From: Sasha Levin Date: Sun, 9 Jul 2023 04:58:24 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v6.4.3~22^2~4 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c56445ea0d06bd4fed707527483af6fdd147d6ae;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/acpi-utils-fix-acpi_evaluate_dsm_typed-redefinition-.patch b/queue-5.15/acpi-utils-fix-acpi_evaluate_dsm_typed-redefinition-.patch new file mode 100644 index 00000000000..50b750d63db --- /dev/null +++ b/queue-5.15/acpi-utils-fix-acpi_evaluate_dsm_typed-redefinition-.patch @@ -0,0 +1,58 @@ +From 690e7b1fda4a50fcfe364c3e1e64a4804a625584 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 12:47:15 +0530 +Subject: ACPI: utils: Fix acpi_evaluate_dsm_typed() redefinition error + +From: Kiran K + +[ Upstream commit 2c5a06e5505a716387a4d86f1f39de506836435a ] + +acpi_evaluate_dsm_typed() needs to be gaurded with CONFIG_ACPI to avoid +a redefintion error when the stub is also enabled. + +In file included from ../drivers/bluetooth/btintel.c:13: +../include/acpi/acpi_bus.h:57:1: error: redefinition of 'acpi_evaluate_dsm_typed' + 57 | acpi_evaluate_dsm_typed(acpi_handle handle, const guid_t *guid,.. + | ^~~~~~~~~~~~~~~~~~~~~~~ +In file included from ../drivers/bluetooth/btintel.c:12: +../include/linux/acpi.h:967:34: note: previous definition of +'acpi_evaluate_dsm_typed' with type 'union acpi_object *(void *, +const guid_t *, u64, u64, union acpi_object *, acpi_object_type)' +{aka 'union acpi_object *(void *, const guid_t *, long long unsigned int, +long long unsigned int, union acpi_object *, unsigned int)'} + 967 | static inline union acpi_object +*acpi_evaluate_dsm_typed(acpi_handle handle, + +Fixes: 1b94ad7ccc21 ("ACPI: utils: Add acpi_evaluate_dsm_typed() and acpi_check_dsm() stubs") +Signed-off-by: Kiran K +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + include/acpi/acpi_bus.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h +index e9c7d7b270e73..7a85ae6b7b005 100644 +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -52,7 +52,7 @@ bool acpi_dock_match(acpi_handle handle); + bool acpi_check_dsm(acpi_handle handle, const guid_t *guid, u64 rev, u64 funcs); + union acpi_object *acpi_evaluate_dsm(acpi_handle handle, const guid_t *guid, + u64 rev, u64 func, union acpi_object *argv4); +- ++#ifdef CONFIG_ACPI + static inline union acpi_object * + acpi_evaluate_dsm_typed(acpi_handle handle, const guid_t *guid, u64 rev, + u64 func, union acpi_object *argv4, +@@ -68,6 +68,7 @@ acpi_evaluate_dsm_typed(acpi_handle handle, const guid_t *guid, u64 rev, + + return obj; + } ++#endif + + #define ACPI_INIT_DSM_ARGV4(cnt, eles) \ + { \ +-- +2.39.2 + diff --git a/queue-5.15/alsa-ac97-fix-possible-null-dereference-in-snd_ac97_.patch b/queue-5.15/alsa-ac97-fix-possible-null-dereference-in-snd_ac97_.patch new file mode 100644 index 00000000000..e00bf235c6d --- /dev/null +++ b/queue-5.15/alsa-ac97-fix-possible-null-dereference-in-snd_ac97_.patch @@ -0,0 +1,42 @@ +From 401fe82071fe9d18c5270518f12162afb8d945dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 10:17:32 +0800 +Subject: ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer + +From: Su Hui + +[ Upstream commit 79597c8bf64ca99eab385115743131d260339da5 ] + +smatch error: +sound/pci/ac97/ac97_codec.c:2354 snd_ac97_mixer() error: +we previously assumed 'rac97' could be null (see line 2072) + +remove redundant assignment, return error if rac97 is NULL. + +Fixes: da3cec35dd3c ("ALSA: Kill snd_assert() in sound/pci/*") +Signed-off-by: Su Hui +Link: https://lore.kernel.org/r/20230615021732.1972194-1-suhui@nfschina.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/ac97/ac97_codec.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c +index ceead55f13ab1..58ae0c3ce1e49 100644 +--- a/sound/pci/ac97/ac97_codec.c ++++ b/sound/pci/ac97/ac97_codec.c +@@ -2070,8 +2070,8 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template, + .dev_disconnect = snd_ac97_dev_disconnect, + }; + +- if (rac97) +- *rac97 = NULL; ++ if (!rac97) ++ return -EINVAL; + if (snd_BUG_ON(!bus || !template)) + return -EINVAL; + if (snd_BUG_ON(template->num >= 4)) +-- +2.39.2 + diff --git a/queue-5.15/amdgpu-validate-offset_in_bo-of-drm_amdgpu_gem_va.patch b/queue-5.15/amdgpu-validate-offset_in_bo-of-drm_amdgpu_gem_va.patch new file mode 100644 index 00000000000..4c5af7f9422 --- /dev/null +++ b/queue-5.15/amdgpu-validate-offset_in_bo-of-drm_amdgpu_gem_va.patch @@ -0,0 +1,73 @@ +From 9b949030c473b3add617fb926d861ba4cd1d0404 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 15:44:12 -0700 +Subject: amdgpu: validate offset_in_bo of drm_amdgpu_gem_va +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chia-I Wu + +[ Upstream commit 9f0bcf49e9895cb005d78b33a5eebfa11711b425 ] + +This is motivated by OOB access in amdgpu_vm_update_range when +offset_in_bo+map_size overflows. + +v2: keep the validations in amdgpu_vm_bo_map +v3: add the validations to amdgpu_vm_bo_map/amdgpu_vm_bo_replace_map + rather than to amdgpu_gem_va_ioctl + +Fixes: 9f7eb5367d00 ("drm/amdgpu: actually use the VM map parameters") +Reviewed-by: Christian König +Signed-off-by: Chia-I Wu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +index 8da5cc8fcc6c0..86914bd3e09e1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -2334,14 +2334,14 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev, + uint64_t eaddr; + + /* validate the parameters */ +- if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || +- size == 0 || size & ~PAGE_MASK) ++ if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK) ++ return -EINVAL; ++ if (saddr + size <= saddr || offset + size <= offset) + return -EINVAL; + + /* make sure object fit at this offset */ + eaddr = saddr + size - 1; +- if (saddr >= eaddr || +- (bo && offset + size > amdgpu_bo_size(bo)) || ++ if ((bo && offset + size > amdgpu_bo_size(bo)) || + (eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT)) + return -EINVAL; + +@@ -2400,14 +2400,14 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev, + int r; + + /* validate the parameters */ +- if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || +- size == 0 || size & ~PAGE_MASK) ++ if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK) ++ return -EINVAL; ++ if (saddr + size <= saddr || offset + size <= offset) + return -EINVAL; + + /* make sure object fit at this offset */ + eaddr = saddr + size - 1; +- if (saddr >= eaddr || +- (bo && offset + size > amdgpu_bo_size(bo)) || ++ if ((bo && offset + size > amdgpu_bo_size(bo)) || + (eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT)) + return -EINVAL; + +-- +2.39.2 + diff --git a/queue-5.15/arc-define-asm_nl-and-__align-_str-outside-ifdef-__a.patch b/queue-5.15/arc-define-asm_nl-and-__align-_str-outside-ifdef-__a.patch new file mode 100644 index 00000000000..6d93c15e112 --- /dev/null +++ b/queue-5.15/arc-define-asm_nl-and-__align-_str-outside-ifdef-__a.patch @@ -0,0 +1,62 @@ +From f19373fb2e30496d1c1203d04dfe222600cebb76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 00:50:50 +0900 +Subject: ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ + guard + +From: Masahiro Yamada + +[ Upstream commit 92e2921eeafdfca9acd9b83f07d2b7ca099bac24 ] + +ASM_NL is useful not only in *.S files but also in .c files for using +inline assembler in C code. + +On ARC, however, ASM_NL is evaluated inconsistently. It is expanded to +a backquote (`) in *.S files, but a semicolon (;) in *.c files because +arch/arc/include/asm/linkage.h defines it inside #ifdef __ASSEMBLY__, +so the definition for C code falls back to the default value defined in +include/linux/linkage.h. + +If ASM_NL is used in inline assembler in .c files, it will result in +wrong assembly code because a semicolon is not an instruction separator, +but the start of a comment for ARC. + +Move ASM_NL (also __ALIGN and __ALIGN_STR) out of the #ifdef. + +Fixes: 9df62f054406 ("arch: use ASM_NL instead of ';' for assembler new line character in the macro") +Fixes: 8d92e992a785 ("ARC: define __ALIGN_STR and __ALIGN symbols for ARC") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + arch/arc/include/asm/linkage.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h +index c9434ff3aa4ce..8a3fb71e9cfad 100644 +--- a/arch/arc/include/asm/linkage.h ++++ b/arch/arc/include/asm/linkage.h +@@ -8,6 +8,10 @@ + + #include + ++#define ASM_NL ` /* use '`' to mark new line in macro */ ++#define __ALIGN .align 4 ++#define __ALIGN_STR __stringify(__ALIGN) ++ + #ifdef __ASSEMBLY__ + + .macro ST2 e, o, off +@@ -28,10 +32,6 @@ + #endif + .endm + +-#define ASM_NL ` /* use '`' to mark new line in macro */ +-#define __ALIGN .align 4 +-#define __ALIGN_STR __stringify(__ALIGN) +- + /* annotation for data we want in DCCM - if enabled in .config */ + .macro ARCFP_DATA nm + #ifdef CONFIG_ARC_HAS_DCCM +-- +2.39.2 + diff --git a/queue-5.15/arm-9303-1-kprobes-avoid-missing-declaration-warning.patch b/queue-5.15/arm-9303-1-kprobes-avoid-missing-declaration-warning.patch new file mode 100644 index 00000000000..a0e1900df93 --- /dev/null +++ b/queue-5.15/arm-9303-1-kprobes-avoid-missing-declaration-warning.patch @@ -0,0 +1,103 @@ +From 4fbedfde2d1e2f4a6b5f92ab16528766f611d5b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 19:28:42 +0100 +Subject: ARM: 9303/1: kprobes: avoid missing-declaration warnings + +From: Arnd Bergmann + +[ Upstream commit 1b9c3ddcec6a55e15d3e38e7405e2d078db02020 ] + +checker_stack_use_t32strd() and kprobe_handler() can be made static since +they are not used from other files, while coverage_start_registers() +and __kprobes_test_case() are used from assembler code, and just need +a declaration to avoid a warning with the global definition. + +arch/arm/probes/kprobes/checkers-common.c:43:18: error: no previous prototype for 'checker_stack_use_t32strd' +arch/arm/probes/kprobes/core.c:236:16: error: no previous prototype for 'kprobe_handler' +arch/arm/probes/kprobes/test-core.c:723:10: error: no previous prototype for 'coverage_start_registers' +arch/arm/probes/kprobes/test-core.c:918:14: error: no previous prototype for '__kprobes_test_case_start' +arch/arm/probes/kprobes/test-core.c:952:14: error: no previous prototype for '__kprobes_test_case_end_16' +arch/arm/probes/kprobes/test-core.c:967:14: error: no previous prototype for '__kprobes_test_case_end_32' + +Fixes: 6624cf651f1a ("ARM: kprobes: collects stack consumption for store instructions") +Fixes: 454f3e132d05 ("ARM/kprobes: Remove jprobe arm implementation") +Acked-by: Masami Hiramatsu (Google) +Reviewed-by: Kees Cook +Signed-off-by: Arnd Bergmann +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/probes/kprobes/checkers-common.c | 2 +- + arch/arm/probes/kprobes/core.c | 2 +- + arch/arm/probes/kprobes/opt-arm.c | 2 -- + arch/arm/probes/kprobes/test-core.c | 2 +- + arch/arm/probes/kprobes/test-core.h | 4 ++++ + 5 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/probes/kprobes/checkers-common.c b/arch/arm/probes/kprobes/checkers-common.c +index 4d720990cf2a3..eba7ac4725c02 100644 +--- a/arch/arm/probes/kprobes/checkers-common.c ++++ b/arch/arm/probes/kprobes/checkers-common.c +@@ -40,7 +40,7 @@ enum probes_insn checker_stack_use_imm_0xx(probes_opcode_t insn, + * Different from other insn uses imm8, the real addressing offset of + * STRD in T32 encoding should be imm8 * 4. See ARMARM description. + */ +-enum probes_insn checker_stack_use_t32strd(probes_opcode_t insn, ++static enum probes_insn checker_stack_use_t32strd(probes_opcode_t insn, + struct arch_probes_insn *asi, + const struct decode_header *h) + { +diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c +index 9bcae72dda440..3bd017f6e256a 100644 +--- a/arch/arm/probes/kprobes/core.c ++++ b/arch/arm/probes/kprobes/core.c +@@ -233,7 +233,7 @@ singlestep(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *kcb) + * kprobe, and that level is reserved for user kprobe handlers, so we can't + * risk encountering a new kprobe in an interrupt handler. + */ +-void __kprobes kprobe_handler(struct pt_regs *regs) ++static void __kprobes kprobe_handler(struct pt_regs *regs) + { + struct kprobe *p, *cur; + struct kprobe_ctlblk *kcb; +diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c +index c78180172120f..e20304f1d8bc9 100644 +--- a/arch/arm/probes/kprobes/opt-arm.c ++++ b/arch/arm/probes/kprobes/opt-arm.c +@@ -145,8 +145,6 @@ __arch_remove_optimized_kprobe(struct optimized_kprobe *op, int dirty) + } + } + +-extern void kprobe_handler(struct pt_regs *regs); +- + static void + optimized_callback(struct optimized_kprobe *op, struct pt_regs *regs) + { +diff --git a/arch/arm/probes/kprobes/test-core.c b/arch/arm/probes/kprobes/test-core.c +index c562832b86272..171c7076b89f4 100644 +--- a/arch/arm/probes/kprobes/test-core.c ++++ b/arch/arm/probes/kprobes/test-core.c +@@ -720,7 +720,7 @@ static const char coverage_register_lookup[16] = { + [REG_TYPE_NOSPPCX] = COVERAGE_ANY_REG | COVERAGE_SP, + }; + +-unsigned coverage_start_registers(const struct decode_header *h) ++static unsigned coverage_start_registers(const struct decode_header *h) + { + unsigned regs = 0; + int i; +diff --git a/arch/arm/probes/kprobes/test-core.h b/arch/arm/probes/kprobes/test-core.h +index f1d5583e7bbbb..7054d9fae2ea0 100644 +--- a/arch/arm/probes/kprobes/test-core.h ++++ b/arch/arm/probes/kprobes/test-core.h +@@ -454,3 +454,7 @@ void kprobe_thumb32_test_cases(void); + #else + void kprobe_arm_test_cases(void); + #endif ++ ++void __kprobes_test_case_start(void); ++void __kprobes_test_case_end_16(void); ++void __kprobes_test_case_end_32(void); +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-bcm5301x-drop-clock-names-from-the-spi-node.patch b/queue-5.15/arm-dts-bcm5301x-drop-clock-names-from-the-spi-node.patch new file mode 100644 index 00000000000..7b5035f3d23 --- /dev/null +++ b/queue-5.15/arm-dts-bcm5301x-drop-clock-names-from-the-spi-node.patch @@ -0,0 +1,42 @@ +From 124ad889d960159614f4c6b38d3c519fb04ee796 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 14:28:30 +0200 +Subject: ARM: dts: BCM5301X: Drop "clock-names" from the SPI node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit d3c8e2c5757153bbfad70019ec1decbca86f3def ] + +There is no such property in the SPI controller binding documentation. +Also Linux driver doesn't look for it. + +This fixes: +arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: spi@18029200: Unevaluated properties are not allowed ('clock-names' was unexpected) + From schema: Documentation/devicetree/bindings/spi/brcm,spi-bcm-qspi.yaml + +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20230503122830.3200-1-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm5301x.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index 30217948ef827..b4b73ab996264 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -542,7 +542,6 @@ spi@18029200 { + "spi_lr_session_done", + "spi_lr_overread"; + clocks = <&iprocmed>; +- clock-names = "iprocmed"; + num-cs = <2>; + #address-cells = <1>; + #size-cells = <0>; +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-bcm5301x-fix-duplex-full-full-duplex.patch b/queue-5.15/arm-dts-bcm5301x-fix-duplex-full-full-duplex.patch new file mode 100644 index 00000000000..ef37f843fa8 --- /dev/null +++ b/queue-5.15/arm-dts-bcm5301x-fix-duplex-full-full-duplex.patch @@ -0,0 +1,56 @@ +From ad70db77f34c89ee6a1fbc6a5ee619e0fca14fb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 17:36:29 +0200 +Subject: ARM: dts: BCM5301X: fix duplex-full => full-duplex + +From: Christian Lamparter + +[ Upstream commit fd274b733bfdde3ca72f0fa2a37f032f3a8c402c ] + +this typo was found by the dtbs_check +| ports:port@5:fixed-link: 'oneOf' conditional failed, +| {'speed': [[1000]], 'duplex-full': True} is not of type 'array' +| 'duplex-full' does not match any of the regexes: 'pinctrl-[0-]..." + +this should have been full-duplex; + +Fixes: 935327a73553 ("ARM: dts: BCM5301X: Add DT for Meraki MR26") +Fixes: ec88a9c344d9 ("ARM: BCM5301X: Add DT for Meraki MR32") +Signed-off-by: Christian Lamparter +Link: https://lore.kernel.org/r/50522f45566951a9eabd22820647924cc6b4a264.1686238550.git.chunkeey@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm53015-meraki-mr26.dts | 2 +- + arch/arm/boot/dts/bcm53016-meraki-mr32.dts | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm53015-meraki-mr26.dts b/arch/arm/boot/dts/bcm53015-meraki-mr26.dts +index 14f58033efeb9..ca2266b936ee2 100644 +--- a/arch/arm/boot/dts/bcm53015-meraki-mr26.dts ++++ b/arch/arm/boot/dts/bcm53015-meraki-mr26.dts +@@ -128,7 +128,7 @@ port@5 { + + fixed-link { + speed = <1000>; +- duplex-full; ++ full-duplex; + }; + }; + }; +diff --git a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts +index 577a4dc604d93..edf9910100b02 100644 +--- a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts ++++ b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts +@@ -212,7 +212,7 @@ port@5 { + + fixed-link { + speed = <1000>; +- duplex-full; ++ full-duplex; + }; + }; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-gta04-move-model-property-out-of-pinctrl-nod.patch b/queue-5.15/arm-dts-gta04-move-model-property-out-of-pinctrl-nod.patch new file mode 100644 index 00000000000..5f1976c704a --- /dev/null +++ b/queue-5.15/arm-dts-gta04-move-model-property-out-of-pinctrl-nod.patch @@ -0,0 +1,41 @@ +From 894055207fd95adc23d1071c0c2f35ee23eff311 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 13:32:25 +0300 +Subject: ARM: dts: gta04: Move model property out of pinctrl node + +From: Tony Lindgren + +[ Upstream commit 4ffec92e70ac5097b9f67ec154065305b16a3b46 ] + +The model property should be at the top level, let's move it out +of the pinctrl node. + +Fixes: d2eaf949d2c3 ("ARM: dts: omap3-gta04a5one: define GTA04A5 variant with OneNAND") +Cc: Andreas Kemnade +Cc: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04a5one.dts | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/omap3-gta04a5one.dts b/arch/arm/boot/dts/omap3-gta04a5one.dts +index 9db9fe67cd63b..95df45cc70c09 100644 +--- a/arch/arm/boot/dts/omap3-gta04a5one.dts ++++ b/arch/arm/boot/dts/omap3-gta04a5one.dts +@@ -5,9 +5,11 @@ + + #include "omap3-gta04a5.dts" + +-&omap3_pmx_core { ++/ { + model = "Goldelico GTA04A5/Letux 2804 with OneNAND"; ++}; + ++&omap3_pmx_core { + gpmc_pins: pinmux_gpmc_pins { + pinctrl-single,pins = < + +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-iwg20d-q7-common-fix-backlight-pwm-specifier.patch b/queue-5.15/arm-dts-iwg20d-q7-common-fix-backlight-pwm-specifier.patch new file mode 100644 index 00000000000..4e151289b36 --- /dev/null +++ b/queue-5.15/arm-dts-iwg20d-q7-common-fix-backlight-pwm-specifier.patch @@ -0,0 +1,49 @@ +From ca46154701352eca3216061683874bff0e5c744e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 17:35:16 +0200 +Subject: ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier + +From: Geert Uytterhoeven + +[ Upstream commit 0501fdec106a291c43b3c1b525cf22ab4c24b2d8 ] + +make dtbs_check: + + arch/arm/boot/dts/renesas/r8a7743-iwg20d-q7.dtb: backlight: pwms: [[58, 0, 5000000], [0]] is too long + From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml + arch/arm/boot/dts/renesas/r8a7743-iwg20d-q7-dbcm-ca.dtb: backlight: pwms: [[67, 0, 5000000], [0]] is too long + From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml + arch/arm/boot/dts/renesas/r8a7744-iwg20d-q7-dbcm-ca.dtb: backlight: pwms: [[67, 0, 5000000], [0]] is too long + From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml + arch/arm/boot/dts/renesas/r8a7744-iwg20d-q7.dtb: backlight: pwms: [[58, 0, 5000000], [0]] is too long + From schema: Documentation/devicetree/bindings/leds/backlight/pwm-backlight.yaml + +PWM specifiers referring to R-Car PWM Timer Controllers should contain +only two cells. + +Fix this by dropping the bogus third cell. + +Fixes: 6f89dd9e9325d05b ("ARM: dts: iwg20d-q7-common: Add LCD support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/6e5c3167424a43faf8c1fa68d9667b3d87dc86d8.1684855911.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/iwg20d-q7-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/iwg20d-q7-common.dtsi b/arch/arm/boot/dts/iwg20d-q7-common.dtsi +index bc857676d1910..c13d2f6e1a38f 100644 +--- a/arch/arm/boot/dts/iwg20d-q7-common.dtsi ++++ b/arch/arm/boot/dts/iwg20d-q7-common.dtsi +@@ -49,7 +49,7 @@ audio_clock: audio_clock { + lcd_backlight: backlight { + compatible = "pwm-backlight"; + +- pwms = <&pwm3 0 5000000 0>; ++ pwms = <&pwm3 0 5000000>; + brightness-levels = <0 4 8 16 32 64 128 255>; + default-brightness-level = <7>; + enable-gpios = <&gpio5 14 GPIO_ACTIVE_HIGH>; +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-meson8-correct-uart_b-and-uart_c-clock-refer.patch b/queue-5.15/arm-dts-meson8-correct-uart_b-and-uart_c-clock-refer.patch new file mode 100644 index 00000000000..bb6bf0fb609 --- /dev/null +++ b/queue-5.15/arm-dts-meson8-correct-uart_b-and-uart_c-clock-refer.patch @@ -0,0 +1,51 @@ +From 1e601da9a7290c18cdb6df026b433405ab8a791f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 22:30:29 +0200 +Subject: ARM: dts: meson8: correct uart_B and uart_C clock references + +From: Martin Blumenstingl + +[ Upstream commit 98b503c7fb13a17a47d8ebf15fa8f7c10118e75c ] + +On Meson8 uart_B and uart_C do not work, because they are relying on +incorrect clocks. Change the references of pclk to the correct CLKID +(UART1 for uart_B and UART2 for uart_C), to allow use of the two uarts. + +This was originally reported by Hans-Frieder Vogt for Meson8b [0], but +the same bug is also present in meson8.dtsi + +[0] https://lore.kernel.org/linux-amlogic/trinity-bf20bcb9-790b-4ab9-99e3-0831ef8257f4-1680878185420@3c-app-gmx-bap55/ + +Fixes: 57007bfb5469 ("ARM: dts: meson8: Fix the UART device-tree schema validation") +Reported-by: Hans-Frieder Vogt # for meson8b.dtsi +Signed-off-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20230516203029.1031174-1-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/meson8.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi +index 9997a5d0333a3..72828b9d4281d 100644 +--- a/arch/arm/boot/dts/meson8.dtsi ++++ b/arch/arm/boot/dts/meson8.dtsi +@@ -749,13 +749,13 @@ &uart_A { + + &uart_B { + compatible = "amlogic,meson8-uart"; +- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clocks = <&xtal>, <&clkc CLKID_UART1>, <&clkc CLKID_CLK81>; + clock-names = "xtal", "pclk", "baud"; + }; + + &uart_C { + compatible = "amlogic,meson8-uart"; +- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clocks = <&xtal>, <&clkc CLKID_UART2>, <&clkc CLKID_CLK81>; + clock-names = "xtal", "pclk", "baud"; + }; + +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-meson8b-correct-uart_b-and-uart_c-clock-refe.patch b/queue-5.15/arm-dts-meson8b-correct-uart_b-and-uart_c-clock-refe.patch new file mode 100644 index 00000000000..7081cd4c5eb --- /dev/null +++ b/queue-5.15/arm-dts-meson8b-correct-uart_b-and-uart_c-clock-refe.patch @@ -0,0 +1,47 @@ +From 37ac8f8761043eee1111103f1ea300b850ff612e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 16:36:25 +0200 +Subject: ARM: dts: meson8b: correct uart_B and uart_C clock references + +From: hfdevel@gmx.net + +[ Upstream commit d542ce8d4769cdef6a7bc3437e59cfed9c68f0e4 ] + +With the current device tree for meson8b, uarts B (e.g. available on pins +8/10 on Odroid-C1) and C (pins 3/5 on Odroid-C1) do not work, because they +are relying on incorrect clocks. Change the references of pclk to the +correct CLKID, to allow use of the two uarts. + +Fixes: 3375aa77135f ("ARM: dts: meson8b: Fix the UART device-tree schema validation") +Signed-off-by: Hans-Frieder Vogt +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/trinity-bf20bcb9-790b-4ab9-99e3-0831ef8257f4-1680878185420@3c-app-gmx-bap55 +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/meson8b.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/meson8b.dtsi b/arch/arm/boot/dts/meson8b.dtsi +index 94f1c03deccef..cfd4a909a7a70 100644 +--- a/arch/arm/boot/dts/meson8b.dtsi ++++ b/arch/arm/boot/dts/meson8b.dtsi +@@ -737,13 +737,13 @@ &uart_A { + + &uart_B { + compatible = "amlogic,meson8b-uart"; +- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clocks = <&xtal>, <&clkc CLKID_UART1>, <&clkc CLKID_CLK81>; + clock-names = "xtal", "pclk", "baud"; + }; + + &uart_C { + compatible = "amlogic,meson8b-uart"; +- clocks = <&xtal>, <&clkc CLKID_UART0>, <&clkc CLKID_CLK81>; ++ clocks = <&xtal>, <&clkc CLKID_UART2>, <&clkc CLKID_CLK81>; + clock-names = "xtal", "pclk", "baud"; + }; + +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-stm32-fix-audio-routing-on-stm32mp15xx-dhcom.patch b/queue-5.15/arm-dts-stm32-fix-audio-routing-on-stm32mp15xx-dhcom.patch new file mode 100644 index 00000000000..575ea9a61a9 --- /dev/null +++ b/queue-5.15/arm-dts-stm32-fix-audio-routing-on-stm32mp15xx-dhcom.patch @@ -0,0 +1,52 @@ +From 06a3619ceb95a39a32313cea09f687b327f73cbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 20:01:12 +0200 +Subject: ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2 + +From: Marek Vasut + +[ Upstream commit e3f2778b1b6ced649bffdc7cbb05b80bb92f2108 ] + +The audio routing flow is not correct, the flow should be from source +(second element in the pair) to sink (first element in the pair). The +flow now is from "HP_OUT" to "Playback", where "Playback" is source +and "HP_OUT" is sink, i.e. the direction is swapped and there is no +direct link between the two either. + +Fill in the correct routing, where "HP_OUT" supplies the "Headphone Jack", +"Line In Jack" supplies "LINE_IN" input, "Microphone Jack" supplies "MIC_IN" +input and "Mic Bias" supplies "Microphone Jack". + +Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board") +Signed-off-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +index fbf3826933e4d..7c0aa59accc55 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +@@ -137,10 +137,13 @@ reg_panel_supply: regulator-panel-supply { + + sound { + compatible = "audio-graph-card"; +- routing = +- "MIC_IN", "Capture", +- "Capture", "Mic Bias", +- "Playback", "HP_OUT"; ++ widgets = "Headphone", "Headphone Jack", ++ "Line", "Line In Jack", ++ "Microphone", "Microphone Jack"; ++ routing = "Headphone Jack", "HP_OUT", ++ "LINE_IN", "Line In Jack", ++ "MIC_IN", "Microphone Jack", ++ "Microphone Jack", "Mic Bias"; + dais = <&sai2a_port &sai2b_port>; + status = "okay"; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-stm32-fix-i2s-endpoint-format-property-for-s.patch b/queue-5.15/arm-dts-stm32-fix-i2s-endpoint-format-property-for-s.patch new file mode 100644 index 00000000000..a854e7c0c0f --- /dev/null +++ b/queue-5.15/arm-dts-stm32-fix-i2s-endpoint-format-property-for-s.patch @@ -0,0 +1,36 @@ +From 95208bb919915ed31b23934128d50e221afe745d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 13:56:04 +0200 +Subject: ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx + +From: Olivier Moysan + +[ Upstream commit 076c74c592cabe4a47537fe5205b5b678bed010d ] + +Use "dai-format" to configure DAI audio format as specified in +audio-graph-port.yaml bindings. + +Fixes: 144d1ba70548 ("ARM: dts: stm32: Adapt STM32MP157 DK boards to stm32 DT diversity") +Signed-off-by: Olivier Moysan +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dkx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi +index 48beed0f1f30a..a76173e8a2a17 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi +@@ -438,7 +438,7 @@ &i2s2 { + i2s2_port: port { + i2s2_endpoint: endpoint { + remote-endpoint = <&sii9022_tx_endpoint>; +- format = "i2s"; ++ dai-format = "i2s"; + mclk-fs = <256>; + }; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-stm32-move-ethernet-mac-eeprom-from-som-to-c.patch b/queue-5.15/arm-dts-stm32-move-ethernet-mac-eeprom-from-som-to-c.patch new file mode 100644 index 00000000000..e3461a04019 --- /dev/null +++ b/queue-5.15/arm-dts-stm32-move-ethernet-mac-eeprom-from-som-to-c.patch @@ -0,0 +1,59 @@ +From a9766c2995d0942dced94c620eb94f6a6e9ea57a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 23:37:29 +0200 +Subject: ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards + +From: Marek Vasut + +[ Upstream commit 9660efc2af37f3c12dc6e6a5511ad99e0addc297 ] + +The ethernet MAC EEPROM is not populated on the SoM itself, it has to be +populated on each carrier board. Move the EEPROM into the correct place +in DTs, i.e. the carrier board DTs. Add label to the EEPROM too. + +Fixes: 7e76f82acd9e1 ("ARM: dts: stm32: Split Avenger96 into DHCOR SoM and Avenger96 board") +Signed-off-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 6 ++++++ + arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi | 6 ------ + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +index d3375ad8c91fc..7fe93cdc82bbb 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +@@ -267,6 +267,12 @@ adv7513_i2s0: endpoint { + }; + }; + }; ++ ++ dh_mac_eeprom: eeprom@53 { ++ compatible = "atmel,24c02"; ++ reg = <0x53>; ++ pagesize = <16>; ++ }; + }; + + <dc { +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi +index 44ecc47085871..108d934a186b4 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi +@@ -171,12 +171,6 @@ watchdog { + status = "disabled"; + }; + }; +- +- eeprom@53 { +- compatible = "atmel,24c02"; +- reg = <0x53>; +- pagesize = <16>; +- }; + }; + + &iwdg2 { +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-stm32-shorten-the-av96-hdmi-sound-card-name.patch b/queue-5.15/arm-dts-stm32-shorten-the-av96-hdmi-sound-card-name.patch new file mode 100644 index 00000000000..f97cd6209f3 --- /dev/null +++ b/queue-5.15/arm-dts-stm32-shorten-the-av96-hdmi-sound-card-name.patch @@ -0,0 +1,38 @@ +From dc0966962dee2eceb46ea6b9e792f76d47213386 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 02:42:32 +0200 +Subject: ARM: dts: stm32: Shorten the AV96 HDMI sound card name + +From: Marek Vasut + +[ Upstream commit 0cf765e598712addec34d0208cc1418c151fefb2 ] + +Fix the following error in kernel log due to too long sound card name: +" +asoc-audio-graph-card sound: ASoC: driver name too long 'STM32MP1-AV96-HDMI' -> 'STM32MP1-AV96-H' +" + +Fixes: e027da342772 ("ARM: dts: stm32: Add bindings for audio on AV96") +Signed-off-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +index 7fe93cdc82bbb..5f65d96435f6e 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +@@ -88,7 +88,7 @@ sd_switch: regulator-sd_switch { + + sound { + compatible = "audio-graph-card"; +- label = "STM32MP1-AV96-HDMI"; ++ label = "STM32-AV96-HDMI"; + dais = <&sai2a_port>; + status = "okay"; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm-ep93xx-fix-missing-prototype-warnings.patch b/queue-5.15/arm-ep93xx-fix-missing-prototype-warnings.patch new file mode 100644 index 00000000000..42e321258a3 --- /dev/null +++ b/queue-5.15/arm-ep93xx-fix-missing-prototype-warnings.patch @@ -0,0 +1,48 @@ +From 2919457c0c1ffeddf28b1bc54b53d68280fde32d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 17:30:58 +0200 +Subject: ARM: ep93xx: fix missing-prototype warnings + +From: Arnd Bergmann + +[ Upstream commit 419013740ea1e4343d8ade535d999f59fa28e460 ] + +ep93xx_clocksource_read() is only called from the file it is declared in, +while ep93xx_timer_init() is declared in a header that is not included here. + +arch/arm/mach-ep93xx/timer-ep93xx.c:120:13: error: no previous prototype for 'ep93xx_timer_init' +arch/arm/mach-ep93xx/timer-ep93xx.c:63:5: error: no previous prototype for 'ep93xx_clocksource_read' + +Fixes: 000bc17817bf ("ARM: ep93xx: switch to GENERIC_CLOCKEVENTS") +Acked-by: Alexander Sverdlin +Link: https://lore.kernel.org/r/20230516153109.514251-3-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-ep93xx/timer-ep93xx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-ep93xx/timer-ep93xx.c b/arch/arm/mach-ep93xx/timer-ep93xx.c +index dd4b164d18317..a9efa7bc2fa12 100644 +--- a/arch/arm/mach-ep93xx/timer-ep93xx.c ++++ b/arch/arm/mach-ep93xx/timer-ep93xx.c +@@ -9,6 +9,7 @@ + #include + #include + #include "soc.h" ++#include "platform.h" + + /************************************************************************* + * Timer handling for EP93xx +@@ -60,7 +61,7 @@ static u64 notrace ep93xx_read_sched_clock(void) + return ret; + } + +-u64 ep93xx_clocksource_read(struct clocksource *c) ++static u64 ep93xx_clocksource_read(struct clocksource *c) + { + u64 ret; + +-- +2.39.2 + diff --git a/queue-5.15/arm-omap2-fix-missing-tick_broadcast-prototype.patch b/queue-5.15/arm-omap2-fix-missing-tick_broadcast-prototype.patch new file mode 100644 index 00000000000..006b7d526c2 --- /dev/null +++ b/queue-5.15/arm-omap2-fix-missing-tick_broadcast-prototype.patch @@ -0,0 +1,41 @@ +From e2d327fd4db9c5c9146146a21dcee615fc2a2ceb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 17:31:04 +0200 +Subject: ARM: omap2: fix missing tick_broadcast() prototype + +From: Arnd Bergmann + +[ Upstream commit 861bc1d2886d47bd57a2cbf2cda87fdbe3eb9d08 ] + +omap2 contains a hack to define tick_broadcast() on non-SMP +configurations in place of the normal SMP definition. This one +causes a warning because of a missing prototype: + +arch/arm/mach-omap2/board-generic.c:44:6: error: no previous prototype for 'tick_broadcast' + +Make sure to always include the header with the declaration. + +Fixes: d86ad463d670 ("ARM: OMAP2+: Fix regression for using local timer on non-SMP SoCs") +Acked-by: Aaro Koskinen +Link: https://lore.kernel.org/r/20230516153109.514251-9-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/board-generic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c +index 1610c567a6a3a..10d2f078e4a8e 100644 +--- a/arch/arm/mach-omap2/board-generic.c ++++ b/arch/arm/mach-omap2/board-generic.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + + #include + #include +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-mediatek-add-cpufreq-nodes-for-mt8192.patch b/queue-5.15/arm64-dts-mediatek-add-cpufreq-nodes-for-mt8192.patch new file mode 100644 index 00000000000..f58aa5c826c --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-add-cpufreq-nodes-for-mt8192.patch @@ -0,0 +1,112 @@ +From 76d07d8fd1404a8988835a4c97c9416c60e43556 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 14:19:44 +0800 +Subject: arm64: dts: mediatek: Add cpufreq nodes for MT8192 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Allen-KH Cheng + +[ Upstream commit 9d498cce9298a71e3896e2d1aee24a1a4c531d81 ] + +Add the cpufreq nodes for MT8192 SoC. + +Signed-off-by: Allen-KH Cheng +Tested-by: Chen-Yu Tsai +Reviewed-by: Nícolas F. R. A. Prado +Tested-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Tested-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230317061944.15434-1-allen-kh.cheng@mediatek.com +Signed-off-by: Matthias Brugger +Stable-dep-of: a4366b5695c9 ("arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index 9ed1a72295747..19ba781729722 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -41,6 +41,7 @@ cpu0: cpu@0 { + clock-frequency = <1701000000>; + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; ++ performance-domains = <&performance 0>; + capacity-dmips-mhz = <530>; + }; + +@@ -52,6 +53,7 @@ cpu1: cpu@100 { + clock-frequency = <1701000000>; + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; ++ performance-domains = <&performance 0>; + capacity-dmips-mhz = <530>; + }; + +@@ -63,6 +65,7 @@ cpu2: cpu@200 { + clock-frequency = <1701000000>; + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; ++ performance-domains = <&performance 0>; + capacity-dmips-mhz = <530>; + }; + +@@ -74,6 +77,7 @@ cpu3: cpu@300 { + clock-frequency = <1701000000>; + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; ++ performance-domains = <&performance 0>; + capacity-dmips-mhz = <530>; + }; + +@@ -85,6 +89,7 @@ cpu4: cpu@400 { + clock-frequency = <2171000000>; + cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>; + next-level-cache = <&l2_1>; ++ performance-domains = <&performance 1>; + capacity-dmips-mhz = <1024>; + }; + +@@ -96,6 +101,7 @@ cpu5: cpu@500 { + clock-frequency = <2171000000>; + cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>; + next-level-cache = <&l2_1>; ++ performance-domains = <&performance 1>; + capacity-dmips-mhz = <1024>; + }; + +@@ -107,6 +113,7 @@ cpu6: cpu@600 { + clock-frequency = <2171000000>; + cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>; + next-level-cache = <&l2_1>; ++ performance-domains = <&performance 1>; + capacity-dmips-mhz = <1024>; + }; + +@@ -118,6 +125,7 @@ cpu7: cpu@700 { + clock-frequency = <2171000000>; + cpu-idle-states = <&cpu_sleep_b &cluster_sleep_b>; + next-level-cache = <&l2_1>; ++ performance-domains = <&performance 1>; + capacity-dmips-mhz = <1024>; + }; + +@@ -234,6 +242,12 @@ soc { + compatible = "simple-bus"; + ranges; + ++ performance: performance-controller@11bc10 { ++ compatible = "mediatek,cpufreq-hw"; ++ reg = <0 0x0011bc10 0 0x120>, <0 0x0011bd30 0 0x120>; ++ #performance-domain-cells = <1>; ++ }; ++ + gic: interrupt-controller@c000000 { + compatible = "arm,gic-v3"; + #interrupt-cells = <4>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8183-add-mediatek-broken-save-r.patch b/queue-5.15/arm64-dts-mediatek-mt8183-add-mediatek-broken-save-r.patch new file mode 100644 index 00000000000..b7d3f973595 --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8183-add-mediatek-broken-save-r.patch @@ -0,0 +1,44 @@ +From d658292658c36f67e8be183d6baac65c86843e7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 13:13:52 -0700 +Subject: arm64: dts: mediatek: mt8183: Add mediatek,broken-save-restore-fw to + kukui + +From: Douglas Anderson + +[ Upstream commit 42127f578ebde652d1373e0233356fbd351675c4 ] + +Firmware shipped on mt8183 Chromebooks is affected by the GICR +save/restore issue as described by the patch ("dt-bindings: +interrupt-controller: arm,gic-v3: Add quirk for Mediatek SoCs w/ +broken FW"). Add the quirk property. + +Fixes: cd894e274b74 ("arm64: dts: mt8183: Add krane-sku176 board") +Reviewed-by: Julius Werner +Signed-off-by: Douglas Anderson +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230515131353.v2.3.I525a2ed4260046d43c885ee1275e91707743df1c@changeid +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +index 8e9cf36a9a41a..6529962edd4e9 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +@@ -281,6 +281,10 @@ dsi_out: endpoint { + }; + }; + ++&gic { ++ mediatek,broken-save-restore-fw; ++}; ++ + &gpu { + mali-supply = <&mt6358_vgpu_reg>; + sram-supply = <&mt6358_vsram_gpu_reg>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8192-fix-cpus-capacity-dmips-mh.patch b/queue-5.15/arm64-dts-mediatek-mt8192-fix-cpus-capacity-dmips-mh.patch new file mode 100644 index 00000000000..98c500b7bfd --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8192-fix-cpus-capacity-dmips-mh.patch @@ -0,0 +1,86 @@ +From 1e92f250a335e565f7d510eeb2fa8881f5866846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 14:35:15 -0400 +Subject: arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit a4366b5695c984b8a3fc8b31de9e758c8f6d1aed ] + +The capacity-dmips-mhz parameter was miscalculated: this SoC runs +the first (Cortex-A55) cluster at a maximum of 2000MHz and the +second (Cortex-A76) cluster at a maximum of 2200MHz. + +In order to calculate the right capacity-dmips-mhz, the following +test was performed: +1. CPUFREQ governor was set to 'performance' on both clusters +2. Ran dhrystone with 500000000 iterations for 10 times on each cluster +3. Calculated the mean result for each cluster +4. Calculated DMIPS/MHz: dmips_mhz = dmips_per_second / cpu_mhz +5. Scaled results to 1024: + result_c0 = dmips_mhz_c0 / dmips_mhz_c1 * 1024 + +The mean results for this SoC are: +Cluster 0 (LITTLE): 12016411 Dhry/s +Cluster 1 (BIG): 31702034 Dhry/s + +The calculated scaled results are: +Cluster 0: 426.953226899238 (rounded to 427) +Cluster 1: 1024 + +Fixes: 48489980e27e ("arm64: dts: Add Mediatek SoC MT8192 and evaluation board dts and Makefile") +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230602183515.3778780-1-nfraprado@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index 19ba781729722..72f444405ebfe 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -42,7 +42,7 @@ cpu0: cpu@0 { + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; + performance-domains = <&performance 0>; +- capacity-dmips-mhz = <530>; ++ capacity-dmips-mhz = <427>; + }; + + cpu1: cpu@100 { +@@ -54,7 +54,7 @@ cpu1: cpu@100 { + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; + performance-domains = <&performance 0>; +- capacity-dmips-mhz = <530>; ++ capacity-dmips-mhz = <427>; + }; + + cpu2: cpu@200 { +@@ -66,7 +66,7 @@ cpu2: cpu@200 { + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; + performance-domains = <&performance 0>; +- capacity-dmips-mhz = <530>; ++ capacity-dmips-mhz = <427>; + }; + + cpu3: cpu@300 { +@@ -78,7 +78,7 @@ cpu3: cpu@300 { + cpu-idle-states = <&cpu_sleep_l &cluster_sleep_l>; + next-level-cache = <&l2_0>; + performance-domains = <&performance 0>; +- capacity-dmips-mhz = <530>; ++ capacity-dmips-mhz = <427>; + }; + + cpu4: cpu@400 { +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-microchip-sparx5-do-not-use-psci-on-refere.patch b/queue-5.15/arm64-dts-microchip-sparx5-do-not-use-psci-on-refere.patch new file mode 100644 index 00000000000..b0ccdd7bc4e --- /dev/null +++ b/queue-5.15/arm64-dts-microchip-sparx5-do-not-use-psci-on-refere.patch @@ -0,0 +1,74 @@ +From c9825c93f372db37e5484336b5831904997363cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Feb 2023 11:50:37 +0100 +Subject: arm64: dts: microchip: sparx5: do not use PSCI on reference boards + +From: Robert Marko + +[ Upstream commit 70be83708c925b3f72c508e4756e48ad2330c830 ] + +PSCI is not implemented on SparX-5 at all, there is no ATF and U-boot that +is shipped does not implement it as well. + +I have tried flashing the latest BSP 2022.12 U-boot which did not work. +After contacting Microchip, they confirmed that there is no ATF for the +SoC nor PSCI implementation which is unfortunate in 2023. + +So, disable PSCI as otherwise kernel crashes as soon as it tries probing +PSCI with, and the crash is only visible if earlycon is used. + +Since PSCI is not implemented, switch core bringup to use spin-tables +which are implemented in the vendor U-boot and actually work. + +Tested on PCB134 with eMMC (VSC5640EV). + +Fixes: 6694aee00a4b ("arm64: dts: sparx5: Add basic cpu support") +Signed-off-by: Robert Marko +Acked-by: Steen Hegelund +Link: https://lore.kernel.org/r/20230221105039.316819-1-robert.marko@sartura.hr +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/microchip/sparx5.dtsi | 2 +- + arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi | 12 ++++++++++++ + 2 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/microchip/sparx5.dtsi b/arch/arm64/boot/dts/microchip/sparx5.dtsi +index 787ebcec121d6..a6405059636c3 100644 +--- a/arch/arm64/boot/dts/microchip/sparx5.dtsi ++++ b/arch/arm64/boot/dts/microchip/sparx5.dtsi +@@ -61,7 +61,7 @@ arm-pmu { + interrupt-affinity = <&cpu0>, <&cpu1>; + }; + +- psci { ++ psci: psci { + compatible = "arm,psci-0.2"; + method = "smc"; + }; +diff --git a/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi b/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi +index 9d1a082de3e29..32bb76b3202a0 100644 +--- a/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi ++++ b/arch/arm64/boot/dts/microchip/sparx5_pcb_common.dtsi +@@ -6,6 +6,18 @@ + /dts-v1/; + #include "sparx5.dtsi" + ++&psci { ++ status = "disabled"; ++}; ++ ++&cpu0 { ++ enable-method = "spin-table"; ++}; ++ ++&cpu1 { ++ enable-method = "spin-table"; ++}; ++ + &uart0 { + status = "okay"; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-apq8016-sbc-clarify-firmware-names.patch b/queue-5.15/arm64-dts-qcom-apq8016-sbc-clarify-firmware-names.patch new file mode 100644 index 00000000000..f0de7163338 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-apq8016-sbc-clarify-firmware-names.patch @@ -0,0 +1,71 @@ +From b1d5a64753a1817917b9b8f8897bed059647eaa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Sep 2021 21:58:53 +0200 +Subject: arm64: dts: qcom: apq8016-sbc: Clarify firmware-names + +From: Stephan Gerhold + +[ Upstream commit 2533786f46d074d67a4bca04c2d44d3825594415 ] + +Commit 0f6b380d580c ("arm64: dts: qcom: apq8016-sbc: Update modem and WiFi +firmware path") added "firmware-name"s to the APQ8016 SBC (DB410c) device +tree to separate the (test key)-signed firmware from other devices. + +However, the added names are a bit confusing. The "modem" firmware used by +DB410c is actually a simplified version for APQ8016 that lacks most of the +modem functionality (phone calls, SMS etc) that is available on MSM8916. +Placing it in "qcom/msm8916/modem.mbn" suggests that it supports all +functionality for MSM and not just the reduced functionality for APQ. + +Request the firmware from "qcom/apq8016/modem.mbn" instead to clarify this. +Do the same for "wcnss.mbn" for consistency (although the WCNSS firmware +works just fine on MSM8916). + +Finally, add a "_sbc" suffix to the WCNSS_qcom_wlan_nv.bin firmware file. +It seems like the nv.bin firmware is somewhat board specific and can +therefore vary a bit from device to device. This makes it more clear +which board it is intended to be used for. + +Signed-off-by: Stephan Gerhold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210922195853.95574-1-stephan@gerhold.net +Stable-dep-of: e27654df20d7 ("arm64: dts: qcom: apq8016-sbc: Fix regulator constraints") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +index 351c68d29afb7..0e4a1f0040211 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +@@ -308,7 +308,7 @@ &mdss { + &mpss { + status = "okay"; + +- firmware-name = "qcom/msm8916/mba.mbn", "qcom/msm8916/modem.mbn"; ++ firmware-name = "qcom/apq8016/mba.mbn", "qcom/apq8016/modem.mbn"; + }; + + &pm8916_resin { +@@ -319,7 +319,7 @@ &pm8916_resin { + &pronto { + status = "okay"; + +- firmware-name = "qcom/msm8916/wcnss.mbn"; ++ firmware-name = "qcom/apq8016/wcnss.mbn"; + }; + + &sdhc_1 { +@@ -403,7 +403,7 @@ &wcd_codec { + }; + + &wcnss_ctrl { +- firmware-name = "qcom/msm8916/WCNSS_qcom_wlan_nv.bin"; ++ firmware-name = "qcom/apq8016/WCNSS_qcom_wlan_nv_sbc.bin"; + }; + + /* Enable CoreSight */ +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-apq8016-sbc-fix-1.8v-power-rail-on-ls.patch b/queue-5.15/arm64-dts-qcom-apq8016-sbc-fix-1.8v-power-rail-on-ls.patch new file mode 100644 index 00000000000..a3b400da320 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-apq8016-sbc-fix-1.8v-power-rail-on-ls.patch @@ -0,0 +1,81 @@ +From 36ef326a3c5dc6fb17c92f9c331eae6e1158c207 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 20:48:41 +0200 +Subject: arm64: dts: qcom: apq8016-sbc: Fix 1.8V power rail on LS expansion + +From: Stephan Gerhold + +[ Upstream commit 5500f823db38db073d30557af159b77fb1f2bf26 ] + +The 96Boards specification expects a 1.8V power rail on the low-speed +expansion connector that is able to provide at least 0.18W / 100 mA. +According to the DB410c hardware user manual this is done by connecting +both L15 and L16 in parallel with up to 55mA each (for 110 mA total) [1]. + +Unfortunately the current regulator setup in the DB410c device tree +does not implement the specification correctly and only provides 5 mA: + + - Only L15 is marked always-on, so L16 is never enabled. + - Without specifying a load the regulator is put into LPM where + it can only provide 5 mA. + +Fix this by: + + - Adding proper voltage constraints for L16. + - Making L16 always-on. + - Adding regulator-system-load for both L15 and L16. 100 mA should be + available in total, so specify 50 mA for each. (The regulator + hardware can only be in normal (55 mA) or low-power mode (5 mA) so + this will actually result in the expected 110 mA total...) + +[1]: https://www.96boards.org/documentation/consumer/dragonboard/dragonboard410c/hardware-docs/hardware-user-manual.md.html#power-supplies + +Cc: Srinivas Kandagatla +Fixes: 828dd5d66f0f ("arm64: dts: apq8016-sbc: make 1.8v available on LS expansion") +Signed-off-by: Stephan Gerhold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230510-msm8916-regulators-v1-2-54d4960a05fc@gerhold.net +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dts | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +index 528138af24f09..c6e8bf18defc6 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +@@ -519,19 +519,27 @@ l14 { + regulator-max-microvolt = <3300000>; + }; + +- /** +- * 1.8v required on LS expansion +- * for mezzanine boards ++ /* ++ * The 96Boards specification expects a 1.8V power rail on the low-speed ++ * expansion connector that is able to provide at least 0.18W / 100 mA. ++ * L15/L16 are connected in parallel to provide 55 mA each. A minimum load ++ * must be specified to ensure the regulators are not put in LPM where they ++ * would only provide 5 mA. + */ + l15 { + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; ++ regulator-system-load = <50000>; ++ regulator-allow-set-load; + regulator-always-on; + }; + + l16 { + regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <3300000>; ++ regulator-max-microvolt = <1800000>; ++ regulator-system-load = <50000>; ++ regulator-allow-set-load; ++ regulator-always-on; + }; + + l17 { +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-apq8016-sbc-fix-mpps-state-names.patch b/queue-5.15/arm64-dts-qcom-apq8016-sbc-fix-mpps-state-names.patch new file mode 100644 index 00000000000..aa6cd7cf838 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-apq8016-sbc-fix-mpps-state-names.patch @@ -0,0 +1,47 @@ +From 9055bb4a3005bb009f8b18ee4ac03b5acd1f9a26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Oct 2021 04:25:11 +0300 +Subject: arm64: dts: qcom: apq8016-sbc: fix mpps state names + +From: Dmitry Baryshkov + +[ Upstream commit a4344427eadd6caf0dc9e5384b023083e567221d ] + +The majority of device tree nodes for mpps use xxxx-state as pinctrl +nodes. Change names of mpps pinctrl nodes for the apq8016-sbc board to +follow that pattern. + +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20211008012524.481877-13-dmitry.baryshkov@linaro.org +Stable-dep-of: e27654df20d7 ("arm64: dts: qcom: apq8016-sbc: Fix regulator constraints") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +index 0e4a1f0040211..1c097098f1e0f 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +@@ -821,7 +821,7 @@ &pm8916_mpps { + pinctrl-names = "default"; + pinctrl-0 = <&ls_exp_gpio_f>; + +- ls_exp_gpio_f: pm8916-mpp4 { ++ ls_exp_gpio_f: pm8916-mpp4-state { + pins = "mpp4"; + function = "digital"; + +@@ -829,7 +829,7 @@ ls_exp_gpio_f: pm8916-mpp4 { + power-source = ; // 1.8V + }; + +- pm8916_mpps_leds: pm8916-mpps-leds { ++ pm8916_mpps_leds: pm8916-mpps-state { + pins = "mpp2", "mpp3"; + function = "digital"; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-apq8016-sbc-fix-regulator-constraints.patch b/queue-5.15/arm64-dts-qcom-apq8016-sbc-fix-regulator-constraints.patch new file mode 100644 index 00000000000..7347c299a0b --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-apq8016-sbc-fix-regulator-constraints.patch @@ -0,0 +1,186 @@ +From 9759957da18b3a0be1450490ef868309e467a50e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 20:48:40 +0200 +Subject: arm64: dts: qcom: apq8016-sbc: Fix regulator constraints + +From: Stephan Gerhold + +[ Upstream commit e27654df20d77ad7549a3cf6739ebaa3aa59a088 ] + +For some reason DB410c has completely bogus regulator constraints that +actually just correspond to the programmable voltages which are already +provided by the regulator driver. Some of them are not just outside the +recommended operating conditions of the APQ8016E SoC but even exceed +the absolute maximum ratings, potentially risking permanent device +damage. + +In practice it's not quite as dangerous thanks to the RPM firmware: +It turns out that it has its own voltage constraints and silently +clamps all regulator requests. For example, requesting 3.3V for L5 +(allowed by the current regulator constraints!) still results in 1.8V +being programmed in the actual regulator hardware. + +Experimentation with various voltages shows that the internal RPM +voltage constraints roughly correspond to the safe "specified range" +in the PM8916 Device Specification (rather than the "programmable +range" used inside apq8016-sbc.dtsi right now). + +Combine those together with some fixed voltages used in the old +msm-3.10 device tree from Qualcomm to give DB410c some actually valid +voltage constraints. + +Cc: Srinivas Kandagatla +Fixes: 4c7d53d16d77 ("arm64: dts: apq8016-sbc: add regulators support") +Signed-off-by: Stephan Gerhold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230510-msm8916-regulators-v1-1-54d4960a05fc@gerhold.net +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dts | 64 ++++++++++++------------ + 1 file changed, 32 insertions(+), 32 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +index a5320d6d30e7b..528138af24f09 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +@@ -440,21 +440,21 @@ &smd_rpm_regulators { + vdd_l7-supply = <&pm8916_s4>; + + s3 { +- regulator-min-microvolt = <375000>; +- regulator-max-microvolt = <1562000>; ++ regulator-min-microvolt = <1250000>; ++ regulator-max-microvolt = <1350000>; + }; + + s4 { +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; ++ regulator-min-microvolt = <1850000>; ++ regulator-max-microvolt = <2150000>; + + regulator-always-on; + regulator-boot-on; + }; + + l1 { +- regulator-min-microvolt = <375000>; +- regulator-max-microvolt = <1525000>; ++ regulator-min-microvolt = <1225000>; ++ regulator-max-microvolt = <1225000>; + }; + + l2 { +@@ -463,13 +463,13 @@ l2 { + }; + + l4 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <2050000>; ++ regulator-max-microvolt = <2050000>; + }; + + l5 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; + }; + + l6 { +@@ -478,45 +478,45 @@ l6 { + }; + + l7 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; + }; + + l8 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <2900000>; ++ regulator-max-microvolt = <2900000>; + }; + + l9 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; + }; + + l10 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <2800000>; ++ regulator-max-microvolt = <2800000>; + }; + + l11 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <2950000>; ++ regulator-max-microvolt = <2950000>; + regulator-allow-set-load; + regulator-system-load = <200000>; + }; + + l12 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <2950000>; + }; + + l13 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <3075000>; ++ regulator-max-microvolt = <3075000>; + }; + + l14 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <3300000>; + }; + + /** +@@ -524,14 +524,14 @@ l14 { + * for mezzanine boards + */ + l15 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; + regulator-always-on; + }; + + l16 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <3300000>; + }; + + l17 { +@@ -540,8 +540,8 @@ l17 { + }; + + l18 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; ++ regulator-min-microvolt = <2700000>; ++ regulator-max-microvolt = <2700000>; + }; + }; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-apq8016-sbc-update-modem-and-wifi-fir.patch b/queue-5.15/arm64-dts-qcom-apq8016-sbc-update-modem-and-wifi-fir.patch new file mode 100644 index 00000000000..95132c79b9c --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-apq8016-sbc-update-modem-and-wifi-fir.patch @@ -0,0 +1,81 @@ +From 05cb862263e083bd6992c3909dc79c9217959e23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 May 2021 15:44:53 -0700 +Subject: arm64: dts: qcom: apq8016-sbc: Update modem and WiFi firmware path + +From: Bjorn Andersson + +[ Upstream commit 0f6b380d580cd081d5e385d349f55dfc52e3d68c ] + +The firmware for the modem and WiFi subsystems platform specific and is +signed with a OEM specific key (or a test key). In order to support more +than a single device it is therefor not possible to rely on the default +path and stash these files directly in the firmware directory. + +This has already been addressed for other platforms, but the APQ8016 SBC +(aka db410c) was never finished upstream. + +Signed-off-by: Bjorn Andersson +Reviewed-by: Stephan Gerhold +Tested-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20210531224453.783218-1-bjorn.andersson@linaro.org +Stable-dep-of: e27654df20d7 ("arm64: dts: qcom: apq8016-sbc: Fix regulator constraints") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 12 ++++++++++++ + arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +- + 2 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +index f8d8f3e3664ec..351c68d29afb7 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +@@ -305,6 +305,12 @@ &mdss { + status = "okay"; + }; + ++&mpss { ++ status = "okay"; ++ ++ firmware-name = "qcom/msm8916/mba.mbn", "qcom/msm8916/modem.mbn"; ++}; ++ + &pm8916_resin { + status = "okay"; + linux,code = ; +@@ -312,6 +318,8 @@ &pm8916_resin { + + &pronto { + status = "okay"; ++ ++ firmware-name = "qcom/msm8916/wcnss.mbn"; + }; + + &sdhc_1 { +@@ -394,6 +402,10 @@ &wcd_codec { + qcom,mbhc-vthreshold-high = <75 150 237 450 500>; + }; + ++&wcnss_ctrl { ++ firmware-name = "qcom/msm8916/WCNSS_qcom_wlan_nv.bin"; ++}; ++ + /* Enable CoreSight */ + &cti0 { status = "okay"; }; + &cti1 { status = "okay"; }; +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index aa79e08075ea7..fcc9f757c9e14 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -1771,7 +1771,7 @@ smd-edge { + + label = "pronto"; + +- wcnss { ++ wcnss_ctrl: wcnss { + compatible = "qcom,wcnss"; + qcom,smd-channels = "WCNSS_CTRL"; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-apq8096-fix-fixed-regulator-name-prop.patch b/queue-5.15/arm64-dts-qcom-apq8096-fix-fixed-regulator-name-prop.patch new file mode 100644 index 00000000000..7eec64e664c --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-apq8096-fix-fixed-regulator-name-prop.patch @@ -0,0 +1,49 @@ +From 95873c8a17ddbd0546f5322c564beda80da0c59e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 19:45:16 +0200 +Subject: arm64: dts: qcom: apq8096: fix fixed regulator name property + +From: Krzysztof Kozlowski + +[ Upstream commit c77612a07d18d4425fd8ddd532a8a9b8e1970c53 ] + +Correct the typo in 'regulator-name' property. + + apq8096-ifc6640.dtb: v1p05-regulator: 'regulator-name' is a required property + apq8096-ifc6640.dtb: v1p05-regulator: Unevaluated properties are not allowed ('reglator-name' was unexpected) + +Fixes: 6cbdec2d3ca6 ("arm64: dts: qcom: msm8996: Introduce IFC6640") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230507174516.264936-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts b/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts +index a57c60070cdc2..f0a98ab1616ab 100644 +--- a/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts ++++ b/arch/arm64/boot/dts/qcom/apq8096-ifc6640.dts +@@ -26,7 +26,7 @@ chosen { + + v1p05: v1p05-regulator { + compatible = "regulator-fixed"; +- reglator-name = "v1p05"; ++ regulator-name = "v1p05"; + regulator-always-on; + regulator-boot-on; + +@@ -38,7 +38,7 @@ v1p05: v1p05-regulator { + + v12_poe: v12-poe-regulator { + compatible = "regulator-fixed"; +- reglator-name = "v12_poe"; ++ regulator-name = "v12_poe"; + regulator-always-on; + regulator-boot-on; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-db820c-move-blsp1_uart2-pin-states-to.patch b/queue-5.15/arm64-dts-qcom-db820c-move-blsp1_uart2-pin-states-to.patch new file mode 100644 index 00000000000..c1acdedaa5b --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-db820c-move-blsp1_uart2-pin-states-to.patch @@ -0,0 +1,107 @@ +From d46d67829db50913ca039411e8edf3fe4e7b204e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 19:33:24 +0000 +Subject: arm64: dts: qcom: db820c: Move blsp1_uart2 pin states to msm8996.dtsi + +From: Yassine Oudjana + +[ Upstream commit c57b4247faaf6d17a319c91d5eb736c3bc65aca2 ] + +Move blsp1_uart2_default and blsp1_uart2_sleep to the SoC device tree to +avoid duplicating them in other device trees. + +Signed-off-by: Yassine Oudjana +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210901193214.250375-2-y.oudjana@protonmail.com +Stable-dep-of: e27654df20d7 ("arm64: dts: qcom: apq8016-sbc: Fix regulator constraints") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi | 29 -------------------- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 17 ++++++++++++ + 2 files changed, 17 insertions(+), 29 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi +index 51e17094d7b18..eca428ab2517a 100644 +--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi +@@ -148,9 +148,6 @@ &blsp1_spi1 { + &blsp1_uart2 { + label = "BT-UART"; + status = "okay"; +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&blsp1_uart2_default>; +- pinctrl-1 = <&blsp1_uart2_sleep>; + + bluetooth { + compatible = "qcom,qca6174-bt"; +@@ -437,32 +434,6 @@ config { + }; + }; + +- blsp1_uart2_default: blsp1_uart2_default { +- mux { +- pins = "gpio41", "gpio42", "gpio43", "gpio44"; +- function = "blsp_uart2"; +- }; +- +- config { +- pins = "gpio41", "gpio42", "gpio43", "gpio44"; +- drive-strength = <16>; +- bias-disable; +- }; +- }; +- +- blsp1_uart2_sleep: blsp1_uart2_sleep { +- mux { +- pins = "gpio41", "gpio42", "gpio43", "gpio44"; +- function = "gpio"; +- }; +- +- config { +- pins = "gpio41", "gpio42", "gpio43", "gpio44"; +- drive-strength = <2>; +- bias-disable; +- }; +- }; +- + hdmi_hpd_active: hdmi_hpd_active { + mux { + pins = "gpio34"; +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 893c241f72030..ec3ef14048cc0 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -1228,6 +1228,20 @@ wake { + }; + }; + ++ blsp1_uart2_default: blsp1-uart2-default { ++ pins = "gpio41", "gpio42", "gpio43", "gpio44"; ++ function = "blsp_uart2"; ++ drive-strength = <16>; ++ bias-disable; ++ }; ++ ++ blsp1_uart2_sleep: blsp1-uart2-sleep { ++ pins = "gpio41", "gpio42", "gpio43", "gpio44"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-disable; ++ }; ++ + blsp1_i2c3_default: blsp1-i2c2-default { + pins = "gpio47", "gpio48"; + function = "blsp_i2c3"; +@@ -2724,6 +2738,9 @@ blsp1_uart2: serial@7570000 { + clocks = <&gcc GCC_BLSP1_UART2_APPS_CLK>, + <&gcc GCC_BLSP1_AHB_CLK>; + clock-names = "core", "iface"; ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&blsp1_uart2_default>; ++ pinctrl-1 = <&blsp1_uart2_sleep>; + dmas = <&blsp1_dma 2>, <&blsp1_dma 3>; + dma-names = "tx", "rx"; + status = "disabled"; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-drop-unneeded-extra-device-specific-i.patch b/queue-5.15/arm64-dts-qcom-drop-unneeded-extra-device-specific-i.patch new file mode 100644 index 00000000000..35e544a2826 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-drop-unneeded-extra-device-specific-i.patch @@ -0,0 +1,4029 @@ +From cc7cdaa6c6e78c776a8500b6f43e104d904d030d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 15:36:56 +0200 +Subject: arm64: dts: qcom: Drop unneeded extra device-specific includes + +From: Stephan Gerhold + +[ Upstream commit 442ee1fc60c47539253fafd4cbbe2f1ec22e2a46 ] + +For some reason apq8016-sbc, apq8096-db820c, msm8916-mtp and msm8996-mtp +were added as separate .dts and .dtsi files where the first only contains +the model name and the latter contains most of the actual definitions. +Perhaps this was done with the expectation that there would be other +devices also making use of exactly the same. However, this has not +been the case until now and it also seems unlikely in the future. +Having the extra .dtsi only clutters the file list and provides +little benefit. + +Move the contents of the .dtsi into the .dts file to make this consistent +with most other devices that simply define everything in the .dts. + +There are no functional changes introduced by this patch: +The compiled ".dtb"s are completely identical. + +Signed-off-by: Stephan Gerhold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20211018133656.32649-1-stephan@gerhold.net +Stable-dep-of: e27654df20d7 ("arm64: dts: qcom: apq8016-sbc: Fix regulator constraints") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dts | 832 +++++++++++++- + arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 838 -------------- + arch/arm64/boot/dts/qcom/apq8096-db820c.dts | 1070 ++++++++++++++++- + arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi | 1076 ------------------ + arch/arm64/boot/dts/qcom/msm8916-mtp.dts | 15 +- + arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi | 21 - + arch/arm64/boot/dts/qcom/msm8996-mtp.dts | 24 +- + arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi | 30 - + 8 files changed, 1937 insertions(+), 1969 deletions(-) + delete mode 100644 arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi + delete mode 100644 arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi + delete mode 100644 arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi + delete mode 100644 arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +index f3c0dbfd0a232..a5320d6d30e7b 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts +@@ -5,9 +5,839 @@ + + /dts-v1/; + +-#include "apq8016-sbc.dtsi" ++#include "msm8916-pm8916.dtsi" ++#include ++#include ++#include ++#include ++#include + + / { + model = "Qualcomm Technologies, Inc. APQ 8016 SBC"; + compatible = "qcom,apq8016-sbc", "qcom,apq8016"; ++ ++ aliases { ++ serial0 = &blsp1_uart2; ++ serial1 = &blsp1_uart1; ++ usid0 = &pm8916_0; ++ i2c0 = &blsp_i2c2; ++ i2c1 = &blsp_i2c6; ++ i2c3 = &blsp_i2c4; ++ spi0 = &blsp_spi5; ++ spi1 = &blsp_spi3; ++ }; ++ ++ chosen { ++ stdout-path = "serial0"; ++ }; ++ ++ camera_vdddo_1v8: camera-vdddo-1v8 { ++ compatible = "regulator-fixed"; ++ regulator-name = "camera_vdddo"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ regulator-always-on; ++ }; ++ ++ camera_vdda_2v8: camera-vdda-2v8 { ++ compatible = "regulator-fixed"; ++ regulator-name = "camera_vdda"; ++ regulator-min-microvolt = <2800000>; ++ regulator-max-microvolt = <2800000>; ++ regulator-always-on; ++ }; ++ ++ camera_vddd_1v5: camera-vddd-1v5 { ++ compatible = "regulator-fixed"; ++ regulator-name = "camera_vddd"; ++ regulator-min-microvolt = <1500000>; ++ regulator-max-microvolt = <1500000>; ++ regulator-always-on; ++ }; ++ ++ reserved-memory { ++ ramoops@bff00000 { ++ compatible = "ramoops"; ++ reg = <0x0 0xbff00000 0x0 0x100000>; ++ ++ record-size = <0x20000>; ++ console-size = <0x20000>; ++ ftrace-size = <0x20000>; ++ }; ++ }; ++ ++ usb2513 { ++ compatible = "smsc,usb3503"; ++ reset-gpios = <&pm8916_gpios 3 GPIO_ACTIVE_LOW>; ++ initial-mode = <1>; ++ }; ++ ++ usb_id: usb-id { ++ compatible = "linux,extcon-usb-gpio"; ++ id-gpio = <&msmgpio 121 GPIO_ACTIVE_HIGH>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&usb_id_default>; ++ }; ++ ++ hdmi-out { ++ compatible = "hdmi-connector"; ++ type = "a"; ++ ++ port { ++ hdmi_con: endpoint { ++ remote-endpoint = <&adv7533_out>; ++ }; ++ }; ++ }; ++ ++ gpio-keys { ++ compatible = "gpio-keys"; ++ #address-cells = <1>; ++ #size-cells = <0>; ++ autorepeat; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&msm_key_volp_n_default>; ++ ++ button@0 { ++ label = "Volume Up"; ++ linux,code = ; ++ gpios = <&msmgpio 107 GPIO_ACTIVE_LOW>; ++ }; ++ }; ++ ++ leds { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&msmgpio_leds>, ++ <&pm8916_gpios_leds>, ++ <&pm8916_mpps_leds>; ++ ++ compatible = "gpio-leds"; ++ ++ led@1 { ++ label = "apq8016-sbc:green:user1"; ++ gpios = <&msmgpio 21 GPIO_ACTIVE_HIGH>; ++ linux,default-trigger = "heartbeat"; ++ default-state = "off"; ++ }; ++ ++ led@2 { ++ label = "apq8016-sbc:green:user2"; ++ gpios = <&msmgpio 120 GPIO_ACTIVE_HIGH>; ++ linux,default-trigger = "mmc0"; ++ default-state = "off"; ++ }; ++ ++ led@3 { ++ label = "apq8016-sbc:green:user3"; ++ gpios = <&pm8916_gpios 1 GPIO_ACTIVE_HIGH>; ++ linux,default-trigger = "mmc1"; ++ default-state = "off"; ++ }; ++ ++ led@4 { ++ label = "apq8016-sbc:green:user4"; ++ gpios = <&pm8916_gpios 2 GPIO_ACTIVE_HIGH>; ++ linux,default-trigger = "none"; ++ panic-indicator; ++ default-state = "off"; ++ }; ++ ++ led@5 { ++ label = "apq8016-sbc:yellow:wlan"; ++ gpios = <&pm8916_mpps 2 GPIO_ACTIVE_HIGH>; ++ linux,default-trigger = "phy0tx"; ++ default-state = "off"; ++ }; ++ ++ led@6 { ++ label = "apq8016-sbc:blue:bt"; ++ gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>; ++ linux,default-trigger = "bluetooth-power"; ++ default-state = "off"; ++ }; ++ }; ++}; ++ ++&blsp_dma { ++ status = "okay"; ++}; ++ ++&blsp_i2c2 { ++ /* On Low speed expansion */ ++ status = "okay"; ++ label = "LS-I2C0"; ++}; ++ ++&blsp_i2c4 { ++ /* On High speed expansion */ ++ status = "okay"; ++ label = "HS-I2C2"; ++ ++ adv_bridge: bridge@39 { ++ status = "okay"; ++ ++ compatible = "adi,adv7533"; ++ reg = <0x39>; ++ ++ interrupt-parent = <&msmgpio>; ++ interrupts = <31 IRQ_TYPE_EDGE_FALLING>; ++ ++ adi,dsi-lanes = <4>; ++ clocks = <&rpmcc RPM_SMD_BB_CLK2>; ++ clock-names = "cec"; ++ ++ pd-gpios = <&msmgpio 32 GPIO_ACTIVE_HIGH>; ++ ++ avdd-supply = <&pm8916_l6>; ++ v1p2-supply = <&pm8916_l6>; ++ v3p3-supply = <&pm8916_l17>; ++ ++ pinctrl-names = "default","sleep"; ++ pinctrl-0 = <&adv7533_int_active &adv7533_switch_active>; ++ pinctrl-1 = <&adv7533_int_suspend &adv7533_switch_suspend>; ++ #sound-dai-cells = <1>; ++ ++ ports { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ port@0 { ++ reg = <0>; ++ adv7533_in: endpoint { ++ remote-endpoint = <&dsi0_out>; ++ }; ++ }; ++ ++ port@1 { ++ reg = <1>; ++ adv7533_out: endpoint { ++ remote-endpoint = <&hdmi_con>; ++ }; ++ }; ++ }; ++ }; ++}; ++ ++&blsp_i2c6 { ++ /* On Low speed expansion */ ++ status = "okay"; ++ label = "LS-I2C1"; ++}; ++ ++&blsp_spi3 { ++ /* On High speed expansion */ ++ status = "okay"; ++ label = "HS-SPI1"; ++}; ++ ++&blsp_spi5 { ++ /* On Low speed expansion */ ++ status = "okay"; ++ label = "LS-SPI0"; ++}; ++ ++&blsp1_uart1 { ++ status = "okay"; ++ label = "LS-UART0"; ++}; ++ ++&blsp1_uart2 { ++ status = "okay"; ++ label = "LS-UART1"; ++}; ++ ++&camss { ++ status = "okay"; ++ ports { ++ port@0 { ++ reg = <0>; ++ csiphy0_ep: endpoint { ++ clock-lanes = <1>; ++ data-lanes = <0 2>; ++ remote-endpoint = <&ov5640_ep>; ++ status = "okay"; ++ }; ++ }; ++ }; ++}; ++ ++&cci { ++ status = "okay"; ++}; ++ ++&cci_i2c0 { ++ camera_rear@3b { ++ compatible = "ovti,ov5640"; ++ reg = <0x3b>; ++ ++ enable-gpios = <&msmgpio 34 GPIO_ACTIVE_HIGH>; ++ reset-gpios = <&msmgpio 35 GPIO_ACTIVE_LOW>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&camera_rear_default>; ++ ++ clocks = <&gcc GCC_CAMSS_MCLK0_CLK>; ++ clock-names = "xclk"; ++ clock-frequency = <23880000>; ++ ++ vdddo-supply = <&camera_vdddo_1v8>; ++ vdda-supply = <&camera_vdda_2v8>; ++ vddd-supply = <&camera_vddd_1v5>; ++ ++ /* No camera mezzanine by default */ ++ status = "disabled"; ++ ++ port { ++ ov5640_ep: endpoint { ++ clock-lanes = <1>; ++ data-lanes = <0 2>; ++ remote-endpoint = <&csiphy0_ep>; ++ }; ++ }; ++ }; ++}; ++ ++&dsi0_out { ++ data-lanes = <0 1 2 3>; ++ remote-endpoint = <&adv7533_in>; ++}; ++ ++&lpass { ++ status = "okay"; ++}; ++ ++&mdss { ++ status = "okay"; ++}; ++ ++&mpss { ++ status = "okay"; ++ ++ firmware-name = "qcom/apq8016/mba.mbn", "qcom/apq8016/modem.mbn"; ++}; ++ ++&pm8916_resin { ++ status = "okay"; ++ linux,code = ; ++}; ++ ++&pronto { ++ status = "okay"; ++ ++ firmware-name = "qcom/apq8016/wcnss.mbn"; ++}; ++ ++&sdhc_1 { ++ status = "okay"; ++ ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on>; ++ pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off>; ++}; ++ ++&sdhc_2 { ++ status = "okay"; ++ ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>; ++ pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>; ++ ++ cd-gpios = <&msmgpio 38 GPIO_ACTIVE_LOW>; ++}; ++ ++&sound { ++ status = "okay"; ++ ++ pinctrl-0 = <&cdc_pdm_lines_act &ext_sec_tlmm_lines_act &ext_mclk_tlmm_lines_act>; ++ pinctrl-1 = <&cdc_pdm_lines_sus &ext_sec_tlmm_lines_sus &ext_mclk_tlmm_lines_sus>; ++ pinctrl-names = "default", "sleep"; ++ qcom,model = "DB410c"; ++ qcom,audio-routing = ++ "AMIC2", "MIC BIAS Internal2", ++ "AMIC3", "MIC BIAS External1"; ++ ++ external-dai-link@0 { ++ link-name = "ADV7533"; ++ cpu { ++ sound-dai = <&lpass MI2S_QUATERNARY>; ++ }; ++ codec { ++ sound-dai = <&adv_bridge 0>; ++ }; ++ }; ++ ++ internal-codec-playback-dai-link@0 { ++ link-name = "WCD"; ++ cpu { ++ sound-dai = <&lpass MI2S_PRIMARY>; ++ }; ++ codec { ++ sound-dai = <&lpass_codec 0>, <&wcd_codec 0>; ++ }; ++ }; ++ ++ internal-codec-capture-dai-link@0 { ++ link-name = "WCD-Capture"; ++ cpu { ++ sound-dai = <&lpass MI2S_TERTIARY>; ++ }; ++ codec { ++ sound-dai = <&lpass_codec 1>, <&wcd_codec 1>; ++ }; ++ }; ++}; ++ ++&usb { ++ status = "okay"; ++ extcon = <&usb_id>, <&usb_id>; ++ ++ pinctrl-names = "default", "device"; ++ pinctrl-0 = <&usb_sw_sel_pm &usb_hub_reset_pm>; ++ pinctrl-1 = <&usb_sw_sel_pm_device &usb_hub_reset_pm_device>; ++}; ++ ++&usb_hs_phy { ++ extcon = <&usb_id>; ++}; ++ ++&wcd_codec { ++ clocks = <&gcc GCC_CODEC_DIGCODEC_CLK>; ++ clock-names = "mclk"; ++ qcom,mbhc-vthreshold-low = <75 150 237 450 500>; ++ qcom,mbhc-vthreshold-high = <75 150 237 450 500>; ++}; ++ ++&wcnss_ctrl { ++ firmware-name = "qcom/apq8016/WCNSS_qcom_wlan_nv_sbc.bin"; ++}; ++ ++/* Enable CoreSight */ ++&cti0 { status = "okay"; }; ++&cti1 { status = "okay"; }; ++&cti12 { status = "okay"; }; ++&cti13 { status = "okay"; }; ++&cti14 { status = "okay"; }; ++&cti15 { status = "okay"; }; ++&debug0 { status = "okay"; }; ++&debug1 { status = "okay"; }; ++&debug2 { status = "okay"; }; ++&debug3 { status = "okay"; }; ++&etf { status = "okay"; }; ++&etm0 { status = "okay"; }; ++&etm1 { status = "okay"; }; ++&etm2 { status = "okay"; }; ++&etm3 { status = "okay"; }; ++&etr { status = "okay"; }; ++&funnel0 { status = "okay"; }; ++&funnel1 { status = "okay"; }; ++&replicator { status = "okay"; }; ++&stm { status = "okay"; }; ++&tpiu { status = "okay"; }; ++ ++&smd_rpm_regulators { ++ vdd_l1_l2_l3-supply = <&pm8916_s3>; ++ vdd_l4_l5_l6-supply = <&pm8916_s4>; ++ vdd_l7-supply = <&pm8916_s4>; ++ ++ s3 { ++ regulator-min-microvolt = <375000>; ++ regulator-max-microvolt = <1562000>; ++ }; ++ ++ s4 { ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ ++ regulator-always-on; ++ regulator-boot-on; ++ }; ++ ++ l1 { ++ regulator-min-microvolt = <375000>; ++ regulator-max-microvolt = <1525000>; ++ }; ++ ++ l2 { ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <1200000>; ++ }; ++ ++ l4 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l5 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l6 { ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ ++ l7 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l8 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l9 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l10 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l11 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ regulator-allow-set-load; ++ regulator-system-load = <200000>; ++ }; ++ ++ l12 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l13 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l14 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ /** ++ * 1.8v required on LS expansion ++ * for mezzanine boards ++ */ ++ l15 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ regulator-always-on; ++ }; ++ ++ l16 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++ ++ l17 { ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ }; ++ ++ l18 { ++ regulator-min-microvolt = <1750000>; ++ regulator-max-microvolt = <3337000>; ++ }; ++}; ++ ++/* ++ * 2mA drive strength is not enough when connecting multiple ++ * I2C devices with different pull up resistors. ++ */ ++&i2c2_default { ++ drive-strength = <16>; ++}; ++ ++&i2c4_default { ++ drive-strength = <16>; ++}; ++ ++&i2c6_default { ++ drive-strength = <16>; ++}; ++ ++/* ++ * GPIO name legend: proper name = the GPIO line is used as GPIO ++ * NC = not connected (pin out but not routed from the chip to ++ * anything the board) ++ * "[PER]" = pin is muxed for [peripheral] (not GPIO) ++ * LSEC = Low Speed External Connector ++ * HSEC = High Speed External Connector ++ * ++ * Line names are taken from the schematic "DragonBoard410c" ++ * dated monday, august 31, 2015. Page 5 in particular. ++ * ++ * For the lines routed to the external connectors the ++ * lines are named after the 96Boards CE Specification 1.0, ++ * Appendix "Expansion Connector Signal Description". ++ * ++ * When the 96Board naming of a line and the schematic name of ++ * the same line are in conflict, the 96Board specification ++ * takes precedence, which means that the external UART on the ++ * LSEC is named UART0 while the schematic and SoC names this ++ * UART3. This is only for the informational lines i.e. "[FOO]", ++ * the GPIO named lines "GPIO-A" thru "GPIO-L" are the only ++ * ones actually used for GPIO. ++ */ ++ ++&msmgpio { ++ gpio-line-names = ++ "[UART0_TX]", /* GPIO_0, LSEC pin 5 */ ++ "[UART0_RX]", /* GPIO_1, LSEC pin 7 */ ++ "[UART0_CTS_N]", /* GPIO_2, LSEC pin 3 */ ++ "[UART0_RTS_N]", /* GPIO_3, LSEC pin 9 */ ++ "[UART1_TX]", /* GPIO_4, LSEC pin 11 */ ++ "[UART1_RX]", /* GPIO_5, LSEC pin 13 */ ++ "[I2C0_SDA]", /* GPIO_8, LSEC pin 17 */ ++ "[I2C0_SCL]", /* GPIO_7, LSEC pin 15 */ ++ "[SPI1_DOUT]", /* SPI1_MOSI, HSEC pin 1 */ ++ "[SPI1_DIN]", /* SPI1_MISO, HSEC pin 11 */ ++ "[SPI1_CS]", /* SPI1_CS_N, HSEC pin 7 */ ++ "[SPI1_SCLK]", /* SPI1_CLK, HSEC pin 9 */ ++ "GPIO-B", /* LS_EXP_GPIO_B, LSEC pin 24 */ ++ "GPIO-C", /* LS_EXP_GPIO_C, LSEC pin 25 */ ++ "[I2C3_SDA]", /* HSEC pin 38 */ ++ "[I2C3_SCL]", /* HSEC pin 36 */ ++ "[SPI0_MOSI]", /* LSEC pin 14 */ ++ "[SPI0_MISO]", /* LSEC pin 10 */ ++ "[SPI0_CS_N]", /* LSEC pin 12 */ ++ "[SPI0_CLK]", /* LSEC pin 8 */ ++ "HDMI_HPD_N", /* GPIO 20 */ ++ "USR_LED_1_CTRL", ++ "[I2C1_SDA]", /* GPIO_22, LSEC pin 21 */ ++ "[I2C1_SCL]", /* GPIO_23, LSEC pin 19 */ ++ "GPIO-G", /* LS_EXP_GPIO_G, LSEC pin 29 */ ++ "GPIO-H", /* LS_EXP_GPIO_H, LSEC pin 30 */ ++ "[CSI0_MCLK]", /* HSEC pin 15 */ ++ "[CSI1_MCLK]", /* HSEC pin 17 */ ++ "GPIO-K", /* LS_EXP_GPIO_K, LSEC pin 33 */ ++ "[I2C2_SDA]", /* HSEC pin 34 */ ++ "[I2C2_SCL]", /* HSEC pin 32 */ ++ "DSI2HDMI_INT_N", ++ "DSI_SW_SEL_APQ", ++ "GPIO-L", /* LS_EXP_GPIO_L, LSEC pin 34 */ ++ "GPIO-J", /* LS_EXP_GPIO_J, LSEC pin 32 */ ++ "GPIO-I", /* LS_EXP_GPIO_I, LSEC pin 31 */ ++ "GPIO-A", /* LS_EXP_GPIO_A, LSEC pin 23 */ ++ "FORCED_USB_BOOT", ++ "SD_CARD_DET_N", ++ "[WCSS_BT_SSBI]", ++ "[WCSS_WLAN_DATA_2]", /* GPIO 40 */ ++ "[WCSS_WLAN_DATA_1]", ++ "[WCSS_WLAN_DATA_0]", ++ "[WCSS_WLAN_SET]", ++ "[WCSS_WLAN_CLK]", ++ "[WCSS_FM_SSBI]", ++ "[WCSS_FM_SDI]", ++ "[WCSS_BT_DAT_CTL]", ++ "[WCSS_BT_DAT_STB]", ++ "NC", ++ "NC", /* GPIO 50 */ ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", /* GPIO 60 */ ++ "NC", ++ "NC", ++ "[CDC_PDM0_CLK]", ++ "[CDC_PDM0_SYNC]", ++ "[CDC_PDM0_TX0]", ++ "[CDC_PDM0_RX0]", ++ "[CDC_PDM0_RX1]", ++ "[CDC_PDM0_RX2]", ++ "GPIO-D", /* LS_EXP_GPIO_D, LSEC pin 26 */ ++ "NC", /* GPIO 70 */ ++ "NC", ++ "NC", ++ "NC", ++ "NC", /* GPIO 74 */ ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "BOOT_CONFIG_0", /* GPIO 80 */ ++ "BOOT_CONFIG_1", ++ "BOOT_CONFIG_2", ++ "BOOT_CONFIG_3", ++ "NC", ++ "NC", ++ "BOOT_CONFIG_5", ++ "NC", ++ "NC", ++ "NC", ++ "NC", /* GPIO 90 */ ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", /* GPIO 100 */ ++ "NC", ++ "NC", ++ "NC", ++ "SSBI_GPS", ++ "NC", ++ "NC", ++ "KEY_VOLP_N", ++ "NC", ++ "NC", ++ "[LS_EXP_MI2S_WS]", /* GPIO 110 */ ++ "NC", ++ "NC", ++ "[LS_EXP_MI2S_SCK]", ++ "[LS_EXP_MI2S_DATA0]", ++ "GPIO-E", /* LS_EXP_GPIO_E, LSEC pin 27 */ ++ "NC", ++ "[DSI2HDMI_MI2S_WS]", ++ "[DSI2HDMI_MI2S_SCK]", ++ "[DSI2HDMI_MI2S_DATA0]", ++ "USR_LED_2_CTRL", /* GPIO 120 */ ++ "SB_HS_ID"; ++ ++ msmgpio_leds: msmgpio-leds { ++ pins = "gpio21", "gpio120"; ++ function = "gpio"; ++ ++ output-low; ++ }; ++ ++ usb_id_default: usb-id-default { ++ pins = "gpio121"; ++ function = "gpio"; ++ ++ drive-strength = <8>; ++ input-enable; ++ bias-pull-up; ++ }; ++ ++ adv7533_int_active: adv533-int-active { ++ pins = "gpio31"; ++ function = "gpio"; ++ ++ drive-strength = <16>; ++ bias-disable; ++ }; ++ ++ adv7533_int_suspend: adv7533-int-suspend { ++ pins = "gpio31"; ++ function = "gpio"; ++ ++ drive-strength = <2>; ++ bias-disable; ++ }; ++ ++ adv7533_switch_active: adv7533-switch-active { ++ pins = "gpio32"; ++ function = "gpio"; ++ ++ drive-strength = <16>; ++ bias-disable; ++ }; ++ ++ adv7533_switch_suspend: adv7533-switch-suspend { ++ pins = "gpio32"; ++ function = "gpio"; ++ ++ drive-strength = <2>; ++ bias-disable; ++ }; ++ ++ msm_key_volp_n_default: msm-key-volp-n-default { ++ pins = "gpio107"; ++ function = "gpio"; ++ ++ drive-strength = <8>; ++ input-enable; ++ bias-pull-up; ++ }; ++}; ++ ++&pm8916_gpios { ++ gpio-line-names = ++ "USR_LED_3_CTRL", ++ "USR_LED_4_CTRL", ++ "USB_HUB_RESET_N_PM", ++ "USB_SW_SEL_PM"; ++ ++ usb_hub_reset_pm: usb-hub-reset-pm { ++ pins = "gpio3"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ ++ input-disable; ++ output-high; ++ }; ++ ++ usb_hub_reset_pm_device: usb-hub-reset-pm-device { ++ pins = "gpio3"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ ++ output-low; ++ }; ++ ++ usb_sw_sel_pm: usb-sw-sel-pm { ++ pins = "gpio4"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ ++ power-source = ; ++ input-disable; ++ output-high; ++ }; ++ ++ usb_sw_sel_pm_device: usb-sw-sel-pm-device { ++ pins = "gpio4"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ ++ power-source = ; ++ input-disable; ++ output-low; ++ }; ++ ++ pm8916_gpios_leds: pm8916-gpios-leds { ++ pins = "gpio1", "gpio2"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ ++ output-low; ++ }; ++}; ++ ++&pm8916_mpps { ++ gpio-line-names = ++ "VDD_PX_BIAS", ++ "WLAN_LED_CTRL", ++ "BT_LED_CTRL", ++ "GPIO-F"; /* LS_EXP_GPIO_F, LSEC pin 28 */ ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&ls_exp_gpio_f>; ++ ++ ls_exp_gpio_f: pm8916-mpp4-state { ++ pins = "mpp4"; ++ function = "digital"; ++ ++ output-low; ++ power-source = ; // 1.8V ++ }; ++ ++ pm8916_mpps_leds: pm8916-mpps-state { ++ pins = "mpp2", "mpp3"; ++ function = "digital"; ++ ++ output-low; ++ }; + }; +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +deleted file mode 100644 +index 1c097098f1e0f..0000000000000 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ /dev/null +@@ -1,838 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/* +- * Copyright (c) 2015, The Linux Foundation. All rights reserved. +- */ +- +-#include "msm8916-pm8916.dtsi" +-#include +-#include +-#include +-#include +-#include +- +-/ { +- aliases { +- serial0 = &blsp1_uart2; +- serial1 = &blsp1_uart1; +- usid0 = &pm8916_0; +- i2c0 = &blsp_i2c2; +- i2c1 = &blsp_i2c6; +- i2c3 = &blsp_i2c4; +- spi0 = &blsp_spi5; +- spi1 = &blsp_spi3; +- }; +- +- chosen { +- stdout-path = "serial0"; +- }; +- +- camera_vdddo_1v8: camera-vdddo-1v8 { +- compatible = "regulator-fixed"; +- regulator-name = "camera_vdddo"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- regulator-always-on; +- }; +- +- camera_vdda_2v8: camera-vdda-2v8 { +- compatible = "regulator-fixed"; +- regulator-name = "camera_vdda"; +- regulator-min-microvolt = <2800000>; +- regulator-max-microvolt = <2800000>; +- regulator-always-on; +- }; +- +- camera_vddd_1v5: camera-vddd-1v5 { +- compatible = "regulator-fixed"; +- regulator-name = "camera_vddd"; +- regulator-min-microvolt = <1500000>; +- regulator-max-microvolt = <1500000>; +- regulator-always-on; +- }; +- +- reserved-memory { +- ramoops@bff00000 { +- compatible = "ramoops"; +- reg = <0x0 0xbff00000 0x0 0x100000>; +- +- record-size = <0x20000>; +- console-size = <0x20000>; +- ftrace-size = <0x20000>; +- }; +- }; +- +- usb2513 { +- compatible = "smsc,usb3503"; +- reset-gpios = <&pm8916_gpios 3 GPIO_ACTIVE_LOW>; +- initial-mode = <1>; +- }; +- +- usb_id: usb-id { +- compatible = "linux,extcon-usb-gpio"; +- id-gpio = <&msmgpio 121 GPIO_ACTIVE_HIGH>; +- pinctrl-names = "default"; +- pinctrl-0 = <&usb_id_default>; +- }; +- +- hdmi-out { +- compatible = "hdmi-connector"; +- type = "a"; +- +- port { +- hdmi_con: endpoint { +- remote-endpoint = <&adv7533_out>; +- }; +- }; +- }; +- +- gpio-keys { +- compatible = "gpio-keys"; +- #address-cells = <1>; +- #size-cells = <0>; +- autorepeat; +- +- pinctrl-names = "default"; +- pinctrl-0 = <&msm_key_volp_n_default>; +- +- button@0 { +- label = "Volume Up"; +- linux,code = ; +- gpios = <&msmgpio 107 GPIO_ACTIVE_LOW>; +- }; +- }; +- +- leds { +- pinctrl-names = "default"; +- pinctrl-0 = <&msmgpio_leds>, +- <&pm8916_gpios_leds>, +- <&pm8916_mpps_leds>; +- +- compatible = "gpio-leds"; +- +- led@1 { +- label = "apq8016-sbc:green:user1"; +- gpios = <&msmgpio 21 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "heartbeat"; +- default-state = "off"; +- }; +- +- led@2 { +- label = "apq8016-sbc:green:user2"; +- gpios = <&msmgpio 120 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "mmc0"; +- default-state = "off"; +- }; +- +- led@3 { +- label = "apq8016-sbc:green:user3"; +- gpios = <&pm8916_gpios 1 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "mmc1"; +- default-state = "off"; +- }; +- +- led@4 { +- label = "apq8016-sbc:green:user4"; +- gpios = <&pm8916_gpios 2 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "none"; +- panic-indicator; +- default-state = "off"; +- }; +- +- led@5 { +- label = "apq8016-sbc:yellow:wlan"; +- gpios = <&pm8916_mpps 2 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "phy0tx"; +- default-state = "off"; +- }; +- +- led@6 { +- label = "apq8016-sbc:blue:bt"; +- gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "bluetooth-power"; +- default-state = "off"; +- }; +- }; +-}; +- +-&blsp_dma { +- status = "okay"; +-}; +- +-&blsp_i2c2 { +- /* On Low speed expansion */ +- status = "okay"; +- label = "LS-I2C0"; +-}; +- +-&blsp_i2c4 { +- /* On High speed expansion */ +- status = "okay"; +- label = "HS-I2C2"; +- +- adv_bridge: bridge@39 { +- status = "okay"; +- +- compatible = "adi,adv7533"; +- reg = <0x39>; +- +- interrupt-parent = <&msmgpio>; +- interrupts = <31 IRQ_TYPE_EDGE_FALLING>; +- +- adi,dsi-lanes = <4>; +- clocks = <&rpmcc RPM_SMD_BB_CLK2>; +- clock-names = "cec"; +- +- pd-gpios = <&msmgpio 32 GPIO_ACTIVE_HIGH>; +- +- avdd-supply = <&pm8916_l6>; +- v1p2-supply = <&pm8916_l6>; +- v3p3-supply = <&pm8916_l17>; +- +- pinctrl-names = "default","sleep"; +- pinctrl-0 = <&adv7533_int_active &adv7533_switch_active>; +- pinctrl-1 = <&adv7533_int_suspend &adv7533_switch_suspend>; +- #sound-dai-cells = <1>; +- +- ports { +- #address-cells = <1>; +- #size-cells = <0>; +- +- port@0 { +- reg = <0>; +- adv7533_in: endpoint { +- remote-endpoint = <&dsi0_out>; +- }; +- }; +- +- port@1 { +- reg = <1>; +- adv7533_out: endpoint { +- remote-endpoint = <&hdmi_con>; +- }; +- }; +- }; +- }; +-}; +- +-&blsp_i2c6 { +- /* On Low speed expansion */ +- status = "okay"; +- label = "LS-I2C1"; +-}; +- +-&blsp_spi3 { +- /* On High speed expansion */ +- status = "okay"; +- label = "HS-SPI1"; +-}; +- +-&blsp_spi5 { +- /* On Low speed expansion */ +- status = "okay"; +- label = "LS-SPI0"; +-}; +- +-&blsp1_uart1 { +- status = "okay"; +- label = "LS-UART0"; +-}; +- +-&blsp1_uart2 { +- status = "okay"; +- label = "LS-UART1"; +-}; +- +-&camss { +- status = "okay"; +- ports { +- port@0 { +- reg = <0>; +- csiphy0_ep: endpoint { +- clock-lanes = <1>; +- data-lanes = <0 2>; +- remote-endpoint = <&ov5640_ep>; +- status = "okay"; +- }; +- }; +- }; +-}; +- +-&cci { +- status = "okay"; +-}; +- +-&cci_i2c0 { +- camera_rear@3b { +- compatible = "ovti,ov5640"; +- reg = <0x3b>; +- +- enable-gpios = <&msmgpio 34 GPIO_ACTIVE_HIGH>; +- reset-gpios = <&msmgpio 35 GPIO_ACTIVE_LOW>; +- pinctrl-names = "default"; +- pinctrl-0 = <&camera_rear_default>; +- +- clocks = <&gcc GCC_CAMSS_MCLK0_CLK>; +- clock-names = "xclk"; +- clock-frequency = <23880000>; +- +- vdddo-supply = <&camera_vdddo_1v8>; +- vdda-supply = <&camera_vdda_2v8>; +- vddd-supply = <&camera_vddd_1v5>; +- +- /* No camera mezzanine by default */ +- status = "disabled"; +- +- port { +- ov5640_ep: endpoint { +- clock-lanes = <1>; +- data-lanes = <0 2>; +- remote-endpoint = <&csiphy0_ep>; +- }; +- }; +- }; +-}; +- +-&dsi0_out { +- data-lanes = <0 1 2 3>; +- remote-endpoint = <&adv7533_in>; +-}; +- +-&lpass { +- status = "okay"; +-}; +- +-&mdss { +- status = "okay"; +-}; +- +-&mpss { +- status = "okay"; +- +- firmware-name = "qcom/apq8016/mba.mbn", "qcom/apq8016/modem.mbn"; +-}; +- +-&pm8916_resin { +- status = "okay"; +- linux,code = ; +-}; +- +-&pronto { +- status = "okay"; +- +- firmware-name = "qcom/apq8016/wcnss.mbn"; +-}; +- +-&sdhc_1 { +- status = "okay"; +- +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on>; +- pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off>; +-}; +- +-&sdhc_2 { +- status = "okay"; +- +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>; +- pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>; +- +- cd-gpios = <&msmgpio 38 GPIO_ACTIVE_LOW>; +-}; +- +-&sound { +- status = "okay"; +- +- pinctrl-0 = <&cdc_pdm_lines_act &ext_sec_tlmm_lines_act &ext_mclk_tlmm_lines_act>; +- pinctrl-1 = <&cdc_pdm_lines_sus &ext_sec_tlmm_lines_sus &ext_mclk_tlmm_lines_sus>; +- pinctrl-names = "default", "sleep"; +- qcom,model = "DB410c"; +- qcom,audio-routing = +- "AMIC2", "MIC BIAS Internal2", +- "AMIC3", "MIC BIAS External1"; +- +- external-dai-link@0 { +- link-name = "ADV7533"; +- cpu { +- sound-dai = <&lpass MI2S_QUATERNARY>; +- }; +- codec { +- sound-dai = <&adv_bridge 0>; +- }; +- }; +- +- internal-codec-playback-dai-link@0 { +- link-name = "WCD"; +- cpu { +- sound-dai = <&lpass MI2S_PRIMARY>; +- }; +- codec { +- sound-dai = <&lpass_codec 0>, <&wcd_codec 0>; +- }; +- }; +- +- internal-codec-capture-dai-link@0 { +- link-name = "WCD-Capture"; +- cpu { +- sound-dai = <&lpass MI2S_TERTIARY>; +- }; +- codec { +- sound-dai = <&lpass_codec 1>, <&wcd_codec 1>; +- }; +- }; +-}; +- +-&usb { +- status = "okay"; +- extcon = <&usb_id>, <&usb_id>; +- +- pinctrl-names = "default", "device"; +- pinctrl-0 = <&usb_sw_sel_pm &usb_hub_reset_pm>; +- pinctrl-1 = <&usb_sw_sel_pm_device &usb_hub_reset_pm_device>; +-}; +- +-&usb_hs_phy { +- extcon = <&usb_id>; +-}; +- +-&wcd_codec { +- clocks = <&gcc GCC_CODEC_DIGCODEC_CLK>; +- clock-names = "mclk"; +- qcom,mbhc-vthreshold-low = <75 150 237 450 500>; +- qcom,mbhc-vthreshold-high = <75 150 237 450 500>; +-}; +- +-&wcnss_ctrl { +- firmware-name = "qcom/apq8016/WCNSS_qcom_wlan_nv_sbc.bin"; +-}; +- +-/* Enable CoreSight */ +-&cti0 { status = "okay"; }; +-&cti1 { status = "okay"; }; +-&cti12 { status = "okay"; }; +-&cti13 { status = "okay"; }; +-&cti14 { status = "okay"; }; +-&cti15 { status = "okay"; }; +-&debug0 { status = "okay"; }; +-&debug1 { status = "okay"; }; +-&debug2 { status = "okay"; }; +-&debug3 { status = "okay"; }; +-&etf { status = "okay"; }; +-&etm0 { status = "okay"; }; +-&etm1 { status = "okay"; }; +-&etm2 { status = "okay"; }; +-&etm3 { status = "okay"; }; +-&etr { status = "okay"; }; +-&funnel0 { status = "okay"; }; +-&funnel1 { status = "okay"; }; +-&replicator { status = "okay"; }; +-&stm { status = "okay"; }; +-&tpiu { status = "okay"; }; +- +-&smd_rpm_regulators { +- vdd_l1_l2_l3-supply = <&pm8916_s3>; +- vdd_l4_l5_l6-supply = <&pm8916_s4>; +- vdd_l7-supply = <&pm8916_s4>; +- +- s3 { +- regulator-min-microvolt = <375000>; +- regulator-max-microvolt = <1562000>; +- }; +- +- s4 { +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- +- regulator-always-on; +- regulator-boot-on; +- }; +- +- l1 { +- regulator-min-microvolt = <375000>; +- regulator-max-microvolt = <1525000>; +- }; +- +- l2 { +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <1200000>; +- }; +- +- l4 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l5 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l6 { +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- +- l7 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l8 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l9 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l10 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l11 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- regulator-allow-set-load; +- regulator-system-load = <200000>; +- }; +- +- l12 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l13 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l14 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- /** +- * 1.8v required on LS expansion +- * for mezzanine boards +- */ +- l15 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- regulator-always-on; +- }; +- +- l16 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +- +- l17 { +- regulator-min-microvolt = <3300000>; +- regulator-max-microvolt = <3300000>; +- }; +- +- l18 { +- regulator-min-microvolt = <1750000>; +- regulator-max-microvolt = <3337000>; +- }; +-}; +- +-/* +- * 2mA drive strength is not enough when connecting multiple +- * I2C devices with different pull up resistors. +- */ +-&i2c2_default { +- drive-strength = <16>; +-}; +- +-&i2c4_default { +- drive-strength = <16>; +-}; +- +-&i2c6_default { +- drive-strength = <16>; +-}; +- +-/* +- * GPIO name legend: proper name = the GPIO line is used as GPIO +- * NC = not connected (pin out but not routed from the chip to +- * anything the board) +- * "[PER]" = pin is muxed for [peripheral] (not GPIO) +- * LSEC = Low Speed External Connector +- * HSEC = High Speed External Connector +- * +- * Line names are taken from the schematic "DragonBoard410c" +- * dated monday, august 31, 2015. Page 5 in particular. +- * +- * For the lines routed to the external connectors the +- * lines are named after the 96Boards CE Specification 1.0, +- * Appendix "Expansion Connector Signal Description". +- * +- * When the 96Board naming of a line and the schematic name of +- * the same line are in conflict, the 96Board specification +- * takes precedence, which means that the external UART on the +- * LSEC is named UART0 while the schematic and SoC names this +- * UART3. This is only for the informational lines i.e. "[FOO]", +- * the GPIO named lines "GPIO-A" thru "GPIO-L" are the only +- * ones actually used for GPIO. +- */ +- +-&msmgpio { +- gpio-line-names = +- "[UART0_TX]", /* GPIO_0, LSEC pin 5 */ +- "[UART0_RX]", /* GPIO_1, LSEC pin 7 */ +- "[UART0_CTS_N]", /* GPIO_2, LSEC pin 3 */ +- "[UART0_RTS_N]", /* GPIO_3, LSEC pin 9 */ +- "[UART1_TX]", /* GPIO_4, LSEC pin 11 */ +- "[UART1_RX]", /* GPIO_5, LSEC pin 13 */ +- "[I2C0_SDA]", /* GPIO_8, LSEC pin 17 */ +- "[I2C0_SCL]", /* GPIO_7, LSEC pin 15 */ +- "[SPI1_DOUT]", /* SPI1_MOSI, HSEC pin 1 */ +- "[SPI1_DIN]", /* SPI1_MISO, HSEC pin 11 */ +- "[SPI1_CS]", /* SPI1_CS_N, HSEC pin 7 */ +- "[SPI1_SCLK]", /* SPI1_CLK, HSEC pin 9 */ +- "GPIO-B", /* LS_EXP_GPIO_B, LSEC pin 24 */ +- "GPIO-C", /* LS_EXP_GPIO_C, LSEC pin 25 */ +- "[I2C3_SDA]", /* HSEC pin 38 */ +- "[I2C3_SCL]", /* HSEC pin 36 */ +- "[SPI0_MOSI]", /* LSEC pin 14 */ +- "[SPI0_MISO]", /* LSEC pin 10 */ +- "[SPI0_CS_N]", /* LSEC pin 12 */ +- "[SPI0_CLK]", /* LSEC pin 8 */ +- "HDMI_HPD_N", /* GPIO 20 */ +- "USR_LED_1_CTRL", +- "[I2C1_SDA]", /* GPIO_22, LSEC pin 21 */ +- "[I2C1_SCL]", /* GPIO_23, LSEC pin 19 */ +- "GPIO-G", /* LS_EXP_GPIO_G, LSEC pin 29 */ +- "GPIO-H", /* LS_EXP_GPIO_H, LSEC pin 30 */ +- "[CSI0_MCLK]", /* HSEC pin 15 */ +- "[CSI1_MCLK]", /* HSEC pin 17 */ +- "GPIO-K", /* LS_EXP_GPIO_K, LSEC pin 33 */ +- "[I2C2_SDA]", /* HSEC pin 34 */ +- "[I2C2_SCL]", /* HSEC pin 32 */ +- "DSI2HDMI_INT_N", +- "DSI_SW_SEL_APQ", +- "GPIO-L", /* LS_EXP_GPIO_L, LSEC pin 34 */ +- "GPIO-J", /* LS_EXP_GPIO_J, LSEC pin 32 */ +- "GPIO-I", /* LS_EXP_GPIO_I, LSEC pin 31 */ +- "GPIO-A", /* LS_EXP_GPIO_A, LSEC pin 23 */ +- "FORCED_USB_BOOT", +- "SD_CARD_DET_N", +- "[WCSS_BT_SSBI]", +- "[WCSS_WLAN_DATA_2]", /* GPIO 40 */ +- "[WCSS_WLAN_DATA_1]", +- "[WCSS_WLAN_DATA_0]", +- "[WCSS_WLAN_SET]", +- "[WCSS_WLAN_CLK]", +- "[WCSS_FM_SSBI]", +- "[WCSS_FM_SDI]", +- "[WCSS_BT_DAT_CTL]", +- "[WCSS_BT_DAT_STB]", +- "NC", +- "NC", /* GPIO 50 */ +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", /* GPIO 60 */ +- "NC", +- "NC", +- "[CDC_PDM0_CLK]", +- "[CDC_PDM0_SYNC]", +- "[CDC_PDM0_TX0]", +- "[CDC_PDM0_RX0]", +- "[CDC_PDM0_RX1]", +- "[CDC_PDM0_RX2]", +- "GPIO-D", /* LS_EXP_GPIO_D, LSEC pin 26 */ +- "NC", /* GPIO 70 */ +- "NC", +- "NC", +- "NC", +- "NC", /* GPIO 74 */ +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "BOOT_CONFIG_0", /* GPIO 80 */ +- "BOOT_CONFIG_1", +- "BOOT_CONFIG_2", +- "BOOT_CONFIG_3", +- "NC", +- "NC", +- "BOOT_CONFIG_5", +- "NC", +- "NC", +- "NC", +- "NC", /* GPIO 90 */ +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", /* GPIO 100 */ +- "NC", +- "NC", +- "NC", +- "SSBI_GPS", +- "NC", +- "NC", +- "KEY_VOLP_N", +- "NC", +- "NC", +- "[LS_EXP_MI2S_WS]", /* GPIO 110 */ +- "NC", +- "NC", +- "[LS_EXP_MI2S_SCK]", +- "[LS_EXP_MI2S_DATA0]", +- "GPIO-E", /* LS_EXP_GPIO_E, LSEC pin 27 */ +- "NC", +- "[DSI2HDMI_MI2S_WS]", +- "[DSI2HDMI_MI2S_SCK]", +- "[DSI2HDMI_MI2S_DATA0]", +- "USR_LED_2_CTRL", /* GPIO 120 */ +- "SB_HS_ID"; +- +- msmgpio_leds: msmgpio-leds { +- pins = "gpio21", "gpio120"; +- function = "gpio"; +- +- output-low; +- }; +- +- usb_id_default: usb-id-default { +- pins = "gpio121"; +- function = "gpio"; +- +- drive-strength = <8>; +- input-enable; +- bias-pull-up; +- }; +- +- adv7533_int_active: adv533-int-active { +- pins = "gpio31"; +- function = "gpio"; +- +- drive-strength = <16>; +- bias-disable; +- }; +- +- adv7533_int_suspend: adv7533-int-suspend { +- pins = "gpio31"; +- function = "gpio"; +- +- drive-strength = <2>; +- bias-disable; +- }; +- +- adv7533_switch_active: adv7533-switch-active { +- pins = "gpio32"; +- function = "gpio"; +- +- drive-strength = <16>; +- bias-disable; +- }; +- +- adv7533_switch_suspend: adv7533-switch-suspend { +- pins = "gpio32"; +- function = "gpio"; +- +- drive-strength = <2>; +- bias-disable; +- }; +- +- msm_key_volp_n_default: msm-key-volp-n-default { +- pins = "gpio107"; +- function = "gpio"; +- +- drive-strength = <8>; +- input-enable; +- bias-pull-up; +- }; +-}; +- +-&pm8916_gpios { +- gpio-line-names = +- "USR_LED_3_CTRL", +- "USR_LED_4_CTRL", +- "USB_HUB_RESET_N_PM", +- "USB_SW_SEL_PM"; +- +- usb_hub_reset_pm: usb-hub-reset-pm { +- pins = "gpio3"; +- function = PMIC_GPIO_FUNC_NORMAL; +- +- input-disable; +- output-high; +- }; +- +- usb_hub_reset_pm_device: usb-hub-reset-pm-device { +- pins = "gpio3"; +- function = PMIC_GPIO_FUNC_NORMAL; +- +- output-low; +- }; +- +- usb_sw_sel_pm: usb-sw-sel-pm { +- pins = "gpio4"; +- function = PMIC_GPIO_FUNC_NORMAL; +- +- power-source = ; +- input-disable; +- output-high; +- }; +- +- usb_sw_sel_pm_device: usb-sw-sel-pm-device { +- pins = "gpio4"; +- function = PMIC_GPIO_FUNC_NORMAL; +- +- power-source = ; +- input-disable; +- output-low; +- }; +- +- pm8916_gpios_leds: pm8916-gpios-leds { +- pins = "gpio1", "gpio2"; +- function = PMIC_GPIO_FUNC_NORMAL; +- +- output-low; +- }; +-}; +- +-&pm8916_mpps { +- gpio-line-names = +- "VDD_PX_BIAS", +- "WLAN_LED_CTRL", +- "BT_LED_CTRL", +- "GPIO-F"; /* LS_EXP_GPIO_F, LSEC pin 28 */ +- +- pinctrl-names = "default"; +- pinctrl-0 = <&ls_exp_gpio_f>; +- +- ls_exp_gpio_f: pm8916-mpp4-state { +- pins = "mpp4"; +- function = "digital"; +- +- output-low; +- power-source = ; // 1.8V +- }; +- +- pm8916_mpps_leds: pm8916-mpps-state { +- pins = "mpp2", "mpp3"; +- function = "digital"; +- +- output-low; +- }; +-}; +diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dts b/arch/arm64/boot/dts/qcom/apq8096-db820c.dts +index 757afa27424dd..d01a512634cfe 100644 +--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dts ++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dts +@@ -5,9 +5,1077 @@ + + /dts-v1/; + +-#include "apq8096-db820c.dtsi" ++#include "msm8996.dtsi" ++#include "pm8994.dtsi" ++#include "pmi8994.dtsi" ++#include ++#include ++#include ++#include ++#include ++ ++/* ++ * GPIO name legend: proper name = the GPIO line is used as GPIO ++ * NC = not connected (pin out but not routed from the chip to ++ * anything the board) ++ * "[PER]" = pin is muxed for [peripheral] (not GPIO) ++ * LSEC = Low Speed External Connector ++ * P HSEC = Primary High Speed External Connector ++ * S HSEC = Secondary High Speed External Connector ++ * J14 = Camera Connector ++ * TP = Test Points ++ * ++ * Line names are taken from the schematic "DragonBoard 820c", ++ * drawing no: LM25-P2751-1 ++ * ++ * For the lines routed to the external connectors the ++ * lines are named after the 96Boards CE Specification 1.0, ++ * Appendix "Expansion Connector Signal Description". ++ * ++ * When the 96Board naming of a line and the schematic name of ++ * the same line are in conflict, the 96Board specification ++ * takes precedence, which means that the external UART on the ++ * LSEC is named UART0 while the schematic and SoC names this ++ * UART3. This is only for the informational lines i.e. "[FOO]", ++ * the GPIO named lines "GPIO-A" thru "GPIO-L" are the only ++ * ones actually used for GPIO. ++ */ + + / { + model = "Qualcomm Technologies, Inc. DB820c"; + compatible = "arrow,apq8096-db820c", "qcom,apq8096-sbc", "qcom,apq8096"; ++ ++ aliases { ++ serial0 = &blsp2_uart2; ++ serial1 = &blsp2_uart3; ++ serial2 = &blsp1_uart2; ++ i2c0 = &blsp1_i2c3; ++ i2c1 = &blsp2_i2c1; ++ i2c2 = &blsp2_i2c1; ++ spi0 = &blsp1_spi1; ++ spi1 = &blsp2_spi6; ++ }; ++ ++ chosen { ++ stdout-path = "serial0:115200n8"; ++ }; ++ ++ clocks { ++ compatible = "simple-bus"; ++ divclk4: divclk4 { ++ compatible = "fixed-clock"; ++ #clock-cells = <0>; ++ clock-frequency = <32768>; ++ clock-output-names = "divclk4"; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&divclk4_pin_a>; ++ }; ++ ++ div1_mclk: divclk1 { ++ compatible = "gpio-gate-clock"; ++ pinctrl-0 = <&audio_mclk>; ++ pinctrl-names = "default"; ++ clocks = <&rpmcc RPM_SMD_DIV_CLK1>; ++ #clock-cells = <0>; ++ enable-gpios = <&pm8994_gpios 15 0>; ++ }; ++ }; ++ ++ gpio_keys { ++ compatible = "gpio-keys"; ++ #address-cells = <1>; ++ #size-cells = <0>; ++ autorepeat; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&volume_up_gpio>; ++ ++ button@0 { ++ label = "Volume Up"; ++ linux,code = ; ++ gpios = <&pm8994_gpios 2 GPIO_ACTIVE_LOW>; ++ }; ++ }; ++ ++ usb2_id: usb2-id { ++ compatible = "linux,extcon-usb-gpio"; ++ id-gpio = <&pmi8994_gpios 6 GPIO_ACTIVE_HIGH>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&usb2_vbus_det_gpio>; ++ }; ++ ++ usb3_id: usb3-id { ++ compatible = "linux,extcon-usb-gpio"; ++ id-gpio = <&pm8994_gpios 22 GPIO_ACTIVE_HIGH>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&usb3_vbus_det_gpio>; ++ }; ++ ++ vph_pwr: vph-pwr-regulator { ++ compatible = "regulator-fixed"; ++ regulator-name = "vph_pwr"; ++ regulator-always-on; ++ regulator-boot-on; ++ ++ regulator-min-microvolt = <3700000>; ++ regulator-max-microvolt = <3700000>; ++ }; ++ ++ wlan_en: wlan-en-1-8v { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&wlan_en_gpios>; ++ compatible = "regulator-fixed"; ++ regulator-name = "wlan-en-regulator"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ ++ gpio = <&pm8994_gpios 8 0>; ++ ++ /* WLAN card specific delay */ ++ startup-delay-us = <70000>; ++ enable-active-high; ++ }; ++}; ++ ++&blsp1_i2c3 { ++ /* On Low speed expansion */ ++ label = "LS-I2C0"; ++ status = "okay"; ++}; ++ ++&blsp1_spi1 { ++ /* On Low speed expansion */ ++ label = "LS-SPI0"; ++ status = "okay"; ++}; ++ ++&blsp1_uart2 { ++ label = "BT-UART"; ++ status = "okay"; ++ ++ bluetooth { ++ compatible = "qcom,qca6174-bt"; ++ ++ /* bt_disable_n gpio */ ++ enable-gpios = <&pm8994_gpios 19 GPIO_ACTIVE_HIGH>; ++ ++ clocks = <&divclk4>; ++ }; ++}; ++ ++&adsp_pil { ++ status = "okay"; ++}; ++ ++&blsp2_i2c1 { ++ /* On High speed expansion */ ++ label = "HS-I2C2"; ++ status = "okay"; ++}; ++ ++&blsp2_i2c1 { ++ /* On Low speed expansion */ ++ label = "LS-I2C1"; ++ status = "okay"; ++}; ++ ++&blsp2_spi6 { ++ /* On High speed expansion */ ++ label = "HS-SPI1"; ++ status = "okay"; ++}; ++ ++&blsp2_uart2 { ++ label = "LS-UART1"; ++ status = "okay"; ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&blsp2_uart2_2pins_default>; ++ pinctrl-1 = <&blsp2_uart2_2pins_sleep>; ++}; ++ ++&blsp2_uart3 { ++ label = "LS-UART0"; ++ status = "disabled"; ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&blsp2_uart3_4pins_default>; ++ pinctrl-1 = <&blsp2_uart3_4pins_sleep>; ++}; ++ ++&camss { ++ vdda-supply = <&vreg_l2a_1p25>; ++}; ++ ++&gpu { ++ status = "okay"; ++}; ++ ++&hdmi { ++ status = "okay"; ++ ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&hdmi_hpd_active &hdmi_ddc_active>; ++ pinctrl-1 = <&hdmi_hpd_suspend &hdmi_ddc_suspend>; ++ ++ core-vdda-supply = <&vreg_l12a_1p8>; ++ core-vcc-supply = <&vreg_s4a_1p8>; ++}; ++ ++&hdmi_phy { ++ status = "okay"; ++ ++ vddio-supply = <&vreg_l12a_1p8>; ++ vcca-supply = <&vreg_l28a_0p925>; ++ #phy-cells = <0>; ++}; ++ ++&hsusb_phy1 { ++ status = "okay"; ++ ++ vdda-pll-supply = <&vreg_l12a_1p8>; ++ vdda-phy-dpdm-supply = <&vreg_l24a_3p075>; ++}; ++ ++&hsusb_phy2 { ++ status = "okay"; ++ ++ vdda-pll-supply = <&vreg_l12a_1p8>; ++ vdda-phy-dpdm-supply = <&vreg_l24a_3p075>; ++}; ++ ++&mdp { ++ status = "okay"; ++}; ++ ++&mdss { ++ status = "okay"; ++}; ++ ++&mmcc { ++ vdd-gfx-supply = <&vdd_gfx>; ++}; ++ ++&pm8994_resin { ++ status = "okay"; ++ linux,code = ; ++}; ++ ++&tlmm { ++ gpio-line-names = ++ "[SPI0_DOUT]", /* GPIO_0, BLSP1_SPI_MOSI, LSEC pin 14 */ ++ "[SPI0_DIN]", /* GPIO_1, BLSP1_SPI_MISO, LSEC pin 10 */ ++ "[SPI0_CS]", /* GPIO_2, BLSP1_SPI_CS_N, LSEC pin 12 */ ++ "[SPI0_SCLK]", /* GPIO_3, BLSP1_SPI_CLK, LSEC pin 8 */ ++ "[UART1_TxD]", /* GPIO_4, BLSP8_UART_TX, LSEC pin 11 */ ++ "[UART1_RxD]", /* GPIO_5, BLSP8_UART_RX, LSEC pin 13 */ ++ "[I2C1_SDA]", /* GPIO_6, BLSP8_I2C_SDA, LSEC pin 21 */ ++ "[I2C1_SCL]", /* GPIO_7, BLSP8_I2C_SCL, LSEC pin 19 */ ++ "GPIO-H", /* GPIO_8, LCD0_RESET_N, LSEC pin 30 */ ++ "TP93", /* GPIO_9 */ ++ "GPIO-G", /* GPIO_10, MDP_VSYNC_P, LSEC pin 29 */ ++ "[MDP_VSYNC_S]", /* GPIO_11, S HSEC pin 55 */ ++ "NC", /* GPIO_12 */ ++ "[CSI0_MCLK]", /* GPIO_13, CAM_MCLK0, P HSEC pin 15 */ ++ "[CAM_MCLK1]", /* GPIO_14, J14 pin 11 */ ++ "[CSI1_MCLK]", /* GPIO_15, CAM_MCLK2, P HSEC pin 17 */ ++ "TP99", /* GPIO_16 */ ++ "[I2C2_SDA]", /* GPIO_17, CCI_I2C_SDA0, P HSEC pin 34 */ ++ "[I2C2_SCL]", /* GPIO_18, CCI_I2C_SCL0, P HSEC pin 32 */ ++ "[CCI_I2C_SDA1]", /* GPIO_19, S HSEC pin 38 */ ++ "[CCI_I2C_SCL1]", /* GPIO_20, S HSEC pin 36 */ ++ "FLASH_STROBE_EN", /* GPIO_21, S HSEC pin 5 */ ++ "FLASH_STROBE_TRIG", /* GPIO_22, S HSEC pin 1 */ ++ "GPIO-K", /* GPIO_23, CAM2_RST_N, LSEC pin 33 */ ++ "GPIO-D", /* GPIO_24, LSEC pin 26 */ ++ "GPIO-I", /* GPIO_25, CAM0_RST_N, LSEC pin 31 */ ++ "GPIO-J", /* GPIO_26, CAM0_STANDBY_N, LSEC pin 32 */ ++ "BLSP6_I2C_SDA", /* GPIO_27 */ ++ "BLSP6_I2C_SCL", /* GPIO_28 */ ++ "GPIO-B", /* GPIO_29, TS0_RESET_N, LSEC pin 24 */ ++ "GPIO30", /* GPIO_30, S HSEC pin 4 */ ++ "HDMI_CEC", /* GPIO_31 */ ++ "HDMI_DDC_CLOCK", /* GPIO_32 */ ++ "HDMI_DDC_DATA", /* GPIO_33 */ ++ "HDMI_HOT_PLUG_DETECT", /* GPIO_34 */ ++ "PCIE0_RST_N", /* GPIO_35 */ ++ "PCIE0_CLKREQ_N", /* GPIO_36 */ ++ "PCIE0_WAKE", /* GPIO_37 */ ++ "SD_CARD_DET_N", /* GPIO_38 */ ++ "TSIF1_SYNC", /* GPIO_39, S HSEC pin 48 */ ++ "W_DISABLE_N", /* GPIO_40 */ ++ "[BLSP9_UART_TX]", /* GPIO_41 */ ++ "[BLSP9_UART_RX]", /* GPIO_42 */ ++ "[BLSP2_UART_CTS_N]", /* GPIO_43 */ ++ "[BLSP2_UART_RFR_N]", /* GPIO_44 */ ++ "[BLSP3_UART_TX]", /* GPIO_45 */ ++ "[BLSP3_UART_RX]", /* GPIO_46 */ ++ "[I2C0_SDA]", /* GPIO_47, LS_I2C0_SDA, LSEC pin 17 */ ++ "[I2C0_SCL]", /* GPIO_48, LS_I2C0_SCL, LSEC pin 15 */ ++ "[UART0_TxD]", /* GPIO_49, BLSP9_UART_TX, LSEC pin 5 */ ++ "[UART0_RxD]", /* GPIO_50, BLSP9_UART_RX, LSEC pin 7 */ ++ "[UART0_CTS]", /* GPIO_51, BLSP9_UART_CTS_N, LSEC pin 3 */ ++ "[UART0_RTS]", /* GPIO_52, BLSP9_UART_RFR_N, LSEC pin 9 */ ++ "[CODEC_INT1_N]", /* GPIO_53 */ ++ "[CODEC_INT2_N]", /* GPIO_54 */ ++ "[BLSP7_I2C_SDA]", /* GPIO_55 */ ++ "[BLSP7_I2C_SCL]", /* GPIO_56 */ ++ "MI2S_MCLK", /* GPIO_57, S HSEC pin 3 */ ++ "[PCM_CLK]", /* GPIO_58, QUA_MI2S_SCK, LSEC pin 18 */ ++ "[PCM_FS]", /* GPIO_59, QUA_MI2S_WS, LSEC pin 16 */ ++ "[PCM_DO]", /* GPIO_60, QUA_MI2S_DATA0, LSEC pin 20 */ ++ "[PCM_DI]", /* GPIO_61, QUA_MI2S_DATA1, LSEC pin 22 */ ++ "GPIO-E", /* GPIO_62, LSEC pin 27 */ ++ "TP87", /* GPIO_63 */ ++ "[CODEC_RST_N]", /* GPIO_64 */ ++ "[PCM1_CLK]", /* GPIO_65 */ ++ "[PCM1_SYNC]", /* GPIO_66 */ ++ "[PCM1_DIN]", /* GPIO_67 */ ++ "[PCM1_DOUT]", /* GPIO_68 */ ++ "AUDIO_REF_CLK", /* GPIO_69 */ ++ "SLIMBUS_CLK", /* GPIO_70 */ ++ "SLIMBUS_DATA0", /* GPIO_71 */ ++ "SLIMBUS_DATA1", /* GPIO_72 */ ++ "NC", /* GPIO_73 */ ++ "NC", /* GPIO_74 */ ++ "NC", /* GPIO_75 */ ++ "NC", /* GPIO_76 */ ++ "TP94", /* GPIO_77 */ ++ "NC", /* GPIO_78 */ ++ "TP95", /* GPIO_79 */ ++ "GPIO-A", /* GPIO_80, MEMS_RESET_N, LSEC pin 23 */ ++ "TP88", /* GPIO_81 */ ++ "TP89", /* GPIO_82 */ ++ "TP90", /* GPIO_83 */ ++ "TP91", /* GPIO_84 */ ++ "[SD_DAT0]", /* GPIO_85, BLSP12_SPI_MOSI, P HSEC pin 1 */ ++ "[SD_CMD]", /* GPIO_86, BLSP12_SPI_MISO, P HSEC pin 11 */ ++ "[SD_DAT3]", /* GPIO_87, BLSP12_SPI_CS_N, P HSEC pin 7 */ ++ "[SD_SCLK]", /* GPIO_88, BLSP12_SPI_CLK, P HSEC pin 9 */ ++ "TSIF1_CLK", /* GPIO_89, S HSEC pin 42 */ ++ "TSIF1_EN", /* GPIO_90, S HSEC pin 46 */ ++ "TSIF1_DATA", /* GPIO_91, S HSEC pin 44 */ ++ "NC", /* GPIO_92 */ ++ "TSIF2_CLK", /* GPIO_93, S HSEC pin 52 */ ++ "TSIF2_EN", /* GPIO_94, S HSEC pin 56 */ ++ "TSIF2_DATA", /* GPIO_95, S HSEC pin 54 */ ++ "TSIF2_SYNC", /* GPIO_96, S HSEC pin 58 */ ++ "NC", /* GPIO_97 */ ++ "CAM1_STANDBY_N", /* GPIO_98 */ ++ "NC", /* GPIO_99 */ ++ "NC", /* GPIO_100 */ ++ "[LCD1_RESET_N]", /* GPIO_101, S HSEC pin 51 */ ++ "BOOT_CONFIG1", /* GPIO_102 */ ++ "USB_HUB_RESET", /* GPIO_103 */ ++ "CAM1_RST_N", /* GPIO_104 */ ++ "NC", /* GPIO_105 */ ++ "NC", /* GPIO_106 */ ++ "NC", /* GPIO_107 */ ++ "NC", /* GPIO_108 */ ++ "NC", /* GPIO_109 */ ++ "NC", /* GPIO_110 */ ++ "NC", /* GPIO_111 */ ++ "NC", /* GPIO_112 */ ++ "PMI8994_BUA", /* GPIO_113 */ ++ "PCIE2_RST_N", /* GPIO_114 */ ++ "PCIE2_CLKREQ_N", /* GPIO_115 */ ++ "PCIE2_WAKE", /* GPIO_116 */ ++ "SSC_IRQ_0", /* GPIO_117 */ ++ "SSC_IRQ_1", /* GPIO_118 */ ++ "SSC_IRQ_2", /* GPIO_119 */ ++ "NC", /* GPIO_120 */ ++ "GPIO121", /* GPIO_121, S HSEC pin 2 */ ++ "NC", /* GPIO_122 */ ++ "SSC_IRQ_6", /* GPIO_123 */ ++ "SSC_IRQ_7", /* GPIO_124 */ ++ "GPIO-C", /* GPIO_125, TS_INT0, LSEC pin 25 */ ++ "BOOT_CONFIG5", /* GPIO_126 */ ++ "NC", /* GPIO_127 */ ++ "NC", /* GPIO_128 */ ++ "BOOT_CONFIG7", /* GPIO_129 */ ++ "PCIE1_RST_N", /* GPIO_130 */ ++ "PCIE1_CLKREQ_N", /* GPIO_131 */ ++ "PCIE1_WAKE", /* GPIO_132 */ ++ "GPIO-L", /* GPIO_133, CAM2_STANDBY_N, LSEC pin 34 */ ++ "NC", /* GPIO_134 */ ++ "NC", /* GPIO_135 */ ++ "BOOT_CONFIG8", /* GPIO_136 */ ++ "NC", /* GPIO_137 */ ++ "NC", /* GPIO_138 */ ++ "GPS_SSBI2", /* GPIO_139 */ ++ "GPS_SSBI1", /* GPIO_140 */ ++ "NC", /* GPIO_141 */ ++ "NC", /* GPIO_142 */ ++ "NC", /* GPIO_143 */ ++ "BOOT_CONFIG6", /* GPIO_144 */ ++ "NC", /* GPIO_145 */ ++ "NC", /* GPIO_146 */ ++ "NC", /* GPIO_147 */ ++ "NC", /* GPIO_148 */ ++ "NC"; /* GPIO_149 */ ++ ++ sdc2_cd_on: sdc2_cd_on { ++ mux { ++ pins = "gpio38"; ++ function = "gpio"; ++ }; ++ ++ config { ++ pins = "gpio38"; ++ bias-pull-up; /* pull up */ ++ drive-strength = <16>; /* 16 MA */ ++ }; ++ }; ++ ++ sdc2_cd_off: sdc2_cd_off { ++ mux { ++ pins = "gpio38"; ++ function = "gpio"; ++ }; ++ ++ config { ++ pins = "gpio38"; ++ bias-pull-up; /* pull up */ ++ drive-strength = <2>; /* 2 MA */ ++ }; ++ }; ++ ++ hdmi_hpd_active: hdmi_hpd_active { ++ mux { ++ pins = "gpio34"; ++ function = "hdmi_hot"; ++ }; ++ ++ config { ++ pins = "gpio34"; ++ bias-pull-down; ++ drive-strength = <16>; ++ }; ++ }; ++ ++ hdmi_hpd_suspend: hdmi_hpd_suspend { ++ mux { ++ pins = "gpio34"; ++ function = "hdmi_hot"; ++ }; ++ ++ config { ++ pins = "gpio34"; ++ bias-pull-down; ++ drive-strength = <2>; ++ }; ++ }; ++ ++ hdmi_ddc_active: hdmi_ddc_active { ++ mux { ++ pins = "gpio32", "gpio33"; ++ function = "hdmi_ddc"; ++ }; ++ ++ config { ++ pins = "gpio32", "gpio33"; ++ drive-strength = <2>; ++ bias-pull-up; ++ }; ++ }; ++ ++ hdmi_ddc_suspend: hdmi_ddc_suspend { ++ mux { ++ pins = "gpio32", "gpio33"; ++ function = "hdmi_ddc"; ++ }; ++ ++ config { ++ pins = "gpio32", "gpio33"; ++ drive-strength = <2>; ++ bias-pull-down; ++ }; ++ }; ++}; ++ ++&pcie0 { ++ status = "okay"; ++ perst-gpio = <&tlmm 35 GPIO_ACTIVE_LOW>; ++ vddpe-3v3-supply = <&wlan_en>; ++ vdda-supply = <&vreg_l28a_0p925>; ++}; ++ ++&pcie1 { ++ status = "okay"; ++ perst-gpio = <&tlmm 130 GPIO_ACTIVE_LOW>; ++ vdda-supply = <&vreg_l28a_0p925>; ++}; ++ ++&pcie2 { ++ status = "okay"; ++ perst-gpio = <&tlmm 114 GPIO_ACTIVE_LOW>; ++ vdda-supply = <&vreg_l28a_0p925>; ++}; ++ ++&pcie_phy { ++ status = "okay"; ++ ++ vdda-phy-supply = <&vreg_l28a_0p925>; ++ vdda-pll-supply = <&vreg_l12a_1p8>; ++}; ++ ++&pm8994_gpios { ++ gpio-line-names = ++ "NC", ++ "KEY_VOLP_N", ++ "NC", ++ "BL1_PWM", ++ "GPIO-F", /* BL0_PWM, LSEC pin 28 */ ++ "BL1_EN", ++ "NC", ++ "WLAN_EN", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "NC", ++ "DIVCLK1", ++ "DIVCLK2", ++ "DIVCLK3", ++ "DIVCLK4", ++ "BT_EN", ++ "PMIC_SLB", ++ "PMIC_BUA", ++ "USB_VBUS_DET"; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&ls_exp_gpio_f &bt_en_gpios>; ++ ++ ls_exp_gpio_f: pm8994_gpio5 { ++ pinconf { ++ pins = "gpio5"; ++ output-low; ++ power-source = <2>; // PM8994_GPIO_S4, 1.8V ++ }; ++ }; ++ ++ bt_en_gpios: bt_en_gpios { ++ pinconf { ++ pins = "gpio19"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ output-low; ++ power-source = ; // 1.8V ++ qcom,drive-strength = ; ++ bias-pull-down; ++ }; ++ }; ++ ++ wlan_en_gpios: wlan_en_gpios { ++ pinconf { ++ pins = "gpio8"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ output-low; ++ power-source = ; // 1.8V ++ qcom,drive-strength = ; ++ bias-pull-down; ++ }; ++ }; ++ ++ audio_mclk: clk_div1 { ++ pinconf { ++ pins = "gpio15"; ++ function = "func1"; ++ power-source = ; // 1.8V ++ }; ++ }; ++ ++ volume_up_gpio: pm8996_gpio2 { ++ pinconf { ++ pins = "gpio2"; ++ function = "normal"; ++ input-enable; ++ drive-push-pull; ++ bias-pull-up; ++ qcom,drive-strength = ; ++ power-source = ; // 1.8V ++ }; ++ }; ++ ++ divclk4_pin_a: divclk4 { ++ pinconf { ++ pins = "gpio18"; ++ function = PMIC_GPIO_FUNC_FUNC2; ++ ++ bias-disable; ++ power-source = ; ++ }; ++ }; ++ ++ usb3_vbus_det_gpio: pm8996_gpio22 { ++ pinconf { ++ pins = "gpio22"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ input-enable; ++ bias-pull-down; ++ qcom,drive-strength = ; ++ power-source = ; // 1.8V ++ }; ++ }; ++}; ++ ++&pm8994_mpps { ++ gpio-line-names = ++ "VDDPX_BIAS", ++ "WIFI_LED", ++ "NC", ++ "BT_LED", ++ "PM_MPP05", ++ "PM_MPP06", ++ "PM_MPP07", ++ "NC"; ++}; ++ ++&pm8994_spmi_regulators { ++ qcom,saw-reg = <&saw3>; ++ s9 { ++ qcom,saw-slave; ++ }; ++ s10 { ++ qcom,saw-slave; ++ }; ++ s11 { ++ qcom,saw-leader; ++ regulator-always-on; ++ regulator-min-microvolt = <980000>; ++ regulator-max-microvolt = <980000>; ++ }; ++}; ++ ++&pmi8994_gpios { ++ gpio-line-names = ++ "NC", ++ "SPKR_AMP_EN1", ++ "SPKR_AMP_EN2", ++ "TP61", ++ "NC", ++ "USB2_VBUS_DET", ++ "NC", ++ "NC", ++ "NC", ++ "NC"; ++ ++ usb2_vbus_det_gpio: pmi8996_gpio6 { ++ pinconf { ++ pins = "gpio6"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ input-enable; ++ bias-pull-down; ++ qcom,drive-strength = ; ++ power-source = ; // 1.8V ++ }; ++ }; ++}; ++ ++&pmi8994_spmi_regulators { ++ vdd_gfx: s2@1700 { ++ reg = <0x1700 0x100>; ++ regulator-name = "VDD_GFX"; ++ regulator-min-microvolt = <980000>; ++ regulator-max-microvolt = <980000>; ++ }; ++}; ++ ++&rpm_requests { ++ pm8994-regulators { ++ compatible = "qcom,rpm-pm8994-regulators"; ++ ++ vdd_s1-supply = <&vph_pwr>; ++ vdd_s2-supply = <&vph_pwr>; ++ vdd_s3-supply = <&vph_pwr>; ++ vdd_s4-supply = <&vph_pwr>; ++ vdd_s5-supply = <&vph_pwr>; ++ vdd_s6-supply = <&vph_pwr>; ++ vdd_s7-supply = <&vph_pwr>; ++ vdd_s8-supply = <&vph_pwr>; ++ vdd_s9-supply = <&vph_pwr>; ++ vdd_s10-supply = <&vph_pwr>; ++ vdd_s11-supply = <&vph_pwr>; ++ vdd_s12-supply = <&vph_pwr>; ++ vdd_l1-supply = <&vreg_s1b_1p025>; ++ vdd_l2_l26_l28-supply = <&vreg_s3a_1p3>; ++ vdd_l3_l11-supply = <&vreg_s3a_1p3>; ++ vdd_l4_l27_l31-supply = <&vreg_s3a_1p3>; ++ vdd_l5_l7-supply = <&vreg_s5a_2p15>; ++ vdd_l6_l12_l32-supply = <&vreg_s5a_2p15>; ++ vdd_l8_l16_l30-supply = <&vph_pwr>; ++ vdd_l9_l10_l18_l22-supply = <&vph_pwr_bbyp>; ++ vdd_l13_l19_l23_l24-supply = <&vph_pwr_bbyp>; ++ vdd_l14_l15-supply = <&vreg_s5a_2p15>; ++ vdd_l17_l29-supply = <&vph_pwr_bbyp>; ++ vdd_l20_l21-supply = <&vph_pwr_bbyp>; ++ vdd_l25-supply = <&vreg_s3a_1p3>; ++ vdd_lvs1_lvs2-supply = <&vreg_s4a_1p8>; ++ ++ vreg_s3a_1p3: s3 { ++ regulator-name = "vreg_s3a_1p3"; ++ regulator-min-microvolt = <1300000>; ++ regulator-max-microvolt = <1300000>; ++ }; ++ ++ /** ++ * 1.8v required on LS expansion ++ * for mezzanine boards ++ */ ++ vreg_s4a_1p8: s4 { ++ regulator-name = "vreg_s4a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ regulator-always-on; ++ }; ++ vreg_s5a_2p15: s5 { ++ regulator-name = "vreg_s5a_2p15"; ++ regulator-min-microvolt = <2150000>; ++ regulator-max-microvolt = <2150000>; ++ }; ++ vreg_s7a_1p0: s7 { ++ regulator-name = "vreg_s7a_1p0"; ++ regulator-min-microvolt = <800000>; ++ regulator-max-microvolt = <800000>; ++ }; ++ ++ vreg_l1a_1p0: l1 { ++ regulator-name = "vreg_l1a_1p0"; ++ regulator-min-microvolt = <1000000>; ++ regulator-max-microvolt = <1000000>; ++ }; ++ vreg_l2a_1p25: l2 { ++ regulator-name = "vreg_l2a_1p25"; ++ regulator-min-microvolt = <1250000>; ++ regulator-max-microvolt = <1250000>; ++ }; ++ vreg_l3a_0p875: l3 { ++ regulator-name = "vreg_l3a_0p875"; ++ regulator-min-microvolt = <850000>; ++ regulator-max-microvolt = <850000>; ++ }; ++ vreg_l4a_1p225: l4 { ++ regulator-name = "vreg_l4a_1p225"; ++ regulator-min-microvolt = <1225000>; ++ regulator-max-microvolt = <1225000>; ++ }; ++ vreg_l6a_1p2: l6 { ++ regulator-name = "vreg_l6a_1p2"; ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <1200000>; ++ }; ++ vreg_l8a_1p8: l8 { ++ regulator-name = "vreg_l8a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l9a_1p8: l9 { ++ regulator-name = "vreg_l9a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l10a_1p8: l10 { ++ regulator-name = "vreg_l10a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l11a_1p15: l11 { ++ regulator-name = "vreg_l11a_1p15"; ++ regulator-min-microvolt = <1150000>; ++ regulator-max-microvolt = <1150000>; ++ }; ++ vreg_l12a_1p8: l12 { ++ regulator-name = "vreg_l12a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l13a_2p95: l13 { ++ regulator-name = "vreg_l13a_2p95"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <2950000>; ++ }; ++ vreg_l14a_1p8: l14 { ++ regulator-name = "vreg_l14a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l15a_1p8: l15 { ++ regulator-name = "vreg_l15a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l16a_2p7: l16 { ++ regulator-name = "vreg_l16a_2p7"; ++ regulator-min-microvolt = <2700000>; ++ regulator-max-microvolt = <2700000>; ++ }; ++ vreg_l17a_2p8: l17 { ++ regulator-name = "vreg_l17a_2p8"; ++ regulator-min-microvolt = <2500000>; ++ regulator-max-microvolt = <2500000>; ++ }; ++ vreg_l18a_2p85: l18 { ++ regulator-name = "vreg_l18a_2p85"; ++ regulator-min-microvolt = <2700000>; ++ regulator-max-microvolt = <2900000>; ++ }; ++ vreg_l19a_2p8: l19 { ++ regulator-name = "vreg_l19a_2p8"; ++ regulator-min-microvolt = <3000000>; ++ regulator-max-microvolt = <3000000>; ++ }; ++ vreg_l20a_2p95: l20 { ++ regulator-name = "vreg_l20a_2p95"; ++ regulator-min-microvolt = <2950000>; ++ regulator-max-microvolt = <2950000>; ++ regulator-allow-set-load; ++ }; ++ vreg_l21a_2p95: l21 { ++ regulator-name = "vreg_l21a_2p95"; ++ regulator-min-microvolt = <2950000>; ++ regulator-max-microvolt = <2950000>; ++ regulator-allow-set-load; ++ regulator-system-load = <200000>; ++ }; ++ vreg_l22a_3p0: l22 { ++ regulator-name = "vreg_l22a_3p0"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ }; ++ vreg_l23a_2p8: l23 { ++ regulator-name = "vreg_l23a_2p8"; ++ regulator-min-microvolt = <2800000>; ++ regulator-max-microvolt = <2800000>; ++ }; ++ vreg_l24a_3p075: l24 { ++ regulator-name = "vreg_l24a_3p075"; ++ regulator-min-microvolt = <3075000>; ++ regulator-max-microvolt = <3075000>; ++ }; ++ vreg_l25a_1p2: l25 { ++ regulator-name = "vreg_l25a_1p2"; ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <1200000>; ++ regulator-allow-set-load; ++ }; ++ vreg_l26a_0p8: l27 { ++ regulator-name = "vreg_l26a_0p8"; ++ regulator-min-microvolt = <1000000>; ++ regulator-max-microvolt = <1000000>; ++ }; ++ vreg_l28a_0p925: l28 { ++ regulator-name = "vreg_l28a_0p925"; ++ regulator-min-microvolt = <925000>; ++ regulator-max-microvolt = <925000>; ++ regulator-allow-set-load; ++ }; ++ vreg_l29a_2p8: l29 { ++ regulator-name = "vreg_l29a_2p8"; ++ regulator-min-microvolt = <2800000>; ++ regulator-max-microvolt = <2800000>; ++ }; ++ vreg_l30a_1p8: l30 { ++ regulator-name = "vreg_l30a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l32a_1p8: l32 { ++ regulator-name = "vreg_l32a_1p8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ ++ vreg_lvs1a_1p8: lvs1 { ++ regulator-name = "vreg_lvs1a_1p8"; ++ }; ++ ++ vreg_lvs2a_1p8: lvs2 { ++ regulator-name = "vreg_lvs2a_1p8"; ++ }; ++ }; ++ ++ pmi8994-regulators { ++ compatible = "qcom,rpm-pmi8994-regulators"; ++ ++ vdd_s1-supply = <&vph_pwr>; ++ vdd_s2-supply = <&vph_pwr>; ++ vdd_s3-supply = <&vph_pwr>; ++ vdd_bst_byp-supply = <&vph_pwr>; ++ ++ vph_pwr_bbyp: boost-bypass { ++ regulator-name = "vph_pwr_bbyp"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ }; ++ ++ vreg_s1b_1p025: s1 { ++ regulator-name = "vreg_s1b_1p025"; ++ regulator-min-microvolt = <1025000>; ++ regulator-max-microvolt = <1025000>; ++ }; ++ }; ++}; ++ ++&sdhc2 { ++ /* External SD card */ ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&sdc2_state_on &sdc2_cd_on>; ++ pinctrl-1 = <&sdc2_state_off &sdc2_cd_off>; ++ cd-gpios = <&tlmm 38 GPIO_ACTIVE_LOW>; ++ vmmc-supply = <&vreg_l21a_2p95>; ++ vqmmc-supply = <&vreg_l13a_2p95>; ++ status = "okay"; ++}; ++ ++&q6asmdai { ++ dai@0 { ++ reg = <0>; ++ }; ++ ++ dai@1 { ++ reg = <1>; ++ }; ++ ++ dai@2 { ++ reg = <2>; ++ }; ++}; ++ ++&sound { ++ compatible = "qcom,apq8096-sndcard"; ++ model = "DB820c"; ++ audio-routing = "RX_BIAS", "MCLK", ++ "MM_DL1", "MultiMedia1 Playback", ++ "MM_DL2", "MultiMedia2 Playback", ++ "MultiMedia3 Capture", "MM_UL3"; ++ ++ mm1-dai-link { ++ link-name = "MultiMedia1"; ++ cpu { ++ sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA1>; ++ }; ++ }; ++ ++ mm2-dai-link { ++ link-name = "MultiMedia2"; ++ cpu { ++ sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA2>; ++ }; ++ }; ++ ++ mm3-dai-link { ++ link-name = "MultiMedia3"; ++ cpu { ++ sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA3>; ++ }; ++ }; ++ ++ hdmi-dai-link { ++ link-name = "HDMI"; ++ cpu { ++ sound-dai = <&q6afedai HDMI_RX>; ++ }; ++ ++ platform { ++ sound-dai = <&q6routing>; ++ }; ++ ++ codec { ++ sound-dai = <&hdmi 0>; ++ }; ++ }; ++ ++ slim-dai-link { ++ link-name = "SLIM Playback"; ++ cpu { ++ sound-dai = <&q6afedai SLIMBUS_6_RX>; ++ }; ++ ++ platform { ++ sound-dai = <&q6routing>; ++ }; ++ ++ codec { ++ sound-dai = <&wcd9335 6>; ++ }; ++ }; ++ ++ slimcap-dai-link { ++ link-name = "SLIM Capture"; ++ cpu { ++ sound-dai = <&q6afedai SLIMBUS_0_TX>; ++ }; ++ ++ platform { ++ sound-dai = <&q6routing>; ++ }; ++ ++ codec { ++ sound-dai = <&wcd9335 1>; ++ }; ++ }; ++}; ++ ++&ufsphy { ++ status = "okay"; ++ ++ vdda-phy-supply = <&vreg_l28a_0p925>; ++ vdda-pll-supply = <&vreg_l12a_1p8>; ++ vddp-ref-clk-supply = <&vreg_l25a_1p2>; ++}; ++ ++&ufshc { ++ status = "okay"; ++ ++ vcc-supply = <&vreg_l20a_2p95>; ++ vccq-supply = <&vreg_l25a_1p2>; ++ vccq2-supply = <&vreg_s4a_1p8>; ++ ++ vcc-max-microamp = <600000>; ++ vccq-max-microamp = <450000>; ++ vccq2-max-microamp = <450000>; ++}; ++ ++&usb2 { ++ status = "okay"; ++ extcon = <&usb2_id>; ++ ++ dwc3@7600000 { ++ extcon = <&usb2_id>; ++ dr_mode = "otg"; ++ maximum-speed = "high-speed"; ++ }; ++}; ++ ++&usb3 { ++ status = "okay"; ++ extcon = <&usb3_id>; ++ ++ dwc3@6a00000 { ++ extcon = <&usb3_id>; ++ dr_mode = "otg"; ++ }; ++}; ++ ++&usb3phy { ++ status = "okay"; ++ ++ vdda-phy-supply = <&vreg_l28a_0p925>; ++ vdda-pll-supply = <&vreg_l12a_1p8>; ++ ++}; ++ ++&venus { ++ status = "okay"; ++}; ++ ++&wcd9335 { ++ clock-names = "mclk", "slimbus"; ++ clocks = <&div1_mclk>, ++ <&rpmcc RPM_SMD_BB_CLK1>; ++ ++ vdd-buck-supply = <&vreg_s4a_1p8>; ++ vdd-buck-sido-supply = <&vreg_s4a_1p8>; ++ vdd-tx-supply = <&vreg_s4a_1p8>; ++ vdd-rx-supply = <&vreg_s4a_1p8>; ++ vdd-io-supply = <&vreg_s4a_1p8>; + }; +diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi +deleted file mode 100644 +index eca428ab2517a..0000000000000 +--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi ++++ /dev/null +@@ -1,1076 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/* +- * Copyright (c) 2014-2016, The Linux Foundation. All rights reserved. +- */ +- +-#include "msm8996.dtsi" +-#include "pm8994.dtsi" +-#include "pmi8994.dtsi" +-#include +-#include +-#include +-#include +-#include +- +-/* +- * GPIO name legend: proper name = the GPIO line is used as GPIO +- * NC = not connected (pin out but not routed from the chip to +- * anything the board) +- * "[PER]" = pin is muxed for [peripheral] (not GPIO) +- * LSEC = Low Speed External Connector +- * P HSEC = Primary High Speed External Connector +- * S HSEC = Secondary High Speed External Connector +- * J14 = Camera Connector +- * TP = Test Points +- * +- * Line names are taken from the schematic "DragonBoard 820c", +- * drawing no: LM25-P2751-1 +- * +- * For the lines routed to the external connectors the +- * lines are named after the 96Boards CE Specification 1.0, +- * Appendix "Expansion Connector Signal Description". +- * +- * When the 96Board naming of a line and the schematic name of +- * the same line are in conflict, the 96Board specification +- * takes precedence, which means that the external UART on the +- * LSEC is named UART0 while the schematic and SoC names this +- * UART3. This is only for the informational lines i.e. "[FOO]", +- * the GPIO named lines "GPIO-A" thru "GPIO-L" are the only +- * ones actually used for GPIO. +- */ +- +-/ { +- aliases { +- serial0 = &blsp2_uart2; +- serial1 = &blsp2_uart3; +- serial2 = &blsp1_uart2; +- i2c0 = &blsp1_i2c3; +- i2c1 = &blsp2_i2c1; +- i2c2 = &blsp2_i2c1; +- spi0 = &blsp1_spi1; +- spi1 = &blsp2_spi6; +- }; +- +- chosen { +- stdout-path = "serial0:115200n8"; +- }; +- +- clocks { +- compatible = "simple-bus"; +- divclk4: divclk4 { +- compatible = "fixed-clock"; +- #clock-cells = <0>; +- clock-frequency = <32768>; +- clock-output-names = "divclk4"; +- +- pinctrl-names = "default"; +- pinctrl-0 = <&divclk4_pin_a>; +- }; +- +- div1_mclk: divclk1 { +- compatible = "gpio-gate-clock"; +- pinctrl-0 = <&audio_mclk>; +- pinctrl-names = "default"; +- clocks = <&rpmcc RPM_SMD_DIV_CLK1>; +- #clock-cells = <0>; +- enable-gpios = <&pm8994_gpios 15 0>; +- }; +- }; +- +- gpio_keys { +- compatible = "gpio-keys"; +- #address-cells = <1>; +- #size-cells = <0>; +- autorepeat; +- +- pinctrl-names = "default"; +- pinctrl-0 = <&volume_up_gpio>; +- +- button@0 { +- label = "Volume Up"; +- linux,code = ; +- gpios = <&pm8994_gpios 2 GPIO_ACTIVE_LOW>; +- }; +- }; +- +- usb2_id: usb2-id { +- compatible = "linux,extcon-usb-gpio"; +- id-gpio = <&pmi8994_gpios 6 GPIO_ACTIVE_HIGH>; +- pinctrl-names = "default"; +- pinctrl-0 = <&usb2_vbus_det_gpio>; +- }; +- +- usb3_id: usb3-id { +- compatible = "linux,extcon-usb-gpio"; +- id-gpio = <&pm8994_gpios 22 GPIO_ACTIVE_HIGH>; +- pinctrl-names = "default"; +- pinctrl-0 = <&usb3_vbus_det_gpio>; +- }; +- +- vph_pwr: vph-pwr-regulator { +- compatible = "regulator-fixed"; +- regulator-name = "vph_pwr"; +- regulator-always-on; +- regulator-boot-on; +- +- regulator-min-microvolt = <3700000>; +- regulator-max-microvolt = <3700000>; +- }; +- +- wlan_en: wlan-en-1-8v { +- pinctrl-names = "default"; +- pinctrl-0 = <&wlan_en_gpios>; +- compatible = "regulator-fixed"; +- regulator-name = "wlan-en-regulator"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- +- gpio = <&pm8994_gpios 8 0>; +- +- /* WLAN card specific delay */ +- startup-delay-us = <70000>; +- enable-active-high; +- }; +-}; +- +-&blsp1_i2c3 { +- /* On Low speed expansion */ +- label = "LS-I2C0"; +- status = "okay"; +-}; +- +-&blsp1_spi1 { +- /* On Low speed expansion */ +- label = "LS-SPI0"; +- status = "okay"; +-}; +- +-&blsp1_uart2 { +- label = "BT-UART"; +- status = "okay"; +- +- bluetooth { +- compatible = "qcom,qca6174-bt"; +- +- /* bt_disable_n gpio */ +- enable-gpios = <&pm8994_gpios 19 GPIO_ACTIVE_HIGH>; +- +- clocks = <&divclk4>; +- }; +-}; +- +-&adsp_pil { +- status = "okay"; +-}; +- +-&blsp2_i2c1 { +- /* On High speed expansion */ +- label = "HS-I2C2"; +- status = "okay"; +-}; +- +-&blsp2_i2c1 { +- /* On Low speed expansion */ +- label = "LS-I2C1"; +- status = "okay"; +-}; +- +-&blsp2_spi6 { +- /* On High speed expansion */ +- label = "HS-SPI1"; +- status = "okay"; +-}; +- +-&blsp2_uart2 { +- label = "LS-UART1"; +- status = "okay"; +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&blsp2_uart2_2pins_default>; +- pinctrl-1 = <&blsp2_uart2_2pins_sleep>; +-}; +- +-&blsp2_uart3 { +- label = "LS-UART0"; +- status = "disabled"; +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&blsp2_uart3_4pins_default>; +- pinctrl-1 = <&blsp2_uart3_4pins_sleep>; +-}; +- +-&camss { +- vdda-supply = <&vreg_l2a_1p25>; +-}; +- +-&gpu { +- status = "okay"; +-}; +- +-&hdmi { +- status = "okay"; +- +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&hdmi_hpd_active &hdmi_ddc_active>; +- pinctrl-1 = <&hdmi_hpd_suspend &hdmi_ddc_suspend>; +- +- core-vdda-supply = <&vreg_l12a_1p8>; +- core-vcc-supply = <&vreg_s4a_1p8>; +-}; +- +-&hdmi_phy { +- status = "okay"; +- +- vddio-supply = <&vreg_l12a_1p8>; +- vcca-supply = <&vreg_l28a_0p925>; +- #phy-cells = <0>; +-}; +- +-&hsusb_phy1 { +- status = "okay"; +- +- vdda-pll-supply = <&vreg_l12a_1p8>; +- vdda-phy-dpdm-supply = <&vreg_l24a_3p075>; +-}; +- +-&hsusb_phy2 { +- status = "okay"; +- +- vdda-pll-supply = <&vreg_l12a_1p8>; +- vdda-phy-dpdm-supply = <&vreg_l24a_3p075>; +-}; +- +-&mdp { +- status = "okay"; +-}; +- +-&mdss { +- status = "okay"; +-}; +- +-&mmcc { +- vdd-gfx-supply = <&vdd_gfx>; +-}; +- +-&pm8994_resin { +- status = "okay"; +- linux,code = ; +-}; +- +-&tlmm { +- gpio-line-names = +- "[SPI0_DOUT]", /* GPIO_0, BLSP1_SPI_MOSI, LSEC pin 14 */ +- "[SPI0_DIN]", /* GPIO_1, BLSP1_SPI_MISO, LSEC pin 10 */ +- "[SPI0_CS]", /* GPIO_2, BLSP1_SPI_CS_N, LSEC pin 12 */ +- "[SPI0_SCLK]", /* GPIO_3, BLSP1_SPI_CLK, LSEC pin 8 */ +- "[UART1_TxD]", /* GPIO_4, BLSP8_UART_TX, LSEC pin 11 */ +- "[UART1_RxD]", /* GPIO_5, BLSP8_UART_RX, LSEC pin 13 */ +- "[I2C1_SDA]", /* GPIO_6, BLSP8_I2C_SDA, LSEC pin 21 */ +- "[I2C1_SCL]", /* GPIO_7, BLSP8_I2C_SCL, LSEC pin 19 */ +- "GPIO-H", /* GPIO_8, LCD0_RESET_N, LSEC pin 30 */ +- "TP93", /* GPIO_9 */ +- "GPIO-G", /* GPIO_10, MDP_VSYNC_P, LSEC pin 29 */ +- "[MDP_VSYNC_S]", /* GPIO_11, S HSEC pin 55 */ +- "NC", /* GPIO_12 */ +- "[CSI0_MCLK]", /* GPIO_13, CAM_MCLK0, P HSEC pin 15 */ +- "[CAM_MCLK1]", /* GPIO_14, J14 pin 11 */ +- "[CSI1_MCLK]", /* GPIO_15, CAM_MCLK2, P HSEC pin 17 */ +- "TP99", /* GPIO_16 */ +- "[I2C2_SDA]", /* GPIO_17, CCI_I2C_SDA0, P HSEC pin 34 */ +- "[I2C2_SCL]", /* GPIO_18, CCI_I2C_SCL0, P HSEC pin 32 */ +- "[CCI_I2C_SDA1]", /* GPIO_19, S HSEC pin 38 */ +- "[CCI_I2C_SCL1]", /* GPIO_20, S HSEC pin 36 */ +- "FLASH_STROBE_EN", /* GPIO_21, S HSEC pin 5 */ +- "FLASH_STROBE_TRIG", /* GPIO_22, S HSEC pin 1 */ +- "GPIO-K", /* GPIO_23, CAM2_RST_N, LSEC pin 33 */ +- "GPIO-D", /* GPIO_24, LSEC pin 26 */ +- "GPIO-I", /* GPIO_25, CAM0_RST_N, LSEC pin 31 */ +- "GPIO-J", /* GPIO_26, CAM0_STANDBY_N, LSEC pin 32 */ +- "BLSP6_I2C_SDA", /* GPIO_27 */ +- "BLSP6_I2C_SCL", /* GPIO_28 */ +- "GPIO-B", /* GPIO_29, TS0_RESET_N, LSEC pin 24 */ +- "GPIO30", /* GPIO_30, S HSEC pin 4 */ +- "HDMI_CEC", /* GPIO_31 */ +- "HDMI_DDC_CLOCK", /* GPIO_32 */ +- "HDMI_DDC_DATA", /* GPIO_33 */ +- "HDMI_HOT_PLUG_DETECT", /* GPIO_34 */ +- "PCIE0_RST_N", /* GPIO_35 */ +- "PCIE0_CLKREQ_N", /* GPIO_36 */ +- "PCIE0_WAKE", /* GPIO_37 */ +- "SD_CARD_DET_N", /* GPIO_38 */ +- "TSIF1_SYNC", /* GPIO_39, S HSEC pin 48 */ +- "W_DISABLE_N", /* GPIO_40 */ +- "[BLSP9_UART_TX]", /* GPIO_41 */ +- "[BLSP9_UART_RX]", /* GPIO_42 */ +- "[BLSP2_UART_CTS_N]", /* GPIO_43 */ +- "[BLSP2_UART_RFR_N]", /* GPIO_44 */ +- "[BLSP3_UART_TX]", /* GPIO_45 */ +- "[BLSP3_UART_RX]", /* GPIO_46 */ +- "[I2C0_SDA]", /* GPIO_47, LS_I2C0_SDA, LSEC pin 17 */ +- "[I2C0_SCL]", /* GPIO_48, LS_I2C0_SCL, LSEC pin 15 */ +- "[UART0_TxD]", /* GPIO_49, BLSP9_UART_TX, LSEC pin 5 */ +- "[UART0_RxD]", /* GPIO_50, BLSP9_UART_RX, LSEC pin 7 */ +- "[UART0_CTS]", /* GPIO_51, BLSP9_UART_CTS_N, LSEC pin 3 */ +- "[UART0_RTS]", /* GPIO_52, BLSP9_UART_RFR_N, LSEC pin 9 */ +- "[CODEC_INT1_N]", /* GPIO_53 */ +- "[CODEC_INT2_N]", /* GPIO_54 */ +- "[BLSP7_I2C_SDA]", /* GPIO_55 */ +- "[BLSP7_I2C_SCL]", /* GPIO_56 */ +- "MI2S_MCLK", /* GPIO_57, S HSEC pin 3 */ +- "[PCM_CLK]", /* GPIO_58, QUA_MI2S_SCK, LSEC pin 18 */ +- "[PCM_FS]", /* GPIO_59, QUA_MI2S_WS, LSEC pin 16 */ +- "[PCM_DO]", /* GPIO_60, QUA_MI2S_DATA0, LSEC pin 20 */ +- "[PCM_DI]", /* GPIO_61, QUA_MI2S_DATA1, LSEC pin 22 */ +- "GPIO-E", /* GPIO_62, LSEC pin 27 */ +- "TP87", /* GPIO_63 */ +- "[CODEC_RST_N]", /* GPIO_64 */ +- "[PCM1_CLK]", /* GPIO_65 */ +- "[PCM1_SYNC]", /* GPIO_66 */ +- "[PCM1_DIN]", /* GPIO_67 */ +- "[PCM1_DOUT]", /* GPIO_68 */ +- "AUDIO_REF_CLK", /* GPIO_69 */ +- "SLIMBUS_CLK", /* GPIO_70 */ +- "SLIMBUS_DATA0", /* GPIO_71 */ +- "SLIMBUS_DATA1", /* GPIO_72 */ +- "NC", /* GPIO_73 */ +- "NC", /* GPIO_74 */ +- "NC", /* GPIO_75 */ +- "NC", /* GPIO_76 */ +- "TP94", /* GPIO_77 */ +- "NC", /* GPIO_78 */ +- "TP95", /* GPIO_79 */ +- "GPIO-A", /* GPIO_80, MEMS_RESET_N, LSEC pin 23 */ +- "TP88", /* GPIO_81 */ +- "TP89", /* GPIO_82 */ +- "TP90", /* GPIO_83 */ +- "TP91", /* GPIO_84 */ +- "[SD_DAT0]", /* GPIO_85, BLSP12_SPI_MOSI, P HSEC pin 1 */ +- "[SD_CMD]", /* GPIO_86, BLSP12_SPI_MISO, P HSEC pin 11 */ +- "[SD_DAT3]", /* GPIO_87, BLSP12_SPI_CS_N, P HSEC pin 7 */ +- "[SD_SCLK]", /* GPIO_88, BLSP12_SPI_CLK, P HSEC pin 9 */ +- "TSIF1_CLK", /* GPIO_89, S HSEC pin 42 */ +- "TSIF1_EN", /* GPIO_90, S HSEC pin 46 */ +- "TSIF1_DATA", /* GPIO_91, S HSEC pin 44 */ +- "NC", /* GPIO_92 */ +- "TSIF2_CLK", /* GPIO_93, S HSEC pin 52 */ +- "TSIF2_EN", /* GPIO_94, S HSEC pin 56 */ +- "TSIF2_DATA", /* GPIO_95, S HSEC pin 54 */ +- "TSIF2_SYNC", /* GPIO_96, S HSEC pin 58 */ +- "NC", /* GPIO_97 */ +- "CAM1_STANDBY_N", /* GPIO_98 */ +- "NC", /* GPIO_99 */ +- "NC", /* GPIO_100 */ +- "[LCD1_RESET_N]", /* GPIO_101, S HSEC pin 51 */ +- "BOOT_CONFIG1", /* GPIO_102 */ +- "USB_HUB_RESET", /* GPIO_103 */ +- "CAM1_RST_N", /* GPIO_104 */ +- "NC", /* GPIO_105 */ +- "NC", /* GPIO_106 */ +- "NC", /* GPIO_107 */ +- "NC", /* GPIO_108 */ +- "NC", /* GPIO_109 */ +- "NC", /* GPIO_110 */ +- "NC", /* GPIO_111 */ +- "NC", /* GPIO_112 */ +- "PMI8994_BUA", /* GPIO_113 */ +- "PCIE2_RST_N", /* GPIO_114 */ +- "PCIE2_CLKREQ_N", /* GPIO_115 */ +- "PCIE2_WAKE", /* GPIO_116 */ +- "SSC_IRQ_0", /* GPIO_117 */ +- "SSC_IRQ_1", /* GPIO_118 */ +- "SSC_IRQ_2", /* GPIO_119 */ +- "NC", /* GPIO_120 */ +- "GPIO121", /* GPIO_121, S HSEC pin 2 */ +- "NC", /* GPIO_122 */ +- "SSC_IRQ_6", /* GPIO_123 */ +- "SSC_IRQ_7", /* GPIO_124 */ +- "GPIO-C", /* GPIO_125, TS_INT0, LSEC pin 25 */ +- "BOOT_CONFIG5", /* GPIO_126 */ +- "NC", /* GPIO_127 */ +- "NC", /* GPIO_128 */ +- "BOOT_CONFIG7", /* GPIO_129 */ +- "PCIE1_RST_N", /* GPIO_130 */ +- "PCIE1_CLKREQ_N", /* GPIO_131 */ +- "PCIE1_WAKE", /* GPIO_132 */ +- "GPIO-L", /* GPIO_133, CAM2_STANDBY_N, LSEC pin 34 */ +- "NC", /* GPIO_134 */ +- "NC", /* GPIO_135 */ +- "BOOT_CONFIG8", /* GPIO_136 */ +- "NC", /* GPIO_137 */ +- "NC", /* GPIO_138 */ +- "GPS_SSBI2", /* GPIO_139 */ +- "GPS_SSBI1", /* GPIO_140 */ +- "NC", /* GPIO_141 */ +- "NC", /* GPIO_142 */ +- "NC", /* GPIO_143 */ +- "BOOT_CONFIG6", /* GPIO_144 */ +- "NC", /* GPIO_145 */ +- "NC", /* GPIO_146 */ +- "NC", /* GPIO_147 */ +- "NC", /* GPIO_148 */ +- "NC"; /* GPIO_149 */ +- +- sdc2_cd_on: sdc2_cd_on { +- mux { +- pins = "gpio38"; +- function = "gpio"; +- }; +- +- config { +- pins = "gpio38"; +- bias-pull-up; /* pull up */ +- drive-strength = <16>; /* 16 MA */ +- }; +- }; +- +- sdc2_cd_off: sdc2_cd_off { +- mux { +- pins = "gpio38"; +- function = "gpio"; +- }; +- +- config { +- pins = "gpio38"; +- bias-pull-up; /* pull up */ +- drive-strength = <2>; /* 2 MA */ +- }; +- }; +- +- hdmi_hpd_active: hdmi_hpd_active { +- mux { +- pins = "gpio34"; +- function = "hdmi_hot"; +- }; +- +- config { +- pins = "gpio34"; +- bias-pull-down; +- drive-strength = <16>; +- }; +- }; +- +- hdmi_hpd_suspend: hdmi_hpd_suspend { +- mux { +- pins = "gpio34"; +- function = "hdmi_hot"; +- }; +- +- config { +- pins = "gpio34"; +- bias-pull-down; +- drive-strength = <2>; +- }; +- }; +- +- hdmi_ddc_active: hdmi_ddc_active { +- mux { +- pins = "gpio32", "gpio33"; +- function = "hdmi_ddc"; +- }; +- +- config { +- pins = "gpio32", "gpio33"; +- drive-strength = <2>; +- bias-pull-up; +- }; +- }; +- +- hdmi_ddc_suspend: hdmi_ddc_suspend { +- mux { +- pins = "gpio32", "gpio33"; +- function = "hdmi_ddc"; +- }; +- +- config { +- pins = "gpio32", "gpio33"; +- drive-strength = <2>; +- bias-pull-down; +- }; +- }; +-}; +- +-&pcie0 { +- status = "okay"; +- perst-gpio = <&tlmm 35 GPIO_ACTIVE_LOW>; +- vddpe-3v3-supply = <&wlan_en>; +- vdda-supply = <&vreg_l28a_0p925>; +-}; +- +-&pcie1 { +- status = "okay"; +- perst-gpio = <&tlmm 130 GPIO_ACTIVE_LOW>; +- vdda-supply = <&vreg_l28a_0p925>; +-}; +- +-&pcie2 { +- status = "okay"; +- perst-gpio = <&tlmm 114 GPIO_ACTIVE_LOW>; +- vdda-supply = <&vreg_l28a_0p925>; +-}; +- +-&pcie_phy { +- status = "okay"; +- +- vdda-phy-supply = <&vreg_l28a_0p925>; +- vdda-pll-supply = <&vreg_l12a_1p8>; +-}; +- +-&pm8994_gpios { +- gpio-line-names = +- "NC", +- "KEY_VOLP_N", +- "NC", +- "BL1_PWM", +- "GPIO-F", /* BL0_PWM, LSEC pin 28 */ +- "BL1_EN", +- "NC", +- "WLAN_EN", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "NC", +- "DIVCLK1", +- "DIVCLK2", +- "DIVCLK3", +- "DIVCLK4", +- "BT_EN", +- "PMIC_SLB", +- "PMIC_BUA", +- "USB_VBUS_DET"; +- +- pinctrl-names = "default"; +- pinctrl-0 = <&ls_exp_gpio_f &bt_en_gpios>; +- +- ls_exp_gpio_f: pm8994_gpio5 { +- pinconf { +- pins = "gpio5"; +- output-low; +- power-source = <2>; // PM8994_GPIO_S4, 1.8V +- }; +- }; +- +- bt_en_gpios: bt_en_gpios { +- pinconf { +- pins = "gpio19"; +- function = PMIC_GPIO_FUNC_NORMAL; +- output-low; +- power-source = ; // 1.8V +- qcom,drive-strength = ; +- bias-pull-down; +- }; +- }; +- +- wlan_en_gpios: wlan_en_gpios { +- pinconf { +- pins = "gpio8"; +- function = PMIC_GPIO_FUNC_NORMAL; +- output-low; +- power-source = ; // 1.8V +- qcom,drive-strength = ; +- bias-pull-down; +- }; +- }; +- +- audio_mclk: clk_div1 { +- pinconf { +- pins = "gpio15"; +- function = "func1"; +- power-source = ; // 1.8V +- }; +- }; +- +- volume_up_gpio: pm8996_gpio2 { +- pinconf { +- pins = "gpio2"; +- function = "normal"; +- input-enable; +- drive-push-pull; +- bias-pull-up; +- qcom,drive-strength = ; +- power-source = ; // 1.8V +- }; +- }; +- +- divclk4_pin_a: divclk4 { +- pinconf { +- pins = "gpio18"; +- function = PMIC_GPIO_FUNC_FUNC2; +- +- bias-disable; +- power-source = ; +- }; +- }; +- +- usb3_vbus_det_gpio: pm8996_gpio22 { +- pinconf { +- pins = "gpio22"; +- function = PMIC_GPIO_FUNC_NORMAL; +- input-enable; +- bias-pull-down; +- qcom,drive-strength = ; +- power-source = ; // 1.8V +- }; +- }; +-}; +- +-&pm8994_mpps { +- gpio-line-names = +- "VDDPX_BIAS", +- "WIFI_LED", +- "NC", +- "BT_LED", +- "PM_MPP05", +- "PM_MPP06", +- "PM_MPP07", +- "NC"; +-}; +- +-&pm8994_spmi_regulators { +- qcom,saw-reg = <&saw3>; +- s9 { +- qcom,saw-slave; +- }; +- s10 { +- qcom,saw-slave; +- }; +- s11 { +- qcom,saw-leader; +- regulator-always-on; +- regulator-min-microvolt = <980000>; +- regulator-max-microvolt = <980000>; +- }; +-}; +- +-&pmi8994_gpios { +- gpio-line-names = +- "NC", +- "SPKR_AMP_EN1", +- "SPKR_AMP_EN2", +- "TP61", +- "NC", +- "USB2_VBUS_DET", +- "NC", +- "NC", +- "NC", +- "NC"; +- +- usb2_vbus_det_gpio: pmi8996_gpio6 { +- pinconf { +- pins = "gpio6"; +- function = PMIC_GPIO_FUNC_NORMAL; +- input-enable; +- bias-pull-down; +- qcom,drive-strength = ; +- power-source = ; // 1.8V +- }; +- }; +-}; +- +-&pmi8994_spmi_regulators { +- vdd_gfx: s2@1700 { +- reg = <0x1700 0x100>; +- regulator-name = "VDD_GFX"; +- regulator-min-microvolt = <980000>; +- regulator-max-microvolt = <980000>; +- }; +-}; +- +-&rpm_requests { +- pm8994-regulators { +- compatible = "qcom,rpm-pm8994-regulators"; +- +- vdd_s1-supply = <&vph_pwr>; +- vdd_s2-supply = <&vph_pwr>; +- vdd_s3-supply = <&vph_pwr>; +- vdd_s4-supply = <&vph_pwr>; +- vdd_s5-supply = <&vph_pwr>; +- vdd_s6-supply = <&vph_pwr>; +- vdd_s7-supply = <&vph_pwr>; +- vdd_s8-supply = <&vph_pwr>; +- vdd_s9-supply = <&vph_pwr>; +- vdd_s10-supply = <&vph_pwr>; +- vdd_s11-supply = <&vph_pwr>; +- vdd_s12-supply = <&vph_pwr>; +- vdd_l1-supply = <&vreg_s1b_1p025>; +- vdd_l2_l26_l28-supply = <&vreg_s3a_1p3>; +- vdd_l3_l11-supply = <&vreg_s3a_1p3>; +- vdd_l4_l27_l31-supply = <&vreg_s3a_1p3>; +- vdd_l5_l7-supply = <&vreg_s5a_2p15>; +- vdd_l6_l12_l32-supply = <&vreg_s5a_2p15>; +- vdd_l8_l16_l30-supply = <&vph_pwr>; +- vdd_l9_l10_l18_l22-supply = <&vph_pwr_bbyp>; +- vdd_l13_l19_l23_l24-supply = <&vph_pwr_bbyp>; +- vdd_l14_l15-supply = <&vreg_s5a_2p15>; +- vdd_l17_l29-supply = <&vph_pwr_bbyp>; +- vdd_l20_l21-supply = <&vph_pwr_bbyp>; +- vdd_l25-supply = <&vreg_s3a_1p3>; +- vdd_lvs1_lvs2-supply = <&vreg_s4a_1p8>; +- +- vreg_s3a_1p3: s3 { +- regulator-name = "vreg_s3a_1p3"; +- regulator-min-microvolt = <1300000>; +- regulator-max-microvolt = <1300000>; +- }; +- +- /** +- * 1.8v required on LS expansion +- * for mezzanine boards +- */ +- vreg_s4a_1p8: s4 { +- regulator-name = "vreg_s4a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- regulator-always-on; +- }; +- vreg_s5a_2p15: s5 { +- regulator-name = "vreg_s5a_2p15"; +- regulator-min-microvolt = <2150000>; +- regulator-max-microvolt = <2150000>; +- }; +- vreg_s7a_1p0: s7 { +- regulator-name = "vreg_s7a_1p0"; +- regulator-min-microvolt = <800000>; +- regulator-max-microvolt = <800000>; +- }; +- +- vreg_l1a_1p0: l1 { +- regulator-name = "vreg_l1a_1p0"; +- regulator-min-microvolt = <1000000>; +- regulator-max-microvolt = <1000000>; +- }; +- vreg_l2a_1p25: l2 { +- regulator-name = "vreg_l2a_1p25"; +- regulator-min-microvolt = <1250000>; +- regulator-max-microvolt = <1250000>; +- }; +- vreg_l3a_0p875: l3 { +- regulator-name = "vreg_l3a_0p875"; +- regulator-min-microvolt = <850000>; +- regulator-max-microvolt = <850000>; +- }; +- vreg_l4a_1p225: l4 { +- regulator-name = "vreg_l4a_1p225"; +- regulator-min-microvolt = <1225000>; +- regulator-max-microvolt = <1225000>; +- }; +- vreg_l6a_1p2: l6 { +- regulator-name = "vreg_l6a_1p2"; +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <1200000>; +- }; +- vreg_l8a_1p8: l8 { +- regulator-name = "vreg_l8a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l9a_1p8: l9 { +- regulator-name = "vreg_l9a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l10a_1p8: l10 { +- regulator-name = "vreg_l10a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l11a_1p15: l11 { +- regulator-name = "vreg_l11a_1p15"; +- regulator-min-microvolt = <1150000>; +- regulator-max-microvolt = <1150000>; +- }; +- vreg_l12a_1p8: l12 { +- regulator-name = "vreg_l12a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l13a_2p95: l13 { +- regulator-name = "vreg_l13a_2p95"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <2950000>; +- }; +- vreg_l14a_1p8: l14 { +- regulator-name = "vreg_l14a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l15a_1p8: l15 { +- regulator-name = "vreg_l15a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l16a_2p7: l16 { +- regulator-name = "vreg_l16a_2p7"; +- regulator-min-microvolt = <2700000>; +- regulator-max-microvolt = <2700000>; +- }; +- vreg_l17a_2p8: l17 { +- regulator-name = "vreg_l17a_2p8"; +- regulator-min-microvolt = <2500000>; +- regulator-max-microvolt = <2500000>; +- }; +- vreg_l18a_2p85: l18 { +- regulator-name = "vreg_l18a_2p85"; +- regulator-min-microvolt = <2700000>; +- regulator-max-microvolt = <2900000>; +- }; +- vreg_l19a_2p8: l19 { +- regulator-name = "vreg_l19a_2p8"; +- regulator-min-microvolt = <3000000>; +- regulator-max-microvolt = <3000000>; +- }; +- vreg_l20a_2p95: l20 { +- regulator-name = "vreg_l20a_2p95"; +- regulator-min-microvolt = <2950000>; +- regulator-max-microvolt = <2950000>; +- regulator-allow-set-load; +- }; +- vreg_l21a_2p95: l21 { +- regulator-name = "vreg_l21a_2p95"; +- regulator-min-microvolt = <2950000>; +- regulator-max-microvolt = <2950000>; +- regulator-allow-set-load; +- regulator-system-load = <200000>; +- }; +- vreg_l22a_3p0: l22 { +- regulator-name = "vreg_l22a_3p0"; +- regulator-min-microvolt = <3300000>; +- regulator-max-microvolt = <3300000>; +- }; +- vreg_l23a_2p8: l23 { +- regulator-name = "vreg_l23a_2p8"; +- regulator-min-microvolt = <2800000>; +- regulator-max-microvolt = <2800000>; +- }; +- vreg_l24a_3p075: l24 { +- regulator-name = "vreg_l24a_3p075"; +- regulator-min-microvolt = <3075000>; +- regulator-max-microvolt = <3075000>; +- }; +- vreg_l25a_1p2: l25 { +- regulator-name = "vreg_l25a_1p2"; +- regulator-min-microvolt = <1200000>; +- regulator-max-microvolt = <1200000>; +- regulator-allow-set-load; +- }; +- vreg_l26a_0p8: l27 { +- regulator-name = "vreg_l26a_0p8"; +- regulator-min-microvolt = <1000000>; +- regulator-max-microvolt = <1000000>; +- }; +- vreg_l28a_0p925: l28 { +- regulator-name = "vreg_l28a_0p925"; +- regulator-min-microvolt = <925000>; +- regulator-max-microvolt = <925000>; +- regulator-allow-set-load; +- }; +- vreg_l29a_2p8: l29 { +- regulator-name = "vreg_l29a_2p8"; +- regulator-min-microvolt = <2800000>; +- regulator-max-microvolt = <2800000>; +- }; +- vreg_l30a_1p8: l30 { +- regulator-name = "vreg_l30a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- vreg_l32a_1p8: l32 { +- regulator-name = "vreg_l32a_1p8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- +- vreg_lvs1a_1p8: lvs1 { +- regulator-name = "vreg_lvs1a_1p8"; +- }; +- +- vreg_lvs2a_1p8: lvs2 { +- regulator-name = "vreg_lvs2a_1p8"; +- }; +- }; +- +- pmi8994-regulators { +- compatible = "qcom,rpm-pmi8994-regulators"; +- +- vdd_s1-supply = <&vph_pwr>; +- vdd_s2-supply = <&vph_pwr>; +- vdd_s3-supply = <&vph_pwr>; +- vdd_bst_byp-supply = <&vph_pwr>; +- +- vph_pwr_bbyp: boost-bypass { +- regulator-name = "vph_pwr_bbyp"; +- regulator-min-microvolt = <3300000>; +- regulator-max-microvolt = <3300000>; +- }; +- +- vreg_s1b_1p025: s1 { +- regulator-name = "vreg_s1b_1p025"; +- regulator-min-microvolt = <1025000>; +- regulator-max-microvolt = <1025000>; +- }; +- }; +-}; +- +-&sdhc2 { +- /* External SD card */ +- pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&sdc2_state_on &sdc2_cd_on>; +- pinctrl-1 = <&sdc2_state_off &sdc2_cd_off>; +- cd-gpios = <&tlmm 38 GPIO_ACTIVE_LOW>; +- vmmc-supply = <&vreg_l21a_2p95>; +- vqmmc-supply = <&vreg_l13a_2p95>; +- status = "okay"; +-}; +- +-&q6asmdai { +- dai@0 { +- reg = <0>; +- }; +- +- dai@1 { +- reg = <1>; +- }; +- +- dai@2 { +- reg = <2>; +- }; +-}; +- +-&sound { +- compatible = "qcom,apq8096-sndcard"; +- model = "DB820c"; +- audio-routing = "RX_BIAS", "MCLK", +- "MM_DL1", "MultiMedia1 Playback", +- "MM_DL2", "MultiMedia2 Playback", +- "MultiMedia3 Capture", "MM_UL3"; +- +- mm1-dai-link { +- link-name = "MultiMedia1"; +- cpu { +- sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA1>; +- }; +- }; +- +- mm2-dai-link { +- link-name = "MultiMedia2"; +- cpu { +- sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA2>; +- }; +- }; +- +- mm3-dai-link { +- link-name = "MultiMedia3"; +- cpu { +- sound-dai = <&q6asmdai MSM_FRONTEND_DAI_MULTIMEDIA3>; +- }; +- }; +- +- hdmi-dai-link { +- link-name = "HDMI"; +- cpu { +- sound-dai = <&q6afedai HDMI_RX>; +- }; +- +- platform { +- sound-dai = <&q6routing>; +- }; +- +- codec { +- sound-dai = <&hdmi 0>; +- }; +- }; +- +- slim-dai-link { +- link-name = "SLIM Playback"; +- cpu { +- sound-dai = <&q6afedai SLIMBUS_6_RX>; +- }; +- +- platform { +- sound-dai = <&q6routing>; +- }; +- +- codec { +- sound-dai = <&wcd9335 6>; +- }; +- }; +- +- slimcap-dai-link { +- link-name = "SLIM Capture"; +- cpu { +- sound-dai = <&q6afedai SLIMBUS_0_TX>; +- }; +- +- platform { +- sound-dai = <&q6routing>; +- }; +- +- codec { +- sound-dai = <&wcd9335 1>; +- }; +- }; +-}; +- +-&ufsphy { +- status = "okay"; +- +- vdda-phy-supply = <&vreg_l28a_0p925>; +- vdda-pll-supply = <&vreg_l12a_1p8>; +- vddp-ref-clk-supply = <&vreg_l25a_1p2>; +-}; +- +-&ufshc { +- status = "okay"; +- +- vcc-supply = <&vreg_l20a_2p95>; +- vccq-supply = <&vreg_l25a_1p2>; +- vccq2-supply = <&vreg_s4a_1p8>; +- +- vcc-max-microamp = <600000>; +- vccq-max-microamp = <450000>; +- vccq2-max-microamp = <450000>; +-}; +- +-&usb2 { +- status = "okay"; +- extcon = <&usb2_id>; +- +- dwc3@7600000 { +- extcon = <&usb2_id>; +- dr_mode = "otg"; +- maximum-speed = "high-speed"; +- }; +-}; +- +-&usb3 { +- status = "okay"; +- extcon = <&usb3_id>; +- +- dwc3@6a00000 { +- extcon = <&usb3_id>; +- dr_mode = "otg"; +- }; +-}; +- +-&usb3phy { +- status = "okay"; +- +- vdda-phy-supply = <&vreg_l28a_0p925>; +- vdda-pll-supply = <&vreg_l12a_1p8>; +- +-}; +- +-&venus { +- status = "okay"; +-}; +- +-&wcd9335 { +- clock-names = "mclk", "slimbus"; +- clocks = <&div1_mclk>, +- <&rpmcc RPM_SMD_BB_CLK1>; +- +- vdd-buck-supply = <&vreg_s4a_1p8>; +- vdd-buck-sido-supply = <&vreg_s4a_1p8>; +- vdd-tx-supply = <&vreg_s4a_1p8>; +- vdd-rx-supply = <&vreg_s4a_1p8>; +- vdd-io-supply = <&vreg_s4a_1p8>; +-}; +diff --git a/arch/arm64/boot/dts/qcom/msm8916-mtp.dts b/arch/arm64/boot/dts/qcom/msm8916-mtp.dts +index d66c155387850..7c0ceb3cff45e 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916-mtp.dts ++++ b/arch/arm64/boot/dts/qcom/msm8916-mtp.dts +@@ -5,9 +5,22 @@ + + /dts-v1/; + +-#include "msm8916-mtp.dtsi" ++#include "msm8916-pm8916.dtsi" + + / { + model = "Qualcomm Technologies, Inc. MSM 8916 MTP"; + compatible = "qcom,msm8916-mtp", "qcom,msm8916-mtp/1", "qcom,msm8916"; ++ ++ aliases { ++ serial0 = &blsp1_uart2; ++ usid0 = &pm8916_0; ++ }; ++ ++ chosen { ++ stdout-path = "serial0"; ++ }; ++}; ++ ++&blsp1_uart2 { ++ status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi +deleted file mode 100644 +index 1bd05046cdeba..0000000000000 +--- a/arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi ++++ /dev/null +@@ -1,21 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/* +- * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. +- */ +- +-#include "msm8916-pm8916.dtsi" +- +-/ { +- aliases { +- serial0 = &blsp1_uart2; +- usid0 = &pm8916_0; +- }; +- +- chosen { +- stdout-path = "serial0"; +- }; +-}; +- +-&blsp1_uart2 { +- status = "okay"; +-}; +diff --git a/arch/arm64/boot/dts/qcom/msm8996-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-mtp.dts +index 45ed594c1b9c2..7d9fc35bc7a06 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996-mtp.dts ++++ b/arch/arm64/boot/dts/qcom/msm8996-mtp.dts +@@ -5,9 +5,31 @@ + + /dts-v1/; + +-#include "msm8996-mtp.dtsi" ++#include "msm8996.dtsi" + + / { + model = "Qualcomm Technologies, Inc. MSM 8996 MTP"; + compatible = "qcom,msm8996-mtp"; ++ ++ aliases { ++ serial0 = &blsp2_uart2; ++ }; ++ ++ chosen { ++ stdout-path = "serial0"; ++ }; ++ ++ soc { ++ serial@75b0000 { ++ status = "okay"; ++ }; ++ }; ++}; ++ ++&hdmi { ++ status = "okay"; ++}; ++ ++&hdmi_phy { ++ status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi +deleted file mode 100644 +index ac43a91f11048..0000000000000 +--- a/arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi ++++ /dev/null +@@ -1,30 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/* +- * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. +- */ +- +-#include "msm8996.dtsi" +- +-/ { +- aliases { +- serial0 = &blsp2_uart2; +- }; +- +- chosen { +- stdout-path = "serial0"; +- }; +- +- soc { +- serial@75b0000 { +- status = "okay"; +- }; +- }; +-}; +- +-&hdmi { +- status = "okay"; +-}; +- +-&hdmi_phy { +- status = "okay"; +-}; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-msm8916-correct-camss-unit-address.patch b/queue-5.15/arm64-dts-qcom-msm8916-correct-camss-unit-address.patch new file mode 100644 index 00000000000..61ccd38a520 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8916-correct-camss-unit-address.patch @@ -0,0 +1,39 @@ +From 6c02aca7f4ae1e89f083ffd85f3c26671868fb35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:18:40 +0200 +Subject: arm64: dts: qcom: msm8916: correct camss unit address + +From: Krzysztof Kozlowski + +[ Upstream commit 48798d992ce276cf0d57bf75318daf8eabd02aa4 ] + +Match unit-address to reg entry to fix dtbs W=1 warnings: + + Warning (simple_bus_reg): /soc@0/camss@1b00000: simple-bus unit address format error, expected "1b0ac00" + +Fixes: 58f479f90a7c ("arm64: dts: qcom: msm8916: Add CAMSS support") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230419211856.79332-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index b967dbfba3b84..aa79e08075ea7 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -1064,7 +1064,7 @@ dsi_phy0: dsi-phy@1a98300 { + }; + }; + +- camss: camss@1b00000 { ++ camss: camss@1b0ac00 { + compatible = "qcom,msm8916-camss"; + reg = <0x01b0ac00 0x200>, + <0x01b00030 0x4>, +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-msm8994-correct-spmi-unit-address.patch b/queue-5.15/arm64-dts-qcom-msm8994-correct-spmi-unit-address.patch new file mode 100644 index 00000000000..62ab959fd73 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8994-correct-spmi-unit-address.patch @@ -0,0 +1,39 @@ +From 07a2e5ad8ff914b9d4cab657863aa20196794250 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:18:46 +0200 +Subject: arm64: dts: qcom: msm8994: correct SPMI unit address + +From: Krzysztof Kozlowski + +[ Upstream commit 24f0f6a8059c7108d4ee3476c95db1e7ff4feb79 ] + +Match unit-address to reg entry to fix dtbs W=1 warnings: + + Warning (simple_bus_reg): /soc/spmi@fc4c0000: simple-bus unit address format error, expected "fc4cf000" + +Fixes: b0ad598f8ec0 ("arm64: dts: qcom: msm8994: Add SPMI PMIC arbiter device") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230419211856.79332-8-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi +index a8dc8163ee82d..4447ed146b3ac 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi +@@ -725,7 +725,7 @@ restart@fc4ab000 { + reg = <0xfc4ab000 0x4>; + }; + +- spmi_bus: spmi@fc4c0000 { ++ spmi_bus: spmi@fc4cf000 { + compatible = "qcom,spmi-pmic-arb"; + reg = <0xfc4cf000 0x1000>, + <0xfc4cb000 0x1000>, +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-msm8996-correct-camss-unit-address.patch b/queue-5.15/arm64-dts-qcom-msm8996-correct-camss-unit-address.patch new file mode 100644 index 00000000000..3b24e77684f --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8996-correct-camss-unit-address.patch @@ -0,0 +1,39 @@ +From 38ab9f3598f98915a385391f19995ba8a5da01c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:18:47 +0200 +Subject: arm64: dts: qcom: msm8996: correct camss unit address + +From: Krzysztof Kozlowski + +[ Upstream commit e959ced1d0e5ef0b1f66a0c2d0e1ae80790e5ca5 ] + +Match unit-address to reg entry to fix dtbs W=1 warnings: + + Warning (simple_bus_reg): /soc/camss@a00000: simple-bus unit address format error, expected "a34000" + +Fixes: e0531312e78f ("arm64: dts: qcom: msm8996: Add CAMSS support") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230419211856.79332-9-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index cd66bb16c7392..893c241f72030 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -1771,7 +1771,7 @@ ufsphy_lane: phy@627400 { + }; + }; + +- camss: camss@a00000 { ++ camss: camss@a34000 { + compatible = "qcom,msm8996-camss"; + reg = <0x00a34000 0x1000>, + <0x00a00030 0x4>, +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-sdm630-correct-camss-unit-address.patch b/queue-5.15/arm64-dts-qcom-sdm630-correct-camss-unit-address.patch new file mode 100644 index 00000000000..9b2b8993238 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sdm630-correct-camss-unit-address.patch @@ -0,0 +1,40 @@ +From 5aa93d50a7d409d4e9cd6e73f0460d75934f2d63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:18:48 +0200 +Subject: arm64: dts: qcom: sdm630: correct camss unit address + +From: Krzysztof Kozlowski + +[ Upstream commit c8b7faa7e9913a94444b3f00b6480e53a174fcfd ] + +Match unit-address to reg entry to fix dtbs W=1 warnings: + + Warning (simple_bus_reg): /soc/camss@ca00000: simple-bus unit address format error, expected "ca00020" + +Fixes: f3d5d3cc6971 ("arm64: dts: qcom: sdm630: Configure the camera subsystem") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230419211856.79332-10-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm630.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm630.dtsi b/arch/arm64/boot/dts/qcom/sdm630.dtsi +index c2e1a0d9a2725..e00c0577cef70 100644 +--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi +@@ -1834,7 +1834,7 @@ pil-reloc@94c { + }; + }; + +- camss: camss@ca00000 { ++ camss: camss@ca00020 { + compatible = "qcom,sdm660-camss"; + reg = <0x0c824000 0x1000>, + <0x0ca00120 0x4>, +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-sdm845-correct-camss-unit-address.patch b/queue-5.15/arm64-dts-qcom-sdm845-correct-camss-unit-address.patch new file mode 100644 index 00000000000..8644d9a1334 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sdm845-correct-camss-unit-address.patch @@ -0,0 +1,39 @@ +From aa4939c60a09f9bbd30d0206294a990d331b7d72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:18:49 +0200 +Subject: arm64: dts: qcom: sdm845: correct camss unit address + +From: Krzysztof Kozlowski + +[ Upstream commit a05b913a27e46926ba60ba2bcacc7ec7a8403e4c ] + +Match unit-address to reg entry to fix dtbs W=1 warnings: + + Warning (simple_bus_reg): /soc@0/camss@a00000: simple-bus unit address format error, expected "acb3000" + +Fixes: d48a6698a6b7 ("arm64: dts: qcom: sdm845: Add CAMSS ISP node") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230419211856.79332-11-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index d973aa39e410b..a0489a45aafbd 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -3921,7 +3921,7 @@ videocc: clock-controller@ab00000 { + #reset-cells = <1>; + }; + +- camss: camss@a00000 { ++ camss: camss@acb3000 { + compatible = "qcom,sdm845-camss"; + + reg = <0 0xacb3000 0 0x1000>, +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-sm8250-edo-panel-framebuffer-is-2.5k-.patch b/queue-5.15/arm64-dts-qcom-sm8250-edo-panel-framebuffer-is-2.5k-.patch new file mode 100644 index 00000000000..ef1a4df36bc --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sm8250-edo-panel-framebuffer-is-2.5k-.patch @@ -0,0 +1,52 @@ +From 2a38faa18f5e4534dd2f0521dc813f59d07bde29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 23:14:18 +0200 +Subject: arm64: dts: qcom: sm8250-edo: Panel framebuffer is 2.5k instead of 4k + +From: Marijn Suijten + +[ Upstream commit 223ce29c8b7e5b00f01a68387aabeefd77d97f06 ] + +The framebuffer configuration for edo pdx203, written in edo dtsi (which +is overwritten in pdx206 dts for its smaller panel) has to use a +1096x2560 configuration as this is what the panel (and framebuffer area) +has been initialized to. Downstream userspace also has access to (and +uses) this 2.5k mode by default, and only switches the panel to 4k when +requested. + +This is similar to commit be8de06dc397 ("arm64: dts: qcom: +sm8150-kumano: Panel framebuffer is 2.5k instead of 4k") which fixed the +same for the previous generation Sony platform. + +Fixes: 69cdb97ef652 ("arm64: dts: qcom: sm8250: Add support for SONY Xperia 1 II / 5 II (Edo platform)") +Signed-off-by: Marijn Suijten +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230606211418.587676-1-marijn.suijten@somainline.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi +index effbd6a9c9891..b093f2a02a9cb 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi +@@ -26,9 +26,10 @@ chosen { + framebuffer: framebuffer@9c000000 { + compatible = "simple-framebuffer"; + reg = <0 0x9c000000 0 0x2300000>; +- width = <1644>; +- height = <3840>; +- stride = <(1644 * 4)>; ++ /* pdx203 BL initializes in 2.5k mode, not 4k */ ++ width = <1096>; ++ height = <2560>; ++ stride = <(1096 * 4)>; + format = "a8r8g8b8"; + /* + * That's a lot of clocks, but it's necessary due +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-renesas-ulcb-kf-remove-flow-control-for-sc.patch b/queue-5.15/arm64-dts-renesas-ulcb-kf-remove-flow-control-for-sc.patch new file mode 100644 index 00000000000..c9660884255 --- /dev/null +++ b/queue-5.15/arm64-dts-renesas-ulcb-kf-remove-flow-control-for-sc.patch @@ -0,0 +1,46 @@ +From 8f6187741c756e1138b62e24e54fd7802abdaff6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 10:48:22 +0200 +Subject: arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1 + +From: Wolfram Sang + +[ Upstream commit 1a2c4e5635177939a088d22fa35c6a7032725663 ] + +The schematics are misleading, the flow control is for HSCIF1. We need +SCIF1 for GNSS/GPS which does not use flow control. + +Fixes: c6c816e22bc8 ("arm64: dts: ulcb-kf: enable SCIF1") +Signed-off-by: Wolfram Sang +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230525084823.4195-2-wsa+renesas@sang-engineering.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/ulcb-kf.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi +index 61bd4df09df0d..26cb5f14f9c7a 100644 +--- a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi ++++ b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi +@@ -270,7 +270,7 @@ hscif0_pins: hscif0 { + }; + + scif1_pins: scif1 { +- groups = "scif1_data_b", "scif1_ctrl"; ++ groups = "scif1_data_b"; + function = "scif1"; + }; + +@@ -330,7 +330,6 @@ rsnd_for_pcm3168a_capture: endpoint { + &scif1 { + pinctrl-0 = <&scif1_pins>; + pinctrl-names = "default"; +- uart-has-rtscts; + + status = "okay"; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-ti-k3-j7200-fix-physical-address-of-pin.patch b/queue-5.15/arm64-dts-ti-k3-j7200-fix-physical-address-of-pin.patch new file mode 100644 index 00000000000..ab2fad08f1f --- /dev/null +++ b/queue-5.15/arm64-dts-ti-k3-j7200-fix-physical-address-of-pin.patch @@ -0,0 +1,83 @@ +From 240796d0b981f6ac583cc835b80cdb497198bcb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 09:30:06 +0530 +Subject: arm64: dts: ti: k3-j7200: Fix physical address of pin + +From: Keerthy + +[ Upstream commit 3d011933000ed9054c649952d83162d24f020a93 ] + +wkup_pmx splits into multiple regions. Like + + wkup_pmx0 -> 13 pins (WKUP_PADCONFIG 0 - 12) + wkup_pmx1 -> 2 pins (WKUP_PADCONFIG 14 - 15) + wkup_pmx2 -> 59 pins (WKUP_PADCONFIG 26 - 84) + wkup_pmx3 -> 8 pins (WKUP_PADCONFIG 93 - 100) + +With this split, pin offset needs to be adjusted to +match with new pmx for all pins above wkup_pmx0. + +Example a pin under wkup_pmx1 should start from 0 instead of +old offset(0x38 WKUP_PADCONFIG 14 offset) + +J7200 Datasheet (Table 6-106, Section 6.4 Pin Multiplexing) : +https://www.ti.com/lit/ds/symlink/dra821u.pdf + +Fixes: 9ae21ac445e9 ("arm64: dts: ti: k3-j7200: Fix wakeup pinmux range") + +Signed-off-by: Keerthy +Signed-off-by: Udit Kumar +Link: https://lore.kernel.org/r/20230419040007.3022780-2-u-kumar1@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + .../dts/ti/k3-j7200-common-proc-board.dts | 28 +++++++++---------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +index 4417fe81afd7f..ee244df75eaea 100644 +--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts ++++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +@@ -80,25 +80,25 @@ vdd_sd_dv: gpio-regulator-TLV71033 { + &wkup_pmx2 { + mcu_cpsw_pins_default: mcu-cpsw-pins-default { + pinctrl-single,pins = < +- J721E_WKUP_IOPAD(0x0068, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */ +- J721E_WKUP_IOPAD(0x006c, PIN_INPUT, 0) /* MCU_RGMII1_RX_CTL */ +- J721E_WKUP_IOPAD(0x0070, PIN_OUTPUT, 0) /* MCU_RGMII1_TD3 */ +- J721E_WKUP_IOPAD(0x0074, PIN_OUTPUT, 0) /* MCU_RGMII1_TD2 */ +- J721E_WKUP_IOPAD(0x0078, PIN_OUTPUT, 0) /* MCU_RGMII1_TD1 */ +- J721E_WKUP_IOPAD(0x007c, PIN_OUTPUT, 0) /* MCU_RGMII1_TD0 */ +- J721E_WKUP_IOPAD(0x0088, PIN_INPUT, 0) /* MCU_RGMII1_RD3 */ +- J721E_WKUP_IOPAD(0x008c, PIN_INPUT, 0) /* MCU_RGMII1_RD2 */ +- J721E_WKUP_IOPAD(0x0090, PIN_INPUT, 0) /* MCU_RGMII1_RD1 */ +- J721E_WKUP_IOPAD(0x0094, PIN_INPUT, 0) /* MCU_RGMII1_RD0 */ +- J721E_WKUP_IOPAD(0x0080, PIN_OUTPUT, 0) /* MCU_RGMII1_TXC */ +- J721E_WKUP_IOPAD(0x0084, PIN_INPUT, 0) /* MCU_RGMII1_RXC */ ++ J721E_WKUP_IOPAD(0x0000, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */ ++ J721E_WKUP_IOPAD(0x0004, PIN_INPUT, 0) /* MCU_RGMII1_RX_CTL */ ++ J721E_WKUP_IOPAD(0x0008, PIN_OUTPUT, 0) /* MCU_RGMII1_TD3 */ ++ J721E_WKUP_IOPAD(0x000c, PIN_OUTPUT, 0) /* MCU_RGMII1_TD2 */ ++ J721E_WKUP_IOPAD(0x0010, PIN_OUTPUT, 0) /* MCU_RGMII1_TD1 */ ++ J721E_WKUP_IOPAD(0x0014, PIN_OUTPUT, 0) /* MCU_RGMII1_TD0 */ ++ J721E_WKUP_IOPAD(0x0020, PIN_INPUT, 0) /* MCU_RGMII1_RD3 */ ++ J721E_WKUP_IOPAD(0x0024, PIN_INPUT, 0) /* MCU_RGMII1_RD2 */ ++ J721E_WKUP_IOPAD(0x0028, PIN_INPUT, 0) /* MCU_RGMII1_RD1 */ ++ J721E_WKUP_IOPAD(0x002c, PIN_INPUT, 0) /* MCU_RGMII1_RD0 */ ++ J721E_WKUP_IOPAD(0x0018, PIN_OUTPUT, 0) /* MCU_RGMII1_TXC */ ++ J721E_WKUP_IOPAD(0x001c, PIN_INPUT, 0) /* MCU_RGMII1_RXC */ + >; + }; + + mcu_mdio_pins_default: mcu-mdio1-pins-default { + pinctrl-single,pins = < +- J721E_WKUP_IOPAD(0x009c, PIN_OUTPUT, 0) /* (L1) MCU_MDIO0_MDC */ +- J721E_WKUP_IOPAD(0x0098, PIN_INPUT, 0) /* (L4) MCU_MDIO0_MDIO */ ++ J721E_WKUP_IOPAD(0x0034, PIN_OUTPUT, 0) /* (L1) MCU_MDIO0_MDC */ ++ J721E_WKUP_IOPAD(0x0030, PIN_INPUT, 0) /* (L4) MCU_MDIO0_MDIO */ + >; + }; + }; +-- +2.39.2 + diff --git a/queue-5.15/asoc-es8316-do-not-set-rate-constraints-for-unsuppor.patch b/queue-5.15/asoc-es8316-do-not-set-rate-constraints-for-unsuppor.patch new file mode 100644 index 00000000000..d930c29c123 --- /dev/null +++ b/queue-5.15/asoc-es8316-do-not-set-rate-constraints-for-unsuppor.patch @@ -0,0 +1,91 @@ +From d5bbb44e7d89b36feed6f880ec73360131779946 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 21:11:39 +0300 +Subject: ASoC: es8316: Do not set rate constraints for unsupported MCLKs + +From: Cristian Ciocaltea + +[ Upstream commit 60413129ee2b38a80347489270af7f6e1c1de4d0 ] + +When using the codec through the generic audio graph card, there are at +least two calls of es8316_set_dai_sysclk(), with the effect of limiting +the allowed sample rates according to the MCLK/LRCK ratios supported by +the codec: + +1. During audio card setup, to set the initial MCLK - see + asoc_simple_init_dai(). + +2. Before opening a stream, to update MCLK, according to the stream + sample rate and the multiplication factor - see + asoc_simple_hw_params(). + +In some cases the initial MCLK might be set to a frequency that doesn't +match any of the supported ratios, e.g. 12287999 instead of 12288000, +which is only 1 Hz below the supported clock, as that is what the +hardware reports. This creates an empty list of rate constraints, which +is further passed to snd_pcm_hw_constraint_list() via +es8316_pcm_startup(), and causes the following error on the very first +access of the sound card: + + $ speaker-test -D hw:Analog,0 -F S16_LE -c 2 -t wav + Broken configuration for playback: no configurations available: Invalid argument + Setting of hwparams failed: Invalid argument + +Note that all subsequent retries succeed thanks to the updated MCLK set +at point 2 above, which uses a computed frequency value instead of a +reading from the hardware registers. Normally this would have mitigated +the issue, but es8316_pcm_startup() executes before the 2nd call to +es8316_set_dai_sysclk(), hence it cannot make use of the updated +constraints. + +Since es8316_pcm_hw_params() performs anyway a final validation of MCLK +against the stream sample rate and the supported MCLK/LRCK ratios, fix +the issue by ensuring that sysclk_constraints list is only set when at +least one supported sample rate is autodetected by the codec. + +Fixes: b8b88b70875a ("ASoC: add es8316 codec driver") +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/20230530181140.483936-3-cristian.ciocaltea@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8316.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c +index 673aac91d717e..b36ccfc54cd69 100644 +--- a/sound/soc/codecs/es8316.c ++++ b/sound/soc/codecs/es8316.c +@@ -369,13 +369,11 @@ static int es8316_set_dai_sysclk(struct snd_soc_dai *codec_dai, + int count = 0; + + es8316->sysclk = freq; ++ es8316->sysclk_constraints.list = NULL; ++ es8316->sysclk_constraints.count = 0; + +- if (freq == 0) { +- es8316->sysclk_constraints.list = NULL; +- es8316->sysclk_constraints.count = 0; +- ++ if (freq == 0) + return 0; +- } + + ret = clk_set_rate(es8316->mclk, freq); + if (ret) +@@ -391,8 +389,10 @@ static int es8316_set_dai_sysclk(struct snd_soc_dai *codec_dai, + es8316->allowed_rates[count++] = freq / ratio; + } + +- es8316->sysclk_constraints.list = es8316->allowed_rates; +- es8316->sysclk_constraints.count = count; ++ if (count) { ++ es8316->sysclk_constraints.list = es8316->allowed_rates; ++ es8316->sysclk_constraints.count = count; ++ } + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.15/asoc-es8316-increment-max-value-for-alc-capture-targ.patch b/queue-5.15/asoc-es8316-increment-max-value-for-alc-capture-targ.patch new file mode 100644 index 00000000000..00f0abedc31 --- /dev/null +++ b/queue-5.15/asoc-es8316-increment-max-value-for-alc-capture-targ.patch @@ -0,0 +1,91 @@ +From 0f7a6439e027e137f4132c3baa654e89800ffca3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 21:11:38 +0300 +Subject: ASoC: es8316: Increment max value for ALC Capture Target Volume + control + +From: Cristian Ciocaltea + +[ Upstream commit 6f073429037cd79d7311cd8236311c53f5ea8f01 ] + +The following error occurs when trying to restore a previously saved +ALSA mixer state (tested on a Rock 5B board): + + $ alsactl --no-ucm -f /tmp/asound.state store hw:Analog + $ alsactl --no-ucm -I -f /tmp/asound.state restore hw:Analog + alsactl: set_control:1475: Cannot write control '2:0:0:ALC Capture Target Volume:0' : Invalid argument + +According to ES8316 datasheet, the register at address 0x2B, which is +related to the above mixer control, contains by default the value 0xB0. +Considering the corresponding ALC target bits (ALCLVL) are 7:4, the +control is initialized with 11, which is one step above the maximum +value allowed by the driver: + + ALCLVL | dB gain + -------+-------- + 0000 | -16.5 + 0001 | -15.0 + 0010 | -13.5 + .... | ..... + 0111 | -6.0 + 1000 | -4.5 + 1001 | -3.0 + 1010 | -1.5 + .... | ..... + 1111 | -1.5 + +The tests performed using the VU meter feature (--vumeter=TYPE) of +arecord/aplay confirm the specs are correct and there is no measured +gain if the 1011-1111 range would have been mapped to 0 dB: + + dB gain | VU meter % + --------+----------- + -6.0 | 30-31 + -4.5 | 35-36 + -3.0 | 42-43 + -1.5 | 50-51 + 0.0 | 50-51 + +Increment the max value allowed for ALC Capture Target Volume control, +so that it matches the hardware default. Additionally, update the +related TLV to prevent an artificial extension of the dB gain range. + +Fixes: b8b88b70875a ("ASoC: add es8316 codec driver") +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/20230530181140.483936-2-cristian.ciocaltea@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8316.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c +index afd6d401e3d09..673aac91d717e 100644 +--- a/sound/soc/codecs/es8316.c ++++ b/sound/soc/codecs/es8316.c +@@ -52,7 +52,12 @@ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(dac_vol_tlv, -9600, 50, 1); + static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(adc_vol_tlv, -9600, 50, 1); + static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_max_gain_tlv, -650, 150, 0); + static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_min_gain_tlv, -1200, 150, 0); +-static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_target_tlv, -1650, 150, 0); ++ ++static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(alc_target_tlv, ++ 0, 10, TLV_DB_SCALE_ITEM(-1650, 150, 0), ++ 11, 11, TLV_DB_SCALE_ITEM(-150, 0, 0), ++); ++ + static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(hpmixer_gain_tlv, + 0, 4, TLV_DB_SCALE_ITEM(-1200, 150, 0), + 8, 11, TLV_DB_SCALE_ITEM(-450, 150, 0), +@@ -115,7 +120,7 @@ static const struct snd_kcontrol_new es8316_snd_controls[] = { + alc_max_gain_tlv), + SOC_SINGLE_TLV("ALC Capture Min Volume", ES8316_ADC_ALC2, 0, 28, 0, + alc_min_gain_tlv), +- SOC_SINGLE_TLV("ALC Capture Target Volume", ES8316_ADC_ALC3, 4, 10, 0, ++ SOC_SINGLE_TLV("ALC Capture Target Volume", ES8316_ADC_ALC3, 4, 11, 0, + alc_target_tlv), + SOC_SINGLE("ALC Capture Hold Time", ES8316_ADC_ALC3, 0, 10, 0), + SOC_SINGLE("ALC Capture Decay Time", ES8316_ADC_ALC4, 4, 10, 0), +-- +2.39.2 + diff --git a/queue-5.15/asoc-imx-audmix-check-return-value-of-devm_kasprintf.patch b/queue-5.15/asoc-imx-audmix-check-return-value-of-devm_kasprintf.patch new file mode 100644 index 00000000000..d7ee49acc12 --- /dev/null +++ b/queue-5.15/asoc-imx-audmix-check-return-value-of-devm_kasprintf.patch @@ -0,0 +1,66 @@ +From 76688a7c83e7f43f0e7aaff1d95ab984f5957318 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 15:15:09 +0300 +Subject: ASoC: imx-audmix: check return value of devm_kasprintf() + +From: Claudiu Beznea + +[ Upstream commit 2f76e1d6ca524a888d29aafe29f2ad2003857971 ] + +devm_kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: b86ef5367761 ("ASoC: fsl: Add Audio Mixer machine driver") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230614121509.443926-1-claudiu.beznea@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-audmix.