namespace-check-from-siw_netdev_even.patch new file mode 100644 index 00000000000..97b3dfb2b67 --- /dev/null +++ b/queue-6.2/rdma-siw-remove-namespace-check-from-siw_netdev_even.patch @@ -0,0 +1,44 @@ +From 8b6e51087c3f0184113fd33eb67f57278c70e4a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Apr 2023 14:10:13 +0900 +Subject: RDMA/siw: Remove namespace check from siw_netdev_event() + +From: Tetsuo Handa + +[ Upstream commit 266e9b3475ba82212062771fdbc40be0e3c06ec8 ] + +syzbot is reporting that siw_netdev_event(NETDEV_UNREGISTER) cannot destroy +siw_device created after unshare(CLONE_NEWNET) due to net namespace check. +It seems that this check was by error there and should be removed. + +Reported-by: syzbot +Link: https://syzkaller.appspot.com/bug?extid=5e70d01ee8985ae62a3b +Suggested-by: Jason Gunthorpe +Suggested-by: Leon Romanovsky +Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface") +Signed-off-by: Tetsuo Handa +Link: https://lore.kernel.org/r/a44e9ac5-44e2-d575-9e30-02483cc7ffd1@I-love.SAKURA.ne.jp +Reviewed-by: Bernard Metzler +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_main.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c +index dacc174604bf2..65b5cda5457ba 100644 +--- a/drivers/infiniband/sw/siw/siw_main.c ++++ b/drivers/infiniband/sw/siw/siw_main.c +@@ -437,9 +437,6 @@ static int siw_netdev_event(struct notifier_block *nb, unsigned long event, + + dev_dbg(&netdev->dev, "siw: event %lu\n", event); + +- if (dev_net(netdev) != &init_net) +- return NOTIFY_OK; +- + base_dev = ib_device_get_by_netdev(netdev, RDMA_DRIVER_SIW); + if (!base_dev) + return NOTIFY_OK; +-- +2.39.2 + diff --git a/queue-6.2/rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch b/queue-6.2/rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch new file mode 100644 index 00000000000..5834e6bb9f6 --- /dev/null +++ b/queue-6.2/rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch @@ -0,0 +1,112 @@ +From 4027a464a6368e9b2636c63ff8404e1bb0ac9248 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 21:25:49 -0700 +Subject: RDMA/srpt: Add a check for valid 'mad_agent' pointer + +From: Saravanan Vajravel + +[ Upstream commit eca5cd9474cd26d62f9756f536e2e656d3f62f3a ] + +When unregistering MAD agent, srpt module has a non-null check +for 'mad_agent' pointer before invoking ib_unregister_mad_agent(). +This check can pass if 'mad_agent' variable holds an error value. +The 'mad_agent' can have an error value for a short window when +srpt_add_one() and srpt_remove_one() is executed simultaneously. + +In srpt module, added a valid pointer check for 'sport->mad_agent' +before unregistering MAD agent. + +This issue can hit when RoCE driver unregisters ib_device + +Stack Trace: +------------ +BUG: kernel NULL pointer dereference, address: 000000000000004d +PGD 145003067 P4D 145003067 PUD 2324fe067 PMD 0 +Oops: 0002 [#1] PREEMPT SMP NOPTI +CPU: 10 PID: 4459 Comm: kworker/u80:0 Kdump: loaded Tainted: P +Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.5.4 01/13/2020 +Workqueue: bnxt_re bnxt_re_task [bnxt_re] +RIP: 0010:_raw_spin_lock_irqsave+0x19/0x40 +Call Trace: + ib_unregister_mad_agent+0x46/0x2f0 [ib_core] + IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready + ? __schedule+0x20b/0x560 + srpt_unregister_mad_agent+0x93/0xd0 [ib_srpt] + srpt_remove_one+0x20/0x150 [ib_srpt] + remove_client_context+0x88/0xd0 [ib_core] + bond0: (slave p2p1): link status definitely up, 100000 Mbps full duplex + disable_device+0x8a/0x160 [ib_core] + bond0: active interface up! + ? kernfs_name_hash+0x12/0x80 + (NULL device *): Bonding Info Received: rdev: 000000006c0b8247 + __ib_unregister_device+0x42/0xb0 [ib_core] + (NULL device *): Master: mode: 4 num_slaves:2 + ib_unregister_device+0x22/0x30 [ib_core] + (NULL device *): Slave: id: 105069936 name:p2p1 link:0 state:0 + bnxt_re_stopqps_and_ib_uninit+0x83/0x90 [bnxt_re] + bnxt_re_alloc_lag+0x12e/0x4e0 [bnxt_re] + +Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") +Reviewed-by: Selvin Xavier +Reviewed-by: Kashyap Desai +Signed-off-by: Saravanan Vajravel +Link: https://lore.kernel.org/r/20230406042549.507328-1-saravanan.vajravel@broadcom.com +Reviewed-by: Bart Van Assche +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index 3c3fae738c3ed..25e799dba999e 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -549,6 +549,7 @@ static int srpt_format_guid(char *buf, unsigned int size, const __be64 *guid) + */ + static int srpt_refresh_port(struct srpt_port *sport) + { ++ struct ib_mad_agent *mad_agent; + struct ib_mad_reg_req reg_req; + struct ib_port_modify port_modify; + struct ib_port_attr port_attr; +@@ -593,24 +594,26 @@ static int srpt_refresh_port(struct srpt_port *sport) + set_bit(IB_MGMT_METHOD_GET, reg_req.method_mask); + set_bit(IB_MGMT_METHOD_SET, reg_req.method_mask); + +- sport->mad_agent = ib_register_mad_agent(sport->sdev->device, +- sport->port, +- IB_QPT_GSI, +- ®_req, 0, +- srpt_mad_send_handler, +- srpt_mad_recv_handler, +- sport, 0); +- if (IS_ERR(sport->mad_agent)) { ++ mad_agent = ib_register_mad_agent(sport->sdev->device, ++ sport->port, ++ IB_QPT_GSI, ++ ®_req, 0, ++ srpt_mad_send_handler, ++ srpt_mad_recv_handler, ++ sport, 0); ++ if (IS_ERR(mad_agent)) { + pr_err("%s-%d: MAD agent registration failed (%ld). Note: this is expected if SR-IOV is enabled.\n", + dev_name(&sport->sdev->device->dev), sport->port, +- PTR_ERR(sport->mad_agent)); ++ PTR_ERR(mad_agent)); + sport->mad_agent = NULL; + memset(&port_modify, 0, sizeof(port_modify)); + port_modify.clr_port_cap_mask = IB_PORT_DEVICE_MGMT_SUP; + ib_modify_port(sport->sdev->device, sport->port, 0, + &port_modify); +- ++ return 0; + } ++ ++ sport->mad_agent = mad_agent; + } + + return 0; +-- +2.39.2 + diff --git a/queue-6.2/regulator-core-avoid-lockdep-reports-when-resolving-.patch b/queue-6.2/regulator-core-avoid-lockdep-reports-when-resolving-.patch new file mode 100644 index 00000000000..1d6db65072b --- /dev/null +++ b/queue-6.2/regulator-core-avoid-lockdep-reports-when-resolving-.patch @@ -0,0 +1,266 @@ +From 05fa0e542d0bfd77fd167977ea8bfbb26875624b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 14:33:54 -0700 +Subject: regulator: core: Avoid lockdep reports when resolving supplies + +From: Douglas Anderson + +[ Upstream commit cba6cfdc7c3f1516f0d08ddfb24e689af0932573 ] + +An automated bot told me that there was a potential lockdep problem +with regulators. This was on the chromeos-5.15 kernel, but I see +nothing that would be different downstream compared to upstream. The +bot said: + ============================================ + WARNING: possible recursive locking detected + 5.15.104-lockdep-17461-gc1e499ed6604 #1 Not tainted + -------------------------------------------- + kworker/u16:4/115 is trying to acquire lock: + ffffff8083110170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: create_regulator+0x398/0x7ec + + but task is already holding lock: + ffffff808378e170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: ww_mutex_trylock+0x3c/0x7b8 + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(regulator_ww_class_mutex); + lock(regulator_ww_class_mutex); + + *** DEADLOCK *** + + May be due to missing lock nesting notation + + 4 locks held by kworker/u16:4/115: + #0: ffffff808006a948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x520/0x1348 + #1: ffffffc00e0a7cc0 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x55c/0x1348 + #2: ffffff80828a2260 (&dev->mutex){....}-{3:3}, at: __device_attach_async_helper+0xd0/0x2a4 + #3: ffffff808378e170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: ww_mutex_trylock+0x3c/0x7b8 + + stack backtrace: + CPU: 2 PID: 115 Comm: kworker/u16:4 Not tainted 5.15.104-lockdep-17461-gc1e499ed6604 #1 9292e52fa83c0e23762b2b3aa1bacf5787a4d5da + Hardware name: Google Quackingstick (rev0+) (DT) + Workqueue: events_unbound async_run_entry_fn + Call trace: + dump_backtrace+0x0/0x4ec + show_stack+0x34/0x50 + dump_stack_lvl+0xdc/0x11c + dump_stack+0x1c/0x48 + __lock_acquire+0x16d4/0x6c74 + lock_acquire+0x208/0x750 + __mutex_lock_common+0x11c/0x11f8 + ww_mutex_lock+0xc0/0x440 + create_regulator+0x398/0x7ec + regulator_resolve_supply+0x654/0x7c4 + regulator_register_resolve_supply+0x30/0x120 + class_for_each_device+0x1b8/0x230 + regulator_register+0x17a4/0x1f40 + devm_regulator_register+0x60/0xd0 + reg_fixed_voltage_probe+0x728/0xaec + platform_probe+0x150/0x1c8 + really_probe+0x274/0xa20 + __driver_probe_device+0x1dc/0x3f4 + driver_probe_device+0x78/0x1c0 + __device_attach_driver+0x1ac/0x2c8 + bus_for_each_drv+0x11c/0x190 + __device_attach_async_helper+0x1e4/0x2a4 + async_run_entry_fn+0xa0/0x3ac + process_one_work+0x638/0x1348 + worker_thread+0x4a8/0x9c4 + kthread+0x2e4/0x3a0 + ret_from_fork+0x10/0x20 + +The problem was first reported soon after we made many of the +regulators probe asynchronously, though nothing I've seen implies that +the problems couldn't have also happened even without that. + +I haven't personally been able to reproduce the lockdep issue, but the +issue does look somewhat legitimate. Specifically, it looks like in +regulator_resolve_supply() we are holding a "rdev" lock while calling +set_supply() -> create_regulator() which grabs the lock of a +_different_ "rdev" (the one for our supply). This is not necessarily +safe from a lockdep perspective since there is no documented ordering +between these two locks. + +In reality, we should always be locking a regulator before the +supplying regulator, so I don't expect there to be any real deadlocks +in practice. However, the regulator framework in general doesn't +express this to lockdep. + +Let's fix the issue by simply grabbing the two locks involved in the +same way we grab multiple locks elsewhere in the regulator framework: +using the "wound/wait" mechanisms. + +Fixes: eaa7995c529b ("regulator: core: avoid regulator_resolve_supply() race condition") +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20230329143317.RFC.v2.2.I30d8e1ca10cfbe5403884cdd192253a2e063eb9e@changeid +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 91 ++++++++++++++++++++++++++++++++++++---- + 1 file changed, 83 insertions(+), 8 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 9a13240f3084f..08726bc0da9d7 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -207,6 +207,78 @@ static void regulator_unlock(struct regulator_dev *rdev) + mutex_unlock(®ulator_nesting_mutex); + } + ++/** ++ * regulator_lock_two - lock two regulators ++ * @rdev1: first regulator ++ * @rdev2: second regulator ++ * @ww_ctx: w/w mutex acquire context ++ * ++ * Locks both rdevs using the regulator_ww_class. ++ */ ++static void regulator_lock_two(struct regulator_dev *rdev1, ++ struct regulator_dev *rdev2, ++ struct ww_acquire_ctx *ww_ctx) ++{ ++ struct regulator_dev *tmp; ++ int ret; ++ ++ ww_acquire_init(ww_ctx, ®ulator_ww_class); ++ ++ /* Try to just grab both of them */ ++ ret = regulator_lock_nested(rdev1, ww_ctx); ++ WARN_ON(ret); ++ ret = regulator_lock_nested(rdev2, ww_ctx); ++ if (ret != -EDEADLOCK) { ++ WARN_ON(ret); ++ goto exit; ++ } ++ ++ while (true) { ++ /* ++ * Start of loop: rdev1 was locked and rdev2 was contended. ++ * Need to unlock rdev1, slowly lock rdev2, then try rdev1 ++ * again. ++ */ ++ regulator_unlock(rdev1); ++ ++ ww_mutex_lock_slow(&rdev2->mutex, ww_ctx); ++ rdev2->ref_cnt++; ++ rdev2->mutex_owner = current; ++ ret = regulator_lock_nested(rdev1, ww_ctx); ++ ++ if (ret == -EDEADLOCK) { ++ /* More contention; swap which needs to be slow */ ++ tmp = rdev1; ++ rdev1 = rdev2; ++ rdev2 = tmp; ++ } else { ++ WARN_ON(ret); ++ break; ++ } ++ } ++ ++exit: ++ ww_acquire_done(ww_ctx); ++} ++ ++/** ++ * regulator_unlock_two - unlock two regulators ++ * @rdev1: first regulator ++ * @rdev2: second regulator ++ * @ww_ctx: w/w mutex acquire context ++ * ++ * The inverse of regulator_lock_two(). ++ */ ++ ++static void regulator_unlock_two(struct regulator_dev *rdev1, ++ struct regulator_dev *rdev2, ++ struct ww_acquire_ctx *ww_ctx) ++{ ++ regulator_unlock(rdev2); ++ regulator_unlock(rdev1); ++ ww_acquire_fini(ww_ctx); ++} ++ + static bool regulator_supply_is_couple(struct regulator_dev *rdev) + { + struct regulator_dev *c_rdev; +@@ -1627,8 +1699,8 @@ static int set_machine_constraints(struct regulator_dev *rdev) + + /** + * set_supply - set regulator supply regulator +- * @rdev: regulator name +- * @supply_rdev: supply regulator name ++ * @rdev: regulator (locked) ++ * @supply_rdev: supply regulator (locked)) + * + * Called by platform initialisation code to set the supply regulator for this + * regulator. This ensures that a regulators supply will also be enabled by the +@@ -1800,6 +1872,8 @@ static struct regulator *create_regulator(struct regulator_dev *rdev, + struct regulator *regulator; + int err = 0; + ++ lockdep_assert_held_once(&rdev->mutex.base); ++ + if (dev) { + char buf[REG_STR_SIZE]; + int size; +@@ -1827,9 +1901,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev, + regulator->rdev = rdev; + regulator->supply_name = supply_name; + +- regulator_lock(rdev); + list_add(®ulator->list, &rdev->consumer_list); +- regulator_unlock(rdev); + + if (dev) { + regulator->dev = dev; +@@ -1995,6 +2067,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev) + { + struct regulator_dev *r; + struct device *dev = rdev->dev.parent; ++ struct ww_acquire_ctx ww_ctx; + int ret = 0; + + /* No supply to resolve? */ +@@ -2061,23 +2134,23 @@ static int regulator_resolve_supply(struct regulator_dev *rdev) + * between rdev->supply null check and setting rdev->supply in + * set_supply() from concurrent tasks. + */ +- regulator_lock(rdev); ++ regulator_lock_two(rdev, r, &ww_ctx); + + /* Supply just resolved by a concurrent task? */ + if (rdev->supply) { +- regulator_unlock(rdev); ++ regulator_unlock_two(rdev, r, &ww_ctx); + put_device(&r->dev); + goto out; + } + + ret = set_supply(rdev, r); + if (ret < 0) { +- regulator_unlock(rdev); ++ regulator_unlock_two(rdev, r, &ww_ctx); + put_device(&r->dev); + goto out; + } + +- regulator_unlock(rdev); ++ regulator_unlock_two(rdev, r, &ww_ctx); + + /* + * In set_machine_constraints() we may have turned this regulator on +@@ -2190,7 +2263,9 @@ struct regulator *_regulator_get(struct device *dev, const char *id, + return regulator; + } + ++ regulator_lock(rdev); + regulator = create_regulator(rdev, dev, id); ++ regulator_unlock(rdev); + if (regulator == NULL) { + regulator = ERR_PTR(-ENOMEM); + module_put(rdev->owner); +-- +2.39.2 + diff --git a/queue-6.2/regulator-core-consistently-set-mutex_owner-when-usi.patch b/queue-6.2/regulator-core-consistently-set-mutex_owner-when-usi.patch new file mode 100644 index 00000000000..e2e9fb7e807 --- /dev/null +++ b/queue-6.2/regulator-core-consistently-set-mutex_owner-when-usi.patch @@ -0,0 +1,54 @@ +From 1649ed042673ecca85e53e2c53367e84c03c59f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 14:33:53 -0700 +Subject: regulator: core: Consistently set mutex_owner when using + ww_mutex_lock_slow() + +From: Douglas Anderson + +[ Upstream commit b83a1772be854f87602de14726737d3e5b06e1f4 ] + +When a codepath locks a rdev using ww_mutex_lock_slow() directly then +that codepath is responsible for incrementing the "ref_cnt" and also +setting the "mutex_owner" to "current". + +The regulator core consistently got that right for "ref_cnt" but +didn't always get it right for "mutex_owner". Let's fix this. + +It's unlikely that this truly matters because the "mutex_owner" is +only needed if we're going to do subsequent locking of the same +rdev. However, even though it's not truly needed it seems less +surprising if we consistently set "mutex_owner" properly. + +Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking") +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20230329143317.RFC.v2.1.I4e9d433ea26360c06dd1381d091c82bb1a4ce843@changeid +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 1490eb40c973a..9a13240f3084f 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -334,6 +334,7 @@ static void regulator_lock_dependent(struct regulator_dev *rdev, + ww_mutex_lock_slow(&new_contended_rdev->mutex, ww_ctx); + old_contended_rdev = new_contended_rdev; + old_contended_rdev->ref_cnt++; ++ old_contended_rdev->mutex_owner = current; + } + + err = regulator_lock_recursive(rdev, +@@ -6048,6 +6049,7 @@ static void regulator_summary_lock(struct ww_acquire_ctx *ww_ctx) + ww_mutex_lock_slow(&new_contended_rdev->mutex, ww_ctx); + old_contended_rdev = new_contended_rdev; + old_contended_rdev->ref_cnt++; ++ old_contended_rdev->mutex_owner = current; + } + + err = regulator_summary_lock_all(ww_ctx, +-- +2.39.2 + diff --git a/queue-6.2/regulator-core-shorten-off-on-delay-us-for-always-on.patch b/queue-6.2/regulator-core-shorten-off-on-delay-us-for-always-on.patch new file mode 100644 index 00000000000..4825a332b7c --- /dev/null +++ b/queue-6.2/regulator-core-shorten-off-on-delay-us-for-always-on.patch @@ -0,0 +1,114 @@ +From fc967829b3e04b73e38b62c596f736fdff512fd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 11:18:19 -0700 +Subject: regulator: core: Shorten off-on-delay-us for always-on/boot-on by + time since booted +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Douglas Anderson + +[ Upstream commit 691c1fcda5351ed98a44610b7dccc0e3ee920020 ] + +This is very close to a straight revert of commit 218320fec294 +("regulator: core: Fix off-on-delay-us for always-on/boot-on +regulators"). We've identified that patch as causing a boot speed +regression on sc7180-trogdor boards. While boot speed certainly isn't +more important than making sure that power sequencing is correct, +looking closely at the original change it doesn't seem to have been +fully justified. It mentions "cycling issues" without describing +exactly what the issues were. That means it's possible that the +cycling issues were really a problem that should be fixed in a +different way. + +Let's take a careful look at how we should handle regulators that have +an off-on-delay and that are boot-on or always-on. Linux currently +doesn't have any way to identify whether a GPIO regulator was already +on when the kernel booted. That means that when the kernel boots we +probe a regulator, see that it wants boot-on / always-on we, and then +turn the regulator on. We could be in one of two cases when we do +this: + +a) The regulator might have been left on by the bootloader and we're + ensuring that it stays on. +b) The regulator might have been left off by the bootloader and we're + just now turning it on. + +For case a) we definitely don't need any sort of delay. For case b) we +_might_ need some delay in case the bootloader turned the regulator +off _right_ before booting the kernel. To get the proper delay for +case b) then we can just assume a `last_off` of 0, which is what it +gets initialized to by default. + +As per above, we can't tell whether we're in case a) or case b) so +we'll assume the longer delay (case b). This basically puts the code +to how it was before commit 218320fec294 ("regulator: core: Fix +off-on-delay-us for always-on/boot-on regulators"). However, we add +one important change: we make sure that the delay is actually honored +if `last_off` is 0. Though the original "cycling issues" cited were +vague, I'm hopeful that this important extra change will be enough to +fix the issues that the initial commit mentioned. + +With this fix, I've confined that on a sc7180-trogdor board the delay +at boot goes down from 500 ms to ~250 ms. That's not as good as the 0 +ms that we had prior to commit 218320fec294 ("regulator: core: Fix +off-on-delay-us for always-on/boot-on regulators"), but it's probably +safer because we don't know if the bootloader turned the regulator off +right before booting. + +One note is that it's possible that we could be in a state that's not +a) or b) if there are other issues in the kernel. The only one I can +think of is related to pinctrl. If the pinctrl driver being used on a +board isn't careful about avoiding glitches when setting up a pin then +it's possible that setting up a pin could cause the regulator to "turn +off" briefly immediately before the regulator probes. If this is +indeed causing problems then the pinctrl driver should be fixed, +perhaps in a similar way to what was done in commit d21f4b7ffc22 +("pinctrl: qcom: Avoid glitching lines when we first mux to output") + +Fixes: 218320fec294 ("regulator: core: Fix off-on-delay-us for always-on/boot-on regulators") +Cc: Christian Kohlschütter +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20230313111806.1.I2eaad872be0932a805c239a7c7a102233fb0b03b@changeid +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 4fcd36055b025..1490eb40c973a 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1583,9 +1583,6 @@ static int set_machine_constraints(struct regulator_dev *rdev) + rdev->constraints->always_on = true; + } + +- if (rdev->desc->off_on_delay) +- rdev->last_off = ktime_get_boottime(); +- + /* If the constraints say the regulator should be on at this point + * and we have control then make sure it is enabled. + */ +@@ -1619,6 +1616,8 @@ static int set_machine_constraints(struct regulator_dev *rdev) + + if (rdev->constraints->always_on) + rdev->use_count++; ++ } else if (rdev->desc->off_on_delay) { ++ rdev->last_off = ktime_get(); + } + + print_constraints(rdev); +@@ -2668,7 +2667,7 @@ static int _regulator_do_enable(struct regulator_dev *rdev) + + trace_regulator_enable(rdev_get_name(rdev)); + +- if (rdev->desc->off_on_delay && rdev->last_off) { ++ if (rdev->desc->off_on_delay) { + /* if needed, keep a distance of off_on_delay from last time + * this regulator was disabled. + */ +-- +2.39.2 + diff --git a/queue-6.2/regulator-stm32-pwr-fix-of_iomap-leak.patch b/queue-6.2/regulator-stm32-pwr-fix-of_iomap-leak.patch new file mode 100644 index 00000000000..c21c9d48335 --- /dev/null +++ b/queue-6.2/regulator-stm32-pwr-fix-of_iomap-leak.patch @@ -0,0 +1,69 @@ +From 1913ba6e9ed3faad852a0c7ec7f139c9dc815fd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 11:35:29 +0800 +Subject: regulator: stm32-pwr: fix of_iomap leak + +From: YAN SHI + +[ Upstream commit c4a413e56d16a2ae84e6d8992f215c4dcc7fac20 ] + +Smatch reports: +drivers/regulator/stm32-pwr.c:166 stm32_pwr_regulator_probe() warn: +'base' from of_iomap() not released on lines: 151,166. + +In stm32_pwr_regulator_probe(), base is not released +when devm_kzalloc() fails to allocate memory or +devm_regulator_register() fails to register a new regulator device, +which may cause a leak. + +To fix this issue, replace of_iomap() with +devm_platform_ioremap_resource(). devm_platform_ioremap_resource() +is a specialized function for platform devices. +It allows 'base' to be automatically released whether the probe +function succeeds or fails. + +Besides, use IS_ERR(base) instead of !base +as the return value of devm_platform_ioremap_resource() +can either be a pointer to the remapped memory or +an ERR_PTR() encoded error code if the operation fails. + +Fixes: dc62f951a6a8 ("regulator: stm32-pwr: Fix return value check in stm32_pwr_regulator_probe()") +Signed-off-by: YAN SHI +Reported-by: kernel test robot +Link: https://lore.kernel.org/oe-kbuild-all/202304111750.o2643eJN-lkp@intel.com/ +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230412033529.18890-1-m202071378@hust.edu.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/stm32-pwr.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/regulator/stm32-pwr.c b/drivers/regulator/stm32-pwr.c +index 2a42acb7c24e9..e5dd4db6403b2 100644 +--- a/drivers/regulator/stm32-pwr.c ++++ b/drivers/regulator/stm32-pwr.c +@@ -129,17 +129,16 @@ static const struct regulator_desc stm32_pwr_desc[] = { + + static int stm32_pwr_regulator_probe(struct platform_device *pdev) + { +- struct device_node *np = pdev->dev.of_node; + struct stm32_pwr_reg *priv; + void __iomem *base; + struct regulator_dev *rdev; + struct regulator_config config = { }; + int i, ret = 0; + +- base = of_iomap(np, 0); +- if (!base) { ++ base = devm_platform_ioremap_resource(pdev, 0); ++ if (IS_ERR(base)) { + dev_err(&pdev->dev, "Unable to map IO memory\n"); +- return -ENOMEM; ++ return PTR_ERR(base); + } + + config.dev = &pdev->dev; +-- +2.39.2 + diff --git a/queue-6.2/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch b/queue-6.2/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch new file mode 100644 index 00000000000..db1f4458a05 --- /dev/null +++ b/queue-6.2/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch @@ -0,0 +1,39 @@ +From 28fcc2cca16c8052905a0904727de53d349ecab8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 18:30:06 +0800 +Subject: Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove + due to unfinished work" + +From: Liu Jian + +[ Upstream commit db2bf510bd5d57f064d9e1db395ed86a08320c54 ] + +This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. + +This patch introduces a possible null-ptr-def problem. Revert it. And the +fixed bug by this patch have resolved by commit 73f7b171b7c0 ("Bluetooth: +btsdio: fix use after free bug in btsdio_remove due to race condition"). + +Fixes: 1e9ac114c442 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work") +Signed-off-by: Liu Jian +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btsdio.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c +index 02893600db390..795be33f2892d 100644 +--- a/drivers/bluetooth/btsdio.c ++++ b/drivers/bluetooth/btsdio.c +@@ -354,7 +354,6 @@ static void btsdio_remove(struct sdio_func *func) + + BT_DBG("func %p", func); + +- cancel_work_sync(&data->work); + if (!data) + return; + +-- +2.39.2 + diff --git a/queue-6.2/revert-net-mlx5-remove-recovery-arg-from-mlx5_load_o.patch b/queue-6.2/revert-net-mlx5-remove-recovery-arg-from-mlx5_load_o.patch new file mode 100644 index 00000000000..03b5ada4f6c --- /dev/null +++ b/queue-6.2/revert-net-mlx5-remove-recovery-arg-from-mlx5_load_o.patch @@ -0,0 +1,95 @@ +From 5adbf32e7e7ef0561494ca81d408985ff19f8936 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Apr 2023 10:44:31 +0300 +Subject: Revert "net/mlx5: Remove "recovery" arg from mlx5_load_one() + function" + +From: Moshe Shemesh + +[ Upstream commit 21608a2cf38e9f743636b5f86507ffbca18ecee7 ] + +This reverts commit 5977ac3910f1cbaf44dca48179118b25c206ac29. + +Revert this patch as we need the "recovery" arg back in mlx5_load_one() +function. This arg will be used in the next patch for using recovery +timeout during sync reset flow. + +Signed-off-by: Moshe Shemesh +Reviewed-by: Maher Sanalla +Signed-off-by: Saeed Mahameed +Stable-dep-of: dfad99750c0f ("net/mlx5: Use recovery timeout on sync reset flow") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 2 +- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 9 +++++---- + drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h | 2 +- + 3 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +index 2ef42d76ac6a3..2b74729180394 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +@@ -154,7 +154,7 @@ static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev) + if (mlx5_health_wait_pci_up(dev)) + mlx5_core_err(dev, "reset reload flow aborted, PCI reads still not working\n"); + else +- mlx5_load_one(dev); ++ mlx5_load_one(dev, false); + devlink_remote_reload_actions_performed(priv_to_devlink(dev), 0, + BIT(DEVLINK_RELOAD_ACTION_DRIVER_REINIT) | + BIT(DEVLINK_RELOAD_ACTION_FW_ACTIVATE)); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index d5d4f499a2a15..0bb010d00a659 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1491,13 +1491,13 @@ int mlx5_load_one_devl_locked(struct mlx5_core_dev *dev, bool recovery) + return err; + } + +-int mlx5_load_one(struct mlx5_core_dev *dev) ++int mlx5_load_one(struct mlx5_core_dev *dev, bool recovery) + { + struct devlink *devlink = priv_to_devlink(dev); + int ret; + + devl_lock(devlink); +- ret = mlx5_load_one_devl_locked(dev, false); ++ ret = mlx5_load_one_devl_locked(dev, recovery); + devl_unlock(devlink); + return ret; + } +@@ -1891,7 +1891,8 @@ static void mlx5_pci_resume(struct pci_dev *pdev) + + mlx5_pci_trace(dev, "Enter, loading driver..\n"); + +- err = mlx5_load_one(dev); ++ err = mlx5_load_one(dev, false); ++ + if (!err) + devlink_health_reporter_state_update(dev->priv.health.fw_fatal_reporter, + DEVLINK_HEALTH_REPORTER_STATE_HEALTHY); +@@ -1982,7 +1983,7 @@ static int mlx5_resume(struct pci_dev *pdev) + { + struct mlx5_core_dev *dev = pci_get_drvdata(pdev); + +- return mlx5_load_one(dev); ++ return mlx5_load_one(dev, false); + } + + static const struct pci_device_id mlx5_core_pci_table[] = { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h +index be0785f83083a..a3c5c2dab5fd7 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h +@@ -321,7 +321,7 @@ int mlx5_init_one(struct mlx5_core_dev *dev); + void mlx5_uninit_one(struct mlx5_core_dev *dev); + void mlx5_unload_one(struct mlx5_core_dev *dev, bool suspend); + void mlx5_unload_one_devl_locked(struct mlx5_core_dev *dev, bool suspend); +-int mlx5_load_one(struct mlx5_core_dev *dev); ++int mlx5_load_one(struct mlx5_core_dev *dev, bool recovery); + int mlx5_load_one_devl_locked(struct mlx5_core_dev *dev, bool recovery); + + int mlx5_vport_set_other_func_cap(struct mlx5_core_dev *dev, const void *hca_cap, u16 function_id, +-- +2.39.2 + diff --git a/queue-6.2/revert-net-mlx5e-don-t-use-termination-table-when-re.patch b/queue-6.2/revert-net-mlx5e-don-t-use-termination-table-when-re.patch new file mode 100644 index 00000000000..be42382f2ce --- /dev/null +++ b/queue-6.2/revert-net-mlx5e-don-t-use-termination-table-when-re.patch @@ -0,0 +1,107 @@ +From f4d4c9e1dd0bc538e327286ce11852e073759203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 15:06:59 +0200 +Subject: Revert "net/mlx5e: Don't use termination table when redundant" + +From: Vlad Buslov + +[ Upstream commit 081abcacaf0a9505c0d4cc9780b12e6ce5d33630 ] + +This reverts commit 14624d7247fcd0f3114a6f5f17b3c8d1020fbbb7. + +The termination table usage is requires for DMFS steering mode as firmware +doesn't support mixed table destinations list which causes following +syndrome with hairpin rules: + +[81922.283225] mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 25977): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0xaca205), err(-22) + +Fixes: 14624d7247fc ("net/mlx5e: Don't use termination table when redundant") +Signed-off-by: Vlad Buslov +Reviewed-by: Roi Dayan +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../mlx5/core/eswitch_offloads_termtbl.c | 32 +++---------------- + 1 file changed, 4 insertions(+), 28 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c +index 3a9a6bb9158de..edd9102583144 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c +@@ -210,18 +210,6 @@ static bool mlx5_eswitch_offload_is_uplink_port(const struct mlx5_eswitch *esw, + return (port_mask & port_value) == MLX5_VPORT_UPLINK; + } + +-static bool +-mlx5_eswitch_is_push_vlan_no_cap(struct mlx5_eswitch *esw, +- struct mlx5_flow_act *flow_act) +-{ +- if (flow_act->action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH && +- !(mlx5_fs_get_capabilities(esw->dev, MLX5_FLOW_NAMESPACE_FDB) & +- MLX5_FLOW_STEERING_CAP_VLAN_PUSH_ON_RX)) +- return true; +- +- return false; +-} +- + bool + mlx5_eswitch_termtbl_required(struct mlx5_eswitch *esw, + struct mlx5_flow_attr *attr, +@@ -237,7 +225,10 @@ mlx5_eswitch_termtbl_required(struct mlx5_eswitch *esw, + (!mlx5_eswitch_offload_is_uplink_port(esw, spec) && !esw_attr->int_port)) + return false; + +- if (mlx5_eswitch_is_push_vlan_no_cap(esw, flow_act)) ++ /* push vlan on RX */ ++ if (flow_act->action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH && ++ !(mlx5_fs_get_capabilities(esw->dev, MLX5_FLOW_NAMESPACE_FDB) & ++ MLX5_FLOW_STEERING_CAP_VLAN_PUSH_ON_RX)) + return true; + + /* hairpin */ +@@ -261,31 +252,19 @@ mlx5_eswitch_add_termtbl_rule(struct mlx5_eswitch *esw, + struct mlx5_flow_act term_tbl_act = {}; + struct mlx5_flow_handle *rule = NULL; + bool term_table_created = false; +- bool is_push_vlan_on_rx; + int num_vport_dests = 0; + int i, curr_dest; + +- is_push_vlan_on_rx = mlx5_eswitch_is_push_vlan_no_cap(esw, flow_act); + mlx5_eswitch_termtbl_actions_move(flow_act, &term_tbl_act); + term_tbl_act.action |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST; + + for (i = 0; i < num_dest; i++) { + struct mlx5_termtbl_handle *tt; +- bool hairpin = false; + + /* only vport destinations can be terminated */ + if (dest[i].type != MLX5_FLOW_DESTINATION_TYPE_VPORT) + continue; + +- if (attr->dests[num_vport_dests].rep && +- attr->dests[num_vport_dests].rep->vport == MLX5_VPORT_UPLINK) +- hairpin = true; +- +- if (!is_push_vlan_on_rx && !hairpin) { +- num_vport_dests++; +- continue; +- } +- + if (attr->dests[num_vport_dests].flags & MLX5_ESW_DEST_ENCAP) { + term_tbl_act.action |= MLX5_FLOW_CONTEXT_ACTION_PACKET_REFORMAT; + term_tbl_act.pkt_reformat = attr->dests[num_vport_dests].pkt_reformat; +@@ -333,9 +312,6 @@ mlx5_eswitch_add_termtbl_rule(struct mlx5_eswitch *esw, + for (curr_dest = 0; curr_dest < num_vport_dests; curr_dest++) { + struct mlx5_termtbl_handle *tt = attr->dests[curr_dest].termtbl; + +- if (!tt) +- continue; +- + attr->dests[curr_dest].termtbl = NULL; + + /* search for the destination associated with the +-- +2.39.2 + diff --git a/queue-6.2/revert-objtool-support-addition-to-set-cfa-base.patch b/queue-6.2/revert-objtool-support-addition-to-set-cfa-base.patch new file mode 100644 index 00000000000..481aec77e86 --- /dev/null +++ b/queue-6.2/revert-objtool-support-addition-to-set-cfa-base.patch @@ -0,0 +1,53 @@ +From c6cd37a007b0bac4b651b14fa3c79c3f6d8d84db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 10:29:01 -0700 +Subject: Revert "objtool: Support addition to set CFA base" + +From: Josh Poimboeuf + +[ Upstream commit e18398e80c73e3cc7d9c3d2e0bc06a4af8f4f1cb ] + +Commit 468af56a7bba ("objtool: Support addition to set CFA base") was +added as a preparatory patch for arm64 support, but that support never +came. It triggers a false positive warning on x86, so just revert it +for now. + +Fixes the following warning: + + vmlinux.o: warning: objtool: cdce925_regmap_i2c_write+0xdb: stack state mismatch: cfa1=4+120 cfa2=5+40 + +Fixes: 468af56a7bba ("objtool: Support addition to set CFA base") +Reported-by: kernel test robot +Signed-off-by: Josh Poimboeuf +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/oe-kbuild-all/202304080538.j5G6h1AB-lkp@intel.com/ +Signed-off-by: Sasha Levin +--- + tools/objtool/check.c | 11 ----------- + 1 file changed, 11 deletions(-) + +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index ea1e7cdeb1b34..3b1e19894b21a 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -2913,17 +2913,6 @@ static int update_cfi_state(struct instruction *insn, + break; + } + +- if (!cfi->drap && op->src.reg == CFI_SP && +- op->dest.reg == CFI_BP && cfa->base == CFI_SP && +- check_reg_frame_pos(®s[CFI_BP], -cfa->offset + op->src.offset)) { +- +- /* lea disp(%rsp), %rbp */ +- cfa->base = CFI_BP; +- cfa->offset -= op->src.offset; +- cfi->bp_scratch = false; +- break; +- } +- + if (op->src.reg == CFI_SP && cfa->base == CFI_SP) { + + /* drap: lea disp(%rsp), %drap */ +-- +2.39.2 + diff --git a/queue-6.2/riscv-fix-ptdump-when-kasan-is-enabled.patch b/queue-6.2/riscv-fix-ptdump-when-kasan-is-enabled.patch new file mode 100644 index 00000000000..75894b0ce99 --- /dev/null +++ b/queue-6.2/riscv-fix-ptdump-when-kasan-is-enabled.patch @@ -0,0 +1,100 @@ +From 04e662d701d69d5cf0438e5ba3e8c36a0e0ed259 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Feb 2023 08:52:31 +0100 +Subject: riscv: Fix ptdump when KASAN is enabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexandre Ghiti + +[ Upstream commit ecd7ebaf0b5a094a6180b299a5635c0eea42be4b ] + +The KASAN shadow region was moved next to the kernel mapping but the +ptdump code was not updated and it appears to break the dump of the kernel +page table, so fix this by moving the KASAN shadow region in ptdump. + +Fixes: f7ae02333d13 ("riscv: Move KASAN mapping next to the kernel mapping") +Signed-off-by: Alexandre Ghiti +Tested-by: Björn Töpel +Reviewed-by: Björn Töpel +Link: https://lore.kernel.org/r/20230203075232.274282-6-alexghiti@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/mm/ptdump.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/riscv/mm/ptdump.c b/arch/riscv/mm/ptdump.c +index 830e7de65e3a3..20a9f991a6d74 100644 +--- a/arch/riscv/mm/ptdump.c ++++ b/arch/riscv/mm/ptdump.c +@@ -59,10 +59,6 @@ struct ptd_mm_info { + }; + + enum address_markers_idx { +-#ifdef CONFIG_KASAN +- KASAN_SHADOW_START_NR, +- KASAN_SHADOW_END_NR, +-#endif + FIXMAP_START_NR, + FIXMAP_END_NR, + PCI_IO_START_NR, +@@ -74,6 +70,10 @@ enum address_markers_idx { + VMALLOC_START_NR, + VMALLOC_END_NR, + PAGE_OFFSET_NR, ++#ifdef CONFIG_KASAN ++ KASAN_SHADOW_START_NR, ++ KASAN_SHADOW_END_NR, ++#endif + #ifdef CONFIG_64BIT + MODULES_MAPPING_NR, + KERNEL_MAPPING_NR, +@@ -82,10 +82,6 @@ enum address_markers_idx { + }; + + static struct addr_marker address_markers[] = { +-#ifdef CONFIG_KASAN +- {0, "Kasan shadow start"}, +- {0, "Kasan shadow end"}, +-#endif + {0, "Fixmap start"}, + {0, "Fixmap end"}, + {0, "PCI I/O start"}, +@@ -97,6 +93,10 @@ static struct addr_marker address_markers[] = { + {0, "vmalloc() area"}, + {0, "vmalloc() end"}, + {0, "Linear mapping"}, ++#ifdef CONFIG_KASAN ++ {0, "Kasan shadow start"}, ++ {0, "Kasan shadow end"}, ++#endif + #ifdef CONFIG_64BIT + {0, "Modules/BPF mapping"}, + {0, "Kernel mapping"}, +@@ -362,10 +362,6 @@ static int __init ptdump_init(void) + { + unsigned int i, j; + +-#ifdef CONFIG_KASAN +- address_markers[KASAN_SHADOW_START_NR].start_address = KASAN_SHADOW_START; +- address_markers[KASAN_SHADOW_END_NR].start_address = KASAN_SHADOW_END; +-#endif + address_markers[FIXMAP_START_NR].start_address = FIXADDR_START; + address_markers[FIXMAP_END_NR].start_address = FIXADDR_TOP; + address_markers[PCI_IO_START_NR].start_address = PCI_IO_START; +@@ -377,6 +373,10 @@ static int __init ptdump_init(void) + address_markers[VMALLOC_START_NR].start_address = VMALLOC_START; + address_markers[VMALLOC_END_NR].start_address = VMALLOC_END; + address_markers[PAGE_OFFSET_NR].start_address = PAGE_OFFSET; ++#ifdef CONFIG_KASAN ++ address_markers[KASAN_SHADOW_START_NR].start_address = KASAN_SHADOW_START; ++ address_markers[KASAN_SHADOW_END_NR].start_address = KASAN_SHADOW_END; ++#endif + #ifdef CONFIG_64BIT + address_markers[MODULES_MAPPING_NR].start_address = MODULES_VADDR; + address_markers[KERNEL_MAPPING_NR].start_address = kernel_map.virt_addr; +-- +2.39.2 + diff --git a/queue-6.2/rpmsg-glink-propagate-tx-failures-in-intentless-mode.patch b/queue-6.2/rpmsg-glink-propagate-tx-failures-in-intentless-mode.patch new file mode 100644 index 00000000000..d6246018a61 --- /dev/null +++ b/queue-6.2/rpmsg-glink-propagate-tx-failures-in-intentless-mode.patch @@ -0,0 +1,61 @@ +From be8825b2c2e5a08acdc602edab56a8c0551bd885 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 09:30:17 -0700 +Subject: rpmsg: glink: Propagate TX failures in intentless mode as well + +From: Bjorn Andersson + +[ Upstream commit 7a68f9fa97357a0f2073c9c31ed4101da4fce93e ] + +As support for splitting transmission over several messages using +TX_DATA_CONT was introduced it does not immediately return the return +value of qcom_glink_tx(). + +The result is that in the intentless case (i.e. intent == NULL), the +code will continue to send all additional chunks. This is wasteful, and +it's possible that the send operation could incorrectly indicate +success, if the last chunk fits in the TX fifo. + +Fix the condition. + +Fixes: 8956927faed3 ("rpmsg: glink: Add TX_DATA_CONT command while sending") +Reviewed-by: Chris Lew +Signed-off-by: Bjorn Andersson +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230418163018.785524-2-quic_bjorande@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_glink_native.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index 35df1b0a515bf..67e7664efb0dc 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -1348,8 +1348,9 @@ static int __qcom_glink_send(struct glink_channel *channel, + ret = qcom_glink_tx(glink, &req, sizeof(req), data, chunk_size, wait); + + /* Mark intent available if we failed */ +- if (ret && intent) { +- intent->in_use = false; ++ if (ret) { ++ if (intent) ++ intent->in_use = false; + return ret; + } + +@@ -1370,8 +1371,9 @@ static int __qcom_glink_send(struct glink_channel *channel, + chunk_size, wait); + + /* Mark intent available if we failed */ +- if (ret && intent) { +- intent->in_use = false; ++ if (ret) { ++ if (intent) ++ intent->in_use = false; + break; + } + } +-- +2.39.2 + diff --git a/queue-6.2/rtc-k3-handle-errors-while-enabling-wake-irq.patch b/queue-6.2/rtc-k3-handle-errors-while-enabling-wake-irq.patch new file mode 100644 index 00000000000..fbd4ee1f785 --- /dev/null +++ b/queue-6.2/rtc-k3-handle-errors-while-enabling-wake-irq.patch @@ -0,0 +1,39 @@ +From 632e5488bc446c871035e801e98182dc597adc6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 14:29:04 +0530 +Subject: rtc: k3: handle errors while enabling wake irq + +From: Dhruva Gole + +[ Upstream commit d31d7300ebc0c43021ec48c0e6a3a427386f4617 ] + +Due to the potential failure of enable_irq_wake(), it would be better to +return error if it fails. + +Fixes: b09d633575e5 ("rtc: Introduce ti-k3-rtc") +Cc: Nishanth Menon +Signed-off-by: Dhruva Gole +Link: https://lore.kernel.org/r/20230323085904.957999-1-d-gole@ti.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-ti-k3.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-ti-k3.c b/drivers/rtc/rtc-ti-k3.c +index ba23163cc0428..0d90fe9233550 100644 +--- a/drivers/rtc/rtc-ti-k3.c ++++ b/drivers/rtc/rtc-ti-k3.c +@@ -632,7 +632,8 @@ static int __maybe_unused ti_k3_rtc_suspend(struct device *dev) + struct ti_k3_rtc *priv = dev_get_drvdata(dev); + + if (device_may_wakeup(dev)) +- enable_irq_wake(priv->irq); ++ return enable_irq_wake(priv->irq); ++ + return 0; + } + +-- +2.39.2 + diff --git a/queue-6.2/rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch b/queue-6.2/rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch new file mode 100644 index 00000000000..2ee8e64632a --- /dev/null +++ b/queue-6.2/rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch @@ -0,0 +1,60 @@ +From 26fbbd75c632cf37c58561232a8d72e10944de0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 22:21:42 +0100 +Subject: rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time + +From: Martin Blumenstingl + +[ Upstream commit 0e6255fa3f649170da6bd1a544680589cfae1131 ] + +The VRTC alarm register can be programmed with an amount of seconds +after which the SoC will be woken up by the VRTC timer again. We are +already converting the alarm time from meson_vrtc_set_alarm() to +"seconds since 1970". This means we also need to use "seconds since +1970" for the current time. + +This fixes a problem where setting the alarm to one minute in the future +results in the firmware (which handles wakeup) to output (on the serial +console) that the system will be woken up in billions of seconds. +ktime_get_raw_ts64() returns the time since boot, not since 1970. Switch +to ktime_get_real_ts64() to fix the calculation of the alarm time and to +make the SoC wake up at the specified date/time. Also the firmware +(which manages suspend) now prints either 59 or 60 seconds until wakeup +(depending on how long it takes for the system to enter suspend). + +Fixes: 6ef35398e827 ("rtc: Add Amlogic Virtual Wake RTC") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Reviewed-by: Kevin Hilman +Link: https://lore.kernel.org/r/20230320212142.2355062-1-martin.blumenstingl@googlemail.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-meson-vrtc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/rtc/rtc-meson-vrtc.c b/drivers/rtc/rtc-meson-vrtc.c +index 1463c86215615..648fa362ec447 100644 +--- a/drivers/rtc/rtc-meson-vrtc.c ++++ b/drivers/rtc/rtc-meson-vrtc.c +@@ -23,7 +23,7 @@ static int meson_vrtc_read_time(struct device *dev, struct rtc_time *tm) + struct timespec64 time; + + dev_dbg(dev, "%s\n", __func__); +- ktime_get_raw_ts64(&time); ++ ktime_get_real_ts64(&time); + rtc_time64_to_tm(time.tv_sec, tm); + + return 0; +@@ -96,7 +96,7 @@ static int __maybe_unused meson_vrtc_suspend(struct device *dev) + long alarm_secs; + struct timespec64 time; + +- ktime_get_raw_ts64(&time); ++ ktime_get_real_ts64(&time); + local_time = time.tv_sec; + + dev_dbg(dev, "alarm_time = %lus, local_time=%lus\n", +-- +2.39.2 + diff --git a/queue-6.2/rtc-omap-include-header-for-omap_rtc_power_off_progr.patch b/queue-6.2/rtc-omap-include-header-for-omap_rtc_power_off_progr.patch new file mode 100644 index 00000000000..97fdc6f6632 --- /dev/null +++ b/queue-6.2/rtc-omap-include-header-for-omap_rtc_power_off_progr.patch @@ -0,0 +1,40 @@ +From 3ea9ee4fcd281bee116fd301264f52339e1d9ff5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Mar 2023 10:40:21 +0100 +Subject: rtc: omap: include header for omap_rtc_power_off_program prototype +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Kozlowski + +[ Upstream commit f69c2b5420497b7a54181ce170d682cbeb1f119f ] + +Non-static functions should have a prototype: + + drivers/rtc/rtc-omap.c:410:5: error: no previous prototype for ‘omap_rtc_power_off_program’ [-Werror=missing-prototypes] + +Fixes: 6256f7f7f217 ("rtc: OMAP: Add support for rtc-only mode") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230311094021.79730-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-omap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c +index 4d4f3b1a73093..73634a3ccfd3b 100644 +--- a/drivers/rtc/rtc-omap.c ++++ b/drivers/rtc/rtc-omap.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + /* + * The OMAP RTC is a year/month/day/hours/minutes/seconds BCD clock +-- +2.39.2 + diff --git a/queue-6.2/rv-fix-addition-on-an-uninitialized-variable-run.patch b/queue-6.2/rv-fix-addition-on-an-uninitialized-variable-run.patch new file mode 100644 index 00000000000..6aef83d27c4 --- /dev/null +++ b/queue-6.2/rv-fix-addition-on-an-uninitialized-variable-run.patch @@ -0,0 +1,41 @@ +From 25ed92a459e6ce68ec2ed366e2f01b6674db2bd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 10:47:30 +0100 +Subject: rv: Fix addition on an uninitialized variable 'run' + +From: Colin Ian King + +[ Upstream commit 54a0dffa62de0c91b406ff32082a121ccfa0d7f1 ] + +The variable run is not initialized however it is being accumulated +by the return value from the call to ikm_run_monitor. Fix this by +initializing run to zero at the start of the function. + +Link: https://lkml.kernel.org/r/20230424094730.105313-1-colin.i.king@gmail.com + +Fixes: 4bc4b131d44c ("rv: Add rv tool") + +Signed-off-by: Colin Ian King +Acked-by: Daniel Bristot de Oliveira +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + tools/verification/rv/src/rv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/verification/rv/src/rv.c b/tools/verification/rv/src/rv.c +index e601cd9c411e1..1ddb855328165 100644 +--- a/tools/verification/rv/src/rv.c ++++ b/tools/verification/rv/src/rv.c +@@ -74,7 +74,7 @@ static void rv_list(int argc, char **argv) + static void rv_mon(int argc, char **argv) + { + char *monitor_name; +- int i, run; ++ int i, run = 0; + + static const char *const usage[] = { + "", +-- +2.39.2 + diff --git a/queue-6.2/rxrpc-fix-error-when-reading-rxrpc-tokens.patch b/queue-6.2/rxrpc-fix-error-when-reading-rxrpc-tokens.patch new file mode 100644 index 00000000000..2a1dd046545 --- /dev/null +++ b/queue-6.2/rxrpc-fix-error-when-reading-rxrpc-tokens.patch @@ -0,0 +1,46 @@ +From 3df2db3062863185d6ddf6847f5ad00f4f11ad2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 17:16:17 +0100 +Subject: rxrpc: Fix error when reading rxrpc tokens + +From: Marc Dionne + +[ Upstream commit fadfc57cc8047080a123b16f288b7138524fb1e2 ] + +When converting from ASSERTCMP to WARN_ON, the tested condition must +be inverted, which was missed for this case. + +This would cause an EIO error when trying to read an rxrpc token, for +instance when trying to display tokens with AuriStor's "tokens" command. + +Fixes: 84924aac08a4 ("rxrpc: Fix checker warning") +Signed-off-by: Marc Dionne +Signed-off-by: David Howells +cc: "David S. Miller" +cc: Eric Dumazet +cc: Jakub Kicinski +cc: Paolo Abeni +cc: linux-afs@lists.infradead.org +cc: netdev@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rxrpc/key.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c +index 8d53aded09c42..33e8302a79e33 100644 +--- a/net/rxrpc/key.c ++++ b/net/rxrpc/key.c +@@ -680,7 +680,7 @@ static long rxrpc_read(const struct key *key, + return -ENOPKG; + } + +- if (WARN_ON((unsigned long)xdr - (unsigned long)oldxdr == ++ if (WARN_ON((unsigned long)xdr - (unsigned long)oldxdr != + toksize)) + return -EIO; + } +-- +2.39.2 + diff --git a/queue-6.2/s390-checksum-always-use-cksm-instruction.patch b/queue-6.2/s390-checksum-always-use-cksm-instruction.patch new file mode 100644 index 00000000000..9c245348691 --- /dev/null +++ b/queue-6.2/s390-checksum-always-use-cksm-instruction.patch @@ -0,0 +1,93 @@ +From b11289c7df2991d09e6d18c70bc165ce2dc0d4a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 12:55:46 +0200 +Subject: s390/checksum: always use cksm instruction + +From: Heiko Carstens + +[ Upstream commit e42ac7789df64120d7d3d57433dfc9f37ec0cb99 ] + +Commit dfe843dce775 ("s390/checksum: support GENERIC_CSUM, enable it for +KASAN") switched s390 to use the generic checksum functions, so that KASAN +instrumentation also works checksum functions by avoiding architecture +specific inline assemblies. + +There is however the problem that the generic csum_partial() function +returns a 32 bit value with a 16 bit folded checksum, while the original +s390 variant does not fold to 16 bit. This in turn causes that the +ipib_checksum in lowcore contains different values depending on kernel +config options. + +The ipib_checksum is used by system dumpers to verify if pointers in +lowcore point to valid data. Verification is done by comparing checksum +values. The system dumpers still use 32 bit checksum values which are not +folded, and therefore the checksum verification fails (incorrectly). + +Symptom is that reboot after dump does not work anymore when a KASAN +instrumented kernel is dumped. + +Fix this by not using the generic checksum implementation. Instead add an +explicit kasan_check_read() so that KASAN knows about the read access from +within the inline assembly. + +Reported-by: Alexander Egorenkov +Fixes: dfe843dce775 ("s390/checksum: support GENERIC_CSUM, enable it for KASAN") +Tested-by: Alexander Egorenkov +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/Kconfig | 4 ---- + arch/s390/include/asm/checksum.h | 9 ++------- + 2 files changed, 2 insertions(+), 11 deletions(-) + +diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig +index 7fd08755a1f9e..854a6581d2f90 100644 +--- a/arch/s390/Kconfig ++++ b/arch/s390/Kconfig +@@ -26,10 +26,6 @@ config GENERIC_BUG + config GENERIC_BUG_RELATIVE_POINTERS + def_bool y + +-config GENERIC_CSUM +- bool +- default y if KASAN +- + config GENERIC_LOCKBREAK + def_bool y if PREEMPTION + +diff --git a/arch/s390/include/asm/checksum.h b/arch/s390/include/asm/checksum.h +index d977a3a2f6190..1b6b992cf18ed 100644 +--- a/arch/s390/include/asm/checksum.h ++++ b/arch/s390/include/asm/checksum.h +@@ -12,12 +12,7 @@ + #ifndef _S390_CHECKSUM_H + #define _S390_CHECKSUM_H + +-#ifdef CONFIG_GENERIC_CSUM +- +-#include +- +-#else /* CONFIG_GENERIC_CSUM */ +- ++#include + #include + #include + +@@ -40,6 +35,7 @@ static inline __wsum csum_partial(const void *buff, int len, __wsum sum) + .odd = (unsigned long) len, + }; + ++ kasan_check_read(buff, len); + asm volatile( + "0: cksm %[sum],%[rp]\n" + " jo 0b\n" +@@ -135,5 +131,4 @@ static inline __sum16 csum_ipv6_magic(const struct in6_addr *saddr, + return csum_fold((__force __wsum)(sum >> 32)); + } + +-#endif /* CONFIG_GENERIC_CSUM */ + #endif /* _S390_CHECKSUM_H */ +-- +2.39.2 + diff --git a/queue-6.2/sched-fair-fix-inaccurate-tally-of-ttwu_move_affine.patch b/queue-6.2/sched-fair-fix-inaccurate-tally-of-ttwu_move_affine.patch new file mode 100644 index 00000000000..fafbe0ab247 --- /dev/null +++ b/queue-6.2/sched-fair-fix-inaccurate-tally-of-ttwu_move_affine.patch @@ -0,0 +1,46 @@ +From 017f1db5403cd0b7d200db5922fc153f575eea67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Aug 2022 15:33:13 -0700 +Subject: sched/fair: Fix inaccurate tally of ttwu_move_affine + +From: Libo Chen + +[ Upstream commit 39afe5d6fc59237ff7738bf3ede5a8856822d59d ] + +There are scenarios where non-affine wakeups are incorrectly counted as +affine wakeups by schedstats. + +When wake_affine_idle() returns prev_cpu which doesn't equal to +nr_cpumask_bits, it will slip through the check: target == nr_cpumask_bits +in wake_affine() and be counted as if target == this_cpu in schedstats. + +Replace target == nr_cpumask_bits with target != this_cpu to make sure +affine wakeups are accurately tallied. + +Fixes: 806486c377e33 (sched/fair: Do not migrate if the prev_cpu is idle) +Suggested-by: Daniel Jordan +Signed-off-by: Libo Chen +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Gautham R. Shenoy +Link: https://lore.kernel.org/r/20220810223313.386614-1-libo.chen@oracle.