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/soc/fsl/imx-audmix.c b/sound/soc/fsl/imx-audmix.c +index a364e2415de02..d991e457060c7 100644 +--- a/sound/soc/fsl/imx-audmix.c ++++ b/sound/soc/fsl/imx-audmix.c +@@ -228,6 +228,8 @@ static int imx_audmix_probe(struct platform_device *pdev) + + dai_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s%s", + fe_name_pref, args.np->full_name + 1); ++ if (!dai_name) ++ return -ENOMEM; + + dev_info(pdev->dev.parent, "DAI FE name:%s\n", dai_name); + +@@ -236,6 +238,8 @@ static int imx_audmix_probe(struct platform_device *pdev) + capture_dai_name = + devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s %s", + dai_name, "CPU-Capture"); ++ if (!capture_dai_name) ++ return -ENOMEM; + } + + priv->dai[i].cpus = &dlc[0]; +@@ -266,6 +270,8 @@ static int imx_audmix_probe(struct platform_device *pdev) + "AUDMIX-Playback-%d", i); + be_cp = devm_kasprintf(&pdev->dev, GFP_KERNEL, + "AUDMIX-Capture-%d", i); ++ if (!be_name || !be_pb || !be_cp) ++ return -ENOMEM; + + priv->dai[num_dai + i].cpus = &dlc[3]; + priv->dai[num_dai + i].codecs = &dlc[4]; +@@ -293,6 +299,9 @@ static int imx_audmix_probe(struct platform_device *pdev) + priv->dapm_routes[i].source = + devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s %s", + dai_name, "CPU-Playback"); ++ if (!priv->dapm_routes[i].source) ++ return -ENOMEM; ++ + priv->dapm_routes[i].sink = be_pb; + priv->dapm_routes[num_dai + i].source = be_pb; + priv->dapm_routes[num_dai + i].sink = be_cp; +-- +2.39.2 + diff --git a/queue-5.15/blk-iocost-use-spin_lock_irqsave-in-adjust_inuse_and.patch b/queue-5.15/blk-iocost-use-spin_lock_irqsave-in-adjust_inuse_and.patch new file mode 100644 index 00000000000..7a6daa973a8 --- /dev/null +++ b/queue-5.15/blk-iocost-use-spin_lock_irqsave-in-adjust_inuse_and.patch @@ -0,0 +1,150 @@ +From d479d169c2149ab341de3f7f3f8d571e59dc9343 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 May 2023 17:19:04 +0800 +Subject: blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost + +From: Li Nan + +[ Upstream commit 8d211554679d0b23702bd32ba04aeac0c1c4f660 ] + +adjust_inuse_and_calc_cost() use spin_lock_irq() and IRQ will be enabled +when unlock. DEADLOCK might happen if we have held other locks and disabled +IRQ before invoking it. + +Fix it by using spin_lock_irqsave() instead, which can keep IRQ state +consistent with before when unlock. + + ================================ + WARNING: inconsistent lock state + 5.10.0-02758-g8e5f91fd772f #26 Not tainted + -------------------------------- + inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. + kworker/2:3/388 [HC0[0]:SC0[0]:HE0:SE1] takes: + ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq + ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390 + {IN-HARDIRQ-W} state was registered at: + __lock_acquire+0x3d7/0x1070 + lock_acquire+0x197/0x4a0 + __raw_spin_lock_irqsave + _raw_spin_lock_irqsave+0x3b/0x60 + bfq_idle_slice_timer_body + bfq_idle_slice_timer+0x53/0x1d0 + __run_hrtimer+0x477/0xa70 + __hrtimer_run_queues+0x1c6/0x2d0 + hrtimer_interrupt+0x302/0x9e0 + local_apic_timer_interrupt + __sysvec_apic_timer_interrupt+0xfd/0x420 + run_sysvec_on_irqstack_cond + sysvec_apic_timer_interrupt+0x46/0xa0 + asm_sysvec_apic_timer_interrupt+0x12/0x20 + irq event stamp: 837522 + hardirqs last enabled at (837521): [] __raw_spin_unlock_irqrestore + hardirqs last enabled at (837521): [] _raw_spin_unlock_irqrestore+0x3d/0x40 + hardirqs last disabled at (837522): [] __raw_spin_lock_irq + hardirqs last disabled at (837522): [] _raw_spin_lock_irq+0x43/0x50 + softirqs last enabled at (835852): [] __do_softirq+0x558/0x8ec + softirqs last disabled at (835845): [] asm_call_irq_on_stack+0xf/0x20 + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(&bfqd->lock); + + lock(&bfqd->lock); + + *** DEADLOCK *** + + 3 locks held by kworker/2:3/388: + #0: ffff888107af0f38 ((wq_completion)kthrotld){+.+.}-{0:0}, at: process_one_work+0x742/0x13f0 + #1: ffff8881176bfdd8 ((work_completion)(&td->dispatch_work)){+.+.}-{0:0}, at: process_one_work+0x777/0x13f0 + #2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq + #2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390 + + stack backtrace: + CPU: 2 PID: 388 Comm: kworker/2:3 Not tainted 5.10.0-02758-g8e5f91fd772f #26 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 + Workqueue: kthrotld blk_throtl_dispatch_work_fn + Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x107/0x167 + print_usage_bug + valid_state + mark_lock_irq.cold+0x32/0x3a + mark_lock+0x693/0xbc0 + mark_held_locks+0x9e/0xe0 + __trace_hardirqs_on_caller + lockdep_hardirqs_on_prepare.part.0+0x151/0x360 + trace_hardirqs_on+0x5b/0x180 + __raw_spin_unlock_irq + _raw_spin_unlock_irq+0x24/0x40 + spin_unlock_irq + adjust_inuse_and_calc_cost+0x4fb/0x970 + ioc_rqos_merge+0x277/0x740 + __rq_qos_merge+0x62/0xb0 + rq_qos_merge + bio_attempt_back_merge+0x12c/0x4a0 + blk_mq_sched_try_merge+0x1b6/0x4d0 + bfq_bio_merge+0x24a/0x390 + __blk_mq_sched_bio_merge+0xa6/0x460 + blk_mq_sched_bio_merge + blk_mq_submit_bio+0x2e7/0x1ee0 + __submit_bio_noacct_mq+0x175/0x3b0 + submit_bio_noacct+0x1fb/0x270 + blk_throtl_dispatch_work_fn+0x1ef/0x2b0 + process_one_work+0x83e/0x13f0 + process_scheduled_works + worker_thread+0x7e3/0xd80 + kthread+0x353/0x470 + ret_from_fork+0x1f/0x30 + +Fixes: b0853ab4a238 ("blk-iocost: revamp in-period donation snapbacks") +Signed-off-by: Li Nan +Acked-by: Tejun Heo +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/r/20230527091904.3001833-1-linan666@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-iocost.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/block/blk-iocost.c b/block/blk-iocost.c +index 43cf04966c745..f95feabb3ca88 100644 +--- a/block/blk-iocost.c ++++ b/block/blk-iocost.c +@@ -2448,6 +2448,7 @@ static u64 adjust_inuse_and_calc_cost(struct ioc_gq *iocg, u64 vtime, + u32 hwi, adj_step; + s64 margin; + u64 cost, new_inuse; ++ unsigned long flags; + + current_hweight(iocg, NULL, &hwi); + old_hwi = hwi; +@@ -2466,11 +2467,11 @@ static u64 adjust_inuse_and_calc_cost(struct ioc_gq *iocg, u64 vtime, + iocg->inuse == iocg->active) + return cost; + +- spin_lock_irq(&ioc->lock); ++ spin_lock_irqsave(&ioc->lock, flags); + + /* we own inuse only when @iocg is in the normal active state */ + if (iocg->abs_vdebt || list_empty(&iocg->active_list)) { +- spin_unlock_irq(&ioc->lock); ++ spin_unlock_irqrestore(&ioc->lock, flags); + return cost; + } + +@@ -2491,7 +2492,7 @@ static u64 adjust_inuse_and_calc_cost(struct ioc_gq *iocg, u64 vtime, + } while (time_after64(vtime + cost, now->vnow) && + iocg->inuse != iocg->active); + +- spin_unlock_irq(&ioc->lock); ++ spin_unlock_irqrestore(&ioc->lock, flags); + + TRACE_IOCG_PATH(inuse_adjust, iocg, now, + old_inuse, iocg->inuse, old_hwi, hwi); +-- +2.39.2 + diff --git a/queue-5.15/bonding-do-not-assume-skb-mac_header-is-set.patch b/queue-5.15/bonding-do-not-assume-skb-mac_header-is-set.patch new file mode 100644 index 00000000000..01962d7503d --- /dev/null +++ b/queue-5.15/bonding-do-not-assume-skb-mac_header-is-set.patch @@ -0,0 +1,92 @@ +From c3d95aad99bc3a175e3e65c679bd53cbc8497cd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 15:23:04 +0000 +Subject: bonding: do not assume skb mac_header is set + +From: Eric Dumazet + +[ Upstream commit 6a940abdef3162e5723f1495b8a49859d1708f79 ] + +Drivers must not assume in their ndo_start_xmit() that +skbs have their mac_header set. skb->data is all what is needed. + +bonding seems to be one of the last offender as caught by syzbot: + +WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 skb_mac_offset include/linux/skbuff.h:2913 [inline] +WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline] +WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline] +WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline] +WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 __bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline] +WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470 +Modules linked in: +CPU: 1 PID: 12155 Comm: syz-executor.3 Not tainted 6.1.30-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 +RIP: 0010:skb_mac_header include/linux/skbuff.h:2907 [inline] +RIP: 0010:skb_mac_offset include/linux/skbuff.h:2913 [inline] +RIP: 0010:bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline] +RIP: 0010:bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline] +RIP: 0010:bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline] +RIP: 0010:__bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline] +RIP: 0010:bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470 +Code: 8b 7c 24 30 e8 76 dd 1a 01 48 85 c0 74 0d 48 89 c3 e8 29 67 2e fe e9 15 ef ff ff e8 1f 67 2e fe e9 10 ef ff ff e8 15 67 2e fe <0f> 0b e9 45 f8 ff ff e8 09 67 2e fe e9 dc fa ff ff e8 ff 66 2e fe +RSP: 0018:ffffc90002fff6e0 EFLAGS: 00010283 +RAX: ffffffff835874db RBX: 000000000000ffff RCX: 0000000000040000 +RDX: ffffc90004dcf000 RSI: 00000000000000b5 RDI: 00000000000000b6 +RBP: ffffc90002fff8b8 R08: ffffffff83586d16 R09: ffffffff83586584 +R10: 0000000000000007 R11: ffff8881599fc780 R12: ffff88811b6a7b7e +R13: 1ffff110236d4f6f R14: ffff88811b6a7ac0 R15: 1ffff110236d4f76 +FS: 00007f2e9eb47700(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000001b2e421000 CR3: 000000010e6d4000 CR4: 00000000003526e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + +[] netdev_start_xmit include/linux/netdevice.h:4925 [inline] +[] __dev_direct_xmit+0x4ef/0x850 net/core/dev.c:4380 +[] dev_direct_xmit include/linux/netdevice.h:3043 [inline] +[] packet_direct_xmit+0x18b/0x300 net/packet/af_packet.c:284 +[] packet_snd net/packet/af_packet.c:3112 [inline] +[] packet_sendmsg+0x4a22/0x64d0 net/packet/af_packet.c:3143 +[] sock_sendmsg_nosec net/socket.c:716 [inline] +[] sock_sendmsg net/socket.c:736 [inline] +[] __sys_sendto+0x472/0x5f0 net/socket.c:2139 +[] __do_sys_sendto net/socket.c:2151 [inline] +[] __se_sys_sendto net/socket.c:2147 [inline] +[] __x64_sys_sendto+0xe5/0x100 net/socket.c:2147 +[] do_syscall_x64 arch/x86/entry/common.c:50 [inline] +[] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80 +[] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: 7b8fc0103bb5 ("bonding: add a vlan+srcmac tx hashing option") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Jarod Wilson +Cc: Moshe Tal +Cc: Jussi Maki +Cc: Jay Vosburgh +Cc: Andy Gospodarek +Cc: Vladimir Oltean +Link: https://lore.kernel.org/r/20230622152304.2137482-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index b4d613bdbc060..7b0b4049bd294 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3900,7 +3900,7 @@ u32 bond_xmit_hash(struct bonding *bond, struct sk_buff *skb) + return skb->hash; + + return __bond_xmit_hash(bond, skb, skb->data, skb->protocol, +- skb_mac_offset(skb), skb_network_offset(skb), ++ 0, skb_network_offset(skb), + skb_headlen(skb)); + } + +-- +2.39.2 + diff --git a/queue-5.15/bpf-call-__bpf_sk_lookup-__bpf_skc_lookup-directly-v.patch b/queue-5.15/bpf-call-__bpf_sk_lookup-__bpf_skc_lookup-directly-v.patch new file mode 100644 index 00000000000..3e6c0cc1c53 --- /dev/null +++ b/queue-5.15/bpf-call-__bpf_sk_lookup-__bpf_skc_lookup-directly-v.patch @@ -0,0 +1,79 @@ +From b5be4ef9977cb176de2430c66cde82a7e61b137c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 13:42:09 +0300 +Subject: bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC + hookpoint + +From: Gilad Sever + +[ Upstream commit 97fbfeb86917bdbe9c41d5143e335a929147f405 ] + +skb->dev always exists in the tc flow. There is no need to use +bpf_skc_lookup(), bpf_sk_lookup() from this code path. + +This change facilitates fixing the tc flow to be VRF aware. + +Signed-off-by: Gilad Sever +Signed-off-by: Daniel Borkmann +Reviewed-by: Shmulik Ladkani +Reviewed-by: Eyal Birger +Acked-by: Stanislav Fomichev +Link: https://lore.kernel.org/bpf/20230621104211.301902-3-gilad9366@gmail.com +Stable-dep-of: 9a5cb79762e0 ("bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings") +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 650214f1d25fa..60c1ad379a0b6 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -6349,8 +6349,12 @@ static const struct bpf_func_proto bpf_sk_lookup_udp_proto = { + BPF_CALL_5(bpf_tc_skc_lookup_tcp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) + { +- return (unsigned long)bpf_skc_lookup(skb, tuple, len, IPPROTO_TCP, +- netns_id, flags); ++ struct net *caller_net = dev_net(skb->dev); ++ int ifindex = skb->dev->ifindex; ++ ++ return (unsigned long)__bpf_skc_lookup(skb, tuple, len, caller_net, ++ ifindex, IPPROTO_TCP, netns_id, ++ flags); + } + + static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = { +@@ -6368,8 +6372,12 @@ static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = { + BPF_CALL_5(bpf_tc_sk_lookup_tcp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) + { +- return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_TCP, +- netns_id, flags); ++ struct net *caller_net = dev_net(skb->dev); ++ int ifindex = skb->dev->ifindex; ++ ++ return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net, ++ ifindex, IPPROTO_TCP, netns_id, ++ flags); + } + + static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = { +@@ -6387,8 +6395,12 @@ static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = { + BPF_CALL_5(bpf_tc_sk_lookup_udp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) + { +- return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_UDP, +- netns_id, flags); ++ struct net *caller_net = dev_net(skb->dev); ++ int ifindex = skb->dev->ifindex; ++ ++ return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net, ++ ifindex, IPPROTO_UDP, netns_id, ++ flags); + } + + static const struct bpf_func_proto bpf_tc_sk_lookup_udp_proto = { +-- +2.39.2 + diff --git a/queue-5.15/bpf-don-t-efault-for-g-s-setsockopt-with-wrong-optle.patch b/queue-5.15/bpf-don-t-efault-for-g-s-setsockopt-with-wrong-optle.patch new file mode 100644 index 00000000000..3d56fa7ecb2 --- /dev/null +++ b/queue-5.15/bpf-don-t-efault-for-g-s-setsockopt-with-wrong-optle.patch @@ -0,0 +1,93 @@ +From 2af711db65e1c70bd862e2f77243f81ac1d9d552 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2023 10:04:53 -0700 +Subject: bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen + +From: Stanislav Fomichev + +[ Upstream commit 29ebbba7d46136cba324264e513a1e964ca16c0a ] + +With the way the hooks implemented right now, we have a special +condition: optval larger than PAGE_SIZE will expose only first 4k into +BPF; any modifications to the optval are ignored. If the BPF program +doesn't handle this condition by resetting optlen to 0, +the userspace will get EFAULT. + +The intention of the EFAULT was to make it apparent to the +developers that the program is doing something wrong. +However, this inadvertently might affect production workloads +with the BPF programs that are not too careful (i.e., returning EFAULT +for perfectly valid setsockopt/getsockopt calls). + +Let's try to minimize the chance of BPF program screwing up userspace +by ignoring the output of those BPF programs (instead of returning +EFAULT to the userspace). pr_info_once those cases to +the dmesg to help with figuring out what's going wrong. + +Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks") +Suggested-by: Martin KaFai Lau +Signed-off-by: Stanislav Fomichev +Link: https://lore.kernel.org/r/20230511170456.1759459-2-sdf@google.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + kernel/bpf/cgroup.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c +index 87174832aa86d..297569e5c6399 100644 +--- a/kernel/bpf/cgroup.c ++++ b/kernel/bpf/cgroup.c +@@ -1481,6 +1481,12 @@ int __cgroup_bpf_run_filter_setsockopt(struct sock *sk, int *level, + ret = 1; + } else if (ctx.optlen > max_optlen || ctx.optlen < -1) { + /* optlen is out of bounds */ ++ if (*optlen > PAGE_SIZE && ctx.optlen >= 0) { ++ pr_info_once("bpf setsockopt: ignoring program buffer with optlen=%d (max_optlen=%d)\n", ++ ctx.optlen, max_optlen); ++ ret = 0; ++ goto out; ++ } + ret = -EFAULT; + } else { + /* optlen within bounds, run kernel handler */ +@@ -1536,6 +1542,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, + .optname = optname, + .retval = retval, + }; ++ int orig_optlen; + int ret; + + /* Opportunistic check to see whether we have any BPF program +@@ -1545,6 +1552,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, + if (__cgroup_bpf_prog_array_is_empty(cgrp, CGROUP_GETSOCKOPT)) + return retval; + ++ orig_optlen = max_optlen; + ctx.optlen = max_optlen; + + max_optlen = sockopt_alloc_buf(&ctx, max_optlen, &buf); +@@ -1568,6 +1576,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, + ret = -EFAULT; + goto out; + } ++ orig_optlen = ctx.optlen; + + if (copy_from_user(ctx.optval, optval, + min(ctx.optlen, max_optlen)) != 0) { +@@ -1587,6 +1596,12 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, + } + + if (optval && (ctx.optlen > max_optlen || ctx.optlen < 0)) { ++ if (orig_optlen > PAGE_SIZE && ctx.optlen >= 0) { ++ pr_info_once("bpf getsockopt: ignoring program buffer with optlen=%d (max_optlen=%d)\n", ++ ctx.optlen, max_optlen); ++ ret = retval; ++ goto out; ++ } + ret = -EFAULT; + goto out; + } +-- +2.39.2 + diff --git a/queue-5.15/bpf-factor-out-socket-lookup-functions-for-the-tc-ho.patch b/queue-5.15/bpf-factor-out-socket-lookup-functions-for-the-tc-ho.patch new file mode 100644 index 00000000000..71544e95b54 --- /dev/null +++ b/queue-5.15/bpf-factor-out-socket-lookup-functions-for-the-tc-ho.patch @@ -0,0 +1,120 @@ +From 0a3a39034f61e9e82e20951cca4cf4ee905b8570 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 13:42:08 +0300 +Subject: bpf: Factor out socket lookup functions for the TC hookpoint. + +From: Gilad Sever + +[ Upstream commit 6e98730bc0b44acaf86eccc75f823128aa9c9e79 ] + +Change BPF helper socket lookup functions to use TC specific variants: +bpf_tc_sk_lookup_tcp() / bpf_tc_sk_lookup_udp() / bpf_tc_skc_lookup_tcp() +instead of sharing implementation with the cg / sk_skb hooking points. +This allows introducing a separate logic for the TC flow. + +The tc functions are identical to the original code. + +Signed-off-by: Gilad Sever +Signed-off-by: Daniel Borkmann +Reviewed-by: Shmulik Ladkani +Reviewed-by: Eyal Birger +Acked-by: Stanislav Fomichev +Link: https://lore.kernel.org/bpf/20230621104211.301902-2-gilad9366@gmail.com +Stable-dep-of: 9a5cb79762e0 ("bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings") +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 63 ++++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 60 insertions(+), 3 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index a8291ba156446..650214f1d25fa 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -6346,6 +6346,63 @@ static const struct bpf_func_proto bpf_sk_lookup_udp_proto = { + .arg5_type = ARG_ANYTHING, + }; + ++BPF_CALL_5(bpf_tc_skc_lookup_tcp, struct sk_buff *, skb, ++ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) ++{ ++ return (unsigned long)bpf_skc_lookup(skb, tuple, len, IPPROTO_TCP, ++ netns_id, flags); ++} ++ ++static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = { ++ .func = bpf_tc_skc_lookup_tcp, ++ .gpl_only = false, ++ .pkt_access = true, ++ .ret_type = RET_PTR_TO_SOCK_COMMON_OR_NULL, ++ .arg1_type = ARG_PTR_TO_CTX, ++ .arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY, ++ .arg3_type = ARG_CONST_SIZE, ++ .arg4_type = ARG_ANYTHING, ++ .arg5_type = ARG_ANYTHING, ++}; ++ ++BPF_CALL_5(bpf_tc_sk_lookup_tcp, struct sk_buff *, skb, ++ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) ++{ ++ return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_TCP, ++ netns_id, flags); ++} ++ ++static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = { ++ .func = bpf_tc_sk_lookup_tcp, ++ .gpl_only = false, ++ .pkt_access = true, ++ .ret_type = RET_PTR_TO_SOCKET_OR_NULL, ++ .arg1_type = ARG_PTR_TO_CTX, ++ .arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY, ++ .arg3_type = ARG_CONST_SIZE, ++ .arg4_type = ARG_ANYTHING, ++ .arg5_type = ARG_ANYTHING, ++}; ++ ++BPF_CALL_5(bpf_tc_sk_lookup_udp, struct sk_buff *, skb, ++ struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) ++{ ++ return (unsigned long)bpf_sk_lookup(skb, tuple, len, IPPROTO_UDP, ++ netns_id, flags); ++} ++ ++static const struct bpf_func_proto bpf_tc_sk_lookup_udp_proto = { ++ .func = bpf_tc_sk_lookup_udp, ++ .gpl_only = false, ++ .pkt_access = true, ++ .ret_type = RET_PTR_TO_SOCKET_OR_NULL, ++ .arg1_type = ARG_PTR_TO_CTX, ++ .arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY, ++ .arg3_type = ARG_CONST_SIZE, ++ .arg4_type = ARG_ANYTHING, ++ .arg5_type = ARG_ANYTHING, ++}; ++ + BPF_CALL_1(bpf_sk_release, struct sock *, sk) + { + if (sk && sk_is_refcounted(sk)) +@@ -7475,9 +7532,9 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) + #endif + #ifdef CONFIG_INET + case BPF_FUNC_sk_lookup_tcp: +- return &bpf_sk_lookup_tcp_proto; ++ return &bpf_tc_sk_lookup_tcp_proto; + case BPF_FUNC_sk_lookup_udp: +- return &bpf_sk_lookup_udp_proto; ++ return &bpf_tc_sk_lookup_udp_proto; + case BPF_FUNC_sk_release: + return &bpf_sk_release_proto; + case BPF_FUNC_tcp_sock: +@@ -7485,7 +7542,7 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) + case BPF_FUNC_get_listener_sock: + return &bpf_get_listener_sock_proto; + case BPF_FUNC_skc_lookup_tcp: +- return &bpf_skc_lookup_tcp_proto; ++ return &bpf_tc_skc_lookup_tcp_proto; + case BPF_FUNC_tcp_check_syncookie: + return &bpf_tcp_check_syncookie_proto; + case BPF_FUNC_skb_ecn_set_ce: +-- +2.39.2 + diff --git a/queue-5.15/bpf-fix-bpf-socket-lookup-from-tc-xdp-to-respect-soc.patch b/queue-5.15/bpf-fix-bpf-socket-lookup-from-tc-xdp-to-respect-soc.patch new file mode 100644 index 00000000000..666d76954bc --- /dev/null +++ b/queue-5.15/bpf-fix-bpf-socket-lookup-from-tc-xdp-to-respect-soc.patch @@ -0,0 +1,250 @@ +From 473d3543d503c3fa1a803c777174fac71e166128 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 13:42:10 +0300 +Subject: bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings + +From: Gilad Sever + +[ Upstream commit 9a5cb79762e0eda17ca15c2a6eaca4622383c21c ] + +When calling bpf_sk_lookup_tcp(), bpf_sk_lookup_udp() or +bpf_skc_lookup_tcp() from tc/xdp ingress, VRF socket bindings aren't +respoected, i.e. unbound sockets are returned, and bound sockets aren't +found. + +VRF binding is determined by the sdif argument to sk_lookup(), however +when called from tc the IP SKB control block isn't initialized and thus +inet{,6}_sdif() always returns 0. + +Fix by calculating sdif for the tc/xdp flows by observing the device's +l3 enslaved state. + +The cg/sk_skb hooking points which are expected to support +inet{,6}_sdif() pass sdif=-1 which makes __bpf_skc_lookup() use the +existing logic. + +Fixes: 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF") +Signed-off-by: Gilad Sever +Signed-off-by: Daniel Borkmann +Reviewed-by: Shmulik Ladkani +Reviewed-by: Eyal Birger +Acked-by: Stanislav Fomichev +Cc: David Ahern +Link: https://lore.kernel.org/bpf/20230621104211.301902-4-gilad9366@gmail.com +Signed-off-by: Sasha Levin +--- + include/linux/netdevice.h | 9 +++++ + net/core/filter.c | 69 ++++++++++++++++++++++----------------- + 2 files changed, 48 insertions(+), 30 deletions(-) + +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index c0a4589ab706f..b5df2e59a51d3 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -5196,6 +5196,15 @@ static inline bool netif_is_l3_slave(const struct net_device *dev) + return dev->priv_flags & IFF_L3MDEV_SLAVE; + } + ++static inline int dev_sdif(const struct net_device *dev) ++{ ++#ifdef CONFIG_NET_L3_MASTER_DEV ++ if (netif_is_l3_slave(dev)) ++ return dev->ifindex; ++#endif ++ return 0; ++} ++ + static inline bool netif_is_bridge_master(const struct net_device *dev) + { + return dev->priv_flags & IFF_EBRIDGE; +diff --git a/net/core/filter.c b/net/core/filter.c +index 60c1ad379a0b6..18eb8049c795c 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -6174,12 +6174,11 @@ static struct sock *sk_lookup(struct net *net, struct bpf_sock_tuple *tuple, + static struct sock * + __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + struct net *caller_net, u32 ifindex, u8 proto, u64 netns_id, +- u64 flags) ++ u64 flags, int sdif) + { + struct sock *sk = NULL; + struct net *net; + u8 family; +- int sdif; + + if (len == sizeof(tuple->ipv4)) + family = AF_INET; +@@ -6191,10 +6190,12 @@ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + if (unlikely(flags || !((s32)netns_id < 0 || netns_id <= S32_MAX))) + goto out; + +- if (family == AF_INET) +- sdif = inet_sdif(skb); +- else +- sdif = inet6_sdif(skb); ++ if (sdif < 0) { ++ if (family == AF_INET) ++ sdif = inet_sdif(skb); ++ else ++ sdif = inet6_sdif(skb); ++ } + + if ((s32)netns_id < 0) { + net = caller_net; +@@ -6214,10 +6215,11 @@ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + static struct sock * + __bpf_sk_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + struct net *caller_net, u32 ifindex, u8 proto, u64 netns_id, +- u64 flags) ++ u64 flags, int sdif) + { + struct sock *sk = __bpf_skc_lookup(skb, tuple, len, caller_net, +- ifindex, proto, netns_id, flags); ++ ifindex, proto, netns_id, flags, ++ sdif); + + if (sk) { + struct sock *sk2 = sk_to_full_sk(sk); +@@ -6257,7 +6259,7 @@ bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + } + + return __bpf_skc_lookup(skb, tuple, len, caller_net, ifindex, proto, +- netns_id, flags); ++ netns_id, flags, -1); + } + + static struct sock * +@@ -6349,12 +6351,13 @@ static const struct bpf_func_proto bpf_sk_lookup_udp_proto = { + BPF_CALL_5(bpf_tc_skc_lookup_tcp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) + { +- struct net *caller_net = dev_net(skb->dev); +- int ifindex = skb->dev->ifindex; ++ struct net_device *dev = skb->dev; ++ int ifindex = dev->ifindex, sdif = dev_sdif(dev); ++ struct net *caller_net = dev_net(dev); + + return (unsigned long)__bpf_skc_lookup(skb, tuple, len, caller_net, + ifindex, IPPROTO_TCP, netns_id, +- flags); ++ flags, sdif); + } + + static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = { +@@ -6372,12 +6375,13 @@ static const struct bpf_func_proto bpf_tc_skc_lookup_tcp_proto = { + BPF_CALL_5(bpf_tc_sk_lookup_tcp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) + { +- struct net *caller_net = dev_net(skb->dev); +- int ifindex = skb->dev->ifindex; ++ struct net_device *dev = skb->dev; ++ int ifindex = dev->ifindex, sdif = dev_sdif(dev); ++ struct net *caller_net = dev_net(dev); + + return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net, + ifindex, IPPROTO_TCP, netns_id, +- flags); ++ flags, sdif); + } + + static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = { +@@ -6395,12 +6399,13 @@ static const struct bpf_func_proto bpf_tc_sk_lookup_tcp_proto = { + BPF_CALL_5(bpf_tc_sk_lookup_udp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, len, u64, netns_id, u64, flags) + { +- struct net *caller_net = dev_net(skb->dev); +- int ifindex = skb->dev->ifindex; ++ struct net_device *dev = skb->dev; ++ int ifindex = dev->ifindex, sdif = dev_sdif(dev); ++ struct net *caller_net = dev_net(dev); + + return (unsigned long)__bpf_sk_lookup(skb, tuple, len, caller_net, + ifindex, IPPROTO_UDP, netns_id, +- flags); ++ flags, sdif); + } + + static const struct bpf_func_proto bpf_tc_sk_lookup_udp_proto = { +@@ -6432,12 +6437,13 @@ static const struct bpf_func_proto bpf_sk_release_proto = { + BPF_CALL_5(bpf_xdp_sk_lookup_udp, struct xdp_buff *, ctx, + struct bpf_sock_tuple *, tuple, u32, len, u32, netns_id, u64, flags) + { +- struct net *caller_net = dev_net(ctx->rxq->dev); +- int ifindex = ctx->rxq->dev->ifindex; ++ struct net_device *dev = ctx->rxq->dev; ++ int ifindex = dev->ifindex, sdif = dev_sdif(dev); ++ struct net *caller_net = dev_net(dev); + + return (unsigned long)__bpf_sk_lookup(NULL, tuple, len, caller_net, + ifindex, IPPROTO_UDP, netns_id, +- flags); ++ flags, sdif); + } + + static const struct bpf_func_proto bpf_xdp_sk_lookup_udp_proto = { +@@ -6455,12 +6461,13 @@ static const struct bpf_func_proto bpf_xdp_sk_lookup_udp_proto = { + BPF_CALL_5(bpf_xdp_skc_lookup_tcp, struct xdp_buff *, ctx, + struct bpf_sock_tuple *, tuple, u32, len, u32, netns_id, u64, flags) + { +- struct net *caller_net = dev_net(ctx->rxq->dev); +- int ifindex = ctx->rxq->dev->ifindex; ++ struct net_device *dev = ctx->rxq->dev; ++ int ifindex = dev->ifindex, sdif = dev_sdif(dev); ++ struct net *caller_net = dev_net(dev); + + return (unsigned long)__bpf_skc_lookup(NULL, tuple, len, caller_net, + ifindex, IPPROTO_TCP, netns_id, +- flags); ++ flags, sdif); + } + + static const struct bpf_func_proto bpf_xdp_skc_lookup_tcp_proto = { +@@ -6478,12 +6485,13 @@ static const struct bpf_func_proto bpf_xdp_skc_lookup_tcp_proto = { + BPF_CALL_5(bpf_xdp_sk_lookup_tcp, struct xdp_buff *, ctx, + struct bpf_sock_tuple *, tuple, u32, len, u32, netns_id, u64, flags) + { +- struct net *caller_net = dev_net(ctx->rxq->dev); +- int ifindex = ctx->rxq->dev->ifindex; ++ struct net_device *dev = ctx->rxq->dev; ++ int ifindex = dev->ifindex, sdif = dev_sdif(dev); ++ struct net *caller_net = dev_net(dev); + + return (unsigned long)__bpf_sk_lookup(NULL, tuple, len, caller_net, + ifindex, IPPROTO_TCP, netns_id, +- flags); ++ flags, sdif); + } + + static const struct bpf_func_proto bpf_xdp_sk_lookup_tcp_proto = { +@@ -6503,7 +6511,8 @@ BPF_CALL_5(bpf_sock_addr_skc_lookup_tcp, struct bpf_sock_addr_kern *, ctx, + { + return (unsigned long)__bpf_skc_lookup(NULL, tuple, len, + sock_net(ctx->sk), 0, +- IPPROTO_TCP, netns_id, flags); ++ IPPROTO_TCP, netns_id, flags, ++ -1); + } + + static const struct bpf_func_proto bpf_sock_addr_skc_lookup_tcp_proto = { +@@ -6522,7 +6531,7 @@ BPF_CALL_5(bpf_sock_addr_sk_lookup_tcp, struct bpf_sock_addr_kern *, ctx, + { + return (unsigned long)__bpf_sk_lookup(NULL, tuple, len, + sock_net(ctx->sk), 0, IPPROTO_TCP, +- netns_id, flags); ++ netns_id, flags, -1); + } + + static const struct bpf_func_proto bpf_sock_addr_sk_lookup_tcp_proto = { +@@ -6541,7 +6550,7 @@ BPF_CALL_5(bpf_sock_addr_sk_lookup_udp, struct bpf_sock_addr_kern *, ctx, + { + return (unsigned long)__bpf_sk_lookup(NULL, tuple, len, + sock_net(ctx->sk), 0, IPPROTO_UDP, +- netns_id, flags); ++ netns_id, flags, -1); + } + + static const struct bpf_func_proto bpf_sock_addr_sk_lookup_udp_proto = { +-- +2.39.2 + diff --git a/queue-5.15/bpf-omit-superfluous-address-family-check-in-__bpf_s.patch b/queue-5.15/bpf-omit-superfluous-address-family-check-in-__bpf_s.patch new file mode 100644 index 00000000000..a83364119a3 --- /dev/null +++ b/queue-5.15/bpf-omit-superfluous-address-family-check-in-__bpf_s.patch @@ -0,0 +1,49 @@ +From 352f492e855b1d9331d4822fa9389161a0c20afc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 10:26:18 +0200 +Subject: bpf: Omit superfluous address family check in __bpf_skc_lookup + +From: Tobias Klauser + +[ Upstream commit 2064a132c0de3426d5ba43023200994e0c77e652 ] + +family is only set to either AF_INET or AF_INET6 based on len. In all +other cases we return early. Thus the check against AF_UNSPEC can be +omitted. + +Signed-off-by: Tobias Klauser +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20220630082618.15649-1-tklauser@distanz.ch +Stable-dep-of: 9a5cb79762e0 ("bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings") +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 519315a1acf3a..a8291ba156446 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -6177,8 +6177,8 @@ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + u64 flags) + { + struct sock *sk = NULL; +- u8 family = AF_UNSPEC; + struct net *net; ++ u8 family; + int sdif; + + if (len == sizeof(tuple->ipv4)) +@@ -6188,8 +6188,7 @@ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + else + return NULL; + +- if (unlikely(family == AF_UNSPEC || flags || +- !((s32)netns_id < 0 || netns_id <= S32_MAX))) ++ if (unlikely(flags || !((s32)netns_id < 0 || netns_id <= S32_MAX))) + goto out; + + if (family == AF_INET) +-- +2.39.2 + diff --git a/queue-5.15/bpftool-jit-limited-misreported-as-negative-value-on.patch b/queue-5.15/bpftool-jit-limited-misreported-as-negative-value-on.patch new file mode 100644 index 00000000000..f26fd1f2247 --- /dev/null +++ b/queue-5.15/bpftool-jit-limited-misreported-as-negative-value-on.patch @@ -0,0 +1,150 @@ +From e30ffc7f4944f15844f3fa36e7ee237fb16ea4e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 12:31:34 +0100 +Subject: bpftool: JIT limited misreported as negative value on aarch64 + +From: Alan Maguire + +[ Upstream commit 04cb8453a91c7c22f60ddadb6cef0d19abb33bb5 ] + +On aarch64, "bpftool feature" reports an incorrect BPF JIT limit: + +$ sudo /sbin/bpftool feature +Scanning system configuration... +bpf() syscall restricted to privileged users +JIT compiler is enabled +JIT compiler hardening is disabled +JIT compiler kallsyms exports are enabled for root +skipping kernel config, can't open file: No such file or directory +Global memory limit for JIT compiler for unprivileged users is -201326592 bytes + +This is because /proc/sys/net/core/bpf_jit_limit reports + +$ sudo cat /proc/sys/net/core/bpf_jit_limit +68169519595520 + +...and an int is assumed in read_procfs(). Change read_procfs() +to return a long to avoid negative value reporting. + +Fixes: 7a4522bbef0c ("tools: bpftool: add probes for /proc/ eBPF parameters") +Reported-by: Nicky Veitch +Signed-off-by: Alan Maguire +Signed-off-by: Daniel Borkmann +Acked-by: Jiri Olsa +Acked-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20230512113134.58996-1-alan.maguire@oracle.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/feature.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/tools/bpf/bpftool/feature.c b/tools/bpf/bpftool/feature.c +index 7f36385aa9e2e..0c9544c6d3020 100644 +--- a/tools/bpf/bpftool/feature.c ++++ b/tools/bpf/bpftool/feature.c +@@ -135,12 +135,12 @@ static void print_end_section(void) + + /* Probing functions */ + +-static int read_procfs(const char *path) ++static long read_procfs(const char *path) + { + char *endptr, *line = NULL; + size_t len = 0; + FILE *fd; +- int res; ++ long res; + + fd = fopen(path, "r"); + if (!fd) +@@ -162,7 +162,7 @@ static int read_procfs(const char *path) + + static void probe_unprivileged_disabled(void) + { +- int res; ++ long res; + + /* No support for C-style ouptut */ + +@@ -181,14 +181,14 @@ static void probe_unprivileged_disabled(void) + printf("Unable to retrieve required privileges for bpf() syscall\n"); + break; + default: +- printf("bpf() syscall restriction has unknown value %d\n", res); ++ printf("bpf() syscall restriction has unknown value %ld\n", res); + } + } + } + + static void probe_jit_enable(void) + { +- int res; ++ long res; + + /* No support for C-style ouptut */ + +@@ -210,7 +210,7 @@ static void probe_jit_enable(void) + printf("Unable to retrieve JIT-compiler status\n"); + break; + default: +- printf("JIT-compiler status has unknown value %d\n", ++ printf("JIT-compiler status has unknown value %ld\n", + res); + } + } +@@ -218,7 +218,7 @@ static void probe_jit_enable(void) + + static void probe_jit_harden(void) + { +- int res; ++ long res; + + /* No support for C-style ouptut */ + +@@ -240,7 +240,7 @@ static void probe_jit_harden(void) + printf("Unable to retrieve JIT hardening status\n"); + break; + default: +- printf("JIT hardening status has unknown value %d\n", ++ printf("JIT hardening status has unknown value %ld\n", + res); + } + } +@@ -248,7 +248,7 @@ static void probe_jit_harden(void) + + static void probe_jit_kallsyms(void) + { +- int res; ++ long res; + + /* No support for C-style ouptut */ + +@@ -267,14 +267,14 @@ static void probe_jit_kallsyms(void) + printf("Unable to retrieve JIT kallsyms export status\n"); + break; + default: +- printf("JIT kallsyms exports status has unknown value %d\n", res); ++ printf("JIT kallsyms exports status has unknown value %ld\n", res); + } + } + } + + static void probe_jit_limit(void) + { +- int res; ++ long res; + + /* No support for C-style ouptut */ + +@@ -287,7 +287,7 @@ static void probe_jit_limit(void) + printf("Unable to retrieve global memory limit for JIT compiler for unprivileged users\n"); + break; + default: +- printf("Global memory limit for JIT compiler for unprivileged users is %d bytes\n", res); ++ printf("Global memory limit for JIT compiler for unprivileged users is %ld bytes\n", res); + } + } + } +-- +2.39.2 + diff --git a/queue-5.15/bus-ti-sysc-fix-dispc-quirk-masking-bool-variables.patch b/queue-5.15/bus-ti-sysc-fix-dispc-quirk-masking-bool-variables.patch new file mode 100644 index 00000000000..da40feb2084 --- /dev/null +++ b/queue-5.15/bus-ti-sysc-fix-dispc-quirk-masking-bool-variables.patch @@ -0,0 +1,49 @@ +From 693b2d445b340c37ef89f47ca066ddaa405db37a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 10:04:16 +0300 +Subject: bus: ti-sysc: Fix dispc quirk masking bool variables + +From: Tony Lindgren + +[ Upstream commit f620596fa347170852da499e778a5736d79a4b79 ] + +Fix warning drivers/bus/ti-sysc.c:1806 sysc_quirk_dispc() +warn: masking a bool. + +While at it let's add a comment for what were doing to make +the code a bit easier to follow. + +Fixes: 7324a7a0d5e2 ("bus: ti-sysc: Implement display subsystem reset quirk") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/linux-omap/a8ec8a68-9c2c-4076-bf47-09fccce7659f@kili.mountain/ +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index e93912e56f28c..7d508f9050038 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1759,7 +1759,7 @@ static u32 sysc_quirk_dispc(struct sysc *ddata, int dispc_offset, + if (!ddata->module_va) + return -EIO; + +- /* DISP_CONTROL */ ++ /* DISP_CONTROL, shut down lcd and digit on disable if enabled */ + val = sysc_read(ddata, dispc_offset + 0x40); + lcd_en = val & lcd_en_mask; + digit_en = val & digit_en_mask; +@@ -1771,7 +1771,7 @@ static u32 sysc_quirk_dispc(struct sysc *ddata, int dispc_offset, + else + irq_mask |= BIT(2) | BIT(3); /* EVSYNC bits */ + } +- if (disable & (lcd_en | digit_en)) ++ if (disable && (lcd_en || digit_en)) + sysc_write(ddata, dispc_offset + 0x40, + val & ~(lcd_en_mask | digit_en_mask)); + +-- +2.39.2 + diff --git a/queue-5.15/can-length-fix-bitstuffing-count.patch b/queue-5.15/can-length-fix-bitstuffing-count.patch new file mode 100644 index 00000000000..a4fa41ba2e0 --- /dev/null +++ b/queue-5.15/can-length-fix-bitstuffing-count.patch @@ -0,0 +1,123 @@ +From 383bfa43bd472f5a3da3f96b0d8662a712867a31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jun 2023 11:57:26 +0900 +Subject: can: length: fix bitstuffing count + +From: Vincent Mailhol + +[ Upstream commit 9fde4c557f78ee2f3626e92b4089ce9d54a2573a ] + +The Stuff Bit Count is always coded on 4 bits [1]. Update the Stuff +Bit Count size accordingly. + +In addition, the CRC fields of CAN FD Frames contain stuff bits at +fixed positions called fixed stuff bits [2]. The CRC field starts with +a fixed stuff bit and then has another fixed stuff bit after each +fourth bit [2], which allows us to derive this formula: + + FSB count = 1 + round_down(len(CRC field)/4) + +The length of the CRC field is [1]: + + len(CRC field) = len(Stuff Bit Count) + len(CRC) + = 4 + len(CRC) + +with len(CRC) either 17 or 21 bits depending of the payload length. + +In conclusion, for CRC17: + + FSB count = 1 + round_down((4 + 17)/4) + = 6 + +and for CRC 21: + + FSB count = 1 + round_down((4 + 21)/4) + = 7 + +Add a Fixed Stuff bits (FSB) field with above values and update +CANFD_FRAME_OVERHEAD_SFF and CANFD_FRAME_OVERHEAD_EFF accordingly. + +[1] ISO 11898-1:2015 section 10.4.2.6 "CRC field": + + The CRC field shall contain the CRC sequence followed by a recessive + CRC delimiter. For FD Frames, the CRC field shall also contain the + stuff count. + + Stuff count + + If FD Frames, the stuff count shall be at the beginning of the CRC + field. It shall consist of the stuff bit count modulo 8 in a 3-bit + gray code followed by a parity bit [...] + +[2] ISO 11898-1:2015 paragraph 10.5 "Frame coding": + + In the CRC field of FD Frames, the stuff bits shall be inserted at + fixed positions; they are called fixed stuff bits. There shall be a + fixed stuff bit before the first bit of the stuff count, even if the + last bits of the preceding field are a sequence of five consecutive + bits of identical value, there shall be only the fixed stuff bit, + there shall not be two consecutive stuff bits. A further fixed stuff + bit shall be inserted after each fourth bit of the CRC field [...] + +Fixes: 85d99c3e2a13 ("can: length: can_skb_get_frame_len(): introduce function to get data length of frame in data link layer") +Suggested-by: Thomas Kopp +Signed-off-by: Vincent Mailhol +Reviewed-by: Thomas Kopp +Link: https://lore.kernel.org/all/20230611025728.450837-2-mailhol.vincent@wanadoo.fr +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + include/linux/can/length.h | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/include/linux/can/length.h b/include/linux/can/length.h +index 6995092b774ec..ef1fd32cef16b 100644 +--- a/include/linux/can/length.h ++++ b/include/linux/can/length.h +@@ -69,17 +69,18 @@ + * Error Status Indicator (ESI) 1 + * Data length code (DLC) 4 + * Data field 0...512 +- * Stuff Bit Count (SBC) 0...16: 4 20...64:5 ++ * Stuff Bit Count (SBC) 4 + * CRC 0...16: 17 20...64:21 + * CRC delimiter (CD) 1 ++ * Fixed Stuff bits (FSB) 0...16: 6 20...64:7 + * ACK slot (AS) 1 + * ACK delimiter (AD) 1 + * End-of-frame (EOF) 7 + * Inter frame spacing 3 + * +- * assuming CRC21, rounded up and ignoring bitstuffing ++ * assuming CRC21, rounded up and ignoring dynamic bitstuffing + */ +-#define CANFD_FRAME_OVERHEAD_SFF DIV_ROUND_UP(61, 8) ++#define CANFD_FRAME_OVERHEAD_SFF DIV_ROUND_UP(67, 8) + + /* + * Size of a CAN-FD Extended Frame +@@ -98,17 +99,18 @@ + * Error Status Indicator (ESI) 1 + * Data length code (DLC) 4 + * Data field 0...512 +- * Stuff Bit Count (SBC) 0...16: 4 20...64:5 ++ * Stuff Bit Count (SBC) 4 + * CRC 0...16: 17 20...64:21 + * CRC delimiter (CD) 1 ++ * Fixed Stuff bits (FSB) 0...16: 6 20...64:7 + * ACK slot (AS) 1 + * ACK delimiter (AD) 1 + * End-of-frame (EOF) 7 + * Inter frame spacing 3 + * +- * assuming CRC21, rounded up and ignoring bitstuffing ++ * assuming CRC21, rounded up and ignoring dynamic bitstuffing + */ +-#define CANFD_FRAME_OVERHEAD_EFF DIV_ROUND_UP(80, 8) ++#define CANFD_FRAME_OVERHEAD_EFF DIV_ROUND_UP(86, 8) + + /* + * Maximum size of a Classical CAN frame +-- +2.39.2 + diff --git a/queue-5.15/clk-cdce925-check-return-value-of-kasprintf.patch b/queue-5.15/clk-cdce925-check-return-value-of-kasprintf.patch new file mode 100644 index 00000000000..1165eed2c49 --- /dev/null +++ b/queue-5.15/clk-cdce925-check-return-value-of-kasprintf.patch @@ -0,0 +1,63 @@ +From 9c4bef1bf70efe820fafa4b9a26a371b15eb3e19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:07 +0300 +Subject: clk: cdce925: check return value of kasprintf() + +From: Claudiu Beznea + +[ Upstream commit bb7d09ddbf361d51eae46f38e7c8a2b85914ea2a ] + +kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 19fbbbbcd3a3 ("Add TI CDCE925 I2C controlled clock synthesizer driver") +Depends-on: e665f029a283 ("clk: Convert to using %pOFn instead of device_node.name") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-3-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-cdce925.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/clk/clk-cdce925.c b/drivers/clk/clk-cdce925.c +index 308b353815e17..470d91d7314db 100644 +--- a/drivers/clk/clk-cdce925.c ++++ b/drivers/clk/clk-cdce925.c +@@ -705,6 +705,10 @@ static int cdce925_probe(struct i2c_client *client, + for (i = 0; i < data->chip_info->num_plls; ++i) { + pll_clk_name[i] = kasprintf(GFP_KERNEL, "%pOFn.pll%d", + client->dev.of_node, i); ++ if (!pll_clk_name[i]) { ++ err = -ENOMEM; ++ goto error; ++ } + init.name = pll_clk_name[i]; + data->pll[i].chip = data; + data->pll[i].hw.init = &init; +@@ -746,6 +750,10 @@ static int cdce925_probe(struct i2c_client *client, + init.num_parents = 1; + init.parent_names = &parent_name; /* Mux Y1 to input */ + init.name = kasprintf(GFP_KERNEL, "%pOFn.Y1", client->dev.of_node); ++ if (!init.name) { ++ err = -ENOMEM; ++ goto error; ++ } + data->clk[0].chip = data; + data->clk[0].hw.init = &init; + data->clk[0].index = 0; +@@ -764,6 +772,10 @@ static int cdce925_probe(struct i2c_client *client, + for (i = 1; i < data->chip_info->num_outputs; ++i) { + init.name = kasprintf(GFP_KERNEL, "%pOFn.Y%d", + client->dev.of_node, i+1); ++ if (!init.name) { ++ err = -ENOMEM; ++ goto error; ++ } + data->clk[i].chip = data; + data->clk[i].hw.init = &init; + data->clk[i].index = i; +-- +2.39.2 + diff --git a/queue-5.15/clk-clocking-wizard-check-return-value-of-devm_kaspr.patch b/queue-5.15/clk-clocking-wizard-check-return-value-of-devm_kaspr.patch new file mode 100644 index 00000000000..d3d3fac532b --- /dev/null +++ b/queue-5.15/clk-clocking-wizard-check-return-value-of-devm_kaspr.patch @@ -0,0 +1,41 @@ +From 43d0645eab6b643c4b3c2f587320ba8b8f907abe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:13 +0300 +Subject: clk: clocking-wizard: check return value of devm_kasprintf() + +From: Claudiu Beznea + +[ Upstream commit b1356ed1a4461de06dfdc02bf549c3e8750162e5 ] + +devm_kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 2046338dcbc6 ("ARM: mxs: Use soc bus infrastructure") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-9-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c b/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c +index cda1e5be305a4..09a95c02ec5f6 100644 +--- a/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c ++++ b/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c +@@ -645,6 +645,11 @@ static int clk_wzrd_probe(struct platform_device *pdev) + } + + clkout_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_out0", dev_name(&pdev->dev)); ++ if (!clkout_name) { ++ ret = -ENOMEM; ++ goto err_disable_clk; ++ } ++ + if (nr_outputs == 1) { + clk_wzrd->clkout[0] = clk_wzrd_register_divider + (&pdev->dev, clkout_name, +-- +2.39.2 + diff --git a/queue-5.15/clk-clocking-wizard-fix-oops-in-clk_wzrd_register_di.patch b/queue-5.15/clk-clocking-wizard-fix-oops-in-clk_wzrd_register_di.patch new file mode 100644 index 00000000000..cdf4e21129e --- /dev/null +++ b/queue-5.15/clk-clocking-wizard-fix-oops-in-clk_wzrd_register_di.patch @@ -0,0 +1,40 @@ +From eea9f936a802211a56696cc83ef6003f0de0c697 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2023 20:01:20 +0300 +Subject: clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider() + +From: Dan Carpenter + +[ Upstream commit 9c632a6396505a019ea6d12b5ab45e659a542a93 ] + +Smatch detected this potential error pointer dereference +clk_wzrd_register_divider(). If devm_clk_hw_register() fails then +it sets "hw" to an error pointer and then dereferences it on the +next line. Return the error directly instead. + +Fixes: 5a853722eb32 ("staging: clocking-wizard: Add support for dynamic reconfiguration") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/f0e39b5c-4554-41e0-80d9-54ca3fabd060@kili.mountain +Reviewed-by: Michal Simek +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c b/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c +index 39367712ef540..8c1934df70dea 100644 +--- a/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c ++++ b/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c +@@ -347,7 +347,7 @@ static struct clk *clk_wzrd_register_divider(struct device *dev, + hw = &div->hw; + ret = devm_clk_hw_register(dev, hw); + if (ret) +- hw = ERR_PTR(ret); ++ return ERR_PTR(ret); + + return hw->clk; + } +-- +2.39.2 + diff --git a/queue-5.15/clk-clocking-wizard-rename-nr-outputs-to-xlnx-nr-out.patch b/queue-5.15/clk-clocking-wizard-rename-nr-outputs-to-xlnx-nr-out.patch new file mode 100644 index 00000000000..9f1581c981e --- /dev/null +++ b/queue-5.15/clk-clocking-wizard-rename-nr-outputs-to-xlnx-nr-out.patch @@ -0,0 +1,37 @@ +From dffa103f0b6b7b25e958cf2f0c71cb9096d7dfed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 15:34:41 +0530 +Subject: clk: clocking-wizard: Rename nr-outputs to xlnx,nr-outputs + +From: Shubhrajyoti Datta + +[ Upstream commit 787ddddcbc43ab158cc15c36986c2c64b6fc84aa ] + +Rename nr-outputs to xlnx,output. + +Signed-off-by: Shubhrajyoti Datta +Link: https://lore.kernel.org/r/20220411100443.15132-4-shubhrajyoti.datta@xilinx.com +Acked-by: Greg Kroah-Hartman +Signed-off-by: Stephen Boyd +Stable-dep-of: b1356ed1a446 ("clk: clocking-wizard: check return value of devm_kasprintf()") +Signed-off-by: Sasha Levin +--- + drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c b/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c +index 8c1934df70dea..e5c5a7c25bbc9 100644 +--- a/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c ++++ b/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c +@@ -479,7 +479,7 @@ static int clk_wzrd_probe(struct platform_device *pdev) + goto err_disable_clk; + } + +- ret = of_property_read_u32(np, "nr-outputs", &nr_outputs); ++ ret = of_property_read_u32(np, "xlnx,nr-outputs", &nr_outputs); + if (ret || nr_outputs > WZRD_NUM_OUTPUTS) { + ret = -EINVAL; + goto err_disable_clk; +-- +2.39.2 + diff --git a/queue-5.15/clk-fix-memory-leak-in-devm_clk_notifier_register.patch b/queue-5.15/clk-fix-memory-leak-in-devm_clk_notifier_register.patch new file mode 100644 index 00000000000..d67dbd8e146 --- /dev/null +++ b/queue-5.15/clk-fix-memory-leak-in-devm_clk_notifier_register.patch @@ -0,0 +1,42 @@ +From 2d217d9280192df0254550e9bdeec25516adbd6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 11:22:53 +0800 +Subject: clk: Fix memory leak in devm_clk_notifier_register() + +From: Fei Shao + +[ Upstream commit 7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff ] + +devm_clk_notifier_register() allocates a devres resource for clk +notifier but didn't register that to the device, so the notifier didn't +get unregistered on device detach and the allocated resource was leaked. + +Fix the issue by registering the resource through devres_add(). + +This issue was found with kmemleak on a Chromebook. + +Fixes: 6d30d50d037d ("clk: add devm variant of clk_notifier_register") +Signed-off-by: Fei Shao +Link: https://lore.kernel.org/r/20230619112253.v2.1.I13f060c10549ef181603e921291bdea95f83033c@changeid +Reviewed-by: Dan Carpenter +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 0674dbc62eb55..5eba83745d8de 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -4504,6 +4504,7 @@ int devm_clk_notifier_register(struct device *dev, struct clk *clk, + if (!ret) { + devres->clk = clk; + devres->nb = nb; ++ devres_add(dev, devres); + } else { + devres_free(devres); + } +-- +2.39.2 + diff --git a/queue-5.15/clk-imx-clk-imx8mn-fix-memory-leak-in-imx8mn_clocks_.patch b/queue-5.15/clk-imx-clk-imx8mn-fix-memory-leak-in-imx8mn_clocks_.patch new file mode 100644 index 00000000000..2816353c7e1 --- /dev/null +++ b/queue-5.15/clk-imx-clk-imx8mn-fix-memory-leak-in-imx8mn_clocks_.patch @@ -0,0 +1,58 @@ +From f9371c4cabe17c1c524bd51232af263571b9b13d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 09:51:07 +0800 +Subject: clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe + +From: Hao Luo + +[ Upstream commit 188d070de9132667956f5aadd98d2bd87d3eac89 ] + +Use devm_of_iomap() instead of of_iomap() to automatically handle +the unused ioremap region. + +If any error occurs, regions allocated by kzalloc() will leak, +but using devm_kzalloc() instead will automatically free the memory +using devm_kfree(). + +Fixes: daeb14545514 ("clk: imx: imx8mn: Switch to clk_hw based API") +Fixes: 96d6392b54db ("clk: imx: Add support for i.MX8MN clock driver") +Signed-off-by: Hao Luo +Reviewed-by: Dongliang Mu +Reviewed-by: Peng Fan +Link: https://lore.kernel.org/r/20230411015107.2645-1-m202171776@hust.edu.cn +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8mn.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx8mn.c b/drivers/clk/imx/clk-imx8mn.c +index 52903146fdbaf..4499da4154f06 100644 +--- a/drivers/clk/imx/clk-imx8mn.c ++++ b/drivers/clk/imx/clk-imx8mn.c +@@ -299,7 +299,7 @@ static int imx8mn_clocks_probe(struct platform_device *pdev) + void __iomem *base; + int ret; + +- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, ++ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws, + IMX8MN_CLK_END), GFP_KERNEL); + if (WARN_ON(!clk_hw_data)) + return -ENOMEM; +@@ -316,10 +316,10 @@ static int imx8mn_clocks_probe(struct platform_device *pdev) + hws[IMX8MN_CLK_EXT4] = imx_obtain_fixed_clk_hw(np, "clk_ext4"); + + np = of_find_compatible_node(NULL, NULL, "fsl,imx8mn-anatop"); +- base = of_iomap(np, 0); ++ base = devm_of_iomap(dev, np, 0, NULL); + of_node_put(np); +- if (WARN_ON(!base)) { +- ret = -ENOMEM; ++ if (WARN_ON(IS_ERR(base))) { ++ ret = PTR_ERR(base); + goto unregister_hws; + } + +-- +2.39.2 + diff --git a/queue-5.15/clk-imx-clk-imx8mp-improve-error-handling-in-imx8mp_.patch b/queue-5.15/clk-imx-clk-imx8mp-improve-error-handling-in-imx8mp_.patch new file mode 100644 index 00000000000..19e09bfadcb --- /dev/null +++ b/queue-5.15/clk-imx-clk-imx8mp-improve-error-handling-in-imx8mp_.patch @@ -0,0 +1,85 @@ +From ca23fff736235e80a8309586071a0c0db0ff618e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 07:06:07 +0000 +Subject: clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() + +From: Yuxing Liu + +[ Upstream commit 878b02d5f3b56cb090dbe2c70c89273be144087f ] + +Replace of_iomap() and kzalloc() with devm_of_iomap() and devm_kzalloc() +which can automatically release the related memory when the device +or driver is removed or unloaded to avoid potential memory leak. + +In this case, iounmap(anatop_base) in line 427,433 are removed +as manual release is not required. + +Besides, referring to clk-imx8mq.c, check the return code of +of_clk_add_hw_provider, if it returns negtive, print error info +and unregister hws, which makes the program more robust. + +Fixes: 9c140d992676 ("clk: imx: Add support for i.MX8MP clock driver") +Signed-off-by: Yuxing Liu +Reviewed-by: Dongliang Mu +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20230503070607.2462-1-lyx2022@hust.edu.cn +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8mp.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c +index b173c30093946..0191457fb3cfc 100644 +--- a/drivers/clk/imx/clk-imx8mp.c ++++ b/drivers/clk/imx/clk-imx8mp.c +@@ -407,25 +407,22 @@ static int imx8mp_clocks_probe(struct platform_device *pdev) + struct device *dev = &pdev->dev; + struct device_node *np; + void __iomem *anatop_base, *ccm_base; ++ int err; + + np = of_find_compatible_node(NULL, NULL, "fsl,imx8mp-anatop"); +- anatop_base = of_iomap(np, 0); ++ anatop_base = devm_of_iomap(dev, np, 0, NULL); + of_node_put(np); +- if (WARN_ON(!anatop_base)) +- return -ENOMEM; ++ if (WARN_ON(IS_ERR(anatop_base))) ++ return PTR_ERR(anatop_base); + + np = dev->of_node; + ccm_base = devm_platform_ioremap_resource(pdev, 0); +- if (WARN_ON(IS_ERR(ccm_base))) { +- iounmap(anatop_base); ++ if (WARN_ON(IS_ERR(ccm_base))) + return PTR_ERR(ccm_base); +- } + +- clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, IMX8MP_CLK_END), GFP_KERNEL); +- if (WARN_ON(!clk_hw_data)) { +- iounmap(anatop_base); ++ clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws, IMX8MP_CLK_END), GFP_KERNEL); ++ if (WARN_ON(!clk_hw_data)) + return -ENOMEM; +- } + + clk_hw_data->num = IMX8MP_CLK_END; + hws = clk_hw_data->hws; +@@ -710,7 +707,12 @@ static int imx8mp_clocks_probe(struct platform_device *pdev) + + imx_check_clk_hws(hws, IMX8MP_CLK_END); + +- of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data); ++ err = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data); ++ if (err < 0) { ++ dev_err(dev, "failed to register hws for i.MX8MP\n"); ++ imx_unregister_hw_clocks(hws, IMX8MP_CLK_END); ++ return err; ++ } + + imx_register_uart_clocks(4); + +-- +2.39.2 + diff --git a/queue-5.15/clk-imx-scu-use-_safe-list-iterator-to-avoid-a-use-a.patch b/queue-5.15/clk-imx-scu-use-_safe-list-iterator-to-avoid-a-use-a.patch new file mode 100644 index 00000000000..86dd70fda57 --- /dev/null +++ b/queue-5.15/clk-imx-scu-use-_safe-list-iterator-to-avoid-a-use-a.patch @@ -0,0 +1,44 @@ +From bf15436628fed417d99db816626fb64ba011b5d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 17:23:01 +0300 +Subject: clk: imx: scu: use _safe list iterator to avoid a use after free + +From: Dan Carpenter + +[ Upstream commit 632c60ecd25dbacee54d5581fe3aeb834b57010a ] + +This loop is freeing "clk" so it needs to use list_for_each_entry_safe(). +Otherwise it dereferences a freed variable to get the next item on the +loop. + +Fixes: 77d8f3068c63 ("clk: imx: scu: add two cells binding support") +Signed-off-by: Dan Carpenter +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/0793fbd1-d2b5-4ec2-9403-3c39343a3e2d@kili.mountain +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-scu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c +index dc933fd5d5a0f..1cee88b073fa2 100644 +--- a/drivers/clk/imx/clk-scu.c ++++ b/drivers/clk/imx/clk-scu.c +@@ -702,11 +702,11 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name, + + void imx_clk_scu_unregister(void) + { +- struct imx_scu_clk_node *clk; ++ struct imx_scu_clk_node *clk, *n; + int i; + + for (i = 0; i < IMX_SC_R_LAST; i++) { +- list_for_each_entry(clk, &imx_scu_clks[i], node) { ++ list_for_each_entry_safe(clk, n, &imx_scu_clks[i], node) { + clk_hw_unregister(clk->hw); + kfree(clk); + } +-- +2.39.2 + diff --git a/queue-5.15/clk-keystone-sci-clk-check-return-value-of-kasprintf.patch b/queue-5.15/clk-keystone-sci-clk-check-return-value-of-kasprintf.patch new file mode 100644 index 00000000000..a5d9086c079 --- /dev/null +++ b/queue-5.15/clk-keystone-sci-clk-check-return-value-of-kasprintf.patch @@ -0,0 +1,40 @@ +From 77555af673eb1227a14fea42738b00adf7fee51d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:11 +0300 +Subject: clk: keystone: sci-clk: check return value of kasprintf() + +From: Claudiu Beznea + +[ Upstream commit b73ed981da6d25c921aaefa7ca3df85bbd85b7fc ] + +kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: b745c0794e2f ("clk: keystone: Add sci-clk driver support") +Depends-on: 96488c09b0f4 ("clk: keystone: sci-clk: cut down the clock name length") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-7-claudiu.beznea@microchip.com +Reviewed-by: Tony Lindgren +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/keystone/sci-clk.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/keystone/sci-clk.c b/drivers/clk/keystone/sci-clk.c +index 7e1b136e71ae0..8af2a9faa805a 100644 +--- a/drivers/clk/keystone/sci-clk.c ++++ b/drivers/clk/keystone/sci-clk.c +@@ -302,6 +302,8 @@ static int _sci_clk_build(struct sci_clk_provider *provider, + + name = kasprintf(GFP_KERNEL, "clk:%d:%d", sci_clk->dev_id, + sci_clk->clk_id); ++ if (!name) ++ return -ENOMEM; + + init.name = name; + +-- +2.39.2 + diff --git a/queue-5.15/clk-si5341-check-return-value-of-devm_-kasprintf.patch b/queue-5.15/clk-si5341-check-return-value-of-devm_-kasprintf.patch new file mode 100644 index 00000000000..3bf1fa373ce --- /dev/null +++ b/queue-5.15/clk-si5341-check-return-value-of-devm_-kasprintf.patch @@ -0,0 +1,51 @@ +From d8a58c70b4d937f2151092f15f37a1d4cc18f796 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:09 +0300 +Subject: clk: si5341: check return value of {devm_}kasprintf() + +From: Claudiu Beznea + +[ Upstream commit 36e4ef82016a2b785cf2317eade77e76699b7bff ] + +{devm_}kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-5-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-si5341.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index 883a49a0805c9..4bcfb38cfbebe 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -1698,6 +1698,10 @@ static int si5341_probe(struct i2c_client *client, + for (i = 0; i < data->num_synth; ++i) { + synth_clock_names[i] = devm_kasprintf(&client->dev, GFP_KERNEL, + "%s.N%u", client->dev.of_node->name, i); ++ if (!synth_clock_names[i]) { ++ err = -ENOMEM; ++ goto free_clk_names; ++ } + init.name = synth_clock_names[i]; + data->synth[i].index = i; + data->synth[i].data = data; +@@ -1716,6 +1720,10 @@ static int si5341_probe(struct i2c_client *client, + for (i = 0; i < data->num_outputs; ++i) { + init.name = kasprintf(GFP_KERNEL, "%s.%d", + client->dev.of_node->name, i); ++ if (!init.name) { ++ err = -ENOMEM; ++ goto free_clk_names; ++ } + init.flags = config[i].synth_master ? CLK_SET_RATE_PARENT : 0; + data->clk[i].index = i; + data->clk[i].data = data; +-- +2.39.2 + diff --git a/queue-5.15/clk-si5341-free-unused-memory-on-probe-failure.patch b/queue-5.15/clk-si5341-free-unused-memory-on-probe-failure.patch new file mode 100644 index 00000000000..7cff7b20f7d --- /dev/null +++ b/queue-5.15/clk-si5341-free-unused-memory-on-probe-failure.patch @@ -0,0 +1,86 @@ +From f8fe84f4fa058f530c107bceaf8ab970df23a763 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:10 +0300 +Subject: clk: si5341: free unused memory on probe failure + +From: Claudiu Beznea + +[ Upstream commit 267ad94b13c53d8c99a336f0841b1fa1595b1d0f ] + +Pointers from synth_clock_names[] should be freed at the end of probe +either on probe success or failure path. + +Fixes: b7bbf6ec4940 ("clk: si5341: Allow different output VDD_SEL values") +Fixes: 9b13ff4340df ("clk: si5341: Add sysfs properties to allow checking/resetting device faults") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-6-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-si5341.c | 16 +++++++--------- + 1 file changed, 7 insertions(+), 9 deletions(-) + +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index 4bcfb38cfbebe..91a6bc74ebd5a 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -1745,7 +1745,7 @@ static int si5341_probe(struct i2c_client *client, + if (err) { + dev_err(&client->dev, + "output %u registration failed\n", i); +- goto cleanup; ++ goto free_clk_names; + } + if (config[i].always_on) + clk_prepare(data->clk[i].hw.clk); +@@ -1755,7 +1755,7 @@ static int si5341_probe(struct i2c_client *client, + data); + if (err) { + dev_err(&client->dev, "unable to add clk provider\n"); +- goto cleanup; ++ goto free_clk_names; + } + + if (initialization_required) { +@@ -1763,11 +1763,11 @@ static int si5341_probe(struct i2c_client *client, + regcache_cache_only(data->regmap, false); + err = regcache_sync(data->regmap); + if (err < 0) +- goto cleanup; ++ goto free_clk_names; + + err = si5341_finalize_defaults(data); + if (err < 0) +- goto cleanup; ++ goto free_clk_names; + } + + /* wait for device to report input clock present and PLL lock */ +@@ -1776,21 +1776,19 @@ static int si5341_probe(struct i2c_client *client, + 10000, 250000); + if (err) { + dev_err(&client->dev, "Error waiting for input clock or PLL lock\n"); +- goto cleanup; ++ goto free_clk_names; + } + + /* clear sticky alarm bits from initialization */ + err = regmap_write(data->regmap, SI5341_STATUS_STICKY, 0); + if (err) { + dev_err(&client->dev, "unable to clear sticky status\n"); +- goto cleanup; ++ goto free_clk_names; + } + + err = sysfs_create_files(&client->dev.kobj, si5341_attributes); +- if (err) { ++ if (err) + dev_err(&client->dev, "unable to create sysfs files\n"); +- goto cleanup; +- } + + free_clk_names: + /* Free the names, clk framework makes copies */ +-- +2.39.2 + diff --git a/queue-5.15/clk-si5341-return-error-if-one-synth-clock-registrat.patch b/queue-5.15/clk-si5341-return-error-if-one-synth-clock-registrat.patch new file mode 100644 index 00000000000..8fee2effec0 --- /dev/null +++ b/queue-5.15/clk-si5341-return-error-if-one-synth-clock-registrat.patch @@ -0,0 +1,72 @@ +From add9bf30690e409f2096e3c0ee3dd7e1b6cf7f94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:08 +0300 +Subject: clk: si5341: return error if one synth clock registration fails + +From: Claudiu Beznea + +[ Upstream commit 2560114c06d7a752b3f4639f28cece58fed11267 ] + +In case devm_clk_hw_register() fails for one of synth clocks the probe +continues. Later on, when registering output clocks which have as parents +all the synth clocks, in case there is registration failure for at least +one synth clock the information passed to clk core for registering output +clock is not right: init.num_parents is fixed but init.parents may contain +an array with less parents. + +Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-4-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-si5341.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index 4de098b6b0d4e..883a49a0805c9 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -1554,7 +1554,7 @@ static int si5341_probe(struct i2c_client *client, + struct clk_init_data init; + struct clk *input; + const char *root_clock_name; +- const char *synth_clock_names[SI5341_NUM_SYNTH]; ++ const char *synth_clock_names[SI5341_NUM_SYNTH] = { NULL }; + int err; + unsigned int i; + struct clk_si5341_output_config config[SI5341_MAX_NUM_OUTPUTS]; +@@ -1706,6 +1706,7 @@ static int si5341_probe(struct i2c_client *client, + if (err) { + dev_err(&client->dev, + "synth N%u registration failed\n", i); ++ goto free_clk_names; + } + } + +@@ -1783,16 +1784,17 @@ static int si5341_probe(struct i2c_client *client, + goto cleanup; + } + ++free_clk_names: + /* Free the names, clk framework makes copies */ + for (i = 0; i < data->num_synth; ++i) + devm_kfree(&client->dev, (void *)synth_clock_names[i]); + +- return 0; +- + cleanup: +- for (i = 0; i < SI5341_MAX_NUM_OUTPUTS; ++i) { +- if (data->clk[i].vddo_reg) +- regulator_disable(data->clk[i].vddo_reg); ++ if (err) { ++ for (i = 0; i < SI5341_MAX_NUM_OUTPUTS; ++i) { ++ if (data->clk[i].vddo_reg) ++ regulator_disable(data->clk[i].vddo_reg); ++ } + } + return err; + } +-- +2.39.2 + diff --git a/queue-5.15/clk-tegra-tegra124-emc-fix-potential-memory-leak.patch b/queue-5.15/clk-tegra-tegra124-emc-fix-potential-memory-leak.patch new file mode 100644 index 00000000000..a8b425da1a0 --- /dev/null +++ b/queue-5.15/clk-tegra-tegra124-emc-fix-potential-memory-leak.patch @@ -0,0 +1,45 @@ +From 6c07fd3af0afc2973d0d7b9fb46a40e6ccdc6a0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Dec 2022 09:41:24 +0000 +Subject: clk: tegra: tegra124-emc: Fix potential memory leak + +From: Yuan Can + +[ Upstream commit 53a06e5924c0d43c11379a08c5a78529c3e61595 ] + +The tegra and tegra needs to be freed in the error handling path, otherwise +it will be leaked. + +Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver") +Signed-off-by: Yuan Can +Link: https://lore.kernel.org/r/20221209094124.71043-1-yuancan@huawei.com +Acked-by: Thierry Reding +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-tegra124-emc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c +index 219c80653dbdb..2a6db04342815 100644 +--- a/drivers/clk/tegra/clk-tegra124-emc.c ++++ b/drivers/clk/tegra/clk-tegra124-emc.c +@@ -464,6 +464,7 @@ static int load_timings_from_dt(struct tegra_clk_emc *tegra, + err = load_one_timing_from_dt(tegra, timing, child); + if (err) { + of_node_put(child); ++ kfree(tegra->timings); + return err; + } + +@@ -515,6 +516,7 @@ struct clk *tegra124_clk_register_emc(void __iomem *base, struct device_node *np + err = load_timings_from_dt(tegra, node, node_ram_code); + if (err) { + of_node_put(node); ++ kfree(tegra); + return ERR_PTR(err); + } + } +-- +2.39.2 + diff --git a/queue-5.15/clk-ti-clkctrl-check-return-value-of-kasprintf.patch b/queue-5.15/clk-ti-clkctrl-check-return-value-of-kasprintf.patch new file mode 100644 index 00000000000..7370ca1e9ac --- /dev/null +++ b/queue-5.15/clk-ti-clkctrl-check-return-value-of-kasprintf.patch @@ -0,0 +1,52 @@ +From 3a1aca8ce860e5131ca3b6cbf866d9db13502a35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:12 +0300 +Subject: clk: ti: clkctrl: check return value of kasprintf() + +From: Claudiu Beznea + +[ Upstream commit bd46cd0b802d9c9576ca78007aa084ae3e74907b ] + +kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 852049594b9a ("clk: ti: clkctrl: convert subclocks to use proper names also") +Fixes: 6c3090520554 ("clk: ti: clkctrl: Fix hidden dependency to node name") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-8-claudiu.beznea@microchip.com +Reviewed-by: Tony Lindgren +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clkctrl.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c +index 864c484bde1b4..157abc46dcf44 100644 +--- a/drivers/clk/ti/clkctrl.c ++++ b/drivers/clk/ti/clkctrl.c +@@ -267,6 +267,9 @@ static const char * __init clkctrl_get_clock_name(struct device_node *np, + if (clkctrl_name && !legacy_naming) { + clock_name = kasprintf(GFP_KERNEL, "%s-clkctrl:%04x:%d", + clkctrl_name, offset, index); ++ if (!clock_name) ++ return NULL; ++ + strreplace(clock_name, '_', '-'); + + return clock_name; +@@ -598,6 +601,10 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node) + if (clkctrl_name) { + provider->clkdm_name = kasprintf(GFP_KERNEL, + "%s_clkdm", clkctrl_name); ++ if (!provider->clkdm_name) { ++ kfree(provider); ++ return; ++ } + goto clkdm_found; + } + +-- +2.39.2 + diff --git a/queue-5.15/clk-vc5-check-memory-returned-by-kasprintf.patch b/queue-5.15/clk-vc5-check-memory-returned-by-kasprintf.patch new file mode 100644 index 00000000000..0ea4006d35a --- /dev/null +++ b/queue-5.15/clk-vc5-check-memory-returned-by-kasprintf.patch @@ -0,0 +1,108 @@ +From 142853bd88e978c61a7712bfe5929e688c356884 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 12:39:06 +0300 +Subject: clk: vc5: check memory returned by kasprintf() + +From: Claudiu Beznea + +[ Upstream commit 144601f6228de5598f03e693822b60a95c367a17 ] + +kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: f491276a5168 ("clk: vc5: Allow Versaclock driver to support multiple instances") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230530093913.1656095-2-claudiu.beznea@microchip.com +Reviewed-by: Luca Ceresoli +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-versaclock5.c | 29 +++++++++++++++++++++++++++++ + 1 file changed, 29 insertions(+) + +diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c +index 5f8bd49b0810c..c52f02471bb4f 100644 +--- a/drivers/clk/clk-versaclock5.c ++++ b/drivers/clk/clk-versaclock5.c +@@ -992,6 +992,11 @@ static int vc5_probe(struct i2c_client *client, const struct i2c_device_id *id) + } + + init.name = kasprintf(GFP_KERNEL, "%pOFn.mux", client->dev.of_node); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } ++ + init.ops = &vc5_mux_ops; + init.flags = 0; + init.parent_names = parent_names; +@@ -1006,6 +1011,10 @@ static int vc5_probe(struct i2c_client *client, const struct i2c_device_id *id) + memset(&init, 0, sizeof(init)); + init.name = kasprintf(GFP_KERNEL, "%pOFn.dbl", + client->dev.of_node); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } + init.ops = &vc5_dbl_ops; + init.flags = CLK_SET_RATE_PARENT; + init.parent_names = parent_names; +@@ -1021,6 +1030,10 @@ static int vc5_probe(struct i2c_client *client, const struct i2c_device_id *id) + /* Register PFD */ + memset(&init, 0, sizeof(init)); + init.name = kasprintf(GFP_KERNEL, "%pOFn.pfd", client->dev.of_node); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } + init.ops = &vc5_pfd_ops; + init.flags = CLK_SET_RATE_PARENT; + init.parent_names = parent_names; +@@ -1038,6 +1051,10 @@ static int vc5_probe(struct i2c_client *client, const struct i2c_device_id *id) + /* Register PLL */ + memset(&init, 0, sizeof(init)); + init.name = kasprintf(GFP_KERNEL, "%pOFn.pll", client->dev.of_node); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } + init.ops = &vc5_pll_ops; + init.flags = CLK_SET_RATE_PARENT; + init.parent_names = parent_names; +@@ -1057,6 +1074,10 @@ static int vc5_probe(struct i2c_client *client, const struct i2c_device_id *id) + memset(&init, 0, sizeof(init)); + init.name = kasprintf(GFP_KERNEL, "%pOFn.fod%d", + client->dev.of_node, idx); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } + init.ops = &vc5_fod_ops; + init.flags = CLK_SET_RATE_PARENT; + init.parent_names = parent_names; +@@ -1075,6 +1096,10 @@ static int vc5_probe(struct i2c_client *client, const struct i2c_device_id *id) + memset(&init, 0, sizeof(init)); + init.name = kasprintf(GFP_KERNEL, "%pOFn.out0_sel_i2cb", + client->dev.of_node); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } + init.ops = &vc5_clk_out_ops; + init.flags = CLK_SET_RATE_PARENT; + init.parent_names = parent_names; +@@ -1101,6 +1126,10 @@ static int vc5_probe(struct i2c_client *client, const struct i2c_device_id *id) + memset(&init, 0, sizeof(init)); + init.name = kasprintf(GFP_KERNEL, "%pOFn.out%d", + client->dev.of_node, idx + 1); ++ if (!init.name) { ++ ret = -ENOMEM; ++ goto err_clk; ++ } + init.ops = &vc5_clk_out_ops; + init.flags = CLK_SET_RATE_PARENT; + init.parent_names = parent_names; +-- +2.39.2 + diff --git a/queue-5.15/clocking-wizard-support-higher-frequency-accuracy.patch b/queue-5.15/clocking-wizard-support-higher-frequency-accuracy.patch new file mode 100644 index 00000000000..a5774e7259e --- /dev/null +++ b/queue-5.15/clocking-wizard-support-higher-frequency-accuracy.patch @@ -0,0 +1,414 @@ +From 23721925927e8c4ea6a163f54f4fd7d2d1006f43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Mar 2023 11:56:37 +0530 +Subject: clocking-wizard: Support higher frequency accuracy + +From: Shubhrajyoti Datta + +[ Upstream commit 595c88cda65d30c6b36277c232193295a45406dc ] + +Change the multipliers and divisors to support a higher +frequency accuracy if there is only one output. +Currently only O is changed now we are changing M, D and O. +For multiple output case the earlier behavior is retained. + +Signed-off-by: Shubhrajyoti Datta +Link: https://lore.kernel.org/r/20230327062637.22237-1-shubhrajyoti.datta@amd.com +Signed-off-by: Stephen Boyd +Stable-dep-of: b1356ed1a446 ("clk: clocking-wizard: check return value of devm_kasprintf()") +Signed-off-by: Sasha Levin +--- + .../clocking-wizard/clk-xlnx-clock-wizard.c | 228 ++++++++++++++++-- + 1 file changed, 204 insertions(+), 24 deletions(-) + +diff --git a/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c b/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c +index e5c5a7c25bbc9..cda1e5be305a4 100644 +--- a/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c ++++ b/drivers/staging/clocking-wizard/clk-xlnx-clock-wizard.c +@@ -7,12 +7,14 @@ + * Sören Brinkmann + */ + ++#include + #include + #include + #include + #include + #include + #include ++#include + #include + #include + #include +@@ -36,6 +38,7 @@ + #define WZRD_CLKOUT_DIVIDE_MASK (0xff << WZRD_DIVCLK_DIVIDE_SHIFT) + #define WZRD_CLKOUT_FRAC_SHIFT 8 + #define WZRD_CLKOUT_FRAC_MASK 0x3ff ++#define WZRD_CLKOUT0_FRAC_MASK GENMASK(17, 8) + + #define WZRD_DR_MAX_INT_DIV_VALUE 255 + #define WZRD_DR_STATUS_REG_OFFSET 0x04 +@@ -46,6 +49,22 @@ + + #define WZRD_USEC_POLL 10 + #define WZRD_TIMEOUT_POLL 1000 ++ ++/* Divider limits, from UG572 Table 3-4 for Ultrascale+ */ ++#define DIV_O 0x01 ++#define DIV_ALL 0x03 ++ ++#define WZRD_M_MIN 2 ++#define WZRD_M_MAX 128 ++#define WZRD_D_MIN 1 ++#define WZRD_D_MAX 106 ++#define WZRD_VCO_MIN 800000000 ++#define WZRD_VCO_MAX 1600000000 ++#define WZRD_O_MIN 1 ++#define WZRD_O_MAX 128 ++#define WZRD_MIN_ERR 20000 ++#define WZRD_FRAC_POINTS 1000 ++ + /* Get the mask from width */ + #define div_mask(width) ((1 << (width)) - 1) + +@@ -94,6 +113,9 @@ struct clk_wzrd { + * @width: width of the divider bit field + * @flags: clk_wzrd divider flags + * @table: array of value/divider pairs, last entry should have div = 0 ++ * @m: value of the multiplier ++ * @d: value of the common divider ++ * @o: value of the leaf divider + * @lock: register lock + */ + struct clk_wzrd_divider { +@@ -104,6 +126,9 @@ struct clk_wzrd_divider { + u8 width; + u8 flags; + const struct clk_div_table *table; ++ u32 m; ++ u32 d; ++ u32 o; + spinlock_t *lock; /* divider lock */ + }; + +@@ -193,12 +218,155 @@ static long clk_wzrd_round_rate(struct clk_hw *hw, unsigned long rate, + return *prate / div; + } + ++static int clk_wzrd_get_divisors(struct clk_hw *hw, unsigned long rate, ++ unsigned long parent_rate) ++{ ++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw); ++ unsigned long vco_freq, freq, diff; ++ u32 m, d, o; ++ ++ for (m = WZRD_M_MIN; m <= WZRD_M_MAX; m++) { ++ for (d = WZRD_D_MIN; d <= WZRD_D_MAX; d++) { ++ vco_freq = DIV_ROUND_CLOSEST((parent_rate * m), d); ++ if (vco_freq >= WZRD_VCO_MIN && vco_freq <= WZRD_VCO_MAX) { ++ for (o = WZRD_O_MIN; o <= WZRD_O_MAX; o++) { ++ freq = DIV_ROUND_CLOSEST_ULL(vco_freq, o); ++ diff = abs(freq - rate); ++ ++ if (diff < WZRD_MIN_ERR) { ++ divider->m = m; ++ divider->d = d; ++ divider->o = o; ++ return 0; ++ } ++ } ++ } ++ } ++ } ++ return -EBUSY; ++} ++ ++static int clk_wzrd_dynamic_all_nolock(struct clk_hw *hw, unsigned long rate, ++ unsigned long parent_rate) ++{ ++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw); ++ unsigned long vco_freq, rate_div, clockout0_div; ++ u32 reg, pre, value, f; ++ int err; ++ ++ err = clk_wzrd_get_divisors(hw, rate, parent_rate); ++ if (err) ++ return err; ++ ++ vco_freq = DIV_ROUND_CLOSEST(parent_rate * divider->m, divider->d); ++ rate_div = DIV_ROUND_CLOSEST_ULL((vco_freq * WZRD_FRAC_POINTS), rate); ++ ++ clockout0_div = div_u64(rate_div, WZRD_FRAC_POINTS); ++ ++ pre = DIV_ROUND_CLOSEST_ULL(vco_freq * WZRD_FRAC_POINTS, rate); ++ f = (pre - (clockout0_div * WZRD_FRAC_POINTS)); ++ f &= WZRD_CLKOUT_FRAC_MASK; ++ ++ reg = FIELD_PREP(WZRD_CLKOUT_DIVIDE_MASK, clockout0_div) | ++ FIELD_PREP(WZRD_CLKOUT0_FRAC_MASK, f); ++ ++ writel(reg, divider->base + WZRD_CLK_CFG_REG(2)); ++ /* Set divisor and clear phase offset */ ++ reg = FIELD_PREP(WZRD_CLKFBOUT_MULT_MASK, divider->m) | ++ FIELD_PREP(WZRD_DIVCLK_DIVIDE_MASK, divider->d); ++ writel(reg, divider->base + WZRD_CLK_CFG_REG(0)); ++ writel(divider->o, divider->base + WZRD_CLK_CFG_REG(2)); ++ writel(0, divider->base + WZRD_CLK_CFG_REG(3)); ++ /* Check status register */ ++ err = readl_poll_timeout(divider->base + WZRD_DR_STATUS_REG_OFFSET, value, ++ value & WZRD_DR_LOCK_BIT_MASK, ++ WZRD_USEC_POLL, WZRD_TIMEOUT_POLL); ++ if (err) ++ return -ETIMEDOUT; ++ ++ /* Initiate reconfiguration */ ++ writel(WZRD_DR_BEGIN_DYNA_RECONF, ++ divider->base + WZRD_DR_INIT_REG_OFFSET); ++ ++ /* Check status register */ ++ return readl_poll_timeout(divider->base + WZRD_DR_STATUS_REG_OFFSET, value, ++ value & WZRD_DR_LOCK_BIT_MASK, ++ WZRD_USEC_POLL, WZRD_TIMEOUT_POLL); ++} ++ ++static int clk_wzrd_dynamic_all(struct clk_hw *hw, unsigned long rate, ++ unsigned long parent_rate) ++{ ++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw); ++ unsigned long flags = 0; ++ int ret; ++ ++ spin_lock_irqsave(divider->lock, flags); ++ ++ ret = clk_wzrd_dynamic_all_nolock(hw, rate, parent_rate); ++ ++ spin_unlock_irqrestore(divider->lock, flags); ++ ++ return ret; ++} ++ ++static unsigned long clk_wzrd_recalc_rate_all(struct clk_hw *hw, ++ unsigned long parent_rate) ++{ ++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw); ++ u32 m, d, o, div, reg, f; ++ ++ reg = readl(divider->base + WZRD_CLK_CFG_REG(0)); ++ d = FIELD_GET(WZRD_DIVCLK_DIVIDE_MASK, reg); ++ m = FIELD_GET(WZRD_CLKFBOUT_MULT_MASK, reg); ++ reg = readl(divider->base + WZRD_CLK_CFG_REG(2)); ++ o = FIELD_GET(WZRD_DIVCLK_DIVIDE_MASK, reg); ++ f = FIELD_GET(WZRD_CLKOUT0_FRAC_MASK, reg); ++ ++ div = DIV_ROUND_CLOSEST(d * (WZRD_FRAC_POINTS * o + f), WZRD_FRAC_POINTS); ++ return divider_recalc_rate(hw, parent_rate * m, div, divider->table, ++ divider->flags, divider->width); ++} ++ ++static long clk_wzrd_round_rate_all(struct clk_hw *hw, unsigned long rate, ++ unsigned long *prate) ++{ ++ struct clk_wzrd_divider *divider = to_clk_wzrd_divider(hw); ++ unsigned long int_freq; ++ u32 m, d, o, div, f; ++ int err; ++ ++ err = clk_wzrd_get_divisors(hw, rate, *prate); ++ if (err) ++ return err; ++ ++ m = divider->m; ++ d = divider->d; ++ o = divider->o; ++ ++ div = d * o; ++ int_freq = divider_recalc_rate(hw, *prate * m, div, divider->table, ++ divider->flags, divider->width); ++ ++ if (rate > int_freq) { ++ f = DIV_ROUND_CLOSEST_ULL(rate * WZRD_FRAC_POINTS, int_freq); ++ rate = DIV_ROUND_CLOSEST(int_freq * f, WZRD_FRAC_POINTS); ++ } ++ return rate; ++} ++ + static const struct clk_ops clk_wzrd_clk_divider_ops = { + .round_rate = clk_wzrd_round_rate, + .set_rate = clk_wzrd_dynamic_reconfig, + .recalc_rate = clk_wzrd_recalc_rate, + }; + ++static const struct clk_ops clk_wzrd_clk_div_all_ops = { ++ .round_rate = clk_wzrd_round_rate_all, ++ .set_rate = clk_wzrd_dynamic_all, ++ .recalc_rate = clk_wzrd_recalc_rate_all, ++}; ++ + static unsigned long clk_wzrd_recalc_ratef(struct clk_hw *hw, + unsigned long parent_rate) + { +@@ -273,7 +441,7 @@ static struct clk *clk_wzrd_register_divf(struct device *dev, + void __iomem *base, u16 offset, + u8 shift, u8 width, + u8 clk_divider_flags, +- const struct clk_div_table *table, ++ u32 div_type, + spinlock_t *lock) + { + struct clk_wzrd_divider *div; +@@ -300,7 +468,6 @@ static struct clk *clk_wzrd_register_divf(struct device *dev, + div->flags = clk_divider_flags; + div->lock = lock; + div->hw.init = &init; +- div->table = table; + + hw = &div->hw; + ret = devm_clk_hw_register(dev, hw); +@@ -317,7 +484,7 @@ static struct clk *clk_wzrd_register_divider(struct device *dev, + void __iomem *base, u16 offset, + u8 shift, u8 width, + u8 clk_divider_flags, +- const struct clk_div_table *table, ++ u32 div_type, + spinlock_t *lock) + { + struct clk_wzrd_divider *div; +@@ -330,7 +497,12 @@ static struct clk *clk_wzrd_register_divider(struct device *dev, + return ERR_PTR(-ENOMEM); + + init.name = name; +- init.ops = &clk_wzrd_clk_divider_ops; ++ if (clk_divider_flags & CLK_DIVIDER_READ_ONLY) ++ init.ops = &clk_divider_ro_ops; ++ else if (div_type == DIV_O) ++ init.ops = &clk_wzrd_clk_divider_ops; ++ else ++ init.ops = &clk_wzrd_clk_div_all_ops; + init.flags = flags; + init.parent_names = &parent_name; + init.num_parents = 1; +@@ -342,7 +514,6 @@ static struct clk *clk_wzrd_register_divider(struct device *dev, + div->flags = clk_divider_flags; + div->lock = lock; + div->hw.init = &init; +- div->table = table; + + hw = &div->hw; + ret = devm_clk_hw_register(dev, hw); +@@ -418,6 +589,7 @@ static int clk_wzrd_probe(struct platform_device *pdev) + const char *clk_name; + void __iomem *ctrl_reg; + struct clk_wzrd *clk_wzrd; ++ const char *clkout_name; + struct device_node *np = pdev->dev.of_node; + int nr_outputs; + unsigned long flags = 0; +@@ -466,6 +638,26 @@ static int clk_wzrd_probe(struct platform_device *pdev) + goto err_disable_clk; + } + ++ ret = of_property_read_u32(np, "xlnx,nr-outputs", &nr_outputs); ++ if (ret || nr_outputs > WZRD_NUM_OUTPUTS) { ++ ret = -EINVAL; ++ goto err_disable_clk; ++ } ++ ++ clkout_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_out0", dev_name(&pdev->dev)); ++ if (nr_outputs == 1) { ++ clk_wzrd->clkout[0] = clk_wzrd_register_divider ++ (&pdev->dev, clkout_name, ++ __clk_get_name(clk_wzrd->clk_in1), 0, ++ clk_wzrd->base, WZRD_CLK_CFG_REG(3), ++ WZRD_CLKOUT_DIVIDE_SHIFT, ++ WZRD_CLKOUT_DIVIDE_WIDTH, ++ CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO, ++ DIV_ALL, &clkwzrd_lock); ++ ++ goto out; ++ } ++ + reg = readl(clk_wzrd->base + WZRD_CLK_CFG_REG(0)); + reg_f = reg & WZRD_CLKFBOUT_FRAC_MASK; + reg_f = reg_f >> WZRD_CLKFBOUT_FRAC_SHIFT; +@@ -473,20 +665,11 @@ static int clk_wzrd_probe(struct platform_device *pdev) + reg = reg & WZRD_CLKFBOUT_MULT_MASK; + reg = reg >> WZRD_CLKFBOUT_MULT_SHIFT; + mult = (reg * 1000) + reg_f; +- clk_name = kasprintf(GFP_KERNEL, "%s_mul", dev_name(&pdev->dev)); ++ clk_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_mul", dev_name(&pdev->dev)); + if (!clk_name) { + ret = -ENOMEM; + goto err_disable_clk; + } +- +- ret = of_property_read_u32(np, "xlnx,nr-outputs", &nr_outputs); +- if (ret || nr_outputs > WZRD_NUM_OUTPUTS) { +- ret = -EINVAL; +- goto err_disable_clk; +- } +- if (nr_outputs == 1) +- flags = CLK_SET_RATE_PARENT; +- + clk_wzrd->clks_internal[wzrd_clk_mul] = clk_register_fixed_factor + (&pdev->dev, clk_name, + __clk_get_name(clk_wzrd->clk_in1), +@@ -497,7 +680,7 @@ static int clk_wzrd_probe(struct platform_device *pdev) + goto err_disable_clk; + } + +- clk_name = kasprintf(GFP_KERNEL, "%s_mul_div", dev_name(&pdev->dev)); ++ clk_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_mul_div", dev_name(&pdev->dev)); + if (!clk_name) { + ret = -ENOMEM; + goto err_rm_int_clk; +@@ -518,9 +701,8 @@ static int clk_wzrd_probe(struct platform_device *pdev) + + /* register div per output */ + for (i = nr_outputs - 1; i >= 0 ; i--) { +- const char *clkout_name; +- +- clkout_name = kasprintf(GFP_KERNEL, "%s_out%d", dev_name(&pdev->dev), i); ++ clkout_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, ++ "%s_out%d", dev_name(&pdev->dev), i); + if (!clkout_name) { + ret = -ENOMEM; + goto err_rm_int_clk; +@@ -534,7 +716,7 @@ static int clk_wzrd_probe(struct platform_device *pdev) + WZRD_CLKOUT_DIVIDE_SHIFT, + WZRD_CLKOUT_DIVIDE_WIDTH, + CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO, +- NULL, &clkwzrd_lock); ++ DIV_O, &clkwzrd_lock); + else + clk_wzrd->clkout[i] = clk_wzrd_register_divider + (&pdev->dev, clkout_name, +@@ -543,7 +725,7 @@ static int clk_wzrd_probe(struct platform_device *pdev) + WZRD_CLKOUT_DIVIDE_SHIFT, + WZRD_CLKOUT_DIVIDE_WIDTH, + CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO, +- NULL, &clkwzrd_lock); ++ DIV_O, &clkwzrd_lock); + if (IS_ERR(clk_wzrd->clkout[i])) { + int j; + +@@ -556,8 +738,7 @@ static int clk_wzrd_probe(struct platform_device *pdev) + } + } + +- kfree(clk_name); +- ++out: + clk_wzrd->clk_data.clks = clk_wzrd->clkout; + clk_wzrd->clk_data.clk_num = ARRAY_SIZE(clk_wzrd->clkout); + of_clk_add_provider(np, of_clk_src_onecell_get, &clk_wzrd->clk_data); +@@ -582,7 +763,6 @@ static int clk_wzrd_probe(struct platform_device *pdev) + err_rm_int_clks: + clk_unregister(clk_wzrd->clks_internal[1]); + err_rm_int_clk: +- kfree(clk_name); + clk_unregister(clk_wzrd->clks_internal[0]); + err_disable_clk: + clk_disable_unprepare(clk_wzrd->axi_clk); +-- +2.39.2 + diff --git a/queue-5.15/clocksource-drivers-cadence-ttc-fix-memory-leak-in-t.patch b/queue-5.15/clocksource-drivers-cadence-ttc-fix-memory-leak-in-t.patch new file mode 100644 index 00000000000..e4ebaba15b5 --- /dev/null +++ b/queue-5.15/clocksource-drivers-cadence-ttc-fix-memory-leak-in-t.patch @@ -0,0 +1,81 @@ +From 645250b99098c8f2ec675536f84501750c21197b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 06:56:11 +0000 +Subject: clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe + +From: Feng Mingxi + +[ Upstream commit 8b5bf64c89c7100c921bd807ba39b2eb003061ab ] + +Smatch reports: +drivers/clocksource/timer-cadence-ttc.c:529 ttc_timer_probe() +warn: 'timer_baseaddr' from of_iomap() not released on lines: 498,508,516. + +timer_baseaddr may have the problem of not being released after use, +I replaced it with the devm_of_iomap() function and added the clk_put() +function to cleanup the "clk_ce" and "clk_cs". + +Fixes: e932900a3279 ("arm: zynq: Use standard timer binding") +Fixes: 70504f311d4b ("clocksource/drivers/cadence_ttc: Convert init function to return error") +Signed-off-by: Feng Mingxi +Reviewed-by: Dongliang Mu +Acked-by: Michal Simek +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20230425065611.702917-1-m202271825@hust.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-cadence-ttc.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/clocksource/timer-cadence-ttc.c b/drivers/clocksource/timer-cadence-ttc.c +index 4efd0cf3b602d..0d52e28fea4de 100644 +--- a/drivers/clocksource/timer-cadence-ttc.c ++++ b/drivers/clocksource/timer-cadence-ttc.c +@@ -486,10 +486,10 @@ static int __init ttc_timer_probe(struct platform_device *pdev) + * and use it. Note that the event timer uses the interrupt and it's the + * 2nd TTC hence the irq_of_parse_and_map(,1) + */ +- timer_baseaddr = of_iomap(timer, 0); +- if (!timer_baseaddr) { ++ timer_baseaddr = devm_of_iomap(&pdev->dev, timer, 0, NULL); ++ if (IS_ERR(timer_baseaddr)) { + pr_err("ERROR: invalid timer base address\n"); +- return -ENXIO; ++ return PTR_ERR(timer_baseaddr); + } + + irq = irq_of_parse_and_map(timer, 1); +@@ -513,20 +513,27 @@ static int __init ttc_timer_probe(struct platform_device *pdev) + clk_ce = of_clk_get(timer, clksel); + if (IS_ERR(clk_ce)) { + pr_err("ERROR: timer input clock not found\n"); +- return PTR_ERR(clk_ce); ++ ret = PTR_ERR(clk_ce); ++ goto put_clk_cs; + } + + ret = ttc_setup_clocksource(clk_cs, timer_baseaddr, timer_width); + if (ret) +- return ret; ++ goto put_clk_ce; + + ret = ttc_setup_clockevent(clk_ce, timer_baseaddr + 4, irq); + if (ret) +- return ret; ++ goto put_clk_ce; + + pr_info("%pOFn #0 at %p, irq=%d\n", timer, timer_baseaddr, irq); + + return 0; ++ ++put_clk_ce: ++ clk_put(clk_ce); ++put_clk_cs: ++ clk_put(clk_cs); ++ return ret; + } + + static const struct of_device_id ttc_timer_of_match[] = { +-- +2.39.2 + diff --git a/queue-5.15/cpufreq-intel_pstate-fix-energy_performance_preferen.patch b/queue-5.15/cpufreq-intel_pstate-fix-energy_performance_preferen.patch new file mode 100644 index 00000000000..13597d863d8 --- /dev/null +++ b/queue-5.15/cpufreq-intel_pstate-fix-energy_performance_preferen.patch @@ -0,0 +1,42 @@ +From 94d2e5c20f7417c01fcda808dc8cf8cdbc204e4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 09:58:39 +0300 +Subject: cpufreq: intel_pstate: Fix energy_performance_preference for passive + +From: Tero Kristo + +[ Upstream commit 03f44ffb3d5be2fceda375d92c70ab6de4df7081 ] + +If the intel_pstate driver is set to passive mode, then writing the +same value to the energy_performance_preference sysfs twice will fail. +This is caused by the wrong return value used (index of the matched +energy_perf_string), instead of the length of the passed in parameter. +Fix by forcing the internal return value to zero when the same +preference is passed in by user. This same issue is not present when +active mode is used for the driver. + +Fixes: f6ebbcf08f37 ("cpufreq: intel_pstate: Implement passive mode with HWP enabled") +Reported-by: Niklas Neronin +Signed-off-by: Tero Kristo +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/intel_pstate.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index eee74a2fe3174..2f5063db2f1fc 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -824,6 +824,8 @@ static ssize_t store_energy_performance_preference( + err = cpufreq_start_governor(policy); + if (!ret) + ret = err; ++ } else { ++ ret = 0; + } + } + +-- +2.39.2 + diff --git a/queue-5.15/crypto-kpp-add-helper-to-set-reqsize.patch b/queue-5.15/crypto-kpp-add-helper-to-set-reqsize.patch new file mode 100644 index 00000000000..4fc65937c10 --- /dev/null +++ b/queue-5.15/crypto-kpp-add-helper-to-set-reqsize.patch @@ -0,0 +1,39 @@ +From 6d735e7dab751f5a45de9270ee765db904bd5180 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 17:24:01 +0800 +Subject: crypto: kpp - Add helper to set reqsize + +From: Herbert Xu + +[ Upstream commit 56861cbde1b9f3b34d300e6ba87f2c3de1a9c309 ] + +The value of reqsize should only be changed through a helper. +To do so we need to first add a helper for this. + +Signed-off-by: Herbert Xu +Stable-dep-of: eb7713f5ca97 ("crypto: qat - unmap buffer before free for DH") +Signed-off-by: Sasha Levin +--- + include/crypto/internal/kpp.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/crypto/internal/kpp.h b/include/crypto/internal/kpp.h +index 659b642efada1..05b25a819d0d1 100644 +--- a/include/crypto/internal/kpp.h ++++ b/include/crypto/internal/kpp.h +@@ -18,6 +18,12 @@ static inline void *kpp_request_ctx(struct kpp_request *req) + return req->__ctx; + } + ++static inline void kpp_set_reqsize(struct crypto_kpp *kpp, ++ unsigned int reqsize) ++{ ++ crypto_kpp_alg(kpp)->reqsize = reqsize; ++} ++ + static inline void *kpp_tfm_ctx(struct crypto_kpp *tfm) + { + return tfm->base.__crt_ctx; +-- +2.39.2 + diff --git a/queue-5.15/crypto-marvell-cesa-fix-type-mismatch-warning.patch b/queue-5.15/crypto-marvell-cesa-fix-type-mismatch-warning.patch new file mode 100644 index 00000000000..2bee6bec475 --- /dev/null +++ b/queue-5.15/crypto-marvell-cesa-fix-type-mismatch-warning.patch @@ -0,0 +1,49 @@ +From 64415a3c6468658f06fbcf645f1185698c988d81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 10:33:04 +0200 +Subject: crypto: marvell/cesa - Fix type mismatch warning + +From: Arnd Bergmann + +[ Upstream commit efbc7764c4446566edb76ca05e903b5905673d2e ] + +Commit df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") uncovered +a type mismatch in cesa 3des support that leads to a memcpy beyond the +end of a structure: + +In function 'fortify_memcpy_chk', + inlined from 'mv_cesa_des3_ede_setkey' at drivers/crypto/marvell/cesa/cipher.c:307:2: +include/linux/fortify-string.h:583:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] + 583 | __write_overflow_field(p_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +This is probably harmless as the actual data that is copied has the correct +type, but clearly worth fixing nonetheless. + +Fixes: 4ada48397823 ("crypto: marvell/cesa - add Triple-DES support") +Cc: Kees Cook +Cc: Gustavo A. R. Silva" +Signed-off-by: Arnd Bergmann +Reviewed-by: Kees Cook +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/marvell/cesa/cipher.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/marvell/cesa/cipher.c b/drivers/crypto/marvell/cesa/cipher.c +index c6f2fa753b7c0..0f37dfd42d850 100644 +--- a/drivers/crypto/marvell/cesa/cipher.c ++++ b/drivers/crypto/marvell/cesa/cipher.c +@@ -297,7 +297,7 @@ static int mv_cesa_des_setkey(struct crypto_skcipher *cipher, const u8 *key, + static int mv_cesa_des3_ede_setkey(struct crypto_skcipher *cipher, + const u8 *key, unsigned int len) + { +- struct mv_cesa_des_ctx *ctx = crypto_skcipher_ctx(cipher); ++ struct mv_cesa_des3_ctx *ctx = crypto_skcipher_ctx(cipher); + int err; + + err = verify_skcipher_des3_key(cipher, key); +-- +2.39.2 + diff --git a/queue-5.15/crypto-nx-fix-build-warnings-when-debug_fs-is-not-en.patch b/queue-5.15/crypto-nx-fix-build-warnings-when-debug_fs-is-not-en.patch new file mode 100644 index 00000000000..5eab55c15de --- /dev/null +++ b/queue-5.15/crypto-nx-fix-build-warnings-when-debug_fs-is-not-en.patch @@ -0,0 +1,88 @@ +From 4de77481db87f8be648b335b837549945ec03103 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 15:33:34 -0700 +Subject: crypto: nx - fix build warnings when DEBUG_FS is not enabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit b04b076fb56560b39d695ac3744db457e12278fd ] + +Fix build warnings when DEBUG_FS is not enabled by using an empty +do-while loop instead of a value: + +In file included from ../drivers/crypto/nx/nx.c:27: +../drivers/crypto/nx/nx.c: In function 'nx_register_algs': +../drivers/crypto/nx/nx.h:173:33: warning: statement with no effect [-Wunused-value] + 173 | #define NX_DEBUGFS_INIT(drv) (0) +../drivers/crypto/nx/nx.c:573:9: note: in expansion of macro 'NX_DEBUGFS_INIT' + 573 | NX_DEBUGFS_INIT(&nx_driver); +../drivers/crypto/nx/nx.c: In function 'nx_remove': +../drivers/crypto/nx/nx.h:174:33: warning: statement with no effect [-Wunused-value] + 174 | #define NX_DEBUGFS_FINI(drv) (0) +../drivers/crypto/nx/nx.c:793:17: note: in expansion of macro 'NX_DEBUGFS_FINI' + 793 | NX_DEBUGFS_FINI(&nx_driver); + +Also, there is no need to build nx_debugfs.o when DEBUG_FS is not +enabled, so change the Makefile to accommodate that. + +Fixes: ae0222b7289d ("powerpc/crypto: nx driver code supporting nx encryption") +Fixes: aef7b31c8833 ("powerpc/crypto: Build files for the nx device driver") +Signed-off-by: Randy Dunlap +Cc: Breno Leitão +Cc: Nayna Jain +Cc: Paulo Flabiano Smorigo +Cc: Herbert Xu +Cc: "David S. Miller" +Cc: linux-crypto@vger.kernel.org +Cc: Michael Ellerman +Cc: Nicholas Piggin +Cc: Christophe Leroy +Cc: linuxppc-dev@lists.ozlabs.org +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/nx/Makefile | 2 +- + drivers/crypto/nx/nx.h | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/nx/Makefile b/drivers/crypto/nx/Makefile +index d00181a26dd65..483cef62acee8 100644 +--- a/drivers/crypto/nx/Makefile ++++ b/drivers/crypto/nx/Makefile +@@ -1,7 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + obj-$(CONFIG_CRYPTO_DEV_NX_ENCRYPT) += nx-crypto.o + nx-crypto-objs := nx.o \ +- nx_debugfs.o \ + nx-aes-cbc.o \ + nx-aes-ecb.o \ + nx-aes-gcm.o \ +@@ -11,6 +10,7 @@ nx-crypto-objs := nx.o \ + nx-sha256.o \ + nx-sha512.o + ++nx-crypto-$(CONFIG_DEBUG_FS) += nx_debugfs.o + obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_PSERIES) += nx-compress-pseries.o nx-compress.o + obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_POWERNV) += nx-compress-powernv.o nx-compress.o + nx-compress-objs := nx-842.o +diff --git a/drivers/crypto/nx/nx.h b/drivers/crypto/nx/nx.h +index c6233173c612e..2697baebb6a35 100644 +--- a/drivers/crypto/nx/nx.h ++++ b/drivers/crypto/nx/nx.h +@@ -170,8 +170,8 @@ struct nx_sg *nx_walk_and_build(struct nx_sg *, unsigned int, + void nx_debugfs_init(struct nx_crypto_driver *); + void nx_debugfs_fini(struct nx_crypto_driver *); + #else +-#define NX_DEBUGFS_INIT(drv) (0) +-#define NX_DEBUGFS_FINI(drv) (0) ++#define NX_DEBUGFS_INIT(drv) do {} while (0) ++#define NX_DEBUGFS_FINI(drv) do {} while (0) + #endif + + #define NX_PAGE_NUM(x) ((u64)(x) & 0xfffffffffffff000ULL) +-- +2.39.2 + diff --git a/queue-5.15/crypto-qat-honor-crypto_tfm_req_may_sleep-flag.patch b/queue-5.15/crypto-qat-honor-crypto_tfm_req_may_sleep-flag.patch new file mode 100644 index 00000000000..e69f249a73f --- /dev/null +++ b/queue-5.15/crypto-qat-honor-crypto_tfm_req_may_sleep-flag.patch @@ -0,0 +1,225 @@ +From f24cc65e2aa2fe2d98f626999a21e5bbe5822bff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 14:34:16 +0100 +Subject: crypto: qat - honor CRYPTO_TFM_REQ_MAY_SLEEP flag + +From: Giovanni Cabiddu + +[ Upstream commit 8fb203c65a795b96faa1836b5086a5d6eb5c5e99 ] + +If a request has the flag CRYPTO_TFM_REQ_MAY_SLEEP set, allocate memory +using the flag GFP_KERNEL otherwise use GFP_ATOMIC. + +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Adam Guerin +Reviewed-by: Wojciech Ziemba +Signed-off-by: Herbert Xu +Stable-dep-of: eb7713f5ca97 ("crypto: qat - unmap buffer before free for DH") +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/qat_algs.c | 19 ++++++++++++------- + drivers/crypto/qat/qat_common/qat_asym_algs.c | 17 ++++++++++------- + drivers/crypto/qat/qat_common/qat_crypto.h | 5 +++++ + 3 files changed, 27 insertions(+), 14 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c +index 906082fbdd67b..d36f90628603c 100644 +--- a/drivers/crypto/qat/qat_common/qat_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_algs.c +@@ -706,7 +706,8 @@ static void qat_alg_free_bufl(struct qat_crypto_instance *inst, + static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst, + struct scatterlist *sgl, + struct scatterlist *sglout, +- struct qat_crypto_request *qat_req) ++ struct qat_crypto_request *qat_req, ++ gfp_t flags) + { + struct device *dev = &GET_DEV(inst->accel_dev); + int i, sg_nctr = 0; +@@ -727,7 +728,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst, + qat_req->buf.sgl_dst_valid = false; + + if (n > QAT_MAX_BUFF_DESC) { +- bufl = kzalloc_node(sz, GFP_ATOMIC, node); ++ bufl = kzalloc_node(sz, flags, node); + if (unlikely(!bufl)) + return -ENOMEM; + } else { +@@ -771,7 +772,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst, + sg_nctr = 0; + + if (n > QAT_MAX_BUFF_DESC) { +- buflout = kzalloc_node(sz_out, GFP_ATOMIC, node); ++ buflout = kzalloc_node(sz_out, flags, node); + if (unlikely(!buflout)) + goto err_in; + } else { +@@ -972,6 +973,7 @@ static int qat_alg_aead_dec(struct aead_request *areq) + struct icp_qat_fw_la_auth_req_params *auth_param; + struct icp_qat_fw_la_bulk_req *msg; + int digst_size = crypto_aead_authsize(aead_tfm); ++ gfp_t f = qat_algs_alloc_flags(&areq->base); + int ret; + u32 cipher_len; + +@@ -979,7 +981,7 @@ static int qat_alg_aead_dec(struct aead_request *areq) + if (cipher_len % AES_BLOCK_SIZE != 0) + return -EINVAL; + +- ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); ++ ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req, f); + if (unlikely(ret)) + return ret; + +@@ -1014,6 +1016,7 @@ static int qat_alg_aead_enc(struct aead_request *areq) + struct qat_crypto_request *qat_req = aead_request_ctx(areq); + struct icp_qat_fw_la_cipher_req_params *cipher_param; + struct icp_qat_fw_la_auth_req_params *auth_param; ++ gfp_t f = qat_algs_alloc_flags(&areq->base); + struct icp_qat_fw_la_bulk_req *msg; + u8 *iv = areq->iv; + int ret; +@@ -1021,7 +1024,7 @@ static int qat_alg_aead_enc(struct aead_request *areq) + if (areq->cryptlen % AES_BLOCK_SIZE != 0) + return -EINVAL; + +- ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); ++ ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req, f); + if (unlikely(ret)) + return ret; + +@@ -1199,13 +1202,14 @@ static int qat_alg_skcipher_encrypt(struct skcipher_request *req) + struct qat_alg_skcipher_ctx *ctx = crypto_tfm_ctx(tfm); + struct qat_crypto_request *qat_req = skcipher_request_ctx(req); + struct icp_qat_fw_la_cipher_req_params *cipher_param; ++ gfp_t f = qat_algs_alloc_flags(&req->base); + struct icp_qat_fw_la_bulk_req *msg; + int ret; + + if (req->cryptlen == 0) + return 0; + +- ret = qat_alg_sgl_to_bufl(ctx->inst, req->src, req->dst, qat_req); ++ ret = qat_alg_sgl_to_bufl(ctx->inst, req->src, req->dst, qat_req, f); + if (unlikely(ret)) + return ret; + +@@ -1264,13 +1268,14 @@ static int qat_alg_skcipher_decrypt(struct skcipher_request *req) + struct qat_alg_skcipher_ctx *ctx = crypto_tfm_ctx(tfm); + struct qat_crypto_request *qat_req = skcipher_request_ctx(req); + struct icp_qat_fw_la_cipher_req_params *cipher_param; ++ gfp_t f = qat_algs_alloc_flags(&req->base); + struct icp_qat_fw_la_bulk_req *msg; + int ret; + + if (req->cryptlen == 0) + return 0; + +- ret = qat_alg_sgl_to_bufl(ctx->inst, req->src, req->dst, qat_req); ++ ret = qat_alg_sgl_to_bufl(ctx->inst, req->src, req->dst, qat_req, f); + if (unlikely(ret)) + return ret; + +diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c +index 5f11929cf9bac..11c7f2b6e5975 100644 +--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c +@@ -224,9 +224,10 @@ static int qat_dh_compute_value(struct kpp_request *req) + struct qat_asym_request *qat_req = + PTR_ALIGN(kpp_request_ctx(req), 64); + struct icp_qat_fw_pke_request *msg = &qat_req->req; +- int ret; ++ gfp_t flags = qat_algs_alloc_flags(&req->base); + int n_input_params = 0; + u8 *vaddr; ++ int ret; + + if (unlikely(!ctx->xa)) + return -EINVAL; +@@ -291,7 +292,7 @@ static int qat_dh_compute_value(struct kpp_request *req) + } else { + int shift = ctx->p_size - req->src_len; + +- qat_req->src_align = kzalloc(ctx->p_size, GFP_KERNEL); ++ qat_req->src_align = kzalloc(ctx->p_size, flags); + if (unlikely(!qat_req->src_align)) + return ret; + +@@ -317,7 +318,7 @@ static int qat_dh_compute_value(struct kpp_request *req) + qat_req->dst_align = NULL; + vaddr = sg_virt(req->dst); + } else { +- qat_req->dst_align = kzalloc(ctx->p_size, GFP_KERNEL); ++ qat_req->dst_align = kzalloc(ctx->p_size, flags); + if (unlikely(!qat_req->dst_align)) + goto unmap_src; + +@@ -650,6 +651,7 @@ static int qat_rsa_enc(struct akcipher_request *req) + struct qat_asym_request *qat_req = + PTR_ALIGN(akcipher_request_ctx(req), 64); + struct icp_qat_fw_pke_request *msg = &qat_req->req; ++ gfp_t flags = qat_algs_alloc_flags(&req->base); + u8 *vaddr; + int ret; + +@@ -696,7 +698,7 @@ static int qat_rsa_enc(struct akcipher_request *req) + } else { + int shift = ctx->key_sz - req->src_len; + +- qat_req->src_align = kzalloc(ctx->key_sz, GFP_KERNEL); ++ qat_req->src_align = kzalloc(ctx->key_sz, flags); + if (unlikely(!qat_req->src_align)) + return ret; + +@@ -714,7 +716,7 @@ static int qat_rsa_enc(struct akcipher_request *req) + qat_req->dst_align = NULL; + vaddr = sg_virt(req->dst); + } else { +- qat_req->dst_align = kzalloc(ctx->key_sz, GFP_KERNEL); ++ qat_req->dst_align = kzalloc(ctx->key_sz, flags); + if (unlikely(!qat_req->dst_align)) + goto unmap_src; + vaddr = qat_req->dst_align; +@@ -783,6 +785,7 @@ static int qat_rsa_dec(struct akcipher_request *req) + struct qat_asym_request *qat_req = + PTR_ALIGN(akcipher_request_ctx(req), 64); + struct icp_qat_fw_pke_request *msg = &qat_req->req; ++ gfp_t flags = qat_algs_alloc_flags(&req->base); + u8 *vaddr; + int ret; + +@@ -839,7 +842,7 @@ static int qat_rsa_dec(struct akcipher_request *req) + } else { + int shift = ctx->key_sz - req->src_len; + +- qat_req->src_align = kzalloc(ctx->key_sz, GFP_KERNEL); ++ qat_req->src_align = kzalloc(ctx->key_sz, flags); + if (unlikely(!qat_req->src_align)) + return ret; + +@@ -857,7 +860,7 @@ static int qat_rsa_dec(struct akcipher_request *req) + qat_req->dst_align = NULL; + vaddr = sg_virt(req->dst); + } else { +- qat_req->dst_align = kzalloc(ctx->key_sz, GFP_KERNEL); ++ qat_req->dst_align = kzalloc(ctx->key_sz, flags); + if (unlikely(!qat_req->dst_align)) + goto unmap_src; + vaddr = qat_req->dst_align; +diff --git a/drivers/crypto/qat/qat_common/qat_crypto.h b/drivers/crypto/qat/qat_common/qat_crypto.h +index 245b6d9a36507..df3c738ce323a 100644 +--- a/drivers/crypto/qat/qat_common/qat_crypto.h ++++ b/drivers/crypto/qat/qat_common/qat_crypto.h +@@ -109,4 +109,9 @@ static inline bool adf_hw_dev_has_crypto(struct adf_accel_dev *accel_dev) + return true; + } + ++static inline gfp_t qat_algs_alloc_flags(struct crypto_async_request *req) ++{ ++ return req->flags & CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL : GFP_ATOMIC; ++} ++ + #endif +-- +2.39.2 + diff --git a/queue-5.15/crypto-qat-replace-get_current_node-with-numa_node_i.patch b/queue-5.15/crypto-qat-replace-get_current_node-with-numa_node_i.patch new file mode 100644 index 00000000000..ceb70c6c87f --- /dev/null +++ b/queue-5.15/crypto-qat-replace-get_current_node-with-numa_node_i.patch @@ -0,0 +1,96 @@ +From 4910299d8c42b8baf7e1eb134e7bccc3ae810697 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jun 2022 09:59:44 +0000 +Subject: crypto: qat - replace get_current_node() with numa_node_id() + +From: Andre Przywara + +[ Upstream commit c2a1b91e47984e477298912ffd55570095d67318 ] + +Currently the QAT driver code uses a self-defined wrapper function +called get_current_node() when it wants to learn the current NUMA node. +This implementation references the topology_physical_package_id[] array, +which more or less coincidentally contains the NUMA node id, at least +on x86. + +Because this is not universal, and Linux offers a direct function to +learn the NUMA node ID, replace that function with a call to +numa_node_id(), which would work everywhere. + +This fixes the QAT driver operation on arm64 machines. + +Reported-by: Yoan Picchi +Signed-off-by: Andre Przywara +Signed-off-by: Yoan Picchi +Signed-off-by: Herbert Xu +Stable-dep-of: eb7713f5ca97 ("crypto: qat - unmap buffer before free for DH") +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_common_drv.h | 5 ----- + drivers/crypto/qat/qat_common/qat_algs.c | 4 ++-- + drivers/crypto/qat/qat_common/qat_asym_algs.c | 4 ++-- + 3 files changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h +index 4261749fae8d4..75693ca4afea1 100644 +--- a/drivers/crypto/qat/qat_common/adf_common_drv.h ++++ b/drivers/crypto/qat/qat_common/adf_common_drv.h +@@ -49,11 +49,6 @@ struct service_hndl { + struct list_head list; + }; + +-static inline int get_current_node(void) +-{ +- return topology_physical_package_id(raw_smp_processor_id()); +-} +- + int adf_service_register(struct service_hndl *service); + int adf_service_unregister(struct service_hndl *service); + +diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c +index d36f90628603c..f56ee4cc5ae8b 100644 +--- a/drivers/crypto/qat/qat_common/qat_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_algs.c +@@ -605,7 +605,7 @@ static int qat_alg_aead_newkey(struct crypto_aead *tfm, const u8 *key, + { + struct qat_alg_aead_ctx *ctx = crypto_aead_ctx(tfm); + struct qat_crypto_instance *inst = NULL; +- int node = get_current_node(); ++ int node = numa_node_id(); + struct device *dev; + int ret; + +@@ -1071,7 +1071,7 @@ static int qat_alg_skcipher_newkey(struct qat_alg_skcipher_ctx *ctx, + { + struct qat_crypto_instance *inst = NULL; + struct device *dev; +- int node = get_current_node(); ++ int node = numa_node_id(); + int ret; + + inst = qat_crypto_get_instance_node(node); +diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c +index 11c7f2b6e5975..85b0f30712e16 100644 +--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c +@@ -489,7 +489,7 @@ static int qat_dh_init_tfm(struct crypto_kpp *tfm) + { + struct qat_dh_ctx *ctx = kpp_tfm_ctx(tfm); + struct qat_crypto_instance *inst = +- qat_crypto_get_instance_node(get_current_node()); ++ qat_crypto_get_instance_node(numa_node_id()); + + if (!inst) + return -EINVAL; +@@ -1225,7 +1225,7 @@ static int qat_rsa_init_tfm(struct crypto_akcipher *tfm) + { + struct qat_rsa_ctx *ctx = akcipher_tfm_ctx(tfm); + struct qat_crypto_instance *inst = +- qat_crypto_get_instance_node(get_current_node()); ++ qat_crypto_get_instance_node(numa_node_id()); + + if (!inst) + return -EINVAL; +-- +2.39.2 + diff --git a/queue-5.15/crypto-qat-unmap-buffer-before-free-for-dh.patch b/queue-5.15/crypto-qat-unmap-buffer-before-free-for-dh.patch new file mode 100644 index 00000000000..048d0a9b956 --- /dev/null +++ b/queue-5.15/crypto-qat-unmap-buffer-before-free-for-dh.patch @@ -0,0 +1,53 @@ +From 374ff2cebe20ea4921ff8b00cf20320cfeb7104b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 22:06:06 +0100 +Subject: crypto: qat - unmap buffer before free for DH + +From: Hareshx Sankar Raj + +[ Upstream commit eb7713f5ca97697b92f225127440d1525119b8de ] + +The callback function for DH frees the memory allocated for the +destination buffer before unmapping it. +This sequence is wrong. + +Change the cleanup sequence to unmap the buffer before freeing it. + +Fixes: 029aa4624a7f ("crypto: qat - remove dma_free_coherent() for DH") +Signed-off-by: Hareshx Sankar Raj +Co-developed-by: Bolemx Sivanagaleela +Signed-off-by: Bolemx Sivanagaleela +Reviewed-by: Giovanni Cabiddu +Reviewed-by: Andy Shevchenko +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/qat_asym_algs.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c +index 935a7e012946e..8806242469a06 100644 +--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c +@@ -170,15 +170,14 @@ static void qat_dh_cb(struct icp_qat_fw_pke_resp *resp) + } + + areq->dst_len = req->ctx.dh->p_size; ++ dma_unmap_single(dev, req->out.dh.r, req->ctx.dh->p_size, ++ DMA_FROM_DEVICE); + if (req->dst_align) { + scatterwalk_map_and_copy(req->dst_align, areq->dst, 0, + areq->dst_len, 1); + kfree_sensitive(req->dst_align); + } + +- dma_unmap_single(dev, req->out.dh.r, req->ctx.dh->p_size, +- DMA_FROM_DEVICE); +- + dma_unmap_single(dev, req->phy_in, sizeof(struct qat_dh_input_params), + DMA_TO_DEVICE); + dma_unmap_single(dev, req->phy_out, +-- +2.39.2 + diff --git a/queue-5.15/crypto-qat-unmap-buffers-before-free-for-rsa.patch b/queue-5.15/crypto-qat-unmap-buffers-before-free-for-rsa.patch new file mode 100644 index 00000000000..cc0ce8d488f --- /dev/null +++ b/queue-5.15/crypto-qat-unmap-buffers-before-free-for-rsa.patch @@ -0,0 +1,62 @@ +From 7a7db75978364930db72efda756f95778b3187ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 22:06:07 +0100 +Subject: crypto: qat - unmap buffers before free for RSA + +From: Hareshx Sankar Raj + +[ Upstream commit d776b25495f2c71b9dbf1f5e53b642215ba72f3c ] + +The callback function for RSA frees the memory allocated for the source +and destination buffers before unmapping them. +This sequence is wrong. + +Change the cleanup sequence to unmap the buffers before freeing them. + +Fixes: 3dfaf0071ed7 ("crypto: qat - remove dma_free_coherent() for RSA") +Signed-off-by: Hareshx Sankar Raj +Co-developed-by: Bolemx Sivanagaleela +Signed-off-by: Bolemx Sivanagaleela +Reviewed-by: Giovanni Cabiddu +Reviewed-by: Andy Shevchenko +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/qat_asym_algs.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c +index 8806242469a06..4128200a90329 100644 +--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c +@@ -520,12 +520,14 @@ static void qat_rsa_cb(struct icp_qat_fw_pke_resp *resp) + + err = (err == ICP_QAT_FW_COMN_STATUS_FLAG_OK) ? 0 : -EINVAL; + +- kfree_sensitive(req->src_align); +- + dma_unmap_single(dev, req->in.rsa.enc.m, req->ctx.rsa->key_sz, + DMA_TO_DEVICE); + ++ kfree_sensitive(req->src_align); ++ + areq->dst_len = req->ctx.rsa->key_sz; ++ dma_unmap_single(dev, req->out.rsa.enc.c, req->ctx.rsa->key_sz, ++ DMA_FROM_DEVICE); + if (req->dst_align) { + scatterwalk_map_and_copy(req->dst_align, areq->dst, 0, + areq->dst_len, 1); +@@ -533,9 +535,6 @@ static void qat_rsa_cb(struct icp_qat_fw_pke_resp *resp) + kfree_sensitive(req->dst_align); + } + +- dma_unmap_single(dev, req->out.rsa.enc.c, req->ctx.rsa->key_sz, +- DMA_FROM_DEVICE); +- + dma_unmap_single(dev, req->phy_in, sizeof(struct qat_rsa_input_params), + DMA_TO_DEVICE); + dma_unmap_single(dev, req->phy_out, +-- +2.39.2 + diff --git a/queue-5.15/crypto-qat-use-helper-to-set-reqsize.patch b/queue-5.15/crypto-qat-use-helper-to-set-reqsize.patch new file mode 100644 index 00000000000..771830d03b3 --- /dev/null +++ b/queue-5.15/crypto-qat-use-helper-to-set-reqsize.patch @@ -0,0 +1,61 @@ +From e04e067f84ed869fae3ae1785b2609bb9fcd945e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 17:30:58 +0800 +Subject: crypto: qat - Use helper to set reqsize + +From: Herbert Xu + +[ Upstream commit 80e62ad58db084920d8cf23323b713391e09f374 ] + +The value of reqsize must only be changed through the helper. + +Signed-off-by: Herbert Xu +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Stable-dep-of: eb7713f5ca97 ("crypto: qat - unmap buffer before free for DH") +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/qat_asym_algs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c +index 94a26702aeae1..935a7e012946e 100644 +--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c +@@ -494,6 +494,8 @@ static int qat_dh_init_tfm(struct crypto_kpp *tfm) + if (!inst) + return -EINVAL; + ++ kpp_set_reqsize(tfm, sizeof(struct qat_asym_request) + 64); ++ + ctx->p_size = 0; + ctx->g2 = false; + ctx->inst = inst; +@@ -1230,6 +1232,8 @@ static int qat_rsa_init_tfm(struct crypto_akcipher *tfm) + if (!inst) + return -EINVAL; + ++ akcipher_set_reqsize(tfm, sizeof(struct qat_asym_request) + 64); ++ + ctx->key_sz = 0; + ctx->inst = inst; + return 0; +@@ -1252,7 +1256,6 @@ static struct akcipher_alg rsa = { + .max_size = qat_rsa_max_size, + .init = qat_rsa_init_tfm, + .exit = qat_rsa_exit_tfm, +- .reqsize = sizeof(struct qat_asym_request) + 64, + .base = { + .cra_name = "rsa", + .cra_driver_name = "qat-rsa", +@@ -1269,7 +1272,6 @@ static struct kpp_alg dh = { + .max_size = qat_dh_max_size, + .init = qat_dh_init_tfm, + .exit = qat_dh_exit_tfm, +- .reqsize = sizeof(struct qat_asym_request) + 64, + .base = { + .cra_name = "dh", + .cra_driver_name = "qat-dh", +-- +2.39.2 + diff --git a/queue-5.15/crypto-qat-use-reference-to-structure-in-dma_map_sin.patch b/queue-5.15/crypto-qat-use-reference-to-structure-in-dma_map_sin.patch new file mode 100644 index 00000000000..26ef97c1778 --- /dev/null +++ b/queue-5.15/crypto-qat-use-reference-to-structure-in-dma_map_sin.patch @@ -0,0 +1,92 @@ +From a7e7914ca463408defe3ea3f9886d7e517308fe1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Sep 2022 11:49:14 +0100 +Subject: crypto: qat - use reference to structure in dma_map_single() + +From: Damian Muszynski + +[ Upstream commit 072d36eefd6fde17928d214df64fdac32f60b4f4 ] + +When mapping the input and output parameters, the implementations of RSA +and DH pass to the function dma_map_single() a pointer to the first +member of the structure they want to map instead of a pointer to the +actual structure. +This results in set of warnings reported by the static analyser Smatch: + + drivers/crypto/qat/qat_common/qat_asym_algs.c:335 qat_dh_compute_value() error: dma_map_single_attrs() '&qat_req->in.dh.in.b' too small (8 vs 64) + drivers/crypto/qat/qat_common/qat_asym_algs.c:341 qat_dh_compute_value() error: dma_map_single_attrs() '&qat_req->out.dh.r' too small (8 vs 64) + drivers/crypto/qat/qat_common/qat_asym_algs.c:732 qat_rsa_enc() error: dma_map_single_attrs() '&qat_req->in.rsa.enc.m' too small (8 vs 64) + drivers/crypto/qat/qat_common/qat_asym_algs.c:738 qat_rsa_enc() error: dma_map_single_attrs() '&qat_req->out.rsa.enc.c' too small (8 vs 64) + drivers/crypto/qat/qat_common/qat_asym_algs.c:878 qat_rsa_dec() error: dma_map_single_attrs() '&qat_req->in.rsa.dec.c' too small (8 vs 64) + drivers/crypto/qat/qat_common/qat_asym_algs.c:884 qat_rsa_dec() error: dma_map_single_attrs() '&qat_req->out.rsa.dec.m' too small (8 vs 64) + +Where the address of the first element of a structure is used as an +input for the function dma_map_single(), replace it with the address of +the structure. This fix does not introduce any functional change as the +addresses are the same. + +Signed-off-by: Damian Muszynski +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Adam Guerin +Signed-off-by: Herbert Xu +Stable-dep-of: eb7713f5ca97 ("crypto: qat - unmap buffer before free for DH") +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/qat_asym_algs.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c +index 85b0f30712e16..94a26702aeae1 100644 +--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c +@@ -332,13 +332,13 @@ static int qat_dh_compute_value(struct kpp_request *req) + qat_req->in.dh.in_tab[n_input_params] = 0; + qat_req->out.dh.out_tab[1] = 0; + /* Mapping in.in.b or in.in_g2.xa is the same */ +- qat_req->phy_in = dma_map_single(dev, &qat_req->in.dh.in.b, ++ qat_req->phy_in = dma_map_single(dev, &qat_req->in.dh, + sizeof(struct qat_dh_input_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_in))) + goto unmap_dst; + +- qat_req->phy_out = dma_map_single(dev, &qat_req->out.dh.r, ++ qat_req->phy_out = dma_map_single(dev, &qat_req->out.dh, + sizeof(struct qat_dh_output_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_out))) +@@ -729,13 +729,13 @@ static int qat_rsa_enc(struct akcipher_request *req) + + qat_req->in.rsa.in_tab[3] = 0; + qat_req->out.rsa.out_tab[1] = 0; +- qat_req->phy_in = dma_map_single(dev, &qat_req->in.rsa.enc.m, ++ qat_req->phy_in = dma_map_single(dev, &qat_req->in.rsa, + sizeof(struct qat_rsa_input_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_in))) + goto unmap_dst; + +- qat_req->phy_out = dma_map_single(dev, &qat_req->out.rsa.enc.c, ++ qat_req->phy_out = dma_map_single(dev, &qat_req->out.rsa, + sizeof(struct qat_rsa_output_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_out))) +@@ -875,13 +875,13 @@ static int qat_rsa_dec(struct akcipher_request *req) + else + qat_req->in.rsa.in_tab[3] = 0; + qat_req->out.rsa.out_tab[1] = 0; +- qat_req->phy_in = dma_map_single(dev, &qat_req->in.rsa.dec.c, ++ qat_req->phy_in = dma_map_single(dev, &qat_req->in.rsa, + sizeof(struct qat_rsa_input_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_in))) + goto unmap_dst; + +- qat_req->phy_out = dma_map_single(dev, &qat_req->out.rsa.dec.m, ++ qat_req->phy_out = dma_map_single(dev, &qat_req->out.rsa, + sizeof(struct qat_rsa_output_params), + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, qat_req->phy_out))) +-- +2.39.2 + diff --git a/queue-5.15/dax-fix-dax_mapping_release-use-after-free.patch b/queue-5.15/dax-fix-dax_mapping_release-use-after-free.patch new file mode 100644 index 00000000000..a054bcf6e92 --- /dev/null +++ b/queue-5.15/dax-fix-dax_mapping_release-use-after-free.patch @@ -0,0 +1,79 @@ +From 404e2a24c459b0c3a26250a002c31ac542e0e3c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 23:13:54 -0700 +Subject: dax: Fix dax_mapping_release() use after free + +From: Dan Williams + +[ Upstream commit 6d24b170a9db0456f577b1ab01226a2254c016a8 ] + +A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region +provider (like modprobe -r dax_hmem) yields: + + kobject: 'mapping0' (ffff93eb460e8800): kobject_release, parent 0000000000000000 (delayed 2000) + [..] + DEBUG_LOCKS_WARN_ON(1) + WARNING: CPU: 23 PID: 282 at kernel/locking/lockdep.c:232 __lock_acquire+0x9fc/0x2260 + [..] + RIP: 0010:__lock_acquire+0x9fc/0x2260 + [..] + Call Trace: + + [..] + lock_acquire+0xd4/0x2c0 + ? ida_free+0x62/0x130 + _raw_spin_lock_irqsave+0x47/0x70 + ? ida_free+0x62/0x130 + ida_free+0x62/0x130 + dax_mapping_release+0x1f/0x30 + device_release+0x36/0x90 + kobject_delayed_cleanup+0x46/0x150 + +Due to attempting ida_free() on an ida object that has already been +freed. Devices typically only hold a reference on their parent while +registered. If a child needs a parent object to complete its release it +needs to hold a reference that it drops from its release callback. +Arrange for a dax_mapping to pin its parent dev_dax instance until +dax_mapping_release(). + +Fixes: 0b07ce872a9e ("device-dax: introduce 'mapping' devices") +Signed-off-by: Dan Williams +Link: https://lore.kernel.org/r/168577283412.1672036.16111545266174261446.stgit@dwillia2-xfh.jf.intel.com +Reviewed-by: Dave Jiang +Reviewed-by: Fan Ni +Reviewed-by: Ira Weiny +Signed-off-by: Vishal Verma +Signed-off-by: Sasha Levin +--- + drivers/dax/bus.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c +index e75b9edc88a1f..ce010040bcef8 100644 +--- a/drivers/dax/bus.c ++++ b/drivers/dax/bus.c +@@ -591,10 +591,12 @@ EXPORT_SYMBOL_GPL(alloc_dax_region); + static void dax_mapping_release(struct device *dev) + { + struct dax_mapping *mapping = to_dax_mapping(dev); +- struct dev_dax *dev_dax = to_dev_dax(dev->parent); ++ struct device *parent = dev->parent; ++ struct dev_dax *dev_dax = to_dev_dax(parent); + + ida_free(&dev_dax->ida, mapping->id); + kfree(mapping); ++ put_device(parent); + } + + static void unregister_dax_mapping(void *data) +@@ -734,6 +736,7 @@ static int devm_register_dax_mapping(struct dev_dax *dev_dax, int range_id) + dev = &mapping->dev; + device_initialize(dev); + dev->parent = &dev_dax->dev; ++ get_device(dev->parent); + dev->type = &dax_mapping_type; + dev_set_name(dev, "mapping%d", mapping->id); + rc = device_add(dev); +-- +2.39.2 + diff --git a/queue-5.15/dax-introduce-alloc_dev_dax_id.patch b/queue-5.15/dax-introduce-alloc_dev_dax_id.patch new file mode 100644 index 00000000000..be7b2349575 --- /dev/null +++ b/queue-5.15/dax-introduce-alloc_dev_dax_id.patch @@ -0,0 +1,195 @@ +From 199360e7fe1d6ec9a3a69b83aa29438b8ad1a191 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 23:14:05 -0700 +Subject: dax: Introduce alloc_dev_dax_id() + +From: Dan Williams + +[ Upstream commit 70aab281e18c68a1284bc387de127c2fc0bed3f8 ] + +The reference counting of dax_region objects is needlessly complicated, +has lead to confusion [1], and has hidden a bug [2]. Towards cleaning up +that mess introduce alloc_dev_dax_id() to minimize the holding of a +dax_region reference to only what dev_dax_release() needs, the +dax_region->ida. + +Part of the reason for the mess was the design to dereference a +dax_region in all cases in free_dev_dax_id() even if the id was +statically assigned by the upper level dax_region driver. Remove the +need to call "is_static(dax_region)" by tracking whether the id is +dynamic directly in the dev_dax instance itself. + +With that flag the dax_region pinning and release per dev_dax instance +can move to alloc_dev_dax_id() and free_dev_dax_id() respectively. + +A follow-on cleanup address the unnecessary references in the dax_region +setup and drivers. + +Fixes: 0f3da14a4f05 ("device-dax: introduce 'seed' devices") +Link: http://lore.kernel.org/r/20221203095858.612027-1-liuyongqiang13@huawei.com [1] +Link: http://lore.kernel.org/r/3cf0890b-4eb0-e70e-cd9c-2ecc3d496263@hpe.com [2] +Reported-by: Yongqiang Liu +Reported-by: Paul Cassella +Reported-by: Ira Weiny +Signed-off-by: Dan Williams +Link: https://lore.kernel.org/r/168577284563.1672036.13493034988900989554.stgit@dwillia2-xfh.jf.intel.com +Reviewed-by: Ira Weiny +Signed-off-by: Vishal Verma +Signed-off-by: Sasha Levin +--- + drivers/dax/bus.c | 56 ++++++++++++++++++++++++--------------- + drivers/dax/dax-private.h | 4 ++- + 2 files changed, 37 insertions(+), 23 deletions(-) + +diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c +index ce010040bcef8..7ad61c707687f 100644 +--- a/drivers/dax/bus.c ++++ b/drivers/dax/bus.c +@@ -402,18 +402,34 @@ static void unregister_dev_dax(void *dev) + put_device(dev); + } + ++static void dax_region_free(struct kref *kref) ++{ ++ struct dax_region *dax_region; ++ ++ dax_region = container_of(kref, struct dax_region, kref); ++ kfree(dax_region); ++} ++ ++void dax_region_put(struct dax_region *dax_region) ++{ ++ kref_put(&dax_region->kref, dax_region_free); ++} ++EXPORT_SYMBOL_GPL(dax_region_put); ++ + /* a return value >= 0 indicates this invocation invalidated the id */ + static int __free_dev_dax_id(struct dev_dax *dev_dax) + { +- struct dax_region *dax_region = dev_dax->region; + struct device *dev = &dev_dax->dev; ++ struct dax_region *dax_region; + int rc = dev_dax->id; + + device_lock_assert(dev); + +- if (is_static(dax_region) || dev_dax->id < 0) ++ if (!dev_dax->dyn_id || dev_dax->id < 0) + return -1; ++ dax_region = dev_dax->region; + ida_free(&dax_region->ida, dev_dax->id); ++ dax_region_put(dax_region); + dev_dax->id = -1; + return rc; + } +@@ -429,6 +445,20 @@ static int free_dev_dax_id(struct dev_dax *dev_dax) + return rc; + } + ++static int alloc_dev_dax_id(struct dev_dax *dev_dax) ++{ ++ struct dax_region *dax_region = dev_dax->region; ++ int id; ++ ++ id = ida_alloc(&dax_region->ida, GFP_KERNEL); ++ if (id < 0) ++ return id; ++ kref_get(&dax_region->kref); ++ dev_dax->dyn_id = true; ++ dev_dax->id = id; ++ return id; ++} ++ + static ssize_t delete_store(struct device *dev, struct device_attribute *attr, + const char *buf, size_t len) + { +@@ -516,20 +546,6 @@ static const struct attribute_group *dax_region_attribute_groups[] = { + NULL, + }; + +-static void dax_region_free(struct kref *kref) +-{ +- struct dax_region *dax_region; +- +- dax_region = container_of(kref, struct dax_region, kref); +- kfree(dax_region); +-} +- +-void dax_region_put(struct dax_region *dax_region) +-{ +- kref_put(&dax_region->kref, dax_region_free); +-} +-EXPORT_SYMBOL_GPL(dax_region_put); +- + static void dax_region_unregister(void *region) + { + struct dax_region *dax_region = region; +@@ -1254,12 +1270,10 @@ static const struct attribute_group *dax_attribute_groups[] = { + static void dev_dax_release(struct device *dev) + { + struct dev_dax *dev_dax = to_dev_dax(dev); +- struct dax_region *dax_region = dev_dax->region; + struct dax_device *dax_dev = dev_dax->dax_dev; + + put_dax(dax_dev); + free_dev_dax_id(dev_dax); +- dax_region_put(dax_region); + kfree(dev_dax->pgmap); + kfree(dev_dax); + } +@@ -1283,6 +1297,7 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data) + if (!dev_dax) + return ERR_PTR(-ENOMEM); + ++ dev_dax->region = dax_region; + if (is_static(dax_region)) { + if (dev_WARN_ONCE(parent, data->id < 0, + "dynamic id specified to static region\n")) { +@@ -1298,13 +1313,11 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data) + goto err_id; + } + +- rc = ida_alloc(&dax_region->ida, GFP_KERNEL); ++ rc = alloc_dev_dax_id(dev_dax); + if (rc < 0) + goto err_id; +- dev_dax->id = rc; + } + +- dev_dax->region = dax_region; + dev = &dev_dax->dev; + device_initialize(dev); + dev_set_name(dev, "dax%d.%d", dax_region->id, dev_dax->id); +@@ -1342,7 +1355,6 @@ struct dev_dax *devm_create_dev_dax(struct dev_dax_data *data) + dev_dax->target_node = dax_region->target_node; + dev_dax->align = dax_region->align; + ida_init(&dev_dax->ida); +- kref_get(&dax_region->kref); + + inode = dax_inode(dax_dev); + dev->devt = inode->i_rdev; +diff --git a/drivers/dax/dax-private.h b/drivers/dax/dax-private.h +index 1c974b7caae6e..afcada6fd2eda 100644 +--- a/drivers/dax/dax-private.h ++++ b/drivers/dax/dax-private.h +@@ -52,7 +52,8 @@ struct dax_mapping { + * @region - parent region + * @dax_dev - core dax functionality + * @target_node: effective numa node if dev_dax memory range is onlined +- * @id: ida allocated id ++ * @dyn_id: is this a dynamic or statically created instance ++ * @id: ida allocated id when the dax_region is not static + * @ida: mapping id allocator + * @dev - device core + * @pgmap - pgmap for memmap setup / lifetime (driver owned) +@@ -64,6 +65,7 @@ struct dev_dax { + struct dax_device *dax_dev; + unsigned int align; + int target_node; ++ bool dyn_id; + int id; + struct ida ida; + struct device dev; +-- +2.39.2 + diff --git a/queue-5.15/dax-kmem-pass-valid-argument-to-memory_group_registe.patch b/queue-5.15/dax-kmem-pass-valid-argument-to-memory_group_registe.patch new file mode 100644 index 00000000000..f328ba7a77a --- /dev/null +++ b/queue-5.15/dax-kmem-pass-valid-argument-to-memory_group_registe.patch @@ -0,0 +1,76 @@ +From 046f25be51125790a5f109f066228a6eede17a89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 21:20:25 +0530 +Subject: dax/kmem: Pass valid argument to memory_group_register_static + +From: Tarun Sahu + +[ Upstream commit 46e66dab8565f742374e9cc4ff7d35f344d774e2 ] + +memory_group_register_static takes maximum number of pages as the argument +while dev_dax_kmem_probe passes total_len (in bytes) as the argument. + +IIUC, I don't see any crash/panic impact as such. As, +memory_group_register_static just set the max_pages limit which is used in +auto_movable_zone_for_pfn to determine the zone. + +which might cause these condition to behave differently, + +This will be true always so jump will happen to kernel_zone + ... + if (!auto_movable_can_online_movable(NUMA_NO_NODE, group, nr_pages)) + goto kernel_zone; + + ... + kernel_zone: + return default_kernel_zone_for_pfn(nid, pfn, nr_pages); + +Here, In below, zone_intersects compare range will be larger as nr_pages +will be higher (derived from total_len passed in dev_dax_kmem_probe). + + ... + static struct zone *default_kernel_zone_for_pfn(int nid, unsigned long start_pfn, + unsigned long nr_pages) + { + struct pglist_data *pgdat = NODE_DATA(nid); + int zid; + + for (zid = 0; zid < ZONE_NORMAL; zid++) { + struct zone *zone = &pgdat->node_zones[zid]; + + if (zone_intersects(zone, start_pfn, nr_pages)) + return zone; + } + + return &pgdat->node_zones[ZONE_NORMAL]; + } + +Incorrect zone will be returned here, which in later time might cause bigger +problem. + +Fixes: eedf634aac3b ("dax/kmem: use a single static memory group for a single probed unit") +Signed-off-by: Tarun Sahu +Link: https://lore.kernel.org/r/20230621155025.370672-1-tsahu@linux.ibm.com +Reviewed-by: Vishal Verma +Signed-off-by: Vishal Verma +Signed-off-by: Sasha Levin +--- + drivers/dax/kmem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dax/kmem.c b/drivers/dax/kmem.c +index 04f85f16720c8..97723ee15bc68 100644 +--- a/drivers/dax/kmem.c ++++ b/drivers/dax/kmem.c +@@ -88,7 +88,7 @@ static int dev_dax_kmem_probe(struct dev_dax *dev_dax) + if (!data->res_name) + goto err_res_name; + +- rc = memory_group_register_static(numa_node, total_len); ++ rc = memory_group_register_static(numa_node, PFN_UP(total_len)); + if (rc < 0) + goto err_reg_mgid; + data->mgid = rc; +-- +2.39.2 + diff --git a/queue-5.15/drivers-meson-secure-pwrc-always-enable-dma-domain.patch b/queue-5.15/drivers-meson-secure-pwrc-always-enable-dma-domain.patch new file mode 100644 index 00000000000..5cf6111cf0e --- /dev/null +++ b/queue-5.15/drivers-meson-secure-pwrc-always-enable-dma-domain.patch @@ -0,0 +1,42 @@ +From 49b686fb56018f69fa0b39db6b7a9378c58838a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jun 2023 12:04:14 +0300 +Subject: drivers: meson: secure-pwrc: always enable DMA domain + +From: Alexey Romanov + +[ Upstream commit 0bb4644d583789c97e74d3e3047189f0c59c4742 ] + +Starting from commit e45f243409db ("firmware: meson_sm: +populate platform devices from sm device tree data") pwrc +is probed successfully and disables unused pwr domains. +By A1 SoC family design, any TEE requires DMA pwr domain +always enabled. + +Fixes: b3dde5013e13 ("soc: amlogic: Add support for Secure power domains controller") +Signed-off-by: Alexey Romanov +Acked-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230610090414.90529-1-avromanov@sberdevices.ru +[narmstrong: added fixes tag] +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + drivers/soc/amlogic/meson-secure-pwrc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/amlogic/meson-secure-pwrc.c b/drivers/soc/amlogic/meson-secure-pwrc.c +index 2eeea5e1b3b7f..2f3ca5531fa96 100644 +--- a/drivers/soc/amlogic/meson-secure-pwrc.c ++++ b/drivers/soc/amlogic/meson-secure-pwrc.c +@@ -104,7 +104,7 @@ static struct meson_secure_pwrc_domain_desc a1_pwrc_domains[] = { + SEC_PD(ACODEC, 0), + SEC_PD(AUDIO, 0), + SEC_PD(OTP, 0), +- SEC_PD(DMA, 0), ++ SEC_PD(DMA, GENPD_FLAG_ALWAYS_ON | GENPD_FLAG_IRQ_SAFE), + SEC_PD(SD_EMMC, 0), + SEC_PD(RAMA, 0), + /* SRAMB is used as ATF runtime memory, and should be always on */ +-- +2.39.2 + diff --git a/queue-5.15/drm-amd-display-add-logging-for-display-mall-refresh.patch b/queue-5.15/drm-amd-display-add-logging-for-display-mall-refresh.patch new file mode 100644 index 00000000000..8b8693e75d3 --- /dev/null +++ b/queue-5.15/drm-amd-display-add-logging-for-display-mall-refresh.patch @@ -0,0 +1,40 @@ +From 825651e3d99631f0657591b1c17b6bf1ceb5ccc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jun 2020 11:49:16 -0400 +Subject: drm/amd/display: Add logging for display MALL refresh setting + +From: Wesley Chalmers + +[ Upstream commit cd8f067a46d34dee3188da184912ae3d64d98444 ] + +[WHY] +Add log entry for when display refresh from MALL +settings are sent to SMU. + +Fixes: 1664641ea946 ("drm/amd/display: Add logger for SMU msg") +Signed-off-by: Wesley Chalmers +Acked-by: Aurabindo Pillai +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c +index 8ecc708bcd9ec..766759420eebb 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c +@@ -302,6 +302,9 @@ void dcn30_smu_set_display_refresh_from_mall(struct clk_mgr_internal *clk_mgr, b + /* bits 8:7 for cache timer scale, bits 6:1 for cache timer delay, bit 0 = 1 for enable, = 0 for disable */ + uint32_t param = (cache_timer_scale << 7) | (cache_timer_delay << 1) | (enable ? 1 : 0); + ++ smu_print("SMU Set display refresh from mall: enable = %d, cache_timer_delay = %d, cache_timer_scale = %d\n", ++ enable, cache_timer_delay, cache_timer_scale); ++ + dcn30_smu_send_msg_with_param(clk_mgr, + DALSMC_MSG_SetDisplayRefreshFromMall, param, NULL); + } +-- +2.39.2 + diff --git a/queue-5.15/drm-amd-display-explicitly-specify-update-type-per-p.patch b/queue-5.15/drm-amd-display-explicitly-specify-update-type-per-p.patch new file mode 100644 index 00000000000..04c6fe42c02 --- /dev/null +++ b/queue-5.15/drm-amd-display-explicitly-specify-update-type-per-p.patch @@ -0,0 +1,49 @@ +From 8a0c36ea4dbcb0878c7d5d0141d892163a81f21b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2019 13:21:48 -0400 +Subject: drm/amd/display: Explicitly specify update type per plane info change + +From: Nicholas Kazlauskas + +[ Upstream commit 710cc1e7cd461446a9325c9bd1e9a54daa462952 ] + +[Why] +The bit for flip addr is being set causing the determination for +FAST vs MEDIUM to always return MEDIUM when plane info is provided +as a surface update. This causes extreme stuttering for the typical +atomic update path on Linux. + +[How] +Don't use update_flags->raw for determining FAST vs MEDIUM. It's too +fragile to changes like this. + +Explicitly specify the update type per update flag instead. It's not +as clever as checking the bits itself but at least it's correct. + +Fixes: aa5fdb1ab5b6 ("drm/amd/display: Explicitly specify update type per plane info change") +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Nicholas Kazlauskas +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index 220a26e45a284..634640d5c0ff4 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -2111,9 +2111,6 @@ static enum surface_update_type det_surface_update(const struct dc *dc, + enum surface_update_type overall_type = UPDATE_TYPE_FAST; + union surface_update_flags *update_flags = &u->surface->update_flags; + +- if (u->flip_addr) +- update_flags->bits.addr_update = 1; +- + if (!is_surface_in_context(context, u->surface) || u->surface->force_full_update) { + update_flags->raw = 0xFFFFFFFF; + return UPDATE_TYPE_FULL; +-- +2.39.2 + diff --git a/queue-5.15/drm-amd-display-fix-artifacting-on-edp-panels-when-e.patch b/queue-5.15/drm-amd-display-fix-artifacting-on-edp-panels-when-e.patch new file mode 100644 index 00000000000..7d41b867f34 --- /dev/null +++ b/queue-5.15/drm-amd-display-fix-artifacting-on-edp-panels-when-e.patch @@ -0,0 +1,47 @@ +From 2d93f65ccdff98ba59f1c577aac05280c5a2a12c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 14:39:46 -0400 +Subject: drm/amd/display: Fix artifacting on eDP panels when engaging freesync + video mode + +From: Aurabindo Pillai + +[ Upstream commit b18f05a0666aecd5cb19c26a8305bcfa4e9d6502 ] + +[Why] +When freesync video mode is enabled, switching resolution from native +mode to one of the freesync video compatible modes can trigger continous +artifacts on some eDP panels when running under KDE. The articating can be seen in the +attached bug report. + +[How] +Fix this by restricting updates that require full commit by using the same checks +for stream and scaling changes in the the enable pass of dm_update_crtc_state() +along with the check for compatible timings for freesync vide mode. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2162 +Fixes: da5e14909776 ("drm/amd/display: Fix hang when skipping modeset") +Signed-off-by: Aurabindo Pillai +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index be863af956bb0..79ac19948e7af 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10209,6 +10209,8 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, + + /* Now check if we should set freesync video mode */ + if (amdgpu_freesync_vid_mode && dm_new_crtc_state->stream && ++ dc_is_stream_unchanged(new_stream, dm_old_crtc_state->stream) && ++ dc_is_stream_scaling_unchanged(new_stream, dm_old_crtc_state->stream) && + is_timing_unchanged_for_freesync(new_crtc_state, + old_crtc_state)) { + new_crtc_state->mode_changed = false; +-- +2.39.2 + diff --git a/queue-5.15/drm-amdkfd-fix-potential-deallocation-of-previously-.patch b/queue-5.15/drm-amdkfd-fix-potential-deallocation-of-previously-.patch new file mode 100644 index 00000000000..453b3f2240c --- /dev/null +++ b/queue-5.15/drm-amdkfd-fix-potential-deallocation-of-previously-.patch @@ -0,0 +1,58 @@ +From 7035118f13177eecc6ebc6995353e7eb066292cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2023 04:23:14 -0700 +Subject: drm/amdkfd: Fix potential deallocation of previously deallocated + memory. + +From: Daniil Dulov + +[ Upstream commit cabbdea1f1861098991768d7bbf5a49ed1608213 ] + +Pointer mqd_mem_obj can be deallocated in kfd_gtt_sa_allocate(). +The function then returns non-zero value, which causes the second deallocation. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: d1f8f0d17d40 ("drm/amdkfd: Move non-sdma mqd allocation out of init_mqd") +Signed-off-by: Daniil Dulov +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +index 7f4e102ff4bd3..ddaafcd7b8256 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +@@ -113,18 +113,19 @@ static struct kfd_mem_obj *allocate_mqd(struct kfd_dev *kfd, + &(mqd_mem_obj->gtt_mem), + &(mqd_mem_obj->gpu_addr), + (void *)&(mqd_mem_obj->cpu_ptr), true); ++ ++ if (retval) { ++ kfree(mqd_mem_obj); ++ return NULL; ++ } + } else { + retval = kfd_gtt_sa_allocate(kfd, sizeof(struct v9_mqd), + &mqd_mem_obj); +- } +- +- if (retval) { +- kfree(mqd_mem_obj); +- return NULL; ++ if (retval) ++ return NULL; + } + + return mqd_mem_obj; +- + } + + static void init_mqd(struct mqd_manager *mm, void **mqd, +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-tc358768-add-atomic_get_input_bus_fmts-im.patch b/queue-5.15/drm-bridge-tc358768-add-atomic_get_input_bus_fmts-im.patch new file mode 100644 index 00000000000..efd9d855bf2 --- /dev/null +++ b/queue-5.15/drm-bridge-tc358768-add-atomic_get_input_bus_fmts-im.patch @@ -0,0 +1,98 @@ +From d60c04169be099f17b3d0b6aec0688c203f95c90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 11:59:41 +0200 +Subject: drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation + +From: Francesco Dolcini + +[ Upstream commit cec5ccef85bd0128cf895612de54a9d21d2015d0 ] + +Add atomic_get_input_bus_fmts() implementation, tc358768 has a parallel +RGB input interface with the actual bus format depending on the amount +of parallel input data lines. + +Without this change when the tc358768 is used with less than 24bit the +color mapping is completely wrong. + +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230330095941.428122-7-francesco@dolcini.it +Stable-dep-of: ee18698e212b ("drm/bridge: tc358768: fix TCLK_TRAILCNT computation") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 44 +++++++++++++++++++++++++++++++ + 1 file changed, 44 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index fa06c06e41ebe..6e95dd4b7aef7 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -871,6 +872,44 @@ static void tc358768_bridge_enable(struct drm_bridge *bridge) + } + } + ++#define MAX_INPUT_SEL_FORMATS 1 ++ ++static u32 * ++tc358768_atomic_get_input_bus_fmts(struct drm_bridge *bridge, ++ struct drm_bridge_state *bridge_state, ++ struct drm_crtc_state *crtc_state, ++ struct drm_connector_state *conn_state, ++ u32 output_fmt, ++ unsigned int *num_input_fmts) ++{ ++ struct tc358768_priv *priv = bridge_to_tc358768(bridge); ++ u32 *input_fmts; ++ ++ *num_input_fmts = 0; ++ ++ input_fmts = kcalloc(MAX_INPUT_SEL_FORMATS, sizeof(*input_fmts), ++ GFP_KERNEL); ++ if (!input_fmts) ++ return NULL; ++ ++ switch (priv->pd_lines) { ++ case 16: ++ input_fmts[0] = MEDIA_BUS_FMT_RGB565_1X16; ++ break; ++ case 18: ++ input_fmts[0] = MEDIA_BUS_FMT_RGB666_1X18; ++ break; ++ default: ++ case 24: ++ input_fmts[0] = MEDIA_BUS_FMT_RGB888_1X24; ++ break; ++ }; ++ ++ *num_input_fmts = MAX_INPUT_SEL_FORMATS; ++ ++ return input_fmts; ++} ++ + static const struct drm_bridge_funcs tc358768_bridge_funcs = { + .attach = tc358768_bridge_attach, + .mode_valid = tc358768_bridge_mode_valid, +@@ -878,6 +917,11 @@ static const struct drm_bridge_funcs tc358768_bridge_funcs = { + .enable = tc358768_bridge_enable, + .disable = tc358768_bridge_disable, + .post_disable = tc358768_bridge_post_disable, ++ ++ .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state, ++ .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state, ++ .atomic_reset = drm_atomic_helper_bridge_reset, ++ .atomic_get_input_bus_fmts = tc358768_atomic_get_input_bus_fmts, + }; + + static const struct drm_bridge_timings default_tc358768_timings = { +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-tc358768-always-enable-hs-video-mode.patch b/queue-5.15/drm-bridge-tc358768-always-enable-hs-video-mode.patch new file mode 100644 index 00000000000..50d7e0b5922 --- /dev/null +++ b/queue-5.15/drm-bridge-tc358768-always-enable-hs-video-mode.patch @@ -0,0 +1,49 @@ +From a16777ea53614bfbf91e189979e88eb247825519 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:26 +0200 +Subject: drm/bridge: tc358768: always enable HS video mode + +From: Francesco Dolcini + +[ Upstream commit 75a8aeac2573ab258c53676eba9b3796ea691988 ] + +Always enable HS video mode setting the TXMD bit, without this change no +video output is present with DSI sinks that are setting +MIPI_DSI_MODE_LPM flag (tested with LT8912B DSI-HDMI bridge). + +Previously the driver was enabling HS mode only when the DSI sink was +not explicitly setting the MIPI_DSI_MODE_LPM, however this is not +correct. + +The MIPI_DSI_MODE_LPM is supposed to indicate that the sink is willing +to receive data in low power mode, however clearing the +TC358768_DSI_CONTROL_TXMD bit will make the TC358768 send video in +LP mode that is not the intended behavior. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index a3db532bbdd16..8de7d9764ba88 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -819,8 +819,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + val = TC358768_DSI_CONFW_MODE_SET | TC358768_DSI_CONFW_ADDR_DSI_CONTROL; + val |= (dsi_dev->lanes - 1) << 1; + +- if (!(dsi_dev->mode_flags & MIPI_DSI_MODE_LPM)) +- val |= TC358768_DSI_CONTROL_TXMD; ++ val |= TC358768_DSI_CONTROL_TXMD; + + if (!(dsi_dev->mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS)) + val |= TC358768_DSI_CONTROL_HSCKMD; +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-tc358768-fix-pll-parameters-computation.patch b/queue-5.15/drm-bridge-tc358768-fix-pll-parameters-computation.patch new file mode 100644 index 00000000000..1516b25b5a8 --- /dev/null +++ b/queue-5.15/drm-bridge-tc358768-fix-pll-parameters-computation.patch @@ -0,0 +1,49 @@ +From 507ef3091a4136a9a8d6a62917c5a4cde29ecdcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:27 +0200 +Subject: drm/bridge: tc358768: fix PLL parameters computation + +From: Francesco Dolcini + +[ Upstream commit 6a4020b4c63911977aaf8047f904a300d15de739 ] + +According to Toshiba documentation the PLL input clock after the divider +should be not less than 4MHz, fix the PLL parameters computation +accordingly. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index 8de7d9764ba88..e09e007a2749c 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -329,13 +329,17 @@ static int tc358768_calc_pll(struct tc358768_priv *priv, + u32 fbd; + + for (fbd = 0; fbd < 512; ++fbd) { +- u32 pll, diff; ++ u32 pll, diff, pll_in; + + pll = (u32)div_u64((u64)refclk * (fbd + 1), divisor); + + if (pll >= max_pll || pll < min_pll) + continue; + ++ pll_in = (u32)div_u64((u64)refclk, prd + 1); ++ if (pll_in < 4000000) ++ continue; ++ + diff = max(pll, target_pll) - min(pll, target_pll); + + if (diff < best_diff) { +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-tc358768-fix-pll-target-frequency.patch b/queue-5.15/drm-bridge-tc358768-fix-pll-target-frequency.patch new file mode 100644 index 00000000000..cbe25a15ac5 --- /dev/null +++ b/queue-5.15/drm-bridge-tc358768-fix-pll-target-frequency.patch @@ -0,0 +1,74 @@ +From 6fe69e8722d56560dcc1dbe646894a2798bee7c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:28 +0200 +Subject: drm/bridge: tc358768: fix PLL target frequency + +From: Francesco Dolcini + +[ Upstream commit ffd2e4bbea626d565b9817312b0fcfb382fecb88 ] + +Correctly compute the PLL target frequency, the current formula works +correctly only when the input bus width is 24bit, actually to properly +compute the PLL target frequency what is relevant is the bits-per-pixel +on the DSI link. + +No regression expected since the DSI format is currently hard-coded as +MIPI_DSI_FMT_RGB888. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index e09e007a2749c..e302310d4acec 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -147,6 +147,7 @@ struct tc358768_priv { + + u32 pd_lines; /* number of Parallel Port Input Data Lines */ + u32 dsi_lanes; /* number of DSI Lanes */ ++ u32 dsi_bpp; /* number of Bits Per Pixel over DSI */ + + /* Parameters for PLL programming */ + u32 fbd; /* PLL feedback divider */ +@@ -279,12 +280,12 @@ static void tc358768_hw_disable(struct tc358768_priv *priv) + + static u32 tc358768_pll_to_pclk(struct tc358768_priv *priv, u32 pll_clk) + { +- return (u32)div_u64((u64)pll_clk * priv->dsi_lanes, priv->pd_lines); ++ return (u32)div_u64((u64)pll_clk * priv->dsi_lanes, priv->dsi_bpp); + } + + static u32 tc358768_pclk_to_pll(struct tc358768_priv *priv, u32 pclk) + { +- return (u32)div_u64((u64)pclk * priv->pd_lines, priv->dsi_lanes); ++ return (u32)div_u64((u64)pclk * priv->dsi_bpp, priv->dsi_lanes); + } + + static int tc358768_calc_pll(struct tc358768_priv *priv, +@@ -421,6 +422,7 @@ static int tc358768_dsi_host_attach(struct mipi_dsi_host *host, + priv->output.panel = panel; + + priv->dsi_lanes = dev->lanes; ++ priv->dsi_bpp = mipi_dsi_pixel_format_to_bpp(dev->format); + + /* get input ep (port0/endpoint0) */ + ret = -EINVAL; +@@ -432,7 +434,7 @@ static int tc358768_dsi_host_attach(struct mipi_dsi_host *host, + } + + if (ret) +- priv->pd_lines = mipi_dsi_pixel_format_to_bpp(dev->format); ++ priv->pd_lines = priv->dsi_bpp; + + drm_bridge_add(&priv->bridge); + +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-tc358768-fix-tclk_trailcnt-computation.patch b/queue-5.15/drm-bridge-tc358768-fix-tclk_trailcnt-computation.patch new file mode 100644 index 00000000000..c405c72750f --- /dev/null +++ b/queue-5.15/drm-bridge-tc358768-fix-tclk_trailcnt-computation.patch @@ -0,0 +1,92 @@ +From eb9d1250fceb84afd0deeeb6a4e3b3dc9b4d26b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:30 +0200 +Subject: drm/bridge: tc358768: fix TCLK_TRAILCNT computation + +From: Francesco Dolcini + +[ Upstream commit ee18698e212b1659dd0850d7e2ae0f22e16ed3d3 ] + +Correct computation of TCLK_TRAILCNT register. + +The driver does not implement non-continuous clock mode, so the actual +value doesn't make a practical difference yet. However this change also +ensures that the value does not write to reserved registers bits in case +of under/overflow. + +This register must be set to a value that ensures that + +TCLK-TRAIL > 60ns + and +TEOT <= (105 ns + 12 x UI) + +with the actual value of TCLK-TRAIL being + +(TCLK_TRAILCNT + (1 to 2)) xHSByteClkCycle + + (2 + (1 to 2)) * HSBYTECLKCycle - (PHY output delay) + +with PHY output delay being about + +(2 to 3) x MIPIBitClk cycle in the BitClk conversion. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-2-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-3-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-4-francesco@dolcini.it +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index 6e95dd4b7aef7..de4022c864034 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -633,6 +634,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + struct tc358768_priv *priv = bridge_to_tc358768(bridge); + struct mipi_dsi_device *dsi_dev = priv->output.dev; + u32 val, val2, lptxcnt, hact, data_type; ++ s32 raw_val; + const struct drm_display_mode *mode; + u32 dsibclk_nsk, dsiclk_nsk, ui_nsk, phy_delay_nsk; + u32 dsiclk, dsibclk; +@@ -733,9 +735,9 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + dev_dbg(priv->dev, "TCLK_HEADERCNT: 0x%x\n", val); + tc358768_write(priv, TC358768_TCLK_HEADERCNT, val); + +- /* TCLK_TRAIL > 60ns + 3*UI */ +- val = 60 + tc358768_to_ns(3 * ui_nsk); +- val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 5; ++ /* TCLK_TRAIL > 60ns AND TEOT <= 105 ns + 12*UI */ ++ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(2 * ui_nsk), dsibclk_nsk) - 5; ++ val = clamp(raw_val, 0, 127); + dev_dbg(priv->dev, "TCLK_TRAILCNT: 0x%x\n", val); + tc358768_write(priv, TC358768_TCLK_TRAILCNT, val); + +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-tc358768-fix-tclk_zerocnt-computation.patch b/queue-5.15/drm-bridge-tc358768-fix-tclk_zerocnt-computation.patch new file mode 100644 index 00000000000..fc8764f2363 --- /dev/null +++ b/queue-5.15/drm-bridge-tc358768-fix-tclk_zerocnt-computation.patch @@ -0,0 +1,54 @@ +From 35e5254d8022c4eab088d9e0609c24eb43c8e0c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:29 +0200 +Subject: drm/bridge: tc358768: fix TCLK_ZEROCNT computation + +From: Francesco Dolcini + +[ Upstream commit f9cf811374f42fca31ac34aaf59ee2ae72b89879 ] + +Correct computation of TCLK_ZEROCNT register. + +This register must be set to a value that ensure that +(TCLK-PREPARECNT + TCLK-ZERO) > 300ns + +with the actual value of (TCLK-PREPARECNT + TCLK-ZERO) being + +(1 to 2) + (TCLK_ZEROCNT + 1)) x HSByteClkCycle + (PHY output delay) + +with PHY output delay being about + +(2 to 3) x MIPIBitClk cycle in the BitClk conversion. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-5-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index e302310d4acec..fa06c06e41ebe 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -725,10 +725,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + + /* 38ns < TCLK_PREPARE < 95ns */ + val = tc358768_ns_to_cnt(65, dsibclk_nsk) - 1; +- /* TCLK_PREPARE > 300ns */ +- val2 = tc358768_ns_to_cnt(300 + tc358768_to_ns(3 * ui_nsk), +- dsibclk_nsk); +- val |= (val2 - tc358768_to_ns(phy_delay_nsk - dsibclk_nsk)) << 8; ++ /* TCLK_PREPARE + TCLK_ZERO > 300ns */ ++ val2 = tc358768_ns_to_cnt(300 - tc358768_to_ns(2 * ui_nsk), ++ dsibclk_nsk) - 2; ++ val |= val2 << 8; + dev_dbg(priv->dev, "TCLK_HEADERCNT: 0x%x\n", val); + tc358768_write(priv, TC358768_TCLK_HEADERCNT, val); + +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-tc358768-fix-ths_trailcnt-computation.patch b/queue-5.15/drm-bridge-tc358768-fix-ths_trailcnt-computation.patch new file mode 100644 index 00000000000..fac28b403e1 --- /dev/null +++ b/queue-5.15/drm-bridge-tc358768-fix-ths_trailcnt-computation.patch @@ -0,0 +1,60 @@ +From 4bd8773ad01bfff363f545d8c3fa9b0564294157 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:33 +0200 +Subject: drm/bridge: tc358768: fix THS_TRAILCNT computation + +From: Francesco Dolcini + +[ Upstream commit bac7842cd179572e8e0fc2d7b5254e40c6e9e057 ] + +Correct computation of THS_TRAILCNT register. + +This register must be set to a value that ensure that +THS_TRAIL > 60 ns + 4 x UI + and +THS_TRAIL > 8 x UI + and +THS_TRAIL < TEOT + with +TEOT = 105 ns + (12 x UI) + +with the actual value of THS_TRAIL being + +(1 + THS_TRAILCNT) x ByteClk cycle + ((1 to 2) + 2) xHSBYTECLK cycle + + - (PHY output delay) + +with PHY output delay being about + +(8 + (5 to 6)) x MIPIBitClk cycle in the BitClk conversion. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-9-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index c9c2e15c6f4a2..8b1bdffc5005d 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -763,9 +763,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + dev_dbg(priv->dev, "TCLK_POSTCNT: 0x%x\n", val); + tc358768_write(priv, TC358768_TCLK_POSTCNT, val); + +- /* 60ns + 4*UI < THS_PREPARE < 105ns + 12*UI */ +- val = tc358768_ns_to_cnt(60 + tc358768_to_ns(15 * ui_nsk), +- dsibclk_nsk) - 5; ++ /* max(60ns + 4*UI, 8*UI) < THS_TRAILCNT < 105ns + 12*UI */ ++ raw_val = tc358768_ns_to_cnt(60 + tc358768_to_ns(18 * ui_nsk), ++ dsibclk_nsk) - 4; ++ val = clamp(raw_val, 0, 15); + dev_dbg(priv->dev, "THS_TRAILCNT: 0x%x\n", val); + tc358768_write(priv, TC358768_THS_TRAILCNT, val); + +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-tc358768-fix-ths_zerocnt-computation.patch b/queue-5.15/drm-bridge-tc358768-fix-ths_zerocnt-computation.patch new file mode 100644 index 00000000000..99cbef6d073 --- /dev/null +++ b/queue-5.15/drm-bridge-tc358768-fix-ths_zerocnt-computation.patch @@ -0,0 +1,54 @@ +From 15ad2cb4e8f60bdf7414bff95f35ddcca306da61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:31 +0200 +Subject: drm/bridge: tc358768: fix THS_ZEROCNT computation + +From: Francesco Dolcini + +[ Upstream commit 77a089328da791118af9692543a5eedc79eb5fd4 ] + +Correct computation of THS_ZEROCNT register. + +This register must be set to a value that ensure that +THS_PREPARE + THS_ZERO > 145ns + 10*UI + +with the actual value of (THS_PREPARE + THS_ZERO) being + +((1 to 2) + 1 + (TCLK_ZEROCNT + 1) + (3 to 4)) x ByteClk cycle + + + HSByteClk x (2 + (1 to 2)) + (PHY delay) + +with PHY delay being about + +(8 + (5 to 6)) x MIPIBitClk cycle in the BitClk conversion. + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-7-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index de4022c864034..151eecbf6027d 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -744,9 +744,10 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + /* 40ns + 4*UI < THS_PREPARE < 85ns + 6*UI */ + val = 50 + tc358768_to_ns(4 * ui_nsk); + val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 1; +- /* THS_ZERO > 145ns + 10*UI */ +- val2 = tc358768_ns_to_cnt(145 - tc358768_to_ns(ui_nsk), dsibclk_nsk); +- val |= (val2 - tc358768_to_ns(phy_delay_nsk)) << 8; ++ /* THS_PREPARE + THS_ZERO > 145ns + 10*UI */ ++ raw_val = tc358768_ns_to_cnt(145 - tc358768_to_ns(3 * ui_nsk), dsibclk_nsk) - 10; ++ val2 = clamp(raw_val, 0, 127); ++ val |= val2 << 8; + dev_dbg(priv->dev, "THS_HEADERCNT: 0x%x\n", val); + tc358768_write(priv, TC358768_THS_HEADERCNT, val); + +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-tc358768-fix-txtagocnt-computation.patch b/queue-5.15/drm-bridge-tc358768-fix-txtagocnt-computation.patch new file mode 100644 index 00000000000..ca05d8b4484 --- /dev/null +++ b/queue-5.15/drm-bridge-tc358768-fix-txtagocnt-computation.patch @@ -0,0 +1,44 @@ +From 788f47ad64967c3021a44e7d9809619e7164e4c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 16:29:32 +0200 +Subject: drm/bridge: tc358768: fix TXTAGOCNT computation + +From: Francesco Dolcini + +[ Upstream commit 3666aad8185af8d0ce164fd3c4974235417d6d0b ] + +Correct computation of TXTAGOCNT register. + +This register must be set to a value that ensure that the +TTA-GO period = (4 x TLPX) + +with the actual value of TTA-GO being + +4 x (TXTAGOCNT + 1) x (HSByteClk cycle) + +Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver") +Signed-off-by: Francesco Dolcini +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20230427142934.55435-8-francesco@dolcini.it +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358768.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c +index 151eecbf6027d..c9c2e15c6f4a2 100644 +--- a/drivers/gpu/drm/bridge/tc358768.c ++++ b/drivers/gpu/drm/bridge/tc358768.c +@@ -779,7 +779,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge) + + /* TXTAGOCNT[26:16] RXTASURECNT[10:0] */ + val = tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk * 4); +- val = tc358768_ns_to_cnt(val, dsibclk_nsk) - 1; ++ val = tc358768_ns_to_cnt(val, dsibclk_nsk) / 4 - 1; + val2 = tc358768_ns_to_cnt(tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk), + dsibclk_nsk) - 2; + val |= val2 << 16; +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-a5xx-really-check-for-a510-in-a5xx_gpu_init.patch b/queue-5.15/drm-msm-a5xx-really-check-for-a510-in-a5xx_gpu_init.patch new file mode 100644 index 00000000000..36b0e06cf06 --- /dev/null +++ b/queue-5.15/drm-msm-a5xx-really-check-for-a510-in-a5xx_gpu_init.patch @@ -0,0 +1,50 @@ +From 5b54975e5d85ad1b96fa4511a3e087b89e5d215e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Apr 2023 04:13:29 +0300 +Subject: drm/msm/a5xx: really check for A510 in a5xx_gpu_init + +From: Dmitry Baryshkov + +[ Upstream commit 736a9327365644b460e4498b1ce172ca411efcbc ] + +The commit 010c8bbad2cb ("drm: msm: adreno: Disable preemption on Adreno +510") added special handling for a510 (this SKU doesn't seem to support +preemption, so the driver should clamp nr_rings to 1). However the +gpu->revn is not yet set (it is set later, in adreno_gpu_init()) and +thus the condition is always false. Check config->rev instead. + +Fixes: 010c8bbad2cb ("drm: msm: adreno: Disable preemption on Adreno 510") +Reported-by: Adam Skladowski +Signed-off-by: Dmitry Baryshkov +Tested-by: Adam Skladowski +Patchwork: https://patchwork.freedesktop.org/patch/531511/ +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +index d92416d526286..ef62900b06128 100644 +--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +@@ -1746,6 +1746,7 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev) + { + struct msm_drm_private *priv = dev->dev_private; + struct platform_device *pdev = priv->gpu_pdev; ++ struct adreno_platform_config *config = pdev->dev.platform_data; + struct a5xx_gpu *a5xx_gpu = NULL; + struct adreno_gpu *adreno_gpu; + struct msm_gpu *gpu; +@@ -1772,7 +1773,7 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev) + + nr_rings = 4; + +- if (adreno_is_a510(adreno_gpu)) ++ if (adreno_cmp_rev(ADRENO_REV(5, 1, 0, ANY_ID), config->rev)) + nr_rings = 1; + + ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, nr_rings); +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-disp-dpu-get-timing-engine-status-from-intf-.patch b/queue-5.15/drm-msm-disp-dpu-get-timing-engine-status-from-intf-.patch new file mode 100644 index 00000000000..c95f22b21f1 --- /dev/null +++ b/queue-5.15/drm-msm-disp-dpu-get-timing-engine-status-from-intf-.patch @@ -0,0 +1,100 @@ +From 2dd5a118b3f266df46b32283418f4e585fcd6bab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Mar 2023 22:03:08 +0530 +Subject: drm/msm/disp/dpu: get timing engine status from intf status register + +From: Vinod Polimera + +[ Upstream commit e3969eadc8ee78a5bdca65b8ed0a421a359e4090 ] + +Recommended way of reading the interface timing gen status is via +status register. Timing gen status register will give a reliable status +of the interface especially during ON/OFF transitions. This support was +added from DPU version 5.0.0. + +Signed-off-by: Vinod Polimera +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/524724/ +Link: https://lore.kernel.org/r/1677774797-31063-6-git-send-email-quic_vpolimer@quicinc.com +Signed-off-by: Dmitry Baryshkov +Stable-dep-of: a7129231edf3 ("drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 3 ++- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 12 +++++++----- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 8 +++++++- + 3 files changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +index 4c65259eecb9d..70d14b0db50fa 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +@@ -53,7 +53,8 @@ + + #define INTF_SDM845_MASK (0) + +-#define INTF_SC7180_MASK BIT(DPU_INTF_INPUT_CTRL) | BIT(DPU_INTF_TE) ++#define INTF_SC7180_MASK \ ++ (BIT(DPU_INTF_INPUT_CTRL) | BIT(DPU_INTF_TE) | BIT(DPU_INTF_STATUS_SUPPORTED)) + + #define INTF_SC7280_MASK INTF_SC7180_MASK | BIT(DPU_DATA_HCTL_EN) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h +index d2a945a27cfaa..321b7599fe2d0 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h +@@ -191,17 +191,19 @@ enum { + + /** + * INTF sub-blocks +- * @DPU_INTF_INPUT_CTRL Supports the setting of pp block from which +- * pixel data arrives to this INTF +- * @DPU_INTF_TE INTF block has TE configuration support +- * @DPU_DATA_HCTL_EN Allows data to be transferred at different rate +- than video timing ++ * @DPU_INTF_INPUT_CTRL Supports the setting of pp block from which ++ * pixel data arrives to this INTF ++ * @DPU_INTF_TE INTF block has TE configuration support ++ * @DPU_DATA_HCTL_EN Allows data to be transferred at different rate ++ * than video timing ++ * @DPU_INTF_STATUS_SUPPORTED INTF block has INTF_STATUS register + * @DPU_INTF_MAX + */ + enum { + DPU_INTF_INPUT_CTRL = 0x1, + DPU_INTF_TE, + DPU_DATA_HCTL_EN, ++ DPU_INTF_STATUS_SUPPORTED, + DPU_INTF_MAX + }; + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c +index 916e2a4756c09..7c09d30a62b8d 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c +@@ -54,6 +54,7 @@ + #define INTF_PROG_FETCH_START 0x170 + #define INTF_PROG_ROT_START 0x174 + #define INTF_MUX 0x25C ++#define INTF_STATUS 0x26C + + static const struct dpu_intf_cfg *_intf_offset(enum dpu_intf intf, + const struct dpu_mdss_cfg *m, +@@ -259,8 +260,13 @@ static void dpu_hw_intf_get_status( + struct intf_status *s) + { + struct dpu_hw_blk_reg_map *c = &intf->hw; ++ unsigned long cap = intf->cap->features; ++ ++ if (cap & BIT(DPU_INTF_STATUS_SUPPORTED)) ++ s->is_en = DPU_REG_READ(c, INTF_STATUS) & BIT(0); ++ else ++ s->is_en = DPU_REG_READ(c, INTF_TIMING_ENGINE_EN); + +- s->is_en = DPU_REG_READ(c, INTF_TIMING_ENGINE_EN); + s->is_prog_fetch_en = !!(DPU_REG_READ(c, INTF_CONFIG) & BIT(31)); + if (s->is_en) { + s->frame_count = DPU_REG_READ(c, INTF_FRAME_COUNT); +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-dp-free-resources-after-unregistering-them.patch b/queue-5.15/drm-msm-dp-free-resources-after-unregistering-them.patch new file mode 100644 index 00000000000..20db04376c0 --- /dev/null +++ b/queue-5.15/drm-msm-dp-free-resources-after-unregistering-them.patch @@ -0,0 +1,46 @@ +From 7161240560bdb234bc2d45b8f1af03b36acea9c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 15:02:59 -0700 +Subject: drm/msm/dp: Free resources after unregistering them + +From: Bjorn Andersson + +[ Upstream commit fa0048a4b1fa7a50c8b0e514f5b428abdf69a6f8 ] + +The DP component's unbind operation walks through the submodules to +unregister and clean things up. But if the unbind happens because the DP +controller itself is being removed, all the memory for those submodules +has just been freed. + +Change the order of these operations to avoid the many use-after-free +that otherwise happens in this code path. + +Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") +Signed-off-by: Bjorn Andersson +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/542166/ +Link: https://lore.kernel.org/r/20230612220259.1884381-1-quic_bjorande@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c +index 38d37345c216b..bbe350fab797c 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -1295,9 +1295,9 @@ static int dp_display_remove(struct platform_device *pdev) + dp = container_of(g_dp_display, + struct dp_display_private, dp_display); + ++ component_del(&pdev->dev, &dp_display_comp_ops); + dp_display_deinit_sub_modules(dp); + +- component_del(&pdev->dev, &dp_display_comp_ops); + platform_set_drvdata(pdev, NULL); + + return 0; +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-dpu-correct-merge_3d-length.patch b/queue-5.15/drm-msm-dpu-correct-merge_3d-length.patch new file mode 100644 index 00000000000..6fc00f29db2 --- /dev/null +++ b/queue-5.15/drm-msm-dpu-correct-merge_3d-length.patch @@ -0,0 +1,39 @@ +From ccc339122d72988b16511589272cceaa2904d09e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 03:09:41 +0300 +Subject: drm/msm/dpu: correct MERGE_3D length + +From: Dmitry Baryshkov + +[ Upstream commit 9a6c13b847d61b0c3796820ca6e976789df59cd8 ] + +Each MERGE_3D block has just two registers. Correct the block length +accordingly. + +Fixes: 4369c93cf36b ("drm/msm/dpu: initial support for merge3D hardware block") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/542177/ +Reviewed-by: Marijn Suijten +Link: https://lore.kernel.org/r/20230613001004.3426676-3-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +index 951aa1aafa96a..272a3d7e1aef2 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +@@ -808,7 +808,7 @@ static const struct dpu_pingpong_cfg sm8150_pp[] = { + #define MERGE_3D_BLK(_name, _id, _base) \ + {\ + .name = _name, .id = _id, \ +- .base = _base, .len = 0x100, \ ++ .base = _base, .len = 0x8, \ + .features = MERGE_3D_SM8150_MASK, \ + .sblk = NULL \ + } +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-dpu-do-not-enable-color-management-if-dspps-.patch b/queue-5.15/drm-msm-dpu-do-not-enable-color-management-if-dspps-.patch new file mode 100644 index 00000000000..2517a7ebe92 --- /dev/null +++ b/queue-5.15/drm-msm-dpu-do-not-enable-color-management-if-dspps-.patch @@ -0,0 +1,54 @@ +From de0feefd5e2c9c5eda64084edbc95af5fda789fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 21:25:33 +0300 +Subject: drm/msm/dpu: do not enable color-management if DSPPs are not + available + +From: Dmitry Baryshkov + +[ Upstream commit 3bcfc7b90465efd337d39b91b43972162f0d1908 ] + +We can not support color management without DSPP blocks being provided +in the HW catalog. Do not enable color management for CRTCs if num_dspps +is 0. + +Fixes: 4259ff7ae509 ("drm/msm/dpu: add support for pcc color block in dpu driver") +Reported-by: Yongqin Liu +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Reviewed-by: Marijn Suijten +Reviewed-by: Sumit Semwal +Tested-by: Yongqin Liu +Patchwork: https://patchwork.freedesktop.org/patch/542141/ +Link: https://lore.kernel.org/r/20230612182534.3345805-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +index 4194689b6b35d..8be941c9b6a94 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +@@ -1380,6 +1380,8 @@ static const struct drm_crtc_helper_funcs dpu_crtc_helper_funcs = { + struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane, + struct drm_plane *cursor) + { ++ struct msm_drm_private *priv = dev->dev_private; ++ struct dpu_kms *dpu_kms = to_dpu_kms(priv->kms); + struct drm_crtc *crtc = NULL; + struct dpu_crtc *dpu_crtc = NULL; + int i; +@@ -1411,7 +1413,8 @@ struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane, + + drm_crtc_helper_add(crtc, &dpu_crtc_helper_funcs); + +- drm_crtc_enable_color_mgmt(crtc, 0, true, 0); ++ if (dpu_kms->catalog->dspp_count) ++ drm_crtc_enable_color_mgmt(crtc, 0, true, 0); + + /* save user friendly CRTC name for later */ + snprintf(dpu_crtc->name, DPU_CRTC_NAME_SIZE, "crtc%u", crtc->base.id); +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-dpu-set-dpu_data_hctl_en-for-in-intf_sc7180_.patch b/queue-5.15/drm-msm-dpu-set-dpu_data_hctl_en-for-in-intf_sc7180_.patch new file mode 100644 index 00000000000..a04631a7c96 --- /dev/null +++ b/queue-5.15/drm-msm-dpu-set-dpu_data_hctl_en-for-in-intf_sc7180_.patch @@ -0,0 +1,48 @@ +From ee953039420a66e6e8305379aa67389d53082f64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 20:49:59 +0200 +Subject: drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK + +From: Konrad Dybcio + +[ Upstream commit a7129231edf329a00e92dbd2d741f6da728a4a06 ] + +DPU5 and newer targets enable this unconditionally. Move it from the +SC7280 mask to the SC7180 one. + +Fixes: 7e6ee55320f0 ("drm/msm/disp/dpu1: enable DATA_HCTL_EN for sc7280 target") +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Marijn Suijten +Signed-off-by: Konrad Dybcio +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/538159/ +Link: https://lore.kernel.org/r/20230508-topic-hctl_en-v2-1-e7bea9f1f5dd@linaro.org +[DB: removed BIT(DPU_INTF_DATA_COMPRESS), which is not yet merged] +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +index 70d14b0db50fa..951aa1aafa96a 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +@@ -54,9 +54,12 @@ + #define INTF_SDM845_MASK (0) + + #define INTF_SC7180_MASK \ +- (BIT(DPU_INTF_INPUT_CTRL) | BIT(DPU_INTF_TE) | BIT(DPU_INTF_STATUS_SUPPORTED)) ++ (BIT(DPU_INTF_INPUT_CTRL) | \ ++ BIT(DPU_INTF_TE) | \ ++ BIT(DPU_INTF_STATUS_SUPPORTED) | \ ++ BIT(DPU_DATA_HCTL_EN)) + +-#define INTF_SC7280_MASK INTF_SC7180_MASK | BIT(DPU_DATA_HCTL_EN) ++#define INTF_SC7280_MASK (INTF_SC7180_MASK) + + #define IRQ_SDM845_MASK (BIT(MDP_SSPP_TOP0_INTR) | \ + BIT(MDP_SSPP_TOP0_INTR2) | \ +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-dsi-don-t-allow-enabling-14nm-vco-with-unpro.patch b/queue-5.15/drm-msm-dsi-don-t-allow-enabling-14nm-vco-with-unpro.patch new file mode 100644 index 00000000000..8404ec35faa --- /dev/null +++ b/queue-5.15/drm-msm-dsi-don-t-allow-enabling-14nm-vco-with-unpro.patch @@ -0,0 +1,45 @@ +From 6b8478f168a7f9e6805211275d55a686d7254a6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 May 2023 04:12:57 +0300 +Subject: drm/msm/dsi: don't allow enabling 14nm VCO with unprogrammed rate + +From: Dmitry Baryshkov + +[ Upstream commit 1e0a97f84d73ea1182740f62069690c7f3271abb ] + +If the dispcc uses CLK_OPS_PARENT_ENABLE (e.g. on QCM2290), CCF can try +enabling VCO before the rate has been programmed. This can cause clock +lockups and/or other boot issues. Program the VCO to the minimal PLL +rate if the read rate is 0 Hz. + +Cc: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Reported-by: Vladimir Zapolskiy +Reported-by: Konrad Dybcio +Reviewed-by: Konrad Dybcio +Fixes: f079f6d999cb ("drm/msm/dsi: Add PHY/PLL for 8x96") +Patchwork: https://patchwork.freedesktop.org/patch/534813/ +Link: https://lore.kernel.org/r/20230501011257.3460103-1-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c +index 6d3abcdc57bfb..66507eb713048 100644 +--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c ++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c +@@ -541,6 +541,9 @@ static int dsi_pll_14nm_vco_prepare(struct clk_hw *hw) + if (unlikely(pll_14nm->phy->pll_on)) + return 0; + ++ if (dsi_pll_14nm_vco_recalc_rate(hw, VCO_REF_CLK_RATE) == 0) ++ dsi_pll_14nm_vco_set_rate(hw, pll_14nm->phy->cfg->min_pll_rate, VCO_REF_CLK_RATE); ++ + dsi_phy_write(base + REG_DSI_14nm_PHY_PLL_VREF_CFG1, 0x10); + dsi_phy_write(cmn_base + REG_DSI_14nm_PHY_CMN_PLL_CNTRL, 1); + +-- +2.39.2 + diff --git a/queue-5.15/drm-panel-sharp-ls043t1le01-adjust-mode-settings.patch b/queue-5.15/drm-panel-sharp-ls043t1le01-adjust-mode-settings.patch new file mode 100644 index 00000000000..b1e7aa340f5 --- /dev/null +++ b/queue-5.15/drm-panel-sharp-ls043t1le01-adjust-mode-settings.patch @@ -0,0 +1,60 @@ +From b1b13a04bbfe10e3a90bc250b206f9f8595be6d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 20:26:38 +0300 +Subject: drm/panel: sharp-ls043t1le01: adjust mode settings + +From: Dmitry Baryshkov + +[ Upstream commit dee23b2c9e3ff46d59c5d45e1436eceb878e7c9a ] + +Using current settings causes panel flickering on APQ8074 dragonboard. +Adjust panel settings to follow the vendor-provided mode. This also +enables MIPI_DSI_MODE_VIDEO_SYNC_PULSE, which is also specified by the +vendor dtsi for the mentioned dragonboard. + +Fixes: ee0172383190 ("drm/panel: Add Sharp LS043T1LE01 MIPI DSI panel") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230507172639.2320934-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c +index 25829a0a8e801..e2f1e983ef7eb 100644 +--- a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c ++++ b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c +@@ -192,15 +192,15 @@ static int sharp_nt_panel_enable(struct drm_panel *panel) + } + + static const struct drm_display_mode default_mode = { +- .clock = 41118, ++ .clock = (540 + 48 + 32 + 80) * (960 + 3 + 10 + 15) * 60 / 1000, + .hdisplay = 540, + .hsync_start = 540 + 48, +- .hsync_end = 540 + 48 + 80, +- .htotal = 540 + 48 + 80 + 32, ++ .hsync_end = 540 + 48 + 32, ++ .htotal = 540 + 48 + 32 + 80, + .vdisplay = 960, + .vsync_start = 960 + 3, +- .vsync_end = 960 + 3 + 15, +- .vtotal = 960 + 3 + 15 + 1, ++ .vsync_end = 960 + 3 + 10, ++ .vtotal = 960 + 3 + 10 + 15, + }; + + static int sharp_nt_panel_get_modes(struct drm_panel *panel, +@@ -280,6 +280,7 @@ static int sharp_nt_panel_probe(struct mipi_dsi_device *dsi) + dsi->lanes = 2; + dsi->format = MIPI_DSI_FMT_RGB888; + dsi->mode_flags = MIPI_DSI_MODE_VIDEO | ++ MIPI_DSI_MODE_VIDEO_SYNC_PULSE | + MIPI_DSI_MODE_VIDEO_HSE | + MIPI_DSI_CLOCK_NON_CONTINUOUS | + MIPI_DSI_MODE_NO_EOT_PACKET; +-- +2.39.2 + diff --git a/queue-5.15/drm-panel-simple-fix-active-size-for-ampire-am-48027.patch b/queue-5.15/drm-panel-simple-fix-active-size-for-ampire-am-48027.patch new file mode 100644 index 00000000000..2677b7421d8 --- /dev/null +++ b/queue-5.15/drm-panel-simple-fix-active-size-for-ampire-am-48027.patch @@ -0,0 +1,51 @@ +From 0f60d0a8263152e59c2971a7dd9a1383b99cb75e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 10:50:39 +0200 +Subject: drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H + +From: Dario Binacchi + +[ Upstream commit f24b49550814fdee4a98b9552e35e243ccafd4a8 ] + +The previous setting was related to the overall dimension and not to the +active display area. +In the "PHYSICAL SPECIFICATIONS" section, the datasheet shows the +following parameters: + + ---------------------------------------------------------- +| Item | Specifications | unit | + ---------------------------------------------------------- +| Display area | 98.7 (W) x 57.5 (H) | mm | + ---------------------------------------------------------- +| Overall dimension | 105.5(W) x 67.2(H) x 4.96(D) | mm | + ---------------------------------------------------------- + +Fixes: 966fea78adf2 ("drm/panel: simple: Add support for Ampire AM-480272H3TMQW-T01H") +Signed-off-by: Dario Binacchi +Reviewed-by: Neil Armstrong +[narmstrong: fixed Fixes commit id length] +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230516085039.3797303-1-dario.binacchi@amarulasolutions.