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 661226e38835d..6f1c7a8fa12ab 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -6487,7 +6487,7 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, + target = wake_affine_weight(sd, p, this_cpu, prev_cpu, sync); + + schedstat_inc(p->stats.nr_wakeups_affine_attempts); +- if (target == nr_cpumask_bits) ++ if (target != this_cpu) + return prev_cpu; + + schedstat_inc(sd->ttwu_move_affine); +-- +2.39.2 + diff --git a/queue-6.2/sched-rt-fix-bad-task-migration-for-rt-tasks.patch b/queue-6.2/sched-rt-fix-bad-task-migration-for-rt-tasks.patch new file mode 100644 index 00000000000..4fd22472ad7 --- /dev/null +++ b/queue-6.2/sched-rt-fix-bad-task-migration-for-rt-tasks.patch @@ -0,0 +1,85 @@ +From dce8b8ab794fa274304ea1fc3ee194746d52b3dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 01:03:02 +0800 +Subject: sched/rt: Fix bad task migration for rt tasks + +From: Schspa Shi + +[ Upstream commit feffe5bb274dd3442080ef0e4053746091878799 ] + +Commit 95158a89dd50 ("sched,rt: Use the full cpumask for balancing") +allows find_lock_lowest_rq() to pick a task with migration disabled. +The purpose of the commit is to push the current running task on the +CPU that has the migrate_disable() task away. + +However, there is a race which allows a migrate_disable() task to be +migrated. Consider: + + CPU0 CPU1 + push_rt_task + check is_migration_disabled(next_task) + + task not running and + migration_disabled == 0 + + find_lock_lowest_rq(next_task, rq); + _double_lock_balance(this_rq, busiest); + raw_spin_rq_unlock(this_rq); + double_rq_lock(this_rq, busiest); + <> + + task become running + migrate_disable(); + + deactivate_task(rq, next_task, 0); + set_task_cpu(next_task, lowest_rq->cpu); + WARN_ON_ONCE(is_migration_disabled(p)); + +Fixes: 95158a89dd50 ("sched,rt: Use the full cpumask for balancing") +Signed-off-by: Schspa Shi +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Steven Rostedt (Google) +Reviewed-by: Dietmar Eggemann +Reviewed-by: Valentin Schneider +Tested-by: Dwaine Gonyier +Signed-off-by: Sasha Levin +--- + kernel/sched/deadline.c | 1 + + kernel/sched/rt.c | 4 ++++ + 2 files changed, 5 insertions(+) + +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 0d97d54276cc8..238bdb36f8848 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -2246,6 +2246,7 @@ static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq) + !cpumask_test_cpu(later_rq->cpu, &task->cpus_mask) || + task_on_cpu(rq, task) || + !dl_task(task) || ++ is_migration_disabled(task) || + !task_on_rq_queued(task))) { + double_unlock_balance(rq, later_rq); + later_rq = NULL; +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 0a11f44adee57..4f5796dd26a56 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -2000,11 +2000,15 @@ static struct rq *find_lock_lowest_rq(struct task_struct *task, struct rq *rq) + * the mean time, task could have + * migrated already or had its affinity changed. + * Also make sure that it wasn't scheduled on its rq. ++ * It is possible the task was scheduled, set ++ * "migrate_disabled" and then got preempted, so we must ++ * check the task migration disable flag here too. + */ + if (unlikely(task_rq(task) != rq || + !cpumask_test_cpu(lowest_rq->cpu, &task->cpus_mask) || + task_on_cpu(rq, task) || + !rt_task(task) || ++ is_migration_disabled(task) || + !task_on_rq_queued(task))) { + + double_unlock_balance(rq, lowest_rq); +-- +2.39.2 + diff --git a/queue-6.2/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch b/queue-6.2/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch new file mode 100644 index 00000000000..3d2bec4b8a7 --- /dev/null +++ b/queue-6.2/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch @@ -0,0 +1,77 @@ +From 4476b86c9fd30decd2c53380fdc47ce81a9a1698 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 12:32:11 +0100 +Subject: scm: fix MSG_CTRUNC setting condition for SO_PASSSEC + +From: Alexander Mikhalitsyn + +[ Upstream commit a02d83f9947d8f71904eda4de046630c3eb6802c ] + +Currently, kernel would set MSG_CTRUNC flag if msg_control buffer +wasn't provided and SO_PASSCRED was set or if there was pending SCM_RIGHTS. + +For some reason we have no corresponding check for SO_PASSSEC. + +In the recvmsg(2) doc we have: + MSG_CTRUNC + indicates that some control data was discarded due to lack + of space in the buffer for ancillary data. + +So, we need to set MSG_CTRUNC flag for all types of SCM. + +This change can break applications those don't check MSG_CTRUNC flag. + +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: Leon Romanovsky +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Alexander Mikhalitsyn + +v2: +- commit message was rewritten according to Eric's suggestion +Acked-by: Paul Moore + +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/scm.h | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/include/net/scm.h b/include/net/scm.h +index 1ce365f4c2560..585adc1346bd0 100644 +--- a/include/net/scm.h ++++ b/include/net/scm.h +@@ -105,16 +105,27 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc + } + } + } ++ ++static inline bool scm_has_secdata(struct socket *sock) ++{ ++ return test_bit(SOCK_PASSSEC, &sock->flags); ++} + #else + static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm) + { } ++ ++static inline bool scm_has_secdata(struct socket *sock) ++{ ++ return false; ++} + #endif /* CONFIG_SECURITY_NETWORK */ + + static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg, + struct scm_cookie *scm, int flags) + { + if (!msg->msg_control) { +- if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp) ++ if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp || ++ scm_has_secdata(sock)) + msg->msg_flags |= MSG_CTRUNC; + scm_destroy(scm); + return; +-- +2.39.2 + diff --git a/queue-6.2/scripts-gdb-bail-early-if-there-are-no-clocks.patch b/queue-6.2/scripts-gdb-bail-early-if-there-are-no-clocks.patch new file mode 100644 index 00000000000..3ecc64b0a73 --- /dev/null +++ b/queue-6.2/scripts-gdb-bail-early-if-there-are-no-clocks.patch @@ -0,0 +1,48 @@ +From cf82daa3423f8b97ccf5af5cac7b8e405834541e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 15:52:45 -0700 +Subject: scripts/gdb: bail early if there are no clocks + +From: Florian Fainelli + +[ Upstream commit 1d7adbc74c009057ed9dc3112f388e91a9c79acc ] + +Avoid generating an exception if there are no clocks registered: + +(gdb) lx-clk-summary + enable prepare protect + clock count count count rate +------------------------------------------------------------------------ +Python Exception : No symbol "clk_root_list" in +current context. +Error occurred in Python: No symbol "clk_root_list" in current context. + +Link: https://lkml.kernel.org/r/20230323225246.3302977-1-f.fainelli@gmail.com +Fixes: d1e9710b63d8 ("scripts/gdb: initial clk support: lx-clk-summary") +Signed-off-by: Florian Fainelli +Cc: Jan Kiszka +Cc: Kieran Bingham +Cc: Leonard Crestez +Cc: Stephen Boyd +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/clk.py | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/scripts/gdb/linux/clk.py b/scripts/gdb/linux/clk.py +index 061aecfa294e6..7a01fdc3e8446 100644 +--- a/scripts/gdb/linux/clk.py ++++ b/scripts/gdb/linux/clk.py +@@ -41,6 +41,8 @@ are cached and potentially out of date""" + self.show_subtree(child, level + 1) + + def invoke(self, arg, from_tty): ++ if utils.gdb_eval_or_none("clk_root_list") is None: ++ raise gdb.GdbError("No clocks registered") + gdb.write(" enable prepare protect \n") + gdb.write(" clock count count count rate \n") + gdb.write("------------------------------------------------------------------------\n") +-- +2.39.2 + diff --git a/queue-6.2/scripts-gdb-bail-early-if-there-are-no-generic-pd.patch b/queue-6.2/scripts-gdb-bail-early-if-there-are-no-generic-pd.patch new file mode 100644 index 00000000000..4302f1d1659 --- /dev/null +++ b/queue-6.2/scripts-gdb-bail-early-if-there-are-no-generic-pd.patch @@ -0,0 +1,60 @@ +From a2799223830b1acd7109e802d7cf283d7bc09660 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 16:16:57 -0700 +Subject: scripts/gdb: bail early if there are no generic PD + +From: Florian Fainelli + +[ Upstream commit f19c3c2959e465209ade1a7a699e6cbf4359ce78 ] + +Avoid generating an exception if there are no generic power domain(s) +registered: + +(gdb) lx-genpd-summary +domain status children + /device runtime status +---------------------------------------------------------------------- +Python Exception : No symbol "gpd_list" in current context. +Error occurred in Python: No symbol "gpd_list" in current context. +(gdb) quit + +[f.fainelli@gmail.com: correctly invoke gdb_eval_or_none] + Link: https://lkml.kernel.org/r/20230327185746.3856407-1-f.fainelli@gmail.com +Link: https://lkml.kernel.org/r/20230323231659.3319941-1-f.fainelli@gmail.com +Fixes: 8207d4a88e1e ("scripts/gdb: add lx-genpd-summary command") +Signed-off-by: Florian Fainelli +Cc: Jan Kiszka +Cc: Kieran Bingham +Cc: Leonard Crestez +Cc: Stephen Boyd +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/genpd.py | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/scripts/gdb/linux/genpd.py b/scripts/gdb/linux/genpd.py +index 39cd1abd85590..b53649c0a77a6 100644 +--- a/scripts/gdb/linux/genpd.py ++++ b/scripts/gdb/linux/genpd.py +@@ -5,7 +5,7 @@ + import gdb + import sys + +-from linux.utils import CachedType ++from linux.utils import CachedType, gdb_eval_or_none + from linux.lists import list_for_each_entry + + generic_pm_domain_type = CachedType('struct generic_pm_domain') +@@ -70,6 +70,8 @@ Output is similar to /sys/kernel/debug/pm_genpd/pm_genpd_summary''' + gdb.write(' %-50s %s\n' % (kobj_path, rtpm_status_str(dev))) + + def invoke(self, arg, from_tty): ++ if gdb_eval_or_none("&gpd_list") is None: ++ raise gdb.GdbError("No power domain(s) registered") + gdb.write('domain status children\n'); + gdb.write(' /device runtime status\n'); + gdb.write('----------------------------------------------------------------------\n'); +-- +2.39.2 + diff --git a/queue-6.2/scripts-gdb-raise-error-with-reduced-debugging-infor.patch b/queue-6.2/scripts-gdb-raise-error-with-reduced-debugging-infor.patch new file mode 100644 index 00000000000..c83ed6caf92 --- /dev/null +++ b/queue-6.2/scripts-gdb-raise-error-with-reduced-debugging-infor.patch @@ -0,0 +1,78 @@ +From 7381ec5b18eb7dc1c21d3a85763eed2effdffbde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 14:52:51 -0700 +Subject: scripts/gdb: raise error with reduced debugging information + +From: Florian Fainelli + +[ Upstream commit 8af055ae25bff48f57227f5e3d48a4306f3dd1c4 ] + +If CONFIG_DEBUG_INFO_REDUCED is enabled in the kernel configuration, we +will typically not be able to load vmlinux-gdb.py and will fail with: + +Traceback (most recent call last): + File "/home/fainelli/work/buildroot/output/arm64/build/linux-custom/vmlinux-gdb.py", line 25, in + import linux.utils + File "/home/fainelli/work/buildroot/output/arm64/build/linux-custom/scripts/gdb/linux/utils.py", line 131, in + atomic_long_counter_offset = atomic_long_type.get_type()['counter'].bitpos +KeyError: 'counter' + +Rather be left wondering what is happening only to find out that reduced +debug information is the cause, raise an eror. This was not typically a +problem until e3c8d33e0d62 ("scripts/gdb: fix 'lx-dmesg' on 32 bits arch") +but it has since then. + +Link: https://lkml.kernel.org/r/20230406215252.1580538-1-f.fainelli@gmail.com +Fixes: e3c8d33e0d62 ("scripts/gdb: fix 'lx-dmesg' on 32 bits arch") +Signed-off-by: Florian Fainelli +Cc: Antonio Borneo +Cc: Jan Kiszka +Cc: John Ogness +Cc: Kieran Bingham +Cc: Petr Mladek +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/constants.py.in | 2 ++ + scripts/gdb/vmlinux-gdb.py | 5 ++++- + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/scripts/gdb/linux/constants.py.in b/scripts/gdb/linux/constants.py.in +index 2efbec6b6b8db..08f0587d15ea1 100644 +--- a/scripts/gdb/linux/constants.py.in ++++ b/scripts/gdb/linux/constants.py.in +@@ -39,6 +39,8 @@ + + import gdb + ++LX_CONFIG(CONFIG_DEBUG_INFO_REDUCED) ++ + /* linux/clk-provider.h */ + if IS_BUILTIN(CONFIG_COMMON_CLK): + LX_GDBPARSED(CLK_GET_RATE_NOCACHE) +diff --git a/scripts/gdb/vmlinux-gdb.py b/scripts/gdb/vmlinux-gdb.py +index 3e8d3669f0ce0..5564ffe8ae327 100644 +--- a/scripts/gdb/vmlinux-gdb.py ++++ b/scripts/gdb/vmlinux-gdb.py +@@ -22,6 +22,10 @@ except: + gdb.write("NOTE: gdb 7.2 or later required for Linux helper scripts to " + "work.\n") + else: ++ import linux.constants ++ if linux.constants.LX_CONFIG_DEBUG_INFO_REDUCED: ++ raise gdb.GdbError("Reduced debug information will prevent GDB " ++ "from having complete types.\n") + import linux.utils + import linux.symbols + import linux.modules +@@ -32,7 +36,6 @@ else: + import linux.lists + import linux.rbtree + import linux.proc +- import linux.constants + import linux.timerlist + import linux.clk + import linux.genpd +-- +2.39.2 + diff --git a/queue-6.2/scsi-hisi_sas-handle-ncq-error-when-iptt-is-valid.patch b/queue-6.2/scsi-hisi_sas-handle-ncq-error-when-iptt-is-valid.patch new file mode 100644 index 00000000000..85f0c6184ca --- /dev/null +++ b/queue-6.2/scsi-hisi_sas-handle-ncq-error-when-iptt-is-valid.patch @@ -0,0 +1,89 @@ +From 0ae8f4adf3b48dafda37473ce8481b563c80b915 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 11:34:23 +0800 +Subject: scsi: hisi_sas: Handle NCQ error when IPTT is valid + +From: Xingui Yang + +[ Upstream commit bb544224da77b96b2c11a13872bf91ede1e015be ] + +If an NCQ error occurs when the IPTT is valid and slot->abort flag is set +in completion path, sas_task_abort() will be called to abort only one NCQ +command now, and the host would be set to SHOST_RECOVERY state. But this +may not kick-off EH Immediately until other outstanding QCs timeouts. As a +result, the host may remain in the SHOST_RECOVERY state for up to 30 +seconds, such as follows: + +[7972317.645234] hisi_sas_v3_hw 0000:74:04.0: erroneous completion iptt=3264 task=00000000466116b8 dev id=2 sas_addr=0x5000000000000502 CQ hdr: 0x1883 0x20cc0 0x40000 0x20420000 Error info: 0x0 0x0 0x200000 0x0 +[7972341.508264] sas: Enter sas_scsi_recover_host busy: 32 failed: 32 +[7972341.984731] sas: --- Exit sas_scsi_recover_host: busy: 0 failed: 32 tries: 1 + +All NCQ commands that are in the queue should be aborted when an NCQ error +occurs in this scenario. + +Fixes: 05d91b557af9 ("scsi: hisi_sas: Directly trigger SCSI error handling for completion errors") +Signed-off-by: Xingui Yang +Signed-off-by: Xiang Chen +Link: https://lore.kernel.org/r/1679283265-115066-3-git-send-email-chenxiang66@hisilicon.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 6 +++++- + drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 6 +++++- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 6 +++++- + 3 files changed, 15 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +index d643c5a49aa94..70c24377c6a19 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +@@ -1258,7 +1258,11 @@ static void slot_complete_v1_hw(struct hisi_hba *hisi_hba, + + slot_err_v1_hw(hisi_hba, task, slot); + if (unlikely(slot->abort)) { +- sas_task_abort(task); ++ if (dev_is_sata(device) && task->ata_task.use_ncq) ++ sas_ata_device_link_abort(device, true); ++ else ++ sas_task_abort(task); ++ + return; + } + goto out; +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +index cded42f4ca445..02575d81afca2 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +@@ -2404,7 +2404,11 @@ static void slot_complete_v2_hw(struct hisi_hba *hisi_hba, + error_info[2], error_info[3]); + + if (unlikely(slot->abort)) { +- sas_task_abort(task); ++ if (dev_is_sata(device) && task->ata_task.use_ncq) ++ sas_ata_device_link_abort(device, true); ++ else ++ sas_task_abort(task); ++ + return; + } + goto out; +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index a63279f55d096..9afc23e3a80fc 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -2320,7 +2320,11 @@ static void slot_complete_v3_hw(struct hisi_hba *hisi_hba, + error_info[0], error_info[1], + error_info[2], error_info[3]); + if (unlikely(slot->abort)) { +- sas_task_abort(task); ++ if (dev_is_sata(device) && task->ata_task.use_ncq) ++ sas_ata_device_link_abort(device, true); ++ else ++ sas_task_abort(task); ++ + return; + } + goto out; +-- +2.39.2 + diff --git a/queue-6.2/scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch b/queue-6.2/scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch new file mode 100644 index 00000000000..4cf6af7f145 --- /dev/null +++ b/queue-6.2/scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch @@ -0,0 +1,70 @@ +From 83b7adc9757fc99ed26d5cae75aee29a68b97d00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 15:21:32 +0800 +Subject: scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() + +From: Shuchang Li + +[ Upstream commit 91a0c0c1413239d0548b5aac4c82f38f6d53a91e ] + +When if_type equals zero and pci_resource_start(pdev, PCI_64BIT_BAR4) +returns false, drbl_regs_memmap_p is not remapped. This passes a NULL +pointer to iounmap(), which can trigger a WARN() on certain arches. + +When if_type equals six and pci_resource_start(pdev, PCI_64BIT_BAR4) +returns true, drbl_regs_memmap_p may has been remapped and +ctrl_regs_memmap_p is not remapped. This is a resource leak and passes a +NULL pointer to iounmap(). + +To fix these issues, we need to add null checks before iounmap(), and +change some goto labels. + +Fixes: 1351e69fc6db ("scsi: lpfc: Add push-to-adapter support to sli4") +Signed-off-by: Shuchang Li +Link: https://lore.kernel.org/r/20230404072133.1022-1-lishuchang@hust.edu.cn +Reviewed-by: Justin Tee +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_init.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index eeb73da754d0d..99d2694fe00a0 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -11970,7 +11970,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba) + goto out_iounmap_all; + } else { + error = -ENOMEM; +- goto out_iounmap_all; ++ goto out_iounmap_ctrl; + } + } + +@@ -11988,7 +11988,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba) + dev_err(&pdev->dev, + "ioremap failed for SLI4 HBA dpp registers.\n"); + error = -ENOMEM; +- goto out_iounmap_ctrl; ++ goto out_iounmap_all; + } + phba->pci_bar4_memmap_p = phba->sli4_hba.dpp_regs_memmap_p; + } +@@ -12013,9 +12013,11 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba) + return 0; + + out_iounmap_all: +- iounmap(phba->sli4_hba.drbl_regs_memmap_p); ++ if (phba->sli4_hba.drbl_regs_memmap_p) ++ iounmap(phba->sli4_hba.drbl_regs_memmap_p); + out_iounmap_ctrl: +- iounmap(phba->sli4_hba.ctrl_regs_memmap_p); ++ if (phba->sli4_hba.ctrl_regs_memmap_p) ++ iounmap(phba->sli4_hba.ctrl_regs_memmap_p); + out_iounmap_conf: + iounmap(phba->sli4_hba.conf_regs_memmap_p); + +-- +2.39.2 + diff --git a/queue-6.2/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch b/queue-6.2/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch new file mode 100644 index 00000000000..9628dfdac95 --- /dev/null +++ b/queue-6.2/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch @@ -0,0 +1,38 @@ +From 3e17cbb6050d614a88864bdac8de35da817f741f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 17:51:09 +0000 +Subject: scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS + +From: Danila Chernetsov + +[ Upstream commit 75cb113cd43f06aaf4f1bda0069cfd5b98e909eb ] + +When cmdid == CMDID_INT_CMDS, the 'cmds' pointer is NULL but is +dereferenced below. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 0f2bb84d2a68 ("[SCSI] megaraid: simplify internal command handling") +Signed-off-by: Danila Chernetsov +Link: https://lore.kernel.org/r/20230317175109.18585-1-listdansp@mail.ru +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c +index bf491af9f0d65..16e2cf848c6ef 100644 +--- a/drivers/scsi/megaraid.c ++++ b/drivers/scsi/megaraid.c +@@ -1441,6 +1441,7 @@ mega_cmd_done(adapter_t *adapter, u8 completed[], int nstatus, int status) + */ + if (cmdid == CMDID_INT_CMDS) { + scb = &adapter->int_scb; ++ cmd = scb->cmd; + + list_del_init(&scb->list); + scb->state = SCB_FREE; +-- +2.39.2 + diff --git a/queue-6.2/scsi-target-fix-multiple-lun_reset-handling.patch b/queue-6.2/scsi-target-fix-multiple-lun_reset-handling.patch new file mode 100644 index 00000000000..b2c278d317f --- /dev/null +++ b/queue-6.2/scsi-target-fix-multiple-lun_reset-handling.patch @@ -0,0 +1,142 @@ +From ef35bb22bfb25bb68a782b78d635e4abcb9ab287 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 20:56:18 -0500 +Subject: scsi: target: Fix multiple LUN_RESET handling + +From: Mike Christie + +[ Upstream commit 673db054d7a2b5a470d7a25baf65956d005ad729 ] + +This fixes a bug where an initiator thinks a LUN_RESET has cleaned up +running commands when it hasn't. The bug was added in commit 51ec502a3266 +("target: Delete tmr from list before processing"). + +The problem occurs when: + + 1. We have N I/O cmds running in the target layer spread over 2 sessions. + + 2. The initiator sends a LUN_RESET for each session. + + 3. session1's LUN_RESET loops over all the running commands from both + sessions and moves them to its local drain_task_list. + + 4. session2's LUN_RESET does not see the LUN_RESET from session1 because + the commit above has it remove itself. session2 also does not see any + commands since the other reset moved them off the state lists. + + 5. sessions2's LUN_RESET will then complete with a successful response. + + 6. sessions2's inititor believes the running commands on its session are + now cleaned up due to the successful response and cleans up the running + commands from its side. It then restarts them. + + 7. The commands do eventually complete on the backend and the target + starts to return aborted task statuses for them. The initiator will + either throw a invalid ITT error or might accidentally lookup a new + task if the ITT has been reallocated already. + +Fix the bug by reverting the patch, and serialize the execution of +LUN_RESETs and Preempt and Aborts. + +Also prevent us from waiting on LUN_RESETs in core_tmr_drain_tmr_list, +because it turns out the original patch fixed a bug that was not +mentioned. For LUN_RESET1 core_tmr_drain_tmr_list can see a second +LUN_RESET and wait on it. Then the second reset will run +core_tmr_drain_tmr_list and see the first reset and wait on it resulting in +a deadlock. + +Fixes: 51ec502a3266 ("target: Delete tmr from list before processing") +Signed-off-by: Mike Christie +Link: https://lore.kernel.org/r/20230319015620.96006-8-michael.christie@oracle.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_device.c | 1 + + drivers/target/target_core_tmr.c | 26 +++++++++++++++++++++++--- + include/target/target_core_base.h | 1 + + 3 files changed, 25 insertions(+), 3 deletions(-) + +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index f6e58410ec3f9..aeb03136773d5 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -782,6 +782,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) + spin_lock_init(&dev->t10_alua.lba_map_lock); + + INIT_WORK(&dev->delayed_cmd_work, target_do_delayed_work); ++ mutex_init(&dev->lun_reset_mutex); + + dev->t10_wwn.t10_dev = dev; + /* +diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c +index 2b95b4550a637..4718db628222b 100644 +--- a/drivers/target/target_core_tmr.c ++++ b/drivers/target/target_core_tmr.c +@@ -188,14 +188,23 @@ static void core_tmr_drain_tmr_list( + * LUN_RESET tmr.. + */ + spin_lock_irqsave(&dev->se_tmr_lock, flags); +- if (tmr) +- list_del_init(&tmr->tmr_list); + list_for_each_entry_safe(tmr_p, tmr_pp, &dev->dev_tmr_list, tmr_list) { ++ if (tmr_p == tmr) ++ continue; ++ + cmd = tmr_p->task_cmd; + if (!cmd) { + pr_err("Unable to locate struct se_cmd for TMR\n"); + continue; + } ++ ++ /* ++ * We only execute one LUN_RESET at a time so we can't wait ++ * on them below. ++ */ ++ if (tmr_p->function == TMR_LUN_RESET) ++ continue; ++ + /* + * If this function was called with a valid pr_res_key + * parameter (eg: for PROUT PREEMPT_AND_ABORT service action +@@ -379,14 +388,25 @@ int core_tmr_lun_reset( + tmr_nacl->initiatorname); + } + } ++ ++ ++ /* ++ * We only allow one reset or preempt and abort to execute at a time ++ * to prevent one call from claiming all the cmds causing a second ++ * call from returning while cmds it should have waited on are still ++ * running. ++ */ ++ mutex_lock(&dev->lun_reset_mutex); ++ + pr_debug("LUN_RESET: %s starting for [%s], tas: %d\n", + (preempt_and_abort_list) ? "Preempt" : "TMR", + dev->transport->name, tas); +- + core_tmr_drain_tmr_list(dev, tmr, preempt_and_abort_list); + core_tmr_drain_state_list(dev, prout_cmd, tmr_sess, tas, + preempt_and_abort_list); + ++ mutex_unlock(&dev->lun_reset_mutex); ++ + /* + * Clear any legacy SPC-2 reservation when called during + * LOGICAL UNIT RESET +diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h +index bd299790e99c3..8cc42ad65c925 100644 +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -872,6 +872,7 @@ struct se_device { + struct rcu_head rcu_head; + int queue_cnt; + struct se_device_queue *queues; ++ struct mutex lun_reset_mutex; + }; + + struct target_opcode_descriptor { +-- +2.39.2 + diff --git a/queue-6.2/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch b/queue-6.2/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch new file mode 100644 index 00000000000..dd7ab550a4f --- /dev/null +++ b/queue-6.2/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch @@ -0,0 +1,67 @@ +From ad5150161f5d03915a21a8190012d7da09cca80a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 20:56:19 -0500 +Subject: scsi: target: iscsit: Fix TAS handling during conn cleanup + +From: Mike Christie + +[ Upstream commit cc79da306ebb2edb700c3816b90219223182ac3c ] + +Fix a bug added in commit f36199355c64 ("scsi: target: iscsi: Fix cmd abort +fabric stop race"). + +If CMD_T_TAS is set on the se_cmd we must call iscsit_free_cmd() to do the +last put on the cmd and free it, because the connection is down and we will +not up sending the response and doing the put from the normal I/O +path. + +Add a check for CMD_T_TAS in iscsit_release_commands_from_conn() so we now +detect this case and run iscsit_free_cmd(). + +Fixes: f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race") +Signed-off-by: Mike Christie +Link: https://lore.kernel.org/r/20230319015620.96006-9-michael.christie@oracle.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/iscsi/iscsi_target.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 83b0071412294..3f7a9f7f5f4e3 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -4220,9 +4220,12 @@ static void iscsit_release_commands_from_conn(struct iscsit_conn *conn) + list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) { + struct se_cmd *se_cmd = &cmd->se_cmd; + +- if (se_cmd->se_tfo != NULL) { +- spin_lock_irq(&se_cmd->t_state_lock); +- if (se_cmd->transport_state & CMD_T_ABORTED) { ++ if (!se_cmd->se_tfo) ++ continue; ++ ++ spin_lock_irq(&se_cmd->t_state_lock); ++ if (se_cmd->transport_state & CMD_T_ABORTED) { ++ if (!(se_cmd->transport_state & CMD_T_TAS)) + /* + * LIO's abort path owns the cleanup for this, + * so put it back on the list and let +@@ -4230,11 +4233,10 @@ static void iscsit_release_commands_from_conn(struct iscsit_conn *conn) + */ + list_move_tail(&cmd->i_conn_node, + &conn->conn_cmd_list); +- } else { +- se_cmd->transport_state |= CMD_T_FABRIC_STOP; +- } +- spin_unlock_irq(&se_cmd->t_state_lock); ++ } else { ++ se_cmd->transport_state |= CMD_T_FABRIC_STOP; + } ++ spin_unlock_irq(&se_cmd->t_state_lock); + } + spin_unlock_bh(&conn->cmd_lock); + +-- +2.39.2 + diff --git a/queue-6.2/scsi-target-iscsit-isert-alloc-per-conn-cmd-counter.patch b/queue-6.2/scsi-target-iscsit-isert-alloc-per-conn-cmd-counter.patch new file mode 100644 index 00000000000..a2b7859d2c9 --- /dev/null +++ b/queue-6.2/scsi-target-iscsit-isert-alloc-per-conn-cmd-counter.patch @@ -0,0 +1,180 @@ +From a26784cd9d7daf8b648111a10ca0c3764a04dfcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 20:56:15 -0500 +Subject: scsi: target: iscsit: isert: Alloc per conn cmd counter + +From: Mike Christie + +[ Upstream commit 6d256bee602b131bd4fbc92863b6a1210bcf6325 ] + +This has iscsit allocate a per conn cmd counter and converts iscsit/isert +to use it instead of the per session one. + +Signed-off-by: Mike Christie +Link: https://lore.kernel.org/r/20230319015620.96006-5-michael.christie@oracle.com +Signed-off-by: Martin K. Petersen +Stable-dep-of: 395cee83d02d ("scsi: target: iscsit: Stop/wait on cmds during conn close") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/isert/ib_isert.c | 4 ++-- + drivers/target/iscsi/iscsi_target.c | 4 ++-- + drivers/target/iscsi/iscsi_target_login.c | 17 +++++++---------- + drivers/target/target_core_transport.c | 9 ++++++--- + include/target/target_core_fabric.h | 3 +++ + 5 files changed, 20 insertions(+), 17 deletions(-) + +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 75404885cf981..f290cd49698ea 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -2506,8 +2506,8 @@ isert_wait4cmds(struct iscsit_conn *conn) + isert_info("iscsit_conn %p\n", conn); + + if (conn->sess) { +- target_stop_session(conn->sess->se_sess); +- target_wait_for_sess_cmds(conn->sess->se_sess); ++ target_stop_cmd_counter(conn->cmd_cnt); ++ target_wait_for_cmds(conn->cmd_cnt); + } + } + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 87927a36f90df..11115c2078446 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -1193,7 +1193,7 @@ int iscsit_setup_scsi_cmd(struct iscsit_conn *conn, struct iscsit_cmd *cmd, + conn->sess->se_sess, be32_to_cpu(hdr->data_length), + cmd->data_direction, sam_task_attr, + cmd->sense_buffer + 2, scsilun_to_int(&hdr->lun), +- conn->sess->se_sess->cmd_cnt); ++ conn->cmd_cnt); + + pr_debug("Got SCSI Command, ITT: 0x%08x, CmdSN: 0x%08x," + " ExpXferLen: %u, Length: %u, CID: %hu\n", hdr->itt, +@@ -2057,7 +2057,7 @@ iscsit_handle_task_mgt_cmd(struct iscsit_conn *conn, struct iscsit_cmd *cmd, + conn->sess->se_sess, 0, DMA_NONE, + TCM_SIMPLE_TAG, cmd->sense_buffer + 2, + scsilun_to_int(&hdr->lun), +- conn->sess->se_sess->cmd_cnt); ++ conn->cmd_cnt); + + target_get_sess_cmd(&cmd->se_cmd, true); + +diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c +index 8ab6c0107d89c..274bdd7845ca9 100644 +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -324,18 +324,8 @@ static int iscsi_login_zero_tsih_s1( + goto free_ops; + } + +- /* +- * This is temp for iser. It will be moved to per conn in later +- * patches for iscsi. +- */ +- sess->se_sess->cmd_cnt = target_alloc_cmd_counter(); +- if (!sess->se_sess->cmd_cnt) +- goto free_se_sess; +- + return 0; + +-free_se_sess: +- transport_free_session(sess->se_sess); + free_ops: + kfree(sess->sess_ops); + free_id: +@@ -1157,8 +1147,14 @@ static struct iscsit_conn *iscsit_alloc_conn(struct iscsi_np *np) + goto free_conn_cpumask; + } + ++ conn->cmd_cnt = target_alloc_cmd_counter(); ++ if (!conn->cmd_cnt) ++ goto free_conn_allowed_cpumask; ++ + return conn; + ++free_conn_allowed_cpumask: ++ free_cpumask_var(conn->allowed_cpumask); + free_conn_cpumask: + free_cpumask_var(conn->conn_cpumask); + free_conn_ops: +@@ -1172,6 +1168,7 @@ static struct iscsit_conn *iscsit_alloc_conn(struct iscsi_np *np) + + void iscsit_free_conn(struct iscsit_conn *conn) + { ++ target_free_cmd_counter(conn->cmd_cnt); + free_cpumask_var(conn->allowed_cpumask); + free_cpumask_var(conn->conn_cpumask); + kfree(conn->conn_ops); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index c395606ab1a9c..86adff2a86edd 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -254,7 +254,7 @@ struct target_cmd_counter *target_alloc_cmd_counter(void) + } + EXPORT_SYMBOL_GPL(target_alloc_cmd_counter); + +-static void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt) ++void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt) + { + /* + * Drivers like loop do not call target_stop_session during session +@@ -265,6 +265,7 @@ static void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt) + + percpu_ref_exit(&cmd_cnt->refcnt); + } ++EXPORT_SYMBOL_GPL(target_free_cmd_counter); + + /** + * transport_init_session - initialize a session object +@@ -3170,13 +3171,14 @@ static void target_stop_cmd_counter_confirm(struct percpu_ref *ref) + * target_stop_cmd_counter - Stop new IO from being added to the counter. + * @cmd_cnt: counter to stop + */ +-static void target_stop_cmd_counter(struct target_cmd_counter *cmd_cnt) ++void target_stop_cmd_counter(struct target_cmd_counter *cmd_cnt) + { + pr_debug("Stopping command counter.\n"); + if (!atomic_cmpxchg(&cmd_cnt->stopped, 0, 1)) + percpu_ref_kill_and_confirm(&cmd_cnt->refcnt, + target_stop_cmd_counter_confirm); + } ++EXPORT_SYMBOL_GPL(target_stop_cmd_counter); + + /** + * target_stop_session - Stop new IO from being queued on the session. +@@ -3192,7 +3194,7 @@ EXPORT_SYMBOL(target_stop_session); + * target_wait_for_cmds - Wait for outstanding cmds. + * @cmd_cnt: counter to wait for active I/O for. + */ +-static void target_wait_for_cmds(struct target_cmd_counter *cmd_cnt) ++void target_wait_for_cmds(struct target_cmd_counter *cmd_cnt) + { + int ret; + +@@ -3208,6 +3210,7 @@ static void target_wait_for_cmds(struct target_cmd_counter *cmd_cnt) + wait_for_completion(&cmd_cnt->stop_done); + pr_debug("Waiting for cmds done.\n"); + } ++EXPORT_SYMBOL_GPL(target_wait_for_cmds); + + /** + * target_wait_for_sess_cmds - Wait for outstanding commands +diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h +index d507e7885f17f..b188b1e90e1ed 100644 +--- a/include/target/target_core_fabric.h ++++ b/include/target/target_core_fabric.h +@@ -133,7 +133,10 @@ struct se_session *target_setup_session(struct se_portal_group *, + struct se_session *, void *)); + void target_remove_session(struct se_session *); + ++void target_stop_cmd_counter(struct target_cmd_counter *cmd_cnt); ++void target_wait_for_cmds(struct target_cmd_counter *cmd_cnt); + struct target_cmd_counter *target_alloc_cmd_counter(void); ++void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt); + + void transport_init_session(struct se_session *se_sess); + struct se_session *transport_alloc_session(enum target_prot_op); +-- +2.39.2 + diff --git a/queue-6.2/scsi-target-iscsit-stop-wait-on-cmds-during-conn-clo.patch b/queue-6.2/scsi-target-iscsit-stop-wait-on-cmds-during-conn-clo.patch new file mode 100644 index 00000000000..d3078cebad7 --- /dev/null +++ b/queue-6.2/scsi-target-iscsit-stop-wait-on-cmds-during-conn-clo.patch @@ -0,0 +1,73 @@ +From 8a7452d7851913d5edcef183ea63d86d17392401 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 20:56:16 -0500 +Subject: scsi: target: iscsit: Stop/wait on cmds during conn close + +From: Mike Christie + +[ Upstream commit 395cee83d02de3073211b04fc85724f4abc663ad ] + +This fixes a bug added in commit f36199355c64 ("scsi: target: iscsi: Fix +cmd abort fabric stop race"). + +If we have multiple sessions to the same se_device we can hit a race where +a LUN_RESET on one session cleans up the se_cmds from under another +session which is being closed. This results in the closing session freeing +its conn/session structs while they are still in use. + +The bug is: + + 1. Session1 has IO se_cmd1. + + 2. Session2 can also have se_cmds for I/O and optionally TMRs for ABORTS + but then gets a LUN_RESET. + + 3. The LUN_RESET on session2 sees the se_cmds on session1 and during the + drain stages marks them all with CMD_T_ABORTED. + + 4. session1 is now closed so iscsit_release_commands_from_conn() only sees + se_cmds with the CMD_T_ABORTED bit set and returns immediately even + though we have outstanding commands. + + 5. session1's connection and session are freed. + + 6. The backend request for se_cmd1 completes and it accesses the freed + connection/session. + +This hooks the iscsit layer into the cmd counter code, so we can wait for +all outstanding se_cmds before freeing the connection. + +Fixes: f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race") +Signed-off-by: Mike Christie +Link: https://lore.kernel.org/r/20230319015620.96006-6-michael.christie@oracle.com +Reviewed-by: Maurizio Lombardi +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/iscsi/iscsi_target.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 11115c2078446..83b0071412294 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -4245,6 +4245,16 @@ static void iscsit_release_commands_from_conn(struct iscsit_conn *conn) + iscsit_free_cmd(cmd, true); + + } ++ ++ /* ++ * Wait on commands that were cleaned up via the aborted_task path. ++ * LLDs that implement iscsit_wait_conn will already have waited for ++ * commands. ++ */ ++ if (!conn->conn_transport->iscsit_wait_conn) { ++ target_stop_cmd_counter(conn->cmd_cnt); ++ target_wait_for_cmds(conn->cmd_cnt); ++ } + } + + static void iscsit_stop_timers_for_cmds( +-- +2.39.2 + diff --git a/queue-6.2/scsi-target-move-cmd-counter-allocation.patch b/queue-6.2/scsi-target-move-cmd-counter-allocation.patch new file mode 100644 index 00000000000..768698dcc02 --- /dev/null +++ b/queue-6.2/scsi-target-move-cmd-counter-allocation.patch @@ -0,0 +1,267 @@ +From 24c578891c64656cd7ecc555c5fe54f561505458 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 20:56:13 -0500 +Subject: scsi: target: Move cmd counter allocation + +From: Mike Christie + +[ Upstream commit 4edba7e4a8f39112398d3cda94128a8e13a7d527 ] + +iSCSI needs to allocate its cmd counter per connection for MCS support +where we need to stop and wait on commands running on a connection instead +of per session. This moves the cmd counter allocation to +target_setup_session() which is used by drivers that need the stop+wait +behavior per session. + +xcopy doesn't need stop+wait at all, so we will be OK moving the cmd +counter allocation outside of transport_init_session(). + +Signed-off-by: Mike Christie +Link: https://lore.kernel.org/r/20230319015620.96006-3-michael.christie@oracle.com +Signed-off-by: Martin K. Petersen +Stable-dep-of: 395cee83d02d ("scsi: target: iscsit: Stop/wait on cmds during conn close") +Signed-off-by: Sasha Levin +--- + drivers/target/iscsi/iscsi_target_login.c | 10 +++++ + drivers/target/target_core_internal.h | 1 - + drivers/target/target_core_transport.c | 55 +++++++++++------------ + drivers/target/target_core_xcopy.c | 15 +------ + include/target/target_core_fabric.h | 4 +- + 5 files changed, 42 insertions(+), 43 deletions(-) + +diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c +index 27e448c2d066c..8ab6c0107d89c 100644 +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -324,8 +324,18 @@ static int iscsi_login_zero_tsih_s1( + goto free_ops; + } + ++ /* ++ * This is temp for iser. It will be moved to per conn in later ++ * patches for iscsi. ++ */ ++ sess->se_sess->cmd_cnt = target_alloc_cmd_counter(); ++ if (!sess->se_sess->cmd_cnt) ++ goto free_se_sess; ++ + return 0; + ++free_se_sess: ++ transport_free_session(sess->se_sess); + free_ops: + kfree(sess->sess_ops); + free_id: +diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h +index 38a6d08f75b34..85e35cf582e50 100644 +--- a/drivers/target/target_core_internal.h ++++ b/drivers/target/target_core_internal.h +@@ -138,7 +138,6 @@ int init_se_kmem_caches(void); + void release_se_kmem_caches(void); + u32 scsi_get_new_index(scsi_index_t); + void transport_subsystem_check_init(void); +-void transport_uninit_session(struct se_session *); + unsigned char *transport_dump_cmd_direction(struct se_cmd *); + void transport_dump_dev_state(struct se_device *, char *, int *); + void transport_dump_dev_info(struct se_device *, struct se_lun *, +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 3d6034f00dcd8..60647a49a1d31 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -228,7 +228,7 @@ static void target_release_cmd_refcnt(struct percpu_ref *ref) + wake_up(&cmd_cnt->refcnt_wq); + } + +-static struct target_cmd_counter *target_alloc_cmd_counter(void) ++struct target_cmd_counter *target_alloc_cmd_counter(void) + { + struct target_cmd_counter *cmd_cnt; + int rc; +@@ -252,6 +252,7 @@ static struct target_cmd_counter *target_alloc_cmd_counter(void) + kfree(cmd_cnt); + return NULL; + } ++EXPORT_SYMBOL_GPL(target_alloc_cmd_counter); + + static void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt) + { +@@ -271,24 +272,14 @@ static void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt) + * + * The caller must have zero-initialized @se_sess before calling this function. + */ +-int transport_init_session(struct se_session *se_sess) ++void transport_init_session(struct se_session *se_sess) + { + INIT_LIST_HEAD(&se_sess->sess_list); + INIT_LIST_HEAD(&se_sess->sess_acl_list); + spin_lock_init(&se_sess->sess_cmd_lock); +- se_sess->cmd_cnt = target_alloc_cmd_counter(); +- if (!se_sess->cmd_cnt) +- return -ENOMEM; +- +- return 0; + } + EXPORT_SYMBOL(transport_init_session); + +-void transport_uninit_session(struct se_session *se_sess) +-{ +- target_free_cmd_counter(se_sess->cmd_cnt); +-} +- + /** + * transport_alloc_session - allocate a session object and initialize it + * @sup_prot_ops: bitmask that defines which T10-PI modes are supported. +@@ -296,7 +287,6 @@ void transport_uninit_session(struct se_session *se_sess) + struct se_session *transport_alloc_session(enum target_prot_op sup_prot_ops) + { + struct se_session *se_sess; +- int ret; + + se_sess = kmem_cache_zalloc(se_sess_cache, GFP_KERNEL); + if (!se_sess) { +@@ -304,11 +294,7 @@ struct se_session *transport_alloc_session(enum target_prot_op sup_prot_ops) + " se_sess_cache\n"); + return ERR_PTR(-ENOMEM); + } +- ret = transport_init_session(se_sess); +- if (ret < 0) { +- kmem_cache_free(se_sess_cache, se_sess); +- return ERR_PTR(ret); +- } ++ transport_init_session(se_sess); + se_sess->sup_prot_ops = sup_prot_ops; + + return se_sess; +@@ -474,8 +460,13 @@ target_setup_session(struct se_portal_group *tpg, + int (*callback)(struct se_portal_group *, + struct se_session *, void *)) + { ++ struct target_cmd_counter *cmd_cnt; + struct se_session *sess; ++ int rc; + ++ cmd_cnt = target_alloc_cmd_counter(); ++ if (!cmd_cnt) ++ return ERR_PTR(-ENOMEM); + /* + * If the fabric driver is using percpu-ida based pre allocation + * of I/O descriptor tags, go ahead and perform that setup now.. +@@ -485,29 +476,36 @@ target_setup_session(struct se_portal_group *tpg, + else + sess = transport_alloc_session(prot_op); + +- if (IS_ERR(sess)) +- return sess; ++ if (IS_ERR(sess)) { ++ rc = PTR_ERR(sess); ++ goto free_cnt; ++ } ++ sess->cmd_cnt = cmd_cnt; + + sess->se_node_acl = core_tpg_check_initiator_node_acl(tpg, + (unsigned char *)initiatorname); + if (!sess->se_node_acl) { +- transport_free_session(sess); +- return ERR_PTR(-EACCES); ++ rc = -EACCES; ++ goto free_sess; + } + /* + * Go ahead and perform any remaining fabric setup that is + * required before transport_register_session(). + */ + if (callback != NULL) { +- int rc = callback(tpg, sess, private); +- if (rc) { +- transport_free_session(sess); +- return ERR_PTR(rc); +- } ++ rc = callback(tpg, sess, private); ++ if (rc) ++ goto free_sess; + } + + transport_register_session(tpg, sess->se_node_acl, sess, private); + return sess; ++ ++free_sess: ++ transport_free_session(sess); ++free_cnt: ++ target_free_cmd_counter(cmd_cnt); ++ return ERR_PTR(rc); + } + EXPORT_SYMBOL(target_setup_session); + +@@ -632,7 +630,8 @@ void transport_free_session(struct se_session *se_sess) + sbitmap_queue_free(&se_sess->sess_tag_pool); + kvfree(se_sess->sess_cmd_map); + } +- transport_uninit_session(se_sess); ++ if (se_sess->cmd_cnt) ++ target_free_cmd_counter(se_sess->cmd_cnt); + kmem_cache_free(se_sess_cache, se_sess); + } + EXPORT_SYMBOL(transport_free_session); +diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c +index 49eaee022ef1d..49a83500c8b75 100644 +--- a/drivers/target/target_core_xcopy.c ++++ b/drivers/target/target_core_xcopy.c +@@ -461,8 +461,6 @@ static const struct target_core_fabric_ops xcopy_pt_tfo = { + + int target_xcopy_setup_pt(void) + { +- int ret; +- + xcopy_wq = alloc_workqueue("xcopy_wq", WQ_MEM_RECLAIM, 0); + if (!xcopy_wq) { + pr_err("Unable to allocate xcopy_wq\n"); +@@ -479,9 +477,7 @@ int target_xcopy_setup_pt(void) + INIT_LIST_HEAD(&xcopy_pt_nacl.acl_list); + INIT_LIST_HEAD(&xcopy_pt_nacl.acl_sess_list); + memset(&xcopy_pt_sess, 0, sizeof(struct se_session)); +- ret = transport_init_session(&xcopy_pt_sess); +- if (ret < 0) +- goto destroy_wq; ++ transport_init_session(&xcopy_pt_sess); + + xcopy_pt_nacl.se_tpg = &xcopy_pt_tpg; + xcopy_pt_nacl.nacl_sess = &xcopy_pt_sess; +@@ -490,19 +486,12 @@ int target_xcopy_setup_pt(void) + xcopy_pt_sess.se_node_acl = &xcopy_pt_nacl; + + return 0; +- +-destroy_wq: +- destroy_workqueue(xcopy_wq); +- xcopy_wq = NULL; +- return ret; + } + + void target_xcopy_release_pt(void) + { +- if (xcopy_wq) { ++ if (xcopy_wq) + destroy_workqueue(xcopy_wq); +- transport_uninit_session(&xcopy_pt_sess); +- } + } + + /* +diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h +index 38f0662476d14..65527174b8bc6 100644 +--- a/include/target/target_core_fabric.h ++++ b/include/target/target_core_fabric.h +@@ -133,7 +133,9 @@ struct se_session *target_setup_session(struct se_portal_group *, + struct se_session *, void *)); + void target_remove_session(struct se_session *); + +-int transport_init_session(struct se_session *se_sess); ++struct target_cmd_counter *target_alloc_cmd_counter(void); ++ ++void transport_init_session(struct se_session *se_sess); + struct se_session *transport_alloc_session(enum target_prot_op); + int transport_alloc_session_tags(struct se_session *, unsigned int, + unsigned int); +-- +2.39.2 + diff --git a/queue-6.2/scsi-target-move-sess-cmd-counter-to-new-struct.patch b/queue-6.2/scsi-target-move-sess-cmd-counter-to-new-struct.patch new file mode 100644 index 00000000000..e886bda8c6a --- /dev/null +++ b/queue-6.2/scsi-target-move-sess-cmd-counter-to-new-struct.patch @@ -0,0 +1,313 @@ +From 16d7a705f41e3c420430c56b71186dc659d499ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 20:56:12 -0500 +Subject: scsi: target: Move sess cmd counter to new struct + +From: Mike Christie + +[ Upstream commit becd9be6069e7b183c084f460f0eb363e43cc487 ] + +iSCSI needs to wait on outstanding commands like how SRP and the FC/FCoE +drivers do. It can't use target_stop_session() because for MCS support we +can't stop the entire session during recovery because if other connections +are OK then we want to be able to continue to execute I/O on them. + +Move the per session cmd counters to a new struct so iSCSI can allocate +them per connection. The xcopy code can also just not allocate in the +future since it doesn't need to track commands. + +Signed-off-by: Mike Christie +Link: https://lore.kernel.org/r/20230319015620.96006-2-michael.christie@oracle.com +Reviewed-by: Maurizio Lombardi +Signed-off-by: Martin K. Petersen +Stable-dep-of: 395cee83d02d ("scsi: target: iscsit: Stop/wait on cmds during conn close") +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_tpg.c | 2 +- + drivers/target/target_core_transport.c | 135 ++++++++++++++++------- + include/target/iscsi/iscsi_target_core.h | 1 + + include/target/target_core_base.h | 13 ++- + 4 files changed, 107 insertions(+), 44 deletions(-) + +diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c +index 736847c933e5c..8ebccdbd94f0e 100644 +--- a/drivers/target/target_core_tpg.c ++++ b/drivers/target/target_core_tpg.c +@@ -328,7 +328,7 @@ static void target_shutdown_sessions(struct se_node_acl *acl) + restart: + spin_lock_irqsave(&acl->nacl_sess_lock, flags); + list_for_each_entry(sess, &acl->acl_sess_list, sess_acl_list) { +- if (atomic_read(&sess->stopped)) ++ if (sess->cmd_cnt && atomic_read(&sess->cmd_cnt->stopped)) + continue; + + list_del_init(&sess->sess_acl_list); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 5926316252eb9..3d6034f00dcd8 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -220,11 +220,49 @@ void transport_subsystem_check_init(void) + sub_api_initialized = 1; + } + +-static void target_release_sess_cmd_refcnt(struct percpu_ref *ref) ++static void target_release_cmd_refcnt(struct percpu_ref *ref) + { +- struct se_session *sess = container_of(ref, typeof(*sess), cmd_count); ++ struct target_cmd_counter *cmd_cnt = container_of(ref, ++ typeof(*cmd_cnt), ++ refcnt); ++ wake_up(&cmd_cnt->refcnt_wq); ++} ++ ++static struct target_cmd_counter *target_alloc_cmd_counter(void) ++{ ++ struct target_cmd_counter *cmd_cnt; ++ int rc; ++ ++ cmd_cnt = kzalloc(sizeof(*cmd_cnt), GFP_KERNEL); ++ if (!cmd_cnt) ++ return NULL; + +- wake_up(&sess->cmd_count_wq); ++ init_completion(&cmd_cnt->stop_done); ++ init_waitqueue_head(&cmd_cnt->refcnt_wq); ++ atomic_set(&cmd_cnt->stopped, 0); ++ ++ rc = percpu_ref_init(&cmd_cnt->refcnt, target_release_cmd_refcnt, 0, ++ GFP_KERNEL); ++ if (rc) ++ goto free_cmd_cnt; ++ ++ return cmd_cnt; ++ ++free_cmd_cnt: ++ kfree(cmd_cnt); ++ return NULL; ++} ++ ++static void target_free_cmd_counter(struct target_cmd_counter *cmd_cnt) ++{ ++ /* ++ * Drivers like loop do not call target_stop_session during session ++ * shutdown so we have to drop the ref taken at init time here. ++ */ ++ if (!atomic_read(&cmd_cnt->stopped)) ++ percpu_ref_put(&cmd_cnt->refcnt); ++ ++ percpu_ref_exit(&cmd_cnt->refcnt); + } + + /** +@@ -238,25 +276,17 @@ int transport_init_session(struct se_session *se_sess) + INIT_LIST_HEAD(&se_sess->sess_list); + INIT_LIST_HEAD(&se_sess->sess_acl_list); + spin_lock_init(&se_sess->sess_cmd_lock); +- init_waitqueue_head(&se_sess->cmd_count_wq); +- init_completion(&se_sess->stop_done); +- atomic_set(&se_sess->stopped, 0); +- return percpu_ref_init(&se_sess->cmd_count, +- target_release_sess_cmd_refcnt, 0, GFP_KERNEL); ++ se_sess->cmd_cnt = target_alloc_cmd_counter(); ++ if (!se_sess->cmd_cnt) ++ return -ENOMEM; ++ ++ return 0; + } + EXPORT_SYMBOL(transport_init_session); + + void transport_uninit_session(struct se_session *se_sess) + { +- /* +- * Drivers like iscsi and loop do not call target_stop_session +- * during session shutdown so we have to drop the ref taken at init +- * time here. +- */ +- if (!atomic_read(&se_sess->stopped)) +- percpu_ref_put(&se_sess->cmd_count); +- +- percpu_ref_exit(&se_sess->cmd_count); ++ target_free_cmd_counter(se_sess->cmd_cnt); + } + + /** +@@ -2970,9 +3000,16 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref) + se_cmd->se_cmd_flags |= SCF_ACK_KREF; + } + +- if (!percpu_ref_tryget_live(&se_sess->cmd_count)) +- ret = -ESHUTDOWN; +- ++ /* ++ * Users like xcopy do not use counters since they never do a stop ++ * and wait. ++ */ ++ if (se_sess->cmd_cnt) { ++ if (!percpu_ref_tryget_live(&se_sess->cmd_cnt->refcnt)) ++ ret = -ESHUTDOWN; ++ else ++ se_cmd->cmd_cnt = se_sess->cmd_cnt; ++ } + if (ret && ack_kref) + target_put_sess_cmd(se_cmd); + +@@ -2993,7 +3030,7 @@ static void target_free_cmd_mem(struct se_cmd *cmd) + static void target_release_cmd_kref(struct kref *kref) + { + struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref); +- struct se_session *se_sess = se_cmd->se_sess; ++ struct target_cmd_counter *cmd_cnt = se_cmd->cmd_cnt; + struct completion *free_compl = se_cmd->free_compl; + struct completion *abrt_compl = se_cmd->abrt_compl; + +@@ -3004,7 +3041,8 @@ static void target_release_cmd_kref(struct kref *kref) + if (abrt_compl) + complete(abrt_compl); + +- percpu_ref_put(&se_sess->cmd_count); ++ if (cmd_cnt) ++ percpu_ref_put(&cmd_cnt->refcnt); + } + + /** +@@ -3123,46 +3161,65 @@ void target_show_cmd(const char *pfx, struct se_cmd *cmd) + } + EXPORT_SYMBOL(target_show_cmd); + +-static void target_stop_session_confirm(struct percpu_ref *ref) ++static void target_stop_cmd_counter_confirm(struct percpu_ref *ref) ++{ ++ struct target_cmd_counter *cmd_cnt = container_of(ref, ++ struct target_cmd_counter, ++ refcnt); ++ complete_all(&cmd_cnt->stop_done); ++} ++ ++/** ++ * target_stop_cmd_counter - Stop new IO from being added to the counter. ++ * @cmd_cnt: counter to stop ++ */ ++static void target_stop_cmd_counter(struct target_cmd_counter *cmd_cnt) + { +- struct se_session *se_sess = container_of(ref, struct se_session, +- cmd_count); +- complete_all(&se_sess->stop_done); ++ pr_debug("Stopping command counter.\n"); ++ if (!atomic_cmpxchg(&cmd_cnt->stopped, 0, 1)) ++ percpu_ref_kill_and_confirm(&cmd_cnt->refcnt, ++ target_stop_cmd_counter_confirm); + } + + /** + * target_stop_session - Stop new IO from being queued on the session. +- * @se_sess: session to stop ++ * @se_sess: session to stop + */ + void target_stop_session(struct se_session *se_sess) + { +- pr_debug("Stopping session queue.\n"); +- if (atomic_cmpxchg(&se_sess->stopped, 0, 1) == 0) +- percpu_ref_kill_and_confirm(&se_sess->cmd_count, +- target_stop_session_confirm); ++ target_stop_cmd_counter(se_sess->cmd_cnt); + } + EXPORT_SYMBOL(target_stop_session); + + /** +- * target_wait_for_sess_cmds - Wait for outstanding commands +- * @se_sess: session to wait for active I/O ++ * target_wait_for_cmds - Wait for outstanding cmds. ++ * @cmd_cnt: counter to wait for active I/O for. + */ +-void target_wait_for_sess_cmds(struct se_session *se_sess) ++static void target_wait_for_cmds(struct target_cmd_counter *cmd_cnt) + { + int ret; + +- WARN_ON_ONCE(!atomic_read(&se_sess->stopped)); ++ WARN_ON_ONCE(!atomic_read(&cmd_cnt->stopped)); + + do { + pr_debug("Waiting for running cmds to complete.\n"); +- ret = wait_event_timeout(se_sess->cmd_count_wq, +- percpu_ref_is_zero(&se_sess->cmd_count), +- 180 * HZ); ++ ret = wait_event_timeout(cmd_cnt->refcnt_wq, ++ percpu_ref_is_zero(&cmd_cnt->refcnt), ++ 180 * HZ); + } while (ret <= 0); + +- wait_for_completion(&se_sess->stop_done); ++ wait_for_completion(&cmd_cnt->stop_done); + pr_debug("Waiting for cmds done.