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index fb785f5a106ac..2f85266cdb2e3 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -890,8 +890,8 @@ static const struct panel_desc ampire_am_480272h3tmqw_t01h = { + .num_modes = 1, + .bpc = 8, + .size = { +- .width = 105, +- .height = 67, ++ .width = 99, ++ .height = 58, + }, + .bus_format = MEDIA_BUS_FMT_RGB888_1X24, + }; +-- +2.39.2 + diff --git a/queue-5.15/drm-radeon-fix-possible-division-by-zero-errors.patch b/queue-5.15/drm-radeon-fix-possible-division-by-zero-errors.patch new file mode 100644 index 00000000000..bca77ad5fae --- /dev/null +++ b/queue-5.15/drm-radeon-fix-possible-division-by-zero-errors.patch @@ -0,0 +1,94 @@ +From af054b1f3f91ee55e8da8d77fd7ca5380f672f98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 08:33:27 -0700 +Subject: drm/radeon: fix possible division-by-zero errors + +From: Nikita Zhandarovich + +[ Upstream commit 1becc57cd1a905e2aa0e1eca60d2a37744525c4a ] + +Function rv740_get_decoded_reference_divider() may return 0 due to +unpredictable reference divider value calculated in +radeon_atom_get_clock_dividers(). This will lead to +division-by-zero error once that value is used as a divider +in calculating 'clk_s'. +While unlikely, this issue should nonetheless be prevented so add a +sanity check for such cases by testing 'decoded_ref' value against 0. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +v2: minor coding style fixes (Alex) +In practice this should actually happen as the vbios should be +properly populated. + +Fixes: 66229b200598 ("drm/radeon/kms: add dpm support for rv7xx (v4)") +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/cypress_dpm.c | 8 ++++++-- + drivers/gpu/drm/radeon/ni_dpm.c | 8 ++++++-- + drivers/gpu/drm/radeon/rv740_dpm.c | 8 ++++++-- + 3 files changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c +index fdddbbaecbb74..72a0768df00f7 100644 +--- a/drivers/gpu/drm/radeon/cypress_dpm.c ++++ b/drivers/gpu/drm/radeon/cypress_dpm.c +@@ -557,8 +557,12 @@ static int cypress_populate_mclk_value(struct radeon_device *rdev, + ASIC_INTERNAL_MEMORY_SS, vco_freq)) { + u32 reference_clock = rdev->clock.mpll.reference_freq; + u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div); +- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate); +- u32 clk_v = ss.percentage * ++ u32 clk_s, clk_v; ++ ++ if (!decoded_ref) ++ return -EINVAL; ++ clk_s = reference_clock * 5 / (decoded_ref * ss.rate); ++ clk_v = ss.percentage * + (0x4000 * dividers.whole_fb_div + 0x800 * dividers.frac_fb_div) / (clk_s * 625); + + mpll_ss1 &= ~CLKV_MASK; +diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c +index 672d2239293e0..3e1c1a392fb7b 100644 +--- a/drivers/gpu/drm/radeon/ni_dpm.c ++++ b/drivers/gpu/drm/radeon/ni_dpm.c +@@ -2241,8 +2241,12 @@ static int ni_populate_mclk_value(struct radeon_device *rdev, + ASIC_INTERNAL_MEMORY_SS, vco_freq)) { + u32 reference_clock = rdev->clock.mpll.reference_freq; + u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div); +- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate); +- u32 clk_v = ss.percentage * ++ u32 clk_s, clk_v; ++ ++ if (!decoded_ref) ++ return -EINVAL; ++ clk_s = reference_clock * 5 / (decoded_ref * ss.rate); ++ clk_v = ss.percentage * + (0x4000 * dividers.whole_fb_div + 0x800 * dividers.frac_fb_div) / (clk_s * 625); + + mpll_ss1 &= ~CLKV_MASK; +diff --git a/drivers/gpu/drm/radeon/rv740_dpm.c b/drivers/gpu/drm/radeon/rv740_dpm.c +index d57a3e1df8d63..4464fd21a3029 100644 +--- a/drivers/gpu/drm/radeon/rv740_dpm.c ++++ b/drivers/gpu/drm/radeon/rv740_dpm.c +@@ -249,8 +249,12 @@ int rv740_populate_mclk_value(struct radeon_device *rdev, + ASIC_INTERNAL_MEMORY_SS, vco_freq)) { + u32 reference_clock = rdev->clock.mpll.reference_freq; + u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div); +- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate); +- u32 clk_v = 0x40000 * ss.percentage * ++ u32 clk_s, clk_v; ++ ++ if (!decoded_ref) ++ return -EINVAL; ++ clk_s = reference_clock * 5 / (decoded_ref * ss.rate); ++ clk_v = 0x40000 * ss.percentage * + (dividers.whole_fb_div + (dividers.frac_fb_div / 8)) / (clk_s * 10000); + + mpll_ss1 &= ~CLKV_MASK; +-- +2.39.2 + diff --git a/queue-5.15/drm-sun4i_tcon-use-devm_clk_get_enabled-in-sun4i_tco.patch b/queue-5.15/drm-sun4i_tcon-use-devm_clk_get_enabled-in-sun4i_tco.patch new file mode 100644 index 00000000000..8cb5e0a59e4 --- /dev/null +++ b/queue-5.15/drm-sun4i_tcon-use-devm_clk_get_enabled-in-sun4i_tco.patch @@ -0,0 +1,116 @@ +From e3a56223f64bdf18c373c34cf62dc31a2bd7f882 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Apr 2023 19:23:46 +0800 +Subject: drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks` + +From: XuDong Liu + +[ Upstream commit 123ee07ba5b7123e0ce0e0f9d64938026c16a2ce ] + +Smatch reports: +drivers/gpu/drm/sun4i/sun4i_tcon.c:805 sun4i_tcon_init_clocks() warn: +'tcon->clk' from clk_prepare_enable() not released on lines: 792,801. + +In the function sun4i_tcon_init_clocks(), tcon->clk and tcon->sclk0 are +not disabled in the error handling, which affects the release of +these variable. Although sun4i_tcon_bind(), which calls +sun4i_tcon_init_clocks(), use sun4i_tcon_free_clocks to disable the +variables mentioned, but the error handling branch of +sun4i_tcon_init_clocks() ignores the required disable process. + +To fix this issue, use the devm_clk_get_enabled to automatically +balance enable and disabled calls. As original implementation use +sun4i_tcon_free_clocks() to disable clk explicitly, we delete the +related calls and error handling that are no longer needed. + +Fixes: 9026e0d122ac ("drm: Add Allwinner A10 Display Engine support") +Fixes: b14e945bda8a ("drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init") +Fixes: 8e9240472522 ("drm/sun4i: support TCONs without channel 1") +Fixes: 34d698f6e349 ("drm/sun4i: Add has_channel_0 TCON quirk") +Signed-off-by: XuDong Liu +Reviewed-by: Dongliang Mu +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20230430112347.4689-1-m202071377@hust.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun4i_tcon.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c +index 9f06dec0fc61d..bb43196d5d83e 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c +@@ -777,21 +777,19 @@ static irqreturn_t sun4i_tcon_handler(int irq, void *private) + static int sun4i_tcon_init_clocks(struct device *dev, + struct sun4i_tcon *tcon) + { +- tcon->clk = devm_clk_get(dev, "ahb"); ++ tcon->clk = devm_clk_get_enabled(dev, "ahb"); + if (IS_ERR(tcon->clk)) { + dev_err(dev, "Couldn't get the TCON bus clock\n"); + return PTR_ERR(tcon->clk); + } +- clk_prepare_enable(tcon->clk); + + if (tcon->quirks->has_channel_0) { +- tcon->sclk0 = devm_clk_get(dev, "tcon-ch0"); ++ tcon->sclk0 = devm_clk_get_enabled(dev, "tcon-ch0"); + if (IS_ERR(tcon->sclk0)) { + dev_err(dev, "Couldn't get the TCON channel 0 clock\n"); + return PTR_ERR(tcon->sclk0); + } + } +- clk_prepare_enable(tcon->sclk0); + + if (tcon->quirks->has_channel_1) { + tcon->sclk1 = devm_clk_get(dev, "tcon-ch1"); +@@ -804,12 +802,6 @@ static int sun4i_tcon_init_clocks(struct device *dev, + return 0; + } + +-static void sun4i_tcon_free_clocks(struct sun4i_tcon *tcon) +-{ +- clk_disable_unprepare(tcon->sclk0); +- clk_disable_unprepare(tcon->clk); +-} +- + static int sun4i_tcon_init_irq(struct device *dev, + struct sun4i_tcon *tcon) + { +@@ -1224,14 +1216,14 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master, + ret = sun4i_tcon_init_regmap(dev, tcon); + if (ret) { + dev_err(dev, "Couldn't init our TCON regmap\n"); +- goto err_free_clocks; ++ goto err_assert_reset; + } + + if (tcon->quirks->has_channel_0) { + ret = sun4i_dclk_create(dev, tcon); + if (ret) { + dev_err(dev, "Couldn't create our TCON dot clock\n"); +- goto err_free_clocks; ++ goto err_assert_reset; + } + } + +@@ -1294,8 +1286,6 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master, + err_free_dotclock: + if (tcon->quirks->has_channel_0) + sun4i_dclk_free(tcon); +-err_free_clocks: +- sun4i_tcon_free_clocks(tcon); + err_assert_reset: + reset_control_assert(tcon->lcd_rst); + return ret; +@@ -1309,7 +1299,6 @@ static void sun4i_tcon_unbind(struct device *dev, struct device *master, + list_del(&tcon->list); + if (tcon->quirks->has_channel_0) + sun4i_dclk_free(tcon); +- sun4i_tcon_free_clocks(tcon); + } + + static const struct component_ops sun4i_tcon_ops = { +-- +2.39.2 + diff --git a/queue-5.15/drm-vram-helper-fix-function-names-in-vram-helper-do.patch b/queue-5.15/drm-vram-helper-fix-function-names-in-vram-helper-do.patch new file mode 100644 index 00000000000..38e2aed7b7a --- /dev/null +++ b/queue-5.15/drm-vram-helper-fix-function-names-in-vram-helper-do.patch @@ -0,0 +1,56 @@ +From 9811e75aadff766dfe7ce8231d49ad0caa3a3d5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 08:09:16 +0800 +Subject: drm/vram-helper: fix function names in vram helper doc + +From: Luc Ma + +[ Upstream commit b8e392245105b50706f18418054821e71e637288 ] + +Refer to drmm_vram_helper_init() instead of the non-existent +drmm_vram_helper_alloc_mm(). + +Fixes: a5f23a72355d ("drm/vram-helper: Managed vram helpers") +Signed-off-by: Luc Ma +Reviewed-by: Thomas Zimmermann +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/64583db2.630a0220.eb75d.8f51@mx.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_gem_vram_helper.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/drm_gem_vram_helper.c b/drivers/gpu/drm/drm_gem_vram_helper.c +index 43cf7e887d1a5..aaf4f7dcc581d 100644 +--- a/drivers/gpu/drm/drm_gem_vram_helper.c ++++ b/drivers/gpu/drm/drm_gem_vram_helper.c +@@ -43,7 +43,7 @@ static const struct drm_gem_object_funcs drm_gem_vram_object_funcs; + * the frame's scanout buffer or the cursor image. If there's no more space + * left in VRAM, inactive GEM objects can be moved to system memory. + * +- * To initialize the VRAM helper library call drmm_vram_helper_alloc_mm(). ++ * To initialize the VRAM helper library call drmm_vram_helper_init(). + * The function allocates and initializes an instance of &struct drm_vram_mm + * in &struct drm_device.vram_mm . Use &DRM_GEM_VRAM_DRIVER to initialize + * &struct drm_driver and &DRM_VRAM_MM_FILE_OPERATIONS to initialize +@@ -71,7 +71,7 @@ static const struct drm_gem_object_funcs drm_gem_vram_object_funcs; + * // setup device, vram base and size + * // ... + * +- * ret = drmm_vram_helper_alloc_mm(dev, vram_base, vram_size); ++ * ret = drmm_vram_helper_init(dev, vram_base, vram_size); + * if (ret) + * return ret; + * return 0; +@@ -84,7 +84,7 @@ static const struct drm_gem_object_funcs drm_gem_vram_object_funcs; + * to userspace. + * + * You don't have to clean up the instance of VRAM MM. +- * drmm_vram_helper_alloc_mm() is a managed interface that installs a ++ * drmm_vram_helper_init() is a managed interface that installs a + * clean-up handler to run during the DRM device's release. + * + * For drawing or scanout operations, rsp. buffer objects have to be pinned +-- +2.39.2 + diff --git a/queue-5.15/efi-libstub-disable-pci-dma-before-grabbing-the-efi-.patch b/queue-5.15/efi-libstub-disable-pci-dma-before-grabbing-the-efi-.patch new file mode 100644 index 00000000000..5d658722260 --- /dev/null +++ b/queue-5.15/efi-libstub-disable-pci-dma-before-grabbing-the-efi-.patch @@ -0,0 +1,65 @@ +From 9b5ff6e1d0658dd27d333a38ff96e31f26e095da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 09:33:09 +0200 +Subject: efi/libstub: Disable PCI DMA before grabbing the EFI memory map + +From: Ard Biesheuvel + +[ Upstream commit 2e28a798c3092ea42b968fa16ac835969d124898 ] + +Currently, the EFI stub will disable PCI DMA as the very last thing it +does before calling ExitBootServices(), to avoid interfering with the +firmware's normal operation as much as possible. + +However, the stub will invoke DisconnectController() on all endpoints +downstream of the PCI bridges it disables, and this may affect the +layout of the EFI memory map, making it substantially more likely that +ExitBootServices() will fail the first time around, and that the EFI +memory map needs to be reloaded. + +This, in turn, increases the likelihood that the slack space we +allocated is insufficient (and we can no longer allocate memory via boot +services after having called ExitBootServices() once), causing the +second call to GetMemoryMap (and therefore the boot) to fail. This makes +the PCI DMA disable feature a bit more fragile than it already is, so +let's make it more robust, by allocating the space for the EFI memory +map after disabling PCI DMA. + +Fixes: 4444f8541dad16fe ("efi: Allow disabling PCI busmastering on bridges during boot") +Reported-by: Glenn Washburn +Acked-by: Matthew Garrett +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/libstub/efi-stub-helper.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c +index d489bdc645fe1..2a00eb627c3c3 100644 +--- a/drivers/firmware/efi/libstub/efi-stub-helper.c ++++ b/drivers/firmware/efi/libstub/efi-stub-helper.c +@@ -439,8 +439,10 @@ efi_status_t efi_exit_boot_services(void *handle, + { + efi_status_t status; + +- status = efi_get_memory_map(map); ++ if (efi_disable_pci_dma) ++ efi_pci_disable_bridge_busmaster(); + ++ status = efi_get_memory_map(map); + if (status != EFI_SUCCESS) + goto fail; + +@@ -448,9 +450,6 @@ efi_status_t efi_exit_boot_services(void *handle, + if (status != EFI_SUCCESS) + goto free_map; + +- if (efi_disable_pci_dma) +- efi_pci_disable_bridge_busmaster(); +- + status = efi_bs_call(exit_boot_services, handle, *map->key_ptr); + + if (status == EFI_INVALID_PARAMETER) { +-- +2.39.2 + diff --git a/queue-5.15/evm-complete-description-of-evm_inode_setattr.patch b/queue-5.15/evm-complete-description-of-evm_inode_setattr.patch new file mode 100644 index 00000000000..6f2472206bb --- /dev/null +++ b/queue-5.15/evm-complete-description-of-evm_inode_setattr.patch @@ -0,0 +1,39 @@ +From 699aa8c4e4ba286318fa11236d54a8f919353409 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 11:40:36 +0100 +Subject: evm: Complete description of evm_inode_setattr() + +From: Roberto Sassu + +[ Upstream commit b1de86d4248b273cb12c4cd7d20c08d459519f7d ] + +Add the description for missing parameters of evm_inode_setattr() to +avoid the warning arising with W=n compile option. + +Fixes: 817b54aa45db ("evm: add evm_inode_setattr to prevent updating an invalid security.evm") # v3.2+ +Fixes: c1632a0f1120 ("fs: port ->setattr() to pass mnt_idmap") # v6.3+ +Signed-off-by: Roberto Sassu +Reviewed-by: Stefan Berger +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/evm/evm_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index 7d87772f0ce68..baddd99c38a43 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -770,7 +770,9 @@ static int evm_attr_change(struct dentry *dentry, struct iattr *attr) + + /** + * evm_inode_setattr - prevent updating an invalid EVM extended attribute ++ * @idmap: idmap of the mount + * @dentry: pointer to the affected dentry ++ * @attr: iattr structure containing the new file attributes + * + * Permit update of file attributes when files have a valid EVM signature, + * except in the case of them having an immutable portable signature. +-- +2.39.2 + diff --git a/queue-5.15/evm-fix-build-warnings.patch b/queue-5.15/evm-fix-build-warnings.patch new file mode 100644 index 00000000000..ac43763bf33 --- /dev/null +++ b/queue-5.15/evm-fix-build-warnings.patch @@ -0,0 +1,59 @@ +From 6b340640d0dbf24f370c9bfeb677d2f39207a3d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 09:41:12 +0200 +Subject: evm: Fix build warnings + +From: Roberto Sassu + +[ Upstream commit 996e0a97ebd7b11cb785794e2a83c20c1add9d92 ] + +Fix build warnings (function parameters description) for +evm_read_protected_xattrs(), evm_set_key() and evm_verifyxattr(). + +Fixes: 7626676320f3 ("evm: provide a function to set the EVM key from the kernel") # v4.5+ +Fixes: 8314b6732ae4 ("ima: Define new template fields xattrnames, xattrlengths and xattrvalues") # v5.14+ +Fixes: 2960e6cb5f7c ("evm: additional parameter to pass integrity cache entry 'iint'") # v3.2+ +Signed-off-by: Roberto Sassu +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/evm/evm_crypto.c | 2 +- + security/integrity/evm/evm_main.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c +index b862f0f919bfc..99c7452555c3c 100644 +--- a/security/integrity/evm/evm_crypto.c ++++ b/security/integrity/evm/evm_crypto.c +@@ -40,7 +40,7 @@ static const char evm_hmac[] = "hmac(sha1)"; + /** + * evm_set_key() - set EVM HMAC key from the kernel + * @key: pointer to a buffer with the key data +- * @size: length of the key data ++ * @keylen: length of the key data + * + * This function allows setting the EVM HMAC key from the kernel + * without using the "encrypted" key subsystem keys. It can be used +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index baddd99c38a43..b0e791e184329 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -324,7 +324,6 @@ int evm_protected_xattr_if_enabled(const char *req_xattr_name) + /** + * evm_read_protected_xattrs - read EVM protected xattr names, lengths, values + * @dentry: dentry of the read xattrs +- * @inode: inode of the read xattrs + * @buffer: buffer xattr names, lengths or values are copied to + * @buffer_size: size of buffer + * @type: n: names, l: lengths, v: values +@@ -396,6 +395,7 @@ int evm_read_protected_xattrs(struct dentry *dentry, u8 *buffer, + * @xattr_name: requested xattr + * @xattr_value: requested xattr value + * @xattr_value_len: requested xattr value length ++ * @iint: inode integrity metadata + * + * Calculate the HMAC for the given dentry and verify it against the stored + * security.evm xattr. For performance, use the xattr value and length +-- +2.39.2 + diff --git a/queue-5.15/fbdev-omapfb-lcd_mipid-fix-an-error-handling-path-in.patch b/queue-5.15/fbdev-omapfb-lcd_mipid-fix-an-error-handling-path-in.patch new file mode 100644 index 00000000000..af1de8d0628 --- /dev/null +++ b/queue-5.15/fbdev-omapfb-lcd_mipid-fix-an-error-handling-path-in.patch @@ -0,0 +1,44 @@ +From ed3f8703d2baf1e37790631661c81bb2df277d2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 17:42:28 +0200 +Subject: fbdev: omapfb: lcd_mipid: Fix an error handling path in + mipid_spi_probe() + +From: Christophe JAILLET + +[ Upstream commit 79a3908d1ea6c35157a6d907b1a9d8ec06015e7a ] + +If 'mipid_detect()' fails, we must free 'md' to avoid a memory leak. + +Fixes: 66d2f99d0bb5 ("omapfb: add support for MIPI-DCS compatible LCDs") +Signed-off-by: Christophe JAILLET +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/omap/lcd_mipid.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/omap/lcd_mipid.c b/drivers/video/fbdev/omap/lcd_mipid.c +index a75ae0c9b14c7..d1cd8785d011d 100644 +--- a/drivers/video/fbdev/omap/lcd_mipid.c ++++ b/drivers/video/fbdev/omap/lcd_mipid.c +@@ -563,11 +563,15 @@ static int mipid_spi_probe(struct spi_device *spi) + + r = mipid_detect(md); + if (r < 0) +- return r; ++ goto free_md; + + omapfb_register_panel(&md->panel); + + return 0; ++ ++free_md: ++ kfree(md); ++ return r; + } + + static int mipid_spi_remove(struct spi_device *spi) +-- +2.39.2 + diff --git a/queue-5.15/fs-pipe-reveal-missing-function-protoypes.patch b/queue-5.15/fs-pipe-reveal-missing-function-protoypes.patch new file mode 100644 index 00000000000..b3c0afabacf --- /dev/null +++ b/queue-5.15/fs-pipe-reveal-missing-function-protoypes.patch @@ -0,0 +1,56 @@ +From fdd43fc459760fc74a6397599df02f91c0c80d0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 21:56:12 +0200 +Subject: fs: pipe: reveal missing function protoypes + +From: Arnd Bergmann + +[ Upstream commit 247c8d2f9837a3e29e3b6b7a4aa9c36c37659dd4 ] + +A couple of functions from fs/pipe.c are used both internally +and for the watch queue code, but the declaration is only +visible when the latter is enabled: + +fs/pipe.c:1254:5: error: no previous prototype for 'pipe_resize_ring' +fs/pipe.c:758:15: error: no previous prototype for 'account_pipe_buffers' +fs/pipe.c:764:6: error: no previous prototype for 'too_many_pipe_buffers_soft' +fs/pipe.c:771:6: error: no previous prototype for 'too_many_pipe_buffers_hard' +fs/pipe.c:777:6: error: no previous prototype for 'pipe_is_unprivileged_user' + +Make the visible unconditionally to avoid these warnings. + +Fixes: c73be61cede5 ("pipe: Add general notification queue support") +Signed-off-by: Arnd Bergmann +Message-Id: <20230516195629.551602-1-arnd@kernel.org> +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + include/linux/pipe_fs_i.h | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h +index 18dcca51829e2..d15190b3e0326 100644 +--- a/include/linux/pipe_fs_i.h ++++ b/include/linux/pipe_fs_i.h +@@ -265,18 +265,14 @@ void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *); + + extern const struct pipe_buf_operations nosteal_pipe_buf_ops; + +-#ifdef CONFIG_WATCH_QUEUE + unsigned long account_pipe_buffers(struct user_struct *user, + unsigned long old, unsigned long new); + bool too_many_pipe_buffers_soft(unsigned long user_bufs); + bool too_many_pipe_buffers_hard(unsigned long user_bufs); + bool pipe_is_unprivileged_user(void); +-#endif + + /* for F_SETPIPE_SZ and F_GETPIPE_SZ */ +-#ifdef CONFIG_WATCH_QUEUE + int pipe_resize_ring(struct pipe_inode_info *pipe, unsigned int nr_slots); +-#endif + long pipe_fcntl(struct file *, unsigned int, unsigned long arg); + struct pipe_inode_info *get_pipe_info(struct file *file, bool for_splice); + +-- +2.39.2 + diff --git a/queue-5.15/gtp-fix-use-after-free-in-__gtp_encap_destroy.patch b/queue-5.15/gtp-fix-use-after-free-in-__gtp_encap_destroy.patch new file mode 100644 index 00000000000..6c76c6cc8da --- /dev/null +++ b/queue-5.15/gtp-fix-use-after-free-in-__gtp_encap_destroy.patch @@ -0,0 +1,190 @@ +From a4a411bfe5e0a57faa7cc9a2235be4341d34530d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 14:32:31 -0700 +Subject: gtp: Fix use-after-free in __gtp_encap_destroy(). + +From: Kuniyuki Iwashima + +[ Upstream commit ce3aee7114c575fab32a5e9e939d4bbb3dcca79f ] + +syzkaller reported use-after-free in __gtp_encap_destroy(). [0] + +It shows the same process freed sk and touched it illegally. + +Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock() +and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data, +but release_sock() is called after sock_put() releases the last refcnt. + +[0]: +BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] +BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] +BUG: KASAN: slab-use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] +BUG: KASAN: slab-use-after-free in do_raw_spin_lock include/linux/spinlock.h:186 [inline] +BUG: KASAN: slab-use-after-free in __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline] +BUG: KASAN: slab-use-after-free in _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178 +Write of size 4 at addr ffff88800dbef398 by task syz-executor.2/2401 + +CPU: 1 PID: 2401 Comm: syz-executor.2 Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #2 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106 + print_address_description mm/kasan/report.c:351 [inline] + print_report+0xcc/0x620 mm/kasan/report.c:462 + kasan_report+0xb2/0xe0 mm/kasan/report.c:572 + check_region_inline mm/kasan/generic.c:181 [inline] + kasan_check_range+0x39/0x1c0 mm/kasan/generic.c:187 + instrument_atomic_read_write include/linux/instrumented.h:96 [inline] + atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] + queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] + do_raw_spin_lock include/linux/spinlock.h:186 [inline] + __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline] + _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178 + spin_lock_bh include/linux/spinlock.h:355 [inline] + release_sock+0x1f/0x1a0 net/core/sock.c:3526 + gtp_encap_disable_sock drivers/net/gtp.c:651 [inline] + gtp_encap_disable+0xb9/0x220 drivers/net/gtp.c:664 + gtp_dev_uninit+0x19/0x50 drivers/net/gtp.c:728 + unregister_netdevice_many_notify+0x97e/0x1520 net/core/dev.c:10841 + rtnl_delete_link net/core/rtnetlink.c:3216 [inline] + rtnl_dellink+0x3c0/0xb30 net/core/rtnetlink.c:3268 + rtnetlink_rcv_msg+0x450/0xb10 net/core/rtnetlink.c:6423 + netlink_rcv_skb+0x15d/0x450 net/netlink/af_netlink.c:2548 + netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] + netlink_unicast+0x700/0x930 net/netlink/af_netlink.c:1365 + netlink_sendmsg+0x91c/0xe30 net/netlink/af_netlink.c:1913 + sock_sendmsg_nosec net/socket.c:724 [inline] + sock_sendmsg+0x1b7/0x200 net/socket.c:747 + ____sys_sendmsg+0x75a/0x990 net/socket.c:2493 + ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2547 + __sys_sendmsg+0xfe/0x1d0 net/socket.c:2576 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc +RIP: 0033:0x7f1168b1fe5d +Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 +RSP: 002b:00007f1167edccc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f1168b1fe5d +RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 +RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +R13: 000000000000000b R14: 00007f1168b80530 R15: 0000000000000000 + + +Allocated by task 1483: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + __kasan_slab_alloc+0x59/0x70 mm/kasan/common.c:328 + kasan_slab_alloc include/linux/kasan.h:186 [inline] + slab_post_alloc_hook mm/slab.h:711 [inline] + slab_alloc_node mm/slub.c:3451 [inline] + slab_alloc mm/slub.c:3459 [inline] + __kmem_cache_alloc_lru mm/slub.c:3466 [inline] + kmem_cache_alloc+0x16d/0x340 mm/slub.c:3475 + sk_prot_alloc+0x5f/0x280 net/core/sock.c:2073 + sk_alloc+0x34/0x6c0 net/core/sock.c:2132 + inet6_create net/ipv6/af_inet6.c:192 [inline] + inet6_create+0x2c7/0xf20 net/ipv6/af_inet6.c:119 + __sock_create+0x2a1/0x530 net/socket.c:1535 + sock_create net/socket.c:1586 [inline] + __sys_socket_create net/socket.c:1623 [inline] + __sys_socket_create net/socket.c:1608 [inline] + __sys_socket+0x137/0x250 net/socket.c:1651 + __do_sys_socket net/socket.c:1664 [inline] + __se_sys_socket net/socket.c:1662 [inline] + __x64_sys_socket+0x72/0xb0 net/socket.c:1662 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Freed by task 2401: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521 + ____kasan_slab_free mm/kasan/common.c:236 [inline] + ____kasan_slab_free mm/kasan/common.c:200 [inline] + __kasan_slab_free+0x10c/0x1b0 mm/kasan/common.c:244 + kasan_slab_free include/linux/kasan.h:162 [inline] + slab_free_hook mm/slub.c:1781 [inline] + slab_free_freelist_hook mm/slub.c:1807 [inline] + slab_free mm/slub.c:3786 [inline] + kmem_cache_free+0xb4/0x490 mm/slub.c:3808 + sk_prot_free net/core/sock.c:2113 [inline] + __sk_destruct+0x500/0x720 net/core/sock.c:2207 + sk_destruct+0xc1/0xe0 net/core/sock.c:2222 + __sk_free+0xed/0x3d0 net/core/sock.c:2233 + sk_free+0x7c/0xa0 net/core/sock.c:2244 + sock_put include/net/sock.h:1981 [inline] + __gtp_encap_destroy+0x165/0x1b0 drivers/net/gtp.c:634 + gtp_encap_disable_sock drivers/net/gtp.c:651 [inline] + gtp_encap_disable+0xb9/0x220 drivers/net/gtp.c:664 + gtp_dev_uninit+0x19/0x50 drivers/net/gtp.c:728 + unregister_netdevice_many_notify+0x97e/0x1520 net/core/dev.c:10841 + rtnl_delete_link net/core/rtnetlink.c:3216 [inline] + rtnl_dellink+0x3c0/0xb30 net/core/rtnetlink.c:3268 + rtnetlink_rcv_msg+0x450/0xb10 net/core/rtnetlink.c:6423 + netlink_rcv_skb+0x15d/0x450 net/netlink/af_netlink.c:2548 + netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] + netlink_unicast+0x700/0x930 net/netlink/af_netlink.c:1365 + netlink_sendmsg+0x91c/0xe30 net/netlink/af_netlink.c:1913 + sock_sendmsg_nosec net/socket.c:724 [inline] + sock_sendmsg+0x1b7/0x200 net/socket.c:747 + ____sys_sendmsg+0x75a/0x990 net/socket.c:2493 + ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2547 + __sys_sendmsg+0xfe/0x1d0 net/socket.c:2576 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +The buggy address belongs to the object at ffff88800dbef300 + which belongs to the cache UDPv6 of size 1344 +The buggy address is located 152 bytes inside of + freed 1344-byte region [ffff88800dbef300, ffff88800dbef840) + +The buggy address belongs to the physical page: +page:00000000d31bfed5 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800dbeed40 pfn:0xdbe8 +head:00000000d31bfed5 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 +memcg:ffff888008ee0801 +flags: 0x100000000010200(slab|head|node=0|zone=1) +page_type: 0xffffffff() +raw: 0100000000010200 ffff88800c7a3000 dead000000000122 0000000000000000 +raw: ffff88800dbeed40 0000000080160015 00000001ffffffff ffff888008ee0801 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: + ffff88800dbef280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff88800dbef300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +>ffff88800dbef380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff88800dbef400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff88800dbef480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + +Fixes: e198987e7dd7 ("gtp: fix suspicious RCU usage") +Reported-by: syzkaller +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Pablo Neira Ayuso +Link: https://lore.kernel.org/r/20230622213231.24651-1-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/gtp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index 30e0a10595a16..a3878aef0ea4a 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -298,7 +298,9 @@ static void __gtp_encap_destroy(struct sock *sk) + gtp->sk1u = NULL; + udp_sk(sk)->encap_type = 0; + rcu_assign_sk_user_data(sk, NULL); ++ release_sock(sk); + sock_put(sk); ++ return; + } + release_sock(sk); + } +-- +2.39.2 + diff --git a/queue-5.15/hwmon-adm1275-allow-setting-sample-averaging.patch b/queue-5.15/hwmon-adm1275-allow-setting-sample-averaging.patch new file mode 100644 index 00000000000..679ba247efd --- /dev/null +++ b/queue-5.15/hwmon-adm1275-allow-setting-sample-averaging.patch @@ -0,0 +1,94 @@ +From 1ab4a5f5ba70202bf62d7ce0f8f65dc26d55434c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Mar 2022 20:38:16 +0800 +Subject: hwmon: (adm1275) Allow setting sample averaging + +From: Potin Lai + +[ Upstream commit a3cd66d7cbadcc0c29884f25b754fd22699c719c ] + +Current driver assume PWR_AVG and VI_AVG as 1 by default, and user needs +to set sample averaging via sysfs manually. + +This patch parses the properties "adi,power-sample-average" and +"adi,volt-curr-sample-average" from device tree, and setting sample +averaging during probe. Input value must be one of value in the +list [1, 2, 4, 8, 16, 32, 64, 128]. + +Signed-off-by: Potin Lai +Link: https://lore.kernel.org/r/20220302123817.27025-2-potin.lai@quantatw.com +Signed-off-by: Guenter Roeck +Stable-dep-of: b153a0bb4199 ("hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272") +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/adm1275.c | 40 ++++++++++++++++++++++++++++++++++- + 1 file changed, 39 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c +index d311e0557401c..3b07bfb43e937 100644 +--- a/drivers/hwmon/pmbus/adm1275.c ++++ b/drivers/hwmon/pmbus/adm1275.c +@@ -475,6 +475,7 @@ static int adm1275_probe(struct i2c_client *client) + int vindex = -1, voindex = -1, cindex = -1, pindex = -1; + int tindex = -1; + u32 shunt; ++ u32 avg; + + if (!i2c_check_functionality(client->adapter, + I2C_FUNC_SMBUS_READ_BYTE_DATA +@@ -687,7 +688,7 @@ static int adm1275_probe(struct i2c_client *client) + if ((config & (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) != + (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) { + config |= ADM1278_VOUT_EN | ADM1278_TEMP1_EN; +- ret = i2c_smbus_write_byte_data(client, ++ ret = i2c_smbus_write_word_data(client, + ADM1275_PMON_CONFIG, + config); + if (ret < 0) { +@@ -756,6 +757,43 @@ static int adm1275_probe(struct i2c_client *client) + return -ENODEV; + } + ++ if (data->have_power_sampling && ++ of_property_read_u32(client->dev.of_node, ++ "adi,power-sample-average", &avg) == 0) { ++ if (!avg || avg > ADM1275_SAMPLES_AVG_MAX || ++ BIT(__fls(avg)) != avg) { ++ dev_err(&client->dev, ++ "Invalid number of power samples"); ++ return -EINVAL; ++ } ++ ret = adm1275_write_pmon_config(data, client, true, ++ ilog2(avg)); ++ if (ret < 0) { ++ dev_err(&client->dev, ++ "Setting power sample averaging failed with error %d", ++ ret); ++ return ret; ++ } ++ } ++ ++ if (of_property_read_u32(client->dev.of_node, ++ "adi,volt-curr-sample-average", &avg) == 0) { ++ if (!avg || avg > ADM1275_SAMPLES_AVG_MAX || ++ BIT(__fls(avg)) != avg) { ++ dev_err(&client->dev, ++ "Invalid number of voltage/current samples"); ++ return -EINVAL; ++ } ++ ret = adm1275_write_pmon_config(data, client, false, ++ ilog2(avg)); ++ if (ret < 0) { ++ dev_err(&client->dev, ++ "Setting voltage and current sample averaging failed with error %d", ++ ret); ++ return ret; ++ } ++ } ++ + if (voindex < 0) + voindex = vindex; + if (vindex >= 0) { +-- +2.39.2 + diff --git a/queue-5.15/hwmon-gsc-hwmon-fix-fan-pwm-temperature-scaling.patch b/queue-5.15/hwmon-gsc-hwmon-fix-fan-pwm-temperature-scaling.patch new file mode 100644 index 00000000000..19665ba9a94 --- /dev/null +++ b/queue-5.15/hwmon-gsc-hwmon-fix-fan-pwm-temperature-scaling.patch @@ -0,0 +1,48 @@ +From fb7731984de1cc1de7c1c403c56fad33b1f50b1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 08:30:04 -0700 +Subject: hwmon: (gsc-hwmon) fix fan pwm temperature scaling + +From: Tim Harvey + +[ Upstream commit a6d80df47ee2c69db99e4f2f8871aa4db154620b ] + +The GSC fan pwm temperature register is in centidegrees celcius but the +Linux hwmon convention is to use milidegrees celcius. Fix the scaling. + +Fixes: 3bce5377ef66 ("hwmon: Add Gateworks System Controller support") +Signed-off-by: Tim Harvey +Link: https://lore.kernel.org/r/20230606153004.1448086-1-tharvey@gateworks.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/gsc-hwmon.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/gsc-hwmon.c b/drivers/hwmon/gsc-hwmon.c +index f29ce49294daf..89d036bf88df7 100644 +--- a/drivers/hwmon/gsc-hwmon.c ++++ b/drivers/hwmon/gsc-hwmon.c +@@ -82,8 +82,8 @@ static ssize_t pwm_auto_point_temp_store(struct device *dev, + if (kstrtol(buf, 10, &temp)) + return -EINVAL; + +- temp = clamp_val(temp, 0, 10000); +- temp = DIV_ROUND_CLOSEST(temp, 10); ++ temp = clamp_val(temp, 0, 100000); ++ temp = DIV_ROUND_CLOSEST(temp, 100); + + regs[0] = temp & 0xff; + regs[1] = (temp >> 8) & 0xff; +@@ -100,7 +100,7 @@ static ssize_t pwm_auto_point_pwm_show(struct device *dev, + { + struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr); + +- return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10)) / 100); ++ return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10))); + } + + static SENSOR_DEVICE_ATTR_RO(pwm1_auto_point1_pwm, pwm_auto_point_pwm, 0); +-- +2.39.2 + diff --git a/queue-5.15/hwmon-pmbus-adm1275-fix-problems-with-temperature-mo.patch b/queue-5.15/hwmon-pmbus-adm1275-fix-problems-with-temperature-mo.patch new file mode 100644 index 00000000000..44249345939 --- /dev/null +++ b/queue-5.15/hwmon-pmbus-adm1275-fix-problems-with-temperature-mo.patch @@ -0,0 +1,128 @@ +From 5a8290338fbc0d448928ab9d880c03a29d363235 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 14:34:47 -0700 +Subject: hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on + ADM1272 + +From: Guenter Roeck + +[ Upstream commit b153a0bb4199566abd337119207f82b59a8cd1ca ] + +The PMON_CONFIG register on ADM1272 is a 16 bit register. Writing a 8 bit +value into it clears the upper 8 bits of the register, resulting in +unexpected side effects. Fix by writing the 16 bit register value. + +Also, it has been reported that temperature readings are sometimes widely +inaccurate, to the point where readings may result in device shutdown due +to errant overtemperature faults. Improve by enabling temperature sampling. + +While at it, move the common code for ADM1272 and ADM1278 into a separate +function, and clarify in the error message that an attempt was made to +enable both VOUT and temperature monitoring. + +Last but not least, return the error code reported by the underlying I2C +controller and not -ENODEV if updating the PMON_CONFIG register fails. +After all, this does not indicate that the chip is not present, but an +error in the communication with the chip. + +Fixes: 4ff0ce227a1e ("hwmon: (pmbus/adm1275) Add support for ADM1272") +Fixes: 9da9c2dc57b2 ("hwmon: (adm1275) enable adm1272 temperature reporting") +Signed-off-by: Guenter Roeck +Link: https://lore.kernel.org/r/20230602213447.3557346-1-linux@roeck-us.net +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/adm1275.c | 52 +++++++++++++++++------------------ + 1 file changed, 26 insertions(+), 26 deletions(-) + +diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c +index 3b07bfb43e937..b8543c06d022a 100644 +--- a/drivers/hwmon/pmbus/adm1275.c ++++ b/drivers/hwmon/pmbus/adm1275.c +@@ -37,10 +37,13 @@ enum chips { adm1075, adm1272, adm1275, adm1276, adm1278, adm1293, adm1294 }; + + #define ADM1272_IRANGE BIT(0) + ++#define ADM1278_TSFILT BIT(15) + #define ADM1278_TEMP1_EN BIT(3) + #define ADM1278_VIN_EN BIT(2) + #define ADM1278_VOUT_EN BIT(1) + ++#define ADM1278_PMON_DEFCONFIG (ADM1278_VOUT_EN | ADM1278_TEMP1_EN | ADM1278_TSFILT) ++ + #define ADM1293_IRANGE_25 0 + #define ADM1293_IRANGE_50 BIT(6) + #define ADM1293_IRANGE_100 BIT(7) +@@ -462,6 +465,22 @@ static const struct i2c_device_id adm1275_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, adm1275_id); + ++/* Enable VOUT & TEMP1 if not enabled (disabled by default) */ ++static int adm1275_enable_vout_temp(struct i2c_client *client, int config) ++{ ++ int ret; ++ ++ if ((config & ADM1278_PMON_DEFCONFIG) != ADM1278_PMON_DEFCONFIG) { ++ config |= ADM1278_PMON_DEFCONFIG; ++ ret = i2c_smbus_write_word_data(client, ADM1275_PMON_CONFIG, config); ++ if (ret < 0) { ++ dev_err(&client->dev, "Failed to enable VOUT/TEMP1 monitoring\n"); ++ return ret; ++ } ++ } ++ return 0; ++} ++ + static int adm1275_probe(struct i2c_client *client) + { + s32 (*config_read_fn)(const struct i2c_client *client, u8 reg); +@@ -615,19 +634,10 @@ static int adm1275_probe(struct i2c_client *client) + PMBUS_HAVE_VOUT | PMBUS_HAVE_STATUS_VOUT | + PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP; + +- /* Enable VOUT & TEMP1 if not enabled (disabled by default) */ +- if ((config & (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) != +- (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) { +- config |= ADM1278_VOUT_EN | ADM1278_TEMP1_EN; +- ret = i2c_smbus_write_byte_data(client, +- ADM1275_PMON_CONFIG, +- config); +- if (ret < 0) { +- dev_err(&client->dev, +- "Failed to enable VOUT monitoring\n"); +- return -ENODEV; +- } +- } ++ ret = adm1275_enable_vout_temp(client, config); ++ if (ret) ++ return ret; ++ + if (config & ADM1278_VIN_EN) + info->func[0] |= PMBUS_HAVE_VIN; + break; +@@ -684,19 +694,9 @@ static int adm1275_probe(struct i2c_client *client) + PMBUS_HAVE_VOUT | PMBUS_HAVE_STATUS_VOUT | + PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP; + +- /* Enable VOUT & TEMP1 if not enabled (disabled by default) */ +- if ((config & (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) != +- (ADM1278_VOUT_EN | ADM1278_TEMP1_EN)) { +- config |= ADM1278_VOUT_EN | ADM1278_TEMP1_EN; +- ret = i2c_smbus_write_word_data(client, +- ADM1275_PMON_CONFIG, +- config); +- if (ret < 0) { +- dev_err(&client->dev, +- "Failed to enable VOUT monitoring\n"); +- return -ENODEV; +- } +- } ++ ret = adm1275_enable_vout_temp(client, config); ++ if (ret) ++ return ret; + + if (config & ADM1278_VIN_EN) + info->func[0] |= PMBUS_HAVE_VIN; +-- +2.39.2 + diff --git a/queue-5.15/hwrng-st-keep-clock-enabled-while-hwrng-is-registere.patch b/queue-5.15/hwrng-st-keep-clock-enabled-while-hwrng-is-registere.patch new file mode 100644 index 00000000000..07452d8a1e9 --- /dev/null +++ b/queue-5.15/hwrng-st-keep-clock-enabled-while-hwrng-is-registere.patch @@ -0,0 +1,96 @@ +From 86e685ed4e0333731d60645171894b5509279973 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 09:58:13 +0100 +Subject: hwrng: st - keep clock enabled while hwrng is registered + +From: Martin Kaiser + +[ Upstream commit 501e197a02d4aef157f53ba3a0b9049c3e52fedc ] + +The st-rng driver uses devres to register itself with the hwrng core, +the driver will be unregistered from hwrng when its device goes out of +scope. This happens after the driver's remove function is called. + +However, st-rng's clock is disabled in the remove function. There's a +short timeframe where st-rng is still registered with the hwrng core +although its clock is disabled. I suppose the clock must be active to +access the hardware and serve requests from the hwrng core. + +Switch to devm_clk_get_enabled and let devres disable the clock and +unregister the hwrng. This avoids the race condition. + +Fixes: 3e75241be808 ("hwrng: drivers - Use device-managed registration API") +Signed-off-by: Martin Kaiser +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/st-rng.c | 21 +-------------------- + 1 file changed, 1 insertion(+), 20 deletions(-) + +diff --git a/drivers/char/hw_random/st-rng.c b/drivers/char/hw_random/st-rng.c +index 15ba1e6fae4d2..6e9dfac9fc9f4 100644 +--- a/drivers/char/hw_random/st-rng.c ++++ b/drivers/char/hw_random/st-rng.c +@@ -42,7 +42,6 @@ + + struct st_rng_data { + void __iomem *base; +- struct clk *clk; + struct hwrng ops; + }; + +@@ -85,26 +84,18 @@ static int st_rng_probe(struct platform_device *pdev) + if (IS_ERR(base)) + return PTR_ERR(base); + +- clk = devm_clk_get(&pdev->dev, NULL); ++ clk = devm_clk_get_enabled(&pdev->dev, NULL); + if (IS_ERR(clk)) + return PTR_ERR(clk); + +- ret = clk_prepare_enable(clk); +- if (ret) +- return ret; +- + ddata->ops.priv = (unsigned long)ddata; + ddata->ops.read = st_rng_read; + ddata->ops.name = pdev->name; + ddata->base = base; +- ddata->clk = clk; +- +- dev_set_drvdata(&pdev->dev, ddata); + + ret = devm_hwrng_register(&pdev->dev, &ddata->ops); + if (ret) { + dev_err(&pdev->dev, "Failed to register HW RNG\n"); +- clk_disable_unprepare(clk); + return ret; + } + +@@ -113,15 +104,6 @@ static int st_rng_probe(struct platform_device *pdev) + return 0; + } + +-static int st_rng_remove(struct platform_device *pdev) +-{ +- struct st_rng_data *ddata = dev_get_drvdata(&pdev->dev); +- +- clk_disable_unprepare(ddata->clk); +- +- return 0; +-} +- + static const struct of_device_id st_rng_match[] __maybe_unused = { + { .compatible = "st,rng" }, + {}, +@@ -134,7 +116,6 @@ static struct platform_driver st_rng_driver = { + .of_match_table = of_match_ptr(st_rng_match), + }, + .probe = st_rng_probe, +- .remove = st_rng_remove + }; + + module_platform_driver(st_rng_driver); +-- +2.39.2 + diff --git a/queue-5.15/hwrng-virtio-add-an-internal-buffer.patch b/queue-5.15/hwrng-virtio-add-an-internal-buffer.patch new file mode 100644 index 00000000000..d988f4379ba --- /dev/null +++ b/queue-5.15/hwrng-virtio-add-an-internal-buffer.patch @@ -0,0 +1,127 @@ +From 924668f7bb368d4f4488fe621cf26d41ee933f9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 12:11:08 +0200 +Subject: hwrng: virtio - add an internal buffer + +From: Laurent Vivier + +[ Upstream commit bf3175bc50a3754dc427e2f5046e17a9fafc8be7 ] + +hwrng core uses two buffers that can be mixed in the +virtio-rng queue. + +If the buffer is provided with wait=0 it is enqueued in the +virtio-rng queue but unused by the caller. +On the next call, core provides another buffer but the +first one is filled instead and the new one queued. +And the caller reads the data from the new one that is not +updated, and the data in the first one are lost. + +To avoid this mix, virtio-rng needs to use its own unique +internal buffer at a cost of a data copy to the caller buffer. + +Signed-off-by: Laurent Vivier +Link: https://lore.kernel.org/r/20211028101111.128049-2-lvivier@redhat.com +Signed-off-by: Michael S. Tsirkin +Stable-dep-of: ac52578d6e8d ("hwrng: virtio - Fix race on data_avail and actual data") +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/virtio-rng.c | 43 ++++++++++++++++++++++------- + 1 file changed, 33 insertions(+), 10 deletions(-) + +diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c +index a90001e02bf7a..208c547dcac16 100644 +--- a/drivers/char/hw_random/virtio-rng.c ++++ b/drivers/char/hw_random/virtio-rng.c +@@ -18,13 +18,20 @@ static DEFINE_IDA(rng_index_ida); + struct virtrng_info { + struct hwrng hwrng; + struct virtqueue *vq; +- struct completion have_data; + char name[25]; +- unsigned int data_avail; + int index; + bool busy; + bool hwrng_register_done; + bool hwrng_removed; ++ /* data transfer */ ++ struct completion have_data; ++ unsigned int data_avail; ++ /* minimal size returned by rng_buffer_size() */ ++#if SMP_CACHE_BYTES < 32 ++ u8 data[32]; ++#else ++ u8 data[SMP_CACHE_BYTES]; ++#endif + }; + + static void random_recv_done(struct virtqueue *vq) +@@ -39,14 +46,14 @@ static void random_recv_done(struct virtqueue *vq) + } + + /* The host will fill any buffer we give it with sweet, sweet randomness. */ +-static void register_buffer(struct virtrng_info *vi, u8 *buf, size_t size) ++static void register_buffer(struct virtrng_info *vi) + { + struct scatterlist sg; + +- sg_init_one(&sg, buf, size); ++ sg_init_one(&sg, vi->data, sizeof(vi->data)); + + /* There should always be room for one buffer. */ +- virtqueue_add_inbuf(vi->vq, &sg, 1, buf, GFP_KERNEL); ++ virtqueue_add_inbuf(vi->vq, &sg, 1, vi->data, GFP_KERNEL); + + virtqueue_kick(vi->vq); + } +@@ -55,6 +62,8 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait) + { + int ret; + struct virtrng_info *vi = (struct virtrng_info *)rng->priv; ++ unsigned int chunk; ++ size_t read; + + if (vi->hwrng_removed) + return -ENODEV; +@@ -62,19 +71,33 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait) + if (!vi->busy) { + vi->busy = true; + reinit_completion(&vi->have_data); +- register_buffer(vi, buf, size); ++ register_buffer(vi); + } + + if (!wait) + return 0; + +- ret = wait_for_completion_killable(&vi->have_data); +- if (ret < 0) +- return ret; ++ read = 0; ++ while (size != 0) { ++ ret = wait_for_completion_killable(&vi->have_data); ++ if (ret < 0) ++ return ret; ++ ++ chunk = min_t(unsigned int, size, vi->data_avail); ++ memcpy(buf + read, vi->data, chunk); ++ read += chunk; ++ size -= chunk; ++ vi->data_avail = 0; ++ ++ if (size != 0) { ++ reinit_completion(&vi->have_data); ++ register_buffer(vi); ++ } ++ } + + vi->busy = false; + +- return vi->data_avail; ++ return read; + } + + static void virtio_cleanup(struct hwrng *rng) +-- +2.39.2 + diff --git a/queue-5.15/hwrng-virtio-always-add-a-pending-request.patch b/queue-5.15/hwrng-virtio-always-add-a-pending-request.patch new file mode 100644 index 00000000000..9406f30d54f --- /dev/null +++ b/queue-5.15/hwrng-virtio-always-add-a-pending-request.patch @@ -0,0 +1,111 @@ +From 4972e4f5d2ec4b0b026957b73f06ae148b68cd19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 12:11:11 +0200 +Subject: hwrng: virtio - always add a pending request + +From: Laurent Vivier + +[ Upstream commit 9a4b612d675b03f7fc9fa1957ca399c8223f3954 ] + +If we ensure we have already some data available by enqueuing +again the buffer once data are exhausted, we can return what we +have without waiting for the device answer. + +Signed-off-by: Laurent Vivier +Link: https://lore.kernel.org/r/20211028101111.128049-5-lvivier@redhat.com +Signed-off-by: Michael S. Tsirkin +Stable-dep-of: ac52578d6e8d ("hwrng: virtio - Fix race on data_avail and actual data") +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/virtio-rng.c | 26 ++++++++++++-------------- + 1 file changed, 12 insertions(+), 14 deletions(-) + +diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c +index 8ba97cf4ca8fb..0a7dde135db19 100644 +--- a/drivers/char/hw_random/virtio-rng.c ++++ b/drivers/char/hw_random/virtio-rng.c +@@ -20,7 +20,6 @@ struct virtrng_info { + struct virtqueue *vq; + char name[25]; + int index; +- bool busy; + bool hwrng_register_done; + bool hwrng_removed; + /* data transfer */ +@@ -44,16 +43,18 @@ static void random_recv_done(struct virtqueue *vq) + return; + + vi->data_idx = 0; +- vi->busy = false; + + complete(&vi->have_data); + } + +-/* The host will fill any buffer we give it with sweet, sweet randomness. */ +-static void register_buffer(struct virtrng_info *vi) ++static void request_entropy(struct virtrng_info *vi) + { + struct scatterlist sg; + ++ reinit_completion(&vi->have_data); ++ vi->data_avail = 0; ++ vi->data_idx = 0; ++ + sg_init_one(&sg, vi->data, sizeof(vi->data)); + + /* There should always be room for one buffer. */ +@@ -69,6 +70,8 @@ static unsigned int copy_data(struct virtrng_info *vi, void *buf, + memcpy(buf, vi->data + vi->data_idx, size); + vi->data_idx += size; + vi->data_avail -= size; ++ if (vi->data_avail == 0) ++ request_entropy(vi); + return size; + } + +@@ -98,13 +101,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait) + * so either size is 0 or data_avail is 0 + */ + while (size != 0) { +- /* data_avail is 0 */ +- if (!vi->busy) { +- /* no pending request, ask for more */ +- vi->busy = true; +- reinit_completion(&vi->have_data); +- register_buffer(vi); +- } ++ /* data_avail is 0 but a request is pending */ + ret = wait_for_completion_killable(&vi->have_data); + if (ret < 0) + return ret; +@@ -126,8 +123,7 @@ static void virtio_cleanup(struct hwrng *rng) + { + struct virtrng_info *vi = (struct virtrng_info *)rng->priv; + +- if (vi->busy) +- complete(&vi->have_data); ++ complete(&vi->have_data); + } + + static int probe_common(struct virtio_device *vdev) +@@ -163,6 +159,9 @@ static int probe_common(struct virtio_device *vdev) + goto err_find; + } + ++ /* we always have a pending entropy request */ ++ request_entropy(vi); ++ + return 0; + + err_find: +@@ -181,7 +180,6 @@ static void remove_common(struct virtio_device *vdev) + vi->data_idx = 0; + complete(&vi->have_data); + vdev->config->reset(vdev); +- vi->busy = false; + if (vi->hwrng_register_done) + hwrng_unregister(&vi->hwrng); + vdev->config->del_vqs(vdev); +-- +2.39.2 + diff --git a/queue-5.15/hwrng-virtio-don-t-wait-on-cleanup.patch b/queue-5.15/hwrng-virtio-don-t-wait-on-cleanup.patch new file mode 100644 index 00000000000..5bf272b370d --- /dev/null +++ b/queue-5.15/hwrng-virtio-don-t-wait-on-cleanup.patch @@ -0,0 +1,58 @@ +From b1bc814b0f63ad68840b530c88a11fb0073b283b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 12:11:09 +0200 +Subject: hwrng: virtio - don't wait on cleanup + +From: Laurent Vivier + +[ Upstream commit 2bb31abdbe55742c89f4dc0cc26fcbc8467364f6 ] + +When virtio-rng device was dropped by the hwrng core we were forced +to wait the buffer to come back from the device to not have +remaining ongoing operation that could spoil the buffer. + +But now, as the buffer is internal to the virtio-rng we can release +the waiting loop immediately, the buffer will be retrieve and use +when the virtio-rng driver will be selected again. + +This avoids to hang on an rng_current write command if the virtio-rng +device is blocked by a lack of entropy. This allows to select +another entropy source if the current one is empty. + +Signed-off-by: Laurent Vivier +Link: https://lore.kernel.org/r/20211028101111.128049-3-lvivier@redhat.com +Signed-off-by: Michael S. Tsirkin +Stable-dep-of: ac52578d6e8d ("hwrng: virtio - Fix race on data_avail and actual data") +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/virtio-rng.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c +index 208c547dcac16..173aeea835bb6 100644 +--- a/drivers/char/hw_random/virtio-rng.c ++++ b/drivers/char/hw_random/virtio-rng.c +@@ -82,6 +82,11 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait) + ret = wait_for_completion_killable(&vi->have_data); + if (ret < 0) + return ret; ++ /* if vi->data_avail is 0, we have been interrupted ++ * by a cleanup, but buffer stays in the queue ++ */ ++ if (vi->data_avail == 0) ++ return read; + + chunk = min_t(unsigned int, size, vi->data_avail); + memcpy(buf + read, vi->data, chunk); +@@ -105,7 +110,7 @@ static void virtio_cleanup(struct hwrng *rng) + struct virtrng_info *vi = (struct virtrng_info *)rng->priv; + + if (vi->busy) +- wait_for_completion(&vi->have_data); ++ complete(&vi->have_data); + } + + static int probe_common(struct virtio_device *vdev) +-- +2.39.2 + diff --git a/queue-5.15/hwrng-virtio-don-t-waste-entropy.patch b/queue-5.15/hwrng-virtio-don-t-waste-entropy.patch new file mode 100644 index 00000000000..27e191b86eb --- /dev/null +++ b/queue-5.15/hwrng-virtio-don-t-waste-entropy.patch @@ -0,0 +1,130 @@ +From a5881884ef3c4619d70bc2ca975e48929cb98ee6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 12:11:10 +0200 +Subject: hwrng: virtio - don't waste entropy + +From: Laurent Vivier + +[ Upstream commit 5c8e933050044d6dd2a000f9a5756ae73cbe7c44 ] + +if we don't use all the entropy available in the buffer, keep it +and use it later. + +Signed-off-by: Laurent Vivier +Link: https://lore.kernel.org/r/20211028101111.128049-4-lvivier@redhat.com +Signed-off-by: Michael S. Tsirkin +Stable-dep-of: ac52578d6e8d ("hwrng: virtio - Fix race on data_avail and actual data") +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/virtio-rng.c | 52 +++++++++++++++++++---------- + 1 file changed, 35 insertions(+), 17 deletions(-) + +diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c +index 173aeea835bb6..8ba97cf4ca8fb 100644 +--- a/drivers/char/hw_random/virtio-rng.c ++++ b/drivers/char/hw_random/virtio-rng.c +@@ -26,6 +26,7 @@ struct virtrng_info { + /* data transfer */ + struct completion have_data; + unsigned int data_avail; ++ unsigned int data_idx; + /* minimal size returned by rng_buffer_size() */ + #if SMP_CACHE_BYTES < 32 + u8 data[32]; +@@ -42,6 +43,9 @@ static void random_recv_done(struct virtqueue *vq) + if (!virtqueue_get_buf(vi->vq, &vi->data_avail)) + return; + ++ vi->data_idx = 0; ++ vi->busy = false; ++ + complete(&vi->have_data); + } + +@@ -58,6 +62,16 @@ static void register_buffer(struct virtrng_info *vi) + virtqueue_kick(vi->vq); + } + ++static unsigned int copy_data(struct virtrng_info *vi, void *buf, ++ unsigned int size) ++{ ++ size = min_t(unsigned int, size, vi->data_avail); ++ memcpy(buf, vi->data + vi->data_idx, size); ++ vi->data_idx += size; ++ vi->data_avail -= size; ++ return size; ++} ++ + static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait) + { + int ret; +@@ -68,17 +82,29 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait) + if (vi->hwrng_removed) + return -ENODEV; + +- if (!vi->busy) { +- vi->busy = true; +- reinit_completion(&vi->have_data); +- register_buffer(vi); ++ read = 0; ++ ++ /* copy available data */ ++ if (vi->data_avail) { ++ chunk = copy_data(vi, buf, size); ++ size -= chunk; ++ read += chunk; + } + + if (!wait) +- return 0; ++ return read; + +- read = 0; ++ /* We have already copied available entropy, ++ * so either size is 0 or data_avail is 0 ++ */ + while (size != 0) { ++ /* data_avail is 0 */ ++ if (!vi->busy) { ++ /* no pending request, ask for more */ ++ vi->busy = true; ++ reinit_completion(&vi->have_data); ++ register_buffer(vi); ++ } + ret = wait_for_completion_killable(&vi->have_data); + if (ret < 0) + return ret; +@@ -88,20 +114,11 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait) + if (vi->data_avail == 0) + return read; + +- chunk = min_t(unsigned int, size, vi->data_avail); +- memcpy(buf + read, vi->data, chunk); +- read += chunk; ++ chunk = copy_data(vi, buf + read, size); + size -= chunk; +- vi->data_avail = 0; +- +- if (size != 0) { +- reinit_completion(&vi->have_data); +- register_buffer(vi); +- } ++ read += chunk; + } + +- vi->busy = false; +- + return read; + } + +@@ -161,6 +178,7 @@ static void remove_common(struct virtio_device *vdev) + + vi->hwrng_removed = true; + vi->data_avail = 0; ++ vi->data_idx = 0; + complete(&vi->have_data); + vdev->config->reset(vdev); + vi->busy = false; +-- +2.39.2 + diff --git a/queue-5.15/hwrng-virtio-fix-race-on-data_avail-and-actual-data.patch b/queue-5.15/hwrng-virtio-fix-race-on-data_avail-and-actual-data.patch new file mode 100644 index 00000000000..da5d452e530 --- /dev/null +++ b/queue-5.15/hwrng-virtio-fix-race-on-data_avail-and-actual-data.patch @@ -0,0 +1,86 @@ +From 68ffb5334edc0f8d252e3fb8ac2f3c97b0121064 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 11:59:32 +0800 +Subject: hwrng: virtio - Fix race on data_avail and actual data + +From: Herbert Xu + +[ Upstream commit ac52578d6e8d300dd50f790f29a24169b1edd26c ] + +The virtio rng device kicks off a new entropy request whenever the +data available reaches zero. When a new request occurs at the end +of a read operation, that is, when the result of that request is +only needed by the next reader, then there is a race between the +writing of the new data and the next reader. + +This is because there is no synchronisation whatsoever between the +writer and the reader. + +Fix this by writing data_avail with smp_store_release and reading +it with smp_load_acquire when we first enter read. The subsequent +reads are safe because they're either protected by the first load +acquire, or by the completion mechanism. + +Also remove the redundant zeroing of data_idx in random_recv_done +(data_idx must already be zero at this point) and data_avail in +request_entropy (ditto). + +Reported-by: syzbot+726dc8c62c3536431ceb@syzkaller.appspotmail.com +Fixes: f7f510ec1957 ("virtio: An entropy device, as suggested by hpa.") +Signed-off-by: Herbert Xu +Acked-by: Michael S. Tsirkin +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/virtio-rng.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c +index 0a7dde135db19..3a194eb3ce8ad 100644 +--- a/drivers/char/hw_random/virtio-rng.c ++++ b/drivers/char/hw_random/virtio-rng.c +@@ -4,6 +4,7 @@ + * Copyright (C) 2007, 2008 Rusty Russell IBM Corporation + */ + ++#include + #include + #include + #include +@@ -37,13 +38,13 @@ struct virtrng_info { + static void random_recv_done(struct virtqueue *vq) + { + struct virtrng_info *vi = vq->vdev->priv; ++ unsigned int len; + + /* We can get spurious callbacks, e.g. shared IRQs + virtio_pci. */ +- if (!virtqueue_get_buf(vi->vq, &vi->data_avail)) ++ if (!virtqueue_get_buf(vi->vq, &len)) + return; + +- vi->data_idx = 0; +- ++ smp_store_release(&vi->data_avail, len); + complete(&vi->have_data); + } + +@@ -52,7 +53,6 @@ static void request_entropy(struct virtrng_info *vi) + struct scatterlist sg; + + reinit_completion(&vi->have_data); +- vi->data_avail = 0; + vi->data_idx = 0; + + sg_init_one(&sg, vi->data, sizeof(vi->data)); +@@ -88,7 +88,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait) + read = 0; + + /* copy available data */ +- if (vi->data_avail) { ++ if (smp_load_acquire(&vi->data_avail)) { + chunk = copy_data(vi, buf, size); + size -= chunk; + read += chunk; +-- +2.39.2 + diff --git a/queue-5.15/ib-hfi1-fix-wrong-mmu_node-used-for-user-sdma-packet.patch b/queue-5.15/ib-hfi1-fix-wrong-mmu_node-used-for-user-sdma-packet.patch new file mode 100644 index 00000000000..3ad59d74054 --- /dev/null +++ b/queue-5.15/ib-hfi1-fix-wrong-mmu_node-used-for-user-sdma-packet.patch @@ -0,0 +1,765 @@ +From 26369f189726fb568e1e4c31ae20f34ba82dae3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 12:32:16 -0400 +Subject: IB/hfi1: Fix wrong mmu_node used for user SDMA packet after + invalidate + +From: Brendan Cunningham + +[ Upstream commit c9358de193ecfb360c3ce75f27ce839ca0b0bc8c ] + +The hfi1 user SDMA pinned-page cache will leave a stale cache entry when +the cache-entry's virtual address range is invalidated but that cache +entry is in-use by an outstanding SDMA request. + +Subsequent user SDMA requests with buffers in or spanning the virtual +address range of the stale cache entry will result in packets constructed +from the wrong memory, the physical pages pointed to by the stale cache +entry. + +To fix this, remove mmu_rb_node cache entries from the mmu_rb_handler +cache independent of the cache entry's refcount. Add 'struct kref +refcount' to struct mmu_rb_node and manage mmu_rb_node lifetime with +kref_get() and kref_put(). + +mmu_rb_node.refcount makes sdma_mmu_node.refcount redundant. Remove +'atomic_t refcount' from struct sdma_mmu_node and change sdma_mmu_node +code to use mmu_rb_node.refcount. + +Move the mmu_rb_handler destructor call after a +wait-for-SDMA-request-completion call so mmu_rb_nodes that need +mmu_rb_handler's workqueue to queue themselves up for destruction from an +interrupt context may do so. + +Fixes: f48ad614c100 ("IB/hfi1: Move driver out of staging") +Fixes: 00cbce5cbf88 ("IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests") +Link: https://lore.kernel.org/r/168451393605.3700681.13493776139032178861.stgit@awfm-02.cornelisnetworks.com +Reviewed-by: Dean Luick +Signed-off-by: Brendan Cunningham +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/ipoib_tx.c | 4 +- + drivers/infiniband/hw/hfi1/mmu_rb.c | 101 ++++++++++------- + drivers/infiniband/hw/hfi1/mmu_rb.h | 3 + + drivers/infiniband/hw/hfi1/sdma.c | 23 +++- + drivers/infiniband/hw/hfi1/sdma.h | 47 +++++--- + drivers/infiniband/hw/hfi1/sdma_txreq.h | 2 + + drivers/infiniband/hw/hfi1/user_sdma.c | 137 ++++++++++-------------- + drivers/infiniband/hw/hfi1/user_sdma.h | 1 - + drivers/infiniband/hw/hfi1/vnic_sdma.c | 4 +- + 9 files changed, 177 insertions(+), 145 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/ipoib_tx.c b/drivers/infiniband/hw/hfi1/ipoib_tx.c +index 33ffb00c63823..a89d1bd99a332 100644 +--- a/drivers/infiniband/hw/hfi1/ipoib_tx.c ++++ b/drivers/infiniband/hw/hfi1/ipoib_tx.c +@@ -251,11 +251,11 @@ static int hfi1_ipoib_build_ulp_payload(struct ipoib_txreq *tx, + const skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; + + ret = sdma_txadd_page(dd, +- NULL, + txreq, + skb_frag_page(frag), + frag->bv_offset, +- skb_frag_size(frag)); ++ skb_frag_size(frag), ++ NULL, NULL, NULL); + if (unlikely(ret)) + break; + } +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c +index 71b9ac0188875..94f1701667301 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -19,8 +19,7 @@ static int mmu_notifier_range_start(struct mmu_notifier *, + const struct mmu_notifier_range *); + static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *, + unsigned long, unsigned long); +-static void do_remove(struct mmu_rb_handler *handler, +- struct list_head *del_list); ++static void release_immediate(struct kref *refcount); + static void handle_remove(struct work_struct *work); + + static const struct mmu_notifier_ops mn_opts = { +@@ -103,7 +102,11 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler) + } + spin_unlock_irqrestore(&handler->lock, flags); + +- do_remove(handler, &del_list); ++ while (!list_empty(&del_list)) { ++ rbnode = list_first_entry(&del_list, struct mmu_rb_node, list); ++ list_del(&rbnode->list); ++ kref_put(&rbnode->refcount, release_immediate); ++ } + + /* Now the mm may be freed. */ + mmdrop(handler->mn.mm); +@@ -131,12 +134,6 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + } + __mmu_int_rb_insert(mnode, &handler->root); + list_add_tail(&mnode->list, &handler->lru_list); +- +- ret = handler->ops->insert(handler->ops_arg, mnode); +- if (ret) { +- __mmu_int_rb_remove(mnode, &handler->root); +- list_del(&mnode->list); /* remove from LRU list */ +- } + mnode->handler = handler; + unlock: + spin_unlock_irqrestore(&handler->lock, flags); +@@ -180,6 +177,48 @@ static struct mmu_rb_node *__mmu_rb_search(struct mmu_rb_handler *handler, + return node; + } + ++/* ++ * Must NOT call while holding mnode->handler->lock. ++ * mnode->handler->ops->remove() may sleep and mnode->handler->lock is a ++ * spinlock. ++ */ ++static void release_immediate(struct kref *refcount) ++{ ++ struct mmu_rb_node *mnode = ++ container_of(refcount, struct mmu_rb_node, refcount); ++ mnode->handler->ops->remove(mnode->handler->ops_arg, mnode); ++} ++ ++/* Caller must hold mnode->handler->lock */ ++static void release_nolock(struct kref *refcount) ++{ ++ struct mmu_rb_node *mnode = ++ container_of(refcount, struct mmu_rb_node, refcount); ++ list_move(&mnode->list, &mnode->handler->del_list); ++ queue_work(mnode->handler->wq, &mnode->handler->del_work); ++} ++ ++/* ++ * struct mmu_rb_node->refcount kref_put() callback. ++ * Adds mmu_rb_node to mmu_rb_node->handler->del_list and queues ++ * handler->del_work on handler->wq. ++ * Does not remove mmu_rb_node from handler->lru_list or handler->rb_root. ++ * Acquires mmu_rb_node->handler->lock; do not call while already holding ++ * handler->lock. ++ */ ++void hfi1_mmu_rb_release(struct kref *refcount) ++{ ++ struct mmu_rb_node *mnode = ++ container_of(refcount, struct mmu_rb_node, refcount); ++ struct mmu_rb_handler *handler = mnode->handler; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&handler->lock, flags); ++ list_move(&mnode->list, &mnode->handler->del_list); ++ spin_unlock_irqrestore(&handler->lock, flags); ++ queue_work(handler->wq, &handler->del_work); ++} ++ + void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + { + struct mmu_rb_node *rbnode, *ptr; +@@ -194,6 +233,10 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + + spin_lock_irqsave(&handler->lock, flags); + list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) { ++ /* refcount == 1 implies mmu_rb_handler has only rbnode ref */ ++ if (kref_read(&rbnode->refcount) > 1) ++ continue; ++ + if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg, + &stop)) { + __mmu_int_rb_remove(rbnode, &handler->root); +@@ -206,7 +249,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + spin_unlock_irqrestore(&handler->lock, flags); + + list_for_each_entry_safe(rbnode, ptr, &del_list, list) { +- handler->ops->remove(handler->ops_arg, rbnode); ++ kref_put(&rbnode->refcount, release_immediate); + } + } + +@@ -218,7 +261,6 @@ static int mmu_notifier_range_start(struct mmu_notifier *mn, + struct rb_root_cached *root = &handler->root; + struct mmu_rb_node *node, *ptr = NULL; + unsigned long flags; +- bool added = false; + + spin_lock_irqsave(&handler->lock, flags); + for (node = __mmu_int_rb_iter_first(root, range->start, range->end-1); +@@ -227,38 +269,16 @@ static int mmu_notifier_range_start(struct mmu_notifier *mn, + ptr = __mmu_int_rb_iter_next(node, range->start, + range->end - 1); + trace_hfi1_mmu_mem_invalidate(node->addr, node->len); +- if (handler->ops->invalidate(handler->ops_arg, node)) { +- __mmu_int_rb_remove(node, root); +- /* move from LRU list to delete list */ +- list_move(&node->list, &handler->del_list); +- added = true; +- } ++ /* Remove from rb tree and lru_list. */ ++ __mmu_int_rb_remove(node, root); ++ list_del_init(&node->list); ++ kref_put(&node->refcount, release_nolock); + } + spin_unlock_irqrestore(&handler->lock, flags); + +- if (added) +- queue_work(handler->wq, &handler->del_work); +- + return 0; + } + +-/* +- * Call the remove function for the given handler and the list. This +- * is expected to be called with a delete list extracted from handler. +- * The caller should not be holding the handler lock. +- */ +-static void do_remove(struct mmu_rb_handler *handler, +- struct list_head *del_list) +-{ +- struct mmu_rb_node *node; +- +- while (!list_empty(del_list)) { +- node = list_first_entry(del_list, struct mmu_rb_node, list); +- list_del(&node->list); +- handler->ops->remove(handler->ops_arg, node); +- } +-} +- + /* + * Work queue function to remove all nodes that have been queued up to + * be removed. The key feature is that mm->mmap_lock is not being held +@@ -271,11 +291,16 @@ static void handle_remove(struct work_struct *work) + del_work); + struct list_head del_list; + unsigned long flags; ++ struct mmu_rb_node *node; + + /* remove anything that is queued to get removed */ + spin_lock_irqsave(&handler->lock, flags); + list_replace_init(&handler->del_list, &del_list); + spin_unlock_irqrestore(&handler->lock, flags); + +- do_remove(handler, &del_list); ++ while (!list_empty(&del_list)) { ++ node = list_first_entry(&del_list, struct mmu_rb_node, list); ++ list_del(&node->list); ++ handler->ops->remove(handler->ops_arg, node); ++ } + } +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.h b/drivers/infiniband/hw/hfi1/mmu_rb.h +index ed75acdb7b839..dd2c4a0ae95b1 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.h ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.h +@@ -16,6 +16,7 @@ struct mmu_rb_node { + struct rb_node node; + struct mmu_rb_handler *handler; + struct list_head list; ++ struct kref refcount; + }; + + /* +@@ -51,6 +52,8 @@ int hfi1_mmu_rb_register(void *ops_arg, + void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler); + int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + struct mmu_rb_node *mnode); ++void hfi1_mmu_rb_release(struct kref *refcount); ++ + void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg); + struct mmu_rb_node *hfi1_mmu_rb_get_first(struct mmu_rb_handler *handler, + unsigned long addr, +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index bb2552dd29c1e..26c62162759ba 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -1593,7 +1593,20 @@ static inline void sdma_unmap_desc( + struct hfi1_devdata *dd, + struct sdma_desc *descp) + { +- system_descriptor_complete(dd, descp); ++ switch (sdma_mapping_type(descp)) { ++ case SDMA_MAP_SINGLE: ++ dma_unmap_single(&dd->pcidev->dev, sdma_mapping_addr(descp), ++ sdma_mapping_len(descp), DMA_TO_DEVICE); ++ break; ++ case SDMA_MAP_PAGE: ++ dma_unmap_page(&dd->pcidev->dev, sdma_mapping_addr(descp), ++ sdma_mapping_len(descp), DMA_TO_DEVICE); ++ break; ++ } ++ ++ if (descp->pinning_ctx && descp->ctx_put) ++ descp->ctx_put(descp->pinning_ctx); ++ descp->pinning_ctx = NULL; + } + + /* +@@ -3113,8 +3126,8 @@ int ext_coal_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx, + + /* Add descriptor for coalesce buffer */ + tx->desc_limit = MAX_DESC; +- return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, +- addr, tx->tlen); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, tx, ++ addr, tx->tlen, NULL, NULL, NULL); + } + + return 1; +@@ -3157,9 +3170,9 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + make_tx_sdma_desc( + tx, + SDMA_MAP_NONE, +- NULL, + dd->sdma_pad_phys, +- sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1))); ++ sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1)), ++ NULL, NULL, NULL); + tx->num_desc++; + _sdma_close_tx(dd, tx); + return rval; +diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h +index 95aaec14c6c28..7fdebab202c4f 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.h ++++ b/drivers/infiniband/hw/hfi1/sdma.h +@@ -594,9 +594,11 @@ static inline dma_addr_t sdma_mapping_addr(struct sdma_desc *d) + static inline void make_tx_sdma_desc( + struct sdma_txreq *tx, + int type, +- void *pinning_ctx, + dma_addr_t addr, +- size_t len) ++ size_t len, ++ void *pinning_ctx, ++ void (*ctx_get)(void *), ++ void (*ctx_put)(void *)) + { + struct sdma_desc *desc = &tx->descp[tx->num_desc]; + +@@ -613,7 +615,11 @@ static inline void make_tx_sdma_desc( + << SDMA_DESC0_PHY_ADDR_SHIFT) | + (((u64)len & SDMA_DESC0_BYTE_COUNT_MASK) + << SDMA_DESC0_BYTE_COUNT_SHIFT); ++ + desc->pinning_ctx = pinning_ctx; ++ desc->ctx_put = ctx_put; ++ if (pinning_ctx && ctx_get) ++ ctx_get(pinning_ctx); + } + + /* helper to extend txreq */ +@@ -645,18 +651,20 @@ static inline void _sdma_close_tx(struct hfi1_devdata *dd, + static inline int _sdma_txadd_daddr( + struct hfi1_devdata *dd, + int type, +- void *pinning_ctx, + struct sdma_txreq *tx, + dma_addr_t addr, +- u16 len) ++ u16 len, ++ void *pinning_ctx, ++ void (*ctx_get)(void *), ++ void (*ctx_put)(void *)) + { + int rval = 0; + + make_tx_sdma_desc( + tx, + type, +- pinning_ctx, +- addr, len); ++ addr, len, ++ pinning_ctx, ctx_get, ctx_put); + WARN_ON(len > tx->tlen); + tx->num_desc++; + tx->tlen -= len; +@@ -676,11 +684,18 @@ static inline int _sdma_txadd_daddr( + /** + * sdma_txadd_page() - add a page to the sdma_txreq + * @dd: the device to use for mapping +- * @pinning_ctx: context to be released at descriptor retirement + * @tx: tx request to which the page is added + * @page: page to map + * @offset: offset within the page + * @len: length in bytes ++ * @pinning_ctx: context to be stored on struct sdma_desc .pinning_ctx. Not ++ * added if coalesce buffer is used. E.g. pointer to pinned-page ++ * cache entry for the sdma_desc. ++ * @ctx_get: optional function to take reference to @pinning_ctx. Not called if ++ * @pinning_ctx is NULL. ++ * @ctx_put: optional function to release reference to @pinning_ctx after ++ * sdma_desc completes. May be called in interrupt context so must ++ * not sleep. Not called if @pinning_ctx is NULL. + * + * This is used to add a page/offset/length descriptor. + * +@@ -692,11 +707,13 @@ static inline int _sdma_txadd_daddr( + */ + static inline int sdma_txadd_page( + struct hfi1_devdata *dd, +- void *pinning_ctx, + struct sdma_txreq *tx, + struct page *page, + unsigned long offset, +- u16 len) ++ u16 len, ++ void *pinning_ctx, ++ void (*ctx_get)(void *), ++ void (*ctx_put)(void *)) + { + dma_addr_t addr; + int rval; +@@ -720,7 +737,8 @@ static inline int sdma_txadd_page( + return -ENOSPC; + } + +- return _sdma_txadd_daddr(dd, SDMA_MAP_PAGE, pinning_ctx, tx, addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_PAGE, tx, addr, len, ++ pinning_ctx, ctx_get, ctx_put); + } + + /** +@@ -754,8 +772,8 @@ static inline int sdma_txadd_daddr( + return rval; + } + +- return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, NULL, tx, +- addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_NONE, tx, addr, len, ++ NULL, NULL, NULL); + } + + /** +@@ -801,7 +819,8 @@ static inline int sdma_txadd_kvaddr( + return -ENOSPC; + } + +- return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, NULL, tx, addr, len); ++ return _sdma_txadd_daddr(dd, SDMA_MAP_SINGLE, tx, addr, len, ++ NULL, NULL, NULL); + } + + struct iowait_work; +@@ -1034,6 +1053,4 @@ u16 sdma_get_descq_cnt(void); + extern uint mod_num_sdma; + + void sdma_update_lmc(struct hfi1_devdata *dd, u64 mask, u32 lid); +- +-void system_descriptor_complete(struct hfi1_devdata *dd, struct sdma_desc *descp); + #endif +diff --git a/drivers/infiniband/hw/hfi1/sdma_txreq.h b/drivers/infiniband/hw/hfi1/sdma_txreq.h +index fad946cb5e0d8..85ae7293c2741 100644 +--- a/drivers/infiniband/hw/hfi1/sdma_txreq.h ++++ b/drivers/infiniband/hw/hfi1/sdma_txreq.h +@@ -20,6 +20,8 @@ struct sdma_desc { + /* private: don't use directly */ + u64 qw[2]; + void *pinning_ctx; ++ /* Release reference to @pinning_ctx. May be called in interrupt context. Must not sleep. */ ++ void (*ctx_put)(void *ctx); + }; + + /** +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c +index ae58b48afe074..02bd62b857b75 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -62,18 +62,14 @@ static int defer_packet_queue( + static void activate_packet_queue(struct iowait *wait, int reason); + static bool sdma_rb_filter(struct mmu_rb_node *node, unsigned long addr, + unsigned long len); +-static int sdma_rb_insert(void *arg, struct mmu_rb_node *mnode); + static int sdma_rb_evict(void *arg, struct mmu_rb_node *mnode, + void *arg2, bool *stop); + static void sdma_rb_remove(void *arg, struct mmu_rb_node *mnode); +-static int sdma_rb_invalidate(void *arg, struct mmu_rb_node *mnode); + + static struct mmu_rb_ops sdma_rb_ops = { + .filter = sdma_rb_filter, +- .insert = sdma_rb_insert, + .evict = sdma_rb_evict, + .remove = sdma_rb_remove, +- .invalidate = sdma_rb_invalidate + }; + + static int add_system_pages_to_sdma_packet(struct user_sdma_request *req, +@@ -247,14 +243,14 @@ int hfi1_user_sdma_free_queues(struct hfi1_filedata *fd, + spin_unlock(&fd->pq_rcu_lock); + synchronize_srcu(&fd->pq_srcu); + /* at this point there can be no more new requests */ +- if (pq->handler) +- hfi1_mmu_rb_unregister(pq->handler); + iowait_sdma_drain(&pq->busy); + /* Wait until all requests have been freed. */ + wait_event_interruptible( + pq->wait, + !atomic_read(&pq->n_reqs)); + kfree(pq->reqs); ++ if (pq->handler) ++ hfi1_mmu_rb_unregister(pq->handler); + bitmap_free(pq->req_in_use); + kmem_cache_destroy(pq->txreq_cache); + flush_pq_iowait(pq); +@@ -1275,25 +1271,17 @@ static void free_system_node(struct sdma_mmu_node *node) + kfree(node); + } + +-static inline void acquire_node(struct sdma_mmu_node *node) +-{ +- atomic_inc(&node->refcount); +- WARN_ON(atomic_read(&node->refcount) < 0); +-} +- +-static inline void release_node(struct mmu_rb_handler *handler, +- struct sdma_mmu_node *node) +-{ +- atomic_dec(&node->refcount); +- WARN_ON(atomic_read(&node->refcount) < 0); +-} +- ++/* ++ * kref_get()'s an additional kref on the returned rb_node to prevent rb_node ++ * from being released until after rb_node is assigned to an SDMA descriptor ++ * (struct sdma_desc) under add_system_iovec_to_sdma_packet(), even if the ++ * virtual address range for rb_node is invalidated between now and then. ++ */ + static struct sdma_mmu_node *find_system_node(struct mmu_rb_handler *handler, + unsigned long start, + unsigned long end) + { + struct mmu_rb_node *rb_node; +- struct sdma_mmu_node *node; + unsigned long flags; + + spin_lock_irqsave(&handler->lock, flags); +@@ -1302,11 +1290,12 @@ static struct sdma_mmu_node *find_system_node(struct mmu_rb_handler *handler, + spin_unlock_irqrestore(&handler->lock, flags); + return NULL; + } +- node = container_of(rb_node, struct sdma_mmu_node, rb); +- acquire_node(node); ++ ++ /* "safety" kref to prevent release before add_system_iovec_to_sdma_packet() */ ++ kref_get(&rb_node->refcount); + spin_unlock_irqrestore(&handler->lock, flags); + +- return node; ++ return container_of(rb_node, struct sdma_mmu_node, rb); + } + + static int pin_system_pages(struct user_sdma_request *req, +@@ -1355,6 +1344,13 @@ static int pin_system_pages(struct user_sdma_request *req, + return 0; + } + ++/* ++ * kref refcount on *node_p will be 2 on successful addition: one kref from ++ * kref_init() for mmu_rb_handler and one kref to prevent *node_p from being ++ * released until after *node_p is assigned to an SDMA descriptor (struct ++ * sdma_desc) under add_system_iovec_to_sdma_packet(), even if the virtual ++ * address range for *node_p is invalidated between now and then. ++ */ + static int add_system_pinning(struct user_sdma_request *req, + struct sdma_mmu_node **node_p, + unsigned long start, unsigned long len) +@@ -1368,6 +1364,12 @@ static int add_system_pinning(struct user_sdma_request *req, + if (!node) + return -ENOMEM; + ++ /* First kref "moves" to mmu_rb_handler */ ++ kref_init(&node->rb.refcount); ++ ++ /* "safety" kref to prevent release before add_system_iovec_to_sdma_packet() */ ++ kref_get(&node->rb.refcount); ++ + node->pq = pq; + ret = pin_system_pages(req, start, len, node, PFN_DOWN(len)); + if (ret == 0) { +@@ -1431,15 +1433,15 @@ static int get_system_cache_entry(struct user_sdma_request *req, + return 0; + } + +- SDMA_DBG(req, "prepend: node->rb.addr %lx, node->refcount %d", +- node->rb.addr, atomic_read(&node->refcount)); ++ SDMA_DBG(req, "prepend: node->rb.addr %lx, node->rb.refcount %d", ++ node->rb.addr, kref_read(&node->rb.refcount)); + prepend_len = node->rb.addr - start; + + /* + * This node will not be returned, instead a new node + * will be. So release the reference. + */ +- release_node(handler, node); ++ kref_put(&node->rb.refcount, hfi1_mmu_rb_release); + + /* Prepend a node to cover the beginning of the allocation */ + ret = add_system_pinning(req, node_p, start, prepend_len); +@@ -1451,6 +1453,20 @@ static int get_system_cache_entry(struct user_sdma_request *req, + } + } + ++static void sdma_mmu_rb_node_get(void *ctx) ++{ ++ struct mmu_rb_node *node = ctx; ++ ++ kref_get(&node->refcount); ++} ++ ++static void sdma_mmu_rb_node_put(void *ctx) ++{ ++ struct sdma_mmu_node *node = ctx; ++ ++ kref_put(&node->rb.refcount, hfi1_mmu_rb_release); ++} ++ + static int add_mapping_to_sdma_packet(struct user_sdma_request *req, + struct user_sdma_txreq *tx, + struct sdma_mmu_node *cache_entry, +@@ -1494,9 +1510,12 @@ static int add_mapping_to_sdma_packet(struct user_sdma_request *req, + ctx = cache_entry; + } + +- ret = sdma_txadd_page(pq->dd, ctx, &tx->txreq, ++ ret = sdma_txadd_page(pq->dd, &tx->txreq, + cache_entry->pages[page_index], +- page_offset, from_this_page); ++ page_offset, from_this_page, ++ ctx, ++ sdma_mmu_rb_node_get, ++ sdma_mmu_rb_node_put); + if (ret) { + /* + * When there's a failure, the entire request is freed by +@@ -1518,8 +1537,6 @@ static int add_system_iovec_to_sdma_packet(struct user_sdma_request *req, + struct user_sdma_iovec *iovec, + size_t from_this_iovec) + { +- struct mmu_rb_handler *handler = req->pq->handler; +- + while (from_this_iovec > 0) { + struct sdma_mmu_node *cache_entry; + size_t from_this_cache_entry; +@@ -1540,15 +1557,15 @@ static int add_system_iovec_to_sdma_packet(struct user_sdma_request *req, + + ret = add_mapping_to_sdma_packet(req, tx, cache_entry, start, + from_this_cache_entry); ++ ++ /* ++ * Done adding cache_entry to zero or more sdma_desc. Can ++ * kref_put() the "safety" kref taken under ++ * get_system_cache_entry(). ++ */ ++ kref_put(&cache_entry->rb.refcount, hfi1_mmu_rb_release); ++ + if (ret) { +- /* +- * We're guaranteed that there will be no descriptor +- * completion callback that releases this node +- * because only the last descriptor referencing it +- * has a context attached, and a failure means the +- * last descriptor was never added. +- */ +- release_node(handler, cache_entry); + SDMA_DBG(req, "add system segment failed %d", ret); + return ret; + } +@@ -1599,42 +1616,12 @@ static int add_system_pages_to_sdma_packet(struct user_sdma_request *req, + return 0; + } + +-void system_descriptor_complete(struct hfi1_devdata *dd, +- struct sdma_desc *descp) +-{ +- switch (sdma_mapping_type(descp)) { +- case SDMA_MAP_SINGLE: +- dma_unmap_single(&dd->pcidev->dev, sdma_mapping_addr(descp), +- sdma_mapping_len(descp), DMA_TO_DEVICE); +- break; +- case SDMA_MAP_PAGE: +- dma_unmap_page(&dd->pcidev->dev, sdma_mapping_addr(descp), +- sdma_mapping_len(descp), DMA_TO_DEVICE); +- break; +- } +- +- if (descp->pinning_ctx) { +- struct sdma_mmu_node *node = descp->pinning_ctx; +- +- release_node(node->rb.handler, node); +- } +-} +- + static bool sdma_rb_filter(struct mmu_rb_node *node, unsigned long addr, + unsigned long len) + { + return (bool)(node->addr == addr); + } + +-static int sdma_rb_insert(void *arg, struct mmu_rb_node *mnode) +-{ +- struct sdma_mmu_node *node = +- container_of(mnode, struct sdma_mmu_node, rb); +- +- atomic_inc(&node->refcount); +- return 0; +-} +- + /* + * Return 1 to remove the node from the rb tree and call the remove op. + * +@@ -1647,10 +1634,6 @@ static int sdma_rb_evict(void *arg, struct mmu_rb_node *mnode, + container_of(mnode, struct sdma_mmu_node, rb); + struct evict_data *evict_data = evict_arg; + +- /* is this node still being used? */ +- if (atomic_read(&node->refcount)) +- return 0; /* keep this node */ +- + /* this node will be evicted, add its pages to our count */ + evict_data->cleared += node->npages; + +@@ -1668,13 +1651,3 @@ static void sdma_rb_remove(void *arg, struct mmu_rb_node *mnode) + + free_system_node(node); + } +- +-static int sdma_rb_invalidate(void *arg, struct mmu_rb_node *mnode) +-{ +- struct sdma_mmu_node *node = +- container_of(mnode, struct sdma_mmu_node, rb); +- +- if (!atomic_read(&node->refcount)) +- return 1; +- return 0; +-} +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h +index a241836371dc1..548347d4c5bc2 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.h ++++ b/drivers/infiniband/hw/hfi1/user_sdma.h +@@ -104,7 +104,6 @@ struct hfi1_user_sdma_comp_q { + struct sdma_mmu_node { + struct mmu_rb_node rb; + struct hfi1_user_sdma_pkt_q *pq; +- atomic_t refcount; + struct page **pages; + unsigned int npages; + }; +diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c +index 727eedfba332a..cc6324d2d1ddc 100644 +--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c ++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c +@@ -64,11 +64,11 @@ static noinline int build_vnic_ulp_payload(struct sdma_engine *sde, + + /* combine physically continuous fragments later? */ + ret = sdma_txadd_page(sde->dd, +- NULL, + &tx->txreq, + skb_frag_page(frag), + skb_frag_off(frag), +- skb_frag_size(frag)); ++ skb_frag_size(frag), ++ NULL, NULL, NULL); + if (unlikely(ret)) + goto bail_txadd; + } +-- +2.39.2 + diff --git a/queue-5.15/ib-hfi1-use-bitmap_zalloc-when-applicable.patch b/queue-5.15/ib-hfi1-use-bitmap_zalloc-when-applicable.patch new file mode 100644 index 00000000000..16208d78d33 --- /dev/null +++ b/queue-5.15/ib-hfi1-use-bitmap_zalloc-when-applicable.patch @@ -0,0 +1,60 @@ +From 806ead3ac3eb1b0f0aee8ef311771df1cad95c26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Nov 2021 20:53:22 +0100 +Subject: IB/hfi1: Use bitmap_zalloc() when applicable + +From: Christophe JAILLET + +[ Upstream commit f86dbc9fc5d83384eae7eda0de17f823e8c81ca0 ] + +Use 'bitmap_zalloc()' to simplify code, improve the semantic and avoid +some open-coded arithmetic in allocator arguments. + +Also change the corresponding 'kfree()' into 'bitmap_free()' to keep +consistency. + +Link: https://lore.kernel.org/r/d46c6bc1869b8869244fa71943d2cad4104b3668.1637869925.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Christophe JAILLET +Signed-off-by: Jason Gunthorpe +Stable-dep-of: c9358de193ec ("IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/user_sdma.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c +index a932ae1e03af5..ae58b48afe074 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -161,9 +161,7 @@ int hfi1_user_sdma_alloc_queues(struct hfi1_ctxtdata *uctxt, + if (!pq->reqs) + goto pq_reqs_nomem; + +- pq->req_in_use = kcalloc(BITS_TO_LONGS(hfi1_sdma_comp_ring_size), +- sizeof(*pq->req_in_use), +- GFP_KERNEL); ++ pq->req_in_use = bitmap_zalloc(hfi1_sdma_comp_ring_size, GFP_KERNEL); + if (!pq->req_in_use) + goto pq_reqs_no_in_use; + +@@ -210,7 +208,7 @@ int hfi1_user_sdma_alloc_queues(struct hfi1_ctxtdata *uctxt, + cq_nomem: + kmem_cache_destroy(pq->txreq_cache); + pq_txreq_nomem: +- kfree(pq->req_in_use); ++ bitmap_free(pq->req_in_use); + pq_reqs_no_in_use: + kfree(pq->reqs); + pq_reqs_nomem: +@@ -257,7 +255,7 @@ int hfi1_user_sdma_free_queues(struct hfi1_filedata *fd, + pq->wait, + !atomic_read(&pq->n_reqs)); + kfree(pq->reqs); +- kfree(pq->req_in_use); ++ bitmap_free(pq->req_in_use); + kmem_cache_destroy(pq->txreq_cache); + flush_pq_iowait(pq); + kfree(pq); +-- +2.39.2 + diff --git a/queue-5.15/igc-enable-and-fix-rx-hash-usage-by-netstack.patch b/queue-5.15/igc-enable-and-fix-rx-hash-usage-by-netstack.patch new file mode 100644 index 00000000000..f3bec299cb3 --- /dev/null +++ b/queue-5.15/igc-enable-and-fix-rx-hash-usage-by-netstack.patch @@ -0,0 +1,149 @@ +From e59d054405d7a4e44f8dc5a9b5dd69ca8ca569e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 15:30:42 +0200 +Subject: igc: Enable and fix RX hash usage by netstack + +From: Jesper Dangaard Brouer + +[ Upstream commit 84214ab4689f962b4bfc47fc9a5838d25ac4274d ] + +When function igc_rx_hash() was introduced in v4.20 via commit 0507ef8a0372 +("igc: Add transmit and receive fastpath and interrupt handlers"), the +hardware wasn't configured to provide RSS hash, thus it made sense to not +enable net_device NETIF_F_RXHASH feature bit. + +The NIC hardware was configured to enable RSS hash info in v5.2 via commit +2121c2712f82 ("igc: Add multiple receive queues control supporting"), but +forgot to set the NETIF_F_RXHASH feature bit. + +The original implementation of igc_rx_hash() didn't extract the associated +pkt_hash_type, but statically set PKT_HASH_TYPE_L3. The largest portions of +this patch are about extracting the RSS Type from the hardware and mapping +this to enum pkt_hash_types. This was based on Foxville i225 software user +manual rev-1.3.1 and tested on Intel Ethernet Controller I225-LM (rev 03). + +For UDP it's worth noting that RSS (type) hashing have been disabled both for +IPv4 and IPv6 (see IGC_MRQC_RSS_FIELD_IPV4_UDP + IGC_MRQC_RSS_FIELD_IPV6_UDP) +because hardware RSS doesn't handle fragmented pkts well when enabled (can +cause out-of-order). This results in PKT_HASH_TYPE_L3 for UDP packets, and +hash value doesn't include UDP port numbers. Not being PKT_HASH_TYPE_L4, have +the effect that netstack will do a software based hash calc calling into +flow_dissect, but only when code calls skb_get_hash(), which doesn't +necessary happen for local delivery. + +For QA verification testing I wrote a small bpftrace prog: + [0] https://github.com/xdp-project/xdp-project/blob/master/areas/hints/monitor_skb_hash_on_dev.bt + +Fixes: 2121c2712f82 ("igc: Add multiple receive queues control supporting") +Signed-off-by: Jesper Dangaard Brouer +Signed-off-by: Daniel Borkmann +Acked-by: Song Yoong Siang +Link: https://lore.kernel.org/bpf/168182464270.616355.11391652654430626584.stgit@firesoul +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc.h | 28 ++++++++++++++++++++ + drivers/net/ethernet/intel/igc/igc_main.c | 31 ++++++++++++++++++++--- + 2 files changed, 55 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h +index 66678cd72a6cd..486e1ce609cd5 100644 +--- a/drivers/net/ethernet/intel/igc/igc.h ++++ b/drivers/net/ethernet/intel/igc/igc.h +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + + #include "igc_hw.h" + +@@ -312,6 +313,33 @@ extern char igc_driver_name[]; + #define IGC_MRQC_RSS_FIELD_IPV4_UDP 0x00400000 + #define IGC_MRQC_RSS_FIELD_IPV6_UDP 0x00800000 + ++/* RX-desc Write-Back format RSS Type's */ ++enum igc_rss_type_num { ++ IGC_RSS_TYPE_NO_HASH = 0, ++ IGC_RSS_TYPE_HASH_TCP_IPV4 = 1, ++ IGC_RSS_TYPE_HASH_IPV4 = 2, ++ IGC_RSS_TYPE_HASH_TCP_IPV6 = 3, ++ IGC_RSS_TYPE_HASH_IPV6_EX = 4, ++ IGC_RSS_TYPE_HASH_IPV6 = 5, ++ IGC_RSS_TYPE_HASH_TCP_IPV6_EX = 6, ++ IGC_RSS_TYPE_HASH_UDP_IPV4 = 7, ++ IGC_RSS_TYPE_HASH_UDP_IPV6 = 8, ++ IGC_RSS_TYPE_HASH_UDP_IPV6_EX = 9, ++ IGC_RSS_TYPE_MAX = 10, ++}; ++#define IGC_RSS_TYPE_MAX_TABLE 16 ++#define IGC_RSS_TYPE_MASK GENMASK(3,0) /* 4-bits (3:0) = mask 0x0F */ ++ ++/* igc_rss_type - Rx descriptor RSS type field */ ++static inline u32 igc_rss_type(const union igc_adv_rx_desc *rx_desc) ++{ ++ /* RSS Type 4-bits (3:0) number: 0-9 (above 9 is reserved) ++ * Accessing the same bits via u16 (wb.lower.lo_dword.hs_rss.pkt_info) ++ * is slightly slower than via u32 (wb.lower.lo_dword.data) ++ */ ++ return le32_get_bits(rx_desc->wb.lower.lo_dword.data, IGC_RSS_TYPE_MASK); ++} ++ + /* Interrupt defines */ + #define IGC_START_ITR 648 /* ~6000 ints/sec */ + #define IGC_4K_ITR 980 +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index eb7aa8c13f7e5..32e4ebac4b693 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -1683,14 +1683,36 @@ static void igc_rx_checksum(struct igc_ring *ring, + le32_to_cpu(rx_desc->wb.upper.status_error)); + } + ++/* Mapping HW RSS Type to enum pkt_hash_types */ ++static const enum pkt_hash_types igc_rss_type_table[IGC_RSS_TYPE_MAX_TABLE] = { ++ [IGC_RSS_TYPE_NO_HASH] = PKT_HASH_TYPE_L2, ++ [IGC_RSS_TYPE_HASH_TCP_IPV4] = PKT_HASH_TYPE_L4, ++ [IGC_RSS_TYPE_HASH_IPV4] = PKT_HASH_TYPE_L3, ++ [IGC_RSS_TYPE_HASH_TCP_IPV6] = PKT_HASH_TYPE_L4, ++ [IGC_RSS_TYPE_HASH_IPV6_EX] = PKT_HASH_TYPE_L3, ++ [IGC_RSS_TYPE_HASH_IPV6] = PKT_HASH_TYPE_L3, ++ [IGC_RSS_TYPE_HASH_TCP_IPV6_EX] = PKT_HASH_TYPE_L4, ++ [IGC_RSS_TYPE_HASH_UDP_IPV4] = PKT_HASH_TYPE_L4, ++ [IGC_RSS_TYPE_HASH_UDP_IPV6] = PKT_HASH_TYPE_L4, ++ [IGC_RSS_TYPE_HASH_UDP_IPV6_EX] = PKT_HASH_TYPE_L4, ++ [10] = PKT_HASH_TYPE_NONE, /* RSS Type above 9 "Reserved" by HW */ ++ [11] = PKT_HASH_TYPE_NONE, /* keep array sized for SW bit-mask */ ++ [12] = PKT_HASH_TYPE_NONE, /* to handle future HW revisons */ ++ [13] = PKT_HASH_TYPE_NONE, ++ [14] = PKT_HASH_TYPE_NONE, ++ [15] = PKT_HASH_TYPE_NONE, ++}; ++ + static inline void igc_rx_hash(struct igc_ring *ring, + union igc_adv_rx_desc *rx_desc, + struct sk_buff *skb) + { +- if (ring->netdev->features & NETIF_F_RXHASH) +- skb_set_hash(skb, +- le32_to_cpu(rx_desc->wb.lower.hi_dword.rss), +- PKT_HASH_TYPE_L3); ++ if (ring->netdev->features & NETIF_F_RXHASH) { ++ u32 rss_hash = le32_to_cpu(rx_desc->wb.lower.hi_dword.rss); ++ u32 rss_type = igc_rss_type(rx_desc); ++ ++ skb_set_hash(skb, rss_hash, igc_rss_type_table[rss_type]); ++ } + } + + static void igc_rx_vlan(struct igc_ring *rx_ring, +@@ -6525,6 +6547,7 @@ static int igc_probe(struct pci_dev *pdev, + netdev->features |= NETIF_F_TSO; + netdev->features |= NETIF_F_TSO6; + netdev->features |= NETIF_F_TSO_ECN; ++ netdev->features |= NETIF_F_RXHASH; + netdev->features |= NETIF_F_RXCSUM; + netdev->features |= NETIF_F_HW_CSUM; + netdev->features |= NETIF_F_SCTP_CRC; +-- +2.39.2 + diff --git a/queue-5.15/igc-fix-race-condition-in-ptp-tx-code.patch b/queue-5.15/igc-fix-race-condition-in-ptp-tx-code.patch new file mode 100644 index 00000000000..d5c82504ba0 --- /dev/null +++ b/queue-5.15/igc-fix-race-condition-in-ptp-tx-code.patch @@ -0,0 +1,237 @@ +From 9659ea486a0f81d55be3027fe053519c844f5a04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jun 2023 14:32:29 -0700 +Subject: igc: Fix race condition in PTP tx code + +From: Vinicius Costa Gomes + +[ Upstream commit 9c50e2b150c8ee0eee5f8154e2ad168cdd748877 ] + +Currently, the igc driver supports timestamping only one tx packet at a +time. During the transmission flow, the skb that requires hardware +timestamping is saved in adapter->ptp_tx_skb. Once hardware has the +timestamp, an interrupt is delivered, and adapter->ptp_tx_work is +scheduled. In igc_ptp_tx_work(), we read the timestamp register, update +adapter->ptp_tx_skb, and notify the network stack. + +While the thread executing the transmission flow (the user process +running in kernel mode) and the thread executing ptp_tx_work don't +access adapter->ptp_tx_skb concurrently, there are two other places +where adapter->ptp_tx_skb is accessed: igc_ptp_tx_hang() and +igc_ptp_suspend(). + +igc_ptp_tx_hang() is executed by the adapter->watchdog_task worker +thread which runs periodically so it is possible we have two threads +accessing ptp_tx_skb at the same time. Consider the following scenario: +right after __IGC_PTP_TX_IN_PROGRESS is set in igc_xmit_frame_ring(), +igc_ptp_tx_hang() is executed. Since adapter->ptp_tx_start hasn't been +written yet, this is considered a timeout and adapter->ptp_tx_skb is +cleaned up. + +This patch fixes the issue described above by adding the ptp_tx_lock to +protect access to ptp_tx_skb and ptp_tx_start fields from igc_adapter. +Since igc_xmit_frame_ring() called in atomic context by the networking +stack, ptp_tx_lock is defined as a spinlock, and the irq safe variants +of lock/unlock are used. + +With the introduction of the ptp_tx_lock, the __IGC_PTP_TX_IN_PROGRESS +flag doesn't provide much of a use anymore so this patch gets rid of it. + +Fixes: 2c344ae24501 ("igc: Add support for TX timestamping") +Signed-off-by: Andre Guedes +Signed-off-by: Vinicius Costa Gomes +Reviewed-by: Kurt Kanzenbach +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc.h | 5 +- + drivers/net/ethernet/intel/igc/igc_main.c | 9 ++-- + drivers/net/ethernet/intel/igc/igc_ptp.c | 57 ++++++++++++----------- + 3 files changed, 41 insertions(+), 30 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h +index 486e1ce609cd5..192fee9e72b05 100644 +--- a/drivers/net/ethernet/intel/igc/igc.h ++++ b/drivers/net/ethernet/intel/igc/igc.h +@@ -228,6 +228,10 @@ struct igc_adapter { + struct ptp_clock *ptp_clock; + struct ptp_clock_info ptp_caps; + struct work_struct ptp_tx_work; ++ /* Access to ptp_tx_skb and ptp_tx_start are protected by the ++ * ptp_tx_lock. ++ */ ++ spinlock_t ptp_tx_lock; + struct sk_buff *ptp_tx_skb; + struct hwtstamp_config tstamp_config; + unsigned long ptp_tx_start; +@@ -430,7 +434,6 @@ enum igc_state_t { + __IGC_TESTING, + __IGC_RESETTING, + __IGC_DOWN, +- __IGC_PTP_TX_IN_PROGRESS, + }; + + enum igc_tx_flags { +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index 32e4ebac4b693..abc63ca9d28bf 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -1576,9 +1576,10 @@ static netdev_tx_t igc_xmit_frame_ring(struct sk_buff *skb, + * the other timer registers before skipping the + * timestamping request. + */ +- if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON && +- !test_and_set_bit_lock(__IGC_PTP_TX_IN_PROGRESS, +- &adapter->state)) { ++ unsigned long flags; ++ ++ spin_lock_irqsave(&adapter->ptp_tx_lock, flags); ++ if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON && !adapter->ptp_tx_skb) { + skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; + tx_flags |= IGC_TX_FLAGS_TSTAMP; + +@@ -1587,6 +1588,8 @@ static netdev_tx_t igc_xmit_frame_ring(struct sk_buff *skb, + } else { + adapter->tx_hwtstamp_skipped++; + } ++ ++ spin_unlock_irqrestore(&adapter->ptp_tx_lock, flags); + } + + if (skb_vlan_tag_present(skb)) { +diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c +index 743c31659709b..6803d91cf71cd 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ptp.c ++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c +@@ -608,6 +608,7 @@ static int igc_ptp_set_timestamp_mode(struct igc_adapter *adapter, + return 0; + } + ++/* Requires adapter->ptp_tx_lock held by caller. */ + static void igc_ptp_tx_timeout(struct igc_adapter *adapter) + { + struct igc_hw *hw = &adapter->hw; +@@ -615,7 +616,6 @@ static void igc_ptp_tx_timeout(struct igc_adapter *adapter) + dev_kfree_skb_any(adapter->ptp_tx_skb); + adapter->ptp_tx_skb = NULL; + adapter->tx_hwtstamp_timeouts++; +- clear_bit_unlock(__IGC_PTP_TX_IN_PROGRESS, &adapter->state); + /* Clear the tx valid bit in TSYNCTXCTL register to enable interrupt. */ + rd32(IGC_TXSTMPH); + netdev_warn(adapter->netdev, "Tx timestamp timeout\n"); +@@ -623,20 +623,20 @@ static void igc_ptp_tx_timeout(struct igc_adapter *adapter) + + void igc_ptp_tx_hang(struct igc_adapter *adapter) + { +- bool timeout = time_is_before_jiffies(adapter->ptp_tx_start + +- IGC_PTP_TX_TIMEOUT); ++ unsigned long flags; + +- if (!test_bit(__IGC_PTP_TX_IN_PROGRESS, &adapter->state)) +- return; ++ spin_lock_irqsave(&adapter->ptp_tx_lock, flags); + +- /* If we haven't received a timestamp within the timeout, it is +- * reasonable to assume that it will never occur, so we can unlock the +- * timestamp bit when this occurs. +- */ +- if (timeout) { +- cancel_work_sync(&adapter->ptp_tx_work); +- igc_ptp_tx_timeout(adapter); +- } ++ if (!adapter->ptp_tx_skb) ++ goto unlock; ++ ++ if (time_is_after_jiffies(adapter->ptp_tx_start + IGC_PTP_TX_TIMEOUT)) ++ goto unlock; ++ ++ igc_ptp_tx_timeout(adapter); ++ ++unlock: ++ spin_unlock_irqrestore(&adapter->ptp_tx_lock, flags); + } + + /** +@@ -646,6 +646,8 @@ void igc_ptp_tx_hang(struct igc_adapter *adapter) + * If we were asked to do hardware stamping and such a time stamp is + * available, then it must have been for this skb here because we only + * allow only one such packet into the queue. ++ * ++ * Context: Expects adapter->ptp_tx_lock to be held by caller. + */ + static void igc_ptp_tx_hwtstamp(struct igc_adapter *adapter) + { +@@ -681,13 +683,7 @@ static void igc_ptp_tx_hwtstamp(struct igc_adapter *adapter) + shhwtstamps.hwtstamp = + ktime_add_ns(shhwtstamps.hwtstamp, adjust); + +- /* Clear the lock early before calling skb_tstamp_tx so that +- * applications are not woken up before the lock bit is clear. We use +- * a copy of the skb pointer to ensure other threads can't change it +- * while we're notifying the stack. +- */ + adapter->ptp_tx_skb = NULL; +- clear_bit_unlock(__IGC_PTP_TX_IN_PROGRESS, &adapter->state); + + /* Notify the stack and free the skb after we've unlocked */ + skb_tstamp_tx(skb, &shhwtstamps); +@@ -698,24 +694,33 @@ static void igc_ptp_tx_hwtstamp(struct igc_adapter *adapter) + * igc_ptp_tx_work + * @work: pointer to work struct + * +- * This work function polls the TSYNCTXCTL valid bit to determine when a +- * timestamp has been taken for the current stored skb. ++ * This work function checks the TSYNCTXCTL valid bit to determine when ++ * a timestamp has been taken for the current stored skb. + */ + static void igc_ptp_tx_work(struct work_struct *work) + { + struct igc_adapter *adapter = container_of(work, struct igc_adapter, + ptp_tx_work); + struct igc_hw *hw = &adapter->hw; ++ unsigned long flags; + u32 tsynctxctl; + +- if (!test_bit(__IGC_PTP_TX_IN_PROGRESS, &adapter->state)) +- return; ++ spin_lock_irqsave(&adapter->ptp_tx_lock, flags); ++ ++ if (!adapter->ptp_tx_skb) ++ goto unlock; + + tsynctxctl = rd32(IGC_TSYNCTXCTL); +- if (WARN_ON_ONCE(!(tsynctxctl & IGC_TSYNCTXCTL_TXTT_0))) +- return; ++ tsynctxctl &= IGC_TSYNCTXCTL_TXTT_0; ++ if (!tsynctxctl) { ++ WARN_ONCE(1, "Received a TSTAMP interrupt but no TSTAMP is ready.\n"); ++ goto unlock; ++ } + + igc_ptp_tx_hwtstamp(adapter); ++ ++unlock: ++ spin_unlock_irqrestore(&adapter->ptp_tx_lock, flags); + } + + /** +@@ -964,6 +969,7 @@ void igc_ptp_init(struct igc_adapter *adapter) + return; + } + ++ spin_lock_init(&adapter->ptp_tx_lock); + spin_lock_init(&adapter->tmreg_lock); + INIT_WORK(&adapter->ptp_tx_work, igc_ptp_tx_work); + +@@ -1028,7 +1034,6 @@ void igc_ptp_suspend(struct igc_adapter *adapter) + cancel_work_sync(&adapter->ptp_tx_work); + dev_kfree_skb_any(adapter->ptp_tx_skb); + adapter->ptp_tx_skb = NULL; +- clear_bit_unlock(__IGC_PTP_TX_IN_PROGRESS, &adapter->state); + + if (pci_device_is_present(adapter->pdev)) { + igc_ptp_time_save(adapter); +-- +2.39.2 + diff --git a/queue-5.15/ima-fix-build-warnings.patch b/queue-5.15/ima-fix-build-warnings.patch new file mode 100644 index 00000000000..ce7b09d9b85 --- /dev/null +++ b/queue-5.15/ima-fix-build-warnings.patch @@ -0,0 +1,61 @@ +From 42b55040b5bb49a5b44cbe88e613f53e1741adc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 09:41:13 +0200 +Subject: ima: Fix build warnings + +From: Roberto Sassu + +[ Upstream commit 95526d13038c2bbddd567a4d8e39fac42484e182 ] + +Fix build warnings (function parameters description) for +ima_collect_modsig(), ima_match_policy() and ima_parse_add_rule(). + +Fixes: 15588227e086 ("ima: Collect modsig") # v5.4+ +Fixes: 2fe5d6def167 ("ima: integrity appraisal extension") # v5.14+ +Fixes: 4af4662fa4a9 ("integrity: IMA policy") # v3.2+ +Signed-off-by: Roberto Sassu +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/ima_modsig.c | 3 +++ + security/integrity/ima/ima_policy.c | 3 ++- + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/security/integrity/ima/ima_modsig.c b/security/integrity/ima/ima_modsig.c +index fb25723c65bc4..3e7bee30080f2 100644 +--- a/security/integrity/ima/ima_modsig.c ++++ b/security/integrity/ima/ima_modsig.c +@@ -89,6 +89,9 @@ int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len, + + /** + * ima_collect_modsig - Calculate the file hash without the appended signature. ++ * @modsig: parsed module signature ++ * @buf: data to verify the signature on ++ * @size: data size + * + * Since the modsig is part of the file contents, the hash used in its signature + * isn't the same one ordinarily calculated by IMA. Therefore PKCS7 code +diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c +index ed43d30682ff8..7e41917e1f767 100644 +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -674,6 +674,7 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func) + * @secid: LSM secid of the task to be validated + * @func: IMA hook identifier + * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) ++ * @flags: IMA actions to consider (e.g. IMA_MEASURE | IMA_APPRAISE) + * @pcr: set the pcr to extend + * @template_desc: the template that should be used for this rule + * @func_data: func specific data, may be NULL +@@ -1709,7 +1710,7 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) + + /** + * ima_parse_add_rule - add a rule to ima_policy_rules +- * @rule - ima measurement policy rule ++ * @rule: ima measurement policy rule + * + * Avoid locking by allowing just one writer at a time in ima_write_policy() + * Returns the length of the rule parsed, an error code on failure +-- +2.39.2 + diff --git a/queue-5.15/input-adxl34x-do-not-hardcode-interrupt-trigger-type.patch b/queue-5.15/input-adxl34x-do-not-hardcode-interrupt-trigger-type.patch new file mode 100644 index 00000000000..3a7fc112da7 --- /dev/null +++ b/queue-5.15/input-adxl34x-do-not-hardcode-interrupt-trigger-type.patch @@ -0,0 +1,39 @@ +From 6bf838d72d2c6454df322f00d0e3d53b62d0ad25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 May 2023 17:27:55 -0700 +Subject: Input: adxl34x - do not hardcode interrupt trigger type + +From: Marek Vasut + +[ Upstream commit e96220bce5176ed2309f77f061dcc0430b82b25e ] + +Instead of hardcoding IRQ trigger type to IRQF_TRIGGER_HIGH, let's +respect the settings specified in the firmware description. + +Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers") +Signed-off-by: Marek Vasut +Acked-by: Michael Hennerich +Link: https://lore.kernel.org/r/20230509203555.549158-1-marex@denx.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/misc/adxl34x.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c +index 4cc4e8ff42b33..ad035c342cd3b 100644 +--- a/drivers/input/misc/adxl34x.c ++++ b/drivers/input/misc/adxl34x.c +@@ -811,8 +811,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq, + AC_WRITE(ac, POWER_CTL, 0); + + err = request_threaded_irq(ac->irq, NULL, adxl34x_irq, +- IRQF_TRIGGER_HIGH | IRQF_ONESHOT, +- dev_name(dev), ac); ++ IRQF_ONESHOT, dev_name(dev), ac); + if (err) { + dev_err(dev, "irq %d busy?\n", ac->irq); + goto err_free_mem; +-- +2.39.2 + diff --git a/queue-5.15/input-drv260x-sleep-between-polling-go-bit.patch b/queue-5.15/input-drv260x-sleep-between-polling-go-bit.patch new file mode 100644 index 00000000000..e6f4c3c1c67 --- /dev/null +++ b/queue-5.15/input-drv260x-sleep-between-polling-go-bit.patch @@ -0,0 +1,39 @@ +From cde807bd701e0166e52e421f038a05c90defd25c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 May 2023 17:01:45 -0700 +Subject: Input: drv260x - sleep between polling GO bit + +From: Luca Weiss + +[ Upstream commit efef661dfa6bf8cbafe4cd6a97433fcef0118967 ] + +When doing the initial startup there's no need to poll without any +delay and spam the I2C bus. + +Let's sleep 15ms between each attempt, which is the same time as used +in the vendor driver. + +Fixes: 7132fe4f5687 ("Input: drv260x - add TI drv260x haptics driver") +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20230430-drv260x-improvements-v1-2-1fb28b4cc698@z3ntu.xyz +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/misc/drv260x.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/misc/drv260x.c b/drivers/input/misc/drv260x.c +index 0efe56f49aa94..1923924fdd444 100644 +--- a/drivers/input/misc/drv260x.c ++++ b/drivers/input/misc/drv260x.c +@@ -435,6 +435,7 @@ static int drv260x_init(struct drv260x_data *haptics) + } + + do { ++ usleep_range(15000, 15500); + error = regmap_read(haptics->regmap, DRV260X_GO, &cal_buf); + if (error) { + dev_err(&haptics->client->dev, +-- +2.39.2 + diff --git a/queue-5.15/ipvlan-fix-return-value-of-ipvlan_queue_xmit.patch b/queue-5.15/ipvlan-fix-return-value-of-ipvlan_queue_xmit.patch new file mode 100644 index 00000000000..2f8683018c2 --- /dev/null +++ b/queue-5.15/ipvlan-fix-return-value-of-ipvlan_queue_xmit.patch @@ -0,0 +1,66 @@ +From 145c991fe76cbe53583a2a524aaeb2d0fd5b2354 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 17:33:47 +0800 +Subject: ipvlan: Fix return value of ipvlan_queue_xmit() + +From: Cambda Zhu + +[ Upstream commit 8a9922e7be6d042fa00f894c376473b17a162b66 ] + +ipvlan_queue_xmit() should return NET_XMIT_XXX, but +ipvlan_xmit_mode_l2/l3() returns rx_handler_result_t or NET_RX_XXX +in some cases. ipvlan_rcv_frame() will only return RX_HANDLER_CONSUMED +in ipvlan_xmit_mode_l2/l3() because 'local' is true. It's equal to +NET_XMIT_SUCCESS. But dev_forward_skb() can return NET_RX_SUCCESS or +NET_RX_DROP, and returning NET_RX_DROP(NET_XMIT_DROP) will increase +both ipvlan and ipvlan->phy_dev drops counter. + +The skb to forward can be treated as xmitted successfully. This patch +makes ipvlan_queue_xmit() return NET_XMIT_SUCCESS for forward skb. + +Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") +Signed-off-by: Cambda Zhu +Link: https://lore.kernel.org/r/20230626093347.7492-1-cambda@linux.alibaba.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ipvlan/ipvlan_core.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c +index 1f5125698e83a..e10cb98b0f4f5 100644 +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -586,7 +586,8 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev) + consume_skb(skb); + return NET_XMIT_DROP; + } +- return ipvlan_rcv_frame(addr, &skb, true); ++ ipvlan_rcv_frame(addr, &skb, true); ++ return NET_XMIT_SUCCESS; + } + } + out: +@@ -612,7 +613,8 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev) + consume_skb(skb); + return NET_XMIT_DROP; + } +- return ipvlan_rcv_frame(addr, &skb, true); ++ ipvlan_rcv_frame(addr, &skb, true); ++ return NET_XMIT_SUCCESS; + } + } + skb = skb_share_check(skb, GFP_ATOMIC); +@@ -624,7 +626,8 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev) + * the skb for the main-dev. At the RX side we just return + * RX_PASS for it to be processed further on the stack. + */ +- return dev_forward_skb(ipvlan->phy_dev, skb); ++ dev_forward_skb(ipvlan->phy_dev, skb); ++ return NET_XMIT_SUCCESS; + + } else if (is_multicast_ether_addr(eth->h_dest)) { + skb_reset_mac_header(skb); +-- +2.39.2 + diff --git a/queue-5.15/irqchip-jcore-aic-fix-missing-allocation-of-irq-desc.patch b/queue-5.15/irqchip-jcore-aic-fix-missing-allocation-of-irq-desc.patch new file mode 100644 index 00000000000..e1fa81aa015 --- /dev/null +++ b/queue-5.15/irqchip-jcore-aic-fix-missing-allocation-of-irq-desc.patch @@ -0,0 +1,53 @@ +From e4a28ac474170444a47d17ff825a8e5244282016 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 May 2023 18:33:42 +0200 +Subject: irqchip/jcore-aic: Fix missing allocation of IRQ descriptors + +From: John Paul Adrian Glaubitz + +[ Upstream commit 4848229494a323eeaab62eee5574ef9f7de80374 ] + +The initialization function for the J-Core AIC aic_irq_of_init() is +currently missing the call to irq_alloc_descs() which allocates and +initializes all the IRQ descriptors. Add missing function call and +return the error code from irq_alloc_descs() in case the allocation +fails. + +Fixes: 981b58f66cfc ("irqchip/jcore-aic: Add J-Core AIC driver") +Signed-off-by: John Paul Adrian Glaubitz +Tested-by: Rob Landley +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230510163343.43090-1-glaubitz@physik.fu-berlin.de +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-jcore-aic.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/irqchip/irq-jcore-aic.c b/drivers/irqchip/irq-jcore-aic.c +index 5f47d8ee4ae39..b9dcc8e78c750 100644 +--- a/drivers/irqchip/irq-jcore-aic.c ++++ b/drivers/irqchip/irq-jcore-aic.c +@@ -68,6 +68,7 @@ static int __init aic_irq_of_init(struct device_node *node, + unsigned min_irq = JCORE_AIC2_MIN_HWIRQ; + unsigned dom_sz = JCORE_AIC_MAX_HWIRQ+1; + struct irq_domain *domain; ++ int ret; + + pr_info("Initializing J-Core AIC\n"); + +@@ -100,6 +101,12 @@ static int __init aic_irq_of_init(struct device_node *node, + jcore_aic.irq_unmask = noop; + jcore_aic.name = "AIC"; + ++ ret = irq_alloc_descs(-1, min_irq, dom_sz - min_irq, ++ of_node_to_nid(node)); ++ ++ if (ret < 0) ++ return ret; ++ + domain = irq_domain_add_legacy(node, dom_sz - min_irq, min_irq, min_irq, + &jcore_aic_irqdomain_ops, + &jcore_aic); +-- +2.39.2 + diff --git a/queue-5.15/iwlwifi-don-t-dump_stack-when-we-get-an-unexpected-i.patch b/queue-5.15/iwlwifi-don-t-dump_stack-when-we-get-an-unexpected-i.patch new file mode 100644 index 00000000000..245e9939491 --- /dev/null +++ b/queue-5.15/iwlwifi-don-t-dump_stack-when-we-get-an-unexpected-i.patch @@ -0,0 +1,47 @@ +From 92d6edaa19775905e4d58996ebef775c37c589f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Feb 2022 11:21:32 +0200 +Subject: iwlwifi: don't dump_stack() when we get an unexpected interrupt + +From: Emmanuel Grumbach + +[ Upstream commit 91ca9c3ade1be665f5ce88594ee687c56b0357d5 ] + +It is yet unclear if the WARNING really points to a real problem, +but for sure the stack dump doesn't help fixing it. +Just use a regular error print instead. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20220205112029.a79e733a12f7.I8189344294222be0589fa43cc70fdf38e3057045@changeid +Signed-off-by: Luca Coelho +Stable-dep-of: 1902f1953b8b ("wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler()") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +index fea89330f692c..8885b19fd8de6 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -1608,10 +1608,13 @@ irqreturn_t iwl_pcie_irq_rx_msix_handler(int irq, void *dev_id) + if (WARN_ON(entry->entry >= trans->num_rx_queues)) + return IRQ_NONE; + +- if (WARN_ONCE(!rxq, +- "[%d] Got MSI-X interrupt before we have Rx queues", +- entry->entry)) ++ if (!rxq) { ++ if (net_ratelimit()) ++ IWL_ERR(trans, ++ "[%d] Got MSI-X interrupt before we have Rx queues\n", ++ entry->entry); + return IRQ_NONE; ++ } + + lock_map_acquire(&trans->sync_cmd_lockdep_map); + IWL_DEBUG_ISR(trans, "[%d] Got interrupt\n", entry->entry); +-- +2.39.2 + diff --git a/queue-5.15/kbuild-disable-gcov-for-.mod.o.patch b/queue-5.15/kbuild-disable-gcov-for-.mod.o.patch new file mode 100644 index 00000000000..7cdf0587508 --- /dev/null +++ b/queue-5.15/kbuild-disable-gcov-for-.mod.o.patch @@ -0,0 +1,50 @@ +From ba169503f42e53f242cd01dde442e2d1a730f133 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 00:11:43 +0000 +Subject: kbuild: Disable GCOV for *.mod.o + +From: Sami Tolvanen + +[ Upstream commit 25a21fbb934a0d989e1858f83c2ddf4cfb2ebe30 ] + +With GCOV_PROFILE_ALL, Clang injects __llvm_gcov_* functions to each +object file, including the *.mod.o. As we filter out CC_FLAGS_CFI +for *.mod.o, the compiler won't generate type hashes for the +injected functions, and therefore indirectly calling them during +module loading trips indirect call checking. + +Enabling CFI for *.mod.o isn't sufficient to fix this issue after +commit 0c3e806ec0f9 ("x86/cfi: Add boot time hash randomization"), +as *.mod.o aren't processed by objtool, which means any hashes +emitted there won't be randomized. Therefore, in addition to +disabling CFI for *.mod.o, also disable GCOV, as the object files +don't otherwise contain any executable code. + +Fixes: cf68fffb66d6 ("add support for Clang CFI") +Reported-by: Joe Fradley +Signed-off-by: Sami Tolvanen +Acked-by: Peter Zijlstra (Intel) +Reviewed-by: Kees Cook +Reviewed-by: Nick Desaulniers +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/Makefile.modfinal | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/Makefile.modfinal b/scripts/Makefile.modfinal +index ce9661d968a3d..47f047458264f 100644 +--- a/scripts/Makefile.modfinal ++++ b/scripts/Makefile.modfinal +@@ -23,7 +23,7 @@ modname = $(notdir $(@:.mod.o=)) + part-of-module = y + + quiet_cmd_cc_o_c = CC [M] $@ +- cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI), $(c_flags)) -c -o $@ $< ++ cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV), $(c_flags)) -c -o $@ $< + + %.mod.o: %.mod.c FORCE + $(call if_changed_dep,cc_o_c) +-- +2.39.2 + diff --git a/queue-5.15/kcsan-don-t-expect-64-bits-atomic-builtins-from-32-b.patch b/queue-5.15/kcsan-don-t-expect-64-bits-atomic-builtins-from-32-b.patch new file mode 100644 index 00000000000..3bf115e10be --- /dev/null +++ b/queue-5.15/kcsan-don-t-expect-64-bits-atomic-builtins-from-32-b.patch @@ -0,0 +1,71 @@ +From da74e931f0c7aa3acbc530e00affc7c8acbe728f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 17:31:17 +0200 +Subject: kcsan: Don't expect 64 bits atomic builtins from 32 bits + architectures + +From: Christophe Leroy + +[ Upstream commit 353e7300a1db928e427462f2745f9a2cd1625b3d ] + +Activating KCSAN on a 32 bits architecture leads to the following +link-time failure: + + LD .tmp_vmlinux.kallsyms1 + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_load': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_load_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_store': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_store_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_exchange': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_exchange_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_add': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_add_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_sub': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_sub_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_and': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_and_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_or': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_or_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_xor': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_xor_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_fetch_nand': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_fetch_nand_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_compare_exchange_strong': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_compare_exchange_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_compare_exchange_weak': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_compare_exchange_8' + powerpc64-linux-ld: kernel/kcsan/core.o: in function `__tsan_atomic64_compare_exchange_val': + kernel/kcsan/core.c:1273: undefined reference to `__atomic_compare_exchange_8' + +32 bits architectures don't have 64 bits atomic builtins. Only +include DEFINE_TSAN_ATOMIC_OPS(64) on 64 bits architectures. + +Fixes: 0f8ad5f2e934 ("kcsan: Add support for atomic builtins") +Suggested-by: Marco Elver +Signed-off-by: Christophe Leroy +Reviewed-by: Marco Elver +Acked-by: Marco Elver +Signed-off-by: Michael Ellerman +Link: https://msgid.link/d9c6afc28d0855240171a4e0ad9ffcdb9d07fceb.1683892665.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + kernel/kcsan/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/kcsan/core.c b/kernel/kcsan/core.c +index 526510b3791ed..3f3b5e3ca9eb3 100644 +--- a/kernel/kcsan/core.c ++++ b/kernel/kcsan/core.c +@@ -1050,7 +1050,9 @@ EXPORT_SYMBOL(__tsan_init); + DEFINE_TSAN_ATOMIC_OPS(8); + DEFINE_TSAN_ATOMIC_OPS(16); + DEFINE_TSAN_ATOMIC_OPS(32); ++#ifdef CONFIG_64BIT + DEFINE_TSAN_ATOMIC_OPS(64); ++#endif + + void __tsan_atomic_thread_fence(int memorder); + void __tsan_atomic_thread_fence(int memorder) +-- +2.39.2 + diff --git a/queue-5.15/kexec-fix-a-memory-leak-in-crash_shrink_memory.patch b/queue-5.15/kexec-fix-a-memory-leak-in-crash_shrink_memory.patch new file mode 100644 index 00000000000..4e4f35bdd8c --- /dev/null +++ b/queue-5.15/kexec-fix-a-memory-leak-in-crash_shrink_memory.patch @@ -0,0 +1,93 @@ +From 7c25b38354bedede3bb8447bca2e3fdf5e37c134 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 May 2023 20:34:34 +0800 +Subject: kexec: fix a memory leak in crash_shrink_memory() + +From: Zhen Lei + +[ Upstream commit 1cba6c4309f03de570202c46f03df3f73a0d4c82 ] + +Patch series "kexec: enable kexec_crash_size to support two crash kernel +regions". + +When crashkernel=X fails to reserve region under 4G, it will fall back to +reserve region above 4G and a region of the default size will also be +reserved under 4G. Unfortunately, /sys/kernel/kexec_crash_size only +supports one crash kernel region now, the user cannot sense the low memory +reserved by reading /sys/kernel/kexec_crash_size. Also, low memory cannot +be freed by writing this file. + +For example: +resource_size(crashk_res) = 512M +resource_size(crashk_low_res) = 256M + +The result of 'cat /sys/kernel/kexec_crash_size' is 512M, but it should be +768M. When we execute 'echo 0 > /sys/kernel/kexec_crash_size', the size +of crashk_res becomes 0 and resource_size(crashk_low_res) is still 256 MB, +which is incorrect. + +Since crashk_res manages the memory with high address and crashk_low_res +manages the memory with low address, crashk_low_res is shrunken only when +all crashk_res is shrunken. And because when there is only one crash +kernel region, crashk_res is always used. Therefore, if all crashk_res is +shrunken and crashk_low_res still exists, swap them. + +This patch (of 6): + +If the value of parameter 'new_size' is in the semi-open and semi-closed +interval (crashk_res.end - KEXEC_CRASH_MEM_ALIGN + 1, crashk_res.end], the +calculation result of ram_res is: + + ram_res->start = crashk_res.end + 1 + ram_res->end = crashk_res.end + +The operation of insert_resource() fails, and ram_res is not added to +iomem_resource. As a result, the memory of the control block ram_res is +leaked. + +In fact, on all architectures, the start address and size of crashk_res +are already aligned by KEXEC_CRASH_MEM_ALIGN. Therefore, we do not need +to round up crashk_res.start again. Instead, we should round up +'new_size' in advance. + +Link: https://lkml.kernel.org/r/20230527123439.772-1-thunder.leizhen@huawei.com +Link: https://lkml.kernel.org/r/20230527123439.772-2-thunder.leizhen@huawei.com +Fixes: 6480e5a09237 ("kdump: add missing RAM resource in crash_shrink_memory()") +Fixes: 06a7f711246b ("kexec: premit reduction of the reserved memory size") +Signed-off-by: Zhen Lei +Acked-by: Baoquan He +Cc: Cong Wang +Cc: Eric W. Biederman +Cc: Michael Holzheu +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + kernel/kexec_core.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c +index bdc2d952911ce..7e735fd338586 100644 +--- a/kernel/kexec_core.c ++++ b/kernel/kexec_core.c +@@ -1029,6 +1029,7 @@ int crash_shrink_memory(unsigned long new_size) + start = crashk_res.start; + end = crashk_res.end; + old_size = (end == 0) ? 0 : end - start + 1; ++ new_size = roundup(new_size, KEXEC_CRASH_MEM_ALIGN); + if (new_size >= old_size) { + ret = (new_size == old_size) ? 0 : -EINVAL; + goto unlock; +@@ -1040,9 +1041,7 @@ int crash_shrink_memory(unsigned long new_size) + goto unlock; + } + +- start = roundup(start, KEXEC_CRASH_MEM_ALIGN); +- end = roundup(start + new_size, KEXEC_CRASH_MEM_ALIGN); +- ++ end = start + new_size; + crash_free_reserved_phys_range(end, crashk_res.end); + + if ((start == end) && (crashk_res.parent != NULL)) +-- +2.39.2 + diff --git a/queue-5.15/kselftest-vdso-fix-accumulation-of-uninitialized-ret.patch b/queue-5.15/kselftest-vdso-fix-accumulation-of-uninitialized-ret.patch new file mode 100644 index 00000000000..66427993579 --- /dev/null +++ b/queue-5.15/kselftest-vdso-fix-accumulation-of-uninitialized-ret.patch @@ -0,0 +1,46 @@ +From 12e00d95875ce0305649757bf5a24106274d0f0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 11:47:43 +0100 +Subject: kselftest: vDSO: Fix accumulation of uninitialized ret when + CLOCK_REALTIME is undefined + +From: Colin Ian King + +[ Upstream commit 375b9ff53cb6f9c042817b75f2be0a650626dc4f ] + +In the unlikely case that CLOCK_REALTIME is not defined, variable ret is +not initialized and further accumulation of return values to ret can leave +ret in an undefined state. Fix this by initialized ret to zero and changing +the assignment of ret to an accumulation for the CLOCK_REALTIME case. + +Fixes: 03f55c7952c9 ("kselftest: Extend vDSO selftest to clock_getres") +Signed-off-by: Colin Ian King +Reviewed-by: Vincenzo Frascino +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vDSO/vdso_test_clock_getres.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/vDSO/vdso_test_clock_getres.c b/tools/testing/selftests/vDSO/vdso_test_clock_getres.c +index 15dcee16ff726..38d46a8bf7cba 100644 +--- a/tools/testing/selftests/vDSO/vdso_test_clock_getres.c ++++ b/tools/testing/selftests/vDSO/vdso_test_clock_getres.c +@@ -84,12 +84,12 @@ static inline int vdso_test_clock(unsigned int clock_id) + + int main(int argc, char **argv) + { +- int ret; ++ int ret = 0; + + #if _POSIX_TIMERS > 0 + + #ifdef CLOCK_REALTIME +- ret = vdso_test_clock(CLOCK_REALTIME); ++ ret += vdso_test_clock(CLOCK_REALTIME); + #endif + + #ifdef CLOCK_BOOTTIME +-- +2.39.2 + diff --git a/queue-5.15/ksmbd-avoid-field-overflow-warning.patch b/queue-5.15/ksmbd-avoid-field-overflow-warning.patch new file mode 100644 index 00000000000..5eb4c44fdab --- /dev/null +++ b/queue-5.15/ksmbd-avoid-field-overflow-warning.patch @@ -0,0 +1,47 @@ +From 57d7c3677108aaa9f8558d260fe6eb187c0a9a9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 10:19:38 +0200 +Subject: ksmbd: avoid field overflow warning + +From: Arnd Bergmann + +[ Upstream commit 9cedc58bdbe9fff9aacd0ca19ee5777659f28fd7 ] + +clang warns about a possible field overflow in a memcpy: + +In file included from fs/smb/server/smb_common.c:7: +include/linux/fortify-string.h:583:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] + __write_overflow_field(p_size_field, size); + +It appears to interpret the "&out[baselen + 4]" as referring to a single +byte of the character array, while the equivalen "out + baselen + 4" is +seen as an offset into the array. + +I don't see that kind of warning elsewhere, so just go with the simple +rework. + +Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") +Signed-off-by: Arnd Bergmann +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/ksmbd/smb_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ksmbd/smb_common.c b/fs/ksmbd/smb_common.c +index f034b75c6d7f4..af583e4266215 100644 +--- a/fs/ksmbd/smb_common.c ++++ b/fs/ksmbd/smb_common.c +@@ -423,7 +423,7 @@ int ksmbd_extract_shortname(struct ksmbd_conn *conn, const char *longname, + out[baselen + 3] = PERIOD; + + if (dot_present) +- memcpy(&out[baselen + 4], extension, 4); ++ memcpy(out + baselen + 4, extension, 4); + else + out[baselen + 4] = '\0'; + smbConvertToUTF16((__le16 *)shortname, out, PATH_MAX, +-- +2.39.2 + diff --git a/queue-5.15/lib-ts_bm-reset-initial-match-offset-for-every-block.patch b/queue-5.15/lib-ts_bm-reset-initial-match-offset-for-every-block.patch new file mode 100644 index 00000000000..87edc86b980 --- /dev/null +++ b/queue-5.15/lib-ts_bm-reset-initial-match-offset-for-every-block.patch @@ -0,0 +1,59 @@ +From 7843fe056119b6e4dfcdc92853e0ec768f5a1971 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 20:06:57 +0100 +Subject: lib/ts_bm: reset initial match offset for every block of text + +From: Jeremy Sowden + +[ Upstream commit 6f67fbf8192da80c4db01a1800c7fceaca9cf1f9 ] + +The `shift` variable which indicates the offset in the string at which +to start matching the pattern is initialized to `bm->patlen - 1`, but it +is not reset when a new block is retrieved. This means the implemen- +tation may start looking at later and later positions in each successive +block and miss occurrences of the pattern at the beginning. E.g., +consider a HTTP packet held in a non-linear skb, where the HTTP request +line occurs in the second block: + + [... 52 bytes of packet headers ...] + GET /bmtest HTTP/1.1\r\nHost: www.example.com\r\n\r\n + +and the pattern is "GET /bmtest". + +Once the first block comprising the packet headers has been examined, +`shift` will be pointing to somewhere near the end of the block, and so +when the second block is examined the request line at the beginning will +be missed. + +Reinitialize the variable for each new block. + +Fixes: 8082e4ed0a61 ("[LIB]: Boyer-Moore extension for textsearch infrastructure strike #2") +Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1390 +Signed-off-by: Jeremy Sowden +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + lib/ts_bm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/lib/ts_bm.c b/lib/ts_bm.c +index 4cf250031f0f0..352ae837e0317 100644 +--- a/lib/ts_bm.c ++++ b/lib/ts_bm.c +@@ -60,10 +60,12 @@ static unsigned int bm_find(struct ts_config *conf, struct ts_state *state) + struct ts_bm *bm = ts_config_priv(conf); + unsigned int i, text_len, consumed = state->offset; + const u8 *text; +- int shift = bm->patlen - 1, bs; ++ int bs; + const u8 icase = conf->flags & TS_IGNORECASE; + + for (;;) { ++ int shift = bm->patlen - 1; ++ + text_len = conf->get_next_block(consumed, &text, conf, state); + + if (unlikely(text_len == 0)) +-- +2.39.2 + diff --git a/queue-5.15/libbpf-btf_dump_type_data_check_overflow-needs-to-co.patch b/queue-5.15/libbpf-btf_dump_type_data_check_overflow-needs-to-co.patch new file mode 100644 index 00000000000..98a3366c93f --- /dev/null +++ b/queue-5.15/libbpf-btf_dump_type_data_check_overflow-needs-to-co.patch @@ -0,0 +1,120 @@ +From 962a4dad3907036ea3d949b437d08d44ea02718b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 18:36:38 -0700 +Subject: libbpf: btf_dump_type_data_check_overflow needs to consider + BTF_MEMBER_BITFIELD_SIZE + +From: Martin KaFai Lau + +[ Upstream commit c39028b333f3a3a765c5c0b9726b8e38aedf0ba1 ] + +The btf_dump/struct_data selftest is failing with: + + [...] + test_btf_dump_struct_data:FAIL:unexpected return value dumping fs_context unexpected unexpected return value dumping fs_context: actual -7 != expected 264 + [...] + +The reason is in btf_dump_type_data_check_overflow(). It does not use +BTF_MEMBER_BITFIELD_SIZE from the struct's member (btf_member). Instead, +it is using the enum size which is 4. It had been working till the recent +commit 4e04143c869c ("fs_context: drop the unused lsm_flags member") +removed an integer member which also removed the 4 bytes padding at the +end of the fs_context. Missing this 4 bytes padding exposed this bug. In +particular, when btf_dump_type_data_check_overflow() reaches the member +'phase', -E2BIG is returned. + +The fix is to pass bit_sz to btf_dump_type_data_check_overflow(). In +btf_dump_type_data_check_overflow(), it does a different size check when +bit_sz is not zero. + +The current fs_context: + +[3600] ENUM 'fs_context_purpose' encoding=UNSIGNED size=4 vlen=3 + 'FS_CONTEXT_FOR_MOUNT' val=0 + 'FS_CONTEXT_FOR_SUBMOUNT' val=1 + 'FS_CONTEXT_FOR_RECONFIGURE' val=2 +[3601] ENUM 'fs_context_phase' encoding=UNSIGNED size=4 vlen=7 + 'FS_CONTEXT_CREATE_PARAMS' val=0 + 'FS_CONTEXT_CREATING' val=1 + 'FS_CONTEXT_AWAITING_MOUNT' val=2 + 'FS_CONTEXT_AWAITING_RECONF' val=3 + 'FS_CONTEXT_RECONF_PARAMS' val=4 + 'FS_CONTEXT_RECONFIGURING' val=5 + 'FS_CONTEXT_FAILED' val=6 +[3602] STRUCT 'fs_context' size=264 vlen=21 + 'ops' type_id=3603 bits_offset=0 + 'uapi_mutex' type_id=235 bits_offset=64 + 'fs_type' type_id=872 bits_offset=1216 + 'fs_private' type_id=21 bits_offset=1280 + 'sget_key' type_id=21 bits_offset=1344 + 'root' type_id=781 bits_offset=1408 + 'user_ns' type_id=251 bits_offset=1472 + 'net_ns' type_id=984 bits_offset=1536 + 'cred' type_id=1785 bits_offset=1600 + 'log' type_id=3621 bits_offset=1664 + 'source' type_id=42 bits_offset=1792 + 'security' type_id=21 bits_offset=1856 + 's_fs_info' type_id=21 bits_offset=1920 + 'sb_flags' type_id=20 bits_offset=1984 + 'sb_flags_mask' type_id=20 bits_offset=2016 + 's_iflags' type_id=20 bits_offset=2048 + 'purpose' type_id=3600 bits_offset=2080 bitfield_size=8 + 'phase' type_id=3601 bits_offset=2088 bitfield_size=8 + 'need_free' type_id=67 bits_offset=2096 bitfield_size=1 + 'global' type_id=67 bits_offset=2097 bitfield_size=1 + 'oldapi' type_id=67 bits_offset=2098 bitfield_size=1 + +Fixes: 920d16af9b42 ("libbpf: BTF dumper support for typed data") +Signed-off-by: Martin KaFai Lau +Signed-off-by: Daniel Borkmann +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20230428013638.1581263-1-martin.lau@linux.dev +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf_dump.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index 98cb3831aa18c..b91dd7cd4ffb0 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -2126,9 +2126,25 @@ static int btf_dump_type_data_check_overflow(struct btf_dump *d, + const struct btf_type *t, + __u32 id, + const void *data, +- __u8 bits_offset) ++ __u8 bits_offset, ++ __u8 bit_sz) + { +- __s64 size = btf__resolve_size(d->btf, id); ++ __s64 size; ++ ++ if (bit_sz) { ++ /* bits_offset is at most 7. bit_sz is at most 128. */ ++ __u8 nr_bytes = (bits_offset + bit_sz + 7) / 8; ++ ++ /* When bit_sz is non zero, it is called from ++ * btf_dump_struct_data() where it only cares about ++ * negative error value. ++ * Return nr_bytes in success case to make it ++ * consistent as the regular integer case below. ++ */ ++ return data + nr_bytes > d->typed_dump->data_end ? -E2BIG : nr_bytes; ++ } ++ ++ size = btf__resolve_size(d->btf, id); + + if (size < 0 || size >= INT_MAX) { + pr_warn("unexpected size [%zu] for id [%u]\n", +@@ -2281,7 +2297,7 @@ static int btf_dump_dump_type_data(struct btf_dump *d, + { + int size, err = 0; + +- size = btf_dump_type_data_check_overflow(d, t, id, data, bits_offset); ++ size = btf_dump_type_data_check_overflow(d, t, id, data, bits_offset, bit_sz); + if (size < 0) + return size; + err = btf_dump_type_data_check_zero(d, t, id, data, bits_offset, bit_sz); +-- +2.39.2 + diff --git a/queue-5.15/libbpf-fix-offsetof-and-container_of-to-work-with-co.patch b/queue-5.15/libbpf-fix-offsetof-and-container_of-to-work-with-co.patch new file mode 100644 index 00000000000..a7d371b41ed --- /dev/null +++ b/queue-5.15/libbpf-fix-offsetof-and-container_of-to-work-with-co.patch @@ -0,0 +1,62 @@ +From c767c4c365b17bbae869e43652ae169263f2131d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 23:55:02 -0700 +Subject: libbpf: fix offsetof() and container_of() to work with CO-RE + +From: Andrii Nakryiko + +[ Upstream commit bdeeed3498c7871c17465bb4f11d1bc67f9098af ] + +It seems like __builtin_offset() doesn't preserve CO-RE field +relocations properly. So if offsetof() macro is defined through +__builtin_offset(), CO-RE-enabled BPF code using container_of() will be +subtly and silently broken. + +To avoid this problem, redefine offsetof() and container_of() in the +form that works with CO-RE relocations more reliably. + +Fixes: 5fbc220862fc ("tools/libpf: Add offsetof/container_of macro in bpf_helpers.h") +Reported-by: Lennart Poettering +Signed-off-by: Andrii Nakryiko +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20230509065502.2306180-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/bpf_helpers.h | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/tools/lib/bpf/bpf_helpers.h b/tools/lib/bpf/bpf_helpers.h +index b9987c3efa3c4..956b57d02eb9a 100644 +--- a/tools/lib/bpf/bpf_helpers.h ++++ b/tools/lib/bpf/bpf_helpers.h +@@ -72,16 +72,21 @@ + /* + * Helper macros to manipulate data structures + */ +-#ifndef offsetof +-#define offsetof(TYPE, MEMBER) ((unsigned long)&((TYPE *)0)->MEMBER) +-#endif +-#ifndef container_of ++ ++/* offsetof() definition that uses __builtin_offset() might not preserve field ++ * offset CO-RE relocation properly, so force-redefine offsetof() using ++ * old-school approach which works with CO-RE correctly ++ */ ++#undef offsetof ++#define offsetof(type, member) ((unsigned long)&((type *)0)->member) ++ ++/* redefined container_of() to ensure we use the above offsetof() macro */ ++#undef container_of + #define container_of(ptr, type, member) \ + ({ \ + void *__mptr = (void *)(ptr); \ + ((type *)(__mptr - offsetof(type, member))); \ + }) +-#endif + + /* + * Helper macro to throw a compilation error if __bpf_unreachable() gets +-- +2.39.2 + diff --git a/queue-5.15/locking-atomic-arm-fix-sync-ops.patch b/queue-5.15/locking-atomic-arm-fix-sync-ops.patch new file mode 100644 index 00000000000..3539f96291d --- /dev/null +++ b/queue-5.15/locking-atomic-arm-fix-sync-ops.patch @@ -0,0 +1,191 @@ +From 39c9eb0b4ad159882950ca96711a6da2036f8db0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 08:00:58 +0100 +Subject: locking/atomic: arm: fix sync ops + +From: Mark Rutland + +[ Upstream commit dda5f312bb09e56e7a1c3e3851f2000eb2e9c879 ] + +The sync_*() ops on arch/arm are defined in terms of the regular bitops +with no special handling. This is not correct, as UP kernels elide +barriers for the fully-ordered operations, and so the required ordering +is lost when such UP kernels are run under a hypervsior on an SMP +system. + +Fix this by defining sync ops with the required barriers. + +Note: On 32-bit arm, the sync_*() ops are currently only used by Xen, +which requires ARMv7, but the semantics can be implemented for ARMv6+. + +Fixes: e54d2f61528165bb ("xen/arm: sync_bitops") +Signed-off-by: Mark Rutland +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kees Cook +Link: https://lore.kernel.org/r/20230605070124.3741859-2-mark.rutland@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/assembler.h | 17 +++++++++++++++++ + arch/arm/include/asm/sync_bitops.h | 29 +++++++++++++++++++++++++---- + arch/arm/lib/bitops.h | 14 +++++++++++--- + arch/arm/lib/testchangebit.S | 4 ++++ + arch/arm/lib/testclearbit.S | 4 ++++ + arch/arm/lib/testsetbit.S | 4 ++++ + 6 files changed, 65 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h +index 09c241280ed9c..5d52da168ab3a 100644 +--- a/arch/arm/include/asm/assembler.h ++++ b/arch/arm/include/asm/assembler.h +@@ -326,6 +326,23 @@ + #endif + .endm + ++/* ++ * Raw SMP data memory barrier ++ */ ++ .macro __smp_dmb mode ++#if __LINUX_ARM_ARCH__ >= 7 ++ .ifeqs "\mode","arm" ++ dmb ish ++ .else ++ W(dmb) ish ++ .endif ++#elif __LINUX_ARM_ARCH__ == 6 ++ mcr p15, 0, r0, c7, c10, 5 @ dmb ++#else ++ .error "Incompatible SMP platform" ++#endif ++ .endm ++ + #if defined(CONFIG_CPU_V7M) + /* + * setmode is used to assert to be in svc mode during boot. For v7-M +diff --git a/arch/arm/include/asm/sync_bitops.h b/arch/arm/include/asm/sync_bitops.h +index 6f5d627c44a3c..f46b3c570f92e 100644 +--- a/arch/arm/include/asm/sync_bitops.h ++++ b/arch/arm/include/asm/sync_bitops.h +@@ -14,14 +14,35 @@ + * ops which are SMP safe even on a UP kernel. + */ + ++/* ++ * Unordered ++ */ ++ + #define sync_set_bit(nr, p) _set_bit(nr, p) + #define sync_clear_bit(nr, p) _clear_bit(nr, p) + #define sync_change_bit(nr, p) _change_bit(nr, p) +-#define sync_test_and_set_bit(nr, p) _test_and_set_bit(nr, p) +-#define sync_test_and_clear_bit(nr, p) _test_and_clear_bit(nr, p) +-#define sync_test_and_change_bit(nr, p) _test_and_change_bit(nr, p) + #define sync_test_bit(nr, addr) test_bit(nr, addr) +-#define arch_sync_cmpxchg arch_cmpxchg + ++/* ++ * Fully ordered ++ */ ++ ++int _sync_test_and_set_bit(int nr, volatile unsigned long * p); ++#define sync_test_and_set_bit(nr, p) _sync_test_and_set_bit(nr, p) ++ ++int _sync_test_and_clear_bit(int nr, volatile unsigned long * p); ++#define sync_test_and_clear_bit(nr, p) _sync_test_and_clear_bit(nr, p) ++ ++int _sync_test_and_change_bit(int nr, volatile unsigned long * p); ++#define sync_test_and_change_bit(nr, p) _sync_test_and_change_bit(nr, p) ++ ++#define arch_sync_cmpxchg(ptr, old, new) \ ++({ \ ++ __typeof__(*(ptr)) __ret; \ ++ __smp_mb__before_atomic(); \ ++ __ret = arch_cmpxchg_relaxed((ptr), (old), (new)); \ ++ __smp_mb__after_atomic(); \ ++ __ret; \ ++}) + + #endif +diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h +index 95bd359912889..f069d1b2318e6 100644 +--- a/arch/arm/lib/bitops.h ++++ b/arch/arm/lib/bitops.h +@@ -28,7 +28,7 @@ UNWIND( .fnend ) + ENDPROC(\name ) + .endm + +- .macro testop, name, instr, store ++ .macro __testop, name, instr, store, barrier + ENTRY( \name ) + UNWIND( .fnstart ) + ands ip, r1, #3 +@@ -38,7 +38,7 @@ UNWIND( .fnstart ) + mov r0, r0, lsr #5 + add r1, r1, r0, lsl #2 @ Get word offset + mov r3, r2, lsl r3 @ create mask +- smp_dmb ++ \barrier + #if __LINUX_ARM_ARCH__ >= 7 && defined(CONFIG_SMP) + .arch_extension mp + ALT_SMP(W(pldw) [r1]) +@@ -50,13 +50,21 @@ UNWIND( .fnstart ) + strex ip, r2, [r1] + cmp ip, #0 + bne 1b +- smp_dmb ++ \barrier + cmp r0, #0 + movne r0, #1 + 2: bx lr + UNWIND( .fnend ) + ENDPROC(\name ) + .endm ++ ++ .macro testop, name, instr, store ++ __testop \name, \instr, \store, smp_dmb ++ .endm ++ ++ .macro sync_testop, name, instr, store ++ __testop \name, \instr, \store, __smp_dmb ++ .endm + #else + .macro bitop, name, instr + ENTRY( \name ) +diff --git a/arch/arm/lib/testchangebit.S b/arch/arm/lib/testchangebit.S +index 4ebecc67e6e04..f13fe9bc2399a 100644 +--- a/arch/arm/lib/testchangebit.S ++++ b/arch/arm/lib/testchangebit.S +@@ -10,3 +10,7 @@ + .text + + testop _test_and_change_bit, eor, str ++ ++#if __LINUX_ARM_ARCH__ >= 6 ++sync_testop _sync_test_and_change_bit, eor, str ++#endif +diff --git a/arch/arm/lib/testclearbit.S b/arch/arm/lib/testclearbit.S +index 009afa0f5b4a7..4d2c5ca620ebf 100644 +--- a/arch/arm/lib/testclearbit.S ++++ b/arch/arm/lib/testclearbit.S +@@ -10,3 +10,7 @@ + .text + + testop _test_and_clear_bit, bicne, strne ++ ++#if __LINUX_ARM_ARCH__ >= 6 ++sync_testop _sync_test_and_clear_bit, bicne, strne ++#endif +diff --git a/arch/arm/lib/testsetbit.S b/arch/arm/lib/testsetbit.S +index f3192e55acc87..649dbab65d8d0 100644 +--- a/arch/arm/lib/testsetbit.S ++++ b/arch/arm/lib/testsetbit.S +@@ -10,3 +10,7 @@ + .text + + testop _test_and_set_bit, orreq, streq ++ ++#if __LINUX_ARM_ARCH__ >= 6 ++sync_testop _sync_test_and_set_bit, orreq, streq ++#endif +-- +2.39.2 + diff --git a/queue-5.15/md-raid10-check-slab-out-of-bounds-in-md_bitmap_get_.patch b/queue-5.15/md-raid10-check-slab-out-of-bounds-in-md_bitmap_get_.patch new file mode 100644 index 00000000000..380409dfb52 --- /dev/null +++ b/queue-5.15/md-raid10-check-slab-out-of-bounds-in-md_bitmap_get_.patch @@ -0,0 +1,65 @@ +From ee367a308d580a3c0f34a8205cc4b252d4b6954a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 21:48:05 +0800 +Subject: md/raid10: check slab-out-of-bounds in md_bitmap_get_counter + +From: Li Nan + +[ Upstream commit 301867b1c16805aebbc306aafa6ecdc68b73c7e5 ] + +If we write a large number to md/bitmap_set_bits, md_bitmap_checkpage() +will return -EINVAL because 'page >= bitmap->pages', but the return value +was not checked immediately in md_bitmap_get_counter() in order to set +*blocks value and slab-out-of-bounds occurs. + +Move check of 'page >= bitmap->pages' to md_bitmap_get_counter() and +return directly if true. + +Fixes: ef4256733506 ("md/bitmap: optimise scanning of empty bitmaps.") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230515134808.3936750-2-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index 062142559caa3..adada558a1b09 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -54,14 +54,7 @@ __acquires(bitmap->lock) + { + unsigned char *mappage; + +- if (page >= bitmap->pages) { +- /* This can happen if bitmap_start_sync goes beyond +- * End-of-device while looking for a whole page. +- * It is harmless. +- */ +- return -EINVAL; +- } +- ++ WARN_ON_ONCE(page >= bitmap->pages); + if (bitmap->bp[page].hijacked) /* it's hijacked, don't try to alloc */ + return 0; + +@@ -1365,6 +1358,14 @@ __acquires(bitmap->lock) + sector_t csize; + int err; + ++ if (page >= bitmap->pages) { ++ /* ++ * This can happen if bitmap_start_sync goes beyond ++ * End-of-device while looking for a whole page or ++ * user set a huge number to sysfs bitmap_set_bits. ++ */ ++ return NULL; ++ } + err = md_bitmap_checkpage(bitmap, page, create, 0); + + if (bitmap->bp[page].hijacked || +-- +2.39.2 + diff --git a/queue-5.15/md-raid10-fix-io-loss-while-replacement-replace-rdev.patch b/queue-5.15/md-raid10-fix-io-loss-while-replacement-replace-rdev.patch new file mode 100644 index 00000000000..b6ab2ec1f15 --- /dev/null +++ b/queue-5.15/md-raid10-fix-io-loss-while-replacement-replace-rdev.patch @@ -0,0 +1,79 @@ +From 258b4311b5591eee493b5629bc3560bcb1f7ac38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 17:18:39 +0800 +Subject: md/raid10: fix io loss while replacement replace rdev + +From: Li Nan + +[ Upstream commit 2ae6aaf76912bae53c74b191569d2ab484f24bf3 ] + +When removing a disk with replacement, the replacement will be used to +replace rdev. During this process, there is a brief window in which both +rdev and replacement are read as NULL in raid10_write_request(). This +will result in io not being submitted but it should be. + + //remove //write + raid10_remove_disk raid10_write_request + mirror->rdev = NULL + read rdev -> NULL + mirror->rdev = mirror->replacement + mirror->replacement = NULL + read replacement -> NULL + +Fix it by reading replacement first and rdev later, meanwhile, use smp_mb() +to prevent memory reordering. + +Fixes: 475b0321a4df ("md/raid10: writes should get directed to replacement as well as original.") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230602091839.743798-3-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index d3f8156da44e5..99607d51d128d 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -752,8 +752,16 @@ static struct md_rdev *read_balance(struct r10conf *conf, + disk = r10_bio->devs[slot].devnum; + rdev = rcu_dereference(conf->mirrors[disk].replacement); + if (rdev == NULL || test_bit(Faulty, &rdev->flags) || +- r10_bio->devs[slot].addr + sectors > rdev->recovery_offset) ++ r10_bio->devs[slot].addr + sectors > ++ rdev->recovery_offset) { ++ /* ++ * Read replacement first to prevent reading both rdev ++ * and replacement as NULL during replacement replace ++ * rdev. ++ */ ++ smp_mb(); + rdev = rcu_dereference(conf->mirrors[disk].rdev); ++ } + if (rdev == NULL || + test_bit(Faulty, &rdev->flags)) + continue; +@@ -1449,9 +1457,15 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, + + for (i = 0; i < conf->copies; i++) { + int d = r10_bio->devs[i].devnum; +- struct md_rdev *rdev = rcu_dereference(conf->mirrors[d].rdev); +- struct md_rdev *rrdev = rcu_dereference( +- conf->mirrors[d].replacement); ++ struct md_rdev *rdev, *rrdev; ++ ++ rrdev = rcu_dereference(conf->mirrors[d].replacement); ++ /* ++ * Read replacement first to prevent reading both rdev and ++ * replacement as NULL during replacement replace rdev. ++ */ ++ smp_mb(); ++ rdev = rcu_dereference(conf->mirrors[d].rdev); + if (rdev == rrdev) + rrdev = NULL; + if (rdev && (test_bit(Faulty, &rdev->flags))) +-- +2.39.2 + diff --git a/queue-5.15/md-raid10-fix-null-ptr-deref-of-mreplace-in-raid10_s.patch b/queue-5.15/md-raid10-fix-null-ptr-deref-of-mreplace-in-raid10_s.patch new file mode 100644 index 00000000000..5e8c79d8a25 --- /dev/null +++ b/queue-5.15/md-raid10-fix-null-ptr-deref-of-mreplace-in-raid10_s.patch @@ -0,0 +1,81 @@ +From fda1ddfab9ef411f328d9379813926289b6f5082 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 May 2023 15:22:15 +0800 +Subject: md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request + +From: Li Nan + +[ Upstream commit 34817a2441747b48e444cb0e05d84e14bc9443da ] + +There are two check of 'mreplace' in raid10_sync_request(). In the first +check, 'need_replace' will be set and 'mreplace' will be used later if +no-Faulty 'mreplace' exists, In the second check, 'mreplace' will be +set to NULL if it is Faulty, but 'need_replace' will not be changed +accordingly. null-ptr-deref occurs if Faulty is set between two check. + +Fix it by merging two checks into one. And replace 'need_replace' with +'mreplace' because their values are always the same. + +Fixes: ee37d7314a32 ("md/raid10: Fix raid10 replace hang when new added disk faulty") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230527072218.2365857-2-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 1f5589c5294dc..d3f8156da44e5 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3412,7 +3412,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + int must_sync; + int any_working; + int need_recover = 0; +- int need_replace = 0; + struct raid10_info *mirror = &conf->mirrors[i]; + struct md_rdev *mrdev, *mreplace; + +@@ -3424,11 +3423,10 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + !test_bit(Faulty, &mrdev->flags) && + !test_bit(In_sync, &mrdev->flags)) + need_recover = 1; +- if (mreplace != NULL && +- !test_bit(Faulty, &mreplace->flags)) +- need_replace = 1; ++ if (mreplace && test_bit(Faulty, &mreplace->flags)) ++ mreplace = NULL; + +- if (!need_recover && !need_replace) { ++ if (!need_recover && !mreplace) { + rcu_read_unlock(); + continue; + } +@@ -3444,8 +3442,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + rcu_read_unlock(); + continue; + } +- if (mreplace && test_bit(Faulty, &mreplace->flags)) +- mreplace = NULL; + /* Unless we are doing a full sync, or a replacement + * we only need to recover the block if it is set in + * the bitmap +@@ -3568,11 +3564,11 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr, + bio = r10_bio->devs[1].repl_bio; + if (bio) + bio->bi_end_io = NULL; +- /* Note: if need_replace, then bio ++ /* Note: if replace is not NULL, then bio + * cannot be NULL as r10buf_pool_alloc will + * have allocated it. + */ +- if (!need_replace) ++ if (!mreplace) + break; + bio->bi_next = biolist; + biolist = bio; +-- +2.39.2 + diff --git a/queue-5.15/md-raid10-fix-overflow-of-md-safe_mode_delay.patch b/queue-5.15/md-raid10-fix-overflow-of-md-safe_mode_delay.patch new file mode 100644 index 00000000000..f6af0b1a1d6 --- /dev/null +++ b/queue-5.15/md-raid10-fix-overflow-of-md-safe_mode_delay.patch @@ -0,0 +1,51 @@ +From a11389865783aa007f234a3428b518e01c133404 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 May 2023 15:25:33 +0800 +Subject: md/raid10: fix overflow of md/safe_mode_delay + +From: Li Nan + +[ Upstream commit 6beb489b2eed25978523f379a605073f99240c50 ] + +There is no input check when echo md/safe_mode_delay in safe_delay_store(). +And msec might also overflow when HZ < 1000 in safe_delay_show(), Fix it by +checking overflow in safe_delay_store() and use unsigned long conversion in +safe_delay_show(). + +Fixes: 72e02075a33f ("md: factor out parsing of fixed-point numbers") +Signed-off-by: Li Nan +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230522072535.1523740-2-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index bd0c9dfac9815..9648801e7910a 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -3872,8 +3872,9 @@ int strict_strtoul_scaled(const char *cp, unsigned long *res, int scale) + static ssize_t + safe_delay_show(struct mddev *mddev, char *page) + { +- int msec = (mddev->safemode_delay*1000)/HZ; +- return sprintf(page, "%d.%03d\n", msec/1000, msec%1000); ++ unsigned int msec = ((unsigned long)mddev->safemode_delay*1000)/HZ; ++ ++ return sprintf(page, "%u.%03u\n", msec/1000, msec%1000); + } + static ssize_t + safe_delay_store(struct mddev *mddev, const char *cbuf, size_t len) +@@ -3885,7 +3886,7 @@ safe_delay_store(struct mddev *mddev, const char *cbuf, size_t len) + return -EINVAL; + } + +- if (strict_strtoul_scaled(cbuf, &msec, 3) < 0) ++ if (strict_strtoul_scaled(cbuf, &msec, 3) < 0 || msec > UINT_MAX / HZ) + return -EINVAL; + if (msec == 0) + mddev->safemode_delay = 0; +-- +2.39.2 + diff --git a/queue-5.15/md-raid10-fix-wrong-setting-of-max_corr_read_errors.patch b/queue-5.15/md-raid10-fix-wrong-setting-of-max_corr_read_errors.patch new file mode 100644 index 00000000000..f2911763a6d --- /dev/null +++ b/queue-5.15/md-raid10-fix-wrong-setting-of-max_corr_read_errors.patch @@ -0,0 +1,38 @@ +From 068a41c10ac36a552dbd1e03bea43586d7032108 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 May 2023 15:25:34 +0800 +Subject: md/raid10: fix wrong setting of max_corr_read_errors + +From: Li Nan + +[ Upstream commit f8b20a405428803bd9881881d8242c9d72c6b2b2 ] + +There is no input check when echo md/max_read_errors and overflow might +occur. Add check of input number. + +Fixes: 1e50915fe0bb ("raid: improve MD/raid10 handling of correctable read errors.") +Signed-off-by: Li Nan +Reviewed-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230522072535.1523740-3-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 9648801e7910a..5a21aeedc1ba7 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -4556,6 +4556,8 @@ max_corrected_read_errors_store(struct mddev *mddev, const char *buf, size_t len + rv = kstrtouint(buf, 10, &n); + if (rv < 0) + return rv; ++ if (n > INT_MAX) ++ return -EINVAL; + atomic_set(&mddev->max_corr_read_errors, n); + return len; + } +-- +2.39.2 + diff --git a/queue-5.15/memory-brcmstb_dpfe-fix-testing-array-offset-after-u.patch b/queue-5.15/memory-brcmstb_dpfe-fix-testing-array-offset-after-u.patch new file mode 100644 index 00000000000..994b64b8f23 --- /dev/null +++ b/queue-5.15/memory-brcmstb_dpfe-fix-testing-array-offset-after-u.patch @@ -0,0 +1,50 @@ +From c915266ecd7ca65e2ead9a53d002c778985979db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 May 2023 13:29:31 +0200 +Subject: memory: brcmstb_dpfe: fix testing array offset after use + +From: Krzysztof Kozlowski + +[ Upstream commit 1d9e93fad549bc38f593147479ee063f2872c170 ] + +Code should first check for valid value of array offset, then use it as +the index. Fixes smatch warning: + + drivers/memory/brcmstb_dpfe.c:443 __send_command() error: testing array offset 'cmd' after use. + +Fixes: 2f330caff577 ("memory: brcmstb: Add driver for DPFE") +Acked-by: Markus Mayer +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230513112931.176066-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/brcmstb_dpfe.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c +index f43ba69fbb3e3..2daae2e0cb19e 100644 +--- a/drivers/memory/brcmstb_dpfe.c ++++ b/drivers/memory/brcmstb_dpfe.c +@@ -434,15 +434,17 @@ static void __finalize_command(struct brcmstb_dpfe_priv *priv) + static int __send_command(struct brcmstb_dpfe_priv *priv, unsigned int cmd, + u32 result[]) + { +- const u32 *msg = priv->dpfe_api->command[cmd]; + void __iomem *regs = priv->regs; + unsigned int i, chksum, chksum_idx; ++ const u32 *msg; + int ret = 0; + u32 resp; + + if (cmd >= DPFE_CMD_MAX) + return -1; + ++ msg = priv->dpfe_api->command[cmd]; ++ + mutex_lock(&priv->lock); + + /* Wait for DCPU to become ready */ +-- +2.39.2 + diff --git a/queue-5.15/memstick-r592-make-memstick_debug_get_tpc_name-stati.patch b/queue-5.15/memstick-r592-make-memstick_debug_get_tpc_name-stati.patch new file mode 100644 index 00000000000..9b7a0170ce1 --- /dev/null +++ b/queue-5.15/memstick-r592-make-memstick_debug_get_tpc_name-stati.patch @@ -0,0 +1,49 @@ +From 654d26780ceb1908a84b939c37ada21296725eed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 22:27:04 +0200 +Subject: memstick r592: make memstick_debug_get_tpc_name() static + +From: Arnd Bergmann + +[ Upstream commit 434587df9f7fd68575f99a889cc5f2efc2eaee5e ] + +There are no other files referencing this function, apparently +it was left global to avoid an 'unused function' warning when +the only caller is left out. With a 'W=1' build, it causes +a 'missing prototype' warning though: + +drivers/memstick/host/r592.c:47:13: error: no previous prototype for 'memstick_debug_get_tpc_name' [-Werror=missing-prototypes] + +Annotate the function as 'static __maybe_unused' to avoid both +problems. + +Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20230516202714.560929-1-arnd@kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/memstick/host/r592.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c +index 42bfc46842b82..461f5ffd02bc1 100644 +--- a/drivers/memstick/host/r592.c ++++ b/drivers/memstick/host/r592.c +@@ -44,12 +44,10 @@ static const char *tpc_names[] = { + * memstick_debug_get_tpc_name - debug helper that returns string for + * a TPC number + */ +-const char *memstick_debug_get_tpc_name(int tpc) ++static __maybe_unused const char *memstick_debug_get_tpc_name(int tpc) + { + return tpc_names[tpc-1]; + } +-EXPORT_SYMBOL(memstick_debug_get_tpc_name); +- + + /* Read a register*/ + static inline u32 r592_read_reg(struct r592_device *dev, int address) +-- +2.39.2 + diff --git a/queue-5.15/mips-dts-ci20-add-parent-supplies-to-act8600-regulat.patch b/queue-5.15/mips-dts-ci20-add-parent-supplies-to-act8600-regulat.patch new file mode 100644 index 00000000000..9378e6df8bf --- /dev/null +++ b/queue-5.15/mips-dts-ci20-add-parent-supplies-to-act8600-regulat.patch @@ -0,0 +1,72 @@ +From d7b1eb93aa5a3f60b2a46f3bc70a4289d1c2c257 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 16:56:36 +0200 +Subject: MIPS: DTS: CI20: Add parent supplies to ACT8600 regulators + +From: Paul Cercueil + +[ Upstream commit fbf1e42093f8d6346baf17079585fbcebb2ff284 ] + +Provide parent regulators to the ACT8600 regulators that need one. + +Signed-off-by: Paul Cercueil +Signed-off-by: Thomas Bogendoerfer +Stable-dep-of: 944520f85d5b ("MIPS: DTS: CI20: Raise VDDCORE voltage to 1.125 volts") +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/ingenic/ci20.dts | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts +index 7f98ee0208efb..2a6c971867795 100644 +--- a/arch/mips/boot/dts/ingenic/ci20.dts ++++ b/arch/mips/boot/dts/ingenic/ci20.dts +@@ -224,16 +224,19 @@ regulators { + vddcore: DCDC1 { + regulator-min-microvolt = <1100000>; + regulator-max-microvolt = <1100000>; ++ vp1-supply = <&vcc_33v>; + regulator-always-on; + }; + vddmem: DCDC2 { + regulator-min-microvolt = <1500000>; + regulator-max-microvolt = <1500000>; ++ vp2-supply = <&vcc_33v>; + regulator-always-on; + }; + vcc_33: DCDC3 { + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; ++ vp3-supply = <&vcc_33v>; + regulator-always-on; + }; + vcc_50: SUDCDC_REG4 { +@@ -244,21 +247,25 @@ vcc_50: SUDCDC_REG4 { + vcc_25: LDO5 { + regulator-min-microvolt = <2500000>; + regulator-max-microvolt = <2500000>; ++ inl-supply = <&vcc_33v>; + regulator-always-on; + }; + wifi_io: LDO6 { + regulator-min-microvolt = <2500000>; + regulator-max-microvolt = <2500000>; ++ inl-supply = <&vcc_33v>; + regulator-always-on; + }; + cim_io_28: LDO7 { + regulator-min-microvolt = <2800000>; + regulator-max-microvolt = <2800000>; ++ inl-supply = <&vcc_33v>; + regulator-always-on; + }; + cim_io_15: LDO8 { + regulator-min-microvolt = <1500000>; + regulator-max-microvolt = <1500000>; ++ inl-supply = <&vcc_33v>; + regulator-always-on; + }; + vrtc_18: LDO_REG9 { +-- +2.39.2 + diff --git a/queue-5.15/mips-dts-ci20-fix-act8600-regulator-node-names.patch b/queue-5.15/mips-dts-ci20-fix-act8600-regulator-node-names.patch new file mode 100644 index 00000000000..3cb8b553037 --- /dev/null +++ b/queue-5.15/mips-dts-ci20-fix-act8600-regulator-node-names.patch @@ -0,0 +1,113 @@ +From c5aa8e045a095108423fd50ab26bcee1bc597cea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 16:56:35 +0200 +Subject: MIPS: DTS: CI20: Fix ACT8600 regulator node names + +From: Paul Cercueil + +[ Upstream commit 08384e80a70fb1942510ab5f0ce27bad134e634e ] + +The Device Tree was using invalid node names for the ACT8600 regulators. +To be fair, it is not the original committer's fault, as the +documentation did gives invalid names as well. + +In theory, the fix should have been to modify the driver to accept the +alternative names. However, even though the act8865 driver spits +warnings, the kernel seemed to work fine with what is currently +supported upstream. For that reason, I think it is okay to just update +the DTS. + +I removed the "regulator-name" too, since they really didn't bring any +information. The node names are enough. + +Fixes: 73f2b940474d ("MIPS: CI20: DTS: Add I2C nodes") +Signed-off-by: Paul Cercueil +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/ingenic/ci20.dts | 27 ++++++++------------------- + 1 file changed, 8 insertions(+), 19 deletions(-) + +diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts +index 74d49dc134384..7f98ee0208efb 100644 +--- a/arch/mips/boot/dts/ingenic/ci20.dts ++++ b/arch/mips/boot/dts/ingenic/ci20.dts +@@ -219,59 +219,49 @@ &i2c0 { + act8600: act8600@5a { + compatible = "active-semi,act8600"; + reg = <0x5a>; +- status = "okay"; + + regulators { +- vddcore: SUDCDC1 { +- regulator-name = "DCDC_REG1"; ++ vddcore: DCDC1 { + regulator-min-microvolt = <1100000>; + regulator-max-microvolt = <1100000>; + regulator-always-on; + }; +- vddmem: SUDCDC2 { +- regulator-name = "DCDC_REG2"; ++ vddmem: DCDC2 { + regulator-min-microvolt = <1500000>; + regulator-max-microvolt = <1500000>; + regulator-always-on; + }; +- vcc_33: SUDCDC3 { +- regulator-name = "DCDC_REG3"; ++ vcc_33: DCDC3 { + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + regulator-always-on; + }; +- vcc_50: SUDCDC4 { +- regulator-name = "SUDCDC_REG4"; ++ vcc_50: SUDCDC_REG4 { + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; + regulator-always-on; + }; +- vcc_25: LDO_REG5 { +- regulator-name = "LDO_REG5"; ++ vcc_25: LDO5 { + regulator-min-microvolt = <2500000>; + regulator-max-microvolt = <2500000>; + regulator-always-on; + }; +- wifi_io: LDO_REG6 { +- regulator-name = "LDO_REG6"; ++ wifi_io: LDO6 { + regulator-min-microvolt = <2500000>; + regulator-max-microvolt = <2500000>; + regulator-always-on; + }; +- vcc_28: LDO_REG7 { +- regulator-name = "LDO_REG7"; ++ cim_io_28: LDO7 { + regulator-min-microvolt = <2800000>; + regulator-max-microvolt = <2800000>; + regulator-always-on; + }; +- vcc_15: LDO_REG8 { +- regulator-name = "LDO_REG8"; ++ cim_io_15: LDO8 { + regulator-min-microvolt = <1500000>; + regulator-max-microvolt = <1500000>; + regulator-always-on; + }; + vrtc_18: LDO_REG9 { +- regulator-name = "LDO_REG9"; + /* Despite the datasheet stating 3.3V + * for REG9 and the driver expecting that, + * REG9 outputs 1.8V. +@@ -285,7 +275,6 @@ vrtc_18: LDO_REG9 { + regulator-always-on; + }; + vcc_11: LDO_REG10 { +- regulator-name = "LDO_REG10"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <1200000>; + regulator-always-on; +-- +2.39.2 + diff --git a/queue-5.15/mips-dts-ci20-raise-vddcore-voltage-to-1.125-volts.patch b/queue-5.15/mips-dts-ci20-raise-vddcore-voltage-to-1.125-volts.patch new file mode 100644 index 00000000000..050bc31abf0 --- /dev/null +++ b/queue-5.15/mips-dts-ci20-raise-vddcore-voltage-to-1.125-volts.patch @@ -0,0 +1,51 @@ +From c96a8fa07d1e6047ee16bc780ce2d85e79f61d86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 19:59:34 +0200 +Subject: MIPS: DTS: CI20: Raise VDDCORE voltage to 1.125 volts + +From: Paul Cercueil + +[ Upstream commit 944520f85d5b1fb2f9ea243be41f9c9af3d4cef3 ] + +Commit 08384e80a70f ("MIPS: DTS: CI20: Fix ACT8600 regulator node +names") caused the VDDCORE power supply (regulated by the ACT8600's +DCDC1 output) to drop from a voltage of 1.2V configured by the +bootloader, to the 1.1V set in the Device Tree. + +According to the documentation, the VDDCORE supply should be between +0.99V and 1.21V; both values are therefore within the supported range. + +However, VDDCORE being 1.1V results in the CI20 being very unstable, +with corrupted memory, failures to boot, or reboots at random. The +reason might be succint drops of the voltage below the minimum required. + +Raising the minimum voltage to 1.125 volts seems to be enough to address +this issue, while still keeping a relatively low core voltage which +helps for power consumption and thermals. + +Fixes: 08384e80a70f ("MIPS: DTS: CI20: Fix ACT8600 regulator node names") +Signed-off-by: Paul Cercueil +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/ingenic/ci20.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts +index 2a6c971867795..d3661ff0f0003 100644 +--- a/arch/mips/boot/dts/ingenic/ci20.dts ++++ b/arch/mips/boot/dts/ingenic/ci20.dts +@@ -222,8 +222,8 @@ act8600: act8600@5a { + + regulators { + vddcore: DCDC1 { +- regulator-min-microvolt = <1100000>; +- regulator-max-microvolt = <1100000>; ++ regulator-min-microvolt = <1125000>; ++ regulator-max-microvolt = <1125000>; + vp1-supply = <&vcc_33v>; + regulator-always-on; + }; +-- +2.39.2 + diff --git a/queue-5.15/mmc-add-mmc_quirk_broken_sd_cache-for-kingston-canva.patch b/queue-5.15/mmc-add-mmc_quirk_broken_sd_cache-for-kingston-canva.patch new file mode 100644 index 00000000000..4191ce50725 --- /dev/null +++ b/queue-5.15/mmc-add-mmc_quirk_broken_sd_cache-for-kingston-canva.patch @@ -0,0 +1,169 @@ +From eca9c82eb96260dadb426749f2a3c45a5fbcefab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 12:27:13 +0200 +Subject: mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from + 11/2019 + +From: Marek Vasut + +[ Upstream commit c467c8f081859d4f4ca4eee4fba54bb5d85d6c97 ] + +This microSD card never clears Flush Cache bit after cache flush has +been started in sd_flush_cache(). This leads e.g. to failure to mount +file system. Add a quirk which disables the SD cache for this specific +card from specific manufacturing date of 11/2019, since on newer dated +cards from 05/2023 the cache flush works correctly. + +Fixes: 08ebf903af57 ("mmc: core: Fixup support for writeback-cache for eMMC and SD") +Signed-off-by: Marek Vasut +Link: https://lore.kernel.org/r/20230620102713.7701-1-marex@denx.de +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/card.h | 30 +++++++++++++++++++++++------- + drivers/mmc/core/quirks.h | 13 +++++++++++++ + drivers/mmc/core/sd.c | 2 +- + include/linux/mmc/card.h | 1 + + 4 files changed, 38 insertions(+), 8 deletions(-) + +diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h +index 3c0ccb37ba36e..3431db49f3fbe 100644 +--- a/drivers/mmc/core/card.h ++++ b/drivers/mmc/core/card.h +@@ -53,6 +53,10 @@ struct mmc_fixup { + unsigned int manfid; + unsigned short oemid; + ++ /* Manufacturing date */ ++ unsigned short year; ++ unsigned char month; ++ + /* SDIO-specific fields. You can use SDIO_ANY_ID here of course */ + u16 cis_vendor, cis_device; + +@@ -68,6 +72,8 @@ struct mmc_fixup { + + #define CID_MANFID_ANY (-1u) + #define CID_OEMID_ANY ((unsigned short) -1) ++#define CID_YEAR_ANY ((unsigned short) -1) ++#define CID_MONTH_ANY ((unsigned char) -1) + #define CID_NAME_ANY (NULL) + + #define EXT_CSD_REV_ANY (-1u) +@@ -81,17 +87,21 @@ struct mmc_fixup { + #define CID_MANFID_APACER 0x27 + #define CID_MANFID_KINGSTON 0x70 + #define CID_MANFID_HYNIX 0x90 ++#define CID_MANFID_KINGSTON_SD 0x9F + #define CID_MANFID_NUMONYX 0xFE + + #define END_FIXUP { NULL } + +-#define _FIXUP_EXT(_name, _manfid, _oemid, _rev_start, _rev_end, \ +- _cis_vendor, _cis_device, \ +- _fixup, _data, _ext_csd_rev) \ ++#define _FIXUP_EXT(_name, _manfid, _oemid, _year, _month, \ ++ _rev_start, _rev_end, \ ++ _cis_vendor, _cis_device, \ ++ _fixup, _data, _ext_csd_rev) \ + { \ + .name = (_name), \ + .manfid = (_manfid), \ + .oemid = (_oemid), \ ++ .year = (_year), \ ++ .month = (_month), \ + .rev_start = (_rev_start), \ + .rev_end = (_rev_end), \ + .cis_vendor = (_cis_vendor), \ +@@ -103,8 +113,8 @@ struct mmc_fixup { + + #define MMC_FIXUP_REV(_name, _manfid, _oemid, _rev_start, _rev_end, \ + _fixup, _data, _ext_csd_rev) \ +- _FIXUP_EXT(_name, _manfid, \ +- _oemid, _rev_start, _rev_end, \ ++ _FIXUP_EXT(_name, _manfid, _oemid, CID_YEAR_ANY, CID_MONTH_ANY, \ ++ _rev_start, _rev_end, \ + SDIO_ANY_ID, SDIO_ANY_ID, \ + _fixup, _data, _ext_csd_rev) \ + +@@ -118,8 +128,9 @@ struct mmc_fixup { + _ext_csd_rev) + + #define SDIO_FIXUP(_vendor, _device, _fixup, _data) \ +- _FIXUP_EXT(CID_NAME_ANY, CID_MANFID_ANY, \ +- CID_OEMID_ANY, 0, -1ull, \ ++ _FIXUP_EXT(CID_NAME_ANY, CID_MANFID_ANY, CID_OEMID_ANY, \ ++ CID_YEAR_ANY, CID_MONTH_ANY, \ ++ 0, -1ull, \ + _vendor, _device, \ + _fixup, _data, EXT_CSD_REV_ANY) \ + +@@ -231,4 +242,9 @@ static inline int mmc_card_broken_sd_discard(const struct mmc_card *c) + return c->quirks & MMC_QUIRK_BROKEN_SD_DISCARD; + } + ++static inline int mmc_card_broken_sd_cache(const struct mmc_card *c) ++{ ++ return c->quirks & MMC_QUIRK_BROKEN_SD_CACHE; ++} ++ + #endif +diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h +index 15ecd839a42f0..7cb861bf6b308 100644 +--- a/drivers/mmc/core/quirks.h ++++ b/drivers/mmc/core/quirks.h +@@ -53,6 +53,15 @@ static const struct mmc_fixup __maybe_unused mmc_blk_fixups[] = { + MMC_FIXUP("MMC32G", CID_MANFID_TOSHIBA, CID_OEMID_ANY, add_quirk_mmc, + MMC_QUIRK_BLK_NO_CMD23), + ++ /* ++ * Kingston Canvas Go! Plus microSD cards never finish SD cache flush. ++ * This has so far only been observed on cards from 11/2019, while new ++ * cards from 2023/05 do not exhibit this behavior. ++ */ ++ _FIXUP_EXT("SD64G", CID_MANFID_KINGSTON_SD, 0x5449, 2019, 11, ++ 0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd, ++ MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY), ++ + /* + * Some SD cards lockup while using CMD23 multiblock transfers. + */ +@@ -196,6 +205,10 @@ static inline void mmc_fixup_device(struct mmc_card *card, + if (f->of_compatible && + !mmc_fixup_of_compatible_match(card, f->of_compatible)) + continue; ++ if (f->year != CID_YEAR_ANY && f->year != card->cid.year) ++ continue; ++ if (f->month != CID_MONTH_ANY && f->month != card->cid.month) ++ continue; + + dev_dbg(&card->dev, "calling %ps\n", f->vendor_fixup); + f->vendor_fixup(card, f->data); +diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c +index 592166e53dce8..ee15da61f8421 100644 +--- a/drivers/mmc/core/sd.c ++++ b/drivers/mmc/core/sd.c +@@ -1163,7 +1163,7 @@ static int sd_parse_ext_reg_perf(struct mmc_card *card, u8 fno, u8 page, + card->ext_perf.feature_support |= SD_EXT_PERF_HOST_MAINT; + + /* Cache support at bit 0. */ +- if (reg_buf[4] & BIT(0)) ++ if ((reg_buf[4] & BIT(0)) && !mmc_card_broken_sd_cache(card)) + card->ext_perf.feature_support |= SD_EXT_PERF_CACHE; + + /* Command queue support indicated via queue depth bits (0 to 4). */ +diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h +index 12c7f2d3e2107..7a45edf6ce46a 100644 +--- a/include/linux/mmc/card.h ++++ b/include/linux/mmc/card.h +@@ -293,6 +293,7 @@ struct mmc_card { + #define MMC_QUIRK_TRIM_BROKEN (1<<12) /* Skip trim */ + #define MMC_QUIRK_BROKEN_HPI (1<<13) /* Disable broken HPI support */ + #define MMC_QUIRK_BROKEN_SD_DISCARD (1<<14) /* Disable broken SD discard support */ ++#define MMC_QUIRK_BROKEN_SD_CACHE (1<<15) /* Disable broken SD cache support */ + + bool reenable_cmdq; /* Re-enable Command Queue */ + +-- +2.39.2 + diff --git a/queue-5.15/mmc-core-allow-to-match-the-device-tree-to-apply-qui.patch b/queue-5.15/mmc-core-allow-to-match-the-device-tree-to-apply-qui.patch new file mode 100644 index 00000000000..f65068e8c0e --- /dev/null +++ b/queue-5.15/mmc-core-allow-to-match-the-device-tree-to-apply-qui.patch @@ -0,0 +1,94 @@ +From 0f24dd438692b853427b177b5a527987792a3df8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 18:17:07 +0100 +Subject: mmc: core: allow to match the device tree to apply quirks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jérôme Pouiller + +[ Upstream commit b360b11026705369f7ea51653f75dbe611322338 ] + +MMC subsystem provides a way to apply quirks when a device match some +properties (VID, PID, etc...) Unfortunately, some SDIO devices do not +comply with the SDIO specification and does not provide reliable VID/PID +(eg. Silabs WF200). + +So, the drivers for these devices rely on device tree to identify the +device. + +This patch allows the MMC to also rely on the device tree to apply a +quirk. + +Signed-off-by: Jérôme Pouiller +Signed-off-by: H. Nikolaus Schaller +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/9e68e3d23e62a78527aabc1281f89e15200c7d09.1636564631.git.hns@goldelico.com +Signed-off-by: Ulf Hansson +Stable-dep-of: c467c8f08185 ("mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from 11/2019") +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/card.h | 3 +++ + drivers/mmc/core/quirks.h | 17 +++++++++++++++++ + 2 files changed, 20 insertions(+) + +diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h +index 5c6986131faff..3c0ccb37ba36e 100644 +--- a/drivers/mmc/core/card.h ++++ b/drivers/mmc/core/card.h +@@ -59,6 +59,9 @@ struct mmc_fixup { + /* for MMC cards */ + unsigned int ext_csd_rev; + ++ /* Match against functions declared in device tree */ ++ const char *of_compatible; ++ + void (*vendor_fixup)(struct mmc_card *card, int data); + int data; + }; +diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h +index 5a936f1ec3cb4..15ecd839a42f0 100644 +--- a/drivers/mmc/core/quirks.h ++++ b/drivers/mmc/core/quirks.h +@@ -10,6 +10,7 @@ + * + */ + ++#include + #include + + #include "card.h" +@@ -151,6 +152,19 @@ static const struct mmc_fixup __maybe_unused sdio_fixup_methods[] = { + END_FIXUP + }; + ++static inline bool mmc_fixup_of_compatible_match(struct mmc_card *card, ++ const char *compatible) ++{ ++ struct device_node *np; ++ ++ for_each_child_of_node(mmc_dev(card->host)->of_node, np) { ++ if (of_device_is_compatible(np, compatible)) ++ return true; ++ } ++ ++ return false; ++} ++ + static inline void mmc_fixup_device(struct mmc_card *card, + const struct mmc_fixup *table) + { +@@ -179,6 +193,9 @@ static inline void mmc_fixup_device(struct mmc_card *card, + continue; + if (rev < f->rev_start || rev > f->rev_end) + continue; ++ if (f->of_compatible && ++ !mmc_fixup_of_compatible_match(card, f->of_compatible)) ++ continue; + + dev_dbg(&card->dev, "calling %ps\n", f->vendor_fixup); + f->vendor_fixup(card, f->data); +-- +2.39.2 + diff --git a/queue-5.15/mmc-core-rewrite-mmc_fixup_device.patch b/queue-5.15/mmc-core-rewrite-mmc_fixup_device.patch new file mode 100644 index 00000000000..c22d4e7a416 --- /dev/null +++ b/queue-5.15/mmc-core-rewrite-mmc_fixup_device.patch @@ -0,0 +1,80 @@ +From 3425059f45152954d8a8f2f574aebe0f3a6593f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 18:17:06 +0100 +Subject: mmc: core: rewrite mmc_fixup_device() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jérôme Pouiller + +[ Upstream commit f3abe2e509387907dd36886c1008445559ff4d91 ] + +Currently, mmc_fixup_device() is a bit difficult to read because of +particularly long condition. + +Signed-off-by: Jérôme Pouiller +Signed-off-by: H. Nikolaus Schaller +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/6515c1e8b3aa69ad273726f6e877d85c20f286ad.1636564631.git.hns@goldelico.com +Signed-off-by: Ulf Hansson +Stable-dep-of: c467c8f08185 ("mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from 11/2019") +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/quirks.h | 41 +++++++++++++++++++++++---------------- + 1 file changed, 24 insertions(+), 17 deletions(-) + +diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h +index c8c0f50a2076d..5a936f1ec3cb4 100644 +--- a/drivers/mmc/core/quirks.h ++++ b/drivers/mmc/core/quirks.h +@@ -158,22 +158,29 @@ static inline void mmc_fixup_device(struct mmc_card *card, + u64 rev = cid_rev_card(card); + + for (f = table; f->vendor_fixup; f++) { +- if ((f->manfid == CID_MANFID_ANY || +- f->manfid == card->cid.manfid) && +- (f->oemid == CID_OEMID_ANY || +- f->oemid == card->cid.oemid) && +- (f->name == CID_NAME_ANY || +- !strncmp(f->name, card->cid.prod_name, +- sizeof(card->cid.prod_name))) && +- (f->cis_vendor == card->cis.vendor || +- f->cis_vendor == (u16) SDIO_ANY_ID) && +- (f->cis_device == card->cis.device || +- f->cis_device == (u16) SDIO_ANY_ID) && +- (f->ext_csd_rev == EXT_CSD_REV_ANY || +- f->ext_csd_rev == card->ext_csd.rev) && +- rev >= f->rev_start && rev <= f->rev_end) { +- dev_dbg(&card->dev, "calling %ps\n", f->vendor_fixup); +- f->vendor_fixup(card, f->data); +- } ++ if (f->manfid != CID_MANFID_ANY && ++ f->manfid != card->cid.manfid) ++ continue; ++ if (f->oemid != CID_OEMID_ANY && ++ f->oemid != card->cid.oemid) ++ continue; ++ if (f->name != CID_NAME_ANY && ++ strncmp(f->name, card->cid.prod_name, ++ sizeof(card->cid.prod_name))) ++ continue; ++ if (f->cis_vendor != (u16)SDIO_ANY_ID && ++ f->cis_vendor != card->cis.vendor) ++ continue; ++ if (f->cis_device != (u16)SDIO_ANY_ID && ++ f->cis_device != card->cis.device) ++ continue; ++ if (f->ext_csd_rev != EXT_CSD_REV_ANY && ++ f->ext_csd_rev != card->ext_csd.rev) ++ continue; ++ if (rev < f->rev_start || rev > f->rev_end) ++ continue; ++ ++ dev_dbg(&card->dev, "calling %ps\n", f->vendor_fixup); ++ f->vendor_fixup(card, f->data); + } + } +-- +2.39.2 + diff --git a/queue-5.15/mmc-core-support-zeroout-using-trim-for-emmc.patch b/queue-5.15/mmc-core-support-zeroout-using-trim-for-emmc.patch new file mode 100644 index 00000000000..b3dd5930401 --- /dev/null +++ b/queue-5.15/mmc-core-support-zeroout-using-trim-for-emmc.patch @@ -0,0 +1,107 @@ +From e71c90bcc65727d323b9a3cb40b263db7be5ee4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Apr 2022 17:21:18 +0200 +Subject: mmc: core: Support zeroout using TRIM for eMMC + +From: Vincent Whitchurch + +[ Upstream commit f7b6fc327327698924ef3afa0c3e87a5b7466af3 ] + +If an eMMC card supports TRIM and indicates that it erases to zeros, we can +use it to support hardware offloading of REQ_OP_WRITE_ZEROES, so let's add +support for this. + +Signed-off-by: Vincent Whitchurch +Reviewed-by: Avri Altman +Link: https://lore.kernel.org/r/20220429152118.3617303-1-vincent.whitchurch@axis.com +Signed-off-by: Ulf Hansson +Stable-dep-of: c467c8f08185 ("mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from 11/2019") +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/block.c | 24 +++++++++++++++++++++--- + drivers/mmc/core/queue.c | 2 ++ + 2 files changed, 23 insertions(+), 3 deletions(-) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 0b72096f10e62..8105b8ef7cf40 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -126,6 +126,7 @@ struct mmc_blk_data { + #define MMC_BLK_DISCARD BIT(2) + #define MMC_BLK_SECDISCARD BIT(3) + #define MMC_BLK_CQE_RECOVERY BIT(4) ++#define MMC_BLK_TRIM BIT(5) + + /* + * Only set in main mmc_blk_data associated +@@ -1100,12 +1101,13 @@ static void mmc_blk_issue_drv_op(struct mmc_queue *mq, struct request *req) + blk_mq_end_request(req, ret ? BLK_STS_IOERR : BLK_STS_OK); + } + +-static void mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req) ++static void mmc_blk_issue_erase_rq(struct mmc_queue *mq, struct request *req, ++ int type, unsigned int erase_arg) + { + struct mmc_blk_data *md = mq->blkdata; + struct mmc_card *card = md->queue.card; + unsigned int from, nr; +- int err = 0, type = MMC_BLK_DISCARD; ++ int err = 0; + blk_status_t status = BLK_STS_OK; + + if (!mmc_can_erase(card)) { +@@ -1126,7 +1128,7 @@ static void mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req) + if (card->quirks & MMC_QUIRK_INAND_CMD38) { + err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, + INAND_CMD38_ARG_EXT_CSD, +- card->erase_arg == MMC_TRIM_ARG ? ++ erase_arg == MMC_TRIM_ARG ? + INAND_CMD38_ARG_TRIM : + INAND_CMD38_ARG_ERASE, + card->ext_csd.generic_cmd6_time); +@@ -1142,6 +1144,19 @@ static void mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req) + blk_mq_end_request(req, status); + } + ++static void mmc_blk_issue_trim_rq(struct mmc_queue *mq, struct request *req) ++{ ++ mmc_blk_issue_erase_rq(mq, req, MMC_BLK_TRIM, MMC_TRIM_ARG); ++} ++ ++static void mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req) ++{ ++ struct mmc_blk_data *md = mq->blkdata; ++ struct mmc_card *card = md->queue.card; ++ ++ mmc_blk_issue_erase_rq(mq, req, MMC_BLK_DISCARD, card->erase_arg); ++} ++ + static void mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq, + struct request *req) + { +@@ -2336,6 +2351,9 @@ enum mmc_issued mmc_blk_mq_issue_rq(struct mmc_queue *mq, struct request *req) + case REQ_OP_SECURE_ERASE: + mmc_blk_issue_secdiscard_rq(mq, req); + break; ++ case REQ_OP_WRITE_ZEROES: ++ mmc_blk_issue_trim_rq(mq, req); ++ break; + case REQ_OP_FLUSH: + mmc_blk_issue_flush(mq, req); + break; +diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c +index b15c034b42fb5..a72431703e527 100644 +--- a/drivers/mmc/core/queue.c ++++ b/drivers/mmc/core/queue.c +@@ -191,6 +191,8 @@ static void mmc_queue_setup_discard(struct request_queue *q, + q->limits.discard_granularity = SECTOR_SIZE; + if (mmc_can_secure_erase_trim(card)) + blk_queue_flag_set(QUEUE_FLAG_SECERASE, q); ++ if (mmc_can_trim(card) && card->erased_byte == 0) ++ blk_queue_max_write_zeroes_sectors(q, max_discard); + } + + static unsigned short mmc_get_max_segments(struct mmc_host *host) +-- +2.39.2 + diff --git a/queue-5.15/modpost-fix-off-by-one-in-is_executable_section.patch b/queue-5.15/modpost-fix-off-by-one-in-is_executable_section.patch new file mode 100644 index 00000000000..4d48ce513b3 --- /dev/null +++ b/queue-5.15/modpost-fix-off-by-one-in-is_executable_section.patch @@ -0,0 +1,36 @@ +From 6a43b360d7741d7f50f7f60682a761142b0133d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 11:23:40 +0300 +Subject: modpost: fix off by one in is_executable_section() + +From: Dan Carpenter + +[ Upstream commit 3a3f1e573a105328a2cca45a7cfbebabbf5e3192 ] + +The > comparison should be >= to prevent an out of bounds array +access. + +Fixes: 52dc0595d540 ("modpost: handle relocations mismatch in __ex_table.") +Signed-off-by: Dan Carpenter +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 78859ef4e03ad..c6e655e0ed988 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1610,7 +1610,7 @@ static void default_mismatch_handler(const char *modname, struct elf_info *elf, + + static int is_executable_section(struct elf_info* elf, unsigned int section_index) + { +- if (section_index > elf->num_sections) ++ if (section_index >= elf->num_sections) + fatal("section_index is outside elf->num_sections!