\n"); + } ++ ++/** ++ * target_wait_for_sess_cmds - Wait for outstanding commands ++ * @se_sess: session to wait for active I/O ++ */ ++void target_wait_for_sess_cmds(struct se_session *se_sess) ++{ ++ target_wait_for_cmds(se_sess->cmd_cnt); ++} + EXPORT_SYMBOL(target_wait_for_sess_cmds); + + /* +diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h +index 94d06ddfd80ad..229118156a1f6 100644 +--- a/include/target/iscsi/iscsi_target_core.h ++++ b/include/target/iscsi/iscsi_target_core.h +@@ -600,6 +600,7 @@ struct iscsit_conn { + struct iscsi_tpg_np *tpg_np; + /* Pointer to parent session */ + struct iscsit_session *sess; ++ struct target_cmd_counter *cmd_cnt; + int bitmap_id; + int rx_thread_active; + struct task_struct *rx_thread; +diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h +index 12c9ba16217ef..bd299790e99c3 100644 +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -494,6 +494,7 @@ struct se_cmd { + struct se_lun *se_lun; + /* Only used for internal passthrough and legacy TCM fabric modules */ + struct se_session *se_sess; ++ struct target_cmd_counter *cmd_cnt; + struct se_tmr_req *se_tmr_req; + struct llist_node se_cmd_list; + struct completion *free_compl; +@@ -619,22 +620,26 @@ static inline struct se_node_acl *fabric_stat_to_nacl(struct config_item *item) + acl_fabric_stat_group); + } + +-struct se_session { ++struct target_cmd_counter { ++ struct percpu_ref refcnt; ++ wait_queue_head_t refcnt_wq; ++ struct completion stop_done; + atomic_t stopped; ++}; ++ ++struct se_session { + u64 sess_bin_isid; + enum target_prot_op sup_prot_ops; + enum target_prot_type sess_prot_type; + struct se_node_acl *se_node_acl; + struct se_portal_group *se_tpg; + void *fabric_sess_ptr; +- struct percpu_ref cmd_count; + struct list_head sess_list; + struct list_head sess_acl_list; + spinlock_t sess_cmd_lock; +- wait_queue_head_t cmd_count_wq; +- struct completion stop_done; + void *sess_cmd_map; + struct sbitmap_queue sess_tag_pool; ++ struct target_cmd_counter *cmd_cnt; + }; + + struct se_device; +-- +2.39.2 + diff --git a/queue-6.2/scsi-target-pass-in-cmd-counter-to-use-during-cmd-se.patch b/queue-6.2/scsi-target-pass-in-cmd-counter-to-use-during-cmd-se.patch new file mode 100644 index 00000000000..c14cbd6ee9a --- /dev/null +++ b/queue-6.2/scsi-target-pass-in-cmd-counter-to-use-during-cmd-se.patch @@ -0,0 +1,199 @@ +From 4f3282381dad9febbbfa861498fc80a73b6fffed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 20:56:14 -0500 +Subject: scsi: target: Pass in cmd counter to use during cmd setup + +From: Mike Christie + +[ Upstream commit 8e288be8606ad87c1726618eacfb8fbd3ab4b806 ] + +Allow target_get_sess_cmd() users to pass in the cmd counter they want to +use. Right now we pass in the session's cmd counter but in a subsequent +commit iSCSI will switch from per session to per conn. + +Signed-off-by: Mike Christie +Link: https://lore.kernel.org/r/20230319015620.96006-4-michael.christie@oracle.com +Signed-off-by: Martin K. Petersen +Stable-dep-of: 395cee83d02d ("scsi: target: iscsit: Stop/wait on cmds during conn close") +Signed-off-by: Sasha Levin +--- + drivers/target/iscsi/iscsi_target.c | 10 +++++---- + drivers/target/target_core_transport.c | 28 ++++++++++++-------------- + drivers/target/target_core_xcopy.c | 8 ++++---- + drivers/usb/gadget/function/f_tcm.c | 4 ++-- + include/target/target_core_fabric.h | 8 +++++--- + 5 files changed, 30 insertions(+), 28 deletions(-) + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index baf4da7bb3b4e..87927a36f90df 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -1190,9 +1190,10 @@ int iscsit_setup_scsi_cmd(struct iscsit_conn *conn, struct iscsit_cmd *cmd, + * Initialize struct se_cmd descriptor from target_core_mod infrastructure + */ + __target_init_cmd(&cmd->se_cmd, &iscsi_ops, +- conn->sess->se_sess, be32_to_cpu(hdr->data_length), +- cmd->data_direction, sam_task_attr, +- cmd->sense_buffer + 2, scsilun_to_int(&hdr->lun)); ++ conn->sess->se_sess, be32_to_cpu(hdr->data_length), ++ cmd->data_direction, sam_task_attr, ++ cmd->sense_buffer + 2, scsilun_to_int(&hdr->lun), ++ conn->sess->se_sess->cmd_cnt); + + pr_debug("Got SCSI Command, ITT: 0x%08x, CmdSN: 0x%08x," + " ExpXferLen: %u, Length: %u, CID: %hu\n", hdr->itt, +@@ -2055,7 +2056,8 @@ iscsit_handle_task_mgt_cmd(struct iscsit_conn *conn, struct iscsit_cmd *cmd, + __target_init_cmd(&cmd->se_cmd, &iscsi_ops, + conn->sess->se_sess, 0, DMA_NONE, + TCM_SIMPLE_TAG, cmd->sense_buffer + 2, +- scsilun_to_int(&hdr->lun)); ++ scsilun_to_int(&hdr->lun), ++ conn->sess->se_sess->cmd_cnt); + + target_get_sess_cmd(&cmd->se_cmd, true); + +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 60647a49a1d31..c395606ab1a9c 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -1441,14 +1441,12 @@ target_cmd_size_check(struct se_cmd *cmd, unsigned int size) + * + * Preserves the value of @cmd->tag. + */ +-void __target_init_cmd( +- struct se_cmd *cmd, +- const struct target_core_fabric_ops *tfo, +- struct se_session *se_sess, +- u32 data_length, +- int data_direction, +- int task_attr, +- unsigned char *sense_buffer, u64 unpacked_lun) ++void __target_init_cmd(struct se_cmd *cmd, ++ const struct target_core_fabric_ops *tfo, ++ struct se_session *se_sess, u32 data_length, ++ int data_direction, int task_attr, ++ unsigned char *sense_buffer, u64 unpacked_lun, ++ struct target_cmd_counter *cmd_cnt) + { + INIT_LIST_HEAD(&cmd->se_delayed_node); + INIT_LIST_HEAD(&cmd->se_qf_node); +@@ -1468,6 +1466,7 @@ void __target_init_cmd( + cmd->sam_task_attr = task_attr; + cmd->sense_buffer = sense_buffer; + cmd->orig_fe_lun = unpacked_lun; ++ cmd->cmd_cnt = cmd_cnt; + + if (!(cmd->se_cmd_flags & SCF_USE_CPUID)) + cmd->cpuid = raw_smp_processor_id(); +@@ -1687,7 +1686,8 @@ int target_init_cmd(struct se_cmd *se_cmd, struct se_session *se_sess, + * target_core_fabric_ops->queue_status() callback + */ + __target_init_cmd(se_cmd, se_tpg->se_tpg_tfo, se_sess, data_length, +- data_dir, task_attr, sense, unpacked_lun); ++ data_dir, task_attr, sense, unpacked_lun, ++ se_sess->cmd_cnt); + + /* + * Obtain struct se_cmd->cmd_kref reference. A second kref_get here is +@@ -1982,7 +1982,8 @@ int target_submit_tmr(struct se_cmd *se_cmd, struct se_session *se_sess, + BUG_ON(!se_tpg); + + __target_init_cmd(se_cmd, se_tpg->se_tpg_tfo, se_sess, +- 0, DMA_NONE, TCM_SIMPLE_TAG, sense, unpacked_lun); ++ 0, DMA_NONE, TCM_SIMPLE_TAG, sense, unpacked_lun, ++ se_sess->cmd_cnt); + /* + * FIXME: Currently expect caller to handle se_cmd->se_tmr_req + * allocation failure. +@@ -2986,7 +2987,6 @@ EXPORT_SYMBOL(transport_generic_free_cmd); + */ + int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref) + { +- struct se_session *se_sess = se_cmd->se_sess; + int ret = 0; + + /* +@@ -3003,11 +3003,9 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref) + * Users like xcopy do not use counters since they never do a stop + * and wait. + */ +- if (se_sess->cmd_cnt) { +- if (!percpu_ref_tryget_live(&se_sess->cmd_cnt->refcnt)) ++ if (se_cmd->cmd_cnt) { ++ if (!percpu_ref_tryget_live(&se_cmd->cmd_cnt->refcnt)) + ret = -ESHUTDOWN; +- else +- se_cmd->cmd_cnt = se_sess->cmd_cnt; + } + if (ret && ack_kref) + target_put_sess_cmd(se_cmd); +diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c +index 49a83500c8b75..91ed015b588c6 100644 +--- a/drivers/target/target_core_xcopy.c ++++ b/drivers/target/target_core_xcopy.c +@@ -591,8 +591,8 @@ static int target_xcopy_read_source( + (unsigned long long)src_lba, transfer_length_block, src_bytes); + + __target_init_cmd(se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, src_bytes, +- DMA_FROM_DEVICE, 0, &xpt_cmd.sense_buffer[0], 0); +- ++ DMA_FROM_DEVICE, 0, &xpt_cmd.sense_buffer[0], 0, ++ NULL); + rc = target_xcopy_setup_pt_cmd(&xpt_cmd, xop, src_dev, &cdb[0], + remote_port); + if (rc < 0) { +@@ -636,8 +636,8 @@ static int target_xcopy_write_destination( + (unsigned long long)dst_lba, transfer_length_block, dst_bytes); + + __target_init_cmd(se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, dst_bytes, +- DMA_TO_DEVICE, 0, &xpt_cmd.sense_buffer[0], 0); +- ++ DMA_TO_DEVICE, 0, &xpt_cmd.sense_buffer[0], 0, ++ NULL); + rc = target_xcopy_setup_pt_cmd(&xpt_cmd, xop, dst_dev, &cdb[0], + remote_port); + if (rc < 0) { +diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c +index 658e2e21fdd0d..c21acebe8aae5 100644 +--- a/drivers/usb/gadget/function/f_tcm.c ++++ b/drivers/usb/gadget/function/f_tcm.c +@@ -1054,7 +1054,7 @@ static void usbg_cmd_work(struct work_struct *work) + tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo, + tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE, + cmd->prio_attr, cmd->sense_iu.sense, +- cmd->unpacked_lun); ++ cmd->unpacked_lun, NULL); + goto out; + } + +@@ -1183,7 +1183,7 @@ static void bot_cmd_work(struct work_struct *work) + tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo, + tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE, + cmd->prio_attr, cmd->sense_iu.sense, +- cmd->unpacked_lun); ++ cmd->unpacked_lun, NULL); + goto out; + } + +diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h +index 65527174b8bc6..d507e7885f17f 100644 +--- a/include/target/target_core_fabric.h ++++ b/include/target/target_core_fabric.h +@@ -151,9 +151,11 @@ void transport_deregister_session_configfs(struct se_session *); + void transport_deregister_session(struct se_session *); + + +-void __target_init_cmd(struct se_cmd *, +- const struct target_core_fabric_ops *, +- struct se_session *, u32, int, int, unsigned char *, u64); ++void __target_init_cmd(struct se_cmd *cmd, ++ const struct target_core_fabric_ops *tfo, ++ struct se_session *sess, u32 data_length, int data_direction, ++ int task_attr, unsigned char *sense_buffer, u64 unpacked_lun, ++ struct target_cmd_counter *cmd_cnt); + int target_init_cmd(struct se_cmd *se_cmd, struct se_session *se_sess, + unsigned char *sense, u64 unpacked_lun, u32 data_length, + int task_attr, int data_dir, int flags); +-- +2.39.2 + diff --git a/queue-6.2/selftests-bpf-fix-a-fd-leak-in-an-error-path-in-netw.patch b/queue-6.2/selftests-bpf-fix-a-fd-leak-in-an-error-path-in-netw.patch new file mode 100644 index 00000000000..2981f4cec70 --- /dev/null +++ b/queue-6.2/selftests-bpf-fix-a-fd-leak-in-an-error-path-in-netw.patch @@ -0,0 +1,40 @@ +From dce8e463396cbc3cd1f6115916ab4a5fca5a0b4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 17:07:26 -0700 +Subject: selftests/bpf: Fix a fd leak in an error path in network_helpers.c + +From: Martin KaFai Lau + +[ Upstream commit 226efec2b0efad60d4a6c4b2c3a8710dafc4dc21 ] + +In __start_server, it leaks a fd when setsockopt(SO_REUSEPORT) fails. +This patch fixes it. + +Fixes: eed92afdd14c ("bpf: selftest: Test batching and bpf_(get|set)sockopt in bpf tcp iter") +Reported-by: Andrii Nakryiko +Signed-off-by: Martin KaFai Lau +Signed-off-by: Daniel Borkmann +Acked-by: Yonghong Song +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/20230316000726.1016773-2-martin.lau@linux.dev +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/network_helpers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/network_helpers.c b/tools/testing/selftests/bpf/network_helpers.c +index 01de33191226b..596caa1765820 100644 +--- a/tools/testing/selftests/bpf/network_helpers.c ++++ b/tools/testing/selftests/bpf/network_helpers.c +@@ -95,7 +95,7 @@ static int __start_server(int type, int protocol, const struct sockaddr *addr, + if (reuseport && + setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &on, sizeof(on))) { + log_err("Failed to set SO_REUSEPORT"); +- return -1; ++ goto error_close; + } + + if (bind(fd, addr, addrlen) < 0) { +-- +2.39.2 + diff --git a/queue-6.2/selftests-bpf-fix-leaked-bpf_link-in-get_stackid_can.patch b/queue-6.2/selftests-bpf-fix-leaked-bpf_link-in-get_stackid_can.patch new file mode 100644 index 00000000000..62b0071179b --- /dev/null +++ b/queue-6.2/selftests-bpf-fix-leaked-bpf_link-in-get_stackid_can.patch @@ -0,0 +1,57 @@ +From f2d9aa269f2c387bd6849c0953129d017a5f4067 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 14:04:22 -0700 +Subject: selftests/bpf: Fix leaked bpf_link in get_stackid_cannot_attach + +From: Song Liu + +[ Upstream commit c1e07a80cf23d3a6e96172bc9a73bfa912a9fcbc ] + +skel->links.oncpu is leaked in one case. This causes test perf_branches +fails when it runs after get_stackid_cannot_attach: + +./test_progs -t get_stackid_cannot_attach,perf_branches +84 get_stackid_cannot_attach:OK +test_perf_branches_common:PASS:test_perf_branches_load 0 nsec +test_perf_branches_common:PASS:attach_perf_event 0 nsec +test_perf_branches_common:PASS:set_affinity 0 nsec +check_good_sample:FAIL:output not valid no valid sample from prog +146/1 perf_branches/perf_branches_hw:FAIL +146/2 perf_branches/perf_branches_no_hw:OK +146 perf_branches:FAIL + +All error logs: +test_perf_branches_common:PASS:test_perf_branches_load 0 nsec +test_perf_branches_common:PASS:attach_perf_event 0 nsec +test_perf_branches_common:PASS:set_affinity 0 nsec +check_good_sample:FAIL:output not valid no valid sample from prog +146/1 perf_branches/perf_branches_hw:FAIL +146 perf_branches:FAIL +Summary: 1/1 PASSED, 0 SKIPPED, 1 FAILED + +Fix this by adding the missing bpf_link__destroy(). + +Fixes: 346938e9380c ("selftests/bpf: Add get_stackid_cannot_attach") +Signed-off-by: Song Liu +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20230412210423.900851-3-song@kernel.org +Signed-off-by: Sasha Levin +--- + .../testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c b/tools/testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c +index 5308de1ed478e..2715c68301f52 100644 +--- a/tools/testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c ++++ b/tools/testing/selftests/bpf/prog_tests/get_stackid_cannot_attach.c +@@ -65,6 +65,7 @@ void test_get_stackid_cannot_attach(void) + skel->links.oncpu = bpf_program__attach_perf_event(skel->progs.oncpu, + pmu_fd); + ASSERT_OK_PTR(skel->links.oncpu, "attach_perf_event_callchain"); ++ bpf_link__destroy(skel->links.oncpu); + close(pmu_fd); + + /* add exclude_callchain_kernel, attach should fail */ +-- +2.39.2 + diff --git a/queue-6.2/selftests-bpf-use-read_perf_max_sample_freq-in-perf_.patch b/queue-6.2/selftests-bpf-use-read_perf_max_sample_freq-in-perf_.patch new file mode 100644 index 00000000000..df56f1d1c72 --- /dev/null +++ b/queue-6.2/selftests-bpf-use-read_perf_max_sample_freq-in-perf_.patch @@ -0,0 +1,109 @@ +From 396febcc5225797f3a49857f4f2f04224c9f6c4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 14:04:21 -0700 +Subject: selftests/bpf: Use read_perf_max_sample_freq() in perf_event_stackmap + +From: Song Liu + +[ Upstream commit de6d014a09bf12a9a8959d60c0a1d4a41d394a89 ] + +Currently, perf_event sample period in perf_event_stackmap is set too low +that the test fails randomly. Fix this by using the max sample frequency, +from read_perf_max_sample_freq(). + +Move read_perf_max_sample_freq() to testing_helpers.c. Replace the CHECK() +with if-printf, as CHECK is not available in testing_helpers.c. + +Fixes: 1da4864c2b20 ("selftests/bpf: Add callchain_stackid") +Signed-off-by: Song Liu +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20230412210423.900851-2-song@kernel.org +Signed-off-by: Sasha Levin +--- + .../bpf/prog_tests/perf_event_stackmap.c | 3 ++- + .../bpf/prog_tests/stacktrace_build_id_nmi.c | 15 -------------- + tools/testing/selftests/bpf/testing_helpers.c | 20 +++++++++++++++++++ + tools/testing/selftests/bpf/testing_helpers.h | 2 ++ + 4 files changed, 24 insertions(+), 16 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/perf_event_stackmap.c b/tools/testing/selftests/bpf/prog_tests/perf_event_stackmap.c +index 33144c9432aeb..f4aad35afae16 100644 +--- a/tools/testing/selftests/bpf/prog_tests/perf_event_stackmap.c ++++ b/tools/testing/selftests/bpf/prog_tests/perf_event_stackmap.c +@@ -63,7 +63,8 @@ void test_perf_event_stackmap(void) + PERF_SAMPLE_BRANCH_NO_FLAGS | + PERF_SAMPLE_BRANCH_NO_CYCLES | + PERF_SAMPLE_BRANCH_CALL_STACK, +- .sample_period = 5000, ++ .freq = 1, ++ .sample_freq = read_perf_max_sample_freq(), + .size = sizeof(struct perf_event_attr), + }; + struct perf_event_stackmap *skel; +diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c +index f4ea1a215ce4d..704f7f6c3704a 100644 +--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c ++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c +@@ -2,21 +2,6 @@ + #include + #include "test_stacktrace_build_id.skel.h" + +-static __u64 read_perf_max_sample_freq(void) +-{ +- __u64 sample_freq = 5000; /* fallback to 5000 on error */ +- FILE *f; +- __u32 duration = 0; +- +- f = fopen("/proc/sys/kernel/perf_event_max_sample_rate", "r"); +- if (f == NULL) +- return sample_freq; +- CHECK(fscanf(f, "%llu", &sample_freq) != 1, "Get max sample rate", +- "return default value: 5000,err %d\n", -errno); +- fclose(f); +- return sample_freq; +-} +- + void test_stacktrace_build_id_nmi(void) + { + int control_map_fd, stackid_hmap_fd, stackmap_fd; +diff --git a/tools/testing/selftests/bpf/testing_helpers.c b/tools/testing/selftests/bpf/testing_helpers.c +index 9695318e8132d..9c3de39023f60 100644 +--- a/tools/testing/selftests/bpf/testing_helpers.c ++++ b/tools/testing/selftests/bpf/testing_helpers.c +@@ -229,3 +229,23 @@ int bpf_test_load_program(enum bpf_prog_type type, const struct bpf_insn *insns, + + return bpf_prog_load(type, NULL, license, insns, insns_cnt, &opts); + } ++ ++__u64 read_perf_max_sample_freq(void) ++{ ++ __u64 sample_freq = 5000; /* fallback to 5000 on error */ ++ FILE *f; ++ ++ f = fopen("/proc/sys/kernel/perf_event_max_sample_rate", "r"); ++ if (f == NULL) { ++ printf("Failed to open /proc/sys/kernel/perf_event_max_sample_rate: err %d\n" ++ "return default value: 5000\n", -errno); ++ return sample_freq; ++ } ++ if (fscanf(f, "%llu", &sample_freq) != 1) { ++ printf("Failed to parse /proc/sys/kernel/perf_event_max_sample_rate: err %d\n" ++ "return default value: 5000\n", -errno); ++ } ++ ++ fclose(f); ++ return sample_freq; ++} +diff --git a/tools/testing/selftests/bpf/testing_helpers.h b/tools/testing/selftests/bpf/testing_helpers.h +index 6ec00bf79cb55..eb8790f928e4c 100644 +--- a/tools/testing/selftests/bpf/testing_helpers.h ++++ b/tools/testing/selftests/bpf/testing_helpers.h +@@ -20,3 +20,5 @@ struct test_filter_set; + int parse_test_list(const char *s, + struct test_filter_set *test_set, + bool is_glob_pattern); ++ ++__u64 read_perf_max_sample_freq(void); +-- +2.39.2 + diff --git a/queue-6.2/selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch b/queue-6.2/selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch new file mode 100644 index 00000000000..d464a1bb183 --- /dev/null +++ b/queue-6.2/selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch @@ -0,0 +1,68 @@ +From 8a944f33ec1afd9572255a03c14ff0a42a1f053d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 19:33:54 +0000 +Subject: selftests/bpf: Wait for receive in cg_storage_multi test + +From: YiFei Zhu + +[ Upstream commit 5af607a861d43ffff830fc1890033e579ec44799 ] + +In some cases the loopback latency might be large enough, causing +the assertion on invocations to be run before ingress prog getting +executed. The assertion would fail and the test would flake. + +This can be reliably reproduced by arbitrarily increasing the +loopback latency (thanks to [1]): + tc qdisc add dev lo root handle 1: htb default 12 + tc class add dev lo parent 1:1 classid 1:12 htb rate 20kbps ceil 20kbps + tc qdisc add dev lo parent 1:12 netem delay 100ms + +Fix this by waiting on the receive end, instead of instantly +returning to the assert. The call to read() will wait for the +default SO_RCVTIMEO timeout of 3 seconds provided by +start_server(). + +[1] https://gist.github.com/kstevens715/4598301 + +Reported-by: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/9c5c8b7e-1d89-a3af-5400-14fde81f4429@linux.dev/ +Fixes: 3573f384014f ("selftests/bpf: Test CGROUP_STORAGE behavior on shared egress + ingress") +Acked-by: Stanislav Fomichev +Signed-off-by: YiFei Zhu +Link: https://lore.kernel.org/r/20230405193354.1956209-1-zhuyifei@google.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c +index 621c572221918..63ee892bc7573 100644 +--- a/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c ++++ b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c +@@ -56,8 +56,9 @@ static bool assert_storage_noexist(struct bpf_map *map, const void *key) + + static bool connect_send(const char *cgroup_path) + { +- bool res = true; + int server_fd = -1, client_fd = -1; ++ char message[] = "message"; ++ bool res = true; + + if (join_cgroup(cgroup_path)) + goto out_clean; +@@ -70,7 +71,10 @@ static bool connect_send(const char *cgroup_path) + if (client_fd < 0) + goto out_clean; + +- if (send(client_fd, "message", strlen("message"), 0) < 0) ++ if (send(client_fd, &message, sizeof(message), 0) < 0) ++ goto out_clean; ++ ++ if (read(server_fd, &message, sizeof(message)) < 0) + goto out_clean; + + res = false; +-- +2.39.2 + diff --git a/queue-6.2/selftests-powerpc-pmu-fix-sample-field-check-in-the-.patch b/queue-6.2/selftests-powerpc-pmu-fix-sample-field-check-in-the-.patch new file mode 100644 index 00000000000..720aa24a04c --- /dev/null +++ b/queue-6.2/selftests-powerpc-pmu-fix-sample-field-check-in-the-.patch @@ -0,0 +1,47 @@ +From e5f854cab0eb0acd698a3000d371a2bc74393d1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 22:39:17 +0530 +Subject: selftests/powerpc/pmu: Fix sample field check in the + mmcra_thresh_marked_sample_test + +From: Kajol Jain + +[ Upstream commit 8a32341cf04ba05974931b4664683c2c9fb84e56 ] + +The testcase verifies the setting of different fields in Monitor Mode +Control Register A (MMCRA). In the current code, EV_CODE_EXTRACT macro +is used to extract the "sample" field, which then needs to be further +processed to fetch rand_samp_elig and rand_samp_mode bits. But the +current code is not passing valid sample field to EV_CODE_EXTRACT +macro. Patch addresses this by fixing the input for EV_CODE_EXTRACT. + +Fixes: 29cf373c5766 ("selftests/powerpc/pmu: Add interface test for mmcra register fields") +Reported-by: David Binderman +Link: https://lore.kernel.org/r/DB6P189MB0568CF002762C6C43AF6DF169CA89@DB6P189MB0568.EURP189.PROD.OUTLOOK.COM +Signed-off-by: Kajol Jain +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230301170918.69176-1-kjain@linux.ibm.com +Signed-off-by: Sasha Levin +--- + .../pmu/sampling_tests/mmcra_thresh_marked_sample_test.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/pmu/sampling_tests/mmcra_thresh_marked_sample_test.c b/tools/testing/selftests/powerpc/pmu/sampling_tests/mmcra_thresh_marked_sample_test.c +index 022cc1655eb52..75527876ad3c1 100644 +--- a/tools/testing/selftests/powerpc/pmu/sampling_tests/mmcra_thresh_marked_sample_test.c ++++ b/tools/testing/selftests/powerpc/pmu/sampling_tests/mmcra_thresh_marked_sample_test.c +@@ -63,9 +63,9 @@ static int mmcra_thresh_marked_sample(void) + get_mmcra_thd_stop(get_reg_value(intr_regs, "MMCRA"), 4)); + FAIL_IF(EV_CODE_EXTRACT(event.attr.config, marked) != + get_mmcra_marked(get_reg_value(intr_regs, "MMCRA"), 4)); +- FAIL_IF(EV_CODE_EXTRACT(event.attr.config, sample >> 2) != ++ FAIL_IF((EV_CODE_EXTRACT(event.attr.config, sample) >> 2) != + get_mmcra_rand_samp_elig(get_reg_value(intr_regs, "MMCRA"), 4)); +- FAIL_IF(EV_CODE_EXTRACT(event.attr.config, sample & 0x3) != ++ FAIL_IF((EV_CODE_EXTRACT(event.attr.config, sample) & 0x3) != + get_mmcra_sample_mode(get_reg_value(intr_regs, "MMCRA"), 4)); + FAIL_IF(EV_CODE_EXTRACT(event.attr.config, sm) != + get_mmcra_sm(get_reg_value(intr_regs, "MMCRA"), 4)); +-- +2.39.2 + diff --git a/queue-6.2/selftests-resctrl-allow-setup-to-return-errors.patch b/queue-6.2/selftests-resctrl-allow-setup-to-return-errors.patch new file mode 100644 index 00000000000..c52b9a036ca --- /dev/null +++ b/queue-6.2/selftests-resctrl-allow-setup-to-return-errors.patch @@ -0,0 +1,140 @@ +From a7bf32e3bcfa3e62b7d4955320d7b2895525f46a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 15:05:59 +0200 +Subject: selftests/resctrl: Allow ->setup() to return errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit fa10366cc6f4cc862871f8938426d85c2481f084 ] + +resctrl_val() assumes ->setup() always returns either 0 to continue +tests or < 0 in case of the normal termination of tests after x runs. +The latter overlaps with normal error returns. + +Define END_OF_TESTS (=1) to differentiate the normal termination of +tests and return errors as negative values. Alter callers of ->setup() +to handle errors properly. + +Fixes: 790bf585b0ee ("selftests/resctrl: Add Cache Allocation Technology (CAT) selftest") +Fixes: ecdbb911f22d ("selftests/resctrl: Add MBM test") +Signed-off-by: Ilpo Järvinen +Reviewed-by: Reinette Chatre +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/cache.c | 4 +++- + tools/testing/selftests/resctrl/cat_test.c | 2 +- + tools/testing/selftests/resctrl/cmt_test.c | 2 +- + tools/testing/selftests/resctrl/mba_test.c | 2 +- + tools/testing/selftests/resctrl/mbm_test.c | 2 +- + tools/testing/selftests/resctrl/resctrl.h | 2 ++ + tools/testing/selftests/resctrl/resctrl_val.c | 4 +++- + 7 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/cache.c b/tools/testing/selftests/resctrl/cache.c +index 68ff856d36f0b..0485863a169f2 100644 +--- a/tools/testing/selftests/resctrl/cache.c ++++ b/tools/testing/selftests/resctrl/cache.c +@@ -244,10 +244,12 @@ int cat_val(struct resctrl_val_param *param) + while (1) { + if (!strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR))) { + ret = param->setup(1, param); +- if (ret) { ++ if (ret == END_OF_TESTS) { + ret = 0; + break; + } ++ if (ret < 0) ++ break; + ret = reset_enable_llc_perf(bm_pid, param->cpu_no); + if (ret) + break; +diff --git a/tools/testing/selftests/resctrl/cat_test.c b/tools/testing/selftests/resctrl/cat_test.c +index 1c5e90c632548..2d3c7c77ab6cb 100644 +--- a/tools/testing/selftests/resctrl/cat_test.c ++++ b/tools/testing/selftests/resctrl/cat_test.c +@@ -40,7 +40,7 @@ static int cat_setup(int num, ...) + + /* Run NUM_OF_RUNS times */ + if (p->num_of_runs >= NUM_OF_RUNS) +- return -1; ++ return END_OF_TESTS; + + if (p->num_of_runs == 0) { + sprintf(schemata, "%lx", p->mask); +diff --git a/tools/testing/selftests/resctrl/cmt_test.c b/tools/testing/selftests/resctrl/cmt_test.c +index 8968e36db99d7..3b0454e7fc826 100644 +--- a/tools/testing/selftests/resctrl/cmt_test.c ++++ b/tools/testing/selftests/resctrl/cmt_test.c +@@ -32,7 +32,7 @@ static int cmt_setup(int num, ...) + + /* Run NUM_OF_RUNS times */ + if (p->num_of_runs >= NUM_OF_RUNS) +- return -1; ++ return END_OF_TESTS; + + p->num_of_runs++; + +diff --git a/tools/testing/selftests/resctrl/mba_test.c b/tools/testing/selftests/resctrl/mba_test.c +index 1a1bdb6180cf2..f32289ae17aeb 100644 +--- a/tools/testing/selftests/resctrl/mba_test.c ++++ b/tools/testing/selftests/resctrl/mba_test.c +@@ -41,7 +41,7 @@ static int mba_setup(int num, ...) + return 0; + + if (allocation < ALLOCATION_MIN || allocation > ALLOCATION_MAX) +- return -1; ++ return END_OF_TESTS; + + sprintf(allocation_str, "%d", allocation); + +diff --git a/tools/testing/selftests/resctrl/mbm_test.c b/tools/testing/selftests/resctrl/mbm_test.c +index 8392e5c55ed02..280187628054d 100644 +--- a/tools/testing/selftests/resctrl/mbm_test.c ++++ b/tools/testing/selftests/resctrl/mbm_test.c +@@ -95,7 +95,7 @@ static int mbm_setup(int num, ...) + + /* Run NUM_OF_RUNS times */ + if (num_of_runs++ >= NUM_OF_RUNS) +- return -1; ++ return END_OF_TESTS; + + va_start(param, num); + p = va_arg(param, struct resctrl_val_param *); +diff --git a/tools/testing/selftests/resctrl/resctrl.h b/tools/testing/selftests/resctrl/resctrl.h +index f0ded31fb3c7c..f44fa2de4d986 100644 +--- a/tools/testing/selftests/resctrl/resctrl.h ++++ b/tools/testing/selftests/resctrl/resctrl.h +@@ -37,6 +37,8 @@ + #define ARCH_INTEL 1 + #define ARCH_AMD 2 + ++#define END_OF_TESTS 1 ++ + #define PARENT_EXIT(err_msg) \ + do { \ + perror(err_msg); \ +diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c +index 787546a528493..00864242d76c6 100644 +--- a/tools/testing/selftests/resctrl/resctrl_val.c ++++ b/tools/testing/selftests/resctrl/resctrl_val.c +@@ -735,10 +735,12 @@ int resctrl_val(char **benchmark_cmd, struct resctrl_val_param *param) + /* Test runs until the callback setup() tells the test to stop. */ + while (1) { + ret = param->setup(1, param); +- if (ret) { ++ if (ret == END_OF_TESTS) { + ret = 0; + break; + } ++ if (ret < 0) ++ break; + + if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR)) || + !strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) { +-- +2.39.2 + diff --git a/queue-6.2/selftests-resctrl-check-for-return-value-after-write.patch b/queue-6.2/selftests-resctrl-check-for-return-value-after-write.patch new file mode 100644 index 00000000000..be0247960c8 --- /dev/null +++ b/queue-6.2/selftests-resctrl-check-for-return-value-after-write.patch @@ -0,0 +1,56 @@ +From f03f3fb4f5a01173f0125912df4646216df96c11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 15:06:00 +0200 +Subject: selftests/resctrl: Check for return value after write_schemata() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 0d45c83b95da414e98ad333e723141a94f6e2c64 ] + +MBA test case writes schemata but it does not check if the write is +successful or not. + +Add the error check and return error properly. + +Fixes: 01fee6b4d1f9 ("selftests/resctrl: Add MBA test") +Co-developed-by: Fenghua Yu +Signed-off-by: Fenghua Yu +Signed-off-by: Ilpo Järvinen +Reviewed-by: Reinette Chatre +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/mba_test.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/resctrl/mba_test.c b/tools/testing/selftests/resctrl/mba_test.c +index f32289ae17aeb..97dc98c0c9497 100644 +--- a/tools/testing/selftests/resctrl/mba_test.c ++++ b/tools/testing/selftests/resctrl/mba_test.c +@@ -28,6 +28,7 @@ static int mba_setup(int num, ...) + struct resctrl_val_param *p; + char allocation_str[64]; + va_list param; ++ int ret; + + va_start(param, num); + p = va_arg(param, struct resctrl_val_param *); +@@ -45,7 +46,11 @@ static int mba_setup(int num, ...) + + sprintf(allocation_str, "%d", allocation); + +- write_schemata(p->ctrlgrp, allocation_str, p->cpu_no, p->resctrl_val); ++ ret = write_schemata(p->ctrlgrp, allocation_str, p->cpu_no, ++ p->resctrl_val); ++ if (ret < 0) ++ return ret; ++ + allocation -= ALLOCATION_STEP; + + return 0; +-- +2.39.2 + diff --git a/queue-6.2/selftests-resctrl-move-setup-call-outside-of-test-sp.patch b/queue-6.2/selftests-resctrl-move-setup-call-outside-of-test-sp.patch new file mode 100644 index 00000000000..001ce1a6ee2 --- /dev/null +++ b/queue-6.2/selftests-resctrl-move-setup-call-outside-of-test-sp.patch @@ -0,0 +1,75 @@ +From b9381828058df8ce17ebc7fd9e574448e9995e80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 15:05:58 +0200 +Subject: selftests/resctrl: Move ->setup() call outside of test specific + branches +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit c90b3b588e369c20087699316259fa5ebbb16f2d ] + +resctrl_val() function is called only by MBM, MBA, and CMT tests which +means the else branch is never used. + +Both test branches call param->setup(). + +Remove the unused else branch and place the ->setup() call outside of +the test specific branches reducing code duplication. + +Co-developed-by: Fenghua Yu +Signed-off-by: Fenghua Yu +Signed-off-by: Ilpo Järvinen +Reviewed-by: Reinette Chatre +Signed-off-by: Shuah Khan +Stable-dep-of: fa10366cc6f4 ("selftests/resctrl: Allow ->setup() to return errors") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/resctrl_val.c | 19 ++++++------------- + 1 file changed, 6 insertions(+), 13 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c +index b32b96356ec70..787546a528493 100644 +--- a/tools/testing/selftests/resctrl/resctrl_val.c ++++ b/tools/testing/selftests/resctrl/resctrl_val.c +@@ -734,29 +734,22 @@ int resctrl_val(char **benchmark_cmd, struct resctrl_val_param *param) + + /* Test runs until the callback setup() tells the test to stop. */ + while (1) { ++ ret = param->setup(1, param); ++ if (ret) { ++ ret = 0; ++ break; ++ } ++ + if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR)) || + !strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) { +- ret = param->setup(1, param); +- if (ret) { +- ret = 0; +- break; +- } +- + ret = measure_vals(param, &bw_resc_start); + if (ret) + break; + } else if (!strncmp(resctrl_val, CMT_STR, sizeof(CMT_STR))) { +- ret = param->setup(1, param); +- if (ret) { +- ret = 0; +- break; +- } + sleep(1); + ret = measure_cache_vals(param, bm_pid); + if (ret) + break; +- } else { +- break; + } + } + +-- +2.39.2 + diff --git a/queue-6.2/selftests-resctrl-return-null-if-malloc_and_init_mem.patch b/queue-6.2/selftests-resctrl-return-null-if-malloc_and_init_mem.patch new file mode 100644 index 00000000000..3231d60c5ac --- /dev/null +++ b/queue-6.2/selftests-resctrl-return-null-if-malloc_and_init_mem.patch @@ -0,0 +1,46 @@ +From d4ae766c60fc589495e8f18be3bbb48b8f23bf41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 15:05:57 +0200 +Subject: selftests/resctrl: Return NULL if malloc_and_init_memory() did not + alloc mem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 22a8be280383812235131dda18a8212a59fadd2d ] + +malloc_and_init_memory() in fill_buf isn't checking if memalign() +successfully allocated memory or not before accessing the memory. + +Check the return value of memalign() and return NULL if allocating +aligned memory fails. + +Fixes: a2561b12fe39 ("selftests/resctrl: Add built in benchmark") +Co-developed-by: Fenghua Yu +Signed-off-by: Fenghua Yu +Signed-off-by: Ilpo Järvinen +Reviewed-by: Reinette Chatre +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/fill_buf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/resctrl/fill_buf.c b/tools/testing/selftests/resctrl/fill_buf.c +index 56ccbeae0638d..c20d0a7ecbe63 100644 +--- a/tools/testing/selftests/resctrl/fill_buf.c ++++ b/tools/testing/selftests/resctrl/fill_buf.c +@@ -68,6 +68,8 @@ static void *malloc_and_init_memory(size_t s) + size_t s64; + + void *p = memalign(PAGE_SIZE, s); ++ if (!p) ++ return NULL; + + p64 = (uint64_t *)p; + s64 = s / sizeof(uint64_t); +-- +2.39.2 + diff --git a/queue-6.2/selftests-xsk-deflakify-stats_rx_dropped-test.patch b/queue-6.2/selftests-xsk-deflakify-stats_rx_dropped-test.patch new file mode 100644 index 00000000000..bd0a8a01f89 --- /dev/null +++ b/queue-6.2/selftests-xsk-deflakify-stats_rx_dropped-test.patch @@ -0,0 +1,66 @@ +From 0d458f6aee9f3db567e9b7242fcfb591fb945409 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 14:03:59 +0200 +Subject: selftests: xsk: Deflakify STATS_RX_DROPPED test + +From: Kal Conley + +[ Upstream commit 68e7322142f5e731af222892d384d311835db0f1 ] + +Fix flaky STATS_RX_DROPPED test. The receiver calls getsockopt after +receiving the last (valid) packet which is not the final packet sent in +the test (valid and invalid packets are sent in alternating fashion with +the final packet being invalid). Since the last packet may or may not +have been dropped already, both outcomes must be allowed. + +This issue could also be fixed by making sure the last packet sent is +valid. This alternative is left as an exercise to the reader (or the +benevolent maintainers of this file). + +This problem was quite visible on certain setups. On one machine this +failure was observed 50% of the time. + +Also, remove a redundant assignment of pkt_stream->nb_pkts. This field +is already initialized by __pkt_stream_alloc. + +Fixes: 27e934bec35b ("selftests: xsk: make stat tests not spin on getsockopt") +Signed-off-by: Kal Conley +Acked-by: Magnus Karlsson +Link: https://lore.kernel.org/r/20230403120400.31018-1-kal.conley@dectris.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/xskxceiver.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c +index 2290982758961..b74dddf6bbbe5 100644 +--- a/tools/testing/selftests/bpf/xskxceiver.c ++++ b/tools/testing/selftests/bpf/xskxceiver.c +@@ -649,7 +649,6 @@ static struct pkt_stream *pkt_stream_generate(struct xsk_umem_info *umem, u32 nb + if (!pkt_stream) + exit_with_error(ENOMEM); + +- pkt_stream->nb_pkts = nb_pkts; + for (i = 0; i < nb_pkts; i++) { + pkt_set(umem, &pkt_stream->pkts[i], (i % umem->num_frames) * umem->frame_size, + pkt_len); +@@ -1142,7 +1141,14 @@ static int validate_rx_dropped(struct ifobject *ifobject) + if (err) + return TEST_FAILURE; + +- if (stats.rx_dropped == ifobject->pkt_stream->nb_pkts / 2) ++ /* The receiver calls getsockopt after receiving the last (valid) ++ * packet which is not the final packet sent in this test (valid and ++ * invalid packets are sent in alternating fashion with the final ++ * packet being invalid). Since the last packet may or may not have ++ * been dropped already, both outcomes must be allowed. ++ */ ++ if (stats.rx_dropped == ifobject->pkt_stream->nb_pkts / 2 || ++ stats.rx_dropped == ifobject->pkt_stream->nb_pkts / 2 - 1) + return TEST_PASS; + + return TEST_FAILURE; +-- +2.39.2 + diff --git a/queue-6.2/selftests-xsk-disable-ipv6-on-veth1.patch b/queue-6.2/selftests-xsk-disable-ipv6-on-veth1.patch new file mode 100644 index 00000000000..3628519815d --- /dev/null +++ b/queue-6.2/selftests-xsk-disable-ipv6-on-veth1.patch @@ -0,0 +1,45 @@ +From 614317153482debdb336769542a01ce64726b9f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 10:29:04 +0200 +Subject: selftests: xsk: Disable IPv6 on VETH1 + +From: Kal Conley + +[ Upstream commit f2b50f17268390567bc0e95642170d88f336c8f4 ] + +This change fixes flakiness in the BIDIRECTIONAL test: + + # [is_pkt_valid] expected length [60], got length [90] + not ok 1 FAIL: SKB BUSY-POLL BIDIRECTIONAL + +When IPv6 is enabled, the interface will periodically send MLDv1 and +MLDv2 packets. These packets can cause the BIDIRECTIONAL test to fail +since it uses VETH0 for RX. + +For other tests, this was not a problem since they only receive on VETH1 +and IPv6 was already disabled on VETH0. + +Fixes: a89052572ebb ("selftests/bpf: Xsk selftests framework") +Signed-off-by: Kal Conley +Link: https://lore.kernel.org/r/20230405082905.6303-1-kal.conley@dectris.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_xsk.sh | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh +index d821fd0985049..4e3ec38cbe68c 100755 +--- a/tools/testing/selftests/bpf/test_xsk.sh ++++ b/tools/testing/selftests/bpf/test_xsk.sh +@@ -118,6 +118,7 @@ setup_vethPairs() { + ip link add ${VETH0} numtxqueues 4 numrxqueues 4 type veth peer name ${VETH1} numtxqueues 4 numrxqueues 4 + if [ -f /proc/net/if_inet6 ]; then + echo 1 > /proc/sys/net/ipv6/conf/${VETH0}/disable_ipv6 ++ echo 1 > /proc/sys/net/ipv6/conf/${VETH1}/disable_ipv6 + fi + if [[ $verbose -eq 1 ]]; then + echo "setting up ${VETH1}: namespace: ${NS1}" +-- +2.39.2 + diff --git a/queue-6.2/selftests-xsk-use-correct-umem-size-in-testapp_inval.patch b/queue-6.2/selftests-xsk-use-correct-umem-size-in-testapp_inval.patch new file mode 100644 index 00000000000..e44cfdff76d --- /dev/null +++ b/queue-6.2/selftests-xsk-use-correct-umem-size-in-testapp_inval.patch @@ -0,0 +1,74 @@ +From 5e675db4deba6c72da99e1fdf31e2d0e67bd26b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 16:50:46 +0200 +Subject: selftests: xsk: Use correct UMEM size in testapp_invalid_desc + +From: Kal Conley + +[ Upstream commit 7a2050df244e2c9a4e90882052b7907450ad10ed ] + +Avoid UMEM_SIZE macro in testapp_invalid_desc which is incorrect when +the frame size is not XSK_UMEM__DEFAULT_FRAME_SIZE. Also remove the +macro since it's no longer being used. + +Fixes: 909f0e28207c ("selftests: xsk: Add tests for 2K frame size") +Signed-off-by: Kal Conley +Acked-by: Magnus Karlsson +Link: https://lore.kernel.org/r/20230403145047.33065-2-kal.conley@dectris.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/xskxceiver.c | 9 +++++---- + tools/testing/selftests/bpf/xskxceiver.h | 1 - + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c +index 1b9f48daa2257..2290982758961 100644 +--- a/tools/testing/selftests/bpf/xskxceiver.c ++++ b/tools/testing/selftests/bpf/xskxceiver.c +@@ -1662,6 +1662,7 @@ static void testapp_single_pkt(struct test_spec *test) + + static void testapp_invalid_desc(struct test_spec *test) + { ++ u64 umem_size = test->ifobj_tx->umem->num_frames * test->ifobj_tx->umem->frame_size; + struct pkt pkts[] = { + /* Zero packet address allowed */ + {0, PKT_SIZE, 0, true}, +@@ -1672,9 +1673,9 @@ static void testapp_invalid_desc(struct test_spec *test) + /* Packet too large */ + {0x2000, XSK_UMEM__INVALID_FRAME_SIZE, 0, false}, + /* After umem ends */ +- {UMEM_SIZE, PKT_SIZE, 0, false}, ++ {umem_size, PKT_SIZE, 0, false}, + /* Straddle the end of umem */ +- {UMEM_SIZE - PKT_SIZE / 2, PKT_SIZE, 0, false}, ++ {umem_size - PKT_SIZE / 2, PKT_SIZE, 0, false}, + /* Straddle a page boundrary */ + {0x3000 - PKT_SIZE / 2, PKT_SIZE, 0, false}, + /* Straddle a 2K boundrary */ +@@ -1692,8 +1693,8 @@ static void testapp_invalid_desc(struct test_spec *test) + } + + if (test->ifobj_tx->shared_umem) { +- pkts[4].addr += UMEM_SIZE; +- pkts[5].addr += UMEM_SIZE; ++ pkts[4].addr += umem_size; ++ pkts[5].addr += umem_size; + } + + pkt_stream_generate_custom(test, pkts, ARRAY_SIZE(pkts)); +diff --git a/tools/testing/selftests/bpf/xskxceiver.h b/tools/testing/selftests/bpf/xskxceiver.h +index edb76d2def9fe..292fc943b8fdf 100644 +--- a/tools/testing/selftests/bpf/xskxceiver.h ++++ b/tools/testing/selftests/bpf/xskxceiver.h +@@ -52,7 +52,6 @@ + #define THREAD_TMOUT 3 + #define DEFAULT_PKT_CNT (4 * 1024) + #define DEFAULT_UMEM_BUFFERS (DEFAULT_PKT_CNT / 4) +-#define UMEM_SIZE (DEFAULT_UMEM_BUFFERS * XSK_UMEM__DEFAULT_FRAME_SIZE) + #define RX_FULL_RXQSIZE 32 + #define UMEM_HEADROOM_TEST_SIZE 128 + #define XSK_UMEM__INVALID_FRAME_SIZE (XSK_UMEM__DEFAULT_FRAME_SIZE + 1) +-- +2.39.2 + diff --git a/queue-6.2/selinux-ensure-av_permissions.h-is-built-when-needed.patch b/queue-6.2/selinux-ensure-av_permissions.h-is-built-when-needed.patch new file mode 100644 index 00000000000..e415bb224c3 --- /dev/null +++ b/queue-6.2/selinux-ensure-av_permissions.h-is-built-when-needed.patch @@ -0,0 +1,36 @@ +From 47d5526708d872115bb98d291dfb717da6f6f914 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 13:29:11 -0400 +Subject: selinux: ensure av_permissions.h is built when needed + +From: Paul Moore + +[ Upstream commit 4ce1f694eb5d8ca607fed8542d32a33b4f1217a5 ] + +The Makefile rule responsible for building flask.h and +av_permissions.h only lists flask.h as a target which means that +av_permissions.h is only generated when flask.h needs to be +generated. This patch fixes this by adding av_permissions.h as a +target to the rule. + +Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build") +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/selinux/Makefile b/security/selinux/Makefile +index 103c2776478a7..0aecf9334ec31 100644 +--- a/security/selinux/Makefile ++++ b/security/selinux/Makefile +@@ -26,5 +26,5 @@ quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h + cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h + + targets += flask.h av_permissions.h +-$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE ++$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE + $(call if_changed,flask) +-- +2.39.2 + diff --git a/queue-6.2/selinux-fix-makefile-dependencies-of-flask.h.patch b/queue-6.2/selinux-fix-makefile-dependencies-of-flask.h.patch new file mode 100644 index 00000000000..5785b9ca1c3 --- /dev/null +++ b/queue-6.2/selinux-fix-makefile-dependencies-of-flask.h.patch @@ -0,0 +1,43 @@ +From dab6a9e95f1d0690239123aa3e47374a205fbd07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 15:59:19 +0200 +Subject: selinux: fix Makefile dependencies of flask.h + +From: Ondrej Mosnacek + +[ Upstream commit bcab1adeaad4b39a1e04cb98979a367d08253f03 ] + +Make the flask.h target depend on the genheaders binary instead of +classmap.h to ensure that it is rebuilt if any of the dependencies of +genheaders are changed. + +Notably this fixes flask.h not being rebuilt when +initial_sid_to_string.h is modified. + +Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build") +Signed-off-by: Ondrej Mosnacek +Acked-by: Stephen Smalley +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/security/selinux/Makefile b/security/selinux/Makefile +index 7761624448826..103c2776478a7 100644 +--- a/security/selinux/Makefile ++++ b/security/selinux/Makefile +@@ -23,8 +23,8 @@ ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include + $(addprefix $(obj)/,$(selinux-y)): $(obj)/flask.h + + quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h +- cmd_flask = scripts/selinux/genheaders/genheaders $(obj)/flask.h $(obj)/av_permissions.h ++ cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h + + targets += flask.h av_permissions.h +-$(obj)/flask.h: $(src)/include/classmap.h FORCE ++$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE + $(call if_changed,flask) +-- +2.39.2 + diff --git a/queue-6.2/serial-8250-add-missing-wakeup-event-reporting.patch b/queue-6.2/serial-8250-add-missing-wakeup-event-reporting.patch new file mode 100644 index 00000000000..c687e9f5835 --- /dev/null +++ b/queue-6.2/serial-8250-add-missing-wakeup-event-reporting.patch @@ -0,0 +1,53 @@ +From 7c7ac6bcae4917f41e2cf088ed4744fe15c88ee5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 10:02:39 -0700 +Subject: serial: 8250: Add missing wakeup event reporting + +From: Florian Fainelli + +[ Upstream commit 0ba9e3a13c6adfa99e32b2576d20820ab10ad48a ] + +An 8250 UART configured as a wake-up source would not have reported +itself through sysfs as being the source of wake-up, correct that. + +Fixes: b3b708fa2780 ("wake up from a serial port") +Signed-off-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230414170241.2016255-1-f.fainelli@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_port.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index b186d6ff12b4a..fa220620511e5 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1925,6 +1926,7 @@ static bool handle_rx_dma(struct uart_8250_port *up, unsigned int iir) + int serial8250_handle_irq(struct uart_port *port, unsigned int iir) + { + struct uart_8250_port *up = up_to_u8250p(port); ++ struct tty_port *tport = &port->state->port; + bool skip_rx = false; + unsigned long flags; + u16 status; +@@ -1950,6 +1952,8 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) + skip_rx = true; + + if (status & (UART_LSR_DR | UART_LSR_BI) && !skip_rx) { ++ if (irqd_is_wakeup_set(irq_get_irq_data(port->irq))) ++ pm_wakeup_event(tport->tty->dev, 0); + if (!up->dma || handle_rx_dma(up, iir)) + status = serial8250_rx_chars(up, status); + } +-- +2.39.2 + diff --git a/queue-6.2/serial-8250_bcm7271-fix-arbitration-handling.patch b/queue-6.2/serial-8250_bcm7271-fix-arbitration-handling.patch new file mode 100644 index 00000000000..3b8a871835b --- /dev/null +++ b/queue-6.2/serial-8250_bcm7271-fix-arbitration-handling.patch @@ -0,0 +1,93 @@ +From 975898381a400cb641add649ad016b2c9533bc44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 11:02:24 -0800 +Subject: serial: 8250_bcm7271: Fix arbitration handling + +From: Doug Berger + +[ Upstream commit 15ac1122fd6d4bf408a03e6f23c7ad4f60b22f9e ] + +The arbitration of the UART DMA is mishandled for a few +exceptional cases when probing and releasing the driver. + +It is possible that the DMA register spaces are not defined in +device tree for an instance of the driver, so attempts to access +the registers in brcmuart_arbitration() would use NULL pointers. + +It is also possible for the probe function to return an error +while still holding the UART DMA. This would prevent the UART +DMA from being claimed by an instance that could use it. + +These errors are addressed by only releasing the UART DMA if it +is held by this instance (i.e. priv->dma_enabled == 1) and +directing early error paths in probe to this common release_dma +handling. + +Fixes: 41a469482de2 ("serial: 8250: Add new 8250-core based Broadcom STB driver") +Signed-off-by: Doug Berger +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230309190224.687380-1-opendmb@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_bcm7271.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_bcm7271.c b/drivers/tty/serial/8250/8250_bcm7271.c +index ed5a947476920..f801b1f5b46c0 100644 +--- a/drivers/tty/serial/8250/8250_bcm7271.c ++++ b/drivers/tty/serial/8250/8250_bcm7271.c +@@ -1014,14 +1014,16 @@ static int brcmuart_probe(struct platform_device *pdev) + /* See if a Baud clock has been specified */ + baud_mux_clk = of_clk_get_by_name(np, "sw_baud"); + if (IS_ERR(baud_mux_clk)) { +- if (PTR_ERR(baud_mux_clk) == -EPROBE_DEFER) +- return -EPROBE_DEFER; ++ if (PTR_ERR(baud_mux_clk) == -EPROBE_DEFER) { ++ ret = -EPROBE_DEFER; ++ goto release_dma; ++ } + dev_dbg(dev, "BAUD MUX clock not specified\n"); + } else { + dev_dbg(dev, "BAUD MUX clock found\n"); + ret = clk_prepare_enable(baud_mux_clk); + if (ret) +- return ret; ++ goto release_dma; + priv->baud_mux_clk = baud_mux_clk; + init_real_clk_rates(dev, priv); + clk_rate = priv->default_mux_rate; +@@ -1029,7 +1031,8 @@ static int brcmuart_probe(struct platform_device *pdev) + + if (clk_rate == 0) { + dev_err(dev, "clock-frequency or clk not defined\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto release_dma; + } + + dev_dbg(dev, "DMA is %senabled\n", priv->dma_enabled ? "" : "not "); +@@ -1116,7 +1119,9 @@ static int brcmuart_probe(struct platform_device *pdev) + serial8250_unregister_port(priv->line); + err: + brcmuart_free_bufs(dev, priv); +- brcmuart_arbitration(priv, 0); ++release_dma: ++ if (priv->dma_enabled) ++ brcmuart_arbitration(priv, 0); + return ret; + } + +@@ -1128,7 +1133,8 @@ static int brcmuart_remove(struct platform_device *pdev) + hrtimer_cancel(&priv->hrt); + serial8250_unregister_port(priv->line); + brcmuart_free_bufs(&pdev->dev, priv); +- brcmuart_arbitration(priv, 0); ++ if (priv->dma_enabled) ++ brcmuart_arbitration(priv, 0); + return 0; + } + +-- +2.39.2 + diff --git a/queue-6.2/serial-stm32-re-assert-rts-de-gpio-in-rs485-mode-onl.patch b/queue-6.2/serial-stm32-re-assert-rts-de-gpio-in-rs485-mode-onl.patch new file mode 100644 index 00000000000..4edab2939b5 --- /dev/null +++ b/queue-6.2/serial-stm32-re-assert-rts-de-gpio-in-rs485-mode-onl.patch @@ -0,0 +1,51 @@ +From e6c730a71d17ddd280aed265f71e9b98a91a7a53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Feb 2023 05:22:52 +0100 +Subject: serial: stm32: Re-assert RTS/DE GPIO in RS485 mode only if more data + are transmitted + +From: Marek Vasut + +[ Upstream commit c47527cbcc3c50800f34b8c684f29721f75de246 ] + +The stm32_usart_transmit_chars() may be called with empty or stopped +transmit queue, and no XON/OFF character pending. This can happen at +the end of transmission, where this last call is used to either handle +the XON/XOFF x_char, or disable TX interrupt if queue is empty or +stopped. + +If that occurs, do not assert the RS485 RTS/DE GPIO anymore, as the +GPIO would remain asserted past the end of transmission and that would +block the RS485 bus after the transmission. + +Only assert the RS485 RTS/DE GPIO if there is either pending XON/XOFF +x_char, or at least one character in running transmit queue. + +Fixes: d7c76716169d ("serial: stm32: Use TC interrupt to deassert GPIO RTS in RS485 mode") +Signed-off-by: Marek Vasut +Link: https://lore.kernel.org/r/20230223042252.95480-2-marex@denx.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 409e91d6829a5..81a53cc41dcb8 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -689,8 +689,9 @@ static void stm32_usart_transmit_chars(struct uart_port *port) + int ret; + + if (!stm32_port->hw_flow_control && +- port->rs485.flags & SER_RS485_ENABLED) { +- stm32_port->txdone = false; ++ port->rs485.flags & SER_RS485_ENABLED && ++ (port->x_char || ++ !