\n"); + + return ((elf->sechdrs[section_index].sh_flags & SHF_EXECINSTR) == SHF_EXECINSTR); +-- +2.39.2 + diff --git a/queue-5.15/modpost-fix-section-mismatch-message-for-r_arm_-pc24.patch b/queue-5.15/modpost-fix-section-mismatch-message-for-r_arm_-pc24.patch new file mode 100644 index 00000000000..8f7c901a065 --- /dev/null +++ b/queue-5.15/modpost-fix-section-mismatch-message-for-r_arm_-pc24.patch @@ -0,0 +1,106 @@ +From 4e46ee87aee6f5e11fd3189188c6ef9b63cd319f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 21:09:56 +0900 +Subject: modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} + +From: Masahiro Yamada + +[ Upstream commit 56a24b8ce6a7f9c4a21b2276a8644f6f3d8fc14d ] + +addend_arm_rel() processes R_ARM_PC24, R_ARM_CALL, R_ARM_JUMP24 in a +wrong way. + +Here, test code. + +[test code for R_ARM_JUMP24] + + .section .init.text,"ax" + bar: + bx lr + + .section .text,"ax" + .globl foo + foo: + b bar + +[test code for R_ARM_CALL] + + .section .init.text,"ax" + bar: + bx lr + + .section .text,"ax" + .globl foo + foo: + push {lr} + bl bar + pop {pc} + +If you compile it with ARM multi_v7_defconfig, modpost will show the +symbol name, (unknown). + + WARNING: modpost: vmlinux.o: section mismatch in reference: foo (section: .text) -> (unknown) (section: .init.text) + +(You need to use GNU linker instead of LLD to reproduce it.) + +Fix the code to make modpost show the correct symbol name. + +I imported (with adjustment) sign_extend32() from include/linux/bitops.h. + +The '+8' is the compensation for pc-relative instruction. It is +documented in "ELF for the Arm Architecture" [1]. + + "If the relocation is pc-relative then compensation for the PC bias + (the PC value is 8 bytes ahead of the executing instruction in Arm + state and 4 bytes in Thumb state) must be encoded in the relocation + by the object producer." + +[1]: https://github.com/ARM-software/abi-aa/blob/main/aaelf32/aaelf32.rst + +Fixes: 56a974fa2d59 ("kbuild: make better section mismatch reports on arm") +Fixes: 6e2e340b59d2 ("ARM: 7324/1: modpost: Fix section warnings for ARM for many compilers") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 789e0ddb41ae4..78859ef4e03ad 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1735,12 +1735,20 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) + #define R_ARM_THM_JUMP19 51 + #endif + ++static int32_t sign_extend32(int32_t value, int index) ++{ ++ uint8_t shift = 31 - index; ++ ++ return (int32_t)(value << shift) >> shift; ++} ++ + static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) + { + unsigned int r_typ = ELF_R_TYPE(r->r_info); + Elf_Sym *sym = elf->symtab_start + ELF_R_SYM(r->r_info); + void *loc = reloc_location(elf, sechdr, r); + uint32_t inst; ++ int32_t offset; + + switch (r_typ) { + case R_ARM_ABS32: +@@ -1750,6 +1758,10 @@ static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) + case R_ARM_PC24: + case R_ARM_CALL: + case R_ARM_JUMP24: ++ inst = TO_NATIVE(*(uint32_t *)loc); ++ offset = sign_extend32((inst & 0x00ffffff) << 2, 25); ++ r->r_addend = offset + sym->st_value + 8; ++ break; + case R_ARM_THM_CALL: + case R_ARM_THM_JUMP24: + case R_ARM_THM_JUMP19: +-- +2.39.2 + diff --git a/queue-5.15/modpost-fix-section-mismatch-message-for-r_arm_abs32.patch b/queue-5.15/modpost-fix-section-mismatch-message-for-r_arm_abs32.patch new file mode 100644 index 00000000000..fe8b56aff7f --- /dev/null +++ b/queue-5.15/modpost-fix-section-mismatch-message-for-r_arm_abs32.patch @@ -0,0 +1,133 @@ +From 40ac3eb2169b314542bc5f557f8abf8bdae31c0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 21:09:55 +0900 +Subject: modpost: fix section mismatch message for R_ARM_ABS32 + +From: Masahiro Yamada + +[ Upstream commit b7c63520f6703a25eebb4f8138fed764fcae1c6f ] + +addend_arm_rel() processes R_ARM_ABS32 in a wrong way. + +Here, test code. + + [test code 1] + + #include + + int __initdata foo; + int get_foo(void) { return foo; } + +If you compile it with ARM versatile_defconfig, modpost will show the +symbol name, (unknown). + + WARNING: modpost: vmlinux.o: section mismatch in reference: get_foo (section: .text) -> (unknown) (section: .init.data) + +(You need to use GNU linker instead of LLD to reproduce it.) + +If you compile it for other architectures, modpost will show the correct +symbol name. + + WARNING: modpost: vmlinux.o: section mismatch in reference: get_foo (section: .text) -> foo (section: .init.data) + +For R_ARM_ABS32, addend_arm_rel() sets r->r_addend to a wrong value. + +I just mimicked the code in arch/arm/kernel/module.c. + +However, there is more difficulty for ARM. + +Here, test code. + + [test code 2] + + #include + + int __initdata foo; + int get_foo(void) { return foo; } + + int __initdata bar; + int get_bar(void) { return bar; } + +With this commit applied, modpost will show the following messages +for ARM versatile_defconfig: + + WARNING: modpost: vmlinux.o: section mismatch in reference: get_foo (section: .text) -> foo (section: .init.data) + WARNING: modpost: vmlinux.o: section mismatch in reference: get_bar (section: .text) -> foo (section: .init.data) + +The reference from 'get_bar' to 'foo' seems wrong. + +I have no solution for this because it is true in assembly level. + +In the following output, relocation at 0x1c is no longer associated +with 'bar'. The two relocation entries point to the same symbol, and +the offset to 'bar' is encoded in the instruction 'r0, [r3, #4]'. + + Disassembly of section .text: + + 00000000 : + 0: e59f3004 ldr r3, [pc, #4] @ c + 4: e5930000 ldr r0, [r3] + 8: e12fff1e bx lr + c: 00000000 .word 0x00000000 + + 00000010 : + 10: e59f3004 ldr r3, [pc, #4] @ 1c + 14: e5930004 ldr r0, [r3, #4] + 18: e12fff1e bx lr + 1c: 00000000 .word 0x00000000 + + Relocation section '.rel.text' at offset 0x244 contains 2 entries: + Offset Info Type Sym.Value Sym. Name + 0000000c 00000c02 R_ARM_ABS32 00000000 .init.data + 0000001c 00000c02 R_ARM_ABS32 00000000 .init.data + +When find_elf_symbol() gets into a situation where relsym->st_name is +zero, there is no guarantee to get the symbol name as written in C. + +I am keeping the current logic because it is useful in many architectures, +but the symbol name is not always correct depending on the optimization. +I left some comments in find_tosym(). + +Fixes: 56a974fa2d59 ("kbuild: make better section mismatch reports on arm") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index b29af4ad08321..789e0ddb41ae4 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1302,6 +1302,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr, + if (relsym->st_name != 0) + return relsym; + ++ /* ++ * Strive to find a better symbol name, but the resulting name may not ++ * match the symbol referenced in the original code. ++ */ + relsym_secindex = get_secindex(elf, relsym); + for (sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { + if (get_secindex(elf, sym) != relsym_secindex) +@@ -1734,12 +1738,14 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) + static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) + { + unsigned int r_typ = ELF_R_TYPE(r->r_info); ++ Elf_Sym *sym = elf->symtab_start + ELF_R_SYM(r->r_info); ++ void *loc = reloc_location(elf, sechdr, r); ++ uint32_t inst; + + switch (r_typ) { + case R_ARM_ABS32: +- /* From ARM ABI: (S + A) | T */ +- r->r_addend = (int)(long) +- (elf->symtab_start + ELF_R_SYM(r->r_info)); ++ inst = TO_NATIVE(*(uint32_t *)loc); ++ r->r_addend = inst + sym->st_value; + break; + case R_ARM_PC24: + case R_ARM_CALL: +-- +2.39.2 + diff --git a/queue-5.15/modpost-remove-broken-calculation-of-exception_table.patch b/queue-5.15/modpost-remove-broken-calculation-of-exception_table.patch new file mode 100644 index 00000000000..d3ecbe96b1b --- /dev/null +++ b/queue-5.15/modpost-remove-broken-calculation-of-exception_table.patch @@ -0,0 +1,161 @@ +From b2fe5982b68981b4a2bc0b4941b9407f6aadc132 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 00:27:19 +0900 +Subject: modpost: remove broken calculation of exception_table_entry size + +From: Masahiro Yamada + +[ Upstream commit d0acc76a49aa917c1a455d11d32d34a01e8b2835 ] + +find_extable_entry_size() is completely broken. It has awesome comments +about how to calculate sizeof(struct exception_table_entry). + +It was based on these assumptions: + + - struct exception_table_entry has two fields + - both of the fields have the same size + +Then, we came up with this equation: + + (offset of the second field) * 2 == (size of struct) + +It was true for all architectures when commit 52dc0595d540 ("modpost: +handle relocations mismatch in __ex_table.") was applied. + +Our mathematics broke when commit 548acf19234d ("x86/mm: Expand the +exception table logic to allow new handling options") introduced the +third field. + +Now, the definition of exception_table_entry is highly arch-dependent. + +For x86, sizeof(struct exception_table_entry) is apparently 12, but +find_extable_entry_size() sets extable_entry_size to 8. + +I could fix it, but I do not see much value in this code. + +extable_entry_size is used just for selecting a slightly different +error message. + +If the first field ("insn") references to a non-executable section, + + The relocation at %s+0x%lx references + section "%s" which is not executable, IOW + it is not possible for the kernel to fault + at that address. Something is seriously wrong + and should be fixed. + +If the second field ("fixup") references to a non-executable section, + + The relocation at %s+0x%lx references + section "%s" which is not executable, IOW + the kernel will fault if it ever tries to + jump to it. Something is seriously wrong + and should be fixed. + +Merge the two error messages rather than adding even more complexity. + +Change fatal() to error() to make it continue running and catch more +possible errors. + +Fixes: 548acf19234d ("x86/mm: Expand the exception table logic to allow new handling options") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 60 +++---------------------------------------- + 1 file changed, 3 insertions(+), 57 deletions(-) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index b284ee01fdebb..b29af4ad08321 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1612,43 +1612,6 @@ static int is_executable_section(struct elf_info* elf, unsigned int section_inde + return ((elf->sechdrs[section_index].sh_flags & SHF_EXECINSTR) == SHF_EXECINSTR); + } + +-/* +- * We rely on a gross hack in section_rel[a]() calling find_extable_entry_size() +- * to know the sizeof(struct exception_table_entry) for the target architecture. +- */ +-static unsigned int extable_entry_size = 0; +-static void find_extable_entry_size(const char* const sec, const Elf_Rela* r) +-{ +- /* +- * If we're currently checking the second relocation within __ex_table, +- * that relocation offset tells us the offsetof(struct +- * exception_table_entry, fixup) which is equal to sizeof(struct +- * exception_table_entry) divided by two. We use that to our advantage +- * since there's no portable way to get that size as every architecture +- * seems to go with different sized types. Not pretty but better than +- * hard-coding the size for every architecture.. +- */ +- if (!extable_entry_size) +- extable_entry_size = r->r_offset * 2; +-} +- +-static inline bool is_extable_fault_address(Elf_Rela *r) +-{ +- /* +- * extable_entry_size is only discovered after we've handled the +- * _second_ relocation in __ex_table, so only abort when we're not +- * handling the first reloc and extable_entry_size is zero. +- */ +- if (r->r_offset && extable_entry_size == 0) +- fatal("extable_entry size hasn't been discovered!\n"); +- +- return ((r->r_offset == 0) || +- (r->r_offset % extable_entry_size == 0)); +-} +- +-#define is_second_extable_reloc(Start, Cur, Sec) \ +- (((Cur) == (Start) + 1) && (strcmp("__ex_table", (Sec)) == 0)) +- + static void report_extable_warnings(const char* modname, struct elf_info* elf, + const struct sectioncheck* const mismatch, + Elf_Rela* r, Elf_Sym* sym, +@@ -1705,22 +1668,9 @@ static void extable_mismatch_handler(const char* modname, struct elf_info *elf, + "You might get more information about where this is\n" + "coming from by using scripts/check_extable.sh %s\n", + fromsec, (long)r->r_offset, tosec, modname); +- else if (!is_executable_section(elf, get_secindex(elf, sym))) { +- if (is_extable_fault_address(r)) +- fatal("The relocation at %s+0x%lx references\n" +- "section \"%s\" which is not executable, IOW\n" +- "it is not possible for the kernel to fault\n" +- "at that address. Something is seriously wrong\n" +- "and should be fixed.\n", +- fromsec, (long)r->r_offset, tosec); +- else +- fatal("The relocation at %s+0x%lx references\n" +- "section \"%s\" which is not executable, IOW\n" +- "the kernel will fault if it ever tries to\n" +- "jump to it. Something is seriously wrong\n" +- "and should be fixed.\n", +- fromsec, (long)r->r_offset, tosec); +- } ++ else if (!is_executable_section(elf, get_secindex(elf, sym))) ++ error("%s+0x%lx references non-executable section '%s'\n", ++ fromsec, (long)r->r_offset, tosec); + } + + static void check_section_mismatch(const char *modname, struct elf_info *elf, +@@ -1871,8 +1821,6 @@ static void section_rela(const char *modname, struct elf_info *elf, + /* Skip special sections */ + if (is_shndx_special(sym->st_shndx)) + continue; +- if (is_second_extable_reloc(start, rela, fromsec)) +- find_extable_entry_size(fromsec, &r); + check_section_mismatch(modname, elf, &r, sym, fromsec); + } + } +@@ -1931,8 +1879,6 @@ static void section_rel(const char *modname, struct elf_info *elf, + /* Skip special sections */ + if (is_shndx_special(sym->st_shndx)) + continue; +- if (is_second_extable_reloc(start, rel, fromsec)) +- find_extable_entry_size(fromsec, &r); + check_section_mismatch(modname, elf, &r, sym, fromsec); + } + } +-- +2.39.2 + diff --git a/queue-5.15/net-axienet-move-reset-before-64-bit-dma-detection.patch b/queue-5.15/net-axienet-move-reset-before-64-bit-dma-detection.patch new file mode 100644 index 00000000000..faecbb44593 --- /dev/null +++ b/queue-5.15/net-axienet-move-reset-before-64-bit-dma-detection.patch @@ -0,0 +1,60 @@ +From dc2c39f68ae9f517cb5f13f5941196b1e988a42e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 22:22:45 +0300 +Subject: net: axienet: Move reset before 64-bit DMA detection + +From: Maxim Kochetkov + +[ Upstream commit f1bc9fc4a06de0108e0dca2a9a7e99ba1fc632f9 ] + +64-bit DMA detection will fail if axienet was started before (by boot +loader, boot ROM, etc). In this state axienet will not start properly. +XAXIDMA_TX_CDESC_OFFSET + 4 register (MM2S_CURDESC_MSB) is used to detect +64-bit DMA capability here. But datasheet says: When DMACR.RS is 1 +(axienet is in enabled state), CURDESC_PTR becomes Read Only (RO) and +is used to fetch the first descriptor. So iowrite32()/ioread32() trick +to this register to detect 64-bit DMA will not work. +So move axienet reset before 64-bit DMA detection. + +Fixes: f735c40ed93c ("net: axienet: Autodetect 64-bit DMA capability") +Signed-off-by: Maxim Kochetkov +Reviewed-by: Robert Hancock +Reviewed-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/20230622192245.116864-1-fido_max@inbox.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index fbbbcfe0e891e..e7f6c29b8dd82 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -2075,6 +2075,11 @@ static int axienet_probe(struct platform_device *pdev) + goto cleanup_clk; + } + ++ /* Reset core now that clocks are enabled, prior to accessing MDIO */ ++ ret = __axienet_device_reset(lp); ++ if (ret) ++ goto cleanup_clk; ++ + /* Autodetect the need for 64-bit DMA pointers. + * When the IP is configured for a bus width bigger than 32 bits, + * writing the MSB registers is mandatory, even if they are all 0. +@@ -2122,11 +2127,6 @@ static int axienet_probe(struct platform_device *pdev) + lp->coalesce_count_rx = XAXIDMA_DFT_RX_THRESHOLD; + lp->coalesce_count_tx = XAXIDMA_DFT_TX_THRESHOLD; + +- /* Reset core now that clocks are enabled, prior to accessing MDIO */ +- ret = __axienet_device_reset(lp); +- if (ret) +- goto cleanup_clk; +- + ret = axienet_mdio_setup(lp); + if (ret) + dev_warn(&pdev->dev, +-- +2.39.2 + diff --git a/queue-5.15/net-nfc-fix-use-after-free-caused-by-nfc_llcp_find_l.patch b/queue-5.15/net-nfc-fix-use-after-free-caused-by-nfc_llcp_find_l.patch new file mode 100644 index 00000000000..c751237ac96 --- /dev/null +++ b/queue-5.15/net-nfc-fix-use-after-free-caused-by-nfc_llcp_find_l.patch @@ -0,0 +1,558 @@ +From 5e4ccd95487026c4995cb4849eb7f7af07122550 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jun 2023 17:10:07 +0800 +Subject: net: nfc: Fix use-after-free caused by nfc_llcp_find_local + +From: Lin Ma + +[ Upstream commit 6709d4b7bc2e079241fdef15d1160581c5261c10 ] + +This commit fixes several use-after-free that caused by function +nfc_llcp_find_local(). For example, one UAF can happen when below buggy +time window occurs. + +// nfc_genl_llc_get_params | // nfc_unregister_device + | +dev = nfc_get_device(idx); | device_lock(...) +if (!dev) | dev->shutting_down = true; + return -ENODEV; | device_unlock(...); + | +device_lock(...); | // nfc_llcp_unregister_device + | nfc_llcp_find_local() +nfc_llcp_find_local(...); | + | local_cleanup() +if (!local) { | + rc = -ENODEV; | // nfc_llcp_local_put + goto exit; | kref_put(.., local_release) +} | + | // local_release + | list_del(&local->list) + // nfc_genl_send_params | kfree() + local->dev->idx !!!UAF!!! | + | + +and the crash trace for the one of the discussed UAF like: + +BUG: KASAN: slab-use-after-free in nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045 +Read of size 8 at addr ffff888105b0e410 by task 20114 + +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106 + print_address_description mm/kasan/report.c:319 [inline] + print_report+0xcc/0x620 mm/kasan/report.c:430 + kasan_report+0xb2/0xe0 mm/kasan/report.c:536 + nfc_genl_send_params net/nfc/netlink.c:999 [inline] + nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045 + genl_family_rcv_msg_doit.isra.0+0x1ee/0x2e0 net/netlink/genetlink.c:968 + genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] + genl_rcv_msg+0x503/0x7d0 net/netlink/genetlink.c:1065 + netlink_rcv_skb+0x161/0x430 net/netlink/af_netlink.c:2548 + genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076 + netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] + netlink_unicast+0x644/0x900 net/netlink/af_netlink.c:1365 + netlink_sendmsg+0x934/0xe70 net/netlink/af_netlink.c:1913 + sock_sendmsg_nosec net/socket.c:724 [inline] + sock_sendmsg+0x1b6/0x200 net/socket.c:747 + ____sys_sendmsg+0x6e9/0x890 net/socket.c:2501 + ___sys_sendmsg+0x110/0x1b0 net/socket.c:2555 + __sys_sendmsg+0xf7/0x1d0 net/socket.c:2584 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc +RIP: 0033:0x7f34640a2389 +RSP: 002b:00007f3463415168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 00007f34641c1f80 RCX: 00007f34640a2389 +RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006 +RBP: 00007f34640ed493 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +R13: 00007ffe38449ecf R14: 00007f3463415300 R15: 0000000000022000 + + +Allocated by task 20116: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + ____kasan_kmalloc mm/kasan/common.c:374 [inline] + __kasan_kmalloc+0x7f/0x90 mm/kasan/common.c:383 + kmalloc include/linux/slab.h:580 [inline] + kzalloc include/linux/slab.h:720 [inline] + nfc_llcp_register_device+0x49/0xa40 net/nfc/llcp_core.c:1567 + nfc_register_device+0x61/0x260 net/nfc/core.c:1124 + nci_register_device+0x776/0xb20 net/nfc/nci/core.c:1257 + virtual_ncidev_open+0x147/0x230 drivers/nfc/virtual_ncidev.c:148 + misc_open+0x379/0x4a0 drivers/char/misc.c:165 + chrdev_open+0x26c/0x780 fs/char_dev.c:414 + do_dentry_open+0x6c4/0x12a0 fs/open.c:920 + do_open fs/namei.c:3560 [inline] + path_openat+0x24fe/0x37e0 fs/namei.c:3715 + do_filp_open+0x1ba/0x410 fs/namei.c:3742 + do_sys_openat2+0x171/0x4c0 fs/open.c:1356 + do_sys_open fs/open.c:1372 [inline] + __do_sys_openat fs/open.c:1388 [inline] + __se_sys_openat fs/open.c:1383 [inline] + __x64_sys_openat+0x143/0x200 fs/open.c:1383 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Freed by task 20115: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521 + ____kasan_slab_free mm/kasan/common.c:236 [inline] + ____kasan_slab_free mm/kasan/common.c:200 [inline] + __kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244 + kasan_slab_free include/linux/kasan.h:162 [inline] + slab_free_hook mm/slub.c:1781 [inline] + slab_free_freelist_hook mm/slub.c:1807 [inline] + slab_free mm/slub.c:3787 [inline] + __kmem_cache_free+0x7a/0x190 mm/slub.c:3800 + local_release net/nfc/llcp_core.c:174 [inline] + kref_put include/linux/kref.h:65 [inline] + nfc_llcp_local_put net/nfc/llcp_core.c:182 [inline] + nfc_llcp_local_put net/nfc/llcp_core.c:177 [inline] + nfc_llcp_unregister_device+0x206/0x290 net/nfc/llcp_core.c:1620 + nfc_unregister_device+0x160/0x1d0 net/nfc/core.c:1179 + virtual_ncidev_close+0x52/0xa0 drivers/nfc/virtual_ncidev.c:163 + __fput+0x252/0xa20 fs/file_table.c:321 + task_work_run+0x174/0x270 kernel/task_work.c:179 + resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] + exit_to_user_mode_loop kernel/entry/common.c:171 [inline] + exit_to_user_mode_prepare+0x108/0x110 kernel/entry/common.c:204 + __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] + syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:297 + do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Last potentially related work creation: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + __kasan_record_aux_stack+0x95/0xb0 mm/kasan/generic.c:491 + kvfree_call_rcu+0x29/0xa80 kernel/rcu/tree.c:3328 + drop_sysctl_table+0x3be/0x4e0 fs/proc/proc_sysctl.c:1735 + unregister_sysctl_table.part.0+0x9c/0x190 fs/proc/proc_sysctl.c:1773 + unregister_sysctl_table+0x24/0x30 fs/proc/proc_sysctl.c:1753 + neigh_sysctl_unregister+0x5f/0x80 net/core/neighbour.c:3895 + addrconf_notify+0x140/0x17b0 net/ipv6/addrconf.c:3684 + notifier_call_chain+0xbe/0x210 kernel/notifier.c:87 + call_netdevice_notifiers_info+0xb5/0x150 net/core/dev.c:1937 + call_netdevice_notifiers_extack net/core/dev.c:1975 [inline] + call_netdevice_notifiers net/core/dev.c:1989 [inline] + dev_change_name+0x3c3/0x870 net/core/dev.c:1211 + dev_ifsioc+0x800/0xf70 net/core/dev_ioctl.c:376 + dev_ioctl+0x3d9/0xf80 net/core/dev_ioctl.c:542 + sock_do_ioctl+0x160/0x260 net/socket.c:1213 + sock_ioctl+0x3f9/0x670 net/socket.c:1316 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:870 [inline] + __se_sys_ioctl fs/ioctl.c:856 [inline] + __x64_sys_ioctl+0x19e/0x210 fs/ioctl.c:856 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +The buggy address belongs to the object at ffff888105b0e400 + which belongs to the cache kmalloc-1k of size 1024 +The buggy address is located 16 bytes inside of + freed 1024-byte region [ffff888105b0e400, ffff888105b0e800) + +The buggy address belongs to the physical page: +head:ffffea000416c200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 +flags: 0x200000000010200(slab|head|node=0|zone=2) +raw: 0200000000010200 ffff8881000430c0 ffffea00044c7010 ffffea0004510e10 +raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: + ffff888105b0e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff888105b0e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +>ffff888105b0e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff888105b0e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff888105b0e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + +In summary, this patch solves those use-after-free by + +1. Re-implement the nfc_llcp_find_local(). The current version does not +grab the reference when getting the local from the linked list. For +example, the llcp_sock_bind() gets the reference like below: + +// llcp_sock_bind() + + local = nfc_llcp_find_local(dev); // A + ..... \ + | raceable + ..... / + llcp_sock->local = nfc_llcp_local_get(local); // B + +There is an apparent race window that one can drop the reference +and free the local object fetched in (A) before (B) gets the reference. + +2. Some callers of the nfc_llcp_find_local() do not grab the reference +at all. For example, the nfc_genl_llc_{{get/set}_params/sdreq} functions. +We add the nfc_llcp_local_put() for them. Moreover, we add the necessary +error handling function to put the reference. + +3. Add the nfc_llcp_remove_local() helper. The local object is removed +from the linked list in local_release() when all reference is gone. This +patch removes it when nfc_llcp_unregister_device() is called. + +Therefore, every caller of nfc_llcp_find_local() will get a reference +even when the nfc_llcp_unregister_device() is called. This promises no +use-after-free for the local object is ever possible. + +Fixes: 52feb444a903 ("NFC: Extend netlink interface for LTO, RW, and MIUX parameters support") +Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket") +Signed-off-by: Lin Ma +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/llcp.h | 1 - + net/nfc/llcp_commands.c | 12 +++++++--- + net/nfc/llcp_core.c | 49 +++++++++++++++++++++++++++++++++++------ + net/nfc/llcp_sock.c | 18 ++++++++------- + net/nfc/netlink.c | 20 ++++++++++++----- + net/nfc/nfc.h | 1 + + 6 files changed, 77 insertions(+), 24 deletions(-) + +diff --git a/net/nfc/llcp.h b/net/nfc/llcp.h +index d49d4bf2e37c8..a81893bc06ce8 100644 +--- a/net/nfc/llcp.h ++++ b/net/nfc/llcp.h +@@ -202,7 +202,6 @@ void nfc_llcp_sock_link(struct llcp_sock_list *l, struct sock *s); + void nfc_llcp_sock_unlink(struct llcp_sock_list *l, struct sock *s); + void nfc_llcp_socket_remote_param_init(struct nfc_llcp_sock *sock); + struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev); +-struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local); + int nfc_llcp_local_put(struct nfc_llcp_local *local); + u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local, + struct nfc_llcp_sock *sock); +diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c +index bb9f40563ff63..5b8754ae7d3af 100644 +--- a/net/nfc/llcp_commands.c ++++ b/net/nfc/llcp_commands.c +@@ -361,6 +361,7 @@ int nfc_llcp_send_symm(struct nfc_dev *dev) + struct sk_buff *skb; + struct nfc_llcp_local *local; + u16 size = 0; ++ int err; + + pr_debug("Sending SYMM\n"); + +@@ -372,8 +373,10 @@ int nfc_llcp_send_symm(struct nfc_dev *dev) + size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE; + + skb = alloc_skb(size, GFP_KERNEL); +- if (skb == NULL) +- return -ENOMEM; ++ if (skb == NULL) { ++ err = -ENOMEM; ++ goto out; ++ } + + skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE); + +@@ -383,8 +386,11 @@ int nfc_llcp_send_symm(struct nfc_dev *dev) + + nfc_llcp_send_to_raw_sock(local, skb, NFC_DIRECTION_TX); + +- return nfc_data_exchange(dev, local->target_idx, skb, ++ err = nfc_data_exchange(dev, local->target_idx, skb, + nfc_llcp_recv, local); ++out: ++ nfc_llcp_local_put(local); ++ return err; + } + + int nfc_llcp_send_connect(struct nfc_llcp_sock *sock) +diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c +index fd43e75abd948..ddfd159f64e13 100644 +--- a/net/nfc/llcp_core.c ++++ b/net/nfc/llcp_core.c +@@ -17,6 +17,8 @@ + static u8 llcp_magic[3] = {0x46, 0x66, 0x6d}; + + static LIST_HEAD(llcp_devices); ++/* Protects llcp_devices list */ ++static DEFINE_SPINLOCK(llcp_devices_lock); + + static void nfc_llcp_rx_skb(struct nfc_llcp_local *local, struct sk_buff *skb); + +@@ -143,7 +145,7 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool device, + write_unlock(&local->raw_sockets.lock); + } + +-struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local) ++static struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local) + { + kref_get(&local->ref); + +@@ -171,7 +173,6 @@ static void local_release(struct kref *ref) + + local = container_of(ref, struct nfc_llcp_local, ref); + +- list_del(&local->list); + local_cleanup(local); + kfree(local); + } +@@ -284,12 +285,33 @@ static void nfc_llcp_sdreq_timer(struct timer_list *t) + struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev) + { + struct nfc_llcp_local *local; ++ struct nfc_llcp_local *res = NULL; + ++ spin_lock(&llcp_devices_lock); + list_for_each_entry(local, &llcp_devices, list) +- if (local->dev == dev) ++ if (local->dev == dev) { ++ res = nfc_llcp_local_get(local); ++ break; ++ } ++ spin_unlock(&llcp_devices_lock); ++ ++ return res; ++} ++ ++static struct nfc_llcp_local *nfc_llcp_remove_local(struct nfc_dev *dev) ++{ ++ struct nfc_llcp_local *local, *tmp; ++ ++ spin_lock(&llcp_devices_lock); ++ list_for_each_entry_safe(local, tmp, &llcp_devices, list) ++ if (local->dev == dev) { ++ list_del(&local->list); ++ spin_unlock(&llcp_devices_lock); + return local; ++ } ++ spin_unlock(&llcp_devices_lock); + +- pr_debug("No device found\n"); ++ pr_warn("Shutting down device not found\n"); + + return NULL; + } +@@ -610,12 +632,15 @@ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len) + + *general_bytes_len = local->gb_len; + ++ nfc_llcp_local_put(local); ++ + return local->gb; + } + + int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len) + { + struct nfc_llcp_local *local; ++ int err; + + if (gb_len < 3 || gb_len > NFC_MAX_GT_LEN) + return -EINVAL; +@@ -632,12 +657,16 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len) + + if (memcmp(local->remote_gb, llcp_magic, 3)) { + pr_err("MAC does not support LLCP\n"); +- return -EINVAL; ++ err = -EINVAL; ++ goto out; + } + +- return nfc_llcp_parse_gb_tlv(local, ++ err = nfc_llcp_parse_gb_tlv(local, + &local->remote_gb[3], + local->remote_gb_len - 3); ++out: ++ nfc_llcp_local_put(local); ++ return err; + } + + static u8 nfc_llcp_dsap(const struct sk_buff *pdu) +@@ -1527,6 +1556,8 @@ int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb) + + __nfc_llcp_recv(local, skb); + ++ nfc_llcp_local_put(local); ++ + return 0; + } + +@@ -1543,6 +1574,8 @@ void nfc_llcp_mac_is_down(struct nfc_dev *dev) + + /* Close and purge all existing sockets */ + nfc_llcp_socket_release(local, true, 0); ++ ++ nfc_llcp_local_put(local); + } + + void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx, +@@ -1568,6 +1601,8 @@ void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx, + mod_timer(&local->link_timer, + jiffies + msecs_to_jiffies(local->remote_lto)); + } ++ ++ nfc_llcp_local_put(local); + } + + int nfc_llcp_register_device(struct nfc_dev *ndev) +@@ -1618,7 +1653,7 @@ int nfc_llcp_register_device(struct nfc_dev *ndev) + + void nfc_llcp_unregister_device(struct nfc_dev *dev) + { +- struct nfc_llcp_local *local = nfc_llcp_find_local(dev); ++ struct nfc_llcp_local *local = nfc_llcp_remove_local(dev); + + if (local == NULL) { + pr_debug("No such device\n"); +diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c +index fdf0856182c65..6e1fba2084930 100644 +--- a/net/nfc/llcp_sock.c ++++ b/net/nfc/llcp_sock.c +@@ -99,7 +99,7 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen) + } + + llcp_sock->dev = dev; +- llcp_sock->local = nfc_llcp_local_get(local); ++ llcp_sock->local = local; + llcp_sock->nfc_protocol = llcp_addr.nfc_protocol; + llcp_sock->service_name_len = min_t(unsigned int, + llcp_addr.service_name_len, +@@ -181,7 +181,7 @@ static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr *addr, + } + + llcp_sock->dev = dev; +- llcp_sock->local = nfc_llcp_local_get(local); ++ llcp_sock->local = local; + llcp_sock->nfc_protocol = llcp_addr.nfc_protocol; + + nfc_llcp_sock_link(&local->raw_sockets, sk); +@@ -698,22 +698,22 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, + if (dev->dep_link_up == false) { + ret = -ENOLINK; + device_unlock(&dev->dev); +- goto put_dev; ++ goto sock_llcp_put_local; + } + device_unlock(&dev->dev); + + if (local->rf_mode == NFC_RF_INITIATOR && + addr->target_idx != local->target_idx) { + ret = -ENOLINK; +- goto put_dev; ++ goto sock_llcp_put_local; + } + + llcp_sock->dev = dev; +- llcp_sock->local = nfc_llcp_local_get(local); ++ llcp_sock->local = local; + llcp_sock->ssap = nfc_llcp_get_local_ssap(local); + if (llcp_sock->ssap == LLCP_SAP_MAX) { + ret = -ENOMEM; +- goto sock_llcp_put_local; ++ goto sock_llcp_nullify; + } + + llcp_sock->reserved_ssap = llcp_sock->ssap; +@@ -759,11 +759,13 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, + sock_llcp_release: + nfc_llcp_put_ssap(local, llcp_sock->ssap); + +-sock_llcp_put_local: +- nfc_llcp_local_put(llcp_sock->local); ++sock_llcp_nullify: + llcp_sock->local = NULL; + llcp_sock->dev = NULL; + ++sock_llcp_put_local: ++ nfc_llcp_local_put(local); ++ + put_dev: + nfc_put_device(dev); + +diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c +index 9bc0ab759ea44..eb4f70a827e4d 100644 +--- a/net/nfc/netlink.c ++++ b/net/nfc/netlink.c +@@ -1039,11 +1039,14 @@ static int nfc_genl_llc_get_params(struct sk_buff *skb, struct genl_info *info) + msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!msg) { + rc = -ENOMEM; +- goto exit; ++ goto put_local; + } + + rc = nfc_genl_send_params(msg, local, info->snd_portid, info->snd_seq); + ++put_local: ++ nfc_llcp_local_put(local); ++ + exit: + device_unlock(&dev->dev); + +@@ -1105,7 +1108,7 @@ static int nfc_genl_llc_set_params(struct sk_buff *skb, struct genl_info *info) + if (info->attrs[NFC_ATTR_LLC_PARAM_LTO]) { + if (dev->dep_link_up) { + rc = -EINPROGRESS; +- goto exit; ++ goto put_local; + } + + local->lto = nla_get_u8(info->attrs[NFC_ATTR_LLC_PARAM_LTO]); +@@ -1117,6 +1120,9 @@ static int nfc_genl_llc_set_params(struct sk_buff *skb, struct genl_info *info) + if (info->attrs[NFC_ATTR_LLC_PARAM_MIUX]) + local->miux = cpu_to_be16(miux); + ++put_local: ++ nfc_llcp_local_put(local); ++ + exit: + device_unlock(&dev->dev); + +@@ -1172,7 +1178,7 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info) + + if (rc != 0) { + rc = -EINVAL; +- goto exit; ++ goto put_local; + } + + if (!sdp_attrs[NFC_SDP_ATTR_URI]) +@@ -1191,7 +1197,7 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info) + sdreq = nfc_llcp_build_sdreq_tlv(tid, uri, uri_len); + if (sdreq == NULL) { + rc = -ENOMEM; +- goto exit; ++ goto put_local; + } + + tlvs_len += sdreq->tlv_len; +@@ -1201,10 +1207,14 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info) + + if (hlist_empty(&sdreq_list)) { + rc = -EINVAL; +- goto exit; ++ goto put_local; + } + + rc = nfc_llcp_send_snl_sdreq(local, &sdreq_list, tlvs_len); ++ ++put_local: ++ nfc_llcp_local_put(local); ++ + exit: + device_unlock(&dev->dev); + +diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h +index de2ec66d7e83a..0b1e6466f4fbf 100644 +--- a/net/nfc/nfc.h ++++ b/net/nfc/nfc.h +@@ -52,6 +52,7 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len); + u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len); + int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb); + struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev); ++int nfc_llcp_local_put(struct nfc_llcp_local *local); + int __init nfc_llcp_init(void); + void nfc_llcp_exit(void); + void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp); +-- +2.39.2 + diff --git a/queue-5.15/net-stmmac-fix-double-serdes-powerdown.patch b/queue-5.15/net-stmmac-fix-double-serdes-powerdown.patch new file mode 100644 index 00000000000..7d1671e2211 --- /dev/null +++ b/queue-5.15/net-stmmac-fix-double-serdes-powerdown.patch @@ -0,0 +1,50 @@ +From 5bcc28bce4e6233d7782ecbe68e190c4f4488ec2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 15:55:37 +0200 +Subject: net: stmmac: fix double serdes powerdown + +From: Bartosz Golaszewski + +[ Upstream commit c4fc88ad2a765224a648db8ab35f125e120fe41b ] + +Commit 49725ffc15fc ("net: stmmac: power up/down serdes in +stmmac_open/release") correctly added a call to the serdes_powerdown() +callback to stmmac_release() but did not remove the one from +stmmac_remove() which leads to a doubled call to serdes_powerdown(). + +This can lead to all kinds of problems: in the case of the qcom ethqos +driver, it caused an unbalanced regulator disable splat. + +Fixes: 49725ffc15fc ("net: stmmac: power up/down serdes in stmmac_open/release") +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Jiri Pirko +Acked-by: Junxiao Chang +Reviewed-by: Andrew Halaney +Tested-by: Andrew Halaney +Link: https://lore.kernel.org/r/20230621135537.376649-1-brgl@bgdev.pl +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 179f8d196c890..a43628dd1f4c2 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -7318,12 +7318,6 @@ int stmmac_dvr_remove(struct device *dev) + netif_carrier_off(ndev); + unregister_netdev(ndev); + +- /* Serdes power down needs to happen after VLAN filter +- * is deleted that is triggered by unregister_netdev(). +- */ +- if (priv->plat->serdes_powerdown) +- priv->plat->serdes_powerdown(ndev, priv->plat->bsp_priv); +- + #ifdef CONFIG_DEBUG_FS + stmmac_exit_fs(ndev); + #endif +-- +2.39.2 + diff --git a/queue-5.15/netfilter-conntrack-dccp-copy-entire-header-to-stack.patch b/queue-5.15/netfilter-conntrack-dccp-copy-entire-header-to-stack.patch new file mode 100644 index 00000000000..c85ea1622ad --- /dev/null +++ b/queue-5.15/netfilter-conntrack-dccp-copy-entire-header-to-stack.patch @@ -0,0 +1,148 @@ +From 1c64834ed6b8406301ce72cb275b908ae8002d9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 17:56:53 +0200 +Subject: netfilter: conntrack: dccp: copy entire header to stack buffer, not + just basic one + +From: Florian Westphal + +[ Upstream commit ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30 ] + +Eric Dumazet says: + nf_conntrack_dccp_packet() has an unique: + + dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); + + And nothing more is 'pulled' from the packet, depending on the content. + dh->dccph_doff, and/or dh->dccph_x ...) + So dccp_ack_seq() is happily reading stuff past the _dh buffer. + +BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 +Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 +[..] + +Fix this by increasing the stack buffer to also include room for +the extra sequence numbers and all the known dccp packet type headers, +then pull again after the initial validation of the basic header. + +While at it, mark packets invalid that lack 48bit sequence bit but +where RFC says the type MUST use them. + +Compile tested only. + +v2: first skb_header_pointer() now needs to adjust the size to + only pull the generic header. (Eric) + +Heads-up: I intend to remove dccp conntrack support later this year. + +Fixes: 2bc780499aa3 ("[NETFILTER]: nf_conntrack: add DCCP protocol support") +Reported-by: Eric Dumazet +Signed-off-by: Florian Westphal +Reviewed-by: Eric Dumazet +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_dccp.c | 52 +++++++++++++++++++++++-- + 1 file changed, 49 insertions(+), 3 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c +index c1557d47ccd1e..d4fd626d2b8c3 100644 +--- a/net/netfilter/nf_conntrack_proto_dccp.c ++++ b/net/netfilter/nf_conntrack_proto_dccp.c +@@ -432,9 +432,19 @@ static bool dccp_error(const struct dccp_hdr *dh, + struct sk_buff *skb, unsigned int dataoff, + const struct nf_hook_state *state) + { ++ static const unsigned long require_seq48 = 1 << DCCP_PKT_REQUEST | ++ 1 << DCCP_PKT_RESPONSE | ++ 1 << DCCP_PKT_CLOSEREQ | ++ 1 << DCCP_PKT_CLOSE | ++ 1 << DCCP_PKT_RESET | ++ 1 << DCCP_PKT_SYNC | ++ 1 << DCCP_PKT_SYNCACK; + unsigned int dccp_len = skb->len - dataoff; + unsigned int cscov; + const char *msg; ++ u8 type; ++ ++ BUILD_BUG_ON(DCCP_PKT_INVALID >= BITS_PER_LONG); + + if (dh->dccph_doff * 4 < sizeof(struct dccp_hdr) || + dh->dccph_doff * 4 > dccp_len) { +@@ -459,34 +469,70 @@ static bool dccp_error(const struct dccp_hdr *dh, + goto out_invalid; + } + +- if (dh->dccph_type >= DCCP_PKT_INVALID) { ++ type = dh->dccph_type; ++ if (type >= DCCP_PKT_INVALID) { + msg = "nf_ct_dccp: reserved packet type "; + goto out_invalid; + } ++ ++ if (test_bit(type, &require_seq48) && !dh->dccph_x) { ++ msg = "nf_ct_dccp: type lacks 48bit sequence numbers"; ++ goto out_invalid; ++ } ++ + return false; + out_invalid: + nf_l4proto_log_invalid(skb, state, IPPROTO_DCCP, "%s", msg); + return true; + } + ++struct nf_conntrack_dccp_buf { ++ struct dccp_hdr dh; /* generic header part */ ++ struct dccp_hdr_ext ext; /* optional depending dh->dccph_x */ ++ union { /* depends on header type */ ++ struct dccp_hdr_ack_bits ack; ++ struct dccp_hdr_request req; ++ struct dccp_hdr_response response; ++ struct dccp_hdr_reset rst; ++ } u; ++}; ++ ++static struct dccp_hdr * ++dccp_header_pointer(const struct sk_buff *skb, int offset, const struct dccp_hdr *dh, ++ struct nf_conntrack_dccp_buf *buf) ++{ ++ unsigned int hdrlen = __dccp_hdr_len(dh); ++ ++ if (hdrlen > sizeof(*buf)) ++ return NULL; ++ ++ return skb_header_pointer(skb, offset, hdrlen, buf); ++} ++ + int nf_conntrack_dccp_packet(struct nf_conn *ct, struct sk_buff *skb, + unsigned int dataoff, + enum ip_conntrack_info ctinfo, + const struct nf_hook_state *state) + { + enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); +- struct dccp_hdr _dh, *dh; ++ struct nf_conntrack_dccp_buf _dh; + u_int8_t type, old_state, new_state; + enum ct_dccp_roles role; + unsigned int *timeouts; ++ struct dccp_hdr *dh; + +- dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); ++ dh = skb_header_pointer(skb, dataoff, sizeof(*dh), &_dh.dh); + if (!dh) + return NF_DROP; + + if (dccp_error(dh, skb, dataoff, state)) + return -NF_ACCEPT; + ++ /* pull again, including possible 48 bit sequences and subtype header */ ++ dh = dccp_header_pointer(skb, dataoff, dh, &_dh); ++ if (!dh) ++ return NF_DROP; ++ + type = dh->dccph_type; + if (!nf_ct_is_confirmed(ct) && !dccp_new(ct, skb, dh, state)) + return -NF_ACCEPT; +-- +2.39.2 + diff --git a/queue-5.15/netfilter-nf_conntrack_sip-fix-the-ct_sip_parse_nume.patch b/queue-5.15/netfilter-nf_conntrack_sip-fix-the-ct_sip_parse_nume.patch new file mode 100644 index 00000000000..9446b4c8a81 --- /dev/null +++ b/queue-5.15/netfilter-nf_conntrack_sip-fix-the-ct_sip_parse_nume.patch @@ -0,0 +1,53 @@ +From 8e545baefdca7b933318c3b386ea4ca5079d98e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 11:23:46 +0000 +Subject: netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() + return value. + +From: Ilia.Gavrilov + +[ Upstream commit f188d30087480eab421cd8ca552fb15f55d57f4d ] + +ct_sip_parse_numerical_param() returns only 0 or 1 now. +But process_register_request() and process_register_response() imply +checking for a negative value if parsing of a numerical header parameter +failed. +The invocation in nf_nat_sip() looks correct: + if (ct_sip_parse_numerical_param(...) > 0 && + ...) { ... } + +Make the return value of the function ct_sip_parse_numerical_param() +a tristate to fix all the cases +a) return 1 if value is found; *val is set +b) return 0 if value is not found; *val is unchanged +c) return -1 on error; *val is undefined + +Found by InfoTeCS on behalf of Linux Verification Center +(linuxtesting.org) with SVACE. + +Fixes: 0f32a40fc91a ("[NETFILTER]: nf_conntrack_sip: create signalling expectations") +Signed-off-by: Ilia.Gavrilov +Reviewed-by: Simon Horman +Reviewed-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_sip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c +index 78fd9122b70c7..751df19fe0f8a 100644 +--- a/net/netfilter/nf_conntrack_sip.c ++++ b/net/netfilter/nf_conntrack_sip.c +@@ -611,7 +611,7 @@ int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr, + start += strlen(name); + *val = simple_strtoul(start, &end, 0); + if (start == end) +- return 0; ++ return -1; + if (matchoff && matchlen) { + *matchoff = start - dptr; + *matchlen = end - start; +-- +2.39.2 + diff --git a/queue-5.15/netlink-add-__sock_i_ino-for-__netlink_diag_dump.patch b/queue-5.15/netlink-add-__sock_i_ino-for-__netlink_diag_dump.patch new file mode 100644 index 00000000000..b5cc824ca1e --- /dev/null +++ b/queue-5.15/netlink-add-__sock_i_ino-for-__netlink_diag_dump.patch @@ -0,0 +1,152 @@ +From a0281ecc26a50aa5b86a30937de421ed98df5e7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 09:43:13 -0700 +Subject: netlink: Add __sock_i_ino() for __netlink_diag_dump(). + +From: Kuniyuki Iwashima + +[ Upstream commit 25a9c8a4431c364f97f75558cb346d2ad3f53fbb ] + +syzbot reported a warning in __local_bh_enable_ip(). [0] + +Commit 8d61f926d420 ("netlink: fix potential deadlock in +netlink_set_err()") converted read_lock(&nl_table_lock) to +read_lock_irqsave() in __netlink_diag_dump() to prevent a deadlock. + +However, __netlink_diag_dump() calls sock_i_ino() that uses +read_lock_bh() and read_unlock_bh(). If CONFIG_TRACE_IRQFLAGS=y, +read_unlock_bh() finally enables IRQ even though it should stay +disabled until the following read_unlock_irqrestore(). + +Using read_lock() in sock_i_ino() would trigger a lockdep splat +in another place that was fixed in commit f064af1e500a ("net: fix +a lockdep splat"), so let's add __sock_i_ino() that would be safe +to use under BH disabled. + +[0]: +WARNING: CPU: 0 PID: 5012 at kernel/softirq.c:376 __local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376 +Modules linked in: +CPU: 0 PID: 5012 Comm: syz-executor487 Not tainted 6.4.0-rc7-syzkaller-00202-g6f68fc395f49 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 +RIP: 0010:__local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376 +Code: 45 bf 01 00 00 00 e8 91 5b 0a 00 e8 3c 15 3d 00 fb 65 8b 05 ec e9 b5 7e 85 c0 74 58 5b 5d c3 65 8b 05 b2 b6 b4 7e 85 c0 75 a2 <0f> 0b eb 9e e8 89 15 3d 00 eb 9f 48 89 ef e8 6f 49 18 00 eb a8 0f +RSP: 0018:ffffc90003a1f3d0 EFLAGS: 00010046 +RAX: 0000000000000000 RBX: 0000000000000201 RCX: 1ffffffff1cf5996 +RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff8805c6f3 +RBP: ffffffff8805c6f3 R08: 0000000000000001 R09: ffff8880152b03a3 +R10: ffffed1002a56074 R11: 0000000000000005 R12: 00000000000073e4 +R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000 +FS: 0000555556726300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000000000045ad50 CR3: 000000007c646000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + sock_i_ino+0x83/0xa0 net/core/sock.c:2559 + __netlink_diag_dump+0x45c/0x790 net/netlink/diag.c:171 + netlink_diag_dump+0xd6/0x230 net/netlink/diag.c:207 + netlink_dump+0x570/0xc50 net/netlink/af_netlink.c:2269 + __netlink_dump_start+0x64b/0x910 net/netlink/af_netlink.c:2374 + netlink_dump_start include/linux/netlink.h:329 [inline] + netlink_diag_handler_dump+0x1ae/0x250 net/netlink/diag.c:238 + __sock_diag_cmd net/core/sock_diag.c:238 [inline] + sock_diag_rcv_msg+0x31e/0x440 net/core/sock_diag.c:269 + netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2547 + sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280 + netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] + netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365 + netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1914 + sock_sendmsg_nosec net/socket.c:724 [inline] + sock_sendmsg+0xde/0x190 net/socket.c:747 + ____sys_sendmsg+0x71c/0x900 net/socket.c:2503 + ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557 + __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f5303aaabb9 +Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007ffc7506e548 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5303aaabb9 +RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003 +RBP: 00007f5303a6ed60 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5303a6edf0 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + + +Fixes: 8d61f926d420 ("netlink: fix potential deadlock in netlink_set_err()") +Reported-by: syzbot+5da61cf6a9bc1902d422@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=5da61cf6a9bc1902d422 +Suggested-by: Eric Dumazet +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230626164313.52528-1-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/sock.h | 1 + + net/core/sock.c | 17 ++++++++++++++--- + net/netlink/diag.c | 2 +- + 3 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/include/net/sock.h b/include/net/sock.h +index 0eb6a4d07a4d1..93a6717213aeb 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -2004,6 +2004,7 @@ static inline void sock_graft(struct sock *sk, struct socket *parent) + } + + kuid_t sock_i_uid(struct sock *sk); ++unsigned long __sock_i_ino(struct sock *sk); + unsigned long sock_i_ino(struct sock *sk); + + static inline kuid_t sock_net_uid(const struct net *net, const struct sock *sk) +diff --git a/net/core/sock.c b/net/core/sock.c +index 93fb3d64f48ee..cf1e437ae4875 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2324,13 +2324,24 @@ kuid_t sock_i_uid(struct sock *sk) + } + EXPORT_SYMBOL(sock_i_uid); + +-unsigned long sock_i_ino(struct sock *sk) ++unsigned long __sock_i_ino(struct sock *sk) + { + unsigned long ino; + +- read_lock_bh(&sk->sk_callback_lock); ++ read_lock(&sk->sk_callback_lock); + ino = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_ino : 0; +- read_unlock_bh(&sk->sk_callback_lock); ++ read_unlock(&sk->sk_callback_lock); ++ return ino; ++} ++EXPORT_SYMBOL(__sock_i_ino); ++ ++unsigned long sock_i_ino(struct sock *sk) ++{ ++ unsigned long ino; ++ ++ local_bh_disable(); ++ ino = __sock_i_ino(sk); ++ local_bh_enable(); + return ino; + } + EXPORT_SYMBOL(sock_i_ino); +diff --git a/net/netlink/diag.c b/net/netlink/diag.c +index 4143b2ea4195a..e4f21b1067bcc 100644 +--- a/net/netlink/diag.c ++++ b/net/netlink/diag.c +@@ -168,7 +168,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, + NLM_F_MULTI, +- sock_i_ino(sk)) < 0) { ++ __sock_i_ino(sk)) < 0) { + ret = 1; + break; + } +-- +2.39.2 + diff --git a/queue-5.15/netlink-do-not-hard-code-device-address-lenth-in-fdb.patch b/queue-5.15/netlink-do-not-hard-code-device-address-lenth-in-fdb.patch new file mode 100644 index 00000000000..ce0cd2cfe06 --- /dev/null +++ b/queue-5.15/netlink-do-not-hard-code-device-address-lenth-in-fdb.patch @@ -0,0 +1,157 @@ +From c786d72fb7e1664dcc41cc9b64a66eea547bb968 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 17:47:20 +0000 +Subject: netlink: do not hard code device address lenth in fdb dumps + +From: Eric Dumazet + +[ Upstream commit aa5406950726e336c5c9585b09799a734b6e77bf ] + +syzbot reports that some netdev devices do not have a six bytes +address [1] + +Replace ETH_ALEN by dev->addr_len. + +[1] (Case of a device where dev->addr_len = 4) + +BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] +BUG: KMSAN: kernel-infoleak in copyout+0xb8/0x100 lib/iov_iter.c:169 +instrument_copy_to_user include/linux/instrumented.h:114 [inline] +copyout+0xb8/0x100 lib/iov_iter.c:169 +_copy_to_iter+0x6d8/0x1d00 lib/iov_iter.c:536 +copy_to_iter include/linux/uio.h:206 [inline] +simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:513 +__skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419 +skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:527 +skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline] +netlink_recvmsg+0x4ae/0x15a0 net/netlink/af_netlink.c:1970 +sock_recvmsg_nosec net/socket.c:1019 [inline] +sock_recvmsg net/socket.c:1040 [inline] +____sys_recvmsg+0x283/0x7f0 net/socket.c:2722 +___sys_recvmsg+0x223/0x840 net/socket.c:2764 +do_recvmmsg+0x4f9/0xfd0 net/socket.c:2858 +__sys_recvmmsg net/socket.c:2937 [inline] +__do_sys_recvmmsg net/socket.c:2960 [inline] +__se_sys_recvmmsg net/socket.c:2953 [inline] +__x64_sys_recvmmsg+0x397/0x490 net/socket.c:2953 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Uninit was stored to memory at: +__nla_put lib/nlattr.c:1009 [inline] +nla_put+0x1c6/0x230 lib/nlattr.c:1067 +nlmsg_populate_fdb_fill+0x2b8/0x600 net/core/rtnetlink.c:4071 +nlmsg_populate_fdb net/core/rtnetlink.c:4418 [inline] +ndo_dflt_fdb_dump+0x616/0x840 net/core/rtnetlink.c:4456 +rtnl_fdb_dump+0x14ff/0x1fc0 net/core/rtnetlink.c:4629 +netlink_dump+0x9d1/0x1310 net/netlink/af_netlink.c:2268 +netlink_recvmsg+0xc5c/0x15a0 net/netlink/af_netlink.c:1995 +sock_recvmsg_nosec+0x7a/0x120 net/socket.c:1019 +____sys_recvmsg+0x664/0x7f0 net/socket.c:2720 +___sys_recvmsg+0x223/0x840 net/socket.c:2764 +do_recvmmsg+0x4f9/0xfd0 net/socket.c:2858 +__sys_recvmmsg net/socket.c:2937 [inline] +__do_sys_recvmmsg net/socket.c:2960 [inline] +__se_sys_recvmmsg net/socket.c:2953 [inline] +__x64_sys_recvmmsg+0x397/0x490 net/socket.c:2953 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Uninit was created at: +slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:716 +slab_alloc_node mm/slub.c:3451 [inline] +__kmem_cache_alloc_node+0x4ff/0x8b0 mm/slub.c:3490 +kmalloc_trace+0x51/0x200 mm/slab_common.c:1057 +kmalloc include/linux/slab.h:559 [inline] +__hw_addr_create net/core/dev_addr_lists.c:60 [inline] +__hw_addr_add_ex+0x2e5/0x9e0 net/core/dev_addr_lists.c:118 +__dev_mc_add net/core/dev_addr_lists.c:867 [inline] +dev_mc_add+0x9a/0x130 net/core/dev_addr_lists.c:885 +igmp6_group_added+0x267/0xbc0 net/ipv6/mcast.c:680 +ipv6_mc_up+0x296/0x3b0 net/ipv6/mcast.c:2754 +ipv6_mc_remap+0x1e/0x30 net/ipv6/mcast.c:2708 +addrconf_type_change net/ipv6/addrconf.c:3731 [inline] +addrconf_notify+0x4d3/0x1d90 net/ipv6/addrconf.c:3699 +notifier_call_chain kernel/notifier.c:93 [inline] +raw_notifier_call_chain+0xe4/0x430 kernel/notifier.c:461 +call_netdevice_notifiers_info net/core/dev.c:1935 [inline] +call_netdevice_notifiers_extack net/core/dev.c:1973 [inline] +call_netdevice_notifiers+0x1ee/0x2d0 net/core/dev.c:1987 +bond_enslave+0xccd/0x53f0 drivers/net/bonding/bond_main.c:1906 +do_set_master net/core/rtnetlink.c:2626 [inline] +rtnl_newlink_create net/core/rtnetlink.c:3460 [inline] +__rtnl_newlink net/core/rtnetlink.c:3660 [inline] +rtnl_newlink+0x378c/0x40e0 net/core/rtnetlink.c:3673 +rtnetlink_rcv_msg+0x16a6/0x1840 net/core/rtnetlink.c:6395 +netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2546 +rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6413 +netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] +netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365 +netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1913 +sock_sendmsg_nosec net/socket.c:724 [inline] +sock_sendmsg net/socket.c:747 [inline] +____sys_sendmsg+0x999/0xd50 net/socket.c:2503 +___sys_sendmsg+0x28d/0x3c0 net/socket.c:2557 +__sys_sendmsg net/socket.c:2586 [inline] +__do_sys_sendmsg net/socket.c:2595 [inline] +__se_sys_sendmsg net/socket.c:2593 [inline] +__x64_sys_sendmsg+0x304/0x490 net/socket.c:2593 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Bytes 2856-2857 of 3500 are uninitialized +Memory access of size 3500 starts at ffff888018d99104 +Data copied to user address 0000000020000480 + +Fixes: d83b06036048 ("net: add fdb generic dump routine") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20230621174720.1845040-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/rtnetlink.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 0ab558501290b..49766446797c1 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -3911,7 +3911,7 @@ static int nlmsg_populate_fdb_fill(struct sk_buff *skb, + ndm->ndm_ifindex = dev->ifindex; + ndm->ndm_state = ndm_state; + +- if (nla_put(skb, NDA_LLADDR, ETH_ALEN, addr)) ++ if (nla_put(skb, NDA_LLADDR, dev->addr_len, addr)) + goto nla_put_failure; + if (vid) + if (nla_put(skb, NDA_VLAN, sizeof(u16), &vid)) +@@ -3925,10 +3925,10 @@ static int nlmsg_populate_fdb_fill(struct sk_buff *skb, + return -EMSGSIZE; + } + +-static inline size_t rtnl_fdb_nlmsg_size(void) ++static inline size_t rtnl_fdb_nlmsg_size(const struct net_device *dev) + { + return NLMSG_ALIGN(sizeof(struct ndmsg)) + +- nla_total_size(ETH_ALEN) + /* NDA_LLADDR */ ++ nla_total_size(dev->addr_len) + /* NDA_LLADDR */ + nla_total_size(sizeof(u16)) + /* NDA_VLAN */ + 0; + } +@@ -3940,7 +3940,7 @@ static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, u16 vid, int type, + struct sk_buff *skb; + int err = -ENOBUFS; + +- skb = nlmsg_new(rtnl_fdb_nlmsg_size(), GFP_ATOMIC); ++ skb = nlmsg_new(rtnl_fdb_nlmsg_size(dev), GFP_ATOMIC); + if (!skb) + goto errout; + +-- +2.39.2 + diff --git a/queue-5.15/netlink-fix-potential-deadlock-in-netlink_set_err.patch b/queue-5.15/netlink-fix-potential-deadlock-in-netlink_set_err.patch new file mode 100644 index 00000000000..c89ff6d2554 --- /dev/null +++ b/queue-5.15/netlink-fix-potential-deadlock-in-netlink_set_err.patch @@ -0,0 +1,117 @@ +From bea7063254053da60d41969b122f25afc40f290a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 15:43:37 +0000 +Subject: netlink: fix potential deadlock in netlink_set_err() + +From: Eric Dumazet + +[ Upstream commit 8d61f926d42045961e6b65191c09e3678d86a9cf ] + +syzbot reported a possible deadlock in netlink_set_err() [1] + +A similar issue was fixed in commit 1d482e666b8e ("netlink: disable IRQs +for netlink_lock_table()") in netlink_lock_table() + +This patch adds IRQ safety to netlink_set_err() and __netlink_diag_dump() +which were not covered by cited commit. + +[1] + +WARNING: possible irq lock inversion dependency detected +6.4.0-rc6-syzkaller-00240-g4e9f0ec38852 #0 Not tainted + +syz-executor.2/23011 just changed the state of lock: +ffffffff8e1a7a58 (nl_table_lock){.+.?}-{2:2}, at: netlink_set_err+0x2e/0x3a0 net/netlink/af_netlink.c:1612 +but this lock was taken by another, SOFTIRQ-safe lock in the past: + (&local->queue_stop_reason_lock){..-.}-{2:2} + +and interrupts could create inverse lock ordering between them. + +other info that might help us debug this: + Possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(nl_table_lock); + local_irq_disable(); + lock(&local->queue_stop_reason_lock); + lock(nl_table_lock); + + lock(&local->queue_stop_reason_lock); + + *** DEADLOCK *** + +Fixes: 1d482e666b8e ("netlink: disable IRQs for netlink_lock_table()") +Reported-by: syzbot+a7d200a347f912723e5c@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=a7d200a347f912723e5c +Link: https://lore.kernel.org/netdev/000000000000e38d1605fea5747e@google.com/T/#u +Signed-off-by: Eric Dumazet +Cc: Johannes Berg +Link: https://lore.kernel.org/r/20230621154337.1668594-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/netlink/af_netlink.c | 5 +++-- + net/netlink/diag.c | 5 +++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 46c4306ddee7e..f41e130a812f0 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1610,6 +1610,7 @@ static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p) + int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code) + { + struct netlink_set_err_data info; ++ unsigned long flags; + struct sock *sk; + int ret = 0; + +@@ -1619,12 +1620,12 @@ int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code) + /* sk->sk_err wants a positive error value */ + info.code = -code; + +- read_lock(&nl_table_lock); ++ read_lock_irqsave(&nl_table_lock, flags); + + sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list) + ret += do_one_set_err(sk, &info); + +- read_unlock(&nl_table_lock); ++ read_unlock_irqrestore(&nl_table_lock, flags); + return ret; + } + EXPORT_SYMBOL(netlink_set_err); +diff --git a/net/netlink/diag.c b/net/netlink/diag.c +index c6255eac305c7..4143b2ea4195a 100644 +--- a/net/netlink/diag.c ++++ b/net/netlink/diag.c +@@ -94,6 +94,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, + struct net *net = sock_net(skb->sk); + struct netlink_diag_req *req; + struct netlink_sock *nlsk; ++ unsigned long flags; + struct sock *sk; + int num = 2; + int ret = 0; +@@ -152,7 +153,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, + num++; + + mc_list: +- read_lock(&nl_table_lock); ++ read_lock_irqsave(&nl_table_lock, flags); + sk_for_each_bound(sk, &tbl->mc_list) { + if (sk_hashed(sk)) + continue; +@@ -173,7 +174,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb, + } + num++; + } +- read_unlock(&nl_table_lock); ++ read_unlock_irqrestore(&nl_table_lock, flags); + + done: + cb->args[0] = num; +-- +2.39.2 + diff --git a/queue-5.15/nfc-llcp-fix-possible-use-of-uninitialized-variable-.patch b/queue-5.15/nfc-llcp-fix-possible-use-of-uninitialized-variable-.patch new file mode 100644 index 00000000000..c55f5c3ebac --- /dev/null +++ b/queue-5.15/nfc-llcp-fix-possible-use-of-uninitialized-variable-.patch @@ -0,0 +1,41 @@ +From 9ba2654a955ef42e3874ddfe47fba32d61bfc632 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 May 2023 13:52:04 +0200 +Subject: nfc: llcp: fix possible use of uninitialized variable in + nfc_llcp_send_connect() + +From: Krzysztof Kozlowski + +[ Upstream commit 0d9b41daa5907756a31772d8af8ac5ff25cf17c1 ] + +If sock->service_name is NULL, the local variable +service_name_tlv_length will not be assigned by nfc_llcp_build_tlv(), +later leading to using value frmo the stack. Smatch warning: + + net/nfc/llcp_commands.c:442 nfc_llcp_send_connect() error: uninitialized symbol 'service_name_tlv_length'. + +Fixes: de9e5aeb4f40 ("NFC: llcp: Fix usage of llcp_add_tlv()") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/llcp_commands.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c +index 3c4172a5aeb5e..bb9f40563ff63 100644 +--- a/net/nfc/llcp_commands.c ++++ b/net/nfc/llcp_commands.c +@@ -394,7 +394,8 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock) + const u8 *service_name_tlv = NULL; + const u8 *miux_tlv = NULL; + const u8 *rw_tlv = NULL; +- u8 service_name_tlv_length, miux_tlv_length, rw_tlv_length, rw; ++ u8 service_name_tlv_length = 0; ++ u8 miux_tlv_length, rw_tlv_length, rw; + int err; + u16 size = 0; + __be16 miux; +-- +2.39.2 + diff --git a/queue-5.15/nfc-llcp-simplify-llcp_sock_connect-error-paths.patch b/queue-5.15/nfc-llcp-simplify-llcp_sock_connect-error-paths.patch new file mode 100644 index 00000000000..55f879c2267 --- /dev/null +++ b/queue-5.15/nfc-llcp-simplify-llcp_sock_connect-error-paths.patch @@ -0,0 +1,51 @@ +From 86da4ebbe4008fd09baf1d1d562c9dbef060f52c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Mar 2022 20:25:19 +0100 +Subject: nfc: llcp: simplify llcp_sock_connect() error paths + +From: Krzysztof Kozlowski + +[ Upstream commit ec10fd154d934cc4195da3cbd017a12817b41d51 ] + +The llcp_sock_connect() error paths were using a mixed way of central +exit (goto) and cleanup + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: David S. Miller +Stable-dep-of: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") +Signed-off-by: Sasha Levin +--- + net/nfc/llcp_sock.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c +index 0b93a17b9f11f..fdf0856182c65 100644 +--- a/net/nfc/llcp_sock.c ++++ b/net/nfc/llcp_sock.c +@@ -712,10 +712,8 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, + llcp_sock->local = nfc_llcp_local_get(local); + llcp_sock->ssap = nfc_llcp_get_local_ssap(local); + if (llcp_sock->ssap == LLCP_SAP_MAX) { +- nfc_llcp_local_put(llcp_sock->local); +- llcp_sock->local = NULL; + ret = -ENOMEM; +- goto put_dev; ++ goto sock_llcp_put_local; + } + + llcp_sock->reserved_ssap = llcp_sock->ssap; +@@ -760,8 +758,11 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, + + sock_llcp_release: + nfc_llcp_put_ssap(local, llcp_sock->ssap); ++ ++sock_llcp_put_local: + nfc_llcp_local_put(llcp_sock->local); + llcp_sock->local = NULL; ++ llcp_sock->dev = NULL; + + put_dev: + nfc_put_device(dev); +-- +2.39.2 + diff --git a/queue-5.15/nfsv4.1-freeze-the-session-table-upon-receiving-nfs4.patch b/queue-5.15/nfsv4.1-freeze-the-session-table-upon-receiving-nfs4.patch new file mode 100644 index 00000000000..dd691681c56 --- /dev/null +++ b/queue-5.15/nfsv4.1-freeze-the-session-table-upon-receiving-nfs4.patch @@ -0,0 +1,41 @@ +From bc686d8deac78de47b30961fc4e957935e8169c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Jun 2023 17:32:25 -0400 +Subject: NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION + +From: Olga Kornievskaia + +[ Upstream commit c907e72f58ed979a24a9fdcadfbc447c51d5e509 ] + +When the client received NFS4ERR_BADSESSION, it schedules recovery +and start the state manager thread which in turn freezes the +session table and does not allow for any new requests to use the +no-longer valid session. However, it is possible that before +the state manager thread runs, a new operation would use the +released slot that received BADSESSION and was therefore not +updated its sequence number. Such re-use of the slot can lead +the application errors. + +Fixes: 5c441544f045 ("NFSv4.x: Handle bad/dead sessions correctly in nfs41_sequence_process()") +Signed-off-by: Olga Kornievskaia +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 0546fa1ac98f4..b1ec9b5d06e58 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -923,6 +923,7 @@ static int nfs41_sequence_process(struct rpc_task *task, + out_noaction: + return ret; + session_recover: ++ set_bit(NFS4_SLOT_TBL_DRAINING, &session->fc_slot_table.slot_tbl_state); + nfs4_schedule_session_recovery(session, status); + dprintk("%s ERROR: %d Reset session\n", __func__, status); + nfs41_sequence_free_slot(res); +-- +2.39.2 + diff --git a/queue-5.15/ovl-update-of-dentry-revalidate-flags-after-copy-up.patch b/queue-5.15/ovl-update-of-dentry-revalidate-flags-after-copy-up.patch new file mode 100644 index 00000000000..899c295feb9 --- /dev/null +++ b/queue-5.15/ovl-update-of-dentry-revalidate-flags-after-copy-up.patch @@ -0,0 +1,163 @@ +From 31afdd2dcc1e4acb2de356b0b4a665ccf4675e79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 11:29:59 +0300 +Subject: ovl: update of dentry revalidate flags after copy up + +From: Amir Goldstein + +[ Upstream commit b07d5cc93e1b28df47a72c519d09d0a836043613 ] + +After copy up, we may need to update d_flags if upper dentry is on a +remote fs and lower dentries are not. + +Add helpers to allow incremental update of the revalidate flags. + +Fixes: bccece1ead36 ("ovl: allow remote upper") +Reviewed-by: Gao Xiang +Signed-off-by: Amir Goldstein +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/overlayfs/copy_up.c | 2 ++ + fs/overlayfs/dir.c | 3 +-- + fs/overlayfs/export.c | 3 +-- + fs/overlayfs/namei.c | 3 +-- + fs/overlayfs/overlayfs.h | 6 ++++-- + fs/overlayfs/super.c | 2 +- + fs/overlayfs/util.c | 24 ++++++++++++++++++++---- + 7 files changed, 30 insertions(+), 13 deletions(-) + +diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c +index ef0bf98b620d7..46cc429c44f7e 100644 +--- a/fs/overlayfs/copy_up.c ++++ b/fs/overlayfs/copy_up.c +@@ -542,6 +542,7 @@ static int ovl_link_up(struct ovl_copy_up_ctx *c) + /* Restore timestamps on parent (best effort) */ + ovl_set_timestamps(upperdir, &c->pstat); + ovl_dentry_set_upper_alias(c->dentry); ++ ovl_dentry_update_reval(c->dentry, upper); + } + } + inode_unlock(udir); +@@ -840,6 +841,7 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c) + inode_unlock(udir); + + ovl_dentry_set_upper_alias(c->dentry); ++ ovl_dentry_update_reval(c->dentry, ovl_dentry_upper(c->dentry)); + } + + out: +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index eca984d6484d1..519193ce7d575 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -267,8 +267,7 @@ static int ovl_instantiate(struct dentry *dentry, struct inode *inode, + + ovl_dir_modified(dentry->d_parent, false); + ovl_dentry_set_upper_alias(dentry); +- ovl_dentry_update_reval(dentry, newdentry, +- DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE); ++ ovl_dentry_init_reval(dentry, newdentry); + + if (!hardlink) { + /* +diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c +index 0cc14ce8c7e83..baa50ece0bc53 100644 +--- a/fs/overlayfs/export.c ++++ b/fs/overlayfs/export.c +@@ -326,8 +326,7 @@ static struct dentry *ovl_obtain_alias(struct super_block *sb, + if (upper_alias) + ovl_dentry_set_upper_alias(dentry); + +- ovl_dentry_update_reval(dentry, upper, +- DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE); ++ ovl_dentry_init_reval(dentry, upper); + + return d_instantiate_anon(dentry, inode); + +diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c +index 1a9b515fc45d4..9c055d11a95de 100644 +--- a/fs/overlayfs/namei.c ++++ b/fs/overlayfs/namei.c +@@ -1103,8 +1103,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry, + ovl_set_flag(OVL_UPPERDATA, inode); + } + +- ovl_dentry_update_reval(dentry, upperdentry, +- DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE); ++ ovl_dentry_init_reval(dentry, upperdentry); + + revert_creds(old_cred); + if (origin_path) { +diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h +index ae4876da2ced2..a96b67586f817 100644 +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -286,8 +286,10 @@ bool ovl_index_all(struct super_block *sb); + bool ovl_verify_lower(struct super_block *sb); + struct ovl_entry *ovl_alloc_entry(unsigned int numlower); + bool ovl_dentry_remote(struct dentry *dentry); +-void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *upperdentry, +- unsigned int mask); ++void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *realdentry); ++void ovl_dentry_init_reval(struct dentry *dentry, struct dentry *upperdentry); ++void ovl_dentry_init_flags(struct dentry *dentry, struct dentry *upperdentry, ++ unsigned int mask); + bool ovl_dentry_weird(struct dentry *dentry); + enum ovl_path_type ovl_path_type(struct dentry *dentry); + void ovl_path_upper(struct dentry *dentry, struct path *path); +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index b3675d13c1ac2..5310271cf2e38 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -1965,7 +1965,7 @@ static struct dentry *ovl_get_root(struct super_block *sb, + ovl_dentry_set_flag(OVL_E_CONNECTED, root); + ovl_set_upperdata(d_inode(root)); + ovl_inode_init(d_inode(root), &oip, ino, fsid); +- ovl_dentry_update_reval(root, upperdentry, DCACHE_OP_WEAK_REVALIDATE); ++ ovl_dentry_init_flags(root, upperdentry, DCACHE_OP_WEAK_REVALIDATE); + + return root; + } +diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c +index 9d33ce385bef0..d62d5ede60dfd 100644 +--- a/fs/overlayfs/util.c ++++ b/fs/overlayfs/util.c +@@ -94,14 +94,30 @@ struct ovl_entry *ovl_alloc_entry(unsigned int numlower) + return oe; + } + ++#define OVL_D_REVALIDATE (DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE) ++ + bool ovl_dentry_remote(struct dentry *dentry) + { +- return dentry->d_flags & +- (DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE); ++ return dentry->d_flags & OVL_D_REVALIDATE; ++} ++ ++void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *realdentry) ++{ ++ if (!ovl_dentry_remote(realdentry)) ++ return; ++ ++ spin_lock(&dentry->d_lock); ++ dentry->d_flags |= realdentry->d_flags & OVL_D_REVALIDATE; ++ spin_unlock(&dentry->d_lock); ++} ++ ++void ovl_dentry_init_reval(struct dentry *dentry, struct dentry *upperdentry) ++{ ++ return ovl_dentry_init_flags(dentry, upperdentry, OVL_D_REVALIDATE); + } + +-void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *upperdentry, +- unsigned int mask) ++void ovl_dentry_init_flags(struct dentry *dentry, struct dentry *upperdentry, ++ unsigned int mask) + { + struct ovl_entry *oe = OVL_E(dentry); + unsigned int i, flags = 0; +-- +2.39.2 + diff --git a/queue-5.15/pci-add-pci_clear_master-stub-for-non-config_pci.patch b/queue-5.15/pci-add-pci_clear_master-stub-for-non-config_pci.patch new file mode 100644 index 00000000000..8948d045fbc --- /dev/null +++ b/queue-5.15/pci-add-pci_clear_master-stub-for-non-config_pci.patch @@ -0,0 +1,39 @@ +From 92711a3514495d14318f158cf3c175723cac446e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 18:27:44 +0800 +Subject: PCI: Add pci_clear_master() stub for non-CONFIG_PCI + +From: Sui Jingfeng + +[ Upstream commit 2aa5ac633259843f656eb6ecff4cf01e8e810c5e ] + +Add a pci_clear_master() stub when CONFIG_PCI is not set so drivers that +support both PCI and platform devices don't need #ifdefs or extra Kconfig +symbols for the PCI parts. + +[bhelgaas: commit log] +Fixes: 6a479079c072 ("PCI: Add pci_clear_master() as opposite of pci_set_master()") +Link: https://lore.kernel.org/r/20230531102744.2354313-1-suijingfeng@loongson.cn +Signed-off-by: Sui Jingfeng +Signed-off-by: Bjorn Helgaas +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + include/linux/pci.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 7e471432a998c..99dfb8c1993a6 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -1787,6 +1787,7 @@ static inline struct pci_dev *pci_get_class(unsigned int class, + #define pci_dev_put(dev) do { } while (0) + + static inline void pci_set_master(struct pci_dev *dev) { } ++static inline void pci_clear_master(struct pci_dev *dev) { } + static inline int pci_enable_device(struct pci_dev *dev) { return -EIO; } + static inline void pci_disable_device(struct pci_dev *dev) { } + static inline int pcim_enable_device(struct pci_dev *pdev) { return -EIO; } +-- +2.39.2 + diff --git a/queue-5.15/pci-aspm-disable-aspm-on-mfd-function-removal-to-avo.patch b/queue-5.15/pci-aspm-disable-aspm-on-mfd-function-removal-to-avo.patch new file mode 100644 index 00000000000..d31a653ac4b --- /dev/null +++ b/queue-5.15/pci-aspm-disable-aspm-on-mfd-function-removal-to-avo.patch @@ -0,0 +1,94 @@ +From 410828bb58e51177efa45d5273c9321a88153d04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 11:40:57 +0800 +Subject: PCI/ASPM: Disable ASPM on MFD function removal to avoid + use-after-free + +From: Ding Hui + +[ Upstream commit 456d8aa37d0f56fc9e985e812496e861dcd6f2f2 ] + +Struct pcie_link_state->downstream is a pointer to the pci_dev of function +0. Previously we retained that pointer when removing function 0, and +subsequent ASPM policy changes dereferenced it, resulting in a +use-after-free warning from KASAN, e.g.: + + # echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove + # echo powersave > /sys/module/pcie_aspm/parameters/policy + + BUG: KASAN: slab-use-after-free in pcie_config_aspm_link+0x42d/0x500 + Call Trace: + kasan_report+0xae/0xe0 + pcie_config_aspm_link+0x42d/0x500 + pcie_aspm_set_policy+0x8e/0x1a0 + param_attr_store+0x162/0x2c0 + module_attr_store+0x3e/0x80 + +PCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM +Control value in all functions of multi-function devices. + +Disable ASPM and free the pcie_link_state when any child function is +removed so we can discard the dangling pcie_link_state->downstream pointer +and maintain the same ASPM Control configuration for all functions. + +[bhelgaas: commit log and comment] +Debugged-by: Zongquan Qin +Suggested-by: Bjorn Helgaas +Fixes: b5a0a9b59c81 ("PCI/ASPM: Read and set up L1 substate capabilities") +Link: https://lore.kernel.org/r/20230507034057.20970-1-dinghui@sangfor.com.cn +Signed-off-by: Ding Hui +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/aspm.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c +index b3ad316418f1c..c58294f53fcd1 100644 +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -993,21 +993,24 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) + + down_read(&pci_bus_sem); + mutex_lock(&aspm_lock); +- /* +- * All PCIe functions are in one slot, remove one function will remove +- * the whole slot, so just wait until we are the last function left. +- */ +- if (!list_empty(&parent->subordinate->devices)) +- goto out; + + link = parent->link_state; + root = link->root; + parent_link = link->parent; + +- /* All functions are removed, so just disable ASPM for the link */ ++ /* ++ * link->downstream is a pointer to the pci_dev of function 0. If ++ * we remove that function, the pci_dev is about to be deallocated, ++ * so we can't use link->downstream again. Free the link state to ++ * avoid this. ++ * ++ * If we're removing a non-0 function, it's possible we could ++ * retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends ++ * programming the same ASPM Control value for all functions of ++ * multi-function devices, so disable ASPM for all of them. ++ */ + pcie_config_aspm_link(link, 0); + list_del(&link->sibling); +- /* Clock PM is for endpoint device */ + free_link_state(link); + + /* Recheck latencies and configure upstream links */ +@@ -1015,7 +1018,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) + pcie_update_aspm_capable(root); + pcie_config_aspm_path(parent_link); + } +-out: ++ + mutex_unlock(&aspm_lock); + up_read(&pci_bus_sem); + } +-- +2.39.2 + diff --git a/queue-5.15/pci-cadence-fix-gen2-link-retraining-process.patch b/queue-5.15/pci-cadence-fix-gen2-link-retraining-process.patch new file mode 100644 index 00000000000..b13c0bcf45c --- /dev/null +++ b/queue-5.15/pci-cadence-fix-gen2-link-retraining-process.patch @@ -0,0 +1,88 @@ +From 540e78a127cd9518a8ae69e551982c7bc511a0c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 12:38:00 +0530 +Subject: PCI: cadence: Fix Gen2 Link Retraining process + +From: Siddharth Vadapalli + +[ Upstream commit 0e12f830236928b6fadf40d917a7527f0a048d2f ] + +The Link Retraining process is initiated to account for the Gen2 defect in +the Cadence PCIe controller in J721E SoC. The errata corresponding to this +is i2085, documented at: +https://www.ti.com/lit/er/sprz455c/sprz455c.pdf + +The existing workaround implemented for the errata waits for the Data Link +initialization to complete and assumes that the link retraining process +at the Physical Layer has completed. However, it is possible that the +Physical Layer training might be ongoing as indicated by the +PCI_EXP_LNKSTA_LT bit in the PCI_EXP_LNKSTA register. + +Fix the existing workaround, to ensure that the Physical Layer training +has also completed, in addition to the Data Link initialization. + +Link: https://lore.kernel.org/r/20230315070800.1615527-1-s-vadapalli@ti.com +Fixes: 4740b969aaf5 ("PCI: cadence: Retrain Link to work around Gen2 training defect") +Signed-off-by: Siddharth Vadapalli +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + .../controller/cadence/pcie-cadence-host.c | 27 +++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c +index fb96d37a135c1..4d8d15ac51ef4 100644 +--- a/drivers/pci/controller/cadence/pcie-cadence-host.c ++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c +@@ -12,6 +12,8 @@ + + #include "pcie-cadence.h" + ++#define LINK_RETRAIN_TIMEOUT HZ ++ + static u64 bar_max_size[] = { + [RP_BAR0] = _ULL(128 * SZ_2G), + [RP_BAR1] = SZ_2G, +@@ -77,6 +79,27 @@ static struct pci_ops cdns_pcie_host_ops = { + .write = pci_generic_config_write, + }; + ++static int cdns_pcie_host_training_complete(struct cdns_pcie *pcie) ++{ ++ u32 pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET; ++ unsigned long end_jiffies; ++ u16 lnk_stat; ++ ++ /* Wait for link training to complete. Exit after timeout. */ ++ end_jiffies = jiffies + LINK_RETRAIN_TIMEOUT; ++ do { ++ lnk_stat = cdns_pcie_rp_readw(pcie, pcie_cap_off + PCI_EXP_LNKSTA); ++ if (!