(uart_circ_empty(xmit) || uart_tx_stopped(port)))) { + stm32_usart_tc_interrupt_disable(port); + stm32_usart_rs485_rts_enable(port); + } +-- +2.39.2 + diff --git a/queue-6.2/series b/queue-6.2/series index bc0be48bf6b..4462bf44331 100644 --- a/queue-6.2/series +++ b/queue-6.2/series @@ -114,3 +114,509 @@ bus-mhi-host-remove-duplicate-ee-check-for-syserr.patch bus-mhi-host-use-mhi_tryset_pm_state-for-setting-fw-error-state.patch bus-mhi-host-range-check-chdboff-and-erdboff.patch asoc-dt-bindings-qcom-lpass-rx-macro-correct-minitems-for-clocks.patch +kunit-fix-bug-in-the-order-of-lines-in-debugfs-logs.patch +rcu-fix-missing-tick_dep_mask_rcu_exp-dependency-che.patch +selftests-resctrl-return-null-if-malloc_and_init_mem.patch +selftests-resctrl-move-setup-call-outside-of-test-sp.patch +selftests-resctrl-allow-setup-to-return-errors.patch +selftests-resctrl-check-for-return-value-after-write.patch +selinux-fix-makefile-dependencies-of-flask.h.patch +selinux-ensure-av_permissions.h-is-built-when-needed.patch +tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch +tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch +tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch +tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch +tpm-tpm-implement-usage-counter-for-locality.patch +tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch +erofs-stop-parsing-non-compact-head-index-if-cluster.patch +erofs-initialize-packed-inode-after-root-inode-is-as.patch +erofs-fix-potential-overflow-calculating-xattr_isize.patch +drm-rockchip-drop-unbalanced-obj-unref.patch +drm-i915-hwmon-enable-pl1-power-limit.patch +drm-i915-dg2-drop-one-pci-id.patch +drm-vgem-add-missing-mutex_destroy.patch +drm-probe-helper-cancel-previous-job-before-starting.patch +drm-amdgpu-register-a-vga_switcheroo-client-for-macb.patch +tools-x86-kcpuid-fix-avx512bw-and-avx512lvl-fields-i.patch +soc-ti-k3-ringacc-add-try_module_get-to-k3_dmaring_r.patch +soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch +arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch +arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch +arm64-dts-renesas-r9a07g044-update-irq-numbers-for-s.patch +arm64-dts-renesas-r9a07g054-update-irq-numbers-for-s.patch +arm64-dts-renesas-r9a07g043-update-irq-numbers-for-s.patch +drm-mediatek-dp-only-trigger-drm-hpd-events-if-bridg.patch +drm-msm-disp-dpu-check-for-crtc-enable-rather-than-c.patch +edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch +arm-dts-qcom-apq8064-fix-opp-table-child-name.patch +regulator-core-shorten-off-on-delay-us-for-always-on.patch +arm64-dts-ti-k3-am62-main-fix-gpio-numbers-in-dt.patch +arm64-dts-ti-k3-am62a7-sk-fix-ddr-size-to-full-4gb.patch +arm64-dts-ti-k3-j721e-main-remove-ti-strobe-sel-prop.patch +arm64-dts-broadcom-bcmbca-bcm4908-fix-nand-interrupt.patch +arm64-dts-broadcom-bcmbca-bcm4908-fix-led-nodenames.patch +arm64-dts-broadcom-bcmbca-bcm4908-fix-procmon-nodena.patch +arm64-dts-qcom-msm8998-fix-stm-stimulus-base-reg-nam.patch +arm64-dts-qcom-sc7280-fix-eud-port-properties.patch +arm64-dts-qcom-sdm845-correct-dynamic-power-coeffici.patch +arm64-dts-qcom-sdm845-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-msm8998-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-sc7280-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-ipq8074-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-ipq6018-use-lowercase-hex.patch +arm64-dts-qcom-ipq6018-pad-addresses-to-8-hex-digits.patch +arm64-dts-qcom-ipq6018-fix-up-indentation.patch +arm64-dts-qcom-ipq6018-sort-nodes-properly.patch +arm64-dts-qcom-ipq6018-add-remove-some-newlines.patch +arm64-dts-qcom-ipq6018-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-msm8996-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-sm8250-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-sc8280xp-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-sm8150-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-sm8450-fix-the-pci-i-o-port-range.patch +arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch +arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch +arm64-dts-qcom-msm8976-add-and-provide-xo-clk-to-rpm.patch +arm-dts-qcom-sdx55-fix-the-unit-address-of-pcie-ep-n.patch +x86-mce-amd-use-an-u64-for-bank_map.patch +media-bdisp-add-missing-check-for-create_workqueue.patch +media-platform-mtk-mdp3-add-missing-check-and-free-f.patch +media-amphion-decoder-implement-display-delay-enable.patch +media-av7110-prevent-underflow-in-write_ts_to_decode.patch +firmware-qcom_scm-clear-download-bit-during-reboot.patch +drm-bridge-adv7533-fix-adv7533_mode_valid-for-adv753.patch +media-max9286-free-control-handler.patch +accel-link-to-compute-accelerator-subsystem-intro.patch +arm64-dts-ti-k3-am625-correct-l2-cache-size-to-512kb.patch +arm64-dts-ti-k3-am62a7-correct-l2-cache-size-to-512k.patch +drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch +drm-msm-adreno-disable-preemption-on-adreno-510.patch +virt-coco-sev-guest-double-buffer-messages.patch +arm64-dts-qcom-sm8350-microsoft-surface-fix-usb-dual.patch +drm-amd-display-dc-dce60-makefile-fix-previous-attem.patch +acpi-processor-fix-evaluating-_pdc-method-when-runni.patch +mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch +arm64-dts-qcom-sm8450-fix-pcie1-gpios-properties-nam.patch +drm-rcar-du-fix-a-null-vs-is_err-bug.patch +arm-dts-gta04-fix-excess-dma-channel-usage.patch +firmware-arm_scmi-fix-xfers-allocation-on-rx-channel.patch +perf-arm-cmn-move-overlapping-wp_combine-field.patch +perf-amlogic-fix-config1-config2-parsing-issue.patch +arm-dts-stm32-fix-spi1-pin-assignment-on-stm32mp15.patch +arm64-dts-apple-t8103-disable-unused-pcie-ports.patch +cpufreq-mediatek-fix-passing-zero-to-ptr_err.patch +cpufreq-mediatek-fix-kp-caused-by-handler-usage-afte.patch +cpufreq-mediatek-raise-proc-sram-max-voltage-for-mt8.patch +cpufreq-mediatek-raise-proc-and-sram-max-voltage-for.patch +cpufreq-qcom-cpufreq-hw-revert-adding-cpufreq-qos.patch +arm64-dts-mediatek-mt8192-asurada-fix-voltage-constr.patch +acpi-viot-initialize-the-correct-iommu-fwspec.patch +drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch +drm-mediatek-dp-change-the-aux-retries-times-when-re.patch +mailbox-mpfs-switch-to-txdone_poll.patch +soc-bcm-brcmstb-biuctrl-fix-of_iomap-leak.patch +soc-renesas-renesas-soc-release-chipid-from-ioremap.patch +gpu-host1x-fix-potential-double-free-if-iommu-is-dis.patch +gpu-host1x-fix-memory-leak-of-device-names.patch +arm64-dts-qcom-sc7280-herobrine-villager-correct-tra.patch +arm64-dts-qcom-sc7180-trogdor-lazor-correct-trackpad.patch +arm64-dts-qcom-sc7180-trogdor-pazquel-correct-trackp.patch +arm64-dts-qcom-msm8998-oneplus-cheeseburger-revert-f.patch +arm64-dts-qcom-msm8994-kitakami-drop-unit-address-fr.patch +arm64-dts-qcom-msm8994-msft-lumia-octagon-drop-unit-.patch +arm64-dts-qcom-apq8096-db820c-drop-unit-address-from.patch +drm-ttm-pool-fix-ttm_pool_alloc-error-path.patch +regulator-core-consistently-set-mutex_owner-when-usi.patch +regulator-core-avoid-lockdep-reports-when-resolving-.patch +x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch +soc-qcom-rpmh-rsc-support-rsc-v3-minor-versions.patch +arm64-dts-qcom-msm8994-angler-fix-cont_splash_mem-ma.patch +arm64-dts-qcom-msm8994-angler-removed-clash-with-sme.patch +arm64-dts-sc7180-rename-qspi-data12-as-data23.patch +arm64-dts-sc7280-rename-qspi-data12-as-data23.patch +arm64-dts-qcom-sdm845-align-tlmm-pin-configuration-w.patch +arm64-dts-sdm845-rename-qspi-data12-as-data23.patch +media-mtk-jpeg-fixes-jpeghw-multi-core-judgement.patch +media-mtk-jpeg-fixes-jpeg-enc-dec-worker-sw-flow.patch +media-mediatek-vcodec-use-4k-frame-size-when-support.patch +media-mediatek-vcodec-make-mm21-the-default-capture-.patch +media-mediatek-vcodec-force-capture-queue-format-to-.patch +media-mediatek-vcodec-add-params-to-record-lat-and-c.patch +media-mediatek-vcodec-using-each-instance-lat_buf-co.patch +media-mediatek-vcodec-move-lat_buf-to-the-top-of-cor.patch +media-mediatek-vcodec-add-core-decode-done-event.patch +media-mediatek-vcodec-remove-unused-lat_buf.patch +media-mediatek-vcodec-making-sure-queue_work-success.patch +media-mediatek-vcodec-change-lat-thread-decode-error.patch +media-cedrus-fix-use-after-free-bug-in-cedrus_remove.patch +media-rkvdec-fix-use-after-free-bug-in-rkvdec_remove.patch +platform-x86-amd-pmf-move-out-of-bios-smn-pair-for-d.patch +platform-x86-amd-pmc-don-t-try-to-read-smu-version-o.patch +platform-x86-amd-pmc-hide-smu-version-and-program-at.patch +platform-x86-amd-pmc-don-t-dump-data-after-resume-fr.patch +platform-x86-amd-pmc-move-idlemask-check-into-amd_pm.patch +platform-x86-amd-pmc-utilize-smn-index-0-for-driver-.patch +platform-x86-amd-pmc-move-out-of-bios-smn-pair-for-s.patch +media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch +media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch +media-platform-mtk-mdp3-fix-potential-frame-size-ove.patch +media-vsp1-replace-vb2_is_streaming-with-vb2_start_s.patch +platform-provide-a-remove-callback-that-returns-no-v.patch +media-rcar_fdp1-convert-to-platform-remove-callback-.patch +media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch +media-v4l-async-return-async-sub-devices-to-subnotif.patch +media-hi846-fix-memleak-in-hi846_init_controls.patch +drm-amd-display-fix-potential-null-dereference.patch +media-rc-gpio-ir-recv-fix-support-for-wake-up.patch +media-venus-dec-fix-handling-of-the-start-cmd.patch +media-venus-dec-fix-capture-formats-enumeration-orde.patch +regulator-stm32-pwr-fix-of_iomap-leak.patch +x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch +arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch +perf-arm-cmn-fix-port-detection-for-cmn-700.patch +media-mediatek-vcodec-fix-decoder-disable-pm-crash.patch +media-mediatek-vcodec-add-remove-function-for-decode.patch +debugobject-prevent-init-race-with-static-objects.patch +drm-i915-make-intel_get_crtc_new_encoder-less-oopsy.patch +tick-common-align-tick-period-with-the-hz-tick.patch +acpi-bus-ensure-that-notify-handlers-are-not-running.patch +cpufreq-use-correct-unit-when-verify-cur-freq.patch +rpmsg-glink-propagate-tx-failures-in-intentless-mode.patch +hwmon-pmbus-fsp-3y-fix-functionality-bitmask-in-fsp-.patch +platform-chrome-cros_typec_switch-add-missing-fwnode.patch +wifi-ath6kl-minor-fix-for-allocation-size.patch +wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch +wifi-ath11k-use-platform_get_irq-to-get-the-interrup.patch +wifi-ath5k-use-platform_get_irq-to-get-the-interrupt.patch +wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch +wifi-ath11k-fix-sac-bug-on-peer-addition-with-sta-ba.patch +wifi-rtl8xxxu-remove-always-true-condition-in-rtl8xx.patch +wifi-brcmfmac-support-cqm-rssi-notification-with-old.patch +wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch +tools-bpftool-remove-invalid-json-escape.patch +wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch +wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch +bpf-take-into-account-liveness-when-propagating-prec.patch +bpf-fix-precision-propagation-verbose-logging.patch +crypto-qat-fix-concurrency-issue-when-device-state-c.patch +scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch +wifi-ath11k-fix-deinitialization-of-firmware-resourc.patch +selftests-bpf-fix-a-fd-leak-in-an-error-path-in-netw.patch +bpf-remove-misleading-spec_v1-check-on-var-offset-st.patch +net-pcs-xpcs-remove-double-read-of-link-state-when-u.patch +vlan-partially-enable-siocshwtstamp-in-container.patch +net-packet-annotate-accesses-to-po-xmit.patch +net-packet-convert-po-origdev-to-an-atomic-flag.patch +net-packet-convert-po-auxdata-to-an-atomic-flag.patch +libbpf-fix-ld_imm64-copy-logic-for-ksym-in-light-ske.patch +net-dsa-qca8k-remove-assignment-of-an_enabled-in-pcs.patch +netfilter-keep-conntrack-reference-until-ipsecv6-pol.patch +bpf-return-long-from-bpf_map_ops-funcs.patch +bpf-fix-__reg_bound_offset-64-32-var_off-subreg-prop.patch +scsi-target-move-sess-cmd-counter-to-new-struct.patch +scsi-target-move-cmd-counter-allocation.patch +scsi-target-pass-in-cmd-counter-to-use-during-cmd-se.patch +scsi-target-iscsit-isert-alloc-per-conn-cmd-counter.patch +scsi-target-iscsit-stop-wait-on-cmds-during-conn-clo.patch +scsi-target-fix-multiple-lun_reset-handling.patch +scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch +scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch +net-sunhme-fix-uninitialized-return-code.patch +f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch +f2fs-fix-uninitialized-skipped_gc_rwsem.patch +f2fs-apply-zone-capacity-to-all-zone-type.patch +f2fs-compress-fix-to-call-f2fs_wait_on_page_writebac.patch +f2fs-fix-scheduling-while-atomic-in-decompression-pa.patch +crypto-caam-clear-some-memory-in-instantiate_rng.patch +crypto-sa2ul-select-crypto_des.patch +wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch +wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-32578 +scsi-hisi_sas-handle-ncq-error-when-iptt-is-valid.patch +wifi-rt2x00-fix-memory-leak-when-handling-surveys.patch +bpf-rename-list_head-graph_root-in-field-info-types.patch +bpf-add-__bpf_kfunc-tag-for-marking-kernel-functions.patch +bpf-migrate-release_on_unlock-logic-to-non-owning-re.patch +bpf-add-basic-bpf_rb_-root-node-support.patch +bpf-add-bpf_rbtree_-add-remove-first-kfuncs.patch +bpf-add-support-for-bpf_rb_root-and-bpf_rb_node-in-k.patch +bpf-add-callback-validation-to-kfunc-verifier-logic.patch +bpf-factor-out-fetching-basic-kfunc-metadata.patch +bpf-fix-struct_meta-lookup-for-bpf_obj_free_fields-k.patch +f2fs-fix-iostat-lock-protection.patch +net-qrtr-correct-types-of-trace-event-parameters.patch +selftests-xsk-use-correct-umem-size-in-testapp_inval.patch +selftests-xsk-disable-ipv6-on-veth1.patch +selftests-xsk-deflakify-stats_rx_dropped-test.patch +selftests-bpf-wait-for-receive-in-cg_storage_multi-t.patch +bpftool-fix-bug-for-long-instructions-in-program-cfg.patch +crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch +xsk-fix-unaligned-descriptor-validation.patch +f2fs-fix-to-avoid-use-after-free-for-cached-ipu-bio.patch +wifi-iwlwifi-fix-duplicate-entry-in-iwl_dev_info_tab.patch +bpf-btf-fix-is_int_ptr.patch +scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch +net-ethernet-stmmac-dwmac-rk-rework-optional-clock-h.patch +net-ethernet-stmmac-dwmac-rk-fix-optional-phy-regula.patch +wifi-ath11k-fix-writing-to-unintended-memory-region.patch +bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch +nvmet-fix-error-handling-in-nvmet_execute_identify_c.patch +nvmet-fix-identify-namespace-handling.patch +nvmet-fix-identify-controller-handling.patch +nvmet-fix-identify-active-namespace-id-list-handling.patch +nvmet-fix-i-o-command-set-specific-identify-controll.patch +nvme-fix-async-event-trace-event.patch +nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch +selftests-bpf-use-read_perf_max_sample_freq-in-perf_.patch +selftests-bpf-fix-leaked-bpf_link-in-get_stackid_can.patch +blk-mq-don-t-plug-for-head-insertions-in-blk_execute.patch +wifi-iwlwifi-debug-fix-crash-in-__iwl_err.patch +wifi-iwlwifi-mvm-fix-a-msdu-checks.patch +wifi-iwlwifi-trans-don-t-trigger-d3-interrupt-twice.patch +wifi-iwlwifi-mvm-don-t-set-checksum_complete-for-uns.patch +bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch +f2fs-fix-to-check-return-value-of-f2fs_do_truncate_b.patch +f2fs-fix-to-check-return-value-of-inc_valid_block_co.patch +md-raid10-fix-task-hung-in-raid10d.patch +md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch +md-raid10-fix-memleak-for-conf-bio_split.patch +md-raid10-fix-memleak-of-md-thread.patch +md-raid10-don-t-call-bio_start_io_acct-twice-for-bio.patch +wifi-iwlwifi-mvm-don-t-drop-unencrypted-mcast-frames.patch +wifi-iwlwifi-yoyo-skip-dump-correctly-on-hw-error.patch +wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch +wifi-iwlwifi-mvm-initialize-seq-variable.patch +wifi-iwlwifi-fw-move-memset-before-early-return.patch +jdb2-don-t-refuse-invalidation-of-already-invalidate.patch +io_uring-rsrc-use-nospec-ed-indexes.patch +wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch +wifi-mt76-remove-redundent-mcu_uni_cmd_-definitions.patch +wifi-mt76-mt7921-fix-wrong-command-to-set-sta-channe.patch +wifi-mt76-mt7921-fix-pci-dma-hang-after-reboot.patch +wifi-mt76-mt7915-unlock-on-error-in-mt7915_thermal_t.patch +wifi-mt76-mt7996-fix-radiotap-bitfield.patch +wifi-mt76-mt7915-expose-device-tree-match-table.patch +wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch +wifi-mt76-mt7915-rework-init-flow-in-mt7915_thermal_.patch +wifi-mt76-handle-failure-of-vzalloc-in-mt7615_coredu.patch +wifi-mt76-mt7996-let-non-bufferable-mmpdus-use-corre.patch +wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch +wifi-mt76-mt7996-fix-eeprom-tx-path-bitfields.patch +wifi-mt76-add-flexible-polling-wait-interval-support.patch +wifi-mt76-mt7921e-fix-probe-timeout-after-reboot.patch +wifi-mt76-fix-6ghz-high-channel-not-be-scanned.patch +mt76-mt7921-fix-kernel-panic-by-accessing-unallocate.patch +wifi-mt76-mt7921-fix-missing-unwind-goto-in-mt7921u_.patch +wifi-mt76-mt7921e-improve-reliability-of-dma-reset.patch +wifi-mt76-mt7921e-stop-chip-reset-worker-in-unregist.patch +wifi-mt76-connac-fix-txd-multicast-rate-setting.patch +wifi-iwlwifi-mvm-check-firmware-response-size.patch +netfilter-conntrack-restore-ips_confirmed-out-of-nf_.patch +wifi-mt76-mt7996-rely-on-mt76_connac_txp_common-stru.patch +wifi-mt76-mt7996-fill-txd-by-host-driver.patch +netfilter-conntrack-fix-wrong-ct-timeout-value.patch +wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch +ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch +ixgbe-enable-setting-rss-table-to-default-values.patch +net-mlx5e-don-t-clone-flow-post-action-attributes-se.patch +net-mlx5-e-switch-create-per-vport-table-based-on-de.patch +net-mlx5-e-switch-don-t-destroy-indirect-table-in-sp.patch +net-mlx5e-fix-error-flow-in-representor-failing-to-a.patch +net-mlx5-remove-recovery-arg-from-mlx5_load_one-func.patch +net-mlx5-suspend-auxiliary-devices-only-in-case-of-p.patch +revert-net-mlx5-remove-recovery-arg-from-mlx5_load_o.patch +net-mlx5-use-recovery-timeout-on-sync-reset-flow.patch +net-mlx5e-nullify-table-pointer-when-failing-to-crea.patch +revert-net-mlx5e-don-t-use-termination-table-when-re.patch +net-stmmac-fix-system-hang-when-setting-up-tag_8021q.patch +bpf-fix-race-between-btf_put-and-btf_idr-walk.patch +bpf-don-t-efault-for-getsockopt-with-optval-null.patch +netfilter-nf_tables-don-t-write-table-validation-sta.patch +net-dpaa-fix-uninitialized-variable-in-dpaa_stop.patch +net-sched-sch_fq-fix-integer-overflow-of-credit.patch +ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch +rxrpc-fix-error-when-reading-rxrpc-tokens.patch +revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch +netlink-use-copy_to_user-for-optval-in-netlink_getso.patch +net-amd-fix-link-leak-when-verifying-config-failed.patch +tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch +ipmi-aspeed_bt_ipmi_bmc-select-regmap_mmio-instead-o.patch +asoc-cs35l41-only-disable-internal-boost.patch +drivers-staging-rtl8723bs-fix-locking-in-_rtw_join_t.patch +drivers-staging-rtl8723bs-fix-locking-in-rtw_scan_ti.patch +pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch +usb-host-xhci-rcar-remove-leftover-quirk-handling.patch +usb-dwc3-gadget-change-condition-for-processing-susp.patch +serial-stm32-re-assert-rts-de-gpio-in-rs485-mode-onl.patch +fpga-bridge-fix-kernel-doc-parameter-description.patch +iommufd-selftest-catch-overflow-of-uptr-and-length.patch +iio-light-max44009-add-missing-of-device-matching.patch +serial-8250_bcm7271-fix-arbitration-handling.patch +spi-atmel-quadspi-don-t-leak-clk-enable-count-in-pm-.patch +spi-atmel-quadspi-free-resources-even-if-runtime-res.patch +spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch +interconnect-qcom-drop-obsolete-osm_l3-epss-defines.patch +interconnect-qcom-osm-l3-drop-unuserd-header-inclusi.patch +spi-f_ospi-add-missing-spi_mem_default_supports_op-h.patch +module-decompress-never-use-kunmap-for-local-un-mapp.patch +usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch +asoc-soc-compress-inherit-atomicity-from-dai-link-fo.patch +pci-imx6-install-the-fault-handler-only-on-compatibl.patch +asoc-es8316-handle-optional-irq-assignment.patch +linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch +spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch +interconnect-qcom-rpm-drop-bogus-pm-domain-attach.patch +spi-mchp-pci1xxxx-fix-length-of-spi-transactions-not.patch +spi-mchp-pci1xxxx-fix-spi-transactions-not-working-a.patch +spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch +vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch +of-fix-modalias-string-generation.patch +pci-edr-clear-device-status-after-edr-error-recovery.patch +ia64-mm-contig-fix-section-mismatch-warning-error.patch +ia64-salinfo-placate-defined-but-not-used-warning.patch +scripts-gdb-bail-early-if-there-are-no-clocks.patch +scripts-gdb-bail-early-if-there-are-no-generic-pd.patch +hid-amd_sfh-correct-the-structure-fields.patch +hid-amd_sfh-correct-the-sensor-enable-and-disable-co.patch +hid-amd_sfh-fix-illuminance-value.patch +hid-amd_sfh-add-support-for-shutdown-operation.patch +hid-amd_sfh-correct-the-stop-all-command.patch +hid-amd_sfh-increase-sensor-command-timeout-for-sfh1.patch +hid-amd_sfh-handle-no-sensors-enabled-for-sfh1.1.patch +cacheinfo-check-sib_leaf-in-cache_leaves_are_shared.patch +coresight-etm_pmu-set-the-module-field.patch +drm-panel-novatek-nt35950-improve-error-handling.patch +asoc-fsl_mqs-move-of_node_put-to-the-correct-locatio.patch +pci-pm-extend-d3hot-delay-for-nvidia-hda-controllers.patch +drm-panel-novatek-nt35950-only-unregister-dsi1-if-it.patch +spi-cadence-quadspi-fix-suspend-resume-implementatio.patch +i2c-cadence-cdns_i2c_master_xfer-fix-runtime-pm-leak.patch +i2c-xiic-xiic_xfer-fix-runtime-pm-leak-on-error-path.patch +scripts-gdb-raise-error-with-reduced-debugging-infor.patch +uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch +sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch +usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch +usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch +usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch +firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch +tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch +serial-8250-add-missing-wakeup-event-reporting.patch +spi-cadence-quadspi-use-macro-define_simple_dev_pm_o.patch +staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch +spmi-add-a-check-for-remove-callback-when-removing-a.patch +virtio_ring-don-t-update-event-idx-on-get_buf.patch +spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch +fbdev-mmp-fix-deferred-clk-handling-in-mmphw_probe.patch +selftests-powerpc-pmu-fix-sample-field-check-in-the-.patch +macintosh-windfarm_smu_sat-add-missing-of_node_put.patch +powerpc-perf-properly-detect-mpc7450-family.patch +powerpc-mpc512x-fix-resource-printk-format-warning.patch +powerpc-wii-fix-resource-printk-format-warnings.patch +powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch +macintosh-via-pmu-led-requires-ata-to-be-set.patch +powerpc-rtas-use-memmove-for-potentially-overlapping.patch +sched-fair-fix-inaccurate-tally-of-ttwu_move_affine.patch +perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch +revert-objtool-support-addition-to-set-cfa-base.patch +riscv-fix-ptdump-when-kasan-is-enabled.patch +sched-rt-fix-bad-task-migration-for-rt-tasks.patch +rv-fix-addition-on-an-uninitialized-variable-run.patch +tracing-user_events-ensure-write-index-cannot-be-neg.patch +clk-at91-clk-sam9x60-pll-fix-return-value-check.patch +ib-hifi1-add-a-null-check-of-kzalloc_node-in-hfi1_ip.patch +rdma-siw-fix-potential-page_array-out-of-range-acces.patch +clk-mediatek-mt2712-add-error-handling-to-clk_mt2712.patch +clk-mediatek-consistently-use-gate_mtk-macro.patch +clk-mediatek-mt7622-properly-use-clk_is_critical-fla.patch +clk-mediatek-mt8135-properly-use-clk_is_critical-fla.patch +rdma-rdmavt-delete-unnecessary-null-check.patch +clk-mediatek-clk-pllfh-fix-missing-of_node_put-in-fh.patch +clk-qcom-gcc-qcm2290-fix-up-gcc_sdcc2_apps_clk_src.patch +workqueue-fix-hung-time-report-of-worker-pools.patch +rtc-omap-include-header-for-omap_rtc_power_off_progr.patch +rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch +rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch +rtc-k3-handle-errors-while-enabling-wake-irq.patch +rdma-rxe-replace-exists-by-rxe-in-rxe.c.patch +rdma-erdma-use-fixed-hardware-page-size.patch +fs-ntfs3-fix-memory-leak-if-ntfs_read_mft-failed.patch +fs-ntfs3-add-check-for-kmemdup.patch +fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lo.patch +fs-ntfs3-fix-oob-read-in-indx_insert_into_buffer.patch +fs-ntfs3-fix-slab-out-of-bounds-read-in-hdr_delete_d.patch +iommu-mediatek-set-dma_mask-for-pgtable_pa_35_en.patch +rdma-rxe-remove-rxe_alloc.patch +rdma-rxe-change-rxe_dbg-to-rxe_dbg_dev.patch +rdma-rxe-extend-dbg-log-messages-to-err-and-info.patch +rdma-rxe-add-error-messages.patch +rdma-rxe-remove-tasklet-call-from-rxe_cq.c.patch +power-supply-generic-adc-battery-fix-unit-scaling.patch +clk-add-missing-of_node_put-in-assigned-clocks-prope.patch +rdma-rxe-clean-kzalloc-failure-paths.patch +rdma-siw-remove-namespace-check-from-siw_netdev_even.patch +clk-qcom-gcc-sm6115-mark-rcgs-shared-where-applicabl.patch +power-supply-rk817-fix-low-soc-bugs.patch +rdma-cm-trace-icm_send_rej-event-before-the-cm-state.patch +rdma-srpt-add-a-check-for-valid-mad_agent-pointer.patch +ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch +ib-hfi1-fix-bugs-with-non-page_size-end-multi-iovec-.patch +clk-imx-fracn-gppll-fix-the-rate-table.patch +clk-imx-fracn-gppll-disable-hardware-select-control.patch +clk-imx-imx8ulp-fix-xbar_divbus-and-ad_slow-clock-pa.patch +nfsv4.1-always-send-a-reclaim_complete-after-establi.patch +iommu-amd-set-page-size-bitmap-during-v2-domain-allo.patch +s390-checksum-always-use-cksm-instruction.patch +clk-qcom-lpasscc-sc7280-skip-qdsp6ss-clock-registrat.patch +clk-qcom-lpassaudiocc-sc7280-add-required-gdsc-power.patch +clk-qcom-gcc-sm8350-fix-pcie-pipe-clocks-handling.patch +clk-qcom-dispcc-qcm2290-get-rid-of-test-clock.patch +clk-qcom-dispcc-qcm2290-remove-inexistent-dsi1phy-cl.patch +input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch +swiotlb-relocate-pagehighmem-test-away-from-rmem_swi.patch +swiotlb-fix-debugfs-reporting-of-reserved-memory-poo.patch +rdma-rxe-convert-tasklet-args-to-queue-pairs.patch +rdma-rxe-remove-__rxe_do_task.patch +rdma-rxe-fix-the-error-trying-to-register-non-static.patch +rdma-mlx5-check-pcie_relaxed_ordering_enabled-in-umr.patch +rdma-mlx5-fix-flow-counter-query-via-devx.patch +sunrpc-remove-the-maximum-number-of-retries-in-call_.patch +rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch +clocksource-drivers-davinci-fix-memory-leak-in-davin.patch +openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch +timekeeping-fix-references-to-nonexistent-ktime_get_.patch +smb3-add-missing-locks-to-protect-deferred-close-fil.patch +smb3-close-deferred-file-handles-in-case-of-handle-l.patch +ext4-fix-i_disksize-exceeding-i_size-problem-in-pari.patch +ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch +pinctrl-renesas-r8a779a0-remove-incorrect-avb-01-pin.patch +pinctrl-renesas-r8a779f0-fix-tsn1_avtp_pps-pin-group.patch +pinctrl-renesas-r8a779g0-fix-group-4-5-pin-functions.patch +pinctrl-renesas-r8a779g0-fix-group-6-7-pin-functions.patch +pinctrl-renesas-r8a779g0-fix-erroroutc-function-name.patch +leds-ti_lmu_common-select-regmap-instead-of-dependin.patch +pinctrl-ralink-reintroduce-ralink-rt2880-pinmux-comp.patch +dmaengine-mv_xor_v2-fix-an-error-code.patch +leds-tca6507-fix-error-handling-of-using-fwnode_prop.patch +pwm-mtk-disp-disable-shadow-registers-before-setting.patch +pwm-mtk-disp-configure-double-buffering-before-readi.patch +soundwire-intel-don-t-save-hw_params-for-use-in-prep.patch +phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch +phy-ti-j721e-wiz-fix-unreachable-code-in-wiz_mode_se.patch +dma-gpi-remove-spurious-unlock-in-gpi_ch_init.patch +dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch +dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch +dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch +pinctrl-bcm2835.c-fix-race-condition-when-setting-gp.patch +thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch +mfd-tqmx86-do-not-access-i2c_detect-register-through.patch +mfd-tqmx86-specify-io-port-register-range-more-preci.patch +mfd-tqmx86-correct-board-names-for-tqmxe39x.patch +mfd-ocelot-spi-fix-unsupported-bulk-read.patch +mfd-arizona-spi-add-missing-module_device_table.patch +hte-tegra-fix-struct-of_device_id-build-error.patch +hte-tegra-194-fix-off-by-one-in-tegra_hte_map_to_lin.patch +acpi-pm-do-not-turn-of-unused-power-resources-on-the.patch +pm-hibernate-turn-snapshot_test-into-global-variable.patch +pm-hibernate-do-not-get-block-device-exclusively-in-.patch +afs-fix-updating-of-i_size-with-dv-jump-from-server.patch +afs-fix-getattr-to-report-server-i_size-on-dirs-not-.patch +afs-avoid-endless-loop-if-file-is-larger-than-expect.patch diff --git a/queue-6.2/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch b/queue-6.2/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch new file mode 100644 index 00000000000..2ec156c61f7 --- /dev/null +++ b/queue-6.2/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch @@ -0,0 +1,44 @@ +From 39a80bcec406b30ff76a3ece415b164e54baca6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 13:48:52 +0200 +Subject: sh: sq: Fix incorrect element size for allocating bitmap buffer + +From: John Paul Adrian Glaubitz + +[ Upstream commit 80f746e2bd0e1da3fdb49a53570e54a1a225faac ] + +The Store Queue code allocates a bitmap buffer with the size of +multiple of sizeof(long) in sq_api_init(). While the buffer size +is calculated correctly, the code uses the wrong element size to +allocate the buffer which results in the allocated bitmap buffer +being too small. + +Fix this by allocating the buffer with kcalloc() with element size +sizeof(long) instead of kzalloc() whose elements size defaults to +sizeof(char). + +Fixes: d7c30c682a27 ("sh: Store Queue API rework.") +Reviewed-by: Geert Uytterhoeven +Signed-off-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20230419114854.528677-1-glaubitz@physik.fu-berlin.de +Signed-off-by: Sasha Levin +--- + arch/sh/kernel/cpu/sh4/sq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sh/kernel/cpu/sh4/sq.c b/arch/sh/kernel/cpu/sh4/sq.c +index a76b94e41e913..8ddfe9989f5fc 100644 +--- a/arch/sh/kernel/cpu/sh4/sq.c ++++ b/arch/sh/kernel/cpu/sh4/sq.c +@@ -382,7 +382,7 @@ static int __init sq_api_init(void) + if (unlikely(!sq_cache)) + return ret; + +- sq_bitmap = kzalloc(size, GFP_KERNEL); ++ sq_bitmap = kcalloc(size, sizeof(long), GFP_KERNEL); + if (unlikely(!sq_bitmap)) + goto out; + +-- +2.39.2 + diff --git a/queue-6.2/smb3-add-missing-locks-to-protect-deferred-close-fil.patch b/queue-6.2/smb3-add-missing-locks-to-protect-deferred-close-fil.patch new file mode 100644 index 00000000000..4b9576ef0b1 --- /dev/null +++ b/queue-6.2/smb3-add-missing-locks-to-protect-deferred-close-fil.patch @@ -0,0 +1,60 @@ +From 4778227f9ff60db03ce3398605fc83b128b80f2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 13:54:33 +0000 +Subject: SMB3: Add missing locks to protect deferred close file list + +From: Bharath SM + +[ Upstream commit ab9ddc87a9055c4bebd6524d5d761d605d52e557 ] + +cifs_del_deferred_close function has a critical section which modifies +the deferred close file list. We must acquire deferred_lock before +calling cifs_del_deferred_close function. + +Fixes: ca08d0eac020 ("cifs: Fix memory leak on the deferred close") +Signed-off-by: Bharath SM +Acked-off-by: Paulo Alcantara (SUSE) +Acked-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/misc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 2fae6b08314d9..dc97013469748 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -749,7 +749,9 @@ cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode) + list_for_each_entry(cfile, &cifs_inode->openFileList, flist) { + if (delayed_work_pending(&cfile->deferred)) { + if (cancel_delayed_work(&cfile->deferred)) { ++ spin_lock(&cifs_inode->deferred_lock); + cifs_del_deferred_close(cfile); ++ spin_unlock(&cifs_inode->deferred_lock); + + tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC); + if (tmp_list == NULL) +@@ -780,7 +782,9 @@ cifs_close_all_deferred_files(struct cifs_tcon *tcon) + list_for_each_entry(cfile, &tcon->openFileList, tlist) { + if (delayed_work_pending(&cfile->deferred)) { + if (cancel_delayed_work(&cfile->deferred)) { ++ spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + cifs_del_deferred_close(cfile); ++ spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + + tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC); + if (tmp_list == NULL) +@@ -815,7 +819,9 @@ cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path) + if (strstr(full_path, path)) { + if (delayed_work_pending(&cfile->deferred)) { + if (cancel_delayed_work(&cfile->deferred)) { ++ spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + cifs_del_deferred_close(cfile); ++ spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + + tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC); + if (tmp_list == NULL) +-- +2.39.2 + diff --git a/queue-6.2/smb3-close-deferred-file-handles-in-case-of-handle-l.patch b/queue-6.2/smb3-close-deferred-file-handles-in-case-of-handle-l.patch new file mode 100644 index 00000000000..7ee8a6a0aa0 --- /dev/null +++ b/queue-6.2/smb3-close-deferred-file-handles-in-case-of-handle-l.patch @@ -0,0 +1,72 @@ +From 55456f9dd9e553448cc2d17f41a81cddeab8a08f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 14:05:16 +0000 +Subject: SMB3: Close deferred file handles in case of handle lease break + +From: Bharath SM + +[ Upstream commit d906be3fa571f6fc9381911304a0eca99f1b6951 ] + +We should not cache deferred file handles if we dont have +handle lease on a file. And we should immediately close all +deferred handles in case of handle lease break. + +Fixes: 9e31678fb403 ("SMB3: fix lease break timeout when multiple deferred close handles for the same file.") +Signed-off-by: Bharath SM +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/file.c | 16 ++++++++++++++++ + fs/cifs/misc.c | 2 +- + 2 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index a53ddc81b698c..bef7c335ccc6e 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -5096,6 +5096,8 @@ void cifs_oplock_break(struct work_struct *work) + struct TCP_Server_Info *server = tcon->ses->server; + int rc = 0; + bool purge_cache = false; ++ struct cifs_deferred_close *dclose; ++ bool is_deferred = false; + + wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS, + TASK_UNINTERRUPTIBLE); +@@ -5131,6 +5133,20 @@ void cifs_oplock_break(struct work_struct *work) + cifs_dbg(VFS, "Push locks rc = %d\n", rc); + + oplock_break_ack: ++ /* ++ * When oplock break is received and there are no active ++ * file handles but cached, then schedule deferred close immediately. ++ * So, new open will not use cached handle. ++ */ ++ spin_lock(&CIFS_I(inode)->deferred_lock); ++ is_deferred = cifs_is_deferred_close(cfile, &dclose); ++ spin_unlock(&CIFS_I(inode)->deferred_lock); ++ ++ if (!CIFS_CACHE_HANDLE(cinode) && is_deferred && ++ cfile->deferred_close_scheduled && delayed_work_pending(&cfile->deferred)) { ++ cifs_close_deferred_file(cinode); ++ } ++ + /* + * releasing stale oplock after recent reconnect of smb session using + * a now incorrect file handle is not a data integrity issue but do +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index dc97013469748..ee0a3c3f6b1d6 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -764,7 +764,7 @@ cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode) + spin_unlock(&cifs_inode->open_file_lock); + + list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { +- _cifsFileInfo_put(tmp_list->cfile, true, false); ++ _cifsFileInfo_put(tmp_list->cfile, false, false); + list_del(&tmp_list->list); + kfree(tmp_list); + } +-- +2.39.2 + diff --git a/queue-6.2/soc-bcm-brcmstb-biuctrl-fix-of_iomap-leak.patch b/queue-6.2/soc-bcm-brcmstb-biuctrl-fix-of_iomap-leak.patch new file mode 100644 index 00000000000..24e446f481d --- /dev/null +++ b/queue-6.2/soc-bcm-brcmstb-biuctrl-fix-of_iomap-leak.patch @@ -0,0 +1,47 @@ +From cf7cb0e2f7e2526e167c646549ede58453015aca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Mar 2023 19:54:22 +0800 +Subject: soc: bcm: brcmstb: biuctrl: fix of_iomap leak + +From: Zhaoyang Li + +[ Upstream commit c3fbced9af885a6f217fd95509a613d6590916ce ] + +Smatch reports: + +drivers/soc/bcm/brcmstb/biuctrl.c:291 setup_hifcpubiuctrl_regs() warn: +'cpubiuctrl_base' from of_iomap() not released on lines: 291. + +This is because in setup_hifcpubiuctrl_regs(), +cpubiuctrl_base is not released when handle error, which may cause a leak. +To fix this, iounmap is added when handle error. + +Fixes: 22f7a9116eba ("soc: brcmstb: Correct CPU_CREDIT_REG offset for Brahma-B53 CPUs") +Signed-off-by: Zhaoyang Li +Reviewed-by: Dan Carpenter +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230327115422.1536615-1-lizhaoyang04@hust.edu.cn +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + drivers/soc/bcm/brcmstb/biuctrl.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/soc/bcm/brcmstb/biuctrl.c b/drivers/soc/bcm/brcmstb/biuctrl.c +index e1d7b45432485..364ddbe365c24 100644 +--- a/drivers/soc/bcm/brcmstb/biuctrl.c ++++ b/drivers/soc/bcm/brcmstb/biuctrl.c +@@ -288,6 +288,10 @@ static int __init setup_hifcpubiuctrl_regs(struct device_node *np) + if (BRCM_ID(family_id) == 0x7260 && BRCM_REV(family_id) == 0) + cpubiuctrl_regs = b53_cpubiuctrl_no_wb_regs; + out: ++ if (ret && cpubiuctrl_base) { ++ iounmap(cpubiuctrl_base); ++ cpubiuctrl_base = NULL; ++ } + return ret; + } + +-- +2.39.2 + diff --git a/queue-6.2/soc-qcom-rpmh-rsc-support-rsc-v3-minor-versions.patch b/queue-6.2/soc-qcom-rpmh-rsc-support-rsc-v3-minor-versions.patch new file mode 100644 index 00000000000..caf0fcf7508 --- /dev/null +++ b/queue-6.2/soc-qcom-rpmh-rsc-support-rsc-v3-minor-versions.patch @@ -0,0 +1,37 @@ +From 763cd9f57c4e281045d412f300e1290712d81b2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 17:27:32 +0530 +Subject: soc: qcom: rpmh-rsc: Support RSC v3 minor versions + +From: Tushar Nimkar + +[ Upstream commit 88704a0cd71909c3107561261412a5d5beb23358 ] + +RSC v3 register offsets are same for all minor versions of v3. Fix a +minor version check to pick correct offsets for all v3 minor versions. + +Fixes: 40482e4f7364 ("soc: qcom: rpmh-rsc: Add support for RSC v3 register offsets") +Signed-off-by: Tushar Nimkar +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230406115732.9293-1-quic_tnimkar@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rpmh-rsc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index 0f8b2249f8894..f93544f6d7961 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -1073,7 +1073,7 @@ static int rpmh_rsc_probe(struct platform_device *pdev) + drv->ver.minor = rsc_id & (MINOR_VER_MASK << MINOR_VER_SHIFT); + drv->ver.minor >>= MINOR_VER_SHIFT; + +- if (drv->ver.major == 3 && drv->ver.minor == 0) ++ if (drv->ver.major == 3 && drv->ver.minor >= 0) + drv->regs = rpmh_rsc_reg_offset_ver_3_0; + else + drv->regs = rpmh_rsc_reg_offset_ver_2_7; +-- +2.39.2 + diff --git a/queue-6.2/soc-renesas-renesas-soc-release-chipid-from-ioremap.patch b/queue-6.2/soc-renesas-renesas-soc-release-chipid-from-ioremap.patch new file mode 100644 index 00000000000..0b55356677d --- /dev/null +++ b/queue-6.2/soc-renesas-renesas-soc-release-chipid-from-ioremap.patch @@ -0,0 +1,50 @@ +From 2da926cc69125a1e57160c32a199df8c6e87fb31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Mar 2023 17:55:44 +0800 +Subject: soc: renesas: renesas-soc: Release 'chipid' from ioremap() + +From: Li Yang + +[ Upstream commit fc187a46a8e682f0f1167b230792b88de01ceaa0 ] + +Smatch reports: + +drivers/soc/renesas/renesas-soc.c:536 renesas_soc_init() warn: +'chipid' from ioremap() not released on lines: 475. + +If soc_dev_atrr allocation is failed, function renesas_soc_init() +will return without releasing 'chipid' from ioremap(). + +Fix this by adding function iounmap(). + +Fixes: cb5508e47e60 ("soc: renesas: Add support for reading product revision for RZ/G2L family") +Signed-off-by: Li Yang +Reviewed-by: Dan Carpenter +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230331095545.31823-1-lidaxian@hust.edu.cn +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/soc/renesas/renesas-soc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/renesas/renesas-soc.c b/drivers/soc/renesas/renesas-soc.c +index 468ebce1ea88b..51191d1a6dd1d 100644 +--- a/drivers/soc/renesas/renesas-soc.c ++++ b/drivers/soc/renesas/renesas-soc.c +@@ -471,8 +471,11 @@ static int __init renesas_soc_init(void) + } + + soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL); +- if (!soc_dev_attr) ++ if (!soc_dev_attr) { ++ if (chipid) ++ iounmap(chipid); + return -ENOMEM; ++ } + + np = of_find_node_by_path("/"); + of_property_read_string(np, "model", &soc_dev_attr->machine); +-- +2.39.2 + diff --git a/queue-6.2/soc-ti-k3-ringacc-add-try_module_get-to-k3_dmaring_r.patch b/queue-6.2/soc-ti-k3-ringacc-add-try_module_get-to-k3_dmaring_r.patch new file mode 100644 index 00000000000..b7658592d97 --- /dev/null +++ b/queue-6.2/soc-ti-k3-ringacc-add-try_module_get-to-k3_dmaring_r.patch @@ -0,0 +1,56 @@ +From 366607d5c260e611778d1727c2d4a9e901a1dc64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Dec 2022 01:14:04 +0100 +Subject: soc: ti: k3-ringacc: Add try_module_get() to + k3_dmaring_request_dual_ring() + +From: Nicolas Frayer + +[ Upstream commit 5f1732a8683c1da8faaa90d6ffc3bd6d33013a58 ] + +When the k3 ring accelerator driver has been modified to add module build +support, try_module_get() and module_put() have been added to update the +module refcnt. One code path has not been updated and it has introduced +an issue where the refcnt is decremented by module_put() in +k3_ringacc_ring_free() without being incremented previously. +Adding try_module_get() to k3_dmaring_request_dual_ring() ensures the +refcnt is kept up to date. + +Fixes: c07f216a8b72 ("soc: ti: k3-ringacc: Allow the driver to be built as module") +Signed-off-by: Nicolas Frayer +Reviewed-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20221230001404.10902-1-nfrayer@baylibre.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/k3-ringacc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/soc/ti/k3-ringacc.c b/drivers/soc/ti/k3-ringacc.c +index e01e4d815230a..8f131368a7586 100644 +--- a/drivers/soc/ti/k3-ringacc.c ++++ b/drivers/soc/ti/k3-ringacc.c +@@ -406,6 +406,11 @@ static int k3_dmaring_request_dual_ring(struct k3_ringacc *ringacc, int fwd_id, + + mutex_lock(&ringacc->req_lock); + ++ if (!try_module_get(ringacc->dev->driver->owner)) { ++ ret = -EINVAL; ++ goto err_module_get; ++ } ++ + if (test_bit(fwd_id, ringacc->rings_inuse)) { + ret = -EBUSY; + goto error; +@@ -421,6 +426,8 @@ static int k3_dmaring_request_dual_ring(struct k3_ringacc *ringacc, int fwd_id, + return 0; + + error: ++ module_put(ringacc->dev->driver->owner); ++err_module_get: + mutex_unlock(&ringacc->req_lock); + return ret; + } +-- +2.39.2 + diff --git a/queue-6.2/soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch b/queue-6.2/soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch new file mode 100644 index 00000000000..6bbf04f13e1 --- /dev/null +++ b/queue-6.2/soc-ti-pm33xx-fix-refcount-leak-in-am33xx_pm_probe.patch @@ -0,0 +1,53 @@ +From 9557f1a66614ed0113a4d6c643cc7335e24a1555 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 09:40:22 +0400 +Subject: soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe + +From: Miaoqian Lin + +[ Upstream commit 8f3c307b580a4a6425896007325bddefc36e8d91 ] + +wkup_m3_ipc_get() takes refcount, which should be freed by +wkup_m3_ipc_put(). Add missing refcount release in the error paths. + +Fixes: 5a99ae0092fe ("soc: ti: pm33xx: AM437X: Add rtc_only with ddr in self-refresh support") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20230106054022.947529-1-linmq006@gmail.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/pm33xx.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/ti/pm33xx.c b/drivers/soc/ti/pm33xx.c +index ce09c42eaed25..f04c21157904b 100644 +--- a/drivers/soc/ti/pm33xx.c ++++ b/drivers/soc/ti/pm33xx.c +@@ -527,7 +527,7 @@ static int am33xx_pm_probe(struct platform_device *pdev) + + ret = am33xx_pm_alloc_sram(); + if (ret) +- return ret; ++ goto err_wkup_m3_ipc_put; + + ret = am33xx_pm_rtc_setup(); + if (ret) +@@ -572,13 +572,14 @@ static int am33xx_pm_probe(struct platform_device *pdev) + pm_runtime_put_sync(dev); + err_pm_runtime_disable: + pm_runtime_disable(dev); +- wkup_m3_ipc_put(m3_ipc); + err_unsetup_rtc: + iounmap(rtc_base_virt); + clk_put(rtc_fck); + err_free_sram: + am33xx_pm_free_sram(); + pm33xx_dev = NULL; ++err_wkup_m3_ipc_put: ++ wkup_m3_ipc_put(m3_ipc); + return ret; + } + +-- +2.39.2 + diff --git a/queue-6.2/soundwire-intel-don-t-save-hw_params-for-use-in-prep.patch b/queue-6.2/soundwire-intel-don-t-save-hw_params-for-use-in-prep.patch new file mode 100644 index 00000000000..81477c07c47 --- /dev/null +++ b/queue-6.2/soundwire-intel-don-t-save-hw_params-for-use-in-prep.patch @@ -0,0 +1,128 @@ +From 89b2ef7e05498486e317794b34b1dc4148f240ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 10:26:42 +0800 +Subject: soundwire: intel: don't save hw_params for use in prepare +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pierre-Louis Bossart + +[ Upstream commit 0a0d1740bd8fd7dafb81fcb102fb5d0b83b1ce73 ] + +The existing code copies the hw_params pointer and reuses it later in +.prepare, specifically to re-initialize the ALH DMA channel +information that's lost in suspend-resume cycles. + +This is not needed, we can directly access the information from the +substream/rtd - as done for the HDAudio DAIs in +sound/soc/sof/intel/hda-dai.c + +In addition, using the saved pointer causes the suspend-resume test +cases to fail on specific platforms, depending on which version of GCC +is used. Péter Ujfalusi and I have spent long hours to root-cause this +problem that was reported by the Intel CI first with 6.2-rc1 and again +v6.3-rc1. In the latter case we were lucky that the problem was 100% +reproducible on local test devices, and found out that adding a +dev_dbg() or adding a call to usleep_range() just before accessing the +saved pointer "fixed" the issue. With errors appearing just by +changing the compiler version or minor changes in the code generated, +clearly we have a memory management Heisenbug. + +The root-cause seems to be that the hw_params pointer is not +persistent. The soc-pcm code allocates the hw_params structure on the +stack, and passes it to the BE dailink hw_params and DAIs +hw_params. Saving such a pointer and reusing it later during the +.prepare stage cannot possibly work reliably, it's broken-by-design +since v5.10. It's astonishing that the problem was not seen earlier. + +This simple fix will have to be back-ported to -stable, due to changes +to avoid the use of the get/set_dmadata routines this patch will only +apply on kernels older than v6.1. + +Fixes: a5a0239c27fe ("soundwire: intel: reinitialize IP+DSP in .prepare(), but only when resuming") +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Reviewed-by: Péter Ujfalusi +Signed-off-by: Bard Liao +Link: https://lore.kernel.org/r/20230321022642.1426611-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/cadence_master.h | 2 -- + drivers/soundwire/intel.c | 11 +++++++---- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/soundwire/cadence_master.h b/drivers/soundwire/cadence_master.h +index e0a64b28c6b9c..4393607c7e4ad 100644 +--- a/drivers/soundwire/cadence_master.h ++++ b/drivers/soundwire/cadence_master.h +@@ -84,7 +84,6 @@ struct sdw_cdns_stream_config { + * @bus: Bus handle + * @stream_type: Stream type + * @link_id: Master link id +- * @hw_params: hw_params to be applied in .prepare step + * @suspended: status set when suspended, to be used in .prepare + * @paused: status set in .trigger, to be used in suspend + * @direction: stream direction +@@ -96,7 +95,6 @@ struct sdw_cdns_dai_runtime { + struct sdw_bus *bus; + enum sdw_stream_type stream_type; + int link_id; +- struct snd_pcm_hw_params *hw_params; + bool suspended; + bool paused; + int direction; +diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c +index bc9c50bacc494..c852745989167 100644 +--- a/drivers/soundwire/intel.c ++++ b/drivers/soundwire/intel.c +@@ -833,7 +833,6 @@ static int intel_hw_params(struct snd_pcm_substream *substream, + dai_runtime->paused = false; + dai_runtime->suspended = false; + dai_runtime->pdi = pdi; +- dai_runtime->hw_params = params; + + /* Inform DSP about PDI stream number */ + ret = intel_params_stream(sdw, substream->stream, dai, params, +@@ -886,6 +885,11 @@ static int intel_prepare(struct snd_pcm_substream *substream, + } + + if (dai_runtime->suspended) { ++ struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); ++ struct snd_pcm_hw_params *hw_params; ++ ++ hw_params = &rtd->dpcm[substream->stream].hw_params; ++ + dai_runtime->suspended = false; + + /* +@@ -897,7 +901,7 @@ static int intel_prepare(struct snd_pcm_substream *substream, + */ + + /* configure stream */ +- ch = params_channels(dai_runtime->hw_params); ++ ch = params_channels(hw_params); + if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) + dir = SDW_DATA_DIR_RX; + else +@@ -909,7 +913,7 @@ static int intel_prepare(struct snd_pcm_substream *substream, + + /* Inform DSP about PDI stream number */ + ret = intel_params_stream(sdw, substream->stream, dai, +- dai_runtime->hw_params, ++ hw_params, + sdw->instance, + dai_runtime->pdi->intel_alh_id); + } +@@ -948,7 +952,6 @@ intel_hw_free(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) + return ret; + } + +- dai_runtime->hw_params = NULL; + dai_runtime->pdi = NULL; + + return 0; +-- +2.39.2 + diff --git a/queue-6.2/spi-atmel-quadspi-don-t-leak-clk-enable-count-in-pm-.patch b/queue-6.2/spi-atmel-quadspi-don-t-leak-clk-enable-count-in-pm-.patch new file mode 100644 index 00000000000..626c59c32d3 --- /dev/null +++ b/queue-6.2/spi-atmel-quadspi-don-t-leak-clk-enable-count-in-pm-.patch @@ -0,0 +1,48 @@ +From 363b652e7aa3f6b357fb0f41eff16acad6476110 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 09:42:30 +0100 +Subject: spi: atmel-quadspi: Don't leak clk enable count in pm resume +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit c18bbac353ffed50be134b0a2a059a2bd540c503 ] + +The pm resume call is supposed to enable two clocks. If the second enable +fails the callback reports failure but doesn't undo the first enable. + +So call clk_disable() for the first clock when clk_enable() for the second +one fails. + +Fixes: 4a2f83b7f780 ("spi: atmel-quadspi: add runtime pm support") +Signed-off-by: Uwe Kleine-König +Reviewed-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20230317084232.142257-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/atmel-quadspi.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/atmel-quadspi.c b/drivers/spi/atmel-quadspi.c +index 70637e46290a4..2dbb37b1840f3 100644 +--- a/drivers/spi/atmel-quadspi.c ++++ b/drivers/spi/atmel-quadspi.c +@@ -786,7 +786,11 @@ static int __maybe_unused atmel_qspi_runtime_resume(struct device *dev) + if (ret) + return ret; + +- return clk_enable(aq->qspick); ++ ret = clk_enable(aq->qspick); ++ if (ret) ++ clk_disable(aq->pclk); ++ ++ return ret; + } + + static const struct dev_pm_ops __maybe_unused atmel_qspi_pm_ops = { +-- +2.39.2 + diff --git a/queue-6.2/spi-atmel-quadspi-free-resources-even-if-runtime-res.patch b/queue-6.2/spi-atmel-quadspi-free-resources-even-if-runtime-res.patch new file mode 100644 index 00000000000..dd8325a89bd --- /dev/null +++ b/queue-6.2/spi-atmel-quadspi-free-resources-even-if-runtime-res.patch @@ -0,0 +1,78 @@ +From 5abcadc2a102208555ee6bbdd354a032eeaf8998 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 09:42:31 +0100 +Subject: spi: atmel-quadspi: Free resources even if runtime resume failed in + .remove() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 9448bc1dee65f86c0fe64d9dea8b410af0586886 ] + +An early error exit in atmel_qspi_remove() doesn't prevent the device +unbind. So this results in an spi controller with an unbound parent +and unmapped register space (because devm_ioremap_resource() is undone). +So using the remaining spi controller probably results in an oops. + +Instead unregister the controller unconditionally and only skip hardware +access and clk disable. + +Also add a warning about resume failing and return zero unconditionally. +The latter has the only effect to suppress a less helpful error message by +the spi core. + +Fixes: 4a2f83b7f780 ("spi: atmel-quadspi: add runtime pm support") +Signed-off-by: Uwe Kleine-König +Reviewed-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20230317084232.142257-3-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/atmel-quadspi.c | 24 +++++++++++++++++------- + 1 file changed, 17 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/atmel-quadspi.c b/drivers/spi/atmel-quadspi.c +index 2dbb37b1840f3..e8971ec74f82e 100644 +--- a/drivers/spi/atmel-quadspi.c ++++ b/drivers/spi/atmel-quadspi.c +@@ -706,18 +706,28 @@ static int atmel_qspi_remove(struct platform_device *pdev) + struct atmel_qspi *aq = spi_controller_get_devdata(ctrl); + int ret; + +- ret = pm_runtime_resume_and_get(&pdev->dev); +- if (ret < 0) +- return ret; +- + spi_unregister_controller(ctrl); +- atmel_qspi_write(QSPI_CR_QSPIDIS, aq, QSPI_CR); ++ ++ ret = pm_runtime_get_sync(&pdev->dev); ++ if (ret >= 0) { ++ atmel_qspi_write(QSPI_CR_QSPIDIS, aq, QSPI_CR); ++ clk_disable(aq->qspick); ++ clk_disable(aq->pclk); ++ } else { ++ /* ++ * atmel_qspi_runtime_{suspend,resume} just disable and enable ++ * the two clks respectively. So after resume failed these are ++ * off, and we skip hardware access and disabling these clks again. ++ */ ++ dev_warn(&pdev->dev, "Failed to resume device on remove\n"); ++ } ++ ++ clk_unprepare(aq->qspick); ++ clk_unprepare(aq->pclk); + + pm_runtime_disable(&pdev->dev); + pm_runtime_put_noidle(&pdev->dev); + +- clk_disable_unprepare(aq->qspick); +- clk_disable_unprepare(aq->pclk); + return 0; + } + +-- +2.39.2 + diff --git a/queue-6.2/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch b/queue-6.2/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch new file mode 100644 index 00000000000..0b397e001ed --- /dev/null +++ b/queue-6.2/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch @@ -0,0 +1,48 @@ +From 3d0357e403cf3a80962bcf9c641abc758c31b50e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 17:46:15 +0530 +Subject: spi: bcm63xx: remove PM_SLEEP based conditional compilation + +From: Dhruva Gole + +[ Upstream commit 25f0617109496e1aff49594fbae5644286447a0f ] + +Get rid of conditional compilation based on CONFIG_PM_SLEEP because +it may introduce build issues with certain configs where it maybe disabled +This is because if above config is not enabled the suspend-resume +functions are never part of the code but the bcm63xx_spi_pm_ops struct +still inits them to non-existent suspend-resume functions. + +Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver") + +Signed-off-by: Dhruva Gole +Link: https://lore.kernel.org/r/20230420121615.967487-1-d-gole@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm63xx.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c +index 3686d78c44a6d..974c96c27a602 100644 +--- a/drivers/spi/spi-bcm63xx.c ++++ b/drivers/spi/spi-bcm63xx.c +@@ -629,7 +629,6 @@ static int bcm63xx_spi_remove(struct platform_device *pdev) + return 0; + } + +-#ifdef CONFIG_PM_SLEEP + static int bcm63xx_spi_suspend(struct device *dev) + { + struct spi_master *master = dev_get_drvdata(dev); +@@ -656,7 +655,6 @@ static int bcm63xx_spi_resume(struct device *dev) + + return 0; + } +-#endif + + static const struct dev_pm_ops bcm63xx_spi_pm_ops = { + SET_SYSTEM_SLEEP_PM_OPS(bcm63xx_spi_suspend, bcm63xx_spi_resume) +-- +2.39.2 + diff --git a/queue-6.2/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch b/queue-6.2/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch new file mode 100644 index 00000000000..c954fa0d3ac --- /dev/null +++ b/queue-6.2/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch @@ -0,0 +1,68 @@ +From de2b5d5183b4c8b82650f61d23e6eb1250bf2a44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 14:40:27 +0530 +Subject: spi: cadence-quadspi: fix suspend-resume implementations + +From: Dhruva Gole + +[ Upstream commit 2087e85bb66ee3652dafe732bb9b9b896229eafc ] + +The cadence QSPI driver misbehaves after performing a full system suspend +resume: +... +spi-nor spi0.0: resume() failed +... +This results in a flash connected via OSPI interface after system suspend- +resume to be unusable. +fix these suspend and resume functions. + +Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller") +Signed-off-by: Dhruva Gole +Link: https://lore.kernel.org/r/20230417091027.966146-3-d-gole@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence-quadspi.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c +index 676313e1bdad1..5dc0090fbeb5b 100644 +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -1772,17 +1772,30 @@ static int cqspi_remove(struct platform_device *pdev) + static int cqspi_suspend(struct device *dev) + { + struct cqspi_st *cqspi = dev_get_drvdata(dev); ++ struct spi_master *master = dev_get_drvdata(dev); ++ int ret; + ++ ret = spi_master_suspend(master); + cqspi_controller_enable(cqspi, 0); +- return 0; ++ ++ clk_disable_unprepare(cqspi->clk); ++ ++ return ret; + } + + static int cqspi_resume(struct device *dev) + { + struct cqspi_st *cqspi = dev_get_drvdata(dev); ++ struct spi_master *master = dev_get_drvdata(dev); + +- cqspi_controller_enable(cqspi, 1); +- return 0; ++ clk_prepare_enable(cqspi->clk); ++ cqspi_wait_idle(cqspi); ++ cqspi_controller_init(cqspi); ++ ++ cqspi->current_cs = -1; ++ cqspi->sclk = 0; ++ ++ return spi_master_resume(master); + } + + static const struct dev_pm_ops cqspi__dev_pm_ops = { +-- +2.39.2 + diff --git a/queue-6.2/spi-cadence-quadspi-use-macro-define_simple_dev_pm_o.patch b/queue-6.2/spi-cadence-quadspi-use-macro-define_simple_dev_pm_o.patch new file mode 100644 index 00000000000..67546faad2b --- /dev/null +++ b/queue-6.2/spi-cadence-quadspi-use-macro-define_simple_dev_pm_o.patch @@ -0,0 +1,76 @@ +From ede59cbc27d0ff42e360fa062a586fe64de953b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 11:12:57 +0530 +Subject: spi: cadence-quadspi: use macro DEFINE_SIMPLE_DEV_PM_OPS + +From: Dhruva Gole + +[ Upstream commit be3206e8906e7a93df673ab2e96d69304a008edc ] + +Using this macro makes the code more readable. +It also inits the members of dev_pm_ops in the following manner +without us explicitly needing to: + +.suspend = cqspi_suspend, \ +.resume = cqspi_resume, \ +.freeze = cqspi_suspend, \ +.thaw = cqspi_resume, \ +.poweroff = cqspi_suspend, \ +.restore = cqspi_resume + +Also get rid of conditional compilation based on CONFIG_PM_SLEEP because +it introduces build issues with certain configs when CQSPI_DEV_PM_OPS is +just NULL. + +Reported-by: kernel test robot +Link: https://lore.kernel.org/oe-kbuild-all/202304191900.2fARFQW9-lkp@intel.com/ +Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller") +Signed-off-by: Dhruva Gole +Link: https://lore.kernel.org/r/20230420054257.925092-1-d-gole@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence-quadspi.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c +index 5dc0090fbeb5b..fa11610ab40b0 100644 +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -1768,7 +1768,6 @@ static int cqspi_remove(struct platform_device *pdev) + return 0; + } + +-#ifdef CONFIG_PM_SLEEP + static int cqspi_suspend(struct device *dev) + { + struct cqspi_st *cqspi = dev_get_drvdata(dev); +@@ -1798,15 +1797,7 @@ static int cqspi_resume(struct device *dev) + return spi_master_resume(master); + } + +-static const struct dev_pm_ops cqspi__dev_pm_ops = { +- .suspend = cqspi_suspend, +- .resume = cqspi_resume, +-}; +- +-#define CQSPI_DEV_PM_OPS (&cqspi__dev_pm_ops) +-#else +-#define CQSPI_DEV_PM_OPS NULL +-#endif ++static DEFINE_SIMPLE_DEV_PM_OPS(cqspi_dev_pm_ops, cqspi_suspend, cqspi_resume); + + static const struct cqspi_driver_platdata cdns_qspi = { + .quirks = CQSPI_DISABLE_DAC_MODE, +@@ -1873,7 +1864,7 @@ static struct platform_driver cqspi_platform_driver = { + .remove = cqspi_remove, + .driver = { + .name = CQSPI_NAME, +- .pm = CQSPI_DEV_PM_OPS, ++ .pm = &cqspi_dev_pm_ops, + .of_match_table = cqspi_dt_ids, + }, + }; +-- +2.39.2 + diff --git a/queue-6.2/spi-f_ospi-add-missing-spi_mem_default_supports_op-h.patch b/queue-6.2/spi-f_ospi-add-missing-spi_mem_default_supports_op-h.patch new file mode 100644 index 00000000000..8b3bb5bb114 --- /dev/null +++ b/queue-6.2/spi-f_ospi-add-missing-spi_mem_default_supports_op-h.patch @@ -0,0 +1,41 @@ +From 83ec3ab294070df0577668352e5e359d0c042b75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 11:31:01 +0900 +Subject: spi: f_ospi: Add missing spi_mem_default_supports_op() helper + +From: Kunihiko Hayashi + +[ Upstream commit bc43c5ec1a97772269785d19f62d32c91ac5fc36 ] + +The .supports_op() callback function returns true by default after +performing driver-specific checks. Therefore the driver cannot apply +the buswidth in devicetree. + +Call spi_mem_default_supports_op() helper to handle the buswidth +in devicetree. + +Fixes: 1b74dd64c861 ("spi: Add Socionext F_OSPI SPI flash controller driver") +Signed-off-by: Kunihiko Hayashi +Link: https://lore.kernel.org/r/20230322023101.24490-1-hayashi.kunihiko@socionext.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sn-f-ospi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-sn-f-ospi.c b/drivers/spi/spi-sn-f-ospi.c +index 333b22dfd8dba..0aedade8908c4 100644 +--- a/drivers/spi/spi-sn-f-ospi.c ++++ b/drivers/spi/spi-sn-f-ospi.c +@@ -561,7 +561,7 @@ static bool f_ospi_supports_op(struct spi_mem *mem, + if (!f_ospi_supports_op_width(mem, op)) + return false; + +- return true; ++ return spi_mem_default_supports_op(mem, op); + } + + static int f_ospi_adjust_op_size(struct spi_mem *mem, struct spi_mem_op *op) +-- +2.39.2 + diff --git a/queue-6.2/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch b/queue-6.2/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch new file mode 100644 index 00000000000..4b8339e1d91 --- /dev/null +++ b/queue-6.2/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch @@ -0,0 +1,71 @@ +From f039e9a37e243eeeb1736e365b622620fdd328bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Apr 2023 19:59:46 +0200 +Subject: spi: fsl-spi: Fix CPM/QE mode Litte Endian + +From: Christophe Leroy + +[ Upstream commit c20c57d9868d7f9fd1b2904c7801b07e128f6322 ] + +CPM has the same problem as QE so for CPM also use the fix added +by commit 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian"): + + CPM mode uses Little Endian so words > 8 bits are byte swapped. + Workaround this by always enforcing wordsize 8 for 16 and 32 bits + words. Unfortunately this will not work for LSB transfers + where wordsize is > 8 bits so disable these for now. + +Also limit the workaround to 16 and 32 bits words because it can +only work for multiples of 8-bits. + +Signed-off-by: Christophe Leroy +Cc: Joakim Tjernlund +Fixes: 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian") +Link: https://lore.kernel.org/r/1b7d3e84b1128f42c1887dd2fb9cdf390f541bc1.1680371809.git.christophe.leroy@csgroup.eu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-spi.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c +index 93152144fd2ec..5602f052b2b50 100644 +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -181,8 +181,8 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs, + struct spi_device *spi, + int bits_per_word) + { +- /* QE uses Little Endian for words > 8 +- * so transform all words > 8 into 8 bits ++ /* CPM/QE uses Little Endian for words > 8 ++ * so transform 16 and 32 bits words into 8 bits + * Unfortnatly that doesn't work for LSB so + * reject these for now */ + /* Note: 32 bits word, LSB works iff +@@ -190,9 +190,11 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs, + if (spi->mode & SPI_LSB_FIRST && + bits_per_word > 8) + return -EINVAL; +- if (bits_per_word > 8) ++ if (bits_per_word <= 8) ++ return bits_per_word; ++ if (bits_per_word == 16 || bits_per_word == 32) + return 8; /* pretend its 8 bits */ +- return bits_per_word; ++ return -EINVAL; + } + + static int fsl_spi_setup_transfer(struct spi_device *spi, +@@ -222,7 +224,7 @@ static int fsl_spi_setup_transfer(struct spi_device *spi, + bits_per_word = mspi_apply_cpu_mode_quirks(cs, spi, + mpc8xxx_spi, + bits_per_word); +- else if (mpc8xxx_spi->flags & SPI_QE) ++ else + bits_per_word = mspi_apply_qe_mode_quirks(cs, spi, + bits_per_word); + +-- +2.39.2 + diff --git a/queue-6.2/spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch b/queue-6.2/spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch new file mode 100644 index 00000000000..4bc371be24e --- /dev/null +++ b/queue-6.2/spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch @@ -0,0 +1,52 @@ +From a1321f9c970bbfc0e7d570b9dbe08a23a4a005f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 07:57:32 +0100 +Subject: spi: imx: Don't skip cleanup in remove's error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 11951c9e3f364d7ae3b568a0e52c8335d43066b5 ] + +Returning early in a platform driver's remove callback is wrong. In this +case the dma resources are not released in the error path. this is never +retried later and so this is a permanent leak. To fix this, only skip +hardware disabling if waking the device fails. + +Fixes: d593574aff0a ("spi: imx: do not access registers while clocks disabled") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20230306065733.2170662-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index e4ccd0c329d06..6c9c87cd14cae 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -1856,13 +1856,11 @@ static int spi_imx_remove(struct platform_device *pdev) + + spi_unregister_controller(controller); + +- ret = pm_runtime_resume_and_get(spi_imx->dev); +- if (ret < 0) { +- dev_err(spi_imx->dev, "failed to enable clock\n"); +- return ret; +- } +- +- writel(0, spi_imx->base + MXC_CSPICTRL); ++ ret = pm_runtime_get_sync(spi_imx->dev); ++ if (ret >= 0) ++ writel(0, spi_imx->base + MXC_CSPICTRL); ++ else ++ dev_warn(spi_imx->dev, "failed to enable clock, skip hw disable\n"); + + pm_runtime_dont_use_autosuspend(spi_imx->dev); + pm_runtime_put_sync(spi_imx->dev); +-- +2.39.2 + diff --git a/queue-6.2/spi-mchp-pci1xxxx-fix-length-of-spi-transactions-not.patch b/queue-6.2/spi-mchp-pci1xxxx-fix-length-of-spi-transactions-not.patch new file mode 100644 index 00000000000..8ef6b3b6bb2 --- /dev/null +++ b/queue-6.2/spi-mchp-pci1xxxx-fix-length-of-spi-transactions-not.patch @@ -0,0 +1,44 @@ +From fd1395cb3944a32d1ed30937ce66d01a0662df05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 22:46:11 +0530 +Subject: spi: mchp-pci1xxxx: Fix length of SPI transactions not set properly + in driver +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tharun Kumar P + +[ Upstream commit 35c8c5e503a82e0a4bf251d32096211eba8c2be6 ] + +In pci1xxxx_spi_transfer_one API, length of SPI transaction gets cleared +by setting of length mask. Set length of transaction only after masking +length field. + +Fixes: 1cc0cbea7167 ("spi: microchip: pci1xxxx: Add driver for SPI controller of PCI1XXXX PCIe switch") +Signed-off-by: Tharun Kumar P +Link: https://lore.kernel.org/r/20230404171613.1336093-2-tharunkumar.pasumarthi@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pci1xxxx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-pci1xxxx.c b/drivers/spi/spi-pci1xxxx.c +index a31c3b612a430..0805c441b4065 100644 +--- a/drivers/spi/spi-pci1xxxx.c ++++ b/drivers/spi/spi-pci1xxxx.c +@@ -199,8 +199,9 @@ static int pci1xxxx_spi_transfer_one(struct spi_controller *spi_ctlr, + else + regval &= ~SPI_MST_CTL_MODE_SEL; + +- regval |= ((clkdiv << 5) | SPI_FORCE_CE | (len << 8)); ++ regval |= ((clkdiv << 5) | SPI_FORCE_CE); + regval &= ~SPI_MST_CTL_CMD_LEN_MASK; ++ regval |= (len << 8); + writel(regval, par->reg_base + + SPI_MST_CTL_REG_OFFSET(p->hw_inst)); + regval = readl(par->reg_base + +-- +2.39.2 + diff --git a/queue-6.2/spi-mchp-pci1xxxx-fix-spi-transactions-not-working-a.patch b/queue-6.2/spi-mchp-pci1xxxx-fix-spi-transactions-not-working-a.patch new file mode 100644 index 00000000000..f35d7d8253f --- /dev/null +++ b/queue-6.2/spi-mchp-pci1xxxx-fix-spi-transactions-not-working-a.patch @@ -0,0 +1,39 @@ +From 65808a229890d9f1a9739706f169922965d1a318 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 22:46:12 +0530 +Subject: spi: mchp-pci1xxxx: Fix SPI transactions not working after suspend + and resume + +From: Tharun Kumar P + +[ Upstream commit 4266d21669de62cf3fb6774f7d404c1eb95a5ab3 ] + +pci1xxxx_spi_resume API masks SPI interrupt bit which prohibits interrupt +from coming to the host at the end of the transaction after suspend-resume. +This patch unmasks this bit at resume. + +Fixes: 1cc0cbea7167 ("spi: microchip: pci1xxxx: Add driver for SPI controller of PCI1XXXX PCIe switch") +Signed-off-by: Tharun Kumar P +Link: https://lore.kernel.org/r/20230404171613.1336093-3-tharunkumar.pasumarthi@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pci1xxxx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-pci1xxxx.c b/drivers/spi/spi-pci1xxxx.c +index 0805c441b4065..13efbfeff92ce 100644 +--- a/drivers/spi/spi-pci1xxxx.c ++++ b/drivers/spi/spi-pci1xxxx.c +@@ -58,7 +58,7 @@ + #define VENDOR_ID_MCHP 0x1055 + + #define SPI_SUSPEND_CONFIG 0x101 +-#define SPI_RESUME_CONFIG 0x303 ++#define SPI_RESUME_CONFIG 0x203 + + struct pci1xxxx_spi_internal { + u8 hw_inst; +-- +2.39.2 + diff --git a/queue-6.2/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch b/queue-6.2/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch new file mode 100644 index 00000000000..9d8d5f9da2b --- /dev/null +++ b/queue-6.2/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch @@ -0,0 +1,65 @@ +From 925c283f1fb731f9e481ee5ac6ae3581982c31bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 23:03:40 +0200 +Subject: spi: qup: Don't skip cleanup in remove's error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 61f49171a43ab1f80c73c5c88c508770c461e0f2 ] + +Returning early in a platform driver's remove callback is wrong. In this +case the dma resources are not released in the error path. this is never +retried later and so this is a permanent leak. To fix this, only skip +hardware disabling if waking the device fails. + +Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20230330210341.2459548-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-qup.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c +index 678dc51ef0174..205e54f157b4a 100644 +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -1277,18 +1277,22 @@ static int spi_qup_remove(struct platform_device *pdev) + struct spi_qup *controller = spi_master_get_devdata(master); + int ret; + +- ret = pm_runtime_resume_and_get(&pdev->dev); +- if (ret < 0) +- return ret; ++ ret = pm_runtime_get_sync(&pdev->dev); + +- ret = spi_qup_set_state(controller, QUP_STATE_RESET); +- if (ret) +- return ret; ++ if (ret >= 0) { ++ ret = spi_qup_set_state(controller, QUP_STATE_RESET); ++ if (ret) ++ dev_warn(&pdev->dev, "failed to reset controller (%pe)\n", ++ ERR_PTR(ret)); + +- spi_qup_release_dma(master); ++ clk_disable_unprepare(controller->cclk); ++ clk_disable_unprepare(controller->iclk); ++ } else { ++ dev_warn(&pdev->dev, "failed to resume, skip hw disable (%pe)\n", ++ ERR_PTR(ret)); ++ } + +- clk_disable_unprepare(controller->cclk); +- clk_disable_unprepare(controller->iclk); ++ spi_qup_release_dma(master); + + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); +-- +2.39.2 + diff --git a/queue-6.2/spmi-add-a-check-for-remove-callback-when-removing-a.patch b/queue-6.2/spmi-add-a-check-for-remove-callback-when-removing-a.patch new file mode 100644 index 00000000000..ef39a8410de --- /dev/null +++ b/queue-6.2/spmi-add-a-check-for-remove-callback-when-removing-a.patch @@ -0,0 +1,65 @@ +From b83ab4bef4a60cfc1fcc7f80a92f1a48801d8121 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 15:38:34 -0700 +Subject: spmi: Add a check for remove callback when removing a SPMI driver + +From: Jishnu Prakash + +[ Upstream commit b56eef3e16d888883fefab47425036de80dd38fc ] + +When removing a SPMI driver, there can be a crash due to NULL pointer +dereference if it does not have a remove callback defined. This is +one such call trace observed when removing the QCOM SPMI PMIC driver: + + dump_backtrace.cfi_jt+0x0/0x8 + dump_stack_lvl+0xd8/0x16c + panic+0x188/0x498 + __cfi_slowpath+0x0/0x214 + __cfi_slowpath+0x1dc/0x214 + spmi_drv_remove+0x16c/0x1e0 + device_release_driver_internal+0x468/0x79c + driver_detach+0x11c/0x1a0 + bus_remove_driver+0xc4/0x124 + driver_unregister+0x58/0x84 + cleanup_module+0x1c/0xc24 [qcom_spmi_pmic] + __do_sys_delete_module+0x3ec/0x53c + __arm64_sys_delete_module+0x18/0x28 + el0_svc_common+0xdc/0x294 + el0_svc+0x38/0x9c + el0_sync_handler+0x8c/0xf0 + el0_sync+0x1b4/0x1c0 + +If a driver has all its resources allocated through devm_() APIs and +does not need any other explicit cleanup, it would not require a +remove callback to be defined. Hence, add a check for remove callback +presence before calling it when removing a SPMI driver. + +Link: https://lore.kernel.org/r/1671601032-18397-2-git-send-email-quic_jprakash@quicinc.com +Fixes: 6f00f8c8635f ("mfd: qcom-spmi-pmic: Use devm_of_platform_populate()") +Fixes: 5a86bf343976 ("spmi: Linux driver framework for SPMI") +Signed-off-by: Jishnu Prakash +Signed-off-by: Stephen Boyd +Link: https://lore.kernel.org/r/20230413223834.4084793-7-sboyd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/spmi/spmi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c +index 55381592bb5a6..e73d3017863cb 100644 +--- a/drivers/spmi/spmi.c ++++ b/drivers/spmi/spmi.c +@@ -350,7 +350,8 @@ static void spmi_drv_remove(struct device *dev) + const struct spmi_driver *sdrv = to_spmi_driver(dev->driver); + + pm_runtime_get_sync(dev); +- sdrv->remove(to_spmi_device(dev)); ++ if (sdrv->remove) ++ sdrv->remove(to_spmi_device(dev)); + pm_runtime_put_noidle(dev); + + pm_runtime_disable(dev); +-- +2.39.2 + diff --git a/queue-6.2/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch b/queue-6.2/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch new file mode 100644 index 00000000000..9817327ef39 --- /dev/null +++ b/queue-6.2/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch @@ -0,0 +1,44 @@ +From f10a2d42633b55a96ac0dd9c0ba4b1ee1d5b392a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 22:02:01 +0200 +Subject: staging: rtl8192e: Fix W_DISABLE# does not work after stop/start + +From: Philipp Hortmann + +[ Upstream commit 3fac2397f562eb669ddc2f45867a253f3fc26184 ] + +When loading the driver for rtl8192e, the W_DISABLE# switch is working as +intended. But when the WLAN is turned off in software and then turned on +again the W_DISABLE# does not work anymore. Reason for this is that in +the function _rtl92e_dm_check_rf_ctrl_gpio() the bfirst_after_down is +checked and returned when true. bfirst_after_down is set true when +switching the WLAN off in software. But it is not set to false again +when WLAN is turned on again. + +Add bfirst_after_down = false in _rtl92e_sta_up to reset bit and fix +above described bug. + +Fixes: 94a799425eee ("From: wlanfae [PATCH 1/8] rtl8192e: Import new version of driver from realtek") +Signed-off-by: Philipp Hortmann +Link: https://lore.kernel.org/r/20230418200201.GA17398@matrix-ESPRIMO-P710 +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +index f8fbe78ccad9f..699ee7754428c 100644 +--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c ++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +@@ -716,6 +716,7 @@ static int _rtl92e_sta_up(struct net_device *dev, bool is_silent_reset) + else + netif_wake_queue(dev); + ++ priv->bfirst_after_down = false; + return 0; + } + +-- +2.39.2 + diff --git a/queue-6.2/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch b/queue-6.2/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch new file mode 100644 index 00000000000..610e7a082cb --- /dev/null +++ b/queue-6.2/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch @@ -0,0 +1,74 @@ +From 1a82b71a013533e3e40a04c8c90ed3c28d00c306 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 13:19:02 -0700 +Subject: SUNRPC: remove the maximum number of retries in call_bind_status + +From: Dai Ngo + +[ Upstream commit 691d0b782066a6eeeecbfceb7910a8f6184e6105 ] + +Currently call_bind_status places a hard limit of 3 to the number of +retries on EACCES error. This limit was done to prevent NLM unlock +requests from being hang forever when the server keeps returning garbage. +However this change causes problem for cases when NLM service takes +longer than 9 seconds to register with the port mapper after a restart. + +This patch removes this hard coded limit and let the RPC handles +the retry based on the standard hard/soft task semantics. + +Fixes: 0b760113a3a1 ("NLM: Don't hang forever on NLM unlock requests") +Reported-by: Helen Chao +Tested-by: Helen Chao +Signed-off-by: Dai Ngo +Reviewed-by: Jeff Layton +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + include/linux/sunrpc/sched.h | 3 +-- + net/sunrpc/clnt.c | 3 --- + net/sunrpc/sched.c | 1 - + 3 files changed, 1 insertion(+), 6 deletions(-) + +diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h +index b8ca3ecaf8d76..8ada7dc802d30 100644 +--- a/include/linux/sunrpc/sched.h ++++ b/include/linux/sunrpc/sched.h +@@ -90,8 +90,7 @@ struct rpc_task { + #endif + unsigned char tk_priority : 2,/* Task priority */ + tk_garb_retry : 2, +- tk_cred_retry : 2, +- tk_rebind_retry : 2; ++ tk_cred_retry : 2; + }; + + typedef void (*rpc_action)(struct rpc_task *); +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index fd7e1c630493e..d2ee566343083 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -2050,9 +2050,6 @@ call_bind_status(struct rpc_task *task) + status = -EOPNOTSUPP; + break; + } +- if (task->tk_rebind_retry == 0) +- break; +- task->tk_rebind_retry--; + rpc_delay(task, 3*HZ); + goto retry_timeout; + case -ENOBUFS: +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index be587a308e05a..c8321de341eea 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -817,7 +817,6 @@ rpc_init_task_statistics(struct rpc_task *task) + /* Initialize retry counters */ + task->tk_garb_retry = 2; + task->tk_cred_retry = 2; +- task->tk_rebind_retry = 2; + + /* starting timestamp */ + task->tk_start = ktime_get(); +-- +2.39.2 + diff --git a/queue-6.2/swiotlb-fix-debugfs-reporting-of-reserved-memory-poo.patch b/queue-6.2/swiotlb-fix-debugfs-reporting-of-reserved-memory-poo.patch new file mode 100644 index 00000000000..da0d7470ce7 --- /dev/null +++ b/queue-6.2/swiotlb-fix-debugfs-reporting-of-reserved-memory-poo.patch @@ -0,0 +1,48 @@ +From 6af420b3ea8684cdaa27fadf83d90ba44d04fd5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 08:37:30 -0700 +Subject: swiotlb: fix debugfs reporting of reserved memory pools + +From: Michael Kelley + +[ Upstream commit 5499d01c029069044a3b3e50501c77b474c96178 ] + +For io_tlb_nslabs, the debugfs code reports the correct value for a +specific reserved memory pool. But for io_tlb_used, the value reported +is always for the default pool, not the specific reserved pool. Fix this. + +Fixes: 5c850d31880e ("swiotlb: fix passing local variable to debugfs_create_ulong()") +Signed-off-by: Michael Kelley +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/swiotlb.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c +index 465cd2b5481f1..81f40821084ec 100644 +--- a/kernel/dma/swiotlb.c ++++ b/kernel/dma/swiotlb.c +@@ -935,7 +935,9 @@ EXPORT_SYMBOL_GPL(is_swiotlb_active); + + static int io_tlb_used_get(void *data, u64 *val) + { +- *val = mem_used(&io_tlb_default_mem); ++ struct io_tlb_mem *mem = data; ++ ++ *val = mem_used(mem); + return 0; + } + DEFINE_DEBUGFS_ATTRIBUTE(fops_io_tlb_used, io_tlb_used_get, NULL, "%llu\n"); +@@ -948,7 +950,7 @@ static void swiotlb_create_debugfs_files(struct io_tlb_mem *mem, + return; + + debugfs_create_ulong("io_tlb_nslabs", 0400, mem->debugfs, &mem->nslabs); +- debugfs_create_file("io_tlb_used", 0400, mem->debugfs, NULL, ++ debugfs_create_file("io_tlb_used", 0400, mem->debugfs, mem, + &fops_io_tlb_used); + } + +-- +2.39.2 + diff --git a/queue-6.2/swiotlb-relocate-pagehighmem-test-away-from-rmem_swi.patch b/queue-6.2/swiotlb-relocate-pagehighmem-test-away-from-rmem_swi.patch new file mode 100644 index 00000000000..ccbb7145ae9 --- /dev/null +++ b/queue-6.2/swiotlb-relocate-pagehighmem-test-away-from-rmem_swi.patch @@ -0,0 +1,65 @@ +From 94553451e7bf5adc39f50462283786e0a4d8949e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 14:29:25 -0700 +Subject: swiotlb: relocate PageHighMem test away from rmem_swiotlb_setup + +From: Doug Berger + +[ Upstream commit a90922fa25370902322e9de6640e58737d459a50 ] + +The reservedmem_of_init_fn's are invoked very early at boot before the +memory zones have even been defined. This makes it inappropriate to test +whether the page corresponding to a PFN is in ZONE_HIGHMEM from within +one. + +Removing the check allows an ARM 32-bit kernel with SPARSEMEM enabled to +boot properly since otherwise we would be de-referencing an +uninitialized sparsemem map to perform pfn_to_page() check. + +The arm64 architecture happens to work (and also has no high memory) but +other 32-bit architectures could also be having similar issues. + +While it would be nice to provide early feedback about a reserved DMA +pool residing in highmem, it is not possible to do that until the first +time we try to use it, which is where the check is moved to. + +Fixes: 0b84e4f8b793 ("swiotlb: Add restricted DMA pool initialization") +Signed-off-by: Doug Berger +Signed-off-by: Florian Fainelli +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/swiotlb.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c +index ef3bc3a5bbed3..465cd2b5481f1 100644 +--- a/kernel/dma/swiotlb.c ++++ b/kernel/dma/swiotlb.c +@@ -1003,6 +1003,11 @@ static int rmem_swiotlb_device_init(struct reserved_mem *rmem, + /* Set Per-device io tlb area to one */ + unsigned int nareas = 1; + ++ if (PageHighMem(pfn_to_page(PHYS_PFN(rmem->base)))) { ++ dev_err(dev, "Restricted DMA pool must be accessible within the linear mapping."); ++ return -EINVAL; ++ } ++ + /* + * Since multiple devices can share the same pool, the private data, + * io_tlb_mem struct, will be initialized by the first device attached +@@ -1064,11 +1069,6 @@ static int __init rmem_swiotlb_setup(struct reserved_mem *rmem) + of_get_flat_dt_prop(node, "no-map", NULL)) + return -EINVAL; + +- if (PageHighMem(pfn_to_page(PHYS_PFN(rmem->base)))) { +- pr_err("Restricted DMA pool must be accessible within the linear mapping."); +- return -EINVAL; +- } +- + rmem->ops = &rmem_swiotlb_ops; + pr_info("Reserved memory: created restricted DMA pool at %pa, size %ld MiB\n", + &rmem->base, (unsigned long)rmem->size / SZ_1M); +-- +2.39.2 + diff --git a/queue-6.2/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch b/queue-6.2/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch new file mode 100644 index 00000000000..2c3f43638a4 --- /dev/null +++ b/queue-6.2/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch @@ -0,0 +1,125 @@ +From 01ea7b91dbffed955a45b58b70f1d971dc3a7353 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 15:20:22 -0700 +Subject: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. + +From: Kuniyuki Iwashima + +[ Upstream commit 50749f2dd6854a41830996ad302aef2ffaf011d8 ] + +syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY +skbs. We can reproduce the problem with these sequences: + + sk = socket(AF_INET, SOCK_DGRAM, 0) + sk.setsockopt(SOL_SOCKET, SO_TIMESTAMPING, SOF_TIMESTAMPING_TX_SOFTWARE) + sk.setsockopt(SOL_SOCKET, SO_ZEROCOPY, 1) + sk.sendto(b'', MSG_ZEROCOPY, ('127.0.0.1', 53)) + sk.close() + +sendmsg() calls msg_zerocopy_alloc(), which allocates a skb, sets +skb->cb->ubuf.refcnt to 1, and calls sock_hold(). Here, struct +ubuf_info_msgzc indirectly holds a refcnt of the socket. When the +skb is sent, __skb_tstamp_tx() clones it and puts the clone into +the socket's error queue with the TX timestamp. + +When the original skb is received locally, skb_copy_ubufs() calls +skb_unclone(), and pskb_expand_head() increments skb->cb->ubuf.refcnt. +This additional count is decremented while freeing the skb, but struct +ubuf_info_msgzc still has a refcnt, so __msg_zerocopy_callback() is +not called. + +The last refcnt is not released unless we retrieve the TX timestamped +skb by recvmsg(). Since we clear the error queue in inet_sock_destruct() +after the socket's refcnt reaches 0, there is a circular dependency. +If we close() the socket holding such skbs, we never call sock_put() +and leak the count, sk, and skb. + +TCP has the same problem, and commit e0c8bccd40fc ("net: stream: +purge sk_error_queue in sk_stream_kill_queues()") tried to fix it +by calling skb_queue_purge() during close(). However, there is a +small chance that skb queued in a qdisc or device could be put +into the error queue after the skb_queue_purge() call. + +In __skb_tstamp_tx(), the cloned skb should not have a reference +to the ubuf to remove the circular dependency, but skb_clone() does +not call skb_copy_ubufs() for zerocopy skb. So, we need to call +skb_orphan_frags_rx() for the cloned skb to call skb_copy_ubufs(). + +[0]: +BUG: memory leak +unreferenced object 0xffff88800c6d2d00 (size 1152): + comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 cd af e8 81 00 00 00 00 ................ + 02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ + backtrace: + [<0000000055636812>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:2024 + [<0000000054d77b7a>] sk_alloc+0x3b/0x800 net/core/sock.c:2083 + [<0000000066f3c7e0>] inet_create net/ipv4/af_inet.c:319 [inline] + [<0000000066f3c7e0>] inet_create+0x31e/0xe40 net/ipv4/af_inet.c:245 + [<000000009b83af97>] __sock_create+0x2ab/0x550 net/socket.c:1515 + [<00000000b9b11231>] sock_create net/socket.c:1566 [inline] + [<00000000b9b11231>] __sys_socket_create net/socket.c:1603 [inline] + [<00000000b9b11231>] __sys_socket_create net/socket.c:1588 [inline] + [<00000000b9b11231>] __sys_socket+0x138/0x250 net/socket.c:1636 + [<000000004fb45142>] __do_sys_socket net/socket.c:1649 [inline] + [<000000004fb45142>] __se_sys_socket net/socket.c:1647 [inline] + [<000000004fb45142>] __x64_sys_socket+0x73/0xb0 net/socket.c:1647 + [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] + [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 + [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +BUG: memory leak +unreferenced object 0xffff888017633a00 (size 240): + comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 2d 6d 0c 80 88 ff ff .........-m..... + backtrace: + [<000000002b1c4368>] __alloc_skb+0x229/0x320 net/core/skbuff.c:497 + [<00000000143579a6>] alloc_skb include/linux/skbuff.h:1265 [inline] + [<00000000143579a6>] sock_omalloc+0xaa/0x190 net/core/sock.c:2596 + [<00000000be626478>] msg_zerocopy_alloc net/core/skbuff.c:1294 [inline] + [<00000000be626478>] msg_zerocopy_realloc+0x1ce/0x7f0 net/core/skbuff.c:1370 + [<00000000cbfc9870>] __ip_append_data+0x2adf/0x3b30 net/ipv4/ip_output.c:1037 + [<0000000089869146>] ip_make_skb+0x26c/0x2e0 net/ipv4/ip_output.c:1652 + [<00000000098015c2>] udp_sendmsg+0x1bac/0x2390 net/ipv4/udp.c:1253 + [<0000000045e0e95e>] inet_sendmsg+0x10a/0x150 net/ipv4/af_inet.c:819 + [<000000008d31bfde>] sock_sendmsg_nosec net/socket.c:714 [inline] + [<000000008d31bfde>] sock_sendmsg+0x141/0x190 net/socket.c:734 + [<0000000021e21aa4>] __sys_sendto+0x243/0x360 net/socket.c:2117 + [<00000000ac0af00c>] __do_sys_sendto net/socket.c:2129 [inline] + [<00000000ac0af00c>] __se_sys_sendto net/socket.c:2125 [inline] + [<00000000ac0af00c>] __x64_sys_sendto+0xe1/0x1c0 net/socket.c:2125 + [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] + [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 + [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: f214f915e7db ("tcp: enable MSG_ZEROCOPY") +Fixes: b5947e5d1e71 ("udp: msg_zerocopy") +Reported-by: syzbot +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/skbuff.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 43e1b89695c22..6f5ef18a8b772 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -5038,6 +5038,9 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb, + skb = alloc_skb(0, GFP_ATOMIC); + } else { + skb = skb_clone(orig_skb, GFP_ATOMIC); ++ ++ if (skb_orphan_frags_rx(skb, GFP_ATOMIC)) ++ return; + } + if (!skb) + return; +-- +2.39.2 + diff --git a/queue-6.2/thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch b/queue-6.2/thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch new file mode 100644 index 00000000000..ffa4635e78c --- /dev/null +++ b/queue-6.2/thermal-drivers-mediatek-use-devm_of_iomap-to-avoid-.patch @@ -0,0 +1,63 @@ +From 17ed8185d4ca98275b42c368729fa949cf8005ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 10:07:48 +0800 +Subject: thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in + mtk_thermal_probe + +From: Kang Chen + +[ Upstream commit f05c7b7d9ea9477fcc388476c6f4ade8c66d2d26 ] + +Smatch reports: +1. mtk_thermal_probe() warn: 'apmixed_base' from of_iomap() not released. +2. mtk_thermal_probe() warn: 'auxadc_base' from of_iomap() not released. + +The original code forgets to release iomap resource when handling errors, +fix it by switch to devm_of_iomap. + +Fixes: 89945047b166 ("thermal: mediatek: Add tsensor support for V2 thermal system") +Signed-off-by: Kang Chen +Reviewed-by: Dongliang Mu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20230419020749.621257-1-void0red@hust.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/thermal/mtk_thermal.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c +index 8440692e3890d..62f1e691659e3 100644 +--- a/drivers/thermal/mtk_thermal.c ++++ b/drivers/thermal/mtk_thermal.c +@@ -1028,7 +1028,12 @@ static int mtk_thermal_probe(struct platform_device *pdev) + return -ENODEV; + } + +- auxadc_base = of_iomap(auxadc, 0); ++ auxadc_base = devm_of_iomap(&pdev->dev, auxadc, 0, NULL); ++ if (IS_ERR(auxadc_base)) { ++ of_node_put(auxadc); ++ return PTR_ERR(auxadc_base); ++ } ++ + auxadc_phys_base = of_get_phys_base(auxadc); + + of_node_put(auxadc); +@@ -1044,7 +1049,12 @@ static int mtk_thermal_probe(struct platform_device *pdev) + return -ENODEV; + } + +- apmixed_base = of_iomap(apmixedsys, 0); ++ apmixed_base = devm_of_iomap(&pdev->dev, apmixedsys, 0, NULL); ++ if (IS_ERR(apmixed_base)) { ++ of_node_put(apmixedsys); ++ return PTR_ERR(apmixed_base); ++ } ++ + apmixed_phys_base = of_get_phys_base(apmixedsys); + + of_node_put(apmixedsys); +-- +2.39.2 + diff --git a/queue-6.2/tick-common-align-tick-period-with-the-hz-tick.patch b/queue-6.2/tick-common-align-tick-period-with-the-hz-tick.patch new file mode 100644 index 00000000000..d6b0ada6763 --- /dev/null +++ b/queue-6.2/tick-common-align-tick-period-with-the-hz-tick.patch @@ -0,0 +1,67 @@ +From 7ce94efb5d7360dead95f3fbf057d21f970b61eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 14:26:39 +0200 +Subject: tick/common: Align tick period with the HZ tick. + +From: Sebastian Andrzej Siewior + +[ Upstream commit e9523a0d81899361214d118ad60ef76f0e92f71d ] + +With HIGHRES enabled tick_sched_timer() is programmed every jiffy to +expire the timer_list timers. This timer is programmed accurate in +respect to CLOCK_MONOTONIC so that 0 seconds and nanoseconds is the +first tick and the next one is 1000/CONFIG_HZ ms later. For HZ=250 it is +every 4 ms and so based on the current time the next tick can be +computed. + +This accuracy broke since the commit mentioned below because the jiffy +based clocksource is initialized with higher accuracy in +read_persistent_wall_and_boot_offset(). This higher accuracy is +inherited during the setup in tick_setup_device(). The timer still fires +every 4ms with HZ=250 but timer is no longer aligned with +CLOCK_MONOTONIC with 0 as it origin but has an offset in the us/ns part +of the timestamp. The offset differs with every boot and makes it +impossible for user land to align with the tick. + +Align the tick period with CLOCK_MONOTONIC ensuring that it is always a +multiple of 1000/CONFIG_HZ ms. + +Fixes: 857baa87b6422 ("sched/clock: Enable sched clock early") +Reported-by: Gusenleitner Klaus +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/20230406095735.0_14edn3@linutronix.de +Link: https://lore.kernel.org/r/20230418122639.ikgfvu3f@linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/time/tick-common.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c +index 46789356f856e..65b8658da829e 100644 +--- a/kernel/time/tick-common.c ++++ b/kernel/time/tick-common.c +@@ -218,9 +218,19 @@ static void tick_setup_device(struct tick_device *td, + * this cpu: + */ + if (tick_do_timer_cpu == TICK_DO_TIMER_BOOT) { ++ ktime_t next_p; ++ u32 rem; ++ + tick_do_timer_cpu = cpu; + +- tick_next_period = ktime_get(); ++ next_p = ktime_get(); ++ div_u64_rem(next_p, TICK_NSEC, &rem); ++ if (rem) { ++ next_p -= rem; ++ next_p += TICK_NSEC; ++ } ++ ++ tick_next_period = next_p; + #ifdef CONFIG_NO_HZ_FULL + /* + * The boot CPU may be nohz_full, in which case set +-- +2.39.2 + diff --git a/queue-6.2/timekeeping-fix-references-to-nonexistent-ktime_get_.patch b/queue-6.2/timekeeping-fix-references-to-nonexistent-ktime_get_.patch new file mode 100644 index 00000000000..10ce44b6def --- /dev/null +++ b/queue-6.2/timekeeping-fix-references-to-nonexistent-ktime_get_.patch @@ -0,0 +1,47 @@ +From 0be371532cabb22be16bca34964feaf05b94921d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 15:43:34 +0200 +Subject: timekeeping: Fix references to nonexistent ktime_get_fast_ns() + +From: Geert Uytterhoeven + +[ Upstream commit 158009f1b4a33bc0f354b994eea361362bd83226 ] + +There was never a function named ktime_get_fast_ns(). +Presumably these should refer to ktime_get_mono_fast_ns() instead. + +Fixes: c1ce406e80fb15fa ("timekeeping: Fix up function documentation for the NMI safe accessors") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Thomas Gleixner +Acked-by: John Stultz +Link: https://lore.kernel.org/r/06df7b3cbd94f016403bbf6cd2b38e4368e7468f.1682516546.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + kernel/time/timekeeping.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index 5579ead449f25..09d594900ee0b 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -526,7 +526,7 @@ EXPORT_SYMBOL_GPL(ktime_get_raw_fast_ns); + * partially updated. Since the tk->offs_boot update is a rare event, this + * should be a rare occurrence which postprocessing should be able to handle. + * +- * The caveats vs. timestamp ordering as documented for ktime_get_fast_ns() ++ * The caveats vs. timestamp ordering as documented for ktime_get_mono_fast_ns() + * apply as well. + */ + u64 notrace ktime_get_boot_fast_ns(void) +@@ -576,7 +576,7 @@ static __always_inline u64 __ktime_get_real_fast(struct tk_fast *tkf, u64 *mono) + /** + * ktime_get_real_fast_ns: - NMI safe and fast access to clock realtime. + * +- * See ktime_get_fast_ns() for documentation of the time stamp ordering. ++ * See ktime_get_mono_fast_ns() for documentation of the time stamp ordering. + */ + u64 ktime_get_real_fast_ns(void) + { +-- +2.39.2 + diff --git a/queue-6.2/tools-bpftool-remove-invalid-json-escape.patch b/queue-6.2/tools-bpftool-remove-invalid-json-escape.patch new file mode 100644 index 00000000000..03791889a7e --- /dev/null +++ b/queue-6.2/tools-bpftool-remove-invalid-json-escape.patch @@ -0,0 +1,53 @@ +From 6b20f56f980fb1ae37307c7f15d171a7448dd942 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 16:08:54 +0100 +Subject: tools: bpftool: Remove invalid \' json escape + +From: Luis Gerhorst + +[ Upstream commit c679bbd611c08b0559ffae079330bc4e5574696a ] + +RFC8259 ("The JavaScript Object Notation (JSON) Data Interchange +Format") only specifies \", \\, \/, \b, \f, \n, \r, and \r as valid +two-character escape sequences. This does not include \', which is not +required in JSON because it exclusively uses double quotes as string +separators. + +Solidus (/) may be escaped, but does not have to. Only reverse +solidus (\), double quotes ("), and the control characters have to be +escaped. Therefore, with this fix, bpftool correctly supports all valid +two-character escape sequences (but still does not support characters +that require multi-character escape sequences). + +Witout this fix, attempting to load a JSON file generated by bpftool +using Python 3.10.6's default json.load() may fail with the error +"Invalid \escape" if the file contains the invalid escaped single +quote (\'). + +Fixes: b66e907cfee2 ("tools: bpftool: copy JSON writer from iproute2 repository") +Signed-off-by: Luis Gerhorst +Signed-off-by: Andrii Nakryiko +Reviewed-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20230227150853.16863-1-gerhorst@cs.fau.de +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/json_writer.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/tools/bpf/bpftool/json_writer.c b/tools/bpf/bpftool/json_writer.c +index 7fea83bedf488..bca5dd0a59e34 100644 +--- a/tools/bpf/bpftool/json_writer.c ++++ b/tools/bpf/bpftool/json_writer.c +@@ -80,9 +80,6 @@ static void jsonw_puts(json_writer_t *self, const char *str) + case '"': + fputs("\\\"", self->out); + break; +- case '\'': +- fputs("\\\'", self->out); +- break; + default: + putc(*str, self->out); + } +-- +2.39.2 + diff --git a/queue-6.2/tools-x86-kcpuid-fix-avx512bw-and-avx512lvl-fields-i.patch b/queue-6.2/tools-x86-kcpuid-fix-avx512bw-and-avx512lvl-fields-i.patch new file mode 100644 index 00000000000..5024b2d9267 --- /dev/null +++ b/queue-6.2/tools-x86-kcpuid-fix-avx512bw-and-avx512lvl-fields-i.patch @@ -0,0 +1,41 @@ +From 436897b87b691f050ed327037d4b34595f7a4f71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 08:18:30 -0600 +Subject: tools/x86/kcpuid: Fix avx512bw and avx512lvl fields in Fn00000007 + +From: Terry Bowman + +[ Upstream commit 4e347bdf44c1fd4296a7b9657a2c0e1bd900fa50 ] + +Leaf Fn00000007 contains avx512bw at bit 26 and avx512vl at bit 28. This +is incorrect per the SDM. Correct avx512bw to be bit 30 and avx512lvl to +be bit 31. + +Fixes: c6b2f240bf8d ("tools/x86: Add a kcpuid tool to show raw CPU features") +Signed-off-by: Terry Bowman +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Feng Tang +Link: https://lore.kernel.org/r/20230206141832.4162264-2-terry.bowman@amd.com +Signed-off-by: Sasha Levin +--- + tools/arch/x86/kcpuid/cpuid.csv | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/arch/x86/kcpuid/cpuid.csv b/tools/arch/x86/kcpuid/cpuid.csv +index 4f1c4b0c29e98..9914bdf4fc9ec 100644 +--- a/tools/arch/x86/kcpuid/cpuid.csv ++++ b/tools/arch/x86/kcpuid/cpuid.csv +@@ -184,8 +184,8 @@ + 7, 0, EBX, 27, avx512er, AVX512 Exponent Reciproca instr + 7, 0, EBX, 28, avx512cd, AVX512 Conflict Detection instr + 7, 0, EBX, 29, sha, Intel Secure Hash Algorithm Extensions instr +- 7, 0, EBX, 26, avx512bw, AVX512 Byte & Word instr +- 7, 0, EBX, 28, avx512vl, AVX512 Vector Length Extentions (VL) ++ 7, 0, EBX, 30, avx512bw, AVX512 Byte & Word instr ++ 7, 0, EBX, 31, avx512vl, AVX512 Vector Length Extentions (VL) + 7, 0, ECX, 0, prefetchwt1, X + 7, 0, ECX, 1, avx512vbmi, AVX512 Vector Byte Manipulation Instructions + 7, 0, ECX, 2, umip, User-mode Instruction Prevention +-- +2.39.2 + diff --git a/queue-6.2/tpm-tpm-implement-usage-counter-for-locality.patch b/queue-6.2/tpm-tpm-implement-usage-counter-for-locality.patch new file mode 100644 index 00000000000..fb17650be61 --- /dev/null +++ b/queue-6.2/tpm-tpm-implement-usage-counter-for-locality.patch @@ -0,0 +1,235 @@ +From 2a29d29a58dd7514609f8de7e18a6032a7ce16d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:33 +0100 +Subject: tpm, tpm: Implement usage counter for locality +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lino Sanfilippo + +[ Upstream commit 7a2f55d0be296c4e81fd782f3d6c43ed4ec7e265 ] + +Implement a usage counter for the (default) locality used by the TPM TIS +driver: +Request the locality from the TPM if it has not been claimed yet, otherwise +only increment the counter. Also release the locality if the counter is 0 +otherwise only decrement the counter. Since in case of SPI the register +accesses are locked by means of the SPI bus mutex use a sleepable lock +(i.e. also a mutex) to ensure thread-safety of the counter which may be +accessed by both a userspace thread and the interrupt handler. + +By doing this refactor the names of the amended functions to use a more +appropriate prefix. + +Signed-off-by: Lino Sanfilippo +Tested-by: Michael Niewöhner +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume") +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 63 +++++++++++++++++++++++---------- + drivers/char/tpm/tpm_tis_core.h | 2 ++ + 2 files changed, 47 insertions(+), 18 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 39f27edb32879..c5fef63c6179d 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -136,16 +136,27 @@ static bool check_locality(struct tpm_chip *chip, int l) + return false; + } + +-static int release_locality(struct tpm_chip *chip, int l) ++static int __tpm_tis_relinquish_locality(struct tpm_tis_data *priv, int l) ++{ ++ tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY); ++ ++ return 0; ++} ++ ++static int tpm_tis_relinquish_locality(struct tpm_chip *chip, int l) + { + struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); + +- tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY); ++ mutex_lock(&priv->locality_count_mutex); ++ priv->locality_count--; ++ if (priv->locality_count == 0) ++ __tpm_tis_relinquish_locality(priv, l); ++ mutex_unlock(&priv->locality_count_mutex); + + return 0; + } + +-static int request_locality(struct tpm_chip *chip, int l) ++static int __tpm_tis_request_locality(struct tpm_chip *chip, int l) + { + struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); + unsigned long stop, timeout; +@@ -186,6 +197,20 @@ static int request_locality(struct tpm_chip *chip, int l) + return -1; + } + ++static int tpm_tis_request_locality(struct tpm_chip *chip, int l) ++{ ++ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); ++ int ret = 0; ++ ++ mutex_lock(&priv->locality_count_mutex); ++ if (priv->locality_count == 0) ++ ret = __tpm_tis_request_locality(chip, l); ++ if (!ret) ++ priv->locality_count++; ++ mutex_unlock(&priv->locality_count_mutex); ++ return ret; ++} ++ + static u8 tpm_tis_status(struct tpm_chip *chip) + { + struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); +@@ -652,7 +677,7 @@ static int probe_itpm(struct tpm_chip *chip) + if (vendor != TPM_VID_INTEL) + return 0; + +- if (request_locality(chip, 0) != 0) ++ if (tpm_tis_request_locality(chip, 0) != 0) + return -EBUSY; + + rc = tpm_tis_send_data(chip, cmd_getticks, len); +@@ -673,7 +698,7 @@ static int probe_itpm(struct tpm_chip *chip) + + out: + tpm_tis_ready(chip); +- release_locality(chip, priv->locality); ++ tpm_tis_relinquish_locality(chip, priv->locality); + + return rc; + } +@@ -765,14 +790,14 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + } + priv->irq = irq; + +- rc = request_locality(chip, 0); ++ rc = tpm_tis_request_locality(chip, 0); + if (rc < 0) + return rc; + + rc = tpm_tis_read8(priv, TPM_INT_VECTOR(priv->locality), + &original_int_vec); + if (rc < 0) { +- release_locality(chip, priv->locality); ++ tpm_tis_relinquish_locality(chip, priv->locality); + return rc; + } + +@@ -811,7 +836,7 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + rc = -1; + } + +- release_locality(chip, priv->locality); ++ tpm_tis_relinquish_locality(chip, priv->locality); + + return rc; + } +@@ -927,8 +952,8 @@ static const struct tpm_class_ops tpm_tis = { + .req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID, + .req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID, + .req_canceled = tpm_tis_req_canceled, +- .request_locality = request_locality, +- .relinquish_locality = release_locality, ++ .request_locality = tpm_tis_request_locality, ++ .relinquish_locality = tpm_tis_relinquish_locality, + .clk_enable = tpm_tis_clkrun_enable, + }; + +@@ -962,6 +987,8 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + priv->timeout_min = TPM_TIMEOUT_USECS_MIN; + priv->timeout_max = TPM_TIMEOUT_USECS_MAX; + priv->phy_ops = phy_ops; ++ priv->locality_count = 0; ++ mutex_init(&priv->locality_count_mutex); + + dev_set_drvdata(&chip->dev, priv); + +@@ -1008,14 +1035,14 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT; + intmask &= ~TPM_GLOBAL_INT_ENABLE; + +- rc = request_locality(chip, 0); ++ rc = tpm_tis_request_locality(chip, 0); + if (rc < 0) { + rc = -ENODEV; + goto out_err; + } + + tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask); +- release_locality(chip, 0); ++ tpm_tis_relinquish_locality(chip, 0); + + rc = tpm_chip_start(chip); + if (rc) +@@ -1075,13 +1102,13 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + * proper timeouts for the driver. + */ + +- rc = request_locality(chip, 0); ++ rc = tpm_tis_request_locality(chip, 0); + if (rc < 0) + goto out_err; + + rc = tpm_get_timeouts(chip); + +- release_locality(chip, 0); ++ tpm_tis_relinquish_locality(chip, 0); + + if (rc) { + dev_err(dev, "Could not get TPM timeouts and durations\n"); +@@ -1099,11 +1126,11 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + dev_err(&chip->dev, FW_BUG + "TPM interrupt not working, polling instead\n"); + +- rc = request_locality(chip, 0); ++ rc = tpm_tis_request_locality(chip, 0); + if (rc < 0) + goto out_err; + disable_interrupts(chip); +- release_locality(chip, 0); ++ tpm_tis_relinquish_locality(chip, 0); + } + } + +@@ -1176,13 +1203,13 @@ int tpm_tis_resume(struct device *dev) + * an error code but for unknown reason it isn't handled. + */ + if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) { +- ret = request_locality(chip, 0); ++ ret = tpm_tis_request_locality(chip, 0); + if (ret < 0) + return ret; + + tpm1_do_selftest(chip); + +- release_locality(chip, 0); ++ tpm_tis_relinquish_locality(chip, 0); + } + + return 0; +diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h +index b68479e0de10f..1d51d5168fb6e 100644 +--- a/drivers/char/tpm/tpm_tis_core.h ++++ b/drivers/char/tpm/tpm_tis_core.h +@@ -91,6 +91,8 @@ enum tpm_tis_flags { + + struct tpm_tis_data { + u16 manufacturer_id; ++ struct mutex locality_count_mutex; ++ unsigned int locality_count; + int locality; + int irq; + bool irq_tested; +-- +2.39.2 + diff --git a/queue-6.2/tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch b/queue-6.2/tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch new file mode 100644 index 00000000000..3b958825dda --- /dev/null +++ b/queue-6.2/tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch @@ -0,0 +1,85 @@ +From ef35e94235050f213b09f061f757356616c202a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:29 +0100 +Subject: tpm, tpm_tis: Claim locality before writing interrupt registers + +From: Lino Sanfilippo + +[ Upstream commit 15d7aa4e46eba87242a320f39773aa16faddadee ] + +In tpm_tis_probe_single_irq() interrupt registers TPM_INT_VECTOR, +TPM_INT_STATUS and TPM_INT_ENABLE are modified to setup the interrupts. +Currently these modifications are done without holding a locality thus they +have no effect. Fix this by claiming the (default) locality before the +registers are written. + +Since now tpm_tis_gen_interrupt() is called with the locality already +claimed remove locality request and release from this function. + +Signed-off-by: Lino Sanfilippo +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume") +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 4e6075d4e2643..39f27edb32879 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -739,16 +739,10 @@ static void tpm_tis_gen_interrupt(struct tpm_chip *chip) + cap_t cap; + int ret; + +- ret = request_locality(chip, 0); +- if (ret < 0) +- return; +- + if (chip->flags & TPM_CHIP_FLAG_TPM2) + ret = tpm2_get_tpm_pt(chip, 0x100, &cap2, desc); + else + ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0); +- +- release_locality(chip, 0); + } + + /* Register the IRQ and issue a command that will cause an interrupt. If an +@@ -771,10 +765,16 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + } + priv->irq = irq; + ++ rc = request_locality(chip, 0); ++ if (rc < 0) ++ return rc; ++ + rc = tpm_tis_read8(priv, TPM_INT_VECTOR(priv->locality), + &original_int_vec); +- if (rc < 0) ++ if (rc < 0) { ++ release_locality(chip, priv->locality); + return rc; ++ } + + rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), irq); + if (rc < 0) +@@ -808,10 +808,12 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { + tpm_tis_write8(priv, original_int_vec, + TPM_INT_VECTOR(priv->locality)); +- return -1; ++ rc = -1; + } + +- return 0; ++ release_locality(chip, priv->locality); ++ ++ return rc; + } + + /* Try to find the IRQ the TPM is using. This is for legacy x86 systems that +-- +2.39.2 + diff --git a/queue-6.2/tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch b/queue-6.2/tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch new file mode 100644 index 00000000000..fae37283481 --- /dev/null +++ b/queue-6.2/tpm-tpm_tis-claim-locality-before-writing-tpm_int_en.patch @@ -0,0 +1,47 @@ +From 85aec2466cd7a48b6c85a33eef0c5220e62edefc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:26 +0100 +Subject: tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lino Sanfilippo + +[ Upstream commit 282657a8bd7fddcf511b834f43705001668b33a7 ] + +In disable_interrupts() the TPM_GLOBAL_INT_ENABLE bit is unset in the +TPM_INT_ENABLE register to shut the interrupts off. However modifying the +register is only possible with a held locality. So claim the locality +before disable_interrupts() is called. + +Signed-off-by: Lino Sanfilippo +Tested-by: Michael Niewöhner +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume") +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 33d98f3e0f7a6..a2cbf9b6f4c92 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -1094,7 +1094,11 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + dev_err(&chip->dev, FW_BUG + "TPM interrupt not working, polling instead\n"); + ++ rc = request_locality(chip, 0); ++ if (rc < 0) ++ goto out_err; + disable_interrupts(chip); ++ release_locality(chip, 0); + } + } else { + tpm_tis_probe_irq(chip, intmask); +-- +2.39.2 + diff --git a/queue-6.2/tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch b/queue-6.2/tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch new file mode 100644 index 00000000000..d1756198ca4 --- /dev/null +++ b/queue-6.2/tpm-tpm_tis-claim-locality-when-interrupts-are-reena.patch @@ -0,0 +1,68 @@ +From 7cf5065d9ff010fea2a0f97d5fb71bc44d0a4f26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:36 +0100 +Subject: tpm, tpm_tis: Claim locality when interrupts are reenabled on resume + +From: Lino Sanfilippo + +[ Upstream commit 955df4f87760b3bb2af253d3fbb12fb712b3ffa6 ] + +In tpm_tis_resume() make sure that the locality has been claimed when +tpm_tis_reenable_interrupts() is called. Otherwise the writings to the +register might not have any effect. + +Fixes: 45baa1d1fa39 ("tpm_tis: Re-enable interrupts upon (S3) resume") +Signed-off-by: Lino Sanfilippo +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index c5fef63c6179d..eecfbd7e97867 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -1191,28 +1191,27 @@ int tpm_tis_resume(struct device *dev) + struct tpm_chip *chip = dev_get_drvdata(dev); + int ret; + ++ ret = tpm_tis_request_locality(chip, 0); ++ if (ret < 0) ++ return ret; ++ + if (chip->flags & TPM_CHIP_FLAG_IRQ) + tpm_tis_reenable_interrupts(chip); + + ret = tpm_pm_resume(dev); + if (ret) +- return ret; ++ goto out; + + /* + * TPM 1.2 requires self-test on resume. This function actually returns + * an error code but for unknown reason it isn't handled. + */ +- if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) { +- ret = tpm_tis_request_locality(chip, 0); +- if (ret < 0) +- return ret; +- ++ if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) + tpm1_do_selftest(chip); ++out: ++ tpm_tis_relinquish_locality(chip, 0); + +- tpm_tis_relinquish_locality(chip, 0); +- } +- +- return 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(tpm_tis_resume); + #endif +-- +2.39.2 + diff --git a/queue-6.2/tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch b/queue-6.2/tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch new file mode 100644 index 00000000000..abf41299a7d --- /dev/null +++ b/queue-6.2/tpm-tpm_tis-disable-interrupts-if-tpm_tis_probe_irq-.patch @@ -0,0 +1,69 @@ +From 9688ad8fe49b8e1212aed018a1e65811163f80d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:27 +0100 +Subject: tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lino Sanfilippo + +[ Upstream commit 6d789ad726950e612a7f31044260337237c5b490 ] + +Both functions tpm_tis_probe_irq_single() and tpm_tis_probe_irq() may setup +the interrupts and then return with an error. This case is indicated by a +missing TPM_CHIP_FLAG_IRQ flag in chip->flags. +Currently the interrupt setup is only undone if tpm_tis_probe_irq_single() +fails. Undo the setup also if tpm_tis_probe_irq() fails. + +Signed-off-by: Lino Sanfilippo +Tested-by: Michael Niewöhner +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume") +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index a2cbf9b6f4c92..4e6075d4e2643 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -1087,21 +1087,21 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + goto out_err; + } + +- if (irq) { ++ if (irq) + tpm_tis_probe_irq_single(chip, intmask, IRQF_SHARED, + irq); +- if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { +- dev_err(&chip->dev, FW_BUG ++ else ++ tpm_tis_probe_irq(chip, intmask); ++ ++ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { ++ dev_err(&chip->dev, FW_BUG + "TPM interrupt not working, polling instead\n"); + +- rc = request_locality(chip, 0); +- if (rc < 0) +- goto out_err; +- disable_interrupts(chip); +- release_locality(chip, 0); +- } +- } else { +- tpm_tis_probe_irq(chip, intmask); ++ rc = request_locality(chip, 0); ++ if (rc < 0) ++ goto out_err; ++ disable_interrupts(chip); ++ release_locality(chip, 0); + } + } + +-- +2.39.2 + diff --git a/queue-6.2/tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch b/queue-6.2/tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch new file mode 100644 index 00000000000..07150ddb97e --- /dev/null +++ b/queue-6.2/tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch @@ -0,0 +1,113 @@ +From ad244ebcf345950c7cfa1abf51c709f10433708d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:28 +0100 +Subject: tpm, tpm_tis: Do not skip reset of original interrupt vector + +From: Lino Sanfilippo + +[ Upstream commit ed9be0e6c892a783800d77a41ca4c7255c6af8c5 ] + +If in tpm_tis_probe_irq_single() an error occurs after the original +interrupt vector has been read, restore the interrupts before the error is +returned. + +Since the caller does not check the error value, return -1 in any case that +the TPM_CHIP_FLAG_IRQ flag is not set. Since the return value of function +tpm_tis_gen_interrupt() is not longer used, make it a void function. + +Fixes: 1107d065fdf1 ("tpm_tis: Introduce intermediate layer for TPM access") +Signed-off-by: Lino Sanfilippo +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 29 +++++++++++------------------ + 1 file changed, 11 insertions(+), 18 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 3f98e587b3e84..33d98f3e0f7a6 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -732,7 +732,7 @@ static irqreturn_t tis_int_handler(int dummy, void *dev_id) + return IRQ_HANDLED; + } + +-static int tpm_tis_gen_interrupt(struct tpm_chip *chip) ++static void tpm_tis_gen_interrupt(struct tpm_chip *chip) + { + const char *desc = "attempting to generate an interrupt"; + u32 cap2; +@@ -741,7 +741,7 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip) + + ret = request_locality(chip, 0); + if (ret < 0) +- return ret; ++ return; + + if (chip->flags & TPM_CHIP_FLAG_TPM2) + ret = tpm2_get_tpm_pt(chip, 0x100, &cap2, desc); +@@ -749,8 +749,6 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip) + ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0); + + release_locality(chip, 0); +- +- return ret; + } + + /* Register the IRQ and issue a command that will cause an interrupt. If an +@@ -780,42 +778,37 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + + rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), irq); + if (rc < 0) +- return rc; ++ goto restore_irqs; + + rc = tpm_tis_read32(priv, TPM_INT_STATUS(priv->locality), &int_status); + if (rc < 0) +- return rc; ++ goto restore_irqs; + + /* Clear all existing */ + rc = tpm_tis_write32(priv, TPM_INT_STATUS(priv->locality), int_status); + if (rc < 0) +- return rc; +- ++ goto restore_irqs; + /* Turn on */ + rc = tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), + intmask | TPM_GLOBAL_INT_ENABLE); + if (rc < 0) +- return rc; ++ goto restore_irqs; + + priv->irq_tested = false; + + /* Generate an interrupt by having the core call through to + * tpm_tis_send + */ +- rc = tpm_tis_gen_interrupt(chip); +- if (rc < 0) +- return rc; ++ tpm_tis_gen_interrupt(chip); + ++restore_irqs: + /* tpm_tis_send will either confirm the interrupt is working or it + * will call disable_irq which undoes all of the above. + */ + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { +- rc = tpm_tis_write8(priv, original_int_vec, +- TPM_INT_VECTOR(priv->locality)); +- if (rc < 0) +- return rc; +- +- return 1; ++ tpm_tis_write8(priv, original_int_vec, ++ TPM_INT_VECTOR(priv->locality)); ++ return -1; + } + + return 0; +-- +2.39.2 + diff --git a/queue-6.2/tracing-user_events-ensure-write-index-cannot-be-neg.patch b/queue-6.2/tracing-user_events-ensure-write-index-cannot-be-neg.patch new file mode 100644 index 00000000000..fdcef64456f --- /dev/null +++ b/queue-6.2/tracing-user_events-ensure-write-index-cannot-be-neg.patch @@ -0,0 +1,61 @@ +From 9c3a74bd3208566652109977459a54699d909421 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 15:51:04 -0700 +Subject: tracing/user_events: Ensure write index cannot be negative + +From: Beau Belgrave + +[ Upstream commit cd98c93286a30cc4588dfd02453bec63c2f4acf4 ] + +The write index indicates which event the data is for and accesses a +per-file array. The index is passed by user processes during write() +calls as the first 4 bytes. Ensure that it cannot be negative by +returning -EINVAL to prevent out of bounds accesses. + +Update ftrace self-test to ensure this occurs properly. + +Link: https://lkml.kernel.org/r/20230425225107.8525-2-beaub@linux.microsoft.com + +Fixes: 7f5a08c79df3 ("user_events: Add minimal support for trace_event into ftrace") +Reported-by: Doug Cook +Signed-off-by: Beau Belgrave +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_events_user.c | 3 +++ + tools/testing/selftests/user_events/ftrace_test.c | 5 +++++ + 2 files changed, 8 insertions(+) + +diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c +index 908e8a13c675b..625cab4b9d945 100644 +--- a/kernel/trace/trace_events_user.c ++++ b/kernel/trace/trace_events_user.c +@@ -1398,6 +1398,9 @@ static ssize_t user_events_write_core(struct file *file, struct iov_iter *i) + if (unlikely(copy_from_iter(&idx, sizeof(idx), i) != sizeof(idx))) + return -EFAULT; + ++ if (idx < 0) ++ return -EINVAL; ++ + rcu_read_lock_sched(); + + refs = rcu_dereference_sched(info->refs); +diff --git a/tools/testing/selftests/user_events/ftrace_test.c b/tools/testing/selftests/user_events/ftrace_test.c +index 404a2713dcae8..1bc26e6476fc3 100644 +--- a/tools/testing/selftests/user_events/ftrace_test.c ++++ b/tools/testing/selftests/user_events/ftrace_test.c +@@ -294,6 +294,11 @@ TEST_F(user, write_events) { + ASSERT_NE(-1, writev(self->data_fd, (const struct iovec *)io, 3)); + after = trace_bytes(); + ASSERT_GT(after, before); ++ ++ /* Negative index should fail with EINVAL */ ++ reg.write_index = -1; ++ ASSERT_EQ(-1, writev(self->data_fd, (const struct iovec *)io, 3)); ++ ASSERT_EQ(EINVAL, errno); + } + + TEST_F(user, write_fault) { +-- +2.39.2 + diff --git a/queue-6.2/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch b/queue-6.2/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch new file mode 100644 index 00000000000..4c826d3eba1 --- /dev/null +++ b/queue-6.2/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch @@ -0,0 +1,39 @@ +From 8c25fe90472bdf5dd9627351395a0f4540388f14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 14:55:55 -0500 +Subject: tty: serial: fsl_lpuart: adjust buffer length to the intended size + +From: Shenwei Wang + +[ Upstream commit f73fd750552524b06b5d77ebfdd106ccc8fcac61 ] + +Based on the fls function definition provided below, we should not +subtract 1 to obtain the correct buffer length: + +fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32. + +Fixes: 5887ad43ee02 ("tty: serial: fsl_lpuart: Use cyclic DMA for Rx") +Signed-off-by: Shenwei Wang +Link: https://lore.kernel.org/r/20230410195555.1003900-1-shenwei.wang@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 59c10bceebbef..29b50a0792dcf 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1270,7 +1270,7 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport) + * 10ms at any baud rate. + */ + sport->rx_dma_rng_buf_len = (DMA_RX_TIMEOUT * baud / bits / 1000) * 2; +- sport->rx_dma_rng_buf_len = (1 << (fls(sport->rx_dma_rng_buf_len) - 1)); ++ sport->rx_dma_rng_buf_len = (1 << fls(sport->rx_dma_rng_buf_len)); + if (sport->rx_dma_rng_buf_len < 16) + sport->rx_dma_rng_buf_len = 16; + +-- +2.39.2 + diff --git a/queue-6.2/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch b/queue-6.2/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch new file mode 100644 index 00000000000..0b1882b5187 --- /dev/null +++ b/queue-6.2/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch @@ -0,0 +1,65 @@ +From f0bf6ad2b949fa897ba937556ae939a3a195931d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 10:27:47 +0100 +Subject: uapi/linux/const.h: prefer ISO-friendly __typeof__ + +From: Kevin Brodsky + +[ Upstream commit 31088f6f7906253ef4577f6a9b84e2d42447dba0 ] + +typeof is (still) a GNU extension, which means that it cannot be used when +building ISO C (e.g. -std=c99). It should therefore be avoided in uapi +headers in favour of the ISO-friendly __typeof__. + +Unfortunately this issue could not be detected by +CONFIG_UAPI_HEADER_TEST=y as the __ALIGN_KERNEL() macro is not expanded in +any uapi header. + +This matters from a userspace perspective, not a kernel one. uapi +headers and their contents are expected to be usable in a variety of +situations, and in particular when building ISO C applications (with +-std=c99 or similar). + +This particular problem can be reproduced by trying to use the +__ALIGN_KERNEL macro directly in application code, say: + +#include + +int align(int x, int a) +{ + return __KERNEL_ALIGN(x, a); +} + +and trying to build that with -std=c99. + +Link: https://lkml.kernel.org/r/20230411092747.3759032-1-kevin.brodsky@arm.com +Fixes: a79ff731a1b2 ("netfilter: xtables: make XT_ALIGN() usable in exported headers by exporting __ALIGN_KERNEL()") +Signed-off-by: Kevin Brodsky +Reported-by: Ruben Ayrapetyan +Tested-by: Ruben Ayrapetyan +Reviewed-by: Petr Vorel +Tested-by: Petr Vorel +Reviewed-by: Masahiro Yamada +Cc: Sam Ravnborg +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + include/uapi/linux/const.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h +index af2a44c08683d..a429381e7ca50 100644 +--- a/include/uapi/linux/const.h ++++ b/include/uapi/linux/const.h +@@ -28,7 +28,7 @@ + #define _BITUL(x) (_UL(1) << (x)) + #define _BITULL(x) (_ULL(1) << (x)) + +-#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1) ++#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1) + #define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask)) + + #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) +-- +2.39.2 + diff --git a/queue-6.2/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch b/queue-6.2/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch new file mode 100644 index 00000000000..1433480a7e6 --- /dev/null +++ b/queue-6.2/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch @@ -0,0 +1,42 @@ +From 1617db1942b693f214823fce60c066ce909c5c10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 13:58:52 +0800 +Subject: usb: chipidea: fix missing goto in `ci_hdrc_probe` + +From: Yinhao Hu + +[ Upstream commit d6f712f53b79f5017cdcefafb7a5aea9ec52da5d ] + +From the comment of ci_usb_phy_init, it returns an error code if +usb_phy_init has failed, and it should do some clean up, not just +return directly. + +Fix this by goto the error handling. + +Fixes: 74475ede784d ("usb: chipidea: move PHY operation to core") +Reviewed-by: Dongliang Mu +Acked-by: Peter Chen +Signed-off-by: Yinhao Hu +Link: https://lore.kernel.org/r/20230412055852.971991-1-dddddd@hust.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c +index 281fc51720cea..25084ce7c297b 100644 +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -1108,7 +1108,7 @@ static int ci_hdrc_probe(struct platform_device *pdev) + ret = ci_usb_phy_init(ci); + if (ret) { + dev_err(dev, "unable to init phy: %d\n", ret); +- return ret; ++ goto ulpi_exit; + } + + ci->hw_bank.phys = res->start; +-- +2.39.2 + diff --git a/queue-6.2/usb-dwc3-gadget-change-condition-for-processing-susp.patch b/queue-6.2/usb-dwc3-gadget-change-condition-for-processing-susp.patch new file mode 100644 index 00000000000..23be3741f92 --- /dev/null +++ b/queue-6.2/usb-dwc3-gadget-change-condition-for-processing-susp.patch @@ -0,0 +1,54 @@ +From f6d6f9e406bd064ffaf3055f8cc146631a6cc266 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Feb 2023 11:16:58 +0530 +Subject: usb: dwc3: gadget: Change condition for processing suspend event + +From: Prashanth K + +[ Upstream commit 4decf4060ecfee1f7a710999fcd421645ac0c419 ] + +Currently we process the suspend interrupt event only if the +device is in configured state. Consider a case where device +is not configured and got suspend interrupt, in that case our +gadget will still use 100mA as composite_suspend didn't happen. +But battery charging specification (BC1.2) expects a downstream +device to draw less than 2.5mA when unconnected OR suspended. + +Fix this by removing the condition for processing suspend event, +and thus composite_resume would set vbus draw to 2. + +Fixes: 72704f876f50 ("dwc3: gadget: Implement the suspend entry event handler") +Signed-off-by: Prashanth K +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/1677217619-10261-2-git-send-email-quic_prashk@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 743186c26e01b..3faac3244c7db 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -4262,15 +4262,8 @@ static void dwc3_gadget_interrupt(struct dwc3 *dwc, + break; + case DWC3_DEVICE_EVENT_SUSPEND: + /* It changed to be suspend event for version 2.30a and above */ +- if (!DWC3_VER_IS_PRIOR(DWC3, 230A)) { +- /* +- * Ignore suspend event until the gadget enters into +- * USB_STATE_CONFIGURED state. +- */ +- if (dwc->gadget->state >= USB_STATE_CONFIGURED) +- dwc3_gadget_suspend_interrupt(dwc, +- event->event_info); +- } ++ if (!DWC3_VER_IS_PRIOR(DWC3, 230A)) ++ dwc3_gadget_suspend_interrupt(dwc, event->event_info); + break; + case DWC3_DEVICE_EVENT_SOF: + case DWC3_DEVICE_EVENT_ERRATIC_ERROR: +-- +2.39.2 + diff --git a/queue-6.2/usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch b/queue-6.2/usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch new file mode 100644 index 00000000000..03394585849 --- /dev/null +++ b/queue-6.2/usb-gadget-tegra-xudc-fix-crash-in-vbus_draw.patch @@ -0,0 +1,43 @@ +From da0a6dff22c8ca4c5161c24ced14d42f179a88ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 19:18:53 +0100 +Subject: usb: gadget: tegra-xudc: Fix crash in vbus_draw + +From: Jon Hunter + +[ Upstream commit 5629d31955297ca47b9283c64fff70f2f34aa528 ] + +Commit ac82b56bda5f ("usb: gadget: tegra-xudc: Add vbus_draw support") +populated the vbus_draw callback for the Tegra XUDC driver. The function +tegra_xudc_gadget_vbus_draw(), that was added by this commit, assumes +that the pointer 'curr_usbphy' has been initialised, which is not always +the case because this is only initialised when the USB role is updated. +Fix this crash, by checking that the 'curr_usbphy' is valid before +dereferencing. + +Fixes: ac82b56bda5f ("usb: gadget: tegra-xudc: Add vbus_draw support") +Reviewed-by: Thierry Reding +Signed-off-by: Jon Hunter +Link: https://lore.kernel.org/r/20230405181854.42355-1-jonathanh@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/tegra-xudc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c +index 76919d7570d23..3c7ffb35c35cd 100644 +--- a/drivers/usb/gadget/udc/tegra-xudc.c ++++ b/drivers/usb/gadget/udc/tegra-xudc.c +@@ -2160,7 +2160,7 @@ static int tegra_xudc_gadget_vbus_draw(struct usb_gadget *gadget, + + dev_dbg(xudc->dev, "%s: %u mA\n", __func__, m_a); + +- if (xudc->curr_usbphy->chg_type == SDP_TYPE) ++ if (xudc->curr_usbphy && xudc->curr_usbphy->chg_type == SDP_TYPE) + ret = usb_phy_set_power(xudc->curr_usbphy, m_a); + + return ret; +-- +2.39.2 + diff --git a/queue-6.2/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch b/queue-6.2/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch new file mode 100644 index 00000000000..5a7c4081fba --- /dev/null +++ b/queue-6.2/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch @@ -0,0 +1,62 @@ +From e84758c0a7dab0823acf5667c75f799bf89a1d4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 14:29:31 +0800 +Subject: usb: gadget: udc: renesas_usb3: Fix use after free bug in + renesas_usb3_remove due to race condition + +From: Zheng Wang + +[ Upstream commit 2b947f8769be8b8181dc795fd292d3e7120f5204 ] + +In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work. +renesas_usb3_start will be called to start the work. + +If we remove the driver which will call usbhs_remove, there may be +an unfinished work. The possible sequence is as follows: + +CPU0 CPU1 + + renesas_usb3_role_work +renesas_usb3_remove +usb_role_switch_unregister +device_unregister +kfree(sw) +//free usb3->role_sw + usb_role_switch_set_role + //use usb3->role_sw + +The usb3->role_sw could be freed under such circumstance and then +used in usb_role_switch_set_role. + +This bug was found by static analysis. And note that removing a +driver is a root-only operation, and should never happen in normal +case. But the root user may directly remove the device which +will also trigger the remove function. + +Fix it by canceling the work before cleanup in the renesas_usb3_remove. + +Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch") +Signed-off-by: Zheng Wang +Reviewed-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/renesas_usb3.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c +index 615ba0a6fbee1..32c9e369216c9 100644 +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -2596,6 +2596,7 @@ static int renesas_usb3_remove(struct platform_device *pdev) + debugfs_remove_recursive(usb3->dentry); + device_remove_file(&pdev->dev, &dev_attr_role); + ++ cancel_work_sync(&usb3->role_work); + usb_role_switch_unregister(usb3->role_sw); + + usb_del_gadget_udc(&usb3->gadget); +-- +2.39.2 + diff --git a/queue-6.2/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch b/queue-6.2/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch new file mode 100644 index 00000000000..cb446ff274b --- /dev/null +++ b/queue-6.2/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch @@ -0,0 +1,46 @@ +From d362511ad4392f52192f37250220bfd421a0cca4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 17:30:37 +0100 +Subject: usb: host: xhci-rcar: remove leftover quirk handling + +From: Wolfram Sang + +[ Upstream commit 5d67f4861884762ebc2bddb5d667444e45f25782 ] + +Loading V3 firmware does not need a quirk anymore, remove the leftover +code. + +Fixes: ed8603e11124 ("usb: host: xhci-rcar: Simplify getting the firmware name for R-Car Gen3") +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Wolfram Sang +Link: https://lore.kernel.org/r/20230307163041.3815-10-wsa+renesas@sang-engineering.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-rcar.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c +index aef0258a7160d..98525704be9d4 100644 +--- a/drivers/usb/host/xhci-rcar.c ++++ b/drivers/usb/host/xhci-rcar.c +@@ -75,7 +75,6 @@ MODULE_FIRMWARE(XHCI_RCAR_FIRMWARE_NAME_V3); + + /* For soc_device_attribute */ + #define RCAR_XHCI_FIRMWARE_V2 BIT(0) /* FIRMWARE V2 */ +-#define RCAR_XHCI_FIRMWARE_V3 BIT(1) /* FIRMWARE V3 */ + + static const struct soc_device_attribute rcar_quirks_match[] = { + { +@@ -147,8 +146,6 @@ static int xhci_rcar_download_firmware(struct usb_hcd *hcd) + + if (quirks & RCAR_XHCI_FIRMWARE_V2) + firmware_name = XHCI_RCAR_FIRMWARE_NAME_V2; +- else if (quirks & RCAR_XHCI_FIRMWARE_V3) +- firmware_name = XHCI_RCAR_FIRMWARE_NAME_V3; + else + firmware_name = priv->firmware_name; + +-- +2.39.2 + diff --git a/queue-6.2/usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch b/queue-6.2/usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch new file mode 100644 index 00000000000..58cee006223 --- /dev/null +++ b/queue-6.2/usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch @@ -0,0 +1,73 @@ +From 7cfd976255495a9c303d1b670b2a2e005f3f119b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 10:51:59 +0800 +Subject: usb: mtu3: fix kernel panic at qmu transfer done irq handler + +From: Chunfeng Yun + +[ Upstream commit d28f4091ea7ec3510fd6a3c6d433234e7a2bef14 ] + +When handle qmu transfer irq, it will unlock @mtu->lock before give back +request, if another thread handle disconnect event at the same time, and +try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu +irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before +handling it. + +e.g. +qmu done irq on cpu0 thread running on cpu1 + +qmu_done_tx() + handle gpd [0] + mtu3_requ_complete() mtu3_gadget_ep_disable() + unlock @mtu->lock + give back request lock @mtu->lock + mtu3_ep_disable() + mtu3_gpd_ring_free() + unlock @mtu->lock + lock @mtu->lock + get next gpd [1] + +[1]: goto [0] to handle next gpd, and next gpd may be NULL. + +Fixes: 48e0d3735aa5 ("usb: mtu3: supports new QMU format") +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/20230417025203.18097-3-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/mtu3/mtu3_qmu.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c +index 2ea3157ddb6e2..e65586147965d 100644 +--- a/drivers/usb/mtu3/mtu3_qmu.c ++++ b/drivers/usb/mtu3/mtu3_qmu.c +@@ -210,6 +210,7 @@ static struct qmu_gpd *advance_enq_gpd(struct mtu3_gpd_ring *ring) + return ring->enqueue; + } + ++/* @dequeue may be NULL if ring is unallocated or freed */ + static struct qmu_gpd *advance_deq_gpd(struct mtu3_gpd_ring *ring) + { + if (ring->dequeue < ring->end) +@@ -484,7 +485,7 @@ static void qmu_done_tx(struct mtu3 *mtu, u8 epnum) + dev_dbg(mtu->dev, "%s EP%d, last=%p, current=%p, enq=%p\n", + __func__, epnum, gpd, gpd_current, ring->enqueue); + +- while (gpd != gpd_current && !GET_GPD_HWO(gpd)) { ++ while (gpd && gpd != gpd_current && !GET_GPD_HWO(gpd)) { + + mreq = next_request(mep); + +@@ -523,7 +524,7 @@ static void qmu_done_rx(struct mtu3 *mtu, u8 epnum) + dev_dbg(mtu->dev, "%s EP%d, last=%p, current=%p, enq=%p\n", + __func__, epnum, gpd, gpd_current, ring->enqueue); + +- while (gpd != gpd_current && !GET_GPD_HWO(gpd)) { ++ while (gpd && gpd != gpd_current && !GET_GPD_HWO(gpd)) { + + mreq = next_request(mep); + +-- +2.39.2 + diff --git a/queue-6.2/virt-coco-sev-guest-double-buffer-messages.patch b/queue-6.2/virt-coco-sev-guest-double-buffer-messages.patch new file mode 100644 index 00000000000..21ffa34fa3b --- /dev/null +++ b/queue-6.2/virt-coco-sev-guest-double-buffer-messages.patch @@ -0,0 +1,98 @@ +From cabb94d28d686ed42e2f4d2621c830056f6bbeb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 20:24:48 +0100 +Subject: virt/coco/sev-guest: Double-buffer messages + +From: Dionna Glaze + +[ Upstream commit 965006103a14703cc42043bbf9b5e0cdf7a468ad ] + +The encryption algorithms read and write directly to shared unencrypted +memory, which may leak information as well as permit the host to tamper +with the message integrity. Instead, copy whole messages in or out as +needed before doing any computation on them. + +Fixes: d5af44dde546 ("x86/sev: Provide support for SNP guest request NAEs") +Signed-off-by: Dionna Glaze +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230214164638.1189804-3-dionnaglaze@google.com +Signed-off-by: Sasha Levin +--- + drivers/virt/coco/sev-guest/sev-guest.c | 27 +++++++++++++++++++++---- + 1 file changed, 23 insertions(+), 4 deletions(-) + +diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/sev-guest/sev-guest.c +index 46f1a8d558b0b..0c7b47acba2a8 100644 +--- a/drivers/virt/coco/sev-guest/sev-guest.c ++++ b/drivers/virt/coco/sev-guest/sev-guest.c +@@ -46,7 +46,15 @@ struct snp_guest_dev { + + void *certs_data; + struct snp_guest_crypto *crypto; ++ /* request and response are in unencrypted memory */ + struct snp_guest_msg *request, *response; ++ ++ /* ++ * Avoid information leakage by double-buffering shared messages ++ * in fields that are in regular encrypted memory. ++ */ ++ struct snp_guest_msg secret_request, secret_response; ++ + struct snp_secrets_page_layout *layout; + struct snp_req_data input; + u32 *os_area_msg_seqno; +@@ -266,14 +274,17 @@ static int dec_payload(struct snp_guest_dev *snp_dev, struct snp_guest_msg *msg, + static int verify_and_dec_payload(struct snp_guest_dev *snp_dev, void *payload, u32 sz) + { + struct snp_guest_crypto *crypto = snp_dev->crypto; +- struct snp_guest_msg *resp = snp_dev->response; +- struct snp_guest_msg *req = snp_dev->request; ++ struct snp_guest_msg *resp = &snp_dev->secret_response; ++ struct snp_guest_msg *req = &snp_dev->secret_request; + struct snp_guest_msg_hdr *req_hdr = &req->hdr; + struct snp_guest_msg_hdr *resp_hdr = &resp->hdr; + + dev_dbg(snp_dev->dev, "response [seqno %lld type %d version %d sz %d]\n", + resp_hdr->msg_seqno, resp_hdr->msg_type, resp_hdr->msg_version, resp_hdr->msg_sz); + ++ /* Copy response from shared memory to encrypted memory. */ ++ memcpy(resp, snp_dev->response, sizeof(*resp)); ++ + /* Verify that the sequence counter is incremented by 1 */ + if (unlikely(resp_hdr->msg_seqno != (req_hdr->msg_seqno + 1))) + return -EBADMSG; +@@ -297,7 +308,7 @@ static int verify_and_dec_payload(struct snp_guest_dev *snp_dev, void *payload, + static int enc_payload(struct snp_guest_dev *snp_dev, u64 seqno, int version, u8 type, + void *payload, size_t sz) + { +- struct snp_guest_msg *req = snp_dev->request; ++ struct snp_guest_msg *req = &snp_dev->secret_request; + struct snp_guest_msg_hdr *hdr = &req->hdr; + + memset(req, 0, sizeof(*req)); +@@ -417,13 +428,21 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, in + if (!seqno) + return -EIO; + ++ /* Clear shared memory's response for the host to populate. */ + memset(snp_dev->response, 0, sizeof(struct snp_guest_msg)); + +- /* Encrypt the userspace provided payload */ ++ /* Encrypt the userspace provided payload in snp_dev->secret_request. */ + rc = enc_payload(snp_dev, seqno, msg_ver, type, req_buf, req_sz); + if (rc) + return rc; + ++ /* ++ * Write the fully encrypted request to the shared unencrypted ++ * request page. ++ */ ++ memcpy(snp_dev->request, &snp_dev->secret_request, ++ sizeof(snp_dev->secret_request)); ++ + rc = __handle_guest_request(snp_dev, exit_code, fw_err); + if (rc) { + if (rc == -EIO && *fw_err == SNP_GUEST_REQ_INVALID_LEN) +-- +2.39.2 + diff --git a/queue-6.2/virtio_ring-don-t-update-event-idx-on-get_buf.patch b/queue-6.2/virtio_ring-don-t-update-event-idx-on-get_buf.patch new file mode 100644 index 00000000000..d9862e33f49 --- /dev/null +++ b/queue-6.2/virtio_ring-don-t-update-event-idx-on-get_buf.patch @@ -0,0 +1,113 @@ +From 6c4933c877a1708f3332d7d2a74bf605b7be0ffb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 18:23:00 +0800 +Subject: virtio_ring: don't update event idx on get_buf + +From: Albert Huang + +[ Upstream commit 6c0b057cec5eade4c3afec3908821176931a9997 ] + +In virtio_net, if we disable napi_tx, when we trigger a tx interrupt, +the vq->event_triggered will be set to true. It is then never reset +until we explicitly call virtqueue_enable_cb_delayed or +virtqueue_enable_cb_prepare. + +If we disable the napi_tx, virtqueue_enable_cb* will only be called when +the tx ring is getting relatively empty. + +Since event_triggered is true, VRING_AVAIL_F_NO_INTERRUPT or +VRING_PACKED_EVENT_FLAG_DISABLE will not be set. As a result we update +vring_used_event(&vq->split.vring) or vq->packed.vring.driver->off_wrap +every time we call virtqueue_get_buf_ctx. This causes more interrupts. + +To summarize: +1) event_triggered was set to true in vring_interrupt() +2) after this nothing will happen in virtqueue_disable_cb() so + VRING_AVAIL_F_NO_INTERRUPT is not set in avail_flags_shadow +3) virtqueue_get_buf_ctx_split() will still think the cb is enabled + and then it will publish a new event index + +To fix: +update VRING_AVAIL_F_NO_INTERRUPT or VRING_PACKED_EVENT_FLAG_DISABLE in +the vq when we call virtqueue_disable_cb even when event_triggered is +true. + +Tested with iperf: +iperf3 tcp stream: +vm1 -----------------> vm2 +vm2 just receives tcp data stream from vm1, and sends acks to vm1, +there are many tx interrupts in vm2. +with the patch applied there are just a few tx interrupts. + +v2->v3: +-update the interrupt disable flag even with the event_triggered is set, +-instead of checking whether event_triggered is set in +-virtqueue_get_buf_ctx_{packed/split}, will cause the drivers which have +-not called virtqueue_{enable/disable}_cb to miss notifications. + +v3->v4: +-remove change for +-"if (vq->packed.event_flags_shadow != VRING_PACKED_EVENT_FLAG_DISABLE)" +-in virtqueue_disable_cb_packed + +Fixes: 8d622d21d248 ("virtio: fix up virtio_disable_cb") +Signed-off-by: Albert Huang +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Jason Wang +Message-Id: <20230329102300.61000-1-huangjie.albert@bytedance.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_ring.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index 723c4e29e1d3b..5bee2ab62111b 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -848,6 +848,14 @@ static void virtqueue_disable_cb_split(struct virtqueue *_vq) + + if (!(vq->split.avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) { + vq->split.avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT; ++ ++ /* ++ * If device triggered an event already it won't trigger one again: ++ * no need to disable. ++ */ ++ if (vq->event_triggered) ++ return; ++ + if (vq->event) + /* TODO: this is a hack. Figure out a cleaner value to write. */ + vring_used_event(&vq->split.vring) = 0x0; +@@ -1687,6 +1695,14 @@ static void virtqueue_disable_cb_packed(struct virtqueue *_vq) + + if (vq->packed.event_flags_shadow != VRING_PACKED_EVENT_FLAG_DISABLE) { + vq->packed.event_flags_shadow = VRING_PACKED_EVENT_FLAG_DISABLE; ++ ++ /* ++ * If device triggered an event already it won't trigger one again: ++ * no need to disable. ++ */ ++ if (vq->event_triggered) ++ return; ++ + vq->packed.vring.driver->flags = + cpu_to_le16(vq->packed.event_flags_shadow); + } +@@ -2309,12 +2325,6 @@ void virtqueue_disable_cb(struct virtqueue *_vq) + { + struct vring_virtqueue *vq = to_vvq(_vq); + +- /* If device triggered an event already it won't trigger one again: +- * no need to disable. +- */ +- if (vq->event_triggered) +- return; +- + if (vq->packed_ring) + virtqueue_disable_cb_packed(_vq); + else +-- +2.39.2 + diff --git a/queue-6.2/vlan-partially-enable-siocshwtstamp-in-container.patch b/queue-6.2/vlan-partially-enable-siocshwtstamp-in-container.patch new file mode 100644 index 00000000000..8b89e5b74d6 --- /dev/null +++ b/queue-6.2/vlan-partially-enable-siocshwtstamp-in-container.patch @@ -0,0 +1,37 @@ +From 258d05b95c9897ff5e70cce25dde3d612d67bf74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 08:33:02 -0700 +Subject: vlan: partially enable SIOCSHWTSTAMP in container + +From: Vadim Fedorenko + +[ Upstream commit 731b73dba359e3ff00517c13aa0daa82b34ff466 ] + +Setting timestamp filter was explicitly disabled on vlan devices in +containers because it might affect other processes on the host. But it's +absolutely legit in case when real device is in the same namespace. + +Fixes: 873017af7784 ("vlan: disable SIOCSHWTSTAMP in container") +Signed-off-by: Vadim Fedorenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/8021q/vlan_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index 296d0145932f4..5920544e93e82 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -365,7 +365,7 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + + switch (cmd) { + case SIOCSHWTSTAMP: +- if (!net_eq(dev_net(dev), &init_net)) ++ if (!net_eq(dev_net(dev), dev_net(real_dev))) + break; + fallthrough; + case SIOCGMIIPHY: +-- +2.39.2 + diff --git a/queue-6.2/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch b/queue-6.2/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch new file mode 100644 index 00000000000..784c5b90b36 --- /dev/null +++ b/queue-6.2/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch @@ -0,0 +1,95 @@ +From 8df62758a90931fc3b95bd905e9c2c9eec962bf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Mar 2023 21:01:53 +0900 +Subject: vmci_host: fix a race condition in vmci_host_poll() causing GPF + +From: Dae R. Jeong + +[ Upstream commit ae13381da5ff0e8e084c0323c3cc0a945e43e9c7 ] + +During fuzzing, a general protection fault is observed in +vmci_host_poll(). + +general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] +RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926 +<- omitting registers -> +Call Trace: + + lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672 + __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] + _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162 + add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22 + poll_wait include/linux/poll.h:49 [inline] + vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174 + vfs_poll include/linux/poll.h:88 [inline] + do_pollfd fs/select.c:873 [inline] + do_poll fs/select.c:921 [inline] + do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015 + __do_sys_ppoll fs/select.c:1121 [inline] + __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Example thread interleaving that causes the general protection fault +is as follows: + +CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context) +----- ----- +// Read uninitialized context +context = vmci_host_dev->context; + // Initialize context + vmci_host_dev->context = vmci_ctx_create(); + vmci_host_dev->ct_type = VMCIOBJ_CONTEXT; + +if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) { + // Dereferencing the wrong pointer + poll_wait(..., &context->host_context); +} + +In this scenario, vmci_host_poll() reads vmci_host_dev->context first, +and then reads vmci_host_dev->ct_type to check that +vmci_host_dev->context is initialized. However, since these two reads +are not atomically executed, there is a chance of a race condition as +described above. + +To fix this race condition, read vmci_host_dev->context after checking +the value of vmci_host_dev->ct_type so that vmci_host_poll() always +reads an initialized context. + +Reported-by: Dae R. Jeong +Fixes: 8bf503991f87 ("VMCI: host side driver implementation.") +Signed-off-by: Dae R. Jeong +Link: https://lore.kernel.org/r/ZCGFsdBAU4cYww5l@dragonet +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/vmw_vmci/vmci_host.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c +index 857b9851402a6..abe79f6fd2a79 100644 +--- a/drivers/misc/vmw_vmci/vmci_host.c ++++ b/drivers/misc/vmw_vmci/vmci_host.c +@@ -165,10 +165,16 @@ static int vmci_host_close(struct inode *inode, struct file *filp) + static __poll_t vmci_host_poll(struct file *filp, poll_table *wait) + { + struct vmci_host_dev *vmci_host_dev = filp->private_data; +- struct vmci_ctx *context = vmci_host_dev->context; ++ struct vmci_ctx *context; + __poll_t mask = 0; + + if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) { ++ /* ++ * Read context only if ct_type == VMCIOBJ_CONTEXT to make ++ * sure that context is initialized ++ */ ++ context = vmci_host_dev->context; ++ + /* Check for VMCI calls to this VM context. */ + if (wait) + poll_wait(filp, &context->host_context.wait_queue, +-- +2.39.2 + diff --git a/queue-6.2/wifi-ath11k-fix-deinitialization-of-firmware-resourc.patch b/queue-6.2/wifi-ath11k-fix-deinitialization-of-firmware-resourc.patch new file mode 100644 index 00000000000..43e9605c463 --- /dev/null +++ b/queue-6.2/wifi-ath11k-fix-deinitialization-of-firmware-resourc.patch @@ -0,0 +1,89 @@ +From 440208b0ddd303bcc663b342e876458cd4143281 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 15:23:08 +0530 +Subject: wifi: ath11k: fix deinitialization of firmware resources + +From: Aditya Kumar Singh + +[ Upstream commit 5a78ac33e3cb8822da64dd1af196e83664b332b0 ] + +Currently, in ath11k_ahb_fw_resources_init(), iommu domain +mapping is done only for the chipsets having fixed firmware +memory. Also, for such chipsets, mapping is done only if it +does not have TrustZone support. + +During deinitialization, only if TrustZone support is not there, +iommu is unmapped back. However, for non fixed firmware memory +chipsets, TrustZone support is not there and this makes the +condition check to true and it tries to unmap the memory which +was not mapped during initialization. + +This leads to the following trace - + +[ 83.198790] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 +[ 83.259537] Modules linked in: ath11k_ahb ath11k qmi_helpers +.. snip .. +[ 83.280286] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 83.287228] pc : __iommu_unmap+0x30/0x140 +[ 83.293907] lr : iommu_unmap+0x5c/0xa4 +[ 83.298072] sp : ffff80000b3abad0 +.. snip .. +[ 83.369175] Call trace: +[ 83.376282] __iommu_unmap+0x30/0x140 +[ 83.378541] iommu_unmap+0x5c/0xa4 +[ 83.382360] ath11k_ahb_fw_resource_deinit.part.12+0x2c/0xac [ath11k_ahb] +[ 83.385666] ath11k_ahb_free_resources+0x140/0x17c [ath11k_ahb] +[ 83.392521] ath11k_ahb_shutdown+0x34/0x40 [ath11k_ahb] +[ 83.398248] platform_shutdown+0x20/0x2c +[ 83.403455] device_shutdown+0x16c/0x1c4 +[ 83.407621] kernel_restart_prepare+0x34/0x3c +[ 83.411529] kernel_restart+0x14/0x74 +[ 83.415781] __do_sys_reboot+0x1c4/0x22c +[ 83.419427] __arm64_sys_reboot+0x1c/0x24 +[ 83.423420] invoke_syscall+0x44/0xfc +[ 83.427326] el0_svc_common.constprop.3+0xac/0xe8 +[ 83.430974] do_el0_svc+0xa0/0xa8 +[ 83.435659] el0_svc+0x1c/0x44 +[ 83.438957] el0t_64_sync_handler+0x60/0x144 +[ 83.441910] el0t_64_sync+0x15c/0x160 +[ 83.446343] Code: aa0103f4 f9400001 f90027a1 d2800001 (f94006a0) +[ 83.449903] ---[ end trace 0000000000000000 ]--- + +This can be reproduced by probing an AHB chipset which is not +having a fixed memory region. During reboot (or rmmod) trace +can be seen. + +Fix this issue by adding a condition check on firmware fixed memory +hw_param as done in the counter initialization function. + +Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 + +Fixes: f9eec4947add ("ath11k: Add support for targets without trustzone") +Signed-off-by: Aditya Kumar Singh +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230309095308.24937-1-quic_adisi@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/ahb.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c +index f70a119bb5c87..76f275ca53e9c 100644 +--- a/drivers/net/wireless/ath/ath11k/ahb.c ++++ b/drivers/net/wireless/ath/ath11k/ahb.c +@@ -1063,6 +1063,12 @@ static int ath11k_ahb_fw_resource_deinit(struct ath11k_base *ab) + struct iommu_domain *iommu; + size_t unmapped_size; + ++ /* Chipsets not requiring MSA would have not initialized ++ * MSA resources, return success in such cases. ++ */ ++ if (!ab->hw_params.fixed_fw_mem) ++ return 0; ++ + if (ab_ahb->fw.use_tz) + return 0; + +-- +2.39.2 + diff --git a/queue-6.2/wifi-ath11k-fix-sac-bug-on-peer-addition-with-sta-ba.patch b/queue-6.2/wifi-ath11k-fix-sac-bug-on-peer-addition-with-sta-ba.patch new file mode 100644 index 00000000000..40d47e37fa2 --- /dev/null +++ b/queue-6.2/wifi-ath11k-fix-sac-bug-on-peer-addition-with-sta-ba.patch @@ -0,0 +1,62 @@ +From 4734774eb63065b0ac11a3efb48e513afaacd474 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 23:26:22 +0100 +Subject: wifi: ath11k: fix SAC bug on peer addition with sta band migration + +From: Christian Marangi + +[ Upstream commit 60b7d62ba8cdbd073997bff0f1cdae8d844002c0 ] + +Fix sleep in atomic context warning detected by Smatch static checker +analyzer. + +Following the locking pattern for peer_rhash_add lock tbl_mtx_lock mutex +always even if sta is not transitioning to another band. +This is peer_add function and a more secure locking should not cause +performance regression. + +Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1 + +Fixes: d673cb6fe6c0 ("wifi: ath11k: fix peer addition/deletion error on sta band migration") +Reported-by: Dan Carpenter +Signed-off-by: Christian Marangi +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230209222622.1751-1-ansuelsmth@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/peer.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/peer.c b/drivers/net/wireless/ath/ath11k/peer.c +index 1ae7af02c364e..1380811827a84 100644 +--- a/drivers/net/wireless/ath/ath11k/peer.c ++++ b/drivers/net/wireless/ath/ath11k/peer.c +@@ -382,22 +382,23 @@ int ath11k_peer_create(struct ath11k *ar, struct ath11k_vif *arvif, + return -ENOBUFS; + } + ++ mutex_lock(&ar->ab->tbl_mtx_lock); + spin_lock_bh(&ar->ab->base_lock); + peer = ath11k_peer_find_by_addr(ar->ab, param->peer_addr); + if (peer) { + if (peer->vdev_id == param->vdev_id) { + spin_unlock_bh(&ar->ab->base_lock); ++ mutex_unlock(&ar->ab->tbl_mtx_lock); + return -EINVAL; + } + + /* Assume sta is transitioning to another band. + * Remove here the peer from rhash. + */ +- mutex_lock(&ar->ab->tbl_mtx_lock); + ath11k_peer_rhash_delete(ar->ab, peer); +- mutex_unlock(&ar->ab->tbl_mtx_lock); + } + spin_unlock_bh(&ar->ab->base_lock); ++ mutex_unlock(&ar->ab->tbl_mtx_lock); + + ret = ath11k_wmi_send_peer_create_cmd(ar, param); + if (ret) { +-- +2.39.2 + diff --git a/queue-6.2/wifi-ath11k-fix-writing-to-unintended-memory-region.patch b/queue-6.2/wifi-ath11k-fix-writing-to-unintended-memory-region.patch new file mode 100644 index 00000000000..7e1bd518e9f --- /dev/null +++ b/queue-6.2/wifi-ath11k-fix-writing-to-unintended-memory-region.patch @@ -0,0 +1,53 @@ +From 6c389e0d1fd03d3a07eb7947800437be285254db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 16:57:01 +0200 +Subject: wifi: ath11k: fix writing to unintended memory region + +From: P Praneesh + +[ Upstream commit 756a7f90878f0866fd2fe167ef37e90b47326b96 ] + +While initializing spectral, the magic value is getting written to the +invalid memory address leading to random boot-up crash. This occurs +due to the incorrect index increment in ath11k_dbring_fill_magic_value +function. Fix it by replacing the existing logic with memset32 to ensure +there is no invalid memory access. + +Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1 + +Fixes: d3d358efc553 ("ath11k: add spectral/CFR buffer validation support") +Signed-off-by: P Praneesh +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230321052900.16895-1-quic_ppranees@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/dbring.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/dbring.c b/drivers/net/wireless/ath/ath11k/dbring.c +index 2107ec05d14fd..5536e86423312 100644 +--- a/drivers/net/wireless/ath/ath11k/dbring.c ++++ b/drivers/net/wireless/ath/ath11k/dbring.c +@@ -26,13 +26,13 @@ int ath11k_dbring_validate_buffer(struct ath11k *ar, void *buffer, u32 size) + static void ath11k_dbring_fill_magic_value(struct ath11k *ar, + void *buffer, u32 size) + { +- u32 *temp; +- int idx; +- +- size = size >> 2; ++ /* memset32 function fills buffer payload with the ATH11K_DB_MAGIC_VALUE ++ * and the variable size is expected to be the number of u32 values ++ * to be stored, not the number of bytes. ++ */ ++ size = size / sizeof(u32); + +- for (idx = 0, temp = buffer; idx < size; idx++, temp++) +- *temp++ = ATH11K_DB_MAGIC_VALUE; ++ memset32(buffer, ATH11K_DB_MAGIC_VALUE, size); + } + + static int ath11k_dbring_bufs_replenish(struct ath11k *ar, +-- +2.39.2 + diff --git a/queue-6.2/wifi-ath11k-use-platform_get_irq-to-get-the-interrup.patch b/queue-6.2/wifi-ath11k-use-platform_get_irq-to-get-the-interrup.patch new file mode 100644 index 00000000000..9ede35b8682 --- /dev/null +++ b/queue-6.2/wifi-ath11k-use-platform_get_irq-to-get-the-interrup.patch @@ -0,0 +1,60 @@ +From 8049ea74cc6e246065209ff45e4b37807e8bd26a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 08:54:42 -0800 +Subject: wifi: ath11k: Use platform_get_irq() to get the interrupt + +From: Douglas Anderson + +[ Upstream commit f117276638b7600b981b3fe28550823cfbe1ef23 ] + +As of commit a1a2b7125e10 ("of/platform: Drop static setup of IRQ +resource from DT core"), we need to use platform_get_irq() instead of +platform_get_resource() to get our IRQs because +platform_get_resource() simply won't get them anymore. + +This was already fixed in several other Atheros WiFi drivers, +apparently in response to Zeal Robot reports. An example of another +fix is commit 9503a1fc123d ("ath9k: Use platform_get_irq() to get the +interrupt"). ath11k seems to have been missed in this effort, though. + +Without this change, WiFi wasn't coming up on my Qualcomm sc7280-based +hardware. Specifically, "platform_get_resource(pdev, IORESOURCE_IRQ, +i)" was failing even for i=0. + +Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1 + +Fixes: a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core") +Fixes: 00402f49d26f ("ath11k: Add support for WCN6750 device") +Signed-off-by: Douglas Anderson +Tested-by: Jun Yu +Reviewed-by: Lad Prabhakar +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230201084131.v2.1.I69cf3d56c97098287fe3a70084ee515098390b70@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/ahb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c +index d34a4d6325b2b..f70a119bb5c87 100644 +--- a/drivers/net/wireless/ath/ath11k/ahb.c ++++ b/drivers/net/wireless/ath/ath11k/ahb.c +@@ -859,11 +859,11 @@ static int ath11k_ahb_setup_msi_resources(struct ath11k_base *ab) + ab->pci.msi.ep_base_data = int_prop + 32; + + for (i = 0; i < ab->pci.msi.config->total_vectors; i++) { +- res = platform_get_resource(pdev, IORESOURCE_IRQ, i); +- if (!res) +- return -ENODEV; ++ ret = platform_get_irq(pdev, i); ++ if (ret < 0) ++ return ret; + +- ab->pci.msi.irqs[i] = res->start; ++ ab->pci.msi.irqs[i] = ret; + } + + set_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, &ab->dev_flags); +-- +2.39.2 + diff --git a/queue-6.2/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch b/queue-6.2/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch new file mode 100644 index 00000000000..104cfe649bd --- /dev/null +++ b/queue-6.2/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch @@ -0,0 +1,39 @@ +From ff02df7f277665d2d3b2280479d77682257e73a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 16:15:48 +0300 +Subject: wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() + +From: Dan Carpenter + +[ Upstream commit 4c856ee12df85aabd437c3836ed9f68d94268358 ] + +This loop checks that i < max at the start of loop but then it does +i++ which could put it past the end of the array. It's harmless to +check again and prevent a potential out of bounds. + +Fixes: 1048643ea94d ("ath5k: Clean up eeprom parsing and add missing calibration data") +Signed-off-by: Dan Carpenter +Reviewed-by: Luis Chamberlain +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/Y+D9hPQrHfWBJhXz@kili +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath5k/eeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c +index d444b3d70ba2e..58d3e86f6256d 100644 +--- a/drivers/net/wireless/ath/ath5k/eeprom.c ++++ b/drivers/net/wireless/ath/ath5k/eeprom.c +@@ -529,7 +529,7 @@ ath5k_eeprom_read_freq_list(struct ath5k_hw *ah, int *offset, int max, + ee->ee_n_piers[mode]++; + + freq2 = (val >> 8) & 0xff; +- if (!freq2) ++ if (!freq2 || i >= max) + break; + + pc[i++].freq = ath5k_eeprom_bin2freq(ee, +-- +2.39.2 + diff --git a/queue-6.2/wifi-ath5k-use-platform_get_irq-to-get-the-interrupt.patch b/queue-6.2/wifi-ath5k-use-platform_get_irq-to-get-the-interrupt.patch new file mode 100644 index 00000000000..bd59f671c33 --- /dev/null +++ b/queue-6.2/wifi-ath5k-use-platform_get_irq-to-get-the-interrupt.patch @@ -0,0 +1,56 @@ +From 7d3498f5696bca9f044da2d25d213897d7791325 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 08:54:43 -0800 +Subject: wifi: ath5k: Use platform_get_irq() to get the interrupt + +From: Douglas Anderson + +[ Upstream commit 95c95251d0547b46d6571e4fbd51b42865c15a4a ] + +As of commit a1a2b7125e10 ("of/platform: Drop static setup of IRQ +resource from DT core"), we need to use platform_get_irq() instead of +platform_get_resource() to get our IRQs because +platform_get_resource() simply won't get them anymore. + +This was already fixed in several other Atheros WiFi drivers, +apparently in response to Zeal Robot reports. An example of another +fix is commit 9503a1fc123d ("ath9k: Use platform_get_irq() to get the +interrupt"). ath5k seems to have been missed in this effort, though. + +Fixes: a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core") +Signed-off-by: Douglas Anderson +Reviewed-by: Lad Prabhakar +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230201084131.v2.2.Ic4f8542b0588d7eb4bc6e322d4af3d2064e84ff0@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath5k/ahb.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath5k/ahb.c b/drivers/net/wireless/ath/ath5k/ahb.c +index 2c9cec8b53d9e..28a1e5eff204e 100644 +--- a/drivers/net/wireless/ath/ath5k/ahb.c ++++ b/drivers/net/wireless/ath/ath5k/ahb.c +@@ -113,15 +113,13 @@ static int ath_ahb_probe(struct platform_device *pdev) + goto err_out; + } + +- res = platform_get_resource(pdev, IORESOURCE_IRQ, 0); +- if (res == NULL) { +- dev_err(&pdev->dev, "no IRQ resource found\n"); +- ret = -ENXIO; ++ irq = platform_get_irq(pdev, 0); ++ if (irq < 0) { ++ dev_err(&pdev->dev, "no IRQ resource found: %d\n", irq); ++ ret = irq; + goto err_iounmap; + } + +- irq = res->start; +- + hw = ieee80211_alloc_hw(sizeof(struct ath5k_hw), &ath5k_hw_ops); + if (hw == NULL) { + dev_err(&pdev->dev, "no memory for ieee80211_hw\n"); +-- +2.39.2 + diff --git a/queue-6.2/wifi-ath6kl-minor-fix-for-allocation-size.patch b/queue-6.2/wifi-ath6kl-minor-fix-for-allocation-size.patch new file mode 100644 index 00000000000..06bbbd7cdca --- /dev/null +++ b/queue-6.2/wifi-ath6kl-minor-fix-for-allocation-size.patch @@ -0,0 +1,40 @@ +From 8dee9fd7505d7d30b485b2b0f914091b8afe7338 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 20:31:37 +0200 +Subject: wifi: ath6kl: minor fix for allocation size + +From: Alexey V. Vissarionov + +[ Upstream commit 778f83f889e7fca37780d9640fcbd0229ae38eaa ] + +Although the "param" pointer occupies more or equal space compared +to "*param", the allocation size should use the size of variable +itself. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: bdcd81707973cf8a ("Add ath6kl cleaned up driver") +Signed-off-by: Alexey V. Vissarionov +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230117110414.GC12547@altlinux.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/bmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/bmi.c b/drivers/net/wireless/ath/ath6kl/bmi.c +index bde5a10d470c8..af98e871199d3 100644 +--- a/drivers/net/wireless/ath/ath6kl/bmi.c ++++ b/drivers/net/wireless/ath/ath6kl/bmi.c +@@ -246,7 +246,7 @@ int ath6kl_bmi_execute(struct ath6kl *ar, u32 addr, u32 *param) + return -EACCES; + } + +- size = sizeof(cid) + sizeof(addr) + sizeof(param); ++ size = sizeof(cid) + sizeof(addr) + sizeof(*param); + if (size > ar->bmi.max_cmd_size) { + WARN_ON(1); + return -EINVAL; +-- +2.39.2 + diff --git a/queue-6.2/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch b/queue-6.2/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch new file mode 100644 index 00000000000..91d8f0782e5 --- /dev/null +++ b/queue-6.2/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch @@ -0,0 +1,43 @@ +From b43333a5ec70a776b80db34af2c224636566aee4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Feb 2023 12:28:05 +0200 +Subject: wifi: ath6kl: reduce WARN to dev_dbg() in callback + +From: Fedor Pchelkin + +[ Upstream commit 75c4a8154cb6c7239fb55d5550f481f6765fb83c ] + +The warn is triggered on a known race condition, documented in the code above +the test, that is correctly handled. Using WARN() hinders automated testing. +Reducing severity. + +Fixes: de2070fc4aa7 ("ath6kl: Fix kernel panic on continuous driver load/unload") +Reported-and-tested-by: syzbot+555908813b2ea35dae9a@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230126182431.867984-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/htc_pipe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c +index c68848819a52d..9b88d96bfe96c 100644 +--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c ++++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c +@@ -960,8 +960,8 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb, + * Thus the possibility of ar->htc_target being NULL + * via ath6kl_recv_complete -> ath6kl_usb_io_comp_work. + */ +- if (WARN_ON_ONCE(!target)) { +- ath6kl_err("Target not yet initialized\n"); ++ if (!target) { ++ ath6kl_dbg(ATH6KL_DBG_HTC, "Target not yet initialized\n"); + status = -EINVAL; + goto free_skb; + } +-- +2.39.2 + diff --git a/queue-6.2/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch b/queue-6.2/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch new file mode 100644 index 00000000000..43f5a445bf1 --- /dev/null +++ b/queue-6.2/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch @@ -0,0 +1,87 @@ +From 0aa834ce8f1b1b0eff3d16d989261f151ce94266 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 22:23:01 +0300 +Subject: wifi: ath9k: hif_usb: fix memory leak of remain_skbs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit 7654cc03eb699297130b693ec34e25f77b17c947 ] + +hif_dev->remain_skb is allocated and used exclusively in +ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is +processed and subsequently freed (in error paths) only during the next +call of ath9k_hif_usb_rx_stream(). + +So, if the urbs are deallocated between those two calls due to the device +deinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream() +is not called next time and the allocated remain_skb is leaked. Our local +Syzkaller instance was able to trigger that. + +remain_skb makes sense when receiving two consecutive urbs which are +logically linked together, i.e. a specific data field from the first skb +indicates a cached skb to be allocated, memcpy'd with some data and +subsequently processed in the next call to ath9k_hif_usb_rx_stream(). Urbs +deallocation supposedly makes that link irrelevant so we need to free the +cached skb in those cases. + +Fix the leak by introducing a function to explicitly free remain_skb (if +it is not NULL) when the rx urbs have been deallocated. remain_skb is NULL +when it has not been allocated at all (hif_dev struct is kzalloced) or +when it has been processed in next call to ath9k_hif_usb_rx_stream(). + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230216192301.171225-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index f521dfa2f1945..e0130beb304df 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -534,6 +534,24 @@ static struct ath9k_htc_hif hif_usb = { + .send = hif_usb_send, + }; + ++/* Need to free remain_skb allocated in ath9k_hif_usb_rx_stream ++ * in case ath9k_hif_usb_rx_stream wasn't called next time to ++ * process the buffer and subsequently free it. ++ */ ++static void ath9k_hif_usb_free_rx_remain_skb(struct hif_device_usb *hif_dev) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&hif_dev->rx_lock, flags); ++ if (hif_dev->remain_skb) { ++ dev_kfree_skb_any(hif_dev->remain_skb); ++ hif_dev->remain_skb = NULL; ++ hif_dev->rx_remain_len = 0; ++ RX_STAT_INC(hif_dev, skb_dropped); ++ } ++ spin_unlock_irqrestore(&hif_dev->rx_lock, flags); ++} ++ + static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + struct sk_buff *skb) + { +@@ -868,6 +886,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev) + static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev) + { + usb_kill_anchored_urbs(&hif_dev->rx_submitted); ++ ath9k_hif_usb_free_rx_remain_skb(hif_dev); + } + + static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) +-- +2.39.2 + diff --git a/queue-6.2/wifi-brcmfmac-support-cqm-rssi-notification-with-old.patch b/queue-6.2/wifi-brcmfmac-support-cqm-rssi-notification-with-old.patch new file mode 100644 index 00000000000..74b154872ec --- /dev/null +++ b/queue-6.2/wifi-brcmfmac-support-cqm-rssi-notification-with-old.patch @@ -0,0 +1,61 @@ +From d38559870bb03c6615f388b2e4603607e2f4d833 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 10:42:48 +0000 +Subject: wifi: brcmfmac: support CQM RSSI notification with older firmware + +From: John Keeping + +[ Upstream commit ec52d77d077529f198fd874c550a26b9cc86a331 ] + +Using the BCM4339 firmware from linux-firmware (version "BCM4339/2 wl0: +Sep 5 2019 11:05:52 version 6.37.39.113 (r722271 CY)" from +cypress/cyfmac4339-sdio.bin) the RSSI respose is only 4 bytes, which +results in an error being logged. + +It seems that older devices send only the RSSI field and neither SNR nor +noise is included. Handle this by accepting a 4 byte message and +reading only the RSSI from it. + +Fixes: 7dd56ea45a66 ("brcmfmac: add support for CQM RSSI notifications") +Signed-off-by: John Keeping +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230124104248.2917465-1-john@metanate.com +Signed-off-by: Sasha Levin +--- + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index b8c99bfce963a..d17bb22422f48 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -6494,18 +6494,20 @@ static s32 brcmf_notify_rssi(struct brcmf_if *ifp, + { + struct brcmf_cfg80211_vif *vif = ifp->vif; + struct brcmf_rssi_be *info = data; +- s32 rssi, snr, noise; ++ s32 rssi, snr = 0, noise = 0; + s32 low, high, last; + +- if (e->datalen < sizeof(*info)) { ++ if (e->datalen >= sizeof(*info)) { ++ rssi = be32_to_cpu(info->rssi); ++ snr = be32_to_cpu(info->snr); ++ noise = be32_to_cpu(info->noise); ++ } else if (e->datalen >= sizeof(rssi)) { ++ rssi = be32_to_cpu(*(__be32 *)data); ++ } else { + brcmf_err("insufficient RSSI event data\n"); + return 0; + } + +- rssi = be32_to_cpu(info->rssi); +- snr = be32_to_cpu(info->snr); +- noise = be32_to_cpu(info->noise); +- + low = vif->cqm_rssi_low; + high = vif->cqm_rssi_high; + last = vif->cqm_rssi_last; +-- +2.39.2 + diff --git a/queue-6.2/wifi-iwlwifi-debug-fix-crash-in-__iwl_err.patch b/queue-6.2/wifi-iwlwifi-debug-fix-crash-in-__iwl_err.patch new file mode 100644 index 00000000000..57577296db7 --- /dev/null +++ b/queue-6.2/wifi-iwlwifi-debug-fix-crash-in-__iwl_err.patch @@ -0,0 +1,51 @@ +From 814c55b4b3669e4c2d6eb8d49dc2b218d21e1bda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 10:44:01 +0300 +Subject: wifi: iwlwifi: debug: fix crash in __iwl_err() + +From: Johannes Berg + +[ Upstream commit 634c7b1bd08ca322537ab389f8cbd7bb543b5e45 ] + +In __iwl_err(), if we rate-limit the message away, then +vaf.va is still NULL-initialized by the time we get to +the tracing code, which then crashes. When it doesn't +get rate-limited out, it's still wrong to reuse the old +args2 that was already printed, which is why we bother +making a copy in the first place. + +Assign vaf.va properly to fix this. + +Fixes: e5f1cc98cc1b ("iwlwifi: allow rate-limited error messages") +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230413102635.e27134c6bcd4.Ib3894cd2ba7a5ad5e75912a7634f146ceaa569e2@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-debug.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-debug.c b/drivers/net/wireless/intel/iwlwifi/iwl-debug.c +index ae4c2a3d63d5b..3a3c13a41fc61 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-debug.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-debug.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause + /* +- * Copyright (C) 2005-2011, 2021 Intel Corporation ++ * Copyright (C) 2005-2011, 2021-2022 Intel Corporation + */ + #include + #include +@@ -57,6 +57,7 @@ void __iwl_err(struct device *dev, enum iwl_err_mode mode, const char *fmt, ...) + default: + break; + } ++ vaf.va = &args; + trace_iwlwifi_err(&vaf); + va_end(args); + } +-- +2.39.2 + diff --git a/queue-6.2/wifi-iwlwifi-fix-duplicate-entry-in-iwl_dev_info_tab.patch b/queue-6.2/wifi-iwlwifi-fix-duplicate-entry-in-iwl_dev_info_tab.patch new file mode 100644 index 00000000000..3fe070a219f --- /dev/null +++ b/queue-6.2/wifi-iwlwifi-fix-duplicate-entry-in-iwl_dev_info_tab.patch @@ -0,0 +1,36 @@ +From 1227a6a6d38ddb9a4f3c6da1115f23201538324a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 17:07:21 +0300 +Subject: wifi: iwlwifi: fix duplicate entry in iwl_dev_info_table + +From: Gregory Greenman + +[ Upstream commit fc3c2f0ed86b65dff4b6844c59c597b977cae533 ] + +There're two identical entries for ax1650 device in +iwl_dev_info_table. Remove one of the duplicate entries. + +Fixes: 953e66a7238b ("iwlwifi: add new ax1650 killer device") +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230410140721.897683-2-gregory.greenman@intel.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 99768d6a60322..a0bf19b18635c 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -565,7 +565,6 @@ static const struct iwl_dev_info iwl_dev_info_table[] = { + IWL_DEV_INFO(0x43F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0, iwl_ax201_killer_1650i_name), + IWL_DEV_INFO(0x43F0, 0x2074, iwl_ax201_cfg_qu_hr, NULL), + IWL_DEV_INFO(0x43F0, 0x4070, iwl_ax201_cfg_qu_hr, NULL), +- IWL_DEV_INFO(0x43F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0, iwl_ax201_killer_1650s_name), + IWL_DEV_INFO(0xA0F0, 0x0070, iwl_ax201_cfg_qu_hr, NULL), + IWL_DEV_INFO(0xA0F0, 0x0074, iwl_ax201_cfg_qu_hr, NULL), + IWL_DEV_INFO(0xA0F0, 0x0078, iwl_ax201_cfg_qu_hr, NULL), +-- +2.39.2 + diff --git a/queue-6.2/wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch b/queue-6.2/wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch new file mode 100644 index 00000000000..3473f19f990 --- /dev/null +++ b/queue-6.2/wifi-iwlwifi-fw-fix-memory-leak-in-debugfs.patch @@ -0,0 +1,42 @@ +From 532aae2c21b1ae121f9eac0573328078c2ec4058 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 12:28:05 +0300 +Subject: wifi: iwlwifi: fw: fix memory leak in debugfs + +From: Johannes Berg + +[ Upstream commit 3d90d2f4a018fe8cfd65068bc6350b6222be4852 ] + +Fix a memory leak that occurs when reading the fw_info +file all the way, since we return NULL indicating no +more data, but don't free the status tracking object. + +Fixes: 36dfe9ac6e8b ("iwlwifi: dump api version in yaml format") +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230418122405.239e501b3b8d.I4268f87809ef91209cbcd748eee0863195e70fa2@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c +index 43e997283db0f..607e07ed2477c 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c +@@ -317,8 +317,10 @@ static void *iwl_dbgfs_fw_info_seq_next(struct seq_file *seq, + const struct iwl_fw *fw = priv->fwrt->fw; + + *pos = ++state->pos; +- if (*pos >= fw->ucode_capa.n_cmd_versions) ++ if (*pos >= fw->ucode_capa.n_cmd_versions) { ++ kfree(state); + return NULL; ++ } + + return state; + } +-- +2.39.2 + diff --git a/queue-6.2/wifi-iwlwifi-fw-move-memset-before-early-return.patch b/queue-6.2/wifi-iwlwifi-fw-move-memset-before-early-return.patch new file mode 100644 index 00000000000..85e7a1d65b1 --- /dev/null +++ b/queue-6.2/wifi-iwlwifi-fw-move-memset-before-early-return.patch @@ -0,0 +1,53 @@ +From 10ee6a5502ced63bb5e6529d2c392dbdd87702ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 13:11:58 +0300 +Subject: wifi: iwlwifi: fw: move memset before early return + +From: Tom Rix + +[ Upstream commit 8ce437dd5b2e4adef13aa4ecce07392f9966b1ab ] + +Clang static analysis reports this representative issue +dbg.c:1455:6: warning: Branch condition evaluates to +a garbage value + if (!rxf_data.size) + ^~~~~~~~~~~~~~ + +This check depends on iwl_ini_get_rxf_data() to clear +rxf_data but the function can return early without +doing the clear. So move the memset before the early +return. + +Fixes: cc9b6012d34b ("iwlwifi: yoyo: use hweight_long instead of bit manipulating") +Signed-off-by: Tom Rix +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230414130637.872a7175f1ff.I33802a77a91998276992b088fbe25f61c87c33ac@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +index bde6f0764a538..027360e63b926 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +@@ -1388,13 +1388,13 @@ static void iwl_ini_get_rxf_data(struct iwl_fw_runtime *fwrt, + if (!data) + return; + ++ memset(data, 0, sizeof(*data)); ++ + /* make sure only one bit is set in only one fid */ + if (WARN_ONCE(hweight_long(fid1) + hweight_long(fid2) != 1, + "fid1=%x, fid2=%x\n", fid1, fid2)) + return; + +- memset(data, 0, sizeof(*data)); +- + if (fid1) { + fifo_idx = ffs(fid1) - 1; + if (WARN_ONCE(fifo_idx >= MAX_NUM_LMAC, "fifo_idx=%d\n", +-- +2.39.2 + diff --git a/queue-6.2/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch b/queue-6.2/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch new file mode 100644 index 00000000000..aa586e2b11a --- /dev/null +++ b/queue-6.2/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch @@ -0,0 +1,50 @@ +From b412b3a52af03aa0ca4a827abea6b674bc1b42da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 15:47:38 +0300 +Subject: wifi: iwlwifi: make the loop for card preparation effective + +From: Emmanuel Grumbach + +[ Upstream commit 28965ec0b5d9112585f725660e2ff13218505ace ] + +Since we didn't reset t to 0, only the first iteration of the loop +did checked the ready bit several times. +From the second iteration and on, we just tested the bit once and +continued to the next iteration. + +Reported-and-tested-by: Lorenzo Zolfanelli +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216452 +Fixes: 289e5501c314 ("iwlwifi: fix the preparation of the card") +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230416154301.615b683ab9c8.Ic52c3229d3345b0064fa34263293db095d88daf8@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 40283fe622daa..171b6bf4a65a0 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -599,7 +599,6 @@ static int iwl_pcie_set_hw_ready(struct iwl_trans *trans) + int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + { + int ret; +- int t = 0; + int iter; + + IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n"); +@@ -616,6 +615,8 @@ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + usleep_range(1000, 2000); + + for (iter = 0; iter < 10; iter++) { ++ int t = 0; ++ + /* If HW is not ready, prepare the conditions to check again */ + iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, + CSR_HW_IF_CONFIG_REG_PREPARE); +-- +2.39.2 + diff --git a/queue-6.2/wifi-iwlwifi-mvm-check-firmware-response-size.patch b/queue-6.2/wifi-iwlwifi-mvm-check-firmware-response-size.patch new file mode 100644 index 00000000000..8dea73232ca --- /dev/null +++ b/queue-6.2/wifi-iwlwifi-mvm-check-firmware-response-size.patch @@ -0,0 +1,53 @@ +From ca1eb41dee53d3cd541a2dc30cd98e0d030a3014 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 11:41:33 +0300 +Subject: wifi: iwlwifi: mvm: check firmware response size + +From: Johannes Berg + +[ Upstream commit 13513cec93ac9902d0b896976d8bab3758a9881c ] + +Check the firmware response size for responses to the +memory read/write command in debugfs before using it. + +Fixes: 2b55f43f8e47 ("iwlwifi: mvm: Add mem debugfs entry") +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230417113648.0d56fcaf68ee.I70e9571f3ed7263929b04f8fabad23c9b999e4ea@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +index 1ce9450e5add2..4071827d44757 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +@@ -1745,6 +1745,11 @@ static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf, + if (ret < 0) + return ret; + ++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) { ++ ret = -EIO; ++ goto out; ++ } ++ + rsp = (void *)hcmd.resp_pkt->data; + if (le32_to_cpu(rsp->status) != DEBUG_MEM_STATUS_SUCCESS) { + ret = -ENXIO; +@@ -1821,6 +1826,11 @@ static ssize_t iwl_dbgfs_mem_write(struct file *file, + if (ret < 0) + return ret; + ++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) { ++ ret = -EIO; ++ goto out; ++ } ++ + rsp = (void *)hcmd.resp_pkt->data; + if (rsp->status != DEBUG_MEM_STATUS_SUCCESS) { + ret = -ENXIO; +-- +2.39.2 + diff --git a/queue-6.2/wifi-iwlwifi-mvm-don-t-drop-unencrypted-mcast-frames.patch b/queue-6.2/wifi-iwlwifi-mvm-don-t-drop-unencrypted-mcast-frames.patch new file mode 100644 index 00000000000..21d63c0bea0 --- /dev/null +++ b/queue-6.2/wifi-iwlwifi-mvm-don-t-drop-unencrypted-mcast-frames.patch @@ -0,0 +1,43 @@ +From 32e9bd194ed1c1130619901e8a1552717ce43cce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 21:40:22 +0300 +Subject: wifi: iwlwifi: mvm: don't drop unencrypted MCAST frames + +From: Ayala Beker + +[ Upstream commit 8e5a26360cbe29b896b6758518280d41c3704d43 ] + +MCAST frames are filtered out by the driver if we are not +authorized yet. +Fix it to filter out only protected frames. + +Fixes: 147eb05f24e6 ("iwlwifi: mvm: always tell the firmware to accept MCAST frames in BSS") +Signed-off-by: Ayala Beker +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230413213309.9cedcc27db60.I8fb7057981392660da482dd215e85c15946d3f4b@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +index 49ca1e168fc5b..eee98cebbb46a 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +@@ -384,9 +384,10 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi, + * Don't even try to decrypt a MCAST frame that was received + * before the managed vif is authorized, we'd fail anyway. + */ +- if (vif->type == NL80211_IFTYPE_STATION && ++ if (is_multicast_ether_addr(hdr->addr1) && ++ vif->type == NL80211_IFTYPE_STATION && + !mvmvif->authorized && +- is_multicast_ether_addr(hdr->addr1)) { ++ ieee80211_has_protected(hdr->frame_control)) { + IWL_DEBUG_DROP(mvm, "MCAST before the vif is authorized\n"); + kfree_skb(skb); + rcu_read_unlock(); +-- +2.39.2 + diff --git a/queue-6.2/wifi-iwlwifi-mvm-don-t-set-checksum_complete-for-uns.patch b/queue-6.2/wifi-iwlwifi-mvm-don-t-set-checksum_complete-for-uns.patch new file mode 100644 index 00000000000..528857d15ad --- /dev/null +++ b/queue-6.2/wifi-iwlwifi-mvm-don-t-set-checksum_complete-for-uns.patch @@ -0,0 +1,49 @@ +From 54fbe32a1755047aea6ae92ca2ca97ee4ef1b22e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 10:44:15 +0300 +Subject: wifi: iwlwifi: mvm: don't set CHECKSUM_COMPLETE for unsupported + protocols + +From: Avraham Stern + +[ Upstream commit 217f3c52f00d3419ecdd38a99a7eceecb11679b2 ] + +On Bz devices, CHECKSUM_COMPLETE was set for unsupported protocols +which results in a warning. Fix it. + +Fixes: b6f5b647f694 ("iwlwifi: mvm: handle RX checksum on Bz devices") +Signed-off-by: Avraham Stern +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230413102635.a2a35286f0ca.I50daa9445a6465514c44f5096c32adef64beba5f@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +index 97b67270f3847..a5356c0d91953 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +@@ -193,8 +193,7 @@ static int iwl_mvm_create_skb(struct iwl_mvm *mvm, struct sk_buff *skb, + * Starting from Bz hardware, it calculates starting directly after + * the MAC header, so that matches mac80211's expectation. + */ +- if (skb->ip_summed == CHECKSUM_COMPLETE && +- mvm->trans->trans_cfg->device_family < IWL_DEVICE_FAMILY_BZ) { ++ if (skb->ip_summed == CHECKSUM_COMPLETE) { + struct { + u8 hdr[6]; + __be16 type; +@@ -209,7 +208,7 @@ static int iwl_mvm_create_skb(struct iwl_mvm *mvm, struct sk_buff *skb, + shdr->type != htons(ETH_P_PAE) && + shdr->type != htons(ETH_P_TDLS)))) + skb->ip_summed = CHECKSUM_NONE; +- else ++ else if (mvm->trans->trans_cfg->device_family < IWL_DEVICE_FAMILY_BZ) + /* mac80211 assumes full CSUM including SNAP header */ + skb_postpush_rcsum(skb, shdr, sizeof(*shdr)); + } +-- +2.39.2 + diff --git a/queue-6.2/wifi-iwlwifi-mvm-fix-a-msdu-checks.patch b/queue-6.2/wifi-iwlwifi-mvm-fix-a-msdu-checks.patch new file mode 100644 index 00000000000..9efe2f04651 --- /dev/null +++ b/queue-6.2/wifi-iwlwifi-mvm-fix-a-msdu-checks.patch @@ -0,0 +1,42 @@ +From fafbb9b1ac38ad0d046b536750054d6fd31c1ac3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 10:44:08 +0300 +Subject: wifi: iwlwifi: mvm: fix A-MSDU checks + +From: Johannes Berg + +[ Upstream commit d34d11aea2d5d71a66f2f90507c3f7202b964175 ] + +Since Gl A-step devices use the old checksum hardware, +we shouldn't use the Bz code to check for A-MSDU +combining ability; fix that. + +Fixes: ec18e7d4d20d ("wifi: iwlwifi: mvm: use old checksum for Bz A-step") +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230413102635.8c445b943fee.Ibf772102ca712f59e2ee0cdd4c344011fcf445aa@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 1d46a2b345eb3..a29e685aac4ff 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -5518,7 +5518,10 @@ static bool iwl_mvm_mac_can_aggregate(struct ieee80211_hw *hw, + { + struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw); + +- if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_BZ) ++ if (mvm->trans->trans_cfg->device_family > IWL_DEVICE_FAMILY_BZ || ++ (mvm->trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_BZ && ++ !(CSR_HW_REV_TYPE(mvm->trans->hw_rev) == IWL_CFG_MAC_TYPE_GL && ++ mvm->trans->hw_rev_step == SILICON_A_STEP))) + return iwl_mvm_tx_csum_bz(mvm, head, true) == + iwl_mvm_tx_csum_bz(mvm, skb, true); + +-- +2.39.2 + diff --git a/queue-6.2/wifi-iwlwifi-mvm-initialize-seq-variable.patch b/queue-6.2/wifi-iwlwifi-mvm-initialize-seq-variable.patch new file mode 100644 index 00000000000..6528e6b5e27 --- /dev/null +++ b/queue-6.2/wifi-iwlwifi-mvm-initialize-seq-variable.patch @@ -0,0 +1,44 @@ +From 8557f703be2a2db4f5b243ad9a368a1d8ac9e1f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 13:11:57 +0300 +Subject: wifi: iwlwifi: mvm: initialize seq variable + +From: Tom Rix + +[ Upstream commit 11e94d2bcd88dea5d9ce99555b6b172f5232d3e2 ] + +Clang static analysis reports this issue +d3.c:567:22: warning: The left operand of '>' is + a garbage value + if (seq.tkip.iv32 > cur_rx_iv32) + ~~~~~~~~~~~~~ ^ + +seq is never initialized. Call ieee80211_get_key_rx_seq() to +initialize seq. + +Fixes: 0419e5e672d6 ("iwlwifi: mvm: d3: separate TKIP data from key iteration") +Signed-off-by: Tom Rix +Reviewed-by: Nick Desaulniers +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230414130637.6dd372f84f93.If1f708c90e6424a935b4eba3917dfb7582e0dd0a@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +index c5ad34b063df6..29f75948ab00c 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +@@ -563,6 +563,7 @@ static void iwl_mvm_wowlan_get_tkip_data(struct ieee80211_hw *hw, + } + + for (i = 0; i < IWL_NUM_RSC; i++) { ++ ieee80211_get_key_rx_seq(key, i, &seq); + /* wrapping isn't allowed, AP must rekey */ + if (seq.tkip.iv32 > cur_rx_iv32) + cur_rx_iv32 = seq.tkip.iv32; +-- +2.39.2 + diff --git a/queue-6.2/wifi-iwlwifi-trans-don-t-trigger-d3-interrupt-twice.patch b/queue-6.2/wifi-iwlwifi-trans-don-t-trigger-d3-interrupt-twice.patch new file mode 100644 index 00000000000..638a20c3105 --- /dev/null +++ b/queue-6.2/wifi-iwlwifi-trans-don-t-trigger-d3-interrupt-twice.patch @@ -0,0 +1,55 @@ +From ace204f0ab9c79374dafc93d42fb8e829b319fd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 10:44:14 +0300 +Subject: wifi: iwlwifi: trans: don't trigger d3 interrupt twice + +From: Avraham Stern + +[ Upstream commit 277f56a141fc54ef7f9e09dba65fb2e12021411d ] + +When the IPC registers are used for sleep control, setting +the IPC sleep bit already triggers an interrupt to the fw, so +there is no need to also set the doorbell. Setting also the +doorbell triggers the sleep interrupt twice which lead to +an assert. + +Fixes: af08571d3925 ("iwlwifi: pcie: support Bz suspend/resume trigger") +Signed-off-by: Avraham Stern +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230413102635.b5f2f6e44d38.I4cb5b6ad4914db47a714e731c4c8b4db679cabce@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 0a9af1ad1f206..40283fe622daa 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -1522,19 +1522,16 @@ static int iwl_pcie_d3_handshake(struct iwl_trans *trans, bool suspend) + struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); + int ret; + +- if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_AX210) { ++ if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_AX210) + iwl_write_umac_prph(trans, UREG_DOORBELL_TO_ISR6, + suspend ? UREG_DOORBELL_TO_ISR6_SUSPEND : + UREG_DOORBELL_TO_ISR6_RESUME); +- } else if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_BZ) { ++ else if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_BZ) + iwl_write32(trans, CSR_IPC_SLEEP_CONTROL, + suspend ? CSR_IPC_SLEEP_CONTROL_SUSPEND : + CSR_IPC_SLEEP_CONTROL_RESUME); +- iwl_write_umac_prph(trans, UREG_DOORBELL_TO_ISR6, +- UREG_DOORBELL_TO_ISR6_SLEEP_CTRL); +- } else { ++ else + return 0; +- } + + ret = wait_event_timeout(trans_pcie->sx_waitq, + trans_pcie->sx_complete, 2 * HZ); +-- +2.39.2 + diff --git a/queue-6.2/wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch b/queue-6.2/wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch new file mode 100644 index 00000000000..336a4f53953 --- /dev/null +++ b/queue-6.2/wifi-iwlwifi-yoyo-fix-possible-division-by-zero.patch @@ -0,0 +1,44 @@ +From 33780a4defec3b14f99ece0c06fabbf4cca9bc7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 21:40:34 +0300 +Subject: wifi: iwlwifi: yoyo: Fix possible division by zero + +From: Daniel Gabay + +[ Upstream commit ba30415118eee374a08b39a0460a1d1e52c24a25 ] + +Don't allow buffer allocation TLV with zero req_size since it +leads later to division by zero in iwl_dbg_tlv_alloc_fragments(). +Also, NPK/SRAM locations are allowed to have zero buffer req_size, +don't discard them. + +Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support") +Signed-off-by: Daniel Gabay +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230413213309.5d6688ed74d8.I5c2f3a882b50698b708d54f4524dc5bdf11e3d32@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +index 48e7376a5fea7..7ed4991f8dab9 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +@@ -138,6 +138,12 @@ static int iwl_dbg_tlv_alloc_buf_alloc(struct iwl_trans *trans, + alloc_id != IWL_FW_INI_ALLOCATION_ID_DBGC1) + goto err; + ++ if (buf_location == IWL_FW_INI_LOCATION_DRAM_PATH && ++ alloc->req_size == 0) { ++ IWL_ERR(trans, "WRT: Invalid DRAM buffer allocation requested size (0)\n"); ++ return -EINVAL; ++ } ++ + trans->dbg.fw_mon_cfg[alloc_id] = *alloc; + + return 0; +-- +2.39.2 + diff --git a/queue-6.2/wifi-iwlwifi-yoyo-skip-dump-correctly-on-hw-error.patch b/queue-6.2/wifi-iwlwifi-yoyo-skip-dump-correctly-on-hw-error.patch new file mode 100644 index 00000000000..620a7b7c323 --- /dev/null +++ b/queue-6.2/wifi-iwlwifi-yoyo-skip-dump-correctly-on-hw-error.patch @@ -0,0 +1,49 @@ +From 2ab765a61175648baae8384486a41de2bc1801d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 21:40:33 +0300 +Subject: wifi: iwlwifi: yoyo: skip dump correctly on hw error + +From: Daniel Gabay + +[ Upstream commit 11195ab0d6f3202cf7af1a4c69570f59c377d8ad ] + +When NIC is in a bad state, reading data will return 28 bits as +0xa5a5a5a and the lowest 4 bits are not fixed value. + +Mask these bits in a few places to skip the dump correctly. + +Fixes: 89639e06d0f3 ("iwlwifi: yoyo: support for new DBGI_SRAM region") +Signed-off-by: Daniel Gabay +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230413213309.df6c0663179d.I36d8487b2419c6fefa65e5514855d94327c3b1eb@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +index abf49022edbe4..bde6f0764a538 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +@@ -1038,7 +1038,7 @@ iwl_dump_ini_prph_mac_iter(struct iwl_fw_runtime *fwrt, + range->range_data_size = reg->dev_addr.size; + for (i = 0; i < le32_to_cpu(reg->dev_addr.size); i += 4) { + prph_val = iwl_read_prph(fwrt->trans, addr + i); +- if (prph_val == 0x5a5a5a5a) ++ if ((prph_val & ~0xf) == 0xa5a5a5a0) + return -EBUSY; + *val++ = cpu_to_le32(prph_val); + } +@@ -1562,7 +1562,7 @@ iwl_dump_ini_dbgi_sram_iter(struct iwl_fw_runtime *fwrt, + prph_data = iwl_read_prph_no_grab(fwrt->trans, (i % 2) ? + DBGI_SRAM_TARGET_ACCESS_RDATA_MSB : + DBGI_SRAM_TARGET_ACCESS_RDATA_LSB); +- if (prph_data == 0x5a5a5a5a) { ++ if ((prph_data & ~0xf) == 0xa5a5a5a0) { + iwl_trans_release_nic_access(fwrt->trans); + return -EBUSY; + } +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-add-flexible-polling-wait-interval-support.patch b/queue-6.2/wifi-mt76-add-flexible-polling-wait-interval-support.patch new file mode 100644 index 00000000000..67a057f20a3 --- /dev/null +++ b/queue-6.2/wifi-mt76-add-flexible-polling-wait-interval-support.patch @@ -0,0 +1,79 @@ +From 803516ca652733af697918f348f84873d8a1c509 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jan 2023 12:56:46 +0800 +Subject: wifi: mt76: add flexible polling wait-interval support + +From: Deren Wu + +[ Upstream commit 35effe6c0c24adcf0f732bb1c3d75573d4c88e63 ] + +The default waiting unit is 10ms and the value is too much for +data path related control. Provide a new API mt76_poll_msec_tick() +to support different cases, such as 1ms polling waiting kick. + +Reviewed-by: Lorenzo Bianconi +Signed-off-by: Deren Wu +Signed-off-by: Felix Fietkau +Stable-dep-of: c397fc1e6365 ("wifi: mt76: mt7921e: fix probe timeout after reboot") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt76.h | 9 +++++---- + drivers/net/wireless/mediatek/mt76/util.c | 10 +++++----- + 2 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h +index d8216243b0224..1fc2fe61ef773 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76.h +@@ -908,10 +908,11 @@ bool __mt76_poll(struct mt76_dev *dev, u32 offset, u32 mask, u32 val, + + #define mt76_poll(dev, ...) __mt76_poll(&((dev)->mt76), __VA_ARGS__) + +-bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val, +- int timeout); +- +-#define mt76_poll_msec(dev, ...) __mt76_poll_msec(&((dev)->mt76), __VA_ARGS__) ++bool ____mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val, ++ int timeout, int kick); ++#define __mt76_poll_msec(...) ____mt76_poll_msec(__VA_ARGS__, 10) ++#define mt76_poll_msec(dev, ...) ____mt76_poll_msec(&((dev)->mt76), __VA_ARGS__, 10) ++#define mt76_poll_msec_tick(dev, ...) ____mt76_poll_msec(&((dev)->mt76), __VA_ARGS__) + + void mt76_mmio_init(struct mt76_dev *dev, void __iomem *regs); + void mt76_pci_disable_aspm(struct pci_dev *pdev); +diff --git a/drivers/net/wireless/mediatek/mt76/util.c b/drivers/net/wireless/mediatek/mt76/util.c +index 581964425468f..fc76c66ff1a5a 100644 +--- a/drivers/net/wireless/mediatek/mt76/util.c ++++ b/drivers/net/wireless/mediatek/mt76/util.c +@@ -24,23 +24,23 @@ bool __mt76_poll(struct mt76_dev *dev, u32 offset, u32 mask, u32 val, + } + EXPORT_SYMBOL_GPL(__mt76_poll); + +-bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val, +- int timeout) ++bool ____mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val, ++ int timeout, int tick) + { + u32 cur; + +- timeout /= 10; ++ timeout /= tick; + do { + cur = __mt76_rr(dev, offset) & mask; + if (cur == val) + return true; + +- usleep_range(10000, 20000); ++ usleep_range(1000 * tick, 2000 * tick); + } while (timeout-- > 0); + + return false; + } +-EXPORT_SYMBOL_GPL(__mt76_poll_msec); ++EXPORT_SYMBOL_GPL(____mt76_poll_msec); + + int mt76_wcid_alloc(u32 *mask, int size) + { +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-connac-fix-txd-multicast-rate-setting.patch b/queue-6.2/wifi-mt76-connac-fix-txd-multicast-rate-setting.patch new file mode 100644 index 00000000000..a6212c47077 --- /dev/null +++ b/queue-6.2/wifi-mt76-connac-fix-txd-multicast-rate-setting.patch @@ -0,0 +1,37 @@ +From fc1718fa2b0a73aa225b04e4898bc0d7b264d27c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 04:23:29 +0800 +Subject: wifi: mt76: connac: fix txd multicast rate setting + +From: Ryder Lee + +[ Upstream commit 3d2892e05086d09aecf14ea64b2debbf495e313c ] + +The vif->bss_conf.mcast_rate should be applied to multicast data frame +only. + +Fixes: 182071cdd594 ("mt76: connac: move connac2_mac_write_txwi in mt76_connac module") +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c +index aed4ee95fb2ec..82aac0a04655f 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c +@@ -537,7 +537,8 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi, + if (txwi[2] & cpu_to_le32(MT_TXD2_FIX_RATE)) { + /* Fixed rata is available just for 802.11 txd */ + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; +- bool multicast = is_multicast_ether_addr(hdr->addr1); ++ bool multicast = ieee80211_is_data(hdr->frame_control) && ++ is_multicast_ether_addr(hdr->addr1); + u16 rate = mt76_connac2_mac_tx_rate_val(mphy, vif, beacon, + multicast); + u32 val = MT_TXD6_FIXED_BW; +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-fix-6ghz-high-channel-not-be-scanned.patch b/queue-6.2/wifi-mt76-fix-6ghz-high-channel-not-be-scanned.patch new file mode 100644 index 00000000000..c96e72650aa --- /dev/null +++ b/queue-6.2/wifi-mt76-fix-6ghz-high-channel-not-be-scanned.patch @@ -0,0 +1,59 @@ +From 32649447573e6b35b898f48ac57af06cd697a652 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 21:26:12 +0800 +Subject: wifi: mt76: fix 6GHz high channel not be scanned + +From: Ming Yen Hsieh + +[ Upstream commit 23792cedaff02351b57bddd8957fc917fa88f2e0 ] + +mt76 scan command only support 64 channels currently. If the +channel count is larger than 64(for 2+5+6GHz), some channels will +not be scanned. Hence change the scan type to full channel scan +in case of the command cannot include proper list for chip. + +Fixes: 399090ef9605 ("mt76: mt76_connac: move hw_scan and sched_scan routine in mt76_connac_mcu module") +Reported-by: Ben Greear +Tested-by: Isaac Konikoff +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Deren Wu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +index d106cbfc387c8..b678820ba6327 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +@@ -1632,8 +1632,16 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif, + req->channel_min_dwell_time = cpu_to_le16(duration); + req->channel_dwell_time = cpu_to_le16(duration); + +- req->channels_num = min_t(u8, sreq->n_channels, 32); +- req->ext_channels_num = min_t(u8, ext_channels_num, 32); ++ if (sreq->n_channels == 0 || sreq->n_channels > 64) { ++ req->channel_type = 0; ++ req->channels_num = 0; ++ req->ext_channels_num = 0; ++ } else { ++ req->channel_type = 4; ++ req->channels_num = min_t(u8, sreq->n_channels, 32); ++ req->ext_channels_num = min_t(u8, ext_channels_num, 32); ++ } ++ + for (i = 0; i < req->channels_num + req->ext_channels_num; i++) { + if (i >= 32) + chan = &req->ext_channels[i - 32]; +@@ -1653,7 +1661,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif, + } + chan->channel_num = scan_list[i]->hw_value; + } +- req->channel_type = sreq->n_channels ? 4 : 0; + + if (sreq->ie_len > 0) { + memcpy(req->ies, sreq->ie, sreq->ie_len); +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-handle-failure-of-vzalloc-in-mt7615_coredu.patch b/queue-6.2/wifi-mt76-handle-failure-of-vzalloc-in-mt7615_coredu.patch new file mode 100644 index 00000000000..91348e0b99c --- /dev/null +++ b/queue-6.2/wifi-mt76-handle-failure-of-vzalloc-in-mt7615_coredu.patch @@ -0,0 +1,48 @@ +From e5e7c77392d3804320b2bb34fcefacf09704acac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 22:48:23 +0800 +Subject: wifi: mt76: handle failure of vzalloc in mt7615_coredump_work + +From: Kang Chen + +[ Upstream commit 9e47dd9f64a47ae00ca0123017584c37209ee900 ] + +vzalloc may fails, dump might be null and will cause +illegal address access later. + +Link: https://lore.kernel.org/all/Y%2Fy5Asxw3T3m4jCw@lore-desk +Fixes: d2bf7959d9c0 ("mt76: mt7663: introduce coredump support") +Signed-off-by: Kang Chen +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +index 5c41ad5955f4b..eafa0f204c1f8 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +@@ -2355,7 +2355,7 @@ void mt7615_coredump_work(struct work_struct *work) + break; + + skb_pull(skb, sizeof(struct mt7615_mcu_rxd)); +- if (data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) { ++ if (!dump || data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) { + dev_kfree_skb(skb); + continue; + } +@@ -2365,6 +2365,8 @@ void mt7615_coredump_work(struct work_struct *work) + + dev_kfree_skb(skb); + } +- dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ, +- GFP_KERNEL); ++ ++ if (dump) ++ dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ, ++ GFP_KERNEL); + } +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch b/queue-6.2/wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch new file mode 100644 index 00000000000..3cb93a8d6ed --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch @@ -0,0 +1,85 @@ +From aac74521994509277ba53f59593b487a0d117917 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Dec 2022 10:28:09 +0800 +Subject: wifi: mt76: mt7915: add error message in + mt7915_thermal_set_cur_throttle_state() + +From: Howard Hsu + +[ Upstream commit 2f2d86309e228adfe658c9c0a23c726d8b3ce475 ] + +Add dev_err so that it is easier to see invalid setting while looking at +dmesg. + +Co-developed-by: Ryder Lee +Signed-off-by: Ryder Lee +Signed-off-by: Howard Hsu +Signed-off-by: Felix Fietkau +Stable-dep-of: 9c97df11dfe6 ("wifi: mt76: mt7915: rework init flow in mt7915_thermal_init()") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/init.c | 12 +++++++----- + drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h | 2 ++ + 2 files changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +index 916d6c7c569d3..db0a35974ca7e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +@@ -146,8 +146,11 @@ mt7915_thermal_set_cur_throttle_state(struct thermal_cooling_device *cdev, + u8 throttling = MT7915_THERMAL_THROTTLE_MAX - state; + int ret; + +- if (state > MT7915_CDEV_THROTTLE_MAX) ++ if (state > MT7915_CDEV_THROTTLE_MAX) { ++ dev_err(phy->dev->mt76.dev, ++ "please specify a valid throttling state\n"); + return -EINVAL; ++ } + + if (state == phy->cdev_state) + return 0; +@@ -176,7 +179,7 @@ static void mt7915_unregister_thermal(struct mt7915_phy *phy) + struct wiphy *wiphy = phy->mt76->hw->wiphy; + + if (!phy->cdev) +- return; ++ return; + + sysfs_remove_link(&wiphy->dev.kobj, "cooling_device"); + thermal_cooling_device_unregister(phy->cdev); +@@ -210,8 +213,8 @@ static int mt7915_thermal_init(struct mt7915_phy *phy) + return PTR_ERR(hwmon); + + /* initialize critical/maximum high temperature */ +- phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = 110; +- phy->throttle_temp[MT7915_MAX_TEMP_IDX] = 120; ++ phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = MT7915_CRIT_TEMP; ++ phy->throttle_temp[MT7915_MAX_TEMP_IDX] = MT7915_MAX_TEMP; + + return 0; + } +@@ -1112,7 +1115,6 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev) + mt7986_wmac_disable(dev); + } + +- + int mt7915_register_device(struct mt7915_dev *dev) + { + struct ieee80211_hw *hw = mt76_hw(dev); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +index e58650bbbd14a..942d70c538254 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +@@ -72,6 +72,8 @@ + + #define MT7915_CRIT_TEMP_IDX 0 + #define MT7915_MAX_TEMP_IDX 1 ++#define MT7915_CRIT_TEMP 110 ++#define MT7915_MAX_TEMP 120 + + struct mt7915_vif; + struct mt7915_sta; +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7915-expose-device-tree-match-table.patch b/queue-6.2/wifi-mt76-mt7915-expose-device-tree-match-table.patch new file mode 100644 index 00000000000..b0406f29a38 --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7915-expose-device-tree-match-table.patch @@ -0,0 +1,40 @@ +From 8a8aeb50b58869f18041abfb09505d1e950be96c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Feb 2023 12:29:45 +0100 +Subject: wifi: mt76: mt7915: expose device tree match table + +From: Lorenz Brun + +[ Upstream commit 90fb69212c60e26ef70ed0e8532b116c7649ac88 ] + +On MT7986 the WiFi driver currently does not get automatically loaded, +requiring manual modprobing because the device tree compatibles are not +exported into metadata. + +Add the missing MODULE_DEVICE_TABLE macro to fix this. + +Fixes: 99ad32a4ca3a2 ("mt76: mt7915: add support for MT7986") +Signed-off-by: Lorenz Brun +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/soc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/soc.c b/drivers/net/wireless/mediatek/mt76/mt7915/soc.c +index 686c9bbd59293..7303b690a64dc 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/soc.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/soc.c +@@ -1237,6 +1237,8 @@ static const struct of_device_id mt7986_wmac_of_match[] = { + {}, + }; + ++MODULE_DEVICE_TABLE(of, mt7986_wmac_of_match); ++ + struct platform_driver mt7986_wmac_driver = { + .driver = { + .name = "mt7986-wmac", +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7915-rework-init-flow-in-mt7915_thermal_.patch b/queue-6.2/wifi-mt76-mt7915-rework-init-flow-in-mt7915_thermal_.patch new file mode 100644 index 00000000000..bb9005e6e6a --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7915-rework-init-flow-in-mt7915_thermal_.patch @@ -0,0 +1,51 @@ +From 673d4c4a4ea1ab15c7e03577449e24553a6c9700 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Feb 2023 14:24:57 +0800 +Subject: wifi: mt76: mt7915: rework init flow in mt7915_thermal_init() + +From: Howard Hsu + +[ Upstream commit 9c97df11dfe68b548a47744ba9fa6beddcfba2bc ] + +If kernel do not enable CONFIG_HWMON, it may cause thermal +initialization to be done with temperature value 0 and then can not +transmit. This commit fixes it by setting trigger/restore temperature +before checking CONFIG_HWMON. + +Fixes: 7d12b38ab6f6 ("wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() only after init_work") +Signed-off-by: Howard Hsu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/init.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +index db0a35974ca7e..0d8bc7b06a46b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +@@ -204,6 +204,10 @@ static int mt7915_thermal_init(struct mt7915_phy *phy) + phy->cdev = cdev; + } + ++ /* initialize critical/maximum high temperature */ ++ phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = MT7915_CRIT_TEMP; ++ phy->throttle_temp[MT7915_MAX_TEMP_IDX] = MT7915_MAX_TEMP; ++ + if (!IS_REACHABLE(CONFIG_HWMON)) + return 0; + +@@ -212,10 +216,6 @@ static int mt7915_thermal_init(struct mt7915_phy *phy) + if (IS_ERR(hwmon)) + return PTR_ERR(hwmon); + +- /* initialize critical/maximum high temperature */ +- phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = MT7915_CRIT_TEMP; +- phy->throttle_temp[MT7915_MAX_TEMP_IDX] = MT7915_MAX_TEMP; +- + return 0; + } + +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7915-unlock-on-error-in-mt7915_thermal_t.patch b/queue-6.2/wifi-mt76-mt7915-unlock-on-error-in-mt7915_thermal_t.patch new file mode 100644 index 00000000000..3ab37cbc00c --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7915-unlock-on-error-in-mt7915_thermal_t.patch @@ -0,0 +1,35 @@ +From 729413fd1651a4341cd187b02b6a8e5b5091befd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 15:15:05 +0300 +Subject: wifi: mt76: mt7915: unlock on error in mt7915_thermal_temp_store() + +From: Dan Carpenter + +[ Upstream commit cdc215c2c8d74b3c8886650e979b47f16c1f7f92 ] + +Drop the lock before returning -EINVAL. + +Fixes: ecaccdae7a7e ("wifi: mt76: mt7915: rework mt7915_thermal_temp_store()") +Signed-off-by: Dan Carpenter +Acked-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/init.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +index a80ae31e7abff..916d6c7c569d3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +@@ -90,6 +90,7 @@ static ssize_t mt7915_thermal_temp_store(struct device *dev, + val < phy->throttle_temp[MT7915_CRIT_TEMP_IDX])) { + dev_err(phy->dev->mt76.dev, + "temp1_max shall be greater than temp1_crit."); ++ mutex_unlock(&phy->dev->mt76.mutex); + return -EINVAL; + } + +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7921-fix-missing-unwind-goto-in-mt7921u_.patch b/queue-6.2/wifi-mt76-mt7921-fix-missing-unwind-goto-in-mt7921u_.patch new file mode 100644 index 00000000000..d726f263b4b --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7921-fix-missing-unwind-goto-in-mt7921u_.patch @@ -0,0 +1,39 @@ +From 8bfce5426df448a4202354c47456514237adb6b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 14:22:34 +0800 +Subject: wifi: mt76: mt7921: fix missing unwind goto in `mt7921u_probe` + +From: Jiefeng Li + +[ Upstream commit 5c47cdebbaeb7724df6f9f46917c93e53f791547 ] + +`mt7921u_dma_init` can only return zero or negative number according to its +definition. When it returns non-zero number, there exists an error and this +function should handle this error rather than return directly. + +Fixes: 0d2afe09fad5 ("mt76: mt7921: add mt7921u driver") +Signed-off-by: Jiefeng Li +Reviewed-by: Dongliang Mu +Reviewed-by: Sridhar Samudrala +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c +index 5321d20dcdcbf..363a170efdda9 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c +@@ -270,7 +270,7 @@ static int mt7921u_probe(struct usb_interface *usb_intf, + + ret = mt7921u_dma_init(dev, false); + if (ret) +- return ret; ++ goto error; + + hw = mt76_hw(dev); + /* check hw sg support in order to enable AMSDU */ +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7921-fix-pci-dma-hang-after-reboot.patch b/queue-6.2/wifi-mt76-mt7921-fix-pci-dma-hang-after-reboot.patch new file mode 100644 index 00000000000..86699f5dfca --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7921-fix-pci-dma-hang-after-reboot.patch @@ -0,0 +1,50 @@ +From efbe6b8aa67af7f398aefd828b0a85da78330ebe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 10:49:57 +0800 +Subject: wifi: mt76: mt7921: fix PCI DMA hang after reboot + +From: Deren Wu + +[ Upstream commit 9270270d62191b7549296721e8d5f3dc0df01563 ] + +mt7921 just stop some workers and clean up chip status before reboot. +In stress test, there are working activities still running at the period +of .shutdown callback and that would cause some hosts cannot recover +DMA after reboot. To avoid the floating state in reboot, we use +mt7921_pci_remove() to fully deinit all resources. + +Fixes: f23a0cea8bd6 ("wifi: mt76: mt7921e: add pci .shutdown() support") +Signed-off-by: Deren Wu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c +index 41be108e1d5a1..bda92d8359692 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c +@@ -515,17 +515,7 @@ static int mt7921_pci_resume(struct device *device) + + static void mt7921_pci_shutdown(struct pci_dev *pdev) + { +- struct mt76_dev *mdev = pci_get_drvdata(pdev); +- struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76); +- struct mt76_connac_pm *pm = &dev->pm; +- +- cancel_delayed_work_sync(&pm->ps_work); +- cancel_work_sync(&pm->wake_work); +- +- /* chip cleanup before reboot */ +- mt7921_mcu_drv_pmctrl(dev); +- mt7921_dma_cleanup(dev); +- mt7921_wfsys_reset(dev); ++ mt7921_pci_remove(pdev); + } + + static DEFINE_SIMPLE_DEV_PM_OPS(mt7921_pm_ops, mt7921_pci_suspend, mt7921_pci_resume); +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7921-fix-wrong-command-to-set-sta-channe.patch b/queue-6.2/wifi-mt76-mt7921-fix-wrong-command-to-set-sta-channe.patch new file mode 100644 index 00000000000..1592d6bd8ca --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7921-fix-wrong-command-to-set-sta-channe.patch @@ -0,0 +1,42 @@ +From 01b376bc4a164dcd6e42e23b10d08526d0282220 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Feb 2023 09:01:58 +0800 +Subject: wifi: mt76: mt7921: fix wrong command to set STA channel + +From: Deren Wu + +[ Upstream commit fcc51acfebb85dbc3ab1bea3ce4997d7c0a3a38d ] + +Should not use AND operator to check vif type NL80211_IFTYPE_MONITOR, and +that will cause we go into sniffer command for both STA and MONITOR +mode. However, the sniffer command would set channel properly (with some +extra options), the STA mode still works even if using the wrong +command. + +Fix vif type check to make sure we using the right command to update +channel. + +Fixes: 914189af23b8 ("wifi: mt76: mt7921: fix channel switch fail in monitor mode") +Signed-off-by: Deren Wu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +index 744382be36f8b..b2366efd74ea5 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +@@ -1705,7 +1705,7 @@ static void mt7921_ctx_iter(void *priv, u8 *mac, + if (ctx != mvif->ctx) + return; + +- if (vif->type & NL80211_IFTYPE_MONITOR) ++ if (vif->type == NL80211_IFTYPE_MONITOR) + mt7921_mcu_config_sniffer(mvif, ctx); + else + mt76_connac_mcu_uni_set_chctx(mvif->phy->mt76, &mvif->mt76, ctx); +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7921e-fix-probe-timeout-after-reboot.patch b/queue-6.2/wifi-mt76-mt7921e-fix-probe-timeout-after-reboot.patch new file mode 100644 index 00000000000..9f525eeae2f --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7921e-fix-probe-timeout-after-reboot.patch @@ -0,0 +1,50 @@ +From cbdbdced2d5f974486e69fc6207962e829b1af50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 15:41:12 +0800 +Subject: wifi: mt76: mt7921e: fix probe timeout after reboot + +From: Quan Zhou + +[ Upstream commit c397fc1e6365a2a9e5540a85b2c1d4ea412aa0e2 ] + +In system warm reboot scene, due to the polling timeout(now 1000us) +is too short to wait dma idle in time, it may make driver probe fail +with error code -ETIMEDOUT. Meanwhile, we also found the dma may take +around 70ms to enter idle state. Change the polling idle timeout to +100ms to avoid the probabilistic probe fail. + +Tested pass with 5000 times warm reboot on x86 platform. + +[4.477496] pci 0000:01:00.0: attach allowed to drvr mt7921e [internal device] +[4.478306] mt7921e 0000:01:00.0: ASIC revision: 79610010 +[4.480063] mt7921e: probe of 0000:01:00.0 failed with error -110 + +Fixes: 0a1059d0f060 ("mt76: mt7921: move mt7921_dma_reset in dma.c") +Signed-off-by: Quan Zhou +Signed-off-by: Deren Wu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/dma.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c +index d1f10f6d9adc3..dc4ccfef4b048 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c +@@ -90,9 +90,9 @@ static int mt7921_dma_disable(struct mt7921_dev *dev, bool force) + MT_WFDMA0_GLO_CFG_OMIT_RX_INFO | + MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2); + +- if (!mt76_poll(dev, MT_WFDMA0_GLO_CFG, +- MT_WFDMA0_GLO_CFG_TX_DMA_BUSY | +- MT_WFDMA0_GLO_CFG_RX_DMA_BUSY, 0, 1000)) ++ if (!mt76_poll_msec_tick(dev, MT_WFDMA0_GLO_CFG, ++ MT_WFDMA0_GLO_CFG_TX_DMA_BUSY | ++ MT_WFDMA0_GLO_CFG_RX_DMA_BUSY, 0, 100, 1)) + return -ETIMEDOUT; + + return 0; +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7921e-improve-reliability-of-dma-reset.patch b/queue-6.2/wifi-mt76-mt7921e-improve-reliability-of-dma-reset.patch new file mode 100644 index 00000000000..154e4a427d0 --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7921e-improve-reliability-of-dma-reset.patch @@ -0,0 +1,107 @@ +From 1ecbc2a1aad7b56b51d1df6f242b8a9a139940e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 05:11:13 +0800 +Subject: wifi: mt76: mt7921e: improve reliability of dma reset + +From: Quan Zhou + +[ Upstream commit 87714bf6ed1589813e473db5471e6e9857755764 ] + +The hardware team has advised the driver that it is necessary to first put +WFDMA into an idle state before resetting the WFDMA. Otherwise, the WFDMA +may enter an unknown state where it cannot be polled with the right state +successfully. To ensure that the DMA can work properly while a stressful +cold reboot test was being made, we have reordered the programming sequence +in the driver based on the hardware team's guidance. + +The patch would modify the WFDMA disabling flow from + +"DMA reset -> disabling DMASHDL -> disabling WFDMA -> polling and waiting +until DMA idle" to "disabling WFDMA -> polling and waiting for DMA idle -> +disabling DMASHDL -> DMA reset. + +Where he polling and waiting until WFDMA is idle is coordinated with the +operation of disabling WFDMA. Even while WFDMA is being disabled, it can +still handle Tx/Rx requests. The additional polling allows sufficient time +for WFDMA to process the last T/Rx request. When the idle state of WFDMA is +reached, it is a reliable indication that DMASHDL is also idle to ensure it +is safe to disable it and perform the DMA reset. + +Fixes: 0a1059d0f060 ("mt76: mt7921: move mt7921_dma_reset in dma.c") +Co-developed-by: Sean Wang +Signed-off-by: Sean Wang +Co-developed-by: Deren Wu +Signed-off-by: Deren Wu +Co-developed-by: Wang Zhao +Signed-off-by: Wang Zhao +Signed-off-by: Quan Zhou +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7921/dma.c | 36 ++++++++++--------- + 1 file changed, 20 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c +index dc4ccfef4b048..fd57c87a29ae3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c +@@ -66,22 +66,6 @@ static void mt7921_dma_prefetch(struct mt7921_dev *dev) + + static int mt7921_dma_disable(struct mt7921_dev *dev, bool force) + { +- if (force) { +- /* reset */ +- mt76_clear(dev, MT_WFDMA0_RST, +- MT_WFDMA0_RST_DMASHDL_ALL_RST | +- MT_WFDMA0_RST_LOGIC_RST); +- +- mt76_set(dev, MT_WFDMA0_RST, +- MT_WFDMA0_RST_DMASHDL_ALL_RST | +- MT_WFDMA0_RST_LOGIC_RST); +- } +- +- /* disable dmashdl */ +- mt76_clear(dev, MT_WFDMA0_GLO_CFG_EXT0, +- MT_WFDMA0_CSR_TX_DMASHDL_ENABLE); +- mt76_set(dev, MT_DMASHDL_SW_CONTROL, MT_DMASHDL_DMASHDL_BYPASS); +- + /* disable WFDMA0 */ + mt76_clear(dev, MT_WFDMA0_GLO_CFG, + MT_WFDMA0_GLO_CFG_TX_DMA_EN | MT_WFDMA0_GLO_CFG_RX_DMA_EN | +@@ -95,6 +79,22 @@ static int mt7921_dma_disable(struct mt7921_dev *dev, bool force) + MT_WFDMA0_GLO_CFG_RX_DMA_BUSY, 0, 100, 1)) + return -ETIMEDOUT; + ++ /* disable dmashdl */ ++ mt76_clear(dev, MT_WFDMA0_GLO_CFG_EXT0, ++ MT_WFDMA0_CSR_TX_DMASHDL_ENABLE); ++ mt76_set(dev, MT_DMASHDL_SW_CONTROL, MT_DMASHDL_DMASHDL_BYPASS); ++ ++ if (force) { ++ /* reset */ ++ mt76_clear(dev, MT_WFDMA0_RST, ++ MT_WFDMA0_RST_DMASHDL_ALL_RST | ++ MT_WFDMA0_RST_LOGIC_RST); ++ ++ mt76_set(dev, MT_WFDMA0_RST, ++ MT_WFDMA0_RST_DMASHDL_ALL_RST | ++ MT_WFDMA0_RST_LOGIC_RST); ++ } ++ + return 0; + } + +@@ -301,6 +301,10 @@ void mt7921_dma_cleanup(struct mt7921_dev *dev) + MT_WFDMA0_GLO_CFG_OMIT_RX_INFO | + MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2); + ++ mt76_poll_msec_tick(dev, MT_WFDMA0_GLO_CFG, ++ MT_WFDMA0_GLO_CFG_TX_DMA_BUSY | ++ MT_WFDMA0_GLO_CFG_RX_DMA_BUSY, 0, 100, 1); ++ + /* reset */ + mt76_clear(dev, MT_WFDMA0_RST, + MT_WFDMA0_RST_DMASHDL_ALL_RST | +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7921e-stop-chip-reset-worker-in-unregist.patch b/queue-6.2/wifi-mt76-mt7921e-stop-chip-reset-worker-in-unregist.patch new file mode 100644 index 00000000000..d4967d0fc77 --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7921e-stop-chip-reset-worker-in-unregist.patch @@ -0,0 +1,52 @@ +From 5fc682c98c8bb8f787df0a36cb3c845849883377 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 05:11:14 +0800 +Subject: wifi: mt76: mt7921e: stop chip reset worker in unregister hook + +From: Quan Zhou + +[ Upstream commit 3d78c46423c6567ed25ca033e086865b1b4d5ae1 ] + +If the chip reset worker is triggered during the remove process, the chip +DMA may not be properly pushed back to the idle state. This can lead to +corruption of the DMA flow due to the chip reset. Therefore, it is +necessary to stop the chip reset before the DMA is finalized. + +To avoid resetting the chip after the reset worker is cancelled, use +__mt7921_mcu_drv_pmctrl() instead of mt7921_mcu_drv_pmctrl(). It is safe to +ignore the pm mutex because the pm worker and wake worker have already been +cancelled. + +Fixes: 033ae79b3830 ("mt76: mt7921: refactor init.c to be bus independent") +Co-developed-by: Sean Wang +Signed-off-by: Sean Wang +Co-developed-by: Deren Wu +Signed-off-by: Deren Wu +Co-developed-by: Wang Zhao +Signed-off-by: Wang Zhao +Signed-off-by: Quan Zhou +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c +index bda92d8359692..aa4ecf008a3c9 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c +@@ -115,9 +115,10 @@ static void mt7921e_unregister_device(struct mt7921_dev *dev) + napi_disable(&dev->mt76.napi[i]); + cancel_delayed_work_sync(&pm->ps_work); + cancel_work_sync(&pm->wake_work); ++ cancel_work_sync(&dev->reset_work); + + mt7921_tx_token_put(dev); +- mt7921_mcu_drv_pmctrl(dev); ++ __mt7921_mcu_drv_pmctrl(dev); + mt7921_dma_cleanup(dev); + mt7921_wfsys_reset(dev); + skb_queue_purge(&dev->mt76.mcu.res_q); +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7996-fill-txd-by-host-driver.patch b/queue-6.2/wifi-mt76-mt7996-fill-txd-by-host-driver.patch new file mode 100644 index 00000000000..a932a76d08f --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7996-fill-txd-by-host-driver.patch @@ -0,0 +1,54 @@ +From 0dad622d915b675ebd07aaae504f65b429c87b5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 13:58:40 +0800 +Subject: wifi: mt76: mt7996: fill txd by host driver + +From: Ryder Lee + +[ Upstream commit 3b522cadedfe6e9e0e8193d7d4ab5aa8d0c73209 ] + +The hardware SDO has issue to fill txd for the moment, so fallback to +driver filling method. + +Fixes: 98686cd21624 (wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices) +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +index 4a9d1d3556825..e643a27048f93 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +@@ -1101,11 +1101,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + return id; + + pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb); +- memset(txwi_ptr, 0, MT_TXD_SIZE); +- /* Transmit non qos data by 802.11 header and need to fill txd by host*/ +- if (!is_8023 || pid >= MT_PACKET_ID_FIRST) +- mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key, +- pid, qid, 0); ++ mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key, ++ pid, qid, 0); + + txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE); + for (i = 0; i < nbuf; i++) { +@@ -1114,10 +1111,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + } + txp->fw.nbuf = nbuf; + +- txp->fw.flags = cpu_to_le16(MT_CT_INFO_FROM_HOST); +- +- if (!is_8023 || pid >= MT_PACKET_ID_FIRST) +- txp->fw.flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD); ++ txp->fw.flags = ++ cpu_to_le16(MT_CT_INFO_FROM_HOST | MT_CT_INFO_APPLY_TXD); + + if (!key) + txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME); +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7996-fix-eeprom-tx-path-bitfields.patch b/queue-6.2/wifi-mt76-mt7996-fix-eeprom-tx-path-bitfields.patch new file mode 100644 index 00000000000..f5fe6320ae9 --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7996-fix-eeprom-tx-path-bitfields.patch @@ -0,0 +1,43 @@ +From d966871610eb8cff4a7ea519350daafa80894217 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 16:35:58 +0800 +Subject: wifi: mt76: mt7996: fix eeprom tx path bitfields + +From: StanleyYP Wang + +[ Upstream commit 72fc0df3006ce5c109f9c68f0724e44c47b4ec7b ] + +Swap the tx path bitfields of band1 and band2 to read correct setting. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: StanleyYP Wang +Signed-off-by: Shayne Chen +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/eeprom.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.h +index 8da599e0abeac..cfc48698539b3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.h +@@ -31,11 +31,11 @@ enum mt7996_eeprom_field { + #define MT_EE_WIFI_CONF2_BAND_SEL GENMASK(2, 0) + + #define MT_EE_WIFI_CONF1_TX_PATH_BAND0 GENMASK(5, 3) +-#define MT_EE_WIFI_CONF2_TX_PATH_BAND1 GENMASK(5, 3) +-#define MT_EE_WIFI_CONF2_TX_PATH_BAND2 GENMASK(2, 0) ++#define MT_EE_WIFI_CONF2_TX_PATH_BAND1 GENMASK(2, 0) ++#define MT_EE_WIFI_CONF2_TX_PATH_BAND2 GENMASK(5, 3) + #define MT_EE_WIFI_CONF4_STREAM_NUM_BAND0 GENMASK(5, 3) +-#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND1 GENMASK(5, 3) +-#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND2 GENMASK(2, 0) ++#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND1 GENMASK(2, 0) ++#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND2 GENMASK(5, 3) + + #define MT_EE_RATE_DELTA_MASK GENMASK(5, 0) + #define MT_EE_RATE_DELTA_SIGN BIT(6) +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch b/queue-6.2/wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch new file mode 100644 index 00000000000..355ef723160 --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch @@ -0,0 +1,39 @@ +From 8ed6866b36b7b6dc033f31786149df232d87e60e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 16:35:55 +0800 +Subject: wifi: mt76: mt7996: fix pointer calculation in ie countdown event + +From: Peter Chiu + +[ Upstream commit 8b14ce24a0297175bc4ebdf26d45a22b5a33847f ] + +Fix the tail and data pointers. The rxd->len in mt7996_mcu_rxd does not +include the length of general rxd. It only includes the length of +firmware event rxd. Use skb->length to get the correct length. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Peter Chiu +Signed-off-by: Shayne Chen +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index 18c4e7bc4370d..c8c332ed8a402 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -421,7 +421,8 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb) + if (hdr->band && dev->mt76.phys[hdr->band]) + mphy = dev->mt76.phys[hdr->band]; + +- tail = skb->data + le16_to_cpu(rxd->len); ++ tail = skb->data + skb->len; ++ data += sizeof(struct header); + while (data + sizeof(struct tlv) < tail && le16_to_cpu(tlv->len)) { + switch (le16_to_cpu(tlv->tag)) { + case UNI_EVENT_IE_COUNTDOWN_CSA: +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7996-fix-radiotap-bitfield.patch b/queue-6.2/wifi-mt76-mt7996-fix-radiotap-bitfield.patch new file mode 100644 index 00000000000..ebea7603a64 --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7996-fix-radiotap-bitfield.patch @@ -0,0 +1,213 @@ +From 1aeed1cc77d8f49b2541aef37a2d08d67b895edc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Feb 2023 01:46:54 +0800 +Subject: wifi: mt76: mt7996: fix radiotap bitfield + +From: Ryder Lee + +[ Upstream commit 63a3724632464559d1e98d90d2c63d43ec6ef6f5 ] + +The 11be generation's radiotap bitfields were wrongly copy-and-pasted +from 11ax driver, so fix them accordingly. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7996/mac.c | 54 ++++++++++--------- + .../net/wireless/mediatek/mt76/mt7996/mac.h | 41 +++++++------- + 2 files changed, 47 insertions(+), 48 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +index 0eb9e4d73f2c1..c4567641210b1 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +@@ -253,12 +253,9 @@ mt7996_mac_decode_he_radiotap_ru(struct mt76_rx_status *status, + struct ieee80211_radiotap_he *he, + __le32 *rxv) + { +- u32 ru_h, ru_l; +- u8 ru, offs = 0; ++ u32 ru, offs = 0; + +- ru_l = le32_get_bits(rxv[0], MT_PRXV_HE_RU_ALLOC_L); +- ru_h = le32_get_bits(rxv[1], MT_PRXV_HE_RU_ALLOC_H); +- ru = (u8)(ru_l | ru_h << 4); ++ ru = le32_get_bits(rxv[0], MT_PRXV_HE_RU_ALLOC); + + status->bw = RATE_INFO_BW_HE_RU; + +@@ -323,18 +320,23 @@ mt7996_mac_decode_he_mu_radiotap(struct sk_buff *skb, __le32 *rxv) + + he_mu->flags2 |= MU_PREP(FLAGS2_BW_FROM_SIG_A_BW, status->bw) | + MU_PREP(FLAGS2_SIG_B_SYMS_USERS, +- le32_get_bits(rxv[2], MT_CRXV_HE_NUM_USER)); ++ le32_get_bits(rxv[4], MT_CRXV_HE_NUM_USER)); + +- he_mu->ru_ch1[0] = le32_get_bits(rxv[3], MT_CRXV_HE_RU0); ++ he_mu->ru_ch1[0] = le32_get_bits(rxv[16], MT_CRXV_HE_RU0) & 0xff; + + if (status->bw >= RATE_INFO_BW_40) { + he_mu->flags1 |= HE_BITS(MU_FLAGS1_CH2_RU_KNOWN); +- he_mu->ru_ch2[0] = le32_get_bits(rxv[3], MT_CRXV_HE_RU1); ++ he_mu->ru_ch2[0] = le32_get_bits(rxv[16], MT_CRXV_HE_RU1) & 0xff; + } + + if (status->bw >= RATE_INFO_BW_80) { +- he_mu->ru_ch1[1] = le32_get_bits(rxv[3], MT_CRXV_HE_RU2); +- he_mu->ru_ch2[1] = le32_get_bits(rxv[3], MT_CRXV_HE_RU3); ++ u32 ru_h, ru_l; ++ ++ he_mu->ru_ch1[1] = le32_get_bits(rxv[16], MT_CRXV_HE_RU2) & 0xff; ++ ++ ru_l = le32_get_bits(rxv[16], MT_CRXV_HE_RU3_L); ++ ru_h = le32_get_bits(rxv[17], MT_CRXV_HE_RU3_H) & 0x7; ++ he_mu->ru_ch2[1] = (u8)(ru_l | ru_h << 4); + } + } + +@@ -357,23 +359,23 @@ mt7996_mac_decode_he_radiotap(struct sk_buff *skb, __le32 *rxv, u8 mode) + HE_BITS(DATA2_TXOP_KNOWN), + }; + struct ieee80211_radiotap_he *he = NULL; +- u32 ltf_size = le32_get_bits(rxv[2], MT_CRXV_HE_LTF_SIZE) + 1; ++ u32 ltf_size = le32_get_bits(rxv[4], MT_CRXV_HE_LTF_SIZE) + 1; + + status->flag |= RX_FLAG_RADIOTAP_HE; + + he = skb_push(skb, sizeof(known)); + memcpy(he, &known, sizeof(known)); + +- he->data3 = HE_PREP(DATA3_BSS_COLOR, BSS_COLOR, rxv[14]) | +- HE_PREP(DATA3_LDPC_XSYMSEG, LDPC_EXT_SYM, rxv[2]); +- he->data4 = HE_PREP(DATA4_SU_MU_SPTL_REUSE, SR_MASK, rxv[11]); +- he->data5 = HE_PREP(DATA5_PE_DISAMBIG, PE_DISAMBIG, rxv[2]) | ++ he->data3 = HE_PREP(DATA3_BSS_COLOR, BSS_COLOR, rxv[9]) | ++ HE_PREP(DATA3_LDPC_XSYMSEG, LDPC_EXT_SYM, rxv[4]); ++ he->data4 = HE_PREP(DATA4_SU_MU_SPTL_REUSE, SR_MASK, rxv[13]); ++ he->data5 = HE_PREP(DATA5_PE_DISAMBIG, PE_DISAMBIG, rxv[5]) | + le16_encode_bits(ltf_size, + IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE); + if (le32_to_cpu(rxv[0]) & MT_PRXV_TXBF) + he->data5 |= HE_BITS(DATA5_TXBF); +- he->data6 = HE_PREP(DATA6_TXOP, TXOP_DUR, rxv[14]) | +- HE_PREP(DATA6_DOPPLER, DOPPLER, rxv[14]); ++ he->data6 = HE_PREP(DATA6_TXOP, TXOP_DUR, rxv[9]) | ++ HE_PREP(DATA6_DOPPLER, DOPPLER, rxv[9]); + + switch (mode) { + case MT_PHY_TYPE_HE_SU: +@@ -382,22 +384,22 @@ mt7996_mac_decode_he_radiotap(struct sk_buff *skb, __le32 *rxv, u8 mode) + HE_BITS(DATA1_BEAM_CHANGE_KNOWN) | + HE_BITS(DATA1_BW_RU_ALLOC_KNOWN); + +- he->data3 |= HE_PREP(DATA3_BEAM_CHANGE, BEAM_CHNG, rxv[14]) | +- HE_PREP(DATA3_UL_DL, UPLINK, rxv[2]); ++ he->data3 |= HE_PREP(DATA3_BEAM_CHANGE, BEAM_CHNG, rxv[8]) | ++ HE_PREP(DATA3_UL_DL, UPLINK, rxv[5]); + break; + case MT_PHY_TYPE_HE_EXT_SU: + he->data1 |= HE_BITS(DATA1_FORMAT_EXT_SU) | + HE_BITS(DATA1_UL_DL_KNOWN) | + HE_BITS(DATA1_BW_RU_ALLOC_KNOWN); + +- he->data3 |= HE_PREP(DATA3_UL_DL, UPLINK, rxv[2]); ++ he->data3 |= HE_PREP(DATA3_UL_DL, UPLINK, rxv[5]); + break; + case MT_PHY_TYPE_HE_MU: + he->data1 |= HE_BITS(DATA1_FORMAT_MU) | + HE_BITS(DATA1_UL_DL_KNOWN); + +- he->data3 |= HE_PREP(DATA3_UL_DL, UPLINK, rxv[2]); +- he->data4 |= HE_PREP(DATA4_MU_STA_ID, MU_AID, rxv[7]); ++ he->data3 |= HE_PREP(DATA3_UL_DL, UPLINK, rxv[5]); ++ he->data4 |= HE_PREP(DATA4_MU_STA_ID, MU_AID, rxv[8]); + + mt7996_mac_decode_he_radiotap_ru(status, he, rxv); + mt7996_mac_decode_he_mu_radiotap(skb, rxv); +@@ -408,10 +410,10 @@ mt7996_mac_decode_he_radiotap(struct sk_buff *skb, __le32 *rxv, u8 mode) + HE_BITS(DATA1_SPTL_REUSE3_KNOWN) | + HE_BITS(DATA1_SPTL_REUSE4_KNOWN); + +- he->data4 |= HE_PREP(DATA4_TB_SPTL_REUSE1, SR_MASK, rxv[11]) | +- HE_PREP(DATA4_TB_SPTL_REUSE2, SR1_MASK, rxv[11]) | +- HE_PREP(DATA4_TB_SPTL_REUSE3, SR2_MASK, rxv[11]) | +- HE_PREP(DATA4_TB_SPTL_REUSE4, SR3_MASK, rxv[11]); ++ he->data4 |= HE_PREP(DATA4_TB_SPTL_REUSE1, SR_MASK, rxv[13]) | ++ HE_PREP(DATA4_TB_SPTL_REUSE2, SR1_MASK, rxv[13]) | ++ HE_PREP(DATA4_TB_SPTL_REUSE3, SR2_MASK, rxv[13]) | ++ HE_PREP(DATA4_TB_SPTL_REUSE4, SR3_MASK, rxv[13]); + + mt7996_mac_decode_he_radiotap_ru(status, he, rxv); + break; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.h b/drivers/net/wireless/mediatek/mt76/mt7996/mac.h +index 9f68852012b9e..ed79388e59713 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.h +@@ -102,8 +102,7 @@ enum rx_pkt_type { + #define MT_PRXV_NSTS GENMASK(10, 7) + #define MT_PRXV_TXBF BIT(11) + #define MT_PRXV_HT_AD_CODE BIT(12) +-#define MT_PRXV_HE_RU_ALLOC_L GENMASK(31, 28) +-#define MT_PRXV_HE_RU_ALLOC_H GENMASK(3, 0) ++#define MT_PRXV_HE_RU_ALLOC GENMASK(30, 22) + #define MT_PRXV_RCPI3 GENMASK(31, 24) + #define MT_PRXV_RCPI2 GENMASK(23, 16) + #define MT_PRXV_RCPI1 GENMASK(15, 8) +@@ -113,34 +112,32 @@ enum rx_pkt_type { + #define MT_PRXV_TX_MODE GENMASK(14, 11) + #define MT_PRXV_FRAME_MODE GENMASK(2, 0) + #define MT_PRXV_DCM BIT(5) +-#define MT_PRXV_NUM_RX BIT(8, 6) + + /* C-RXV */ +-#define MT_CRXV_HT_STBC GENMASK(1, 0) +-#define MT_CRXV_TX_MODE GENMASK(7, 4) +-#define MT_CRXV_FRAME_MODE GENMASK(10, 8) +-#define MT_CRXV_HT_SHORT_GI GENMASK(14, 13) +-#define MT_CRXV_HE_LTF_SIZE GENMASK(18, 17) +-#define MT_CRXV_HE_LDPC_EXT_SYM BIT(20) +-#define MT_CRXV_HE_PE_DISAMBIG BIT(23) +-#define MT_CRXV_HE_NUM_USER GENMASK(30, 24) +-#define MT_CRXV_HE_UPLINK BIT(31) +-#define MT_CRXV_HE_RU0 GENMASK(7, 0) +-#define MT_CRXV_HE_RU1 GENMASK(15, 8) +-#define MT_CRXV_HE_RU2 GENMASK(23, 16) +-#define MT_CRXV_HE_RU3 GENMASK(31, 24) +- +-#define MT_CRXV_HE_MU_AID GENMASK(30, 20) ++#define MT_CRXV_HE_NUM_USER GENMASK(26, 20) ++#define MT_CRXV_HE_LTF_SIZE GENMASK(28, 27) ++#define MT_CRXV_HE_LDPC_EXT_SYM BIT(30) ++ ++#define MT_CRXV_HE_PE_DISAMBIG BIT(1) ++#define MT_CRXV_HE_UPLINK BIT(2) ++ ++#define MT_CRXV_HE_MU_AID GENMASK(27, 17) ++#define MT_CRXV_HE_BEAM_CHNG BIT(29) ++ ++#define MT_CRXV_HE_DOPPLER BIT(0) ++#define MT_CRXV_HE_BSS_COLOR GENMASK(15, 10) ++#define MT_CRXV_HE_TXOP_DUR GENMASK(19, 17) + + #define MT_CRXV_HE_SR_MASK GENMASK(11, 8) + #define MT_CRXV_HE_SR1_MASK GENMASK(16, 12) + #define MT_CRXV_HE_SR2_MASK GENMASK(20, 17) + #define MT_CRXV_HE_SR3_MASK GENMASK(24, 21) + +-#define MT_CRXV_HE_BSS_COLOR GENMASK(5, 0) +-#define MT_CRXV_HE_TXOP_DUR GENMASK(12, 6) +-#define MT_CRXV_HE_BEAM_CHNG BIT(13) +-#define MT_CRXV_HE_DOPPLER BIT(16) ++#define MT_CRXV_HE_RU0 GENMASK(8, 0) ++#define MT_CRXV_HE_RU1 GENMASK(17, 9) ++#define MT_CRXV_HE_RU2 GENMASK(26, 18) ++#define MT_CRXV_HE_RU3_L GENMASK(31, 27) ++#define MT_CRXV_HE_RU3_H GENMASK(3, 0) + + enum tx_header_format { + MT_HDR_FORMAT_802_3, +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7996-let-non-bufferable-mmpdus-use-corre.patch b/queue-6.2/wifi-mt76-mt7996-let-non-bufferable-mmpdus-use-corre.patch new file mode 100644 index 00000000000..28fd77440fa --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7996-let-non-bufferable-mmpdus-use-corre.patch @@ -0,0 +1,102 @@ +From 338dd0a26b7259fc01de9a68d2434301b5ce3c5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 16:35:53 +0800 +Subject: wifi: mt76: mt7996: let non-bufferable MMPDUs use correct hw queue + +From: Shayne Chen + +[ Upstream commit d0b6f86fdbefa62fd4ad2acd1aea6c45f9b518ba ] + +Pass qid into mt7996_mac_write_txwi() to let the tx descriptor of +non-bufferable MMPDUs be filled with correct hw queue index. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Shayne Chen +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 11 ++++++----- + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 6 +++--- + drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 5 +++-- + 3 files changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +index c4567641210b1..17f0b287507d7 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +@@ -962,8 +962,9 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi, + } + + void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, +- struct sk_buff *skb, struct mt76_wcid *wcid, int pid, +- struct ieee80211_key_conf *key, u32 changed) ++ struct sk_buff *skb, struct mt76_wcid *wcid, ++ struct ieee80211_key_conf *key, int pid, ++ enum mt76_txq_id qid, u32 changed) + { + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + struct ieee80211_vif *vif = info->control.vif; +@@ -994,7 +995,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, + } else if (beacon) { + p_fmt = MT_TX_TYPE_FW; + q_idx = MT_LMAC_BCN0; +- } else if (skb_get_queue_mapping(skb) >= MT_TXQ_PSD) { ++ } else if (qid >= MT_TXQ_PSD) { + p_fmt = MT_TX_TYPE_CT; + q_idx = MT_LMAC_ALTX0; + } else { +@@ -1103,8 +1104,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + memset(txwi_ptr, 0, MT_TXD_SIZE); + /* Transmit non qos data by 802.11 header and need to fill txd by host*/ + if (!is_8023 || pid >= MT_PACKET_ID_FIRST) +- mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid, +- key, 0); ++ mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key, ++ pid, qid, 0); + + txp = (struct mt7996_txp *)(txwi + MT_TXD_SIZE); + for (i = 0; i < nbuf; i++) { +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index d593ed9e3f73c..18c4e7bc4370d 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -1804,8 +1804,9 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif, + } + + buf = (u8 *)bcn + sizeof(*bcn) - MAX_BEACON_SIZE; +- mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL, ++ mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL, 0, 0, + BSS_CHANGED_BEACON); ++ + memcpy(buf + MT_TXD_SIZE, skb->data, skb->len); + } + +@@ -1995,8 +1996,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev, + + buf = (u8 *)tlv + sizeof(*discov) - MAX_INBAND_FRAME_SIZE; + +- mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL, +- changed); ++ mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL, 0, 0, changed); + + memcpy(buf + MT_TXD_SIZE, skb->data, skb->len); + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +index 725344791b4cd..e8eedae78479f 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +@@ -472,8 +472,9 @@ void mt7996_mac_enable_nf(struct mt7996_dev *dev, u8 band); + void mt7996_mac_enable_rtscts(struct mt7996_dev *dev, + struct ieee80211_vif *vif, bool enable); + void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, +- struct sk_buff *skb, struct mt76_wcid *wcid, int pid, +- struct ieee80211_key_conf *key, u32 changed); ++ struct sk_buff *skb, struct mt76_wcid *wcid, ++ struct ieee80211_key_conf *key, int pid, ++ enum mt76_txq_id qid, u32 changed); + void mt7996_mac_set_timing(struct mt7996_phy *phy); + int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif, + struct ieee80211_sta *sta); +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-mt7996-rely-on-mt76_connac_txp_common-stru.patch b/queue-6.2/wifi-mt76-mt7996-rely-on-mt76_connac_txp_common-stru.patch new file mode 100644 index 00000000000..27e14460047 --- /dev/null +++ b/queue-6.2/wifi-mt76-mt7996-rely-on-mt76_connac_txp_common-stru.patch @@ -0,0 +1,172 @@ +From db97d56a3f6471535415750517ebf19ecc206760 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 17:30:38 +0100 +Subject: wifi: mt76: mt7996: rely on mt76_connac_txp_common structure + +From: Lorenzo Bianconi + +[ Upstream commit 3c38dfc1702d812f7c4a89ed5b0521e2ad8381d6 ] + +mt7996_txp structure is equal to mt76_connac_fw_txp one. Drop mt7996_txp +and rely on mt76_connac_txp_common. + +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Stable-dep-of: 3b522cadedfe ("wifi: mt76: mt7996: fill txd by host driver") +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7996/mac.c | 38 +++++++++---------- + .../net/wireless/mediatek/mt76/mt7996/mac.h | 15 +------- + .../net/wireless/mediatek/mt76/mt7996/mmio.c | 2 +- + 3 files changed, 22 insertions(+), 33 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +index 17f0b287507d7..4a9d1d3556825 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +@@ -1072,8 +1072,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb); + struct ieee80211_key_conf *key = info->control.hw_key; + struct ieee80211_vif *vif = info->control.vif; ++ struct mt76_connac_txp_common *txp; + struct mt76_txwi_cache *t; +- struct mt7996_txp *txp; + int id, i, pid, nbuf = tx_info->nbuf - 1; + bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP; + u8 *txwi = (u8 *)txwi_ptr; +@@ -1107,35 +1107,35 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key, + pid, qid, 0); + +- txp = (struct mt7996_txp *)(txwi + MT_TXD_SIZE); ++ txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE); + for (i = 0; i < nbuf; i++) { +- txp->buf[i] = cpu_to_le32(tx_info->buf[i + 1].addr); +- txp->len[i] = cpu_to_le16(tx_info->buf[i + 1].len); ++ txp->fw.buf[i] = cpu_to_le32(tx_info->buf[i + 1].addr); ++ txp->fw.len[i] = cpu_to_le16(tx_info->buf[i + 1].len); + } +- txp->nbuf = nbuf; ++ txp->fw.nbuf = nbuf; + +- txp->flags = cpu_to_le16(MT_CT_INFO_FROM_HOST); ++ txp->fw.flags = cpu_to_le16(MT_CT_INFO_FROM_HOST); + + if (!is_8023 || pid >= MT_PACKET_ID_FIRST) +- txp->flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD); ++ txp->fw.flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD); + + if (!key) +- txp->flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME); ++ txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME); + + if (!is_8023 && ieee80211_is_mgmt(hdr->frame_control)) +- txp->flags |= cpu_to_le16(MT_CT_INFO_MGMT_FRAME); ++ txp->fw.flags |= cpu_to_le16(MT_CT_INFO_MGMT_FRAME); + + if (vif) { + struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv; + +- txp->bss_idx = mvif->mt76.idx; ++ txp->fw.bss_idx = mvif->mt76.idx; + } + +- txp->token = cpu_to_le16(id); ++ txp->fw.token = cpu_to_le16(id); + if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) +- txp->rept_wds_wcid = cpu_to_le16(wcid->idx); ++ txp->fw.rept_wds_wcid = cpu_to_le16(wcid->idx); + else +- txp->rept_wds_wcid = cpu_to_le16(0xfff); ++ txp->fw.rept_wds_wcid = cpu_to_le16(0xfff); + tx_info->skb = DMA_DUMMY_DATA; + + /* pass partial skb header to fw */ +@@ -1174,13 +1174,13 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi) + static void + mt7996_txp_skb_unmap(struct mt76_dev *dev, struct mt76_txwi_cache *t) + { +- struct mt7996_txp *txp; ++ struct mt76_connac_txp_common *txp; + int i; + + txp = mt7996_txwi_to_txp(dev, t); +- for (i = 0; i < txp->nbuf; i++) +- dma_unmap_single(dev->dev, le32_to_cpu(txp->buf[i]), +- le16_to_cpu(txp->len[i]), DMA_TO_DEVICE); ++ for (i = 0; i < txp->fw.nbuf; i++) ++ dma_unmap_single(dev->dev, le32_to_cpu(txp->fw.buf[i]), ++ le16_to_cpu(txp->fw.len[i]), DMA_TO_DEVICE); + } + + static void +@@ -1557,11 +1557,11 @@ void mt7996_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e) + + /* error path */ + if (e->skb == DMA_DUMMY_DATA) { ++ struct mt76_connac_txp_common *txp; + struct mt76_txwi_cache *t; +- struct mt7996_txp *txp; + + txp = mt7996_txwi_to_txp(mdev, e->txwi); +- t = mt76_token_put(mdev, le16_to_cpu(txp->token)); ++ t = mt76_token_put(mdev, le16_to_cpu(txp->fw.token)); + e->skb = t ? t->skb : NULL; + } + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.h b/drivers/net/wireless/mediatek/mt76/mt7996/mac.h +index ed79388e59713..1404ded52104a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.h +@@ -265,17 +265,6 @@ enum tx_mgnt_type { + /* VHT/HE only use bits 0-3 */ + #define MT_TX_RATE_IDX GENMASK(5, 0) + +-struct mt7996_txp { +- __le16 flags; +- __le16 token; +- u8 bss_idx; +- __le16 rept_wds_wcid; +- u8 nbuf; +-#define MT_TXP_MAX_BUF_NUM 6 +- __le32 buf[MT_TXP_MAX_BUF_NUM]; +- __le16 len[MT_TXP_MAX_BUF_NUM]; +-} __packed __aligned(4); +- + #define MT_TXFREE0_PKT_TYPE GENMASK(31, 27) + #define MT_TXFREE0_MSDU_CNT GENMASK(25, 16) + #define MT_TXFREE0_RX_BYTE GENMASK(15, 0) +@@ -379,7 +368,7 @@ struct mt7996_dfs_radar_spec { + struct mt7996_dfs_pattern radar_pattern[16]; + }; + +-static inline struct mt7996_txp * ++static inline struct mt76_connac_txp_common * + mt7996_txwi_to_txp(struct mt76_dev *dev, struct mt76_txwi_cache *t) + { + u8 *txwi; +@@ -389,7 +378,7 @@ mt7996_txwi_to_txp(struct mt76_dev *dev, struct mt76_txwi_cache *t) + + txwi = mt76_get_txwi_ptr(dev, t); + +- return (struct mt7996_txp *)(txwi + MT_TXD_SIZE); ++ return (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE); + } + + #endif +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +index d8a2c1a744b25..2237f50adbc71 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +@@ -318,7 +318,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev, + { + static const struct mt76_driver_ops drv_ops = { + /* txwi_size = txd size + txp size */ +- .txwi_size = MT_TXD_SIZE + sizeof(struct mt7996_txp), ++ .txwi_size = MT_TXD_SIZE + sizeof(struct mt76_connac_fw_txp), + .drv_flags = MT_DRV_TXWI_NO_FREE | + MT_DRV_HW_MGMT_TXQ, + .survey_flags = SURVEY_INFO_TIME_TX | +-- +2.39.2 + diff --git a/queue-6.2/wifi-mt76-remove-redundent-mcu_uni_cmd_-definitions.patch b/queue-6.2/wifi-mt76-remove-redundent-mcu_uni_cmd_-definitions.patch new file mode 100644 index 00000000000..ee99dca8066 --- /dev/null +++ b/queue-6.2/wifi-mt76-remove-redundent-mcu_uni_cmd_-definitions.patch @@ -0,0 +1,36 @@ +From 870480d6ce6d343329df3e1a849087b004646a97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Feb 2023 14:53:04 +0800 +Subject: wifi: mt76: remove redundent MCU_UNI_CMD_* definitions + +From: Deren Wu + +[ Upstream commit 532f0482fc577a78c0086893ab39acb406ac3e65 ] + +clear redundent definitions only + +Fixes: 5b55b6da982c ("wifi: mt76: mt7921: add unified ROC cmd/event support") +Signed-off-by: Deren Wu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h +index 82fdf6d794bcf..3c7c369d997ad 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h +@@ -962,9 +962,6 @@ enum { + DEV_INFO_MAX_NUM + }; + +-#define MCU_UNI_CMD_EVENT BIT(1) +-#define MCU_UNI_CMD_UNSOLICITED_EVENT BIT(2) +- + /* event table */ + enum { + MCU_EVENT_TARGET_ADDRESS_LEN = 0x01, +-- +2.39.2 + diff --git a/queue-6.2/wifi-rt2x00-fix-memory-leak-when-handling-surveys.patch b/queue-6.2/wifi-rt2x00-fix-memory-leak-when-handling-surveys.patch new file mode 100644 index 00000000000..4adb6ae8e38 --- /dev/null +++ b/queue-6.2/wifi-rt2x00-fix-memory-leak-when-handling-surveys.patch @@ -0,0 +1,65 @@ +From 71322d82417ec67a56cdc4125c8cb7083957ebc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 23:56:37 +0200 +Subject: wifi: rt2x00: Fix memory leak when handling surveys + +From: Armin Wolf + +[ Upstream commit cbef9a83c51dfcb07f77cfa6ac26f53a1ea86f49 ] + +When removing a rt2x00 device, its associated channel surveys +are not freed, causing a memory leak observable with kmemleak: + +unreferenced object 0xffff9620f0881a00 (size 512): + comm "systemd-udevd", pid 2290, jiffies 4294906974 (age 33.768s) + hex dump (first 32 bytes): + 70 44 12 00 00 00 00 00 92 8a 00 00 00 00 00 00 pD.............. + 00 00 00 00 00 00 00 00 ab 87 01 00 00 00 00 00 ................ + backtrace: + [] __kmalloc+0x4b/0x130 + [] rt2800_probe_hw+0xc2b/0x1380 [rt2800lib] + [] rt2800usb_probe_hw+0xe/0x60 [rt2800usb] + [] rt2x00lib_probe_dev+0x21a/0x7d0 [rt2x00lib] + [] rt2x00usb_probe+0x1be/0x980 [rt2x00usb] + [] usb_probe_interface+0xe2/0x310 [usbcore] + [] really_probe+0x1a5/0x410 + [] __driver_probe_device+0x78/0x180 + [] driver_probe_device+0x1e/0x90 + [] __driver_attach+0xd2/0x1c0 + [] bus_for_each_dev+0x77/0xd0 + [] bus_add_driver+0x112/0x210 + [] driver_register+0x5c/0x120 + [] usb_register_driver+0x88/0x150 [usbcore] + [] do_one_initcall+0x44/0x220 + [] do_init_module+0x4c/0x220 + +Fix this by freeing the channel surveys on device removal. + +Tested with a RT3070 based USB wireless adapter. + +Fixes: 5447626910f5 ("rt2x00: save survey for every channel visited") +Signed-off-by: Armin Wolf +Reviewed-by: Simon Horman +Acked-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230330215637.4332-1-W_Armin@gmx.de +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c +index 3a035afcf7f99..9a9cfd0ce402d 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c +@@ -1091,6 +1091,7 @@ static void rt2x00lib_remove_hw(struct rt2x00_dev *rt2x00dev) + } + + kfree(rt2x00dev->spec.channels_info); ++ kfree(rt2x00dev->chan_survey); + } + + static const struct ieee80211_tpt_blink rt2x00_tpt_blink[] = { +-- +2.39.2 + diff --git a/queue-6.2/wifi-rtl8xxxu-remove-always-true-condition-in-rtl8xx.patch b/queue-6.2/wifi-rtl8xxxu-remove-always-true-condition-in-rtl8xx.patch new file mode 100644 index 00000000000..a0711d937c0 --- /dev/null +++ b/queue-6.2/wifi-rtl8xxxu-remove-always-true-condition-in-rtl8xx.patch @@ -0,0 +1,45 @@ +From 5a6a77cc9745c9634771db0ab300ea24b7cebd0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Feb 2023 20:49:12 +0200 +Subject: wifi: rtl8xxxu: Remove always true condition in + rtl8xxxu_print_chipinfo + +From: Bitterblue Smith + +[ Upstream commit b9b1e4fe2957f361c86e288ecf373dc7895cf7c7 ] + +Fix a new smatch warning: +drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c:1580 rtl8xxxu_print_chipinfo() warn: always true condition '(priv->chip_cut <= 15) => (0-15 <= 15)' + +Reported-by: kernel test robot +Link: https://lore.kernel.org/oe-kbuild-all/202302140753.71IgU77A-lkp@intel.com/ +Fixes: 7b0ac469e331 ("wifi: rtl8xxxu: Recognise all possible chip cuts") +Signed-off-by: Bitterblue Smith +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/68eff98b-a022-5a00-f330-adf623a35772@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index d22990464dad6..846bd268ffd94 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -1574,11 +1574,7 @@ rtl8xxxu_set_spec_sifs(struct rtl8xxxu_priv *priv, u16 cck, u16 ofdm) + static void rtl8xxxu_print_chipinfo(struct rtl8xxxu_priv *priv) + { + struct device *dev = &priv->udev->dev; +- char cut = '?'; +- +- /* Currently always true: chip_cut is 4 bits. */ +- if (priv->chip_cut <= 15) +- cut = 'A' + priv->chip_cut; ++ char cut = 'A' + priv->chip_cut; + + dev_info(dev, + "RTL%s rev %c (%s) %iT%iR, TX queues %i, WiFi=%i, BT=%i, GPS=%i, HI PA=%i\n", +-- +2.39.2 + diff --git a/queue-6.2/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch b/queue-6.2/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch new file mode 100644 index 00000000000..6c25f5ffe9c --- /dev/null +++ b/queue-6.2/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch @@ -0,0 +1,54 @@ +From 04e5f37680c8cc06ac67537a3e66a2283973c893 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 05:31:38 +0000 +Subject: wifi: rtlwifi: fix incorrect error codes in + rtl_debugfs_set_write_rfreg() + +From: Wei Chen + +[ Upstream commit 905a9241e4e8c15d2c084fee916280514848fe35 ] + +If there is a failure during copy_from_user or user-provided data buffer +is invalid, rtl_debugfs_set_write_rfreg should return negative error code +instead of a positive value count. + +Fix this bug by returning correct error code. Moreover, the check of buffer +against null is removed since it will be handled by copy_from_user. + +Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs") +Signed-off-by: Wei Chen +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230326053138.91338-1-harperchen1110@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c +index 0b1bc04cb6adb..602717928887d 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.c ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c +@@ -375,8 +375,8 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp, + + tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count); + +- if (!buffer || copy_from_user(tmp, buffer, tmp_len)) +- return count; ++ if (copy_from_user(tmp, buffer, tmp_len)) ++ return -EFAULT; + + tmp[tmp_len] = '\0'; + +@@ -386,7 +386,7 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp, + if (num != 4) { + rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG, + "Format is \n"); +- return count; ++ return -EINVAL; + } + + rtl_set_rfreg(hw, path, addr, bitmask, data); +-- +2.39.2 + diff --git a/queue-6.2/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-32578 b/queue-6.2/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-32578 new file mode 100644 index 00000000000..9a7024edd7f --- /dev/null +++ b/queue-6.2/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-32578 @@ -0,0 +1,54 @@ +From 8dc02cc33010335a46f0c1d278984a052e3c72ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 05:42:17 +0000 +Subject: wifi: rtlwifi: fix incorrect error codes in + rtl_debugfs_set_write_reg() + +From: Wei Chen + +[ Upstream commit 5dbe1f8eb8c5ac69394400a5b86fd81775e96c43 ] + +If there is a failure during copy_from_user or user-provided data buffer is +invalid, rtl_debugfs_set_write_reg should return negative error code instead +of a positive value count. + +Fix this bug by returning correct error code. Moreover, the check of buffer +against null is removed since it will be handled by copy_from_user. + +Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs") +Signed-off-by: Wei Chen +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230326054217.93492-1-harperchen1110@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c +index 602717928887d..9eb26dfe4ca92 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.c ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c +@@ -278,8 +278,8 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp, + + tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count); + +- if (!buffer || copy_from_user(tmp, buffer, tmp_len)) +- return count; ++ if (copy_from_user(tmp, buffer, tmp_len)) ++ return -EFAULT; + + tmp[tmp_len] = '\0'; + +@@ -287,7 +287,7 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp, + num = sscanf(tmp, "%x %x %x", &addr, &val, &len); + + if (num != 3) +- return count; ++ return -EINVAL; + + switch (len) { + case 1: +-- +2.39.2 + diff --git a/queue-6.2/wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch b/queue-6.2/wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch new file mode 100644 index 00000000000..c2bb258f9cf --- /dev/null +++ b/queue-6.2/wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch @@ -0,0 +1,51 @@ +From 3fbe1f34d670c5e4af611582ebc55404bd2c2f0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Feb 2023 23:10:04 +0100 +Subject: wifi: rtw88: mac: Return the original error from + rtw_mac_power_switch() + +From: Martin Blumenstingl + +[ Upstream commit 15c8e267dfa62f207ee1db666c822324e3362b84 ] + +rtw_mac_power_switch() calls rtw_pwr_seq_parser() which can return +-EINVAL, -EBUSY or 0. Propagate the original error code instead of +unconditionally returning -EINVAL in case of an error. + +Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230226221004.138331-3-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/mac.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c +index a4afef14e18d6..8625a0a1430ac 100644 +--- a/drivers/net/wireless/realtek/rtw88/mac.c ++++ b/drivers/net/wireless/realtek/rtw88/mac.c +@@ -247,6 +247,7 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on) + const struct rtw_pwr_seq_cmd **pwr_seq; + u8 rpwm; + bool cur_pwr; ++ int ret; + + if (rtw_chip_wcpu_11ac(rtwdev)) { + rpwm = rtw_read8(rtwdev, rtwdev->hci.rpwm_addr); +@@ -270,8 +271,9 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on) + return -EALREADY; + + pwr_seq = pwr_on ? chip->pwr_on_seq : chip->pwr_off_seq; +- if (rtw_pwr_seq_parser(rtwdev, pwr_seq)) +- return -EINVAL; ++ ret = rtw_pwr_seq_parser(rtwdev, pwr_seq); ++ if (ret) ++ return ret; + + if (pwr_on) + set_bit(RTW_FLAG_POWERON, rtwdev->flags); +-- +2.39.2 + diff --git a/queue-6.2/wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch b/queue-6.2/wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch new file mode 100644 index 00000000000..ab05dfda2eb --- /dev/null +++ b/queue-6.2/wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch @@ -0,0 +1,39 @@ +From 11f29f2208e51e035248f59415604c7873f64537 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Feb 2023 23:10:03 +0100 +Subject: wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser() + +From: Martin Blumenstingl + +[ Upstream commit b7ed9fa2cb76ca7a3c3cd4a6d35748fe1fbda9f6 ] + +rtw_pwr_seq_parser() calls rtw_sub_pwr_seq_parser() which can either +return -EBUSY, -EINVAL or 0. Propagate the original error code instead +of unconditionally returning -EBUSY in case of an error. + +Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230226221004.138331-2-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/mac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c +index aa7c5901ef260..a4afef14e18d6 100644 +--- a/drivers/net/wireless/realtek/rtw88/mac.c ++++ b/drivers/net/wireless/realtek/rtw88/mac.c +@@ -233,7 +233,7 @@ static int rtw_pwr_seq_parser(struct rtw_dev *rtwdev, + + ret = rtw_sub_pwr_seq_parser(rtwdev, intf_mask, cut_mask, cmd); + if (ret) +- return -EBUSY; ++ return ret; + + idx++; + } while (1); +-- +2.39.2 + diff --git a/queue-6.2/workqueue-fix-hung-time-report-of-worker-pools.patch b/queue-6.2/workqueue-fix-hung-time-report-of-worker-pools.patch new file mode 100644 index 00000000000..4adf5b02371 --- /dev/null +++ b/queue-6.2/workqueue-fix-hung-time-report-of-worker-pools.patch @@ -0,0 +1,71 @@ +From 814e1aca3e2a22e5f5ecf1542563ae101158f34a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 13:53:31 +0100 +Subject: workqueue: Fix hung time report of worker pools + +From: Petr Mladek + +[ Upstream commit 335a42ebb0ca8ee9997a1731aaaae6dcd704c113 ] + +The workqueue watchdog prints a warning when there is no progress in +a worker pool. Where the progress means that the pool started processing +a pending work item. + +Note that it is perfectly fine to process work items much longer. +The progress should be guaranteed by waking up or creating idle +workers. + +show_one_worker_pool() prints state of non-idle worker pool. It shows +a delay since the last pool->watchdog_ts. + +The timestamp is updated when a first pending work is queued in +__queue_work(). Also it is updated when a work is dequeued for +processing in worker_thread() and rescuer_thread(). + +The delay is misleading when there is no pending work item. In this +case it shows how long the last work item is being proceed. Show +zero instead. There is no stall if there is no pending work. + +Fixes: 82607adcf9cdf40fb7b ("workqueue: implement lockup detector") +Signed-off-by: Petr Mladek +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/workqueue.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 76ea87b0251ce..e5421775deb38 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -4850,10 +4850,16 @@ static void show_one_worker_pool(struct worker_pool *pool) + struct worker *worker; + bool first = true; + unsigned long flags; ++ unsigned long hung = 0; + + raw_spin_lock_irqsave(&pool->lock, flags); + if (pool->nr_workers == pool->nr_idle) + goto next_pool; ++ ++ /* How long the first pending work is waiting for a worker. */ ++ if (!list_empty(&pool->worklist)) ++ hung = jiffies_to_msecs(jiffies - pool->watchdog_ts) / 1000; ++ + /* + * Defer printing to avoid deadlocks in console drivers that + * queue work while holding locks also taken in their write +@@ -4862,9 +4868,7 @@ static void show_one_worker_pool(struct worker_pool *pool) + printk_deferred_enter(); + pr_info("pool %d:", pool->id); + pr_cont_pool_info(pool); +- pr_cont(" hung=%us workers=%d", +- jiffies_to_msecs(jiffies - pool->watchdog_ts) / 1000, +- pool->nr_workers); ++ pr_cont(" hung=%lus workers=%d", hung, pool->nr_workers); + if (pool->manager) + pr_cont(" manager: %d", + task_pid_nr(pool->manager->task)); +-- +2.39.2 + diff --git a/queue-6.2/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch b/queue-6.2/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch new file mode 100644 index 00000000000..31dab572096 --- /dev/null +++ b/queue-6.2/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch @@ -0,0 +1,49 @@ +From d6c352c99233bd4fdb373a06f1a6f30bbe773c9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 17:09:17 +0100 +Subject: x86/apic: Fix atomic update of offset in reserve_eilvt_offset() + +From: Uros Bizjak + +[ Upstream commit f96fb2df3eb31ede1b34b0521560967310267750 ] + +The detection of atomic update failure in reserve_eilvt_offset() is +not correct. The value returned by atomic_cmpxchg() should be compared +to the old value from the location to be updated. + +If these two are the same, then atomic update succeeded and +"eilvt_offsets[offset]" location is updated to "new" in an atomic way. + +Otherwise, the atomic update failed and it should be retried with the +value from "eilvt_offsets[offset]" - exactly what atomic_try_cmpxchg() +does in a correct and more optimal way. + +Fixes: a68c439b1966c ("apic, x86: Check if EILVT APIC registers are available (AMD only)") +Signed-off-by: Uros Bizjak +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230227160917.107820-1-ubizjak@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/apic.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index 20d9a604da7c4..7705571100518 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -422,10 +422,9 @@ static unsigned int reserve_eilvt_offset(int offset, unsigned int new) + if (vector && !eilvt_entry_is_changeable(vector, new)) + /* may not change if vectors are different */ + return rsvd; +- rsvd = atomic_cmpxchg(&eilvt_offsets[offset], rsvd, new); +- } while (rsvd != new); ++ } while (!atomic_try_cmpxchg(&eilvt_offsets[offset], &rsvd, new)); + +- rsvd &= ~APIC_EILVT_MASKED; ++ rsvd = new & ~APIC_EILVT_MASKED; + if (rsvd && rsvd != vector) + pr_info("LVT offset %d assigned for vector 0x%02x\n", + offset, rsvd); +-- +2.39.2 + diff --git a/queue-6.2/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch b/queue-6.2/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch new file mode 100644 index 00000000000..bd929521492 --- /dev/null +++ b/queue-6.2/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch @@ -0,0 +1,72 @@ +From 9e05eda07a7cb593a750b429fa23b3e9b06d1845 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 00:30:04 -0700 +Subject: x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() + +From: Saurabh Sengar + +[ Upstream commit 5af507bef93c09a94fb8f058213b489178f4cbe5 ] + +arch_dynirq_lower_bound() is invoked by the core interrupt code to +retrieve the lowest possible Linux interrupt number for dynamically +allocated interrupts like MSI. + +The x86 implementation uses this to exclude the IO/APIC GSI space. +This works correctly as long as there is an IO/APIC registered, but +returns 0 if not. This has been observed in VMs where the BIOS does +not advertise an IO/APIC. + +0 is an invalid interrupt number except for the legacy timer interrupt +on x86. The return value is unchecked in the core code, so it ends up +to allocate interrupt number 0 which is subsequently considered to be +invalid by the caller, e.g. the MSI allocation code. + +The function has already a check for 0 in the case that an IO/APIC is +registered, as ioapic_dynirq_base is 0 in case of device tree setups. + +Consolidate this and zero check for both ioapic_dynirq_base and gsi_top, +which is used in the case that no IO/APIC is registered. + +Fixes: 3e5bedc2c258 ("x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines") +Signed-off-by: Saurabh Sengar +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/1679988604-20308-1-git-send-email-ssengar@linux.microsoft.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/io_apic.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index a868b76cd3d42..efa87b6bb1cde 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -2480,17 +2480,21 @@ static int io_apic_get_redir_entries(int ioapic) + + unsigned int arch_dynirq_lower_bound(unsigned int from) + { ++ unsigned int ret; ++ + /* + * dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use + * gsi_top if ioapic_dynirq_base hasn't been initialized yet. + */ +- if (!ioapic_initialized) +- return gsi_top; ++ ret = ioapic_dynirq_base ? : gsi_top; ++ + /* +- * For DT enabled machines ioapic_dynirq_base is irrelevant and not +- * updated. So simply return @from if ioapic_dynirq_base == 0. ++ * For DT enabled machines ioapic_dynirq_base is irrelevant and ++ * always 0. gsi_top can be 0 if there is no IO/APIC registered. ++ * 0 is an invalid interrupt number for dynamic allocations. Return ++ * @from instead. + */ +- return ioapic_dynirq_base ? : from; ++ return ret ? : from; + } + + #ifdef CONFIG_X86_32 +-- +2.39.2 + diff --git a/queue-6.2/x86-mce-amd-use-an-u64-for-bank_map.patch b/queue-6.2/x86-mce-amd-use-an-u64-for-bank_map.patch new file mode 100644 index 00000000000..c92c6723d95 --- /dev/null +++ b/queue-6.2/x86-mce-amd-use-an-u64-for-bank_map.patch @@ -0,0 +1,99 @@ +From 3f7600e5cfeca3708ab4d2a41292173e0b209b96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 15:16:01 +0000 +Subject: x86/MCE/AMD: Use an u64 for bank_map + +From: Muralidhara M K + +[ Upstream commit 4c1cdec319b9aadb65737c3eb1f5cb74bd6aa156 ] + +Thee maximum number of MCA banks is 64 (MAX_NR_BANKS), see + + a0bc32b3cacf ("x86/mce: Increase maximum number of banks to 64"). + +However, the bank_map which contains a bitfield of which banks to +initialize is of type unsigned int and that overflows when those bit +numbers are >= 32, leading to UBSAN complaining correctly: + + UBSAN: shift-out-of-bounds in arch/x86/kernel/cpu/mce/amd.c:1365:38 + shift exponent 32 is too large for 32-bit type 'int' + +Change the bank_map to a u64 and use the proper BIT_ULL() macro when +modifying bits in there. + + [ bp: Rewrite commit message. ] + +Fixes: a0bc32b3cacf ("x86/mce: Increase maximum number of banks to 64") +Signed-off-by: Muralidhara M K +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230127151601.1068324-1-muralimk@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mce/amd.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c +index 10fb5b5c9efa4..5518272061bfb 100644 +--- a/arch/x86/kernel/cpu/mce/amd.c ++++ b/arch/x86/kernel/cpu/mce/amd.c +@@ -235,10 +235,10 @@ static DEFINE_PER_CPU(struct threshold_bank **, threshold_banks); + * A list of the banks enabled on each logical CPU. Controls which respective + * descriptors to initialize later in mce_threshold_create_device(). + */ +-static DEFINE_PER_CPU(unsigned int, bank_map); ++static DEFINE_PER_CPU(u64, bank_map); + + /* Map of banks that have more than MCA_MISC0 available. */ +-static DEFINE_PER_CPU(u32, smca_misc_banks_map); ++static DEFINE_PER_CPU(u64, smca_misc_banks_map); + + static void amd_threshold_interrupt(void); + static void amd_deferred_error_interrupt(void); +@@ -267,7 +267,7 @@ static void smca_set_misc_banks_map(unsigned int bank, unsigned int cpu) + return; + + if (low & MASK_BLKPTR_LO) +- per_cpu(smca_misc_banks_map, cpu) |= BIT(bank); ++ per_cpu(smca_misc_banks_map, cpu) |= BIT_ULL(bank); + + } + +@@ -528,7 +528,7 @@ static u32 smca_get_block_address(unsigned int bank, unsigned int block, + if (!block) + return MSR_AMD64_SMCA_MCx_MISC(bank); + +- if (!(per_cpu(smca_misc_banks_map, cpu) & BIT(bank))) ++ if (!(per_cpu(smca_misc_banks_map, cpu) & BIT_ULL(bank))) + return 0; + + return MSR_AMD64_SMCA_MCx_MISCy(bank, block - 1); +@@ -572,7 +572,7 @@ prepare_threshold_block(unsigned int bank, unsigned int block, u32 addr, + int new; + + if (!block) +- per_cpu(bank_map, cpu) |= (1 << bank); ++ per_cpu(bank_map, cpu) |= BIT_ULL(bank); + + memset(&b, 0, sizeof(b)); + b.cpu = cpu; +@@ -884,7 +884,7 @@ static void amd_threshold_interrupt(void) + return; + + for (bank = 0; bank < this_cpu_read(mce_num_banks); ++bank) { +- if (!(per_cpu(bank_map, cpu) & (1 << bank))) ++ if (!(per_cpu(bank_map, cpu) & BIT_ULL(bank))) + continue; + + first_block = bp[bank]->blocks; +@@ -1362,7 +1362,7 @@ int mce_threshold_create_device(unsigned int cpu) + return -ENOMEM; + + for (bank = 0; bank < numbanks; ++bank) { +- if (!(this_cpu_read(bank_map) & (1 << bank))) ++ if (!(this_cpu_read(bank_map) & BIT_ULL(bank))) + continue; + err = threshold_create_bank(bp, cpu, bank); + if (err) { +-- +2.39.2 + diff --git a/queue-6.2/xsk-fix-unaligned-descriptor-validation.patch b/queue-6.2/xsk-fix-unaligned-descriptor-validation.patch new file mode 100644 index 00000000000..d76efefcdee --- /dev/null +++ b/queue-6.2/xsk-fix-unaligned-descriptor-validation.patch @@ -0,0 +1,65 @@ +From 1ca620cedaf107c9e6b22d5ef96874fda976c064 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 01:59:18 +0200 +Subject: xsk: Fix unaligned descriptor validation + +From: Kal Conley + +[ Upstream commit d769ccaf957fe7391f357c0a923de71f594b8a2b ] + +Make sure unaligned descriptors that straddle the end of the UMEM are +considered invalid. Currently, descriptor validation is broken for +zero-copy mode which only checks descriptors at page granularity. +For example, descriptors in zero-copy mode that overrun the end of the +UMEM but not a page boundary are (incorrectly) considered valid. The +UMEM boundary check needs to happen before the page boundary and +contiguity checks in xp_desc_crosses_non_contig_pg(). Do this check in +xp_unaligned_validate_desc() instead like xp_check_unaligned() already +does. + +Fixes: 2b43470add8c ("xsk: Introduce AF_XDP buffer allocation API") +Signed-off-by: Kal Conley +Acked-by: Magnus Karlsson +Link: https://lore.kernel.org/r/20230405235920.7305-2-kal.conley@dectris.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + include/net/xsk_buff_pool.h | 9 ++------- + net/xdp/xsk_queue.h | 1 + + 2 files changed, 3 insertions(+), 7 deletions(-) + +diff --git a/include/net/xsk_buff_pool.h b/include/net/xsk_buff_pool.h +index f787c3f524b03..996eaf1ef1a1d 100644 +--- a/include/net/xsk_buff_pool.h ++++ b/include/net/xsk_buff_pool.h +@@ -175,13 +175,8 @@ static inline bool xp_desc_crosses_non_contig_pg(struct xsk_buff_pool *pool, + if (likely(!cross_pg)) + return false; + +- if (pool->dma_pages_cnt) { +- return !(pool->dma_pages[addr >> PAGE_SHIFT] & +- XSK_NEXT_PG_CONTIG_MASK); +- } +- +- /* skb path */ +- return addr + len > pool->addrs_cnt; ++ return pool->dma_pages_cnt && ++ !(pool->dma_pages[addr >> PAGE_SHIFT] & XSK_NEXT_PG_CONTIG_MASK); + } + + static inline u64 xp_aligned_extract_addr(struct xsk_buff_pool *pool, u64 addr) +diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h +index c6fb6b7636582..bdeba20aaf8ff 100644 +--- a/net/xdp/xsk_queue.h ++++ b/net/xdp/xsk_queue.h +@@ -161,6 +161,7 @@ static inline bool xp_unaligned_validate_desc(struct xsk_buff_pool *pool, + return false; + + if (base_addr >= pool->addrs_cnt || addr >= pool->addrs_cnt || ++ addr + desc->len > pool->addrs_cnt || + xp_desc_crosses_non_contig_pg(pool, addr, desc->len)) + return false; + +-- +2.39.2 +