(lnk_stat & PCI_EXP_LNKSTA_LT)) ++ break; ++ usleep_range(0, 1000); ++ } while (time_before(jiffies, end_jiffies)); ++ ++ if (!(lnk_stat & PCI_EXP_LNKSTA_LT)) ++ return 0; ++ ++ return -ETIMEDOUT; ++} ++ + static int cdns_pcie_host_wait_for_link(struct cdns_pcie *pcie) + { + struct device *dev = pcie->dev; +@@ -118,6 +141,10 @@ static int cdns_pcie_retrain(struct cdns_pcie *pcie) + cdns_pcie_rp_writew(pcie, pcie_cap_off + PCI_EXP_LNKCTL, + lnk_ctl); + ++ ret = cdns_pcie_host_training_complete(pcie); ++ if (ret) ++ return ret; ++ + ret = cdns_pcie_host_wait_for_link(pcie); + } + return ret; +-- +2.39.2 + diff --git a/queue-5.15/pci-ftpci100-release-the-clock-resources.patch b/queue-5.15/pci-ftpci100-release-the-clock-resources.patch new file mode 100644 index 00000000000..c944ca2b391 --- /dev/null +++ b/queue-5.15/pci-ftpci100-release-the-clock-resources.patch @@ -0,0 +1,75 @@ +From 9d89e58384917778adffedf109baff18ba90bcaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 12:36:41 +0800 +Subject: PCI: ftpci100: Release the clock resources + +From: Junyan Ye + +[ Upstream commit c60738de85f40b0b9f5cb23c21f9246e5a47908c ] + +Smatch reported: +1. drivers/pci/controller/pci-ftpci100.c:526 faraday_pci_probe() warn: +'clk' from clk_prepare_enable() not released on lines: 442,451,462,478,512,517. +2. drivers/pci/controller/pci-ftpci100.c:526 faraday_pci_probe() warn: +'p->bus_clk' from clk_prepare_enable() not released on lines: 451,462,478,512,517. + +The clock resource is obtained by devm_clk_get(), and then +clk_prepare_enable() makes the clock resource ready for use. After that, +clk_disable_unprepare() should be called to release the clock resource +when it is no longer needed. However, while doing some error handling +in faraday_pci_probe(), clk_disable_unprepare() is not called to release +clk and p->bus_clk before returning. These return lines are exactly 442, +451, 462, 478, 512, 517. + +Fix this warning by replacing devm_clk_get() with devm_clk_get_enabled(), +which is equivalent to devm_clk_get() + clk_prepare_enable(). And with +devm_clk_get_enabled(), the clock will automatically be disabled, +unprepared and freed when the device is unbound from the bus. + +Link: https://lore.kernel.org/r/20230508043641.23807-1-yejunyan@hust.edu.cn +Fixes: b3c433efb8a3 ("PCI: faraday: Fix wrong pointer passed to PTR_ERR()") +Fixes: 2eeb02b28579 ("PCI: faraday: Add clock handling") +Fixes: 783a862563f7 ("PCI: faraday: Use pci_parse_request_of_pci_ranges()") +Fixes: d3c68e0a7e34 ("PCI: faraday: Add Faraday Technology FTPCI100 PCI Host Bridge driver") +Fixes: f1e8bd21e39e ("PCI: faraday: Convert IRQ masking to raw PCI config accessors") +Signed-off-by: Junyan Ye +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Dongliang Mu +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-ftpci100.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/pci/controller/pci-ftpci100.c b/drivers/pci/controller/pci-ftpci100.c +index 88980a44461df..ca8de44045bbe 100644 +--- a/drivers/pci/controller/pci-ftpci100.c ++++ b/drivers/pci/controller/pci-ftpci100.c +@@ -442,22 +442,12 @@ static int faraday_pci_probe(struct platform_device *pdev) + p->dev = dev; + + /* Retrieve and enable optional clocks */ +- clk = devm_clk_get(dev, "PCLK"); ++ clk = devm_clk_get_enabled(dev, "PCLK"); + if (IS_ERR(clk)) + return PTR_ERR(clk); +- ret = clk_prepare_enable(clk); +- if (ret) { +- dev_err(dev, "could not prepare PCLK\n"); +- return ret; +- } +- p->bus_clk = devm_clk_get(dev, "PCICLK"); ++ p->bus_clk = devm_clk_get_enabled(dev, "PCICLK"); + if (IS_ERR(p->bus_clk)) + return PTR_ERR(p->bus_clk); +- ret = clk_prepare_enable(p->bus_clk); +- if (ret) { +- dev_err(dev, "could not prepare PCICLK\n"); +- return ret; +- } + + p->base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(p->base)) +-- +2.39.2 + diff --git a/queue-5.15/pci-pciehp-cancel-bringup-sequence-if-card-is-not-pr.patch b/queue-5.15/pci-pciehp-cancel-bringup-sequence-if-card-is-not-pr.patch new file mode 100644 index 00000000000..9772d748c78 --- /dev/null +++ b/queue-5.15/pci-pciehp-cancel-bringup-sequence-if-card-is-not-pr.patch @@ -0,0 +1,74 @@ +From 101b36ae53a3119b2c7e44b2549c1eb8f4c55b46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 10:15:18 +0800 +Subject: PCI: pciehp: Cancel bringup sequence if card is not present + +From: Rongguang Wei + +[ Upstream commit e8afd0d9fccc27c8ad263db5cf5952cfcf72d6fe ] + +If a PCIe hotplug slot has an Attention Button, the normal hot-add flow is: + + - Slot is empty and slot power is off + - User inserts card in slot and presses Attention Button + - OS blinks Power Indicator for 5 seconds + - After 5 seconds, OS turns on Power Indicator, turns on slot power, and + enumerates the device + +Previously, if a user pressed the Attention Button on an *empty* slot, +pciehp logged the following messages and blinked the Power Indicator +until a second button press: + + [0.000] pciehp: Button press: will power on in 5 sec + [0.001] # Power Indicator starts blinking + [5.001] # 5 second timeout; slot is empty, so we should cancel the + request to power on and turn off Power Indicator + + [7.000] # Power Indicator still blinking + [8.000] # possible card insertion + [9.000] pciehp: Button press: canceling request to power on + +The first button press incorrectly left the slot in BLINKINGON_STATE, so +the second was interpreted as a "cancel power on" event regardless of +whether a card was present. + +If the slot is empty, turn off the Power Indicator and return from +BLINKINGON_STATE to OFF_STATE after 5 seconds, effectively canceling the +request to power on. Putting the slot in OFF_STATE also means the second +button press will correctly request a slot power on if the slot is +occupied. + +[bhelgaas: commit log] +Link: https://lore.kernel.org/r/20230512021518.336460-1-clementwei90@163.com +Fixes: d331710ea78f ("PCI: pciehp: Become resilient to missed events") +Suggested-by: Lukas Wunner +Signed-off-by: Rongguang Wei +Signed-off-by: Bjorn Helgaas +Reviewed-by: Lukas Wunner +Signed-off-by: Sasha Levin +--- + drivers/pci/hotplug/pciehp_ctrl.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c +index 529c348084401..32baba1b7f131 100644 +--- a/drivers/pci/hotplug/pciehp_ctrl.c ++++ b/drivers/pci/hotplug/pciehp_ctrl.c +@@ -256,6 +256,14 @@ void pciehp_handle_presence_or_link_change(struct controller *ctrl, u32 events) + present = pciehp_card_present(ctrl); + link_active = pciehp_check_link_active(ctrl); + if (present <= 0 && link_active <= 0) { ++ if (ctrl->state == BLINKINGON_STATE) { ++ ctrl->state = OFF_STATE; ++ cancel_delayed_work(&ctrl->button_work); ++ pciehp_set_indicators(ctrl, PCI_EXP_SLTCTL_PWR_IND_OFF, ++ INDICATOR_NOOP); ++ ctrl_info(ctrl, "Slot(%s): Card not present\n", ++ slot_name(ctrl)); ++ } + mutex_unlock(&ctrl->state_lock); + return; + } +-- +2.39.2 + diff --git a/queue-5.15/pci-vmd-reset-vmd-config-register-between-soft-reboo.patch b/queue-5.15/pci-vmd-reset-vmd-config-register-between-soft-reboo.patch new file mode 100644 index 00000000000..cd0cc02751a --- /dev/null +++ b/queue-5.15/pci-vmd-reset-vmd-config-register-between-soft-reboo.patch @@ -0,0 +1,57 @@ +From 63361faa4c66c5593b7ef6a4004e83313d1f6a80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Feb 2023 13:28:11 -0700 +Subject: PCI: vmd: Reset VMD config register between soft reboots + +From: Nirmal Patel + +[ Upstream commit b61cf04c49c3dfa70a0d6725d3eb40bf9b35cf71 ] + +VMD driver can disable or enable MSI remapping by changing +VMCONFIG_MSI_REMAP register. This register needs to be set to the +default value during soft reboots. Drives failed to enumerate +when Windows boots after performing a soft reboot from Linux. +Windows doesn't support MSI remapping disable feature and stale +register value hinders Windows VMD driver initialization process. +Adding vmd_shutdown function to make sure to set the VMCONFIG +register to the default value. + +Link: https://lore.kernel.org/r/20230224202811.644370-1-nirmal.patel@linux.intel.com +Fixes: ee81ee84f873 ("PCI: vmd: Disable MSI-X remapping when possible") +Signed-off-by: Nirmal Patel +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Jon Derrick +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/vmd.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c +index 8dce71142e10f..f49001ba96c75 100644 +--- a/drivers/pci/controller/vmd.c ++++ b/drivers/pci/controller/vmd.c +@@ -881,6 +881,13 @@ static void vmd_remove(struct pci_dev *dev) + vmd_remove_irq_domain(vmd); + } + ++static void vmd_shutdown(struct pci_dev *dev) ++{ ++ struct vmd_dev *vmd = pci_get_drvdata(dev); ++ ++ vmd_remove_irq_domain(vmd); ++} ++ + #ifdef CONFIG_PM_SLEEP + static int vmd_suspend(struct device *dev) + { +@@ -946,6 +953,7 @@ static struct pci_driver vmd_drv = { + .id_table = vmd_ids, + .probe = vmd_probe, + .remove = vmd_remove, ++ .shutdown = vmd_shutdown, + .driver = { + .pm = &vmd_dev_pm_ops, + }, +-- +2.39.2 + diff --git a/queue-5.15/perf-arm-cmn-fix-dtc-reset.patch b/queue-5.15/perf-arm-cmn-fix-dtc-reset.patch new file mode 100644 index 00000000000..09e146e475a --- /dev/null +++ b/queue-5.15/perf-arm-cmn-fix-dtc-reset.patch @@ -0,0 +1,58 @@ +From 0ff3808431ba1e3bcacdbb571d7347b162c63491 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 May 2023 17:44:32 +0100 +Subject: perf/arm-cmn: Fix DTC reset + +From: Robin Murphy + +[ Upstream commit 71746c995cac92fcf6a65661b51211cf2009d7f0 ] + +It turns out that my naive DTC reset logic fails to work as intended, +since, after checking with the hardware designers, the PMU actually +needs to be fully enabled in order to correctly clear any pending +overflows. Therefore, invert the sequence to start with turning on both +enables so that we can reliably get the DTCs into a known state, then +moving to our normal counters-stopped state from there. Since all the +DTM counters have already been unpaired during the initial discovery +pass, we just need to additionally reset the cycle counters to ensure +that no other unexpected overflows occur during this period. + +Fixes: 0ba64770a2f2 ("perf: Add Arm CMN-600 PMU driver") +Reported-by: Geoff Blake +Signed-off-by: Robin Murphy +Link: https://lore.kernel.org/r/0ea4559261ea394f827c9aee5168c77a60aaee03.1684946389.git.robin.murphy@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index 400eb7f579dce..40945343c4cc1 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -1254,9 +1254,10 @@ static int arm_cmn_init_dtc(struct arm_cmn *cmn, struct arm_cmn_node *dn, int id + if (dtc->irq < 0) + return dtc->irq; + +- writel_relaxed(0, dtc->base + CMN_DT_PMCR); ++ writel_relaxed(CMN_DT_DTC_CTL_DT_EN, dtc->base + CMN_DT_DTC_CTL); ++ writel_relaxed(CMN_DT_PMCR_PMU_EN | CMN_DT_PMCR_OVFL_INTR_EN, dtc->base + CMN_DT_PMCR); ++ writeq_relaxed(0, dtc->base + CMN_DT_PMCCNTR); + writel_relaxed(0x1ff, dtc->base + CMN_DT_PMOVSR_CLR); +- writel_relaxed(CMN_DT_PMCR_OVFL_INTR_EN, dtc->base + CMN_DT_PMCR); + + /* We do at least know that a DTC's XP must be in that DTC's domain */ + xp = arm_cmn_node_to_xp(dn); +@@ -1303,7 +1304,7 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn) + dn->type = CMN_TYPE_RNI; + } + +- writel_relaxed(CMN_DT_DTC_CTL_DT_EN, cmn->dtc[0].base + CMN_DT_DTC_CTL); ++ arm_cmn_set_state(cmn, CMN_STATE_DISABLED); + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.15/perf-bench-add-missing-setlocale-call-to-allow-usage.patch b/queue-5.15/perf-bench-add-missing-setlocale-call-to-allow-usage.patch new file mode 100644 index 00000000000..bd374078112 --- /dev/null +++ b/queue-5.15/perf-bench-add-missing-setlocale-call-to-allow-usage.patch @@ -0,0 +1,79 @@ +From 888e05acdf7b4cdee4171830b35ccd8c915e0a31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 15:38:25 -0300 +Subject: perf bench: Add missing setlocale() call to allow usage of %'d style + formatting + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 16203e9cd01896b4244100a8e3fb9f6e612ab2b1 ] + +Without this we were not getting the thousands separator for big +numbers. + +Noticed while developing 'perf bench uprobe', but the use of %' predates +that, for instance 'perf bench syscall' uses it. + +Before: + + # perf bench uprobe all + # Running uprobe/baseline benchmark... + # Executed 1000 usleep(1000) calls + Total time: 1054082243ns + + 1054082.243000 nsecs/op + + # + +After: + + # perf bench uprobe all + # Running uprobe/baseline benchmark... + # Executed 1,000 usleep(1000) calls + Total time: 1,053,715,144ns + + 1,053,715.144000 nsecs/op + + # + +Fixes: c2a08203052f8975 ("perf bench: Add basic syscall benchmark") +Cc: Adrian Hunter +Cc: Andre Fredette +Cc: Clark Williams +Cc: Dave Tucker +Cc: Davidlohr Bueso +Cc: Derek Barbosa +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Tiezhu Yang +Link: https://lore.kernel.org/lkml/ZH3lcepZ4tBYr1jv@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-bench.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/perf/builtin-bench.c b/tools/perf/builtin-bench.c +index d291f3a8af5f2..ac72bcccc353b 100644 +--- a/tools/perf/builtin-bench.c ++++ b/tools/perf/builtin-bench.c +@@ -21,6 +21,7 @@ + #include "builtin.h" + #include "bench/bench.h" + ++#include + #include + #include + #include +@@ -248,6 +249,7 @@ int cmd_bench(int argc, const char **argv) + + /* Unbuffered output */ + setvbuf(stdout, NULL, _IONBF, 0); ++ setlocale(LC_ALL, ""); + + if (argc < 2) { + /* No collection specified. */ +-- +2.39.2 + diff --git a/queue-5.15/perf-bench-use-unbuffered-output-when-pipe-tee-ing-t.patch b/queue-5.15/perf-bench-use-unbuffered-output-when-pipe-tee-ing-t.patch new file mode 100644 index 00000000000..ca5df2ec584 --- /dev/null +++ b/queue-5.15/perf-bench-use-unbuffered-output-when-pipe-tee-ing-t.patch @@ -0,0 +1,101 @@ +From e2a7f4dc654559283fd4fbd73f29f426afaec03e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Nov 2021 08:14:08 +0200 +Subject: perf bench: Use unbuffered output when pipe/tee'ing to a file + +From: Sohaib Mohamed + +[ Upstream commit f0a29c9647ff8bbb424641f79bc1894e83dec218 ] + +The output of 'perf bench' gets buffered when I pipe it to a file or to +tee, in such a way that I can see it only at the end. + +E.g. + + $ perf bench internals synthesize -t + < output comes out fine after each test run > + + $ perf bench internals synthesize -t | tee file.txt + < output comes out only at the end of all tests > + +This patch resolves this issue for 'bench' and 'test' subcommands. + +See, also: + + $ perf bench mem all | tee file.txt + $ perf bench sched all | tee file.txt + $ perf bench internals all -t | tee file.txt + $ perf bench internals all | tee file.txt + +Committer testing: + +It really gets staggered, i.e. outputs in bursts, when the buffer fills +up and has to be drained to make up space for more output. + +Suggested-by: Riccardo Mancini +Signed-off-by: Sohaib Mohamed +Tested-by: Arnaldo Carvalho de Melo +Acked-by: Jiri Olsa +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Fabian Hemmer +Cc: Ian Rogers +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20211119061409.78004-1-sohaib.amhmd@gmail.com +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 16203e9cd018 ("perf bench: Add missing setlocale() call to allow usage of %'d style formatting") +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-bench.c | 5 +++-- + tools/perf/tests/builtin-test.c | 3 +++ + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/builtin-bench.c b/tools/perf/builtin-bench.c +index d0895162c2ba6..d291f3a8af5f2 100644 +--- a/tools/perf/builtin-bench.c ++++ b/tools/perf/builtin-bench.c +@@ -226,7 +226,6 @@ static void run_collection(struct collection *coll) + if (!bench->fn) + break; + printf("# Running %s/%s benchmark...\n", coll->name, bench->name); +- fflush(stdout); + + argv[1] = bench->name; + run_bench(coll->name, bench->name, bench->fn, 1, argv); +@@ -247,6 +246,9 @@ int cmd_bench(int argc, const char **argv) + struct collection *coll; + int ret = 0; + ++ /* Unbuffered output */ ++ setvbuf(stdout, NULL, _IONBF, 0); ++ + if (argc < 2) { + /* No collection specified. */ + print_usage(); +@@ -300,7 +302,6 @@ int cmd_bench(int argc, const char **argv) + + if (bench_format == BENCH_FORMAT_DEFAULT) + printf("# Running '%s/%s' benchmark:\n", coll->name, bench->name); +- fflush(stdout); + ret = run_bench(coll->name, bench->name, bench->fn, argc-1, argv+1); + goto end; + } +diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c +index da7dc5e45d0cf..4d6d3e3142008 100644 +--- a/tools/perf/tests/builtin-test.c ++++ b/tools/perf/tests/builtin-test.c +@@ -828,6 +828,9 @@ int cmd_test(int argc, const char **argv) + if (ret < 0) + return ret; + ++ /* Unbuffered output */ ++ setvbuf(stdout, NULL, _IONBF, 0); ++ + argc = parse_options_subcommand(argc, argv, test_options, test_subcommands, test_usage, 0); + if (argc >= 1 && !strcmp(argv[0], "list")) + return perf_test__list(argc - 1, argv + 1); +-- +2.39.2 + diff --git a/queue-5.15/perf-dwarf-aux-fix-off-by-one-in-die_get_varname.patch b/queue-5.15/perf-dwarf-aux-fix-off-by-one-in-die_get_varname.patch new file mode 100644 index 00000000000..4af0393d068 --- /dev/null +++ b/queue-5.15/perf-dwarf-aux-fix-off-by-one-in-die_get_varname.patch @@ -0,0 +1,45 @@ +From 58d8d143948af2f61dc861d12ca7b9714291663a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 16:41:01 -0700 +Subject: perf dwarf-aux: Fix off-by-one in die_get_varname() + +From: Namhyung Kim + +[ Upstream commit 3abfcfd847717d232e36963f31a361747c388fe7 ] + +The die_get_varname() returns "(unknown_type)" string if it failed to +find a type for the variable. But it had a space before the opening +parenthesis and it made the closing parenthesis cut off due to the +off-by-one in the string length (14). + +Signed-off-by: Namhyung Kim +Fixes: 88fd633cdfa19060 ("perf probe: No need to use formatting strbuf method") +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Masami Hiramatsu +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20230612234102.3909116-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dwarf-aux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index 623527edeac1e..b125eaadcec4d 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -1081,7 +1081,7 @@ int die_get_varname(Dwarf_Die *vr_die, struct strbuf *buf) + ret = die_get_typename(vr_die, buf); + if (ret < 0) { + pr_debug("Failed to get type, make it unknown.\n"); +- ret = strbuf_add(buf, " (unknown_type)", 14); ++ ret = strbuf_add(buf, "(unknown_type)", 14); + } + + return ret < 0 ? ret : strbuf_addf(buf, "\t%s", dwarf_diename(vr_die)); +-- +2.39.2 + diff --git a/queue-5.15/perf-ibs-fix-interface-via-core-pmu-events.patch b/queue-5.15/perf-ibs-fix-interface-via-core-pmu-events.patch new file mode 100644 index 00000000000..2ff890d91c3 --- /dev/null +++ b/queue-5.15/perf-ibs-fix-interface-via-core-pmu-events.patch @@ -0,0 +1,164 @@ +From bda3fe99299f58f8508937347803cc85830f2f5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 16:30:01 +0530 +Subject: perf/ibs: Fix interface via core pmu events + +From: Ravi Bangoria + +[ Upstream commit 2fad201fe38ff9a692acedb1990ece2c52a29f95 ] + +Although, IBS pmus can be invoked via their own interface, indirect +IBS invocation via core pmu events is also supported with fixed set +of events: cpu-cycles:p, r076:p (same as cpu-cycles:p) and r0C1:p +(micro-ops) for user convenience. + +This indirect IBS invocation is broken since commit 66d258c5b048 +("perf/core: Optimize perf_init_event()"), which added RAW pmu under +'pmu_idr' list and thus if event_init() fails with RAW pmu, it started +returning error instead of trying other pmus. + +Forward precise events from core pmu to IBS by overwriting 'type' and +'config' in the kernel copy of perf_event_attr. Overwriting will cause +perf_init_event() to retry with updated 'type' and 'config', which will +automatically forward event to IBS pmu. + +Without patch: + $ sudo ./perf record -C 0 -e r076:p -- sleep 1 + Error: + The r076:p event is not supported. + +With patch: + $ sudo ./perf record -C 0 -e r076:p -- sleep 1 + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.341 MB perf.data (37 samples) ] + +Fixes: 66d258c5b048 ("perf/core: Optimize perf_init_event()") +Reported-by: Stephane Eranian +Signed-off-by: Ravi Bangoria +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20230504110003.2548-3-ravi.bangoria@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/amd/core.c | 2 +- + arch/x86/events/amd/ibs.c | 53 +++++++++++++++---------------- + arch/x86/include/asm/perf_event.h | 2 ++ + 3 files changed, 29 insertions(+), 28 deletions(-) + +diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c +index d93d098dea99d..4ebedc7e1188b 100644 +--- a/arch/x86/events/amd/core.c ++++ b/arch/x86/events/amd/core.c +@@ -364,7 +364,7 @@ static int amd_pmu_hw_config(struct perf_event *event) + + /* pass precise event sampling to ibs: */ + if (event->attr.precise_ip && get_ibs_caps()) +- return -ENOENT; ++ return forward_event_to_ibs(event); + + if (has_branch_stack(event)) + return -EOPNOTSUPP; +diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c +index 2704ec1e42a30..b605e08f9a8ef 100644 +--- a/arch/x86/events/amd/ibs.c ++++ b/arch/x86/events/amd/ibs.c +@@ -194,7 +194,7 @@ static struct perf_ibs *get_ibs_pmu(int type) + } + + /* +- * Use IBS for precise event sampling: ++ * core pmu config -> IBS config + * + * perf record -a -e cpu-cycles:p ... # use ibs op counting cycle count + * perf record -a -e r076:p ... # same as -e cpu-cycles:p +@@ -203,25 +203,9 @@ static struct perf_ibs *get_ibs_pmu(int type) + * IbsOpCntCtl (bit 19) of IBS Execution Control Register (IbsOpCtl, + * MSRC001_1033) is used to select either cycle or micro-ops counting + * mode. +- * +- * The rip of IBS samples has skid 0. Thus, IBS supports precise +- * levels 1 and 2 and the PERF_EFLAGS_EXACT is set. In rare cases the +- * rip is invalid when IBS was not able to record the rip correctly. +- * We clear PERF_EFLAGS_EXACT and take the rip from pt_regs then. +- * + */ +-static int perf_ibs_precise_event(struct perf_event *event, u64 *config) ++static int core_pmu_ibs_config(struct perf_event *event, u64 *config) + { +- switch (event->attr.precise_ip) { +- case 0: +- return -ENOENT; +- case 1: +- case 2: +- break; +- default: +- return -EOPNOTSUPP; +- } +- + switch (event->attr.type) { + case PERF_TYPE_HARDWARE: + switch (event->attr.config) { +@@ -247,22 +231,37 @@ static int perf_ibs_precise_event(struct perf_event *event, u64 *config) + return -EOPNOTSUPP; + } + ++/* ++ * The rip of IBS samples has skid 0. Thus, IBS supports precise ++ * levels 1 and 2 and the PERF_EFLAGS_EXACT is set. In rare cases the ++ * rip is invalid when IBS was not able to record the rip correctly. ++ * We clear PERF_EFLAGS_EXACT and take the rip from pt_regs then. ++ */ ++int forward_event_to_ibs(struct perf_event *event) ++{ ++ u64 config = 0; ++ ++ if (!event->attr.precise_ip || event->attr.precise_ip > 2) ++ return -EOPNOTSUPP; ++ ++ if (!core_pmu_ibs_config(event, &config)) { ++ event->attr.type = perf_ibs_op.pmu.type; ++ event->attr.config = config; ++ } ++ return -ENOENT; ++} ++ + static int perf_ibs_init(struct perf_event *event) + { + struct hw_perf_event *hwc = &event->hw; + struct perf_ibs *perf_ibs; + u64 max_cnt, config; +- int ret; + + perf_ibs = get_ibs_pmu(event->attr.type); +- if (perf_ibs) { +- config = event->attr.config; +- } else { +- perf_ibs = &perf_ibs_op; +- ret = perf_ibs_precise_event(event, &config); +- if (ret) +- return ret; +- } ++ if (!perf_ibs) ++ return -ENOENT; ++ ++ config = event->attr.config; + + if (event->pmu != &perf_ibs->pmu) + return -ENOENT; +diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h +index a2b6626c681f5..0e4efcde07831 100644 +--- a/arch/x86/include/asm/perf_event.h ++++ b/arch/x86/include/asm/perf_event.h +@@ -427,8 +427,10 @@ struct pebs_xmm { + + #ifdef CONFIG_X86_LOCAL_APIC + extern u32 get_ibs_caps(void); ++extern int forward_event_to_ibs(struct perf_event *event); + #else + static inline u32 get_ibs_caps(void) { return 0; } ++static inline int forward_event_to_ibs(struct perf_event *event) { return -ENOENT; } + #endif + + #ifdef CONFIG_PERF_EVENTS +-- +2.39.2 + diff --git a/queue-5.15/perf-script-fix-allocation-of-evsel-priv-related-to-.patch b/queue-5.15/perf-script-fix-allocation-of-evsel-priv-related-to-.patch new file mode 100644 index 00000000000..86b53906086 --- /dev/null +++ b/queue-5.15/perf-script-fix-allocation-of-evsel-priv-related-to-.patch @@ -0,0 +1,100 @@ +From 89bc631c761a471f1869d6f262b5958e667e56df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 16:11:10 -0300 +Subject: perf script: Fix allocation of evsel->priv related to per-event dump + files + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 36d3e4138e1b6cc9ab179f3f397b5548f8b1eaae ] + +When printing output we may want to generate per event files, where the +--per-event-dump option should be used, creating perf.data.EVENT.dump +files instead of printing to stdout. + +The callback thar processes event thus expects that evsel->priv->fp +should point to either the per-event FILE descriptor or to stdout. + +The a3af66f51bd0bca7 ("perf script: Fix crash because of missing +evsel->priv") changeset fixed a case where evsel->priv wasn't setup, +thus set to NULL, causing a segfault when trying to access +evsel->priv->fp. + +But it did it for the non --per-event-dump case by allocating a 'struct +perf_evsel_script' just to set its ->fp to stdout. + +Since evsel->priv is only freed when --per-event-dump is used, we ended +up with a memory leak, detected using ASAN. + +Fix it by using the same method as perf_script__setup_per_event_dump(), +and reuse that static 'struct perf_evsel_script'. + +Also check if evsel_script__new() failed. + +Fixes: a3af66f51bd0bca7 ("perf script: Fix crash because of missing evsel->priv") +Reported-by: Ian Rogers +Tested-by: Ian Rogers +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Ravi Bangoria +Link: https://lore.kernel.org/lkml/ZH+F0wGAWV14zvMP@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-script.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index c6c40191933d4..34e809c934d72 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -2260,6 +2260,9 @@ static int process_sample_event(struct perf_tool *tool, + return ret; + } + ++// Used when scr->per_event_dump is not set ++static struct evsel_script es_stdout; ++ + static int process_attr(struct perf_tool *tool, union perf_event *event, + struct evlist **pevlist) + { +@@ -2268,7 +2271,6 @@ static int process_attr(struct perf_tool *tool, union perf_event *event, + struct evsel *evsel, *pos; + u64 sample_type; + int err; +- static struct evsel_script *es; + + err = perf_event__process_attr(tool, event, pevlist); + if (err) +@@ -2278,14 +2280,13 @@ static int process_attr(struct perf_tool *tool, union perf_event *event, + evsel = evlist__last(*pevlist); + + if (!evsel->priv) { +- if (scr->per_event_dump) { ++ if (scr->per_event_dump) { + evsel->priv = evsel_script__new(evsel, scr->session->data); +- } else { +- es = zalloc(sizeof(*es)); +- if (!es) ++ if (!evsel->priv) + return -ENOMEM; +- es->fp = stdout; +- evsel->priv = es; ++ } else { // Replicate what is done in perf_script__setup_per_event_dump() ++ es_stdout.fp = stdout; ++ evsel->priv = &es_stdout; + } + } + +@@ -2591,7 +2592,6 @@ static int perf_script__fopen_per_event_dump(struct perf_script *script) + static int perf_script__setup_per_event_dump(struct perf_script *script) + { + struct evsel *evsel; +- static struct evsel_script es_stdout; + + if (script->per_event_dump) + return perf_script__fopen_per_event_dump(script); +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-at91-pio4-check-return-value-of-devm_kasprin.patch b/queue-5.15/pinctrl-at91-pio4-check-return-value-of-devm_kasprin.patch new file mode 100644 index 00000000000..ef1912c547a --- /dev/null +++ b/queue-5.15/pinctrl-at91-pio4-check-return-value-of-devm_kasprin.patch @@ -0,0 +1,41 @@ +From 28a3ad74bed268b648b0011a54efc53a68c44b32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 13:53:33 +0300 +Subject: pinctrl: at91-pio4: check return value of devm_kasprintf() + +From: Claudiu Beznea + +[ Upstream commit f6fd5d4ff8ca0b24cee1af4130bcb1fa96b61aa0 ] + +devm_kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 776180848b57 ("pinctrl: introduce driver for Atmel PIO4 controller") +Depends-on: 1c4e5c470a56 ("pinctrl: at91: use devm_kasprintf() to avoid potential leaks") +Depends-on: 5a8f9cf269e8 ("pinctrl: at91-pio4: use proper format specifier for unsigned int") +Signed-off-by: Claudiu Beznea +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230615105333.585304-4-claudiu.beznea@microchip.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-at91-pio4.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c +index e31f5d9febe9e..62b9a94c10baa 100644 +--- a/drivers/pinctrl/pinctrl-at91-pio4.c ++++ b/drivers/pinctrl/pinctrl-at91-pio4.c +@@ -1128,6 +1128,8 @@ static int atmel_pinctrl_probe(struct platform_device *pdev) + /* Pin naming convention: P(bank_name)(bank_pin_number). */ + pin_desc[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "P%c%d", + bank + 'A', line); ++ if (!pin_desc[i].name) ++ return -ENOMEM; + + group->name = group_names[i] = pin_desc[i].name; + group->pin = pin_desc[i].number; +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-bcm2835-handle-gpiochip_add_pin_range-errors.patch b/queue-5.15/pinctrl-bcm2835-handle-gpiochip_add_pin_range-errors.patch new file mode 100644 index 00000000000..4426ea486d8 --- /dev/null +++ b/queue-5.15/pinctrl-bcm2835-handle-gpiochip_add_pin_range-errors.patch @@ -0,0 +1,41 @@ +From 5aceae035434717889edadaa724e7d1934a36ed8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 23:43:41 +0200 +Subject: pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors + +From: Christophe JAILLET + +[ Upstream commit cdf7e616120065007687fe1df0412154f259daec ] + +gpiochip_add_pin_range() can fail, so better return its error code than +a hard coded '0'. + +Fixes: d2b67744fd99 ("pinctrl: bcm2835: implement hook for missing gpio-ranges") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/98c3b5890bb72415145c9fe4e1d974711edae376.1681681402.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/bcm/pinctrl-bcm2835.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +index 2c10086fd155b..7904ae5406da1 100644 +--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c ++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +@@ -359,10 +359,8 @@ static int bcm2835_of_gpio_ranges_fallback(struct gpio_chip *gc, + if (!pctldev) + return 0; + +- gpiochip_add_pin_range(gc, pinctrl_dev_get_devname(pctldev), 0, 0, +- gc->ngpio); +- +- return 0; ++ return gpiochip_add_pin_range(gc, pinctrl_dev_get_devname(pctldev), 0, 0, ++ gc->ngpio); + } + + static const struct gpio_chip bcm2835_gpio_chip = { +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-cherryview-return-correct-value-if-pin-in-pu.patch b/queue-5.15/pinctrl-cherryview-return-correct-value-if-pin-in-pu.patch new file mode 100644 index 00000000000..196e3c972c1 --- /dev/null +++ b/queue-5.15/pinctrl-cherryview-return-correct-value-if-pin-in-pu.patch @@ -0,0 +1,57 @@ +From 58a1074c703854788a5f4b5141f3fd9a1d788519 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 17:37:34 +0300 +Subject: pinctrl: cherryview: Return correct value if pin in push-pull mode + +From: Andy Shevchenko + +[ Upstream commit 5835196a17be5cfdcad0b617f90cf4abe16951a4 ] + +Currently the getter returns ENOTSUPP on pin configured in +the push-pull mode. Fix this by adding the missed switch case. + +Fixes: ccdf81d08dbe ("pinctrl: cherryview: add option to set open-drain pin config") +Fixes: 6e08d6bbebeb ("pinctrl: Add Intel Cherryview/Braswell pin controller support") +Acked-by: Mika Westerberg +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-cherryview.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c +index 980099028cf8a..34f0ec784dbe2 100644 +--- a/drivers/pinctrl/intel/pinctrl-cherryview.c ++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c +@@ -945,11 +945,6 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned int pin, + + break; + +- case PIN_CONFIG_DRIVE_OPEN_DRAIN: +- if (!(ctrl1 & CHV_PADCTRL1_ODEN)) +- return -EINVAL; +- break; +- + case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: { + u32 cfg; + +@@ -959,6 +954,16 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned int pin, + return -EINVAL; + + break; ++ ++ case PIN_CONFIG_DRIVE_PUSH_PULL: ++ if (ctrl1 & CHV_PADCTRL1_ODEN) ++ return -EINVAL; ++ break; ++ ++ case PIN_CONFIG_DRIVE_OPEN_DRAIN: ++ if (!(ctrl1 & CHV_PADCTRL1_ODEN)) ++ return -EINVAL; ++ break; + } + + default: +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-microchip-sgpio-check-return-value-of-devm_k.patch b/queue-5.15/pinctrl-microchip-sgpio-check-return-value-of-devm_k.patch new file mode 100644 index 00000000000..ce326358c76 --- /dev/null +++ b/queue-5.15/pinctrl-microchip-sgpio-check-return-value-of-devm_k.patch @@ -0,0 +1,40 @@ +From 122cfed49bb1fd09d3b674d70983cfca7a9c1930 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 13:53:32 +0300 +Subject: pinctrl: microchip-sgpio: check return value of devm_kasprintf() + +From: Claudiu Beznea + +[ Upstream commit 310cd4c206cd04696ccbfd1927b5ab6973e8cc8e ] + +devm_kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 7e5ea974e61c ("pinctrl: pinctrl-microchip-sgpio: Add pinctrl driver for Microsemi Serial GPIO") +Signed-off-by: Claudiu Beznea +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230615105333.585304-3-claudiu.beznea@microchip.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-microchip-sgpio.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-microchip-sgpio.c b/drivers/pinctrl/pinctrl-microchip-sgpio.c +index dfa374195694d..aceadc9ec0244 100644 +--- a/drivers/pinctrl/pinctrl-microchip-sgpio.c ++++ b/drivers/pinctrl/pinctrl-microchip-sgpio.c +@@ -729,6 +729,9 @@ static int microchip_sgpio_register_bank(struct device *dev, + pctl_desc->name = devm_kasprintf(dev, GFP_KERNEL, "%s-%sput", + dev_name(dev), + bank->is_input ? "in" : "out"); ++ if (!pctl_desc->name) ++ return -ENOMEM; ++ + pctl_desc->pctlops = &sgpio_pctl_ops; + pctl_desc->pmxops = &sgpio_pmx_ops; + pctl_desc->confops = &sgpio_confops; +-- +2.39.2 + diff --git a/queue-5.15/pm-domains-fix-integer-overflow-issues-in-genpd_pars.patch b/queue-5.15/pm-domains-fix-integer-overflow-issues-in-genpd_pars.patch new file mode 100644 index 00000000000..f52f20d2e8c --- /dev/null +++ b/queue-5.15/pm-domains-fix-integer-overflow-issues-in-genpd_pars.patch @@ -0,0 +1,48 @@ +From ff5e129ec89dbd8205a59763797ec328bc538676 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 06:07:43 -0700 +Subject: PM: domains: fix integer overflow issues in genpd_parse_state() + +From: Nikita Zhandarovich + +[ Upstream commit e5d1c8722083f0332dcd3c85fa1273d85fb6bed8 ] + +Currently, while calculating residency and latency values, right +operands may overflow if resulting values are big enough. + +To prevent this, albeit unlikely case, play it safe and convert +right operands to left ones' type s64. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 30f604283e05 ("PM / Domains: Allow domain power states to be read from DT") +Signed-off-by: Nikita Zhandarovich +Acked-by: Ulf Hansson +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/domain.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c +index 24a82e252b7e1..6ffee01e174da 100644 +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -2860,10 +2860,10 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state, + + err = of_property_read_u32(state_node, "min-residency-us", &residency); + if (!err) +- genpd_state->residency_ns = 1000 * residency; ++ genpd_state->residency_ns = 1000LL * residency; + +- genpd_state->power_on_latency_ns = 1000 * exit_latency; +- genpd_state->power_off_latency_ns = 1000 * entry_latency; ++ genpd_state->power_on_latency_ns = 1000LL * exit_latency; ++ genpd_state->power_off_latency_ns = 1000LL * entry_latency; + genpd_state->fwnode = &state_node->fwnode; + + return 0; +-- +2.39.2 + diff --git a/queue-5.15/posix-timers-prevent-rt-livelock-in-itimer_delete.patch b/queue-5.15/posix-timers-prevent-rt-livelock-in-itimer_delete.patch new file mode 100644 index 00000000000..edb9cfe8ab1 --- /dev/null +++ b/queue-5.15/posix-timers-prevent-rt-livelock-in-itimer_delete.patch @@ -0,0 +1,110 @@ +From dd947ef08589e65c8f9b547bf4b512666c9567f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 22:16:34 +0200 +Subject: posix-timers: Prevent RT livelock in itimer_delete() + +From: Thomas Gleixner + +[ Upstream commit 9d9e522010eb5685d8b53e8a24320653d9d4cbbf ] + +itimer_delete() has a retry loop when the timer is concurrently expired. On +non-RT kernels this just spin-waits until the timer callback has completed, +except for posix CPU timers which have HAVE_POSIX_CPU_TIMERS_TASK_WORK +enabled. + +In that case and on RT kernels the existing task could live lock when +preempting the task which does the timer delivery. + +Replace spin_unlock() with an invocation of timer_wait_running() to handle +it the same way as the other retry loops in the posix timer code. + +Fixes: ec8f954a40da ("posix-timers: Use a callback for cancel synchronization on PREEMPT_RT") +Signed-off-by: Thomas Gleixner +Reviewed-by: Frederic Weisbecker +Link: https://lore.kernel.org/r/87v8g7c50d.ffs@tglx +Signed-off-by: Sasha Levin +--- + kernel/time/posix-timers.c | 43 +++++++++++++++++++++++++++++++------- + 1 file changed, 35 insertions(+), 8 deletions(-) + +diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c +index 808a247205a9a..ed3c4a9543982 100644 +--- a/kernel/time/posix-timers.c ++++ b/kernel/time/posix-timers.c +@@ -1037,27 +1037,52 @@ SYSCALL_DEFINE1(timer_delete, timer_t, timer_id) + } + + /* +- * return timer owned by the process, used by exit_itimers ++ * Delete a timer if it is armed, remove it from the hash and schedule it ++ * for RCU freeing. + */ + static void itimer_delete(struct k_itimer *timer) + { +-retry_delete: +- spin_lock_irq(&timer->it_lock); ++ unsigned long flags; ++ ++ /* ++ * irqsave is required to make timer_wait_running() work. ++ */ ++ spin_lock_irqsave(&timer->it_lock, flags); + ++retry_delete: ++ /* ++ * Even if the timer is not longer accessible from other tasks ++ * it still might be armed and queued in the underlying timer ++ * mechanism. Worse, that timer mechanism might run the expiry ++ * function concurrently. ++ */ + if (timer_delete_hook(timer) == TIMER_RETRY) { +- spin_unlock_irq(&timer->it_lock); ++ /* ++ * Timer is expired concurrently, prevent livelocks ++ * and pointless spinning on RT. ++ * ++ * timer_wait_running() drops timer::it_lock, which opens ++ * the possibility for another task to delete the timer. ++ * ++ * That's not possible here because this is invoked from ++ * do_exit() only for the last thread of the thread group. ++ * So no other task can access and delete that timer. ++ */ ++ if (WARN_ON_ONCE(timer_wait_running(timer, &flags) != timer)) ++ return; ++ + goto retry_delete; + } + list_del(&timer->list); + +- spin_unlock_irq(&timer->it_lock); ++ spin_unlock_irqrestore(&timer->it_lock, flags); + release_posix_timer(timer, IT_ID_SET); + } + + /* +- * This is called by do_exit or de_thread, only when nobody else can +- * modify the signal->posix_timers list. Yet we need sighand->siglock +- * to prevent the race with /proc/pid/timers. ++ * Invoked from do_exit() when the last thread of a thread group exits. ++ * At that point no other task can access the timers of the dying ++ * task anymore. + */ + void exit_itimers(struct task_struct *tsk) + { +@@ -1067,10 +1092,12 @@ void exit_itimers(struct task_struct *tsk) + if (list_empty(&tsk->signal->posix_timers)) + return; + ++ /* Protect against concurrent read via /proc/$PID/timers */ + spin_lock_irq(&tsk->sighand->siglock); + list_replace_init(&tsk->signal->posix_timers, &timers); + spin_unlock_irq(&tsk->sighand->siglock); + ++ /* The timers are not longer accessible via tsk::signal */ + while (!list_empty(&timers)) { + tmr = list_first_entry(&timers, struct k_itimer, list); + itimer_delete(tmr); +-- +2.39.2 + diff --git a/queue-5.15/powercap-rapl-fix-config_iosf_mbi-dependency.patch b/queue-5.15/powercap-rapl-fix-config_iosf_mbi-dependency.patch new file mode 100644 index 00000000000..000695203d6 --- /dev/null +++ b/queue-5.15/powercap-rapl-fix-config_iosf_mbi-dependency.patch @@ -0,0 +1,73 @@ +From a89046faeb052de2a1b98de185df94042d026031 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 22:00:00 +0800 +Subject: powercap: RAPL: Fix CONFIG_IOSF_MBI dependency + +From: Zhang Rui + +[ Upstream commit 4658fe81b3f8afe8adf37734ec5fe595d90415c6 ] + +After commit 3382388d7148 ("intel_rapl: abstract RAPL common code"), +accessing to IOSF_MBI interface is done in the RAPL common code. + +Thus it is the CONFIG_INTEL_RAPL_CORE that has dependency of +CONFIG_IOSF_MBI, while CONFIG_INTEL_RAPL_MSR does not. + +This problem was not exposed previously because all the previous RAPL +common code users, aka, the RAPL MSR and MMIO I/F drivers, have +CONFIG_IOSF_MBI selected. + +Fix the CONFIG_IOSF_MBI dependency in RAPL code. This also fixes a build +time failure when the RAPL TPMI I/F driver is introduced without +selecting CONFIG_IOSF_MBI. + +x86_64-linux-ld: vmlinux.o: in function `set_floor_freq_atom': +intel_rapl_common.c:(.text+0x2dac9b8): undefined reference to `iosf_mbi_write' +x86_64-linux-ld: intel_rapl_common.c:(.text+0x2daca66): undefined reference to `iosf_mbi_read' + +Reference to iosf_mbi.h is also removed from the RAPL MSR I/F driver. + +Fixes: 3382388d7148 ("intel_rapl: abstract RAPL common code") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/all/20230601213246.3271412-1-arnd@kernel.org +Signed-off-by: Zhang Rui +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/powercap/Kconfig | 4 +++- + drivers/powercap/intel_rapl_msr.c | 1 - + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/powercap/Kconfig b/drivers/powercap/Kconfig +index 8242e8c5ed77e..503797b2a1c69 100644 +--- a/drivers/powercap/Kconfig ++++ b/drivers/powercap/Kconfig +@@ -18,10 +18,12 @@ if POWERCAP + # Client driver configurations go here. + config INTEL_RAPL_CORE + tristate ++ depends on PCI ++ select IOSF_MBI + + config INTEL_RAPL + tristate "Intel RAPL Support via MSR Interface" +- depends on X86 && IOSF_MBI ++ depends on X86 && PCI + select INTEL_RAPL_CORE + help + This enables support for the Intel Running Average Power Limit (RAPL) +diff --git a/drivers/powercap/intel_rapl_msr.c b/drivers/powercap/intel_rapl_msr.c +index 1be45f36ab6cd..c19e69e77093b 100644 +--- a/drivers/powercap/intel_rapl_msr.c ++++ b/drivers/powercap/intel_rapl_msr.c +@@ -22,7 +22,6 @@ + #include + #include + +-#include + #include + #include + +-- +2.39.2 + diff --git a/queue-5.15/powerpc-64s-fix-vas-mm-use-after-free.patch b/queue-5.15/powerpc-64s-fix-vas-mm-use-after-free.patch new file mode 100644 index 00000000000..082f40bc84e --- /dev/null +++ b/queue-5.15/powerpc-64s-fix-vas-mm-use-after-free.patch @@ -0,0 +1,55 @@ +From f52ca4f5e116c06793936c44c6604a1facfbe464 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jun 2023 20:10:24 +1000 +Subject: powerpc/64s: Fix VAS mm use after free + +From: Nicholas Piggin + +[ Upstream commit b4bda59b47879cce38a6ec5a01cd3cac702b5331 ] + +The refcount on mm is dropped before the coprocessor is detached. + +Reported-by: Sachin Sant +Fixes: 7bc6f71bdff5f ("powerpc/vas: Define and use common vas_window struct") +Fixes: b22f2d88e435c ("powerpc/pseries/vas: Integrate API with open/close windows") +Signed-off-by: Nicholas Piggin +Tested-by: Sachin Sant +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230607101024.14559-1-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/vas-window.c | 2 +- + arch/powerpc/platforms/pseries/vas.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/platforms/powernv/vas-window.c b/arch/powerpc/platforms/powernv/vas-window.c +index 0072682531d80..b664838008c12 100644 +--- a/arch/powerpc/platforms/powernv/vas-window.c ++++ b/arch/powerpc/platforms/powernv/vas-window.c +@@ -1310,8 +1310,8 @@ int vas_win_close(struct vas_window *vwin) + /* if send window, drop reference to matching receive window */ + if (window->tx_win) { + if (window->user_win) { +- put_vas_user_win_ref(&vwin->task_ref); + mm_context_remove_vas_window(vwin->task_ref.mm); ++ put_vas_user_win_ref(&vwin->task_ref); + } + put_rx_win(window->rxwin); + } +diff --git a/arch/powerpc/platforms/pseries/vas.c b/arch/powerpc/platforms/pseries/vas.c +index 15046d80f0427..b54f6fc27896f 100644 +--- a/arch/powerpc/platforms/pseries/vas.c ++++ b/arch/powerpc/platforms/pseries/vas.c +@@ -441,8 +441,8 @@ static int vas_deallocate_window(struct vas_window *vwin) + atomic_dec(&caps->used_lpar_creds); + mutex_unlock(&vas_pseries_mutex); + +- put_vas_user_win_ref(&vwin->task_ref); + mm_context_remove_vas_window(vwin->task_ref.mm); ++ put_vas_user_win_ref(&vwin->task_ref); + + kfree(win); + return 0; +-- +2.39.2 + diff --git a/queue-5.15/powerpc-book3s64-mm-fix-directmap-stats-in-proc-memi.patch b/queue-5.15/powerpc-book3s64-mm-fix-directmap-stats-in-proc-memi.patch new file mode 100644 index 00000000000..8f18bcaa352 --- /dev/null +++ b/queue-5.15/powerpc-book3s64-mm-fix-directmap-stats-in-proc-memi.patch @@ -0,0 +1,158 @@ +From 0019ae64ef464366109ae5d410a7d25b0c994b8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 16:38:13 +0530 +Subject: powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo + +From: Aneesh Kumar K.V + +[ Upstream commit 0da90af431abc3f497a38ec9ef6e43b0d0dabe80 ] + +On memory unplug reduce DirectMap page count correctly. +root@ubuntu-guest:# grep Direct /proc/meminfo +DirectMap4k: 0 kB +DirectMap64k: 0 kB +DirectMap2M: 115343360 kB +DirectMap1G: 0 kB + +Before fix: +root@ubuntu-guest:# ndctl disable-namespace all +disabled 1 namespace +root@ubuntu-guest:# grep Direct /proc/meminfo +DirectMap4k: 0 kB +DirectMap64k: 0 kB +DirectMap2M: 115343360 kB +DirectMap1G: 0 kB + +After fix: +root@ubuntu-guest:# ndctl disable-namespace all +disabled 1 namespace +root@ubuntu-guest:# grep Direct /proc/meminfo +DirectMap4k: 0 kB +DirectMap64k: 0 kB +DirectMap2M: 104857600 kB +DirectMap1G: 0 kB + +Fixes: a2dc009afa9a ("powerpc/mm/book3s/radix: Add mapping statistics") +Signed-off-by: Aneesh Kumar K.V +Tested-by: Sachin Sant > +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230616110826.344417-4-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/book3s64/radix_pgtable.c | 34 +++++++++++++++--------- + 1 file changed, 22 insertions(+), 12 deletions(-) + +diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c +index 1d9d7efacbc79..832dfc59fc6c6 100644 +--- a/arch/powerpc/mm/book3s64/radix_pgtable.c ++++ b/arch/powerpc/mm/book3s64/radix_pgtable.c +@@ -764,9 +764,9 @@ static void free_pud_table(pud_t *pud_start, p4d_t *p4d) + } + + static void remove_pte_table(pte_t *pte_start, unsigned long addr, +- unsigned long end) ++ unsigned long end, bool direct) + { +- unsigned long next; ++ unsigned long next, pages = 0; + pte_t *pte; + + pte = pte_start + pte_index(addr); +@@ -788,13 +788,16 @@ static void remove_pte_table(pte_t *pte_start, unsigned long addr, + } + + pte_clear(&init_mm, addr, pte); ++ pages++; + } ++ if (direct) ++ update_page_count(mmu_virtual_psize, -pages); + } + + static void __meminit remove_pmd_table(pmd_t *pmd_start, unsigned long addr, +- unsigned long end) ++ unsigned long end, bool direct) + { +- unsigned long next; ++ unsigned long next, pages = 0; + pte_t *pte_base; + pmd_t *pmd; + +@@ -812,19 +815,22 @@ static void __meminit remove_pmd_table(pmd_t *pmd_start, unsigned long addr, + continue; + } + pte_clear(&init_mm, addr, (pte_t *)pmd); ++ pages++; + continue; + } + + pte_base = (pte_t *)pmd_page_vaddr(*pmd); +- remove_pte_table(pte_base, addr, next); ++ remove_pte_table(pte_base, addr, next, direct); + free_pte_table(pte_base, pmd); + } ++ if (direct) ++ update_page_count(MMU_PAGE_2M, -pages); + } + + static void __meminit remove_pud_table(pud_t *pud_start, unsigned long addr, +- unsigned long end) ++ unsigned long end, bool direct) + { +- unsigned long next; ++ unsigned long next, pages = 0; + pmd_t *pmd_base; + pud_t *pud; + +@@ -842,16 +848,20 @@ static void __meminit remove_pud_table(pud_t *pud_start, unsigned long addr, + continue; + } + pte_clear(&init_mm, addr, (pte_t *)pud); ++ pages++; + continue; + } + + pmd_base = pud_pgtable(*pud); +- remove_pmd_table(pmd_base, addr, next); ++ remove_pmd_table(pmd_base, addr, next, direct); + free_pmd_table(pmd_base, pud); + } ++ if (direct) ++ update_page_count(MMU_PAGE_1G, -pages); + } + +-static void __meminit remove_pagetable(unsigned long start, unsigned long end) ++static void __meminit remove_pagetable(unsigned long start, unsigned long end, ++ bool direct) + { + unsigned long addr, next; + pud_t *pud_base; +@@ -880,7 +890,7 @@ static void __meminit remove_pagetable(unsigned long start, unsigned long end) + } + + pud_base = p4d_pgtable(*p4d); +- remove_pud_table(pud_base, addr, next); ++ remove_pud_table(pud_base, addr, next, direct); + free_pud_table(pud_base, p4d); + } + +@@ -903,7 +913,7 @@ int __meminit radix__create_section_mapping(unsigned long start, + + int __meminit radix__remove_section_mapping(unsigned long start, unsigned long end) + { +- remove_pagetable(start, end); ++ remove_pagetable(start, end, true); + return 0; + } + #endif /* CONFIG_MEMORY_HOTPLUG */ +@@ -939,7 +949,7 @@ int __meminit radix__vmemmap_create_mapping(unsigned long start, + #ifdef CONFIG_MEMORY_HOTPLUG + void __meminit radix__vmemmap_remove_mapping(unsigned long start, unsigned long page_size) + { +- remove_pagetable(start, start + page_size); ++ remove_pagetable(start, start + page_size, false); + } + #endif + #endif +-- +2.39.2 + diff --git a/queue-5.15/powerpc-interrupt-don-t-read-msr-from-interrupt_exit.patch b/queue-5.15/powerpc-interrupt-don-t-read-msr-from-interrupt_exit.patch new file mode 100644 index 00000000000..e3b2353081f --- /dev/null +++ b/queue-5.15/powerpc-interrupt-don-t-read-msr-from-interrupt_exit.patch @@ -0,0 +1,58 @@ +From ae3cf776120039aafd4384d5bb873d11345e77bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 10:55:26 +0200 +Subject: powerpc/interrupt: Don't read MSR from + interrupt_exit_kernel_prepare() + +From: Christophe Leroy + +[ Upstream commit 0eb089a72fda3f7969e6277804bde75dc1474a14 ] + +A disassembly of interrupt_exit_kernel_prepare() shows a useless read +of MSR register. This is shown by r9 being re-used immediately without +doing anything with the value read. + + c000e0e0: 60 00 00 00 nop + c000e0e4: 7d 3a c2 a6 mfmd_ap r9 + c000e0e8: 7d 20 00 a6 mfmsr r9 + c000e0ec: 7c 51 13 a6 mtspr 81,r2 + c000e0f0: 81 3f 00 84 lwz r9,132(r31) + c000e0f4: 71 29 80 00 andi. r9,r9,32768 + +This is due to the use of local_irq_save(). The flags read by +local_irq_save() are never used, use local_irq_disable() instead. + +Fixes: 13799748b957 ("powerpc/64: use interrupt restart table to speed up return from interrupt") +Signed-off-by: Christophe Leroy +Reviewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://msgid.link/df36c6205ab64326fb1b991993c82057e92ace2f.1685955214.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/interrupt.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/powerpc/kernel/interrupt.c b/arch/powerpc/kernel/interrupt.c +index 8703df709cce8..e93f67c3af76b 100644 +--- a/arch/powerpc/kernel/interrupt.c ++++ b/arch/powerpc/kernel/interrupt.c +@@ -531,7 +531,6 @@ void preempt_schedule_irq(void); + + notrace unsigned long interrupt_exit_kernel_prepare(struct pt_regs *regs) + { +- unsigned long flags; + unsigned long ret = 0; + unsigned long kuap; + bool stack_store = current_thread_info()->flags & +@@ -548,7 +547,7 @@ notrace unsigned long interrupt_exit_kernel_prepare(struct pt_regs *regs) + + kuap = kuap_get_and_assert_locked(); + +- local_irq_save(flags); ++ local_irq_disable(); + + if (!arch_irq_disabled_regs(regs)) { + /* Returning to a kernel context with local irqs enabled. */ +-- +2.39.2 + diff --git a/queue-5.15/powerpc-mm-dax-fix-the-condition-when-checking-if-al.patch b/queue-5.15/powerpc-mm-dax-fix-the-condition-when-checking-if-al.patch new file mode 100644 index 00000000000..d64379ca420 --- /dev/null +++ b/queue-5.15/powerpc-mm-dax-fix-the-condition-when-checking-if-al.patch @@ -0,0 +1,40 @@ +From c3ce08eea95b9cb1a7b9d31c50dff775617344bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 16:38:15 +0530 +Subject: powerpc/mm/dax: Fix the condition when checking if altmap vmemap can + cross-boundary + +From: Aneesh Kumar K.V + +[ Upstream commit c8eebc4a99f15280654f23e914e746c40a516e50 ] + +Without this fix, the last subsection vmemmap can end up in memory even if +the namespace is created with -M mem and has sufficient space in the altmap +area. + +Fixes: cf387d9644d8 ("libnvdimm/altmap: Track namespace boundaries in altmap") +Signed-off-by: Aneesh Kumar K.V +Tested-by: Sachin Sant > +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230616110826.344417-6-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/init_64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c +index 386be136026e8..b76cd49d521b9 100644 +--- a/arch/powerpc/mm/init_64.c ++++ b/arch/powerpc/mm/init_64.c +@@ -188,7 +188,7 @@ static bool altmap_cross_boundary(struct vmem_altmap *altmap, unsigned long star + unsigned long nr_pfn = page_size / sizeof(struct page); + unsigned long start_pfn = page_to_pfn((struct page *)start); + +- if ((start_pfn + nr_pfn) > altmap->end_pfn) ++ if ((start_pfn + nr_pfn - 1) > altmap->end_pfn) + return true; + + if (start_pfn < altmap->base_pfn) +-- +2.39.2 + diff --git a/queue-5.15/powerpc-powernv-sriov-perform-null-check-on-iov-befo.patch b/queue-5.15/powerpc-powernv-sriov-perform-null-check-on-iov-befo.patch new file mode 100644 index 00000000000..26aba19c33d --- /dev/null +++ b/queue-5.15/powerpc-powernv-sriov-perform-null-check-on-iov-befo.patch @@ -0,0 +1,53 @@ +From 26a10cea363232c4f830101d7f338b916201974d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 10:58:49 +0100 +Subject: powerpc/powernv/sriov: perform null check on iov before dereferencing + iov + +From: Colin Ian King + +[ Upstream commit f4f913c980bc6abe0ccfe88fe3909c125afe4a2d ] + +Currently pointer iov is being dereferenced before the null check of iov +which can lead to null pointer dereference errors. Fix this by moving the +iov null check before the dereferencing. + +Detected using cppcheck static analysis: +linux/arch/powerpc/platforms/powernv/pci-sriov.c:597:12: warning: Either +the condition '!iov' is redundant or there is possible null pointer +dereference: iov. [nullPointerRedundantCheck] + num_vfs = iov->num_vfs; + ^ + +Fixes: 052da31d45fc ("powerpc/powernv/sriov: De-indent setup and teardown") +Signed-off-by: Colin Ian King +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230608095849.1147969-1-colin.i.king@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/pci-sriov.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/platforms/powernv/pci-sriov.c b/arch/powerpc/platforms/powernv/pci-sriov.c +index 28aac933a4391..e3e52ff2cbf58 100644 +--- a/arch/powerpc/platforms/powernv/pci-sriov.c ++++ b/arch/powerpc/platforms/powernv/pci-sriov.c +@@ -600,12 +600,12 @@ static void pnv_pci_sriov_disable(struct pci_dev *pdev) + struct pnv_iov_data *iov; + + iov = pnv_iov_get(pdev); +- num_vfs = iov->num_vfs; +- base_pe = iov->vf_pe_arr[0].pe_number; +- + if (WARN_ON(!iov)) + return; + ++ num_vfs = iov->num_vfs; ++ base_pe = iov->vf_pe_arr[0].pe_number; ++ + /* Release VF PEs */ + pnv_ioda_release_vf_PE(pdev); + +-- +2.39.2 + diff --git a/queue-5.15/powerpc-signal32-force-inlining-of-__unsafe_save_use.patch b/queue-5.15/powerpc-signal32-force-inlining-of-__unsafe_save_use.patch new file mode 100644 index 00000000000..daee55203d7 --- /dev/null +++ b/queue-5.15/powerpc-signal32-force-inlining-of-__unsafe_save_use.patch @@ -0,0 +1,79 @@ +From b2e0bbb63a1e36b6d7771d71ae2fb2dcad45b3ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 10:58:35 +0200 +Subject: powerpc/signal32: Force inlining of __unsafe_save_user_regs() and + save_tm_user_regs_unsafe() + +From: Christophe Leroy + +[ Upstream commit a03b1a0b19398a47489fdcef02ec19c2ba05a15d ] + +Looking at generated code for handle_signal32() shows calls to a +function called __unsafe_save_user_regs.constprop.0 while user access +is open. + +And that __unsafe_save_user_regs.constprop.0 function has two nops at +the begining, allowing it to be traced, which is unexpected during +user access open window. + +The solution could be to mark __unsafe_save_user_regs() no trace, but +to be on the safe side the most efficient is to flag it __always_inline +as already done for function __unsafe_restore_general_regs(). The +function is relatively small and only called twice, so the size +increase will remain in the noise. + +Do the same with save_tm_user_regs_unsafe() as it may suffer the +same issue. + +Fixes: ef75e7318294 ("powerpc/signal32: Transform save_user_regs() and save_tm_user_regs() in 'unsafe' version") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/7e469c8f01860a69c1ada3ca6a5e2aa65f0f74b2.1685955220.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/signal_32.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c +index 3e053e2fd6b69..68ed8ecf64fcc 100644 +--- a/arch/powerpc/kernel/signal_32.c ++++ b/arch/powerpc/kernel/signal_32.c +@@ -258,8 +258,9 @@ static void prepare_save_user_regs(int ctx_has_vsx_region) + #endif + } + +-static int __unsafe_save_user_regs(struct pt_regs *regs, struct mcontext __user *frame, +- struct mcontext __user *tm_frame, int ctx_has_vsx_region) ++static __always_inline int ++__unsafe_save_user_regs(struct pt_regs *regs, struct mcontext __user *frame, ++ struct mcontext __user *tm_frame, int ctx_has_vsx_region) + { + unsigned long msr = regs->msr; + +@@ -358,8 +359,9 @@ static void prepare_save_tm_user_regs(void) + current->thread.ckvrsave = mfspr(SPRN_VRSAVE); + } + +-static int save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame, +- struct mcontext __user *tm_frame, unsigned long msr) ++static __always_inline int ++save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame, ++ struct mcontext __user *tm_frame, unsigned long msr) + { + /* Save both sets of general registers */ + unsafe_save_general_regs(¤t->thread.ckpt_regs, frame, failed); +@@ -438,8 +440,9 @@ static int save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user + #else + static void prepare_save_tm_user_regs(void) { } + +-static int save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame, +- struct mcontext __user *tm_frame, unsigned long msr) ++static __always_inline int ++save_tm_user_regs_unsafe(struct pt_regs *regs, struct mcontext __user *frame, ++ struct mcontext __user *tm_frame, unsigned long msr) + { + return 0; + } +-- +2.39.2 + diff --git a/queue-5.15/powerpc-simplify-ppc_save_regs.patch b/queue-5.15/powerpc-simplify-ppc_save_regs.patch new file mode 100644 index 00000000000..e4848a7c816 --- /dev/null +++ b/queue-5.15/powerpc-simplify-ppc_save_regs.patch @@ -0,0 +1,104 @@ +From f46db5273f4d90a84ffbc987659d10056355397d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Nov 2022 22:49:31 +1000 +Subject: powerpc: simplify ppc_save_regs + +From: Nicholas Piggin + +[ Upstream commit 37195b820d32c23bdefce3f460ed7de48a57e5e4 ] + +Adjust the pt_regs pointer so the interrupt frame offsets can be used +to save registers. + +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20221127124942.1665522-7-npiggin@gmail.com +Stable-dep-of: b684c09f09e7 ("powerpc: update ppc_save_regs to save current r1 in pt_regs") +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/ppc_save_regs.S | 57 ++++++++--------------------- + 1 file changed, 15 insertions(+), 42 deletions(-) + +diff --git a/arch/powerpc/kernel/ppc_save_regs.S b/arch/powerpc/kernel/ppc_save_regs.S +index 2d4d21bb46a97..6e86f3bf46735 100644 +--- a/arch/powerpc/kernel/ppc_save_regs.S ++++ b/arch/powerpc/kernel/ppc_save_regs.S +@@ -21,60 +21,33 @@ + * different ABIs, though). + */ + _GLOBAL(ppc_save_regs) +- PPC_STL r0,0*SZL(r3) ++ /* This allows stack frame accessor macros and offsets to be used */ ++ subi r3,r3,STACK_FRAME_OVERHEAD ++ PPC_STL r0,GPR0(r3) + #ifdef CONFIG_PPC32 +- stmw r2, 2*SZL(r3) ++ stmw r2,GPR2(r3) + #else +- PPC_STL r2,2*SZL(r3) +- PPC_STL r3,3*SZL(r3) +- PPC_STL r4,4*SZL(r3) +- PPC_STL r5,5*SZL(r3) +- PPC_STL r6,6*SZL(r3) +- PPC_STL r7,7*SZL(r3) +- PPC_STL r8,8*SZL(r3) +- PPC_STL r9,9*SZL(r3) +- PPC_STL r10,10*SZL(r3) +- PPC_STL r11,11*SZL(r3) +- PPC_STL r12,12*SZL(r3) +- PPC_STL r13,13*SZL(r3) +- PPC_STL r14,14*SZL(r3) +- PPC_STL r15,15*SZL(r3) +- PPC_STL r16,16*SZL(r3) +- PPC_STL r17,17*SZL(r3) +- PPC_STL r18,18*SZL(r3) +- PPC_STL r19,19*SZL(r3) +- PPC_STL r20,20*SZL(r3) +- PPC_STL r21,21*SZL(r3) +- PPC_STL r22,22*SZL(r3) +- PPC_STL r23,23*SZL(r3) +- PPC_STL r24,24*SZL(r3) +- PPC_STL r25,25*SZL(r3) +- PPC_STL r26,26*SZL(r3) +- PPC_STL r27,27*SZL(r3) +- PPC_STL r28,28*SZL(r3) +- PPC_STL r29,29*SZL(r3) +- PPC_STL r30,30*SZL(r3) +- PPC_STL r31,31*SZL(r3) ++ SAVE_GPRS(2, 31, r3) + lbz r0,PACAIRQSOFTMASK(r13) +- PPC_STL r0,SOFTE-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,SOFTE(r3) + #endif + /* go up one stack frame for SP */ + PPC_LL r4,0(r1) +- PPC_STL r4,1*SZL(r3) ++ PPC_STL r4,GPR1(r3) + /* get caller's LR */ + PPC_LL r0,LRSAVE(r4) +- PPC_STL r0,_LINK-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_LINK(r3) + mflr r0 +- PPC_STL r0,_NIP-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_NIP(r3) + mfmsr r0 +- PPC_STL r0,_MSR-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_MSR(r3) + mfctr r0 +- PPC_STL r0,_CTR-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_CTR(r3) + mfxer r0 +- PPC_STL r0,_XER-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_XER(r3) + mfcr r0 +- PPC_STL r0,_CCR-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_CCR(r3) + li r0,0 +- PPC_STL r0,_TRAP-STACK_FRAME_OVERHEAD(r3) +- PPC_STL r0,ORIG_GPR3-STACK_FRAME_OVERHEAD(r3) ++ PPC_STL r0,_TRAP(r3) ++ PPC_STL r0,ORIG_GPR3(r3) + blr +-- +2.39.2 + diff --git a/queue-5.15/powerpc-update-ppc_save_regs-to-save-current-r1-in-p.patch b/queue-5.15/powerpc-update-ppc_save_regs-to-save-current-r1-in-p.patch new file mode 100644 index 00000000000..ff7fe268355 --- /dev/null +++ b/queue-5.15/powerpc-update-ppc_save_regs-to-save-current-r1-in-p.patch @@ -0,0 +1,104 @@ +From eeeab3a668233bc74a8948e42443981213a9e5bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 14:40:47 +0530 +Subject: powerpc: update ppc_save_regs to save current r1 in pt_regs + +From: Aditya Gupta + +[ Upstream commit b684c09f09e7a6af3794d4233ef785819e72db79 ] + +ppc_save_regs() skips one stack frame while saving the CPU register states. +Instead of saving current R1, it pulls the previous stack frame pointer. + +When vmcores caused by direct panic call (such as `echo c > +/proc/sysrq-trigger`), are debugged with gdb, gdb fails to show the +backtrace correctly. On further analysis, it was found that it was because +of mismatch between r1 and NIP. + +GDB uses NIP to get current function symbol and uses corresponding debug +info of that function to unwind previous frames, but due to the +mismatching r1 and NIP, the unwinding does not work, and it fails to +unwind to the 2nd frame and hence does not show the backtrace. + +GDB backtrace with vmcore of kernel without this patch: + +--------- +(gdb) bt + #0 0xc0000000002a53e8 in crash_setup_regs (oldregs=, + newregs=0xc000000004f8f8d8) at ./arch/powerpc/include/asm/kexec.h:69 + #1 __crash_kexec (regs=) at kernel/kexec_core.c:974 + #2 0x0000000000000063 in ?? () + #3 0xc000000003579320 in ?? () +--------- + +Further analysis revealed that the mismatch occurred because +"ppc_save_regs" was saving the previous stack's SP instead of the current +r1. This patch fixes this by storing current r1 in the saved pt_regs. + +GDB backtrace with vmcore of patched kernel: + +-------- +(gdb) bt + #0 0xc0000000002a53e8 in crash_setup_regs (oldregs=0x0, newregs=0xc00000000670b8d8) + at ./arch/powerpc/include/asm/kexec.h:69 + #1 __crash_kexec (regs=regs@entry=0x0) at kernel/kexec_core.c:974 + #2 0xc000000000168918 in panic (fmt=fmt@entry=0xc000000001654a60 "sysrq triggered crash\n") + at kernel/panic.c:358 + #3 0xc000000000b735f8 in sysrq_handle_crash (key=) at drivers/tty/sysrq.c:155 + #4 0xc000000000b742cc in __handle_sysrq (key=key@entry=99, check_mask=check_mask@entry=false) + at drivers/tty/sysrq.c:602 + #5 0xc000000000b7506c in write_sysrq_trigger (file=, buf=, + count=2, ppos=) at drivers/tty/sysrq.c:1163 + #6 0xc00000000069a7bc in pde_write (ppos=, count=, + buf=, file=, pde=0xc00000000362cb40) at fs/proc/inode.c:340 + #7 proc_reg_write (file=, buf=, count=, + ppos=) at fs/proc/inode.c:352 + #8 0xc0000000005b3bbc in vfs_write (file=file@entry=0xc000000006aa6b00, + buf=buf@entry=0x61f498b4f60 , + count=count@entry=2, pos=pos@entry=0xc00000000670bda0) at fs/read_write.c:582 + #9 0xc0000000005b4264 in ksys_write (fd=, + buf=0x61f498b4f60 , count=2) + at fs/read_write.c:637 + #10 0xc00000000002ea2c in system_call_exception (regs=0xc00000000670be80, r0=) + at arch/powerpc/kernel/syscall.c:171 + #11 0xc00000000000c270 in system_call_vectored_common () + at arch/powerpc/kernel/interrupt_64.S:192 +-------- + +Nick adds: + So this now saves regs as though it was an interrupt taken in the + caller, at the instruction after the call to ppc_save_regs, whereas + previously the NIP was there, but R1 came from the caller's caller and + that mismatch is what causes gdb's dwarf unwinder to go haywire. + +Signed-off-by: Aditya Gupta +Fixes: d16a58f8854b1 ("powerpc: Improve ppc_save_regs()") +Reivewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230615091047.90433-1-adityag@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/ppc_save_regs.S | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/kernel/ppc_save_regs.S b/arch/powerpc/kernel/ppc_save_regs.S +index 6e86f3bf46735..235ae24284519 100644 +--- a/arch/powerpc/kernel/ppc_save_regs.S ++++ b/arch/powerpc/kernel/ppc_save_regs.S +@@ -31,10 +31,10 @@ _GLOBAL(ppc_save_regs) + lbz r0,PACAIRQSOFTMASK(r13) + PPC_STL r0,SOFTE(r3) + #endif +- /* go up one stack frame for SP */ +- PPC_LL r4,0(r1) +- PPC_STL r4,GPR1(r3) ++ /* store current SP */ ++ PPC_STL r1,GPR1(r3) + /* get caller's LR */ ++ PPC_LL r4,0(r1) + PPC_LL r0,LRSAVE(r4) + PPC_STL r0,_LINK(r3) + mflr r0 +-- +2.39.2 + diff --git a/queue-5.15/pstore-ram-add-check-for-kstrdup.patch b/queue-5.15/pstore-ram-add-check-for-kstrdup.patch new file mode 100644 index 00000000000..36bd5a23eb4 --- /dev/null +++ b/queue-5.15/pstore-ram-add-check-for-kstrdup.patch @@ -0,0 +1,37 @@ +From 4fe82e4b5980dab8817a00d23beb243b91bd5d04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 17:37:33 +0800 +Subject: pstore/ram: Add check for kstrdup + +From: Jiasheng Jiang + +[ Upstream commit d97038d5ec2062733c1e016caf9baaf68cf64ea1 ] + +Add check for the return value of kstrdup() and return the error +if it fails in order to avoid NULL pointer dereference. + +Fixes: e163fdb3f7f8 ("pstore/ram: Regularize prz label allocation lifetime") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20230614093733.36048-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + fs/pstore/ram_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 155c7010b1f83..fd9bab137685d 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -591,6 +591,8 @@ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size, + raw_spin_lock_init(&prz->buffer_lock); + prz->flags = flags; + prz->label = kstrdup(label, GFP_KERNEL); ++ if (!prz->label) ++ goto err; + + ret = persistent_ram_buffer_map(start, size, prz, memtype); + if (ret) +-- +2.39.2 + diff --git a/queue-5.15/radeon-avoid-double-free-in-ci_dpm_init.patch b/queue-5.15/radeon-avoid-double-free-in-ci_dpm_init.patch new file mode 100644 index 00000000000..0680f057d7a --- /dev/null +++ b/queue-5.15/radeon-avoid-double-free-in-ci_dpm_init.patch @@ -0,0 +1,110 @@ +From 7dc2fd17117665f6603d70ce48cfed07b8f9d8d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 08:12:28 -0700 +Subject: radeon: avoid double free in ci_dpm_init() + +From: Nikita Zhandarovich + +[ Upstream commit 20c3dffdccbd494e0dd631d1660aeecbff6775f2 ] + +Several calls to ci_dpm_fini() will attempt to free resources that +either have been freed before or haven't been allocated yet. This +may lead to undefined or dangerous behaviour. + +For instance, if r600_parse_extended_power_table() fails, it might +call r600_free_extended_power_table() as will ci_dpm_fini() later +during error handling. + +Fix this by only freeing pointers to objects previously allocated. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: cc8dbbb4f62a ("drm/radeon: add dpm support for CI dGPUs (v2)") +Co-developed-by: Natalia Petrova +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/ci_dpm.c | 28 ++++++++++++++++++++-------- + 1 file changed, 20 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c +index f0cfb58da4672..4f93cc81ca7a0 100644 +--- a/drivers/gpu/drm/radeon/ci_dpm.c ++++ b/drivers/gpu/drm/radeon/ci_dpm.c +@@ -5520,6 +5520,7 @@ static int ci_parse_power_table(struct radeon_device *rdev) + u8 frev, crev; + u8 *power_state_offset; + struct ci_ps *ps; ++ int ret; + + if (!atom_parse_data_header(mode_info->atom_context, index, NULL, + &frev, &crev, &data_offset)) +@@ -5549,11 +5550,15 @@ static int ci_parse_power_table(struct radeon_device *rdev) + non_clock_array_index = power_state->v2.nonClockInfoIndex; + non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) + &non_clock_info_array->nonClockInfo[non_clock_array_index]; +- if (!rdev->pm.power_state[i].clock_info) +- return -EINVAL; ++ if (!rdev->pm.power_state[i].clock_info) { ++ ret = -EINVAL; ++ goto err_free_ps; ++ } + ps = kzalloc(sizeof(struct ci_ps), GFP_KERNEL); +- if (ps == NULL) +- return -ENOMEM; ++ if (ps == NULL) { ++ ret = -ENOMEM; ++ goto err_free_ps; ++ } + rdev->pm.dpm.ps[i].ps_priv = ps; + ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i], + non_clock_info, +@@ -5593,6 +5598,12 @@ static int ci_parse_power_table(struct radeon_device *rdev) + } + + return 0; ++ ++err_free_ps: ++ for (i = 0; i < rdev->pm.dpm.num_ps; i++) ++ kfree(rdev->pm.dpm.ps[i].ps_priv); ++ kfree(rdev->pm.dpm.ps); ++ return ret; + } + + static int ci_get_vbios_boot_values(struct radeon_device *rdev, +@@ -5681,25 +5692,26 @@ int ci_dpm_init(struct radeon_device *rdev) + + ret = ci_get_vbios_boot_values(rdev, &pi->vbios_boot_state); + if (ret) { +- ci_dpm_fini(rdev); ++ kfree(rdev->pm.dpm.priv); + return ret; + } + + ret = r600_get_platform_caps(rdev); + if (ret) { +- ci_dpm_fini(rdev); ++ kfree(rdev->pm.dpm.priv); + return ret; + } + + ret = r600_parse_extended_power_table(rdev); + if (ret) { +- ci_dpm_fini(rdev); ++ kfree(rdev->pm.dpm.priv); + return ret; + } + + ret = ci_parse_power_table(rdev); + if (ret) { +- ci_dpm_fini(rdev); ++ kfree(rdev->pm.dpm.priv); ++ r600_free_extended_power_table(rdev); + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.15/rcu-rcuscale-move-rcu_scale_-after-kfree_scale_clean.patch b/queue-5.15/rcu-rcuscale-move-rcu_scale_-after-kfree_scale_clean.patch new file mode 100644 index 00000000000..5f0b9bab72f --- /dev/null +++ b/queue-5.15/rcu-rcuscale-move-rcu_scale_-after-kfree_scale_clean.patch @@ -0,0 +1,245 @@ +From e25f8b97062fe9b3cb6c5812315f805a045caf77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 19:42:40 +0800 +Subject: rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup() + +From: Qiuxu Zhuo + +[ Upstream commit bf5ddd736509a7d9077c0b6793e6f0852214dbea ] + +This code-movement-only commit moves the rcu_scale_cleanup() and +rcu_scale_shutdown() functions to follow kfree_scale_cleanup(). +This is code movement is in preparation for a bug-fix patch that invokes +kfree_scale_cleanup() from rcu_scale_cleanup(). + +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Paul E. McKenney +Reviewed-by: Joel Fernandes (Google) +Stable-dep-of: 23fc8df26dea ("rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale") +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcuscale.c | 194 +++++++++++++++++++++--------------------- + 1 file changed, 97 insertions(+), 97 deletions(-) + +diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c +index a3e86c4843d37..3509aabac942e 100644 +--- a/kernel/rcu/rcuscale.c ++++ b/kernel/rcu/rcuscale.c +@@ -500,89 +500,6 @@ rcu_scale_print_module_parms(struct rcu_scale_ops *cur_ops, const char *tag) + scale_type, tag, nrealreaders, nrealwriters, verbose, shutdown); + } + +-static void +-rcu_scale_cleanup(void) +-{ +- int i; +- int j; +- int ngps = 0; +- u64 *wdp; +- u64 *wdpp; +- +- /* +- * Would like warning at start, but everything is expedited +- * during the mid-boot phase, so have to wait till the end. +- */ +- if (rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp) +- SCALEOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!"); +- if (rcu_gp_is_normal() && gp_exp) +- SCALEOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!"); +- if (gp_exp && gp_async) +- SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!"); +- +- if (torture_cleanup_begin()) +- return; +- if (!cur_ops) { +- torture_cleanup_end(); +- return; +- } +- +- if (reader_tasks) { +- for (i = 0; i < nrealreaders; i++) +- torture_stop_kthread(rcu_scale_reader, +- reader_tasks[i]); +- kfree(reader_tasks); +- } +- +- if (writer_tasks) { +- for (i = 0; i < nrealwriters; i++) { +- torture_stop_kthread(rcu_scale_writer, +- writer_tasks[i]); +- if (!writer_n_durations) +- continue; +- j = writer_n_durations[i]; +- pr_alert("%s%s writer %d gps: %d\n", +- scale_type, SCALE_FLAG, i, j); +- ngps += j; +- } +- pr_alert("%s%s start: %llu end: %llu duration: %llu gps: %d batches: %ld\n", +- scale_type, SCALE_FLAG, +- t_rcu_scale_writer_started, t_rcu_scale_writer_finished, +- t_rcu_scale_writer_finished - +- t_rcu_scale_writer_started, +- ngps, +- rcuscale_seq_diff(b_rcu_gp_test_finished, +- b_rcu_gp_test_started)); +- for (i = 0; i < nrealwriters; i++) { +- if (!writer_durations) +- break; +- if (!writer_n_durations) +- continue; +- wdpp = writer_durations[i]; +- if (!wdpp) +- continue; +- for (j = 0; j < writer_n_durations[i]; j++) { +- wdp = &wdpp[j]; +- pr_alert("%s%s %4d writer-duration: %5d %llu\n", +- scale_type, SCALE_FLAG, +- i, j, *wdp); +- if (j % 100 == 0) +- schedule_timeout_uninterruptible(1); +- } +- kfree(writer_durations[i]); +- } +- kfree(writer_tasks); +- kfree(writer_durations); +- kfree(writer_n_durations); +- } +- +- /* Do torture-type-specific cleanup operations. */ +- if (cur_ops->cleanup != NULL) +- cur_ops->cleanup(); +- +- torture_cleanup_end(); +-} +- + /* + * Return the number if non-negative. If -1, the number of CPUs. + * If less than -1, that much less than the number of CPUs, but +@@ -602,20 +519,6 @@ static int compute_real(int n) + return nr; + } + +-/* +- * RCU scalability shutdown kthread. Just waits to be awakened, then shuts +- * down system. +- */ +-static int +-rcu_scale_shutdown(void *arg) +-{ +- wait_event_idle(shutdown_wq, atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters); +- smp_mb(); /* Wake before output. */ +- rcu_scale_cleanup(); +- kernel_power_off(); +- return -EINVAL; +-} +- + /* + * kfree_rcu() scalability tests: Start a kfree_rcu() loop on all CPUs for number + * of iterations and measure total time and number of GP for all iterations to complete. +@@ -790,6 +693,103 @@ kfree_scale_init(void) + return firsterr; + } + ++static void ++rcu_scale_cleanup(void) ++{ ++ int i; ++ int j; ++ int ngps = 0; ++ u64 *wdp; ++ u64 *wdpp; ++ ++ /* ++ * Would like warning at start, but everything is expedited ++ * during the mid-boot phase, so have to wait till the end. ++ */ ++ if (rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp) ++ SCALEOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!"); ++ if (rcu_gp_is_normal() && gp_exp) ++ SCALEOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!"); ++ if (gp_exp && gp_async) ++ SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!"); ++ ++ if (torture_cleanup_begin()) ++ return; ++ if (!cur_ops) { ++ torture_cleanup_end(); ++ return; ++ } ++ ++ if (reader_tasks) { ++ for (i = 0; i < nrealreaders; i++) ++ torture_stop_kthread(rcu_scale_reader, ++ reader_tasks[i]); ++ kfree(reader_tasks); ++ } ++ ++ if (writer_tasks) { ++ for (i = 0; i < nrealwriters; i++) { ++ torture_stop_kthread(rcu_scale_writer, ++ writer_tasks[i]); ++ if (!writer_n_durations) ++ continue; ++ j = writer_n_durations[i]; ++ pr_alert("%s%s writer %d gps: %d\n", ++ scale_type, SCALE_FLAG, i, j); ++ ngps += j; ++ } ++ pr_alert("%s%s start: %llu end: %llu duration: %llu gps: %d batches: %ld\n", ++ scale_type, SCALE_FLAG, ++ t_rcu_scale_writer_started, t_rcu_scale_writer_finished, ++ t_rcu_scale_writer_finished - ++ t_rcu_scale_writer_started, ++ ngps, ++ rcuscale_seq_diff(b_rcu_gp_test_finished, ++ b_rcu_gp_test_started)); ++ for (i = 0; i < nrealwriters; i++) { ++ if (!writer_durations) ++ break; ++ if (!writer_n_durations) ++ continue; ++ wdpp = writer_durations[i]; ++ if (!wdpp) ++ continue; ++ for (j = 0; j < writer_n_durations[i]; j++) { ++ wdp = &wdpp[j]; ++ pr_alert("%s%s %4d writer-duration: %5d %llu\n", ++ scale_type, SCALE_FLAG, ++ i, j, *wdp); ++ if (j % 100 == 0) ++ schedule_timeout_uninterruptible(1); ++ } ++ kfree(writer_durations[i]); ++ } ++ kfree(writer_tasks); ++ kfree(writer_durations); ++ kfree(writer_n_durations); ++ } ++ ++ /* Do torture-type-specific cleanup operations. */ ++ if (cur_ops->cleanup != NULL) ++ cur_ops->cleanup(); ++ ++ torture_cleanup_end(); ++} ++ ++/* ++ * RCU scalability shutdown kthread. Just waits to be awakened, then shuts ++ * down system. ++ */ ++static int ++rcu_scale_shutdown(void *arg) ++{ ++ wait_event_idle(shutdown_wq, atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters); ++ smp_mb(); /* Wake before output. */ ++ rcu_scale_cleanup(); ++ kernel_power_off(); ++ return -EINVAL; ++} ++ + static int __init + rcu_scale_init(void) + { +-- +2.39.2 + diff --git a/queue-5.15/rcu-rcuscale-stop-kfree_scale_thread-thread-s-after-.patch b/queue-5.15/rcu-rcuscale-stop-kfree_scale_thread-thread-s-after-.patch new file mode 100644 index 00000000000..16ab15047c7 --- /dev/null +++ b/queue-5.15/rcu-rcuscale-stop-kfree_scale_thread-thread-s-after-.patch @@ -0,0 +1,81 @@ +From 6bb57696f32b2bd680bce4aec36a0de867b3ebd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 19:42:41 +0800 +Subject: rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading + rcuscale + +From: Qiuxu Zhuo + +[ Upstream commit 23fc8df26dead16687ae6eb47b0561a4a832e2f6 ] + +Running the 'kfree_rcu_test' test case [1] results in a splat [2]. +The root cause is the kfree_scale_thread thread(s) continue running +after unloading the rcuscale module. This commit fixes that isue by +invoking kfree_scale_cleanup() from rcu_scale_cleanup() when removing +the rcuscale module. + +[1] modprobe rcuscale kfree_rcu_test=1 + // After some time + rmmod rcuscale + rmmod torture + +[2] BUG: unable to handle page fault for address: ffffffffc0601a87 + #PF: supervisor instruction fetch in kernel mode + #PF: error_code(0x0010) - not-present page + PGD 11de4f067 P4D 11de4f067 PUD 11de51067 PMD 112f4d067 PTE 0 + Oops: 0010 [#1] PREEMPT SMP NOPTI + CPU: 1 PID: 1798 Comm: kfree_scale_thr Not tainted 6.3.0-rc1-rcu+ #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 + RIP: 0010:0xffffffffc0601a87 + Code: Unable to access opcode bytes at 0xffffffffc0601a5d. + RSP: 0018:ffffb25bc2e57e18 EFLAGS: 00010297 + RAX: 0000000000000000 RBX: ffffffffc061f0b6 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: ffffffff962fd0de RDI: ffffffff962fd0de + RBP: ffffb25bc2e57ea8 R08: 0000000000000000 R09: 0000000000000000 + R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 + R13: 0000000000000000 R14: 000000000000000a R15: 00000000001c1dbe + FS: 0000000000000000(0000) GS:ffff921fa2200000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffffffffc0601a5d CR3: 000000011de4c006 CR4: 0000000000370ee0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + ? kvfree_call_rcu+0xf0/0x3a0 + ? kthread+0xf3/0x120 + ? kthread_complete_and_exit+0x20/0x20 + ? ret_from_fork+0x1f/0x30 + + Modules linked in: rfkill sunrpc ... [last unloaded: torture] + CR2: ffffffffc0601a87 + ---[ end trace 0000000000000000 ]--- + +Fixes: e6e78b004fa7 ("rcuperf: Add kfree_rcu() performance Tests") +Reviewed-by: Davidlohr Bueso +Reviewed-by: Joel Fernandes (Google) +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcuscale.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c +index 3509aabac942e..57ec414710bbc 100644 +--- a/kernel/rcu/rcuscale.c ++++ b/kernel/rcu/rcuscale.c +@@ -713,6 +713,11 @@ rcu_scale_cleanup(void) + if (gp_exp && gp_async) + SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!"); + ++ if (kfree_rcu_test) { ++ kfree_scale_cleanup(); ++ return; ++ } ++ + if (torture_cleanup_begin()) + return; + if (!cur_ops) { +-- +2.39.2 + diff --git a/queue-5.15/rcuscale-always-log-error-message.patch b/queue-5.15/rcuscale-always-log-error-message.patch new file mode 100644 index 00000000000..fd60e7ad846 --- /dev/null +++ b/queue-5.15/rcuscale-always-log-error-message.patch @@ -0,0 +1,71 @@ +From f8c4eb498638c48dae47376716a2d417784d776f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Oct 2021 17:40:28 +0800 +Subject: rcuscale: Always log error message + +From: Li Zhijian + +[ Upstream commit 86e7ed1bd57d020e35d430542bf5d689c3200568 ] + +Unconditionally log messages corresponding to errors. + +Acked-by: Davidlohr Bueso +Signed-off-by: Li Zhijian +Signed-off-by: Paul E. McKenney +Stable-dep-of: 23fc8df26dea ("rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale") +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcuscale.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c +index 2cc34a22a5060..5c8449a8827a1 100644 +--- a/kernel/rcu/rcuscale.c ++++ b/kernel/rcu/rcuscale.c +@@ -50,8 +50,8 @@ MODULE_AUTHOR("Paul E. McKenney "); + pr_alert("%s" SCALE_FLAG " %s\n", scale_type, s) + #define VERBOSE_SCALEOUT_STRING(s) \ + do { if (verbose) pr_alert("%s" SCALE_FLAG " %s\n", scale_type, s); } while (0) +-#define VERBOSE_SCALEOUT_ERRSTRING(s) \ +- do { if (verbose) pr_alert("%s" SCALE_FLAG "!!! %s\n", scale_type, s); } while (0) ++#define SCALEOUT_ERRSTRING(s) \ ++ pr_alert("%s" SCALE_FLAG "!!! %s\n", scale_type, s) + + /* + * The intended use cases for the nreaders and nwriters module parameters +@@ -514,11 +514,11 @@ rcu_scale_cleanup(void) + * during the mid-boot phase, so have to wait till the end. + */ + if (rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp) +- VERBOSE_SCALEOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!"); ++ SCALEOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!"); + if (rcu_gp_is_normal() && gp_exp) +- VERBOSE_SCALEOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!"); ++ SCALEOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!"); + if (gp_exp && gp_async) +- VERBOSE_SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!"); ++ SCALEOUT_ERRSTRING("No expedited async GPs, so went with async!"); + + if (torture_cleanup_begin()) + return; +@@ -845,7 +845,7 @@ rcu_scale_init(void) + reader_tasks = kcalloc(nrealreaders, sizeof(reader_tasks[0]), + GFP_KERNEL); + if (reader_tasks == NULL) { +- VERBOSE_SCALEOUT_ERRSTRING("out of memory"); ++ SCALEOUT_ERRSTRING("out of memory"); + firsterr = -ENOMEM; + goto unwind; + } +@@ -865,7 +865,7 @@ rcu_scale_init(void) + kcalloc(nrealwriters, sizeof(*writer_n_durations), + GFP_KERNEL); + if (!writer_tasks || !writer_durations || !writer_n_durations) { +- VERBOSE_SCALEOUT_ERRSTRING("out of memory"); ++ SCALEOUT_ERRSTRING("out of memory"); + firsterr = -ENOMEM; + goto unwind; + } +-- +2.39.2 + diff --git a/queue-5.15/rcuscale-move-shutdown-from-wait_event-to-wait_event.patch b/queue-5.15/rcuscale-move-shutdown-from-wait_event-to-wait_event.patch new file mode 100644 index 00000000000..87210fb003e --- /dev/null +++ b/queue-5.15/rcuscale-move-shutdown-from-wait_event-to-wait_event.patch @@ -0,0 +1,57 @@ +From 765c003e573e684e839a4d4136d09047ac34a12d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 12:08:54 -0800 +Subject: rcuscale: Move shutdown from wait_event() to wait_event_idle() + +From: Paul E. McKenney + +[ Upstream commit ef1ef3d47677dc191b88650a9f7f91413452cc1b ] + +The rcu_scale_shutdown() and kfree_scale_shutdown() kthreads/functions +use wait_event() to wait for the rcuscale test to complete. However, +each updater thread in such a test waits for at least 100 grace periods. +If each grace period takes more than 1.2 seconds, which is long, but +not insanely so, this can trigger the hung-task timeout. + +This commit therefore replaces those wait_event() calls with calls to +wait_event_idle(), which do not trigger the hung-task timeout. + +Reported-by: kernel test robot +Reported-by: Liam Howlett +Signed-off-by: Paul E. McKenney +Tested-by: Yujie Liu +Signed-off-by: Boqun Feng +Stable-dep-of: 23fc8df26dea ("rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale") +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcuscale.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c +index 5c8449a8827a1..a3e86c4843d37 100644 +--- a/kernel/rcu/rcuscale.c ++++ b/kernel/rcu/rcuscale.c +@@ -609,8 +609,7 @@ static int compute_real(int n) + static int + rcu_scale_shutdown(void *arg) + { +- wait_event(shutdown_wq, +- atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters); ++ wait_event_idle(shutdown_wq, atomic_read(&n_rcu_scale_writer_finished) >= nrealwriters); + smp_mb(); /* Wake before output. */ + rcu_scale_cleanup(); + kernel_power_off(); +@@ -736,8 +735,8 @@ kfree_scale_cleanup(void) + static int + kfree_scale_shutdown(void *arg) + { +- wait_event(shutdown_wq, +- atomic_read(&n_kfree_scale_thread_ended) >= kfree_nrealthreads); ++ wait_event_idle(shutdown_wq, ++ atomic_read(&n_kfree_scale_thread_ended) >= kfree_nrealthreads); + + smp_mb(); /* Wake before output. */ + +-- +2.39.2 + diff --git a/queue-5.15/rcutorture-correct-name-of-use_softirq-module-parame.patch b/queue-5.15/rcutorture-correct-name-of-use_softirq-module-parame.patch new file mode 100644 index 00000000000..1434180b8e3 --- /dev/null +++ b/queue-5.15/rcutorture-correct-name-of-use_softirq-module-parame.patch @@ -0,0 +1,45 @@ +From 019f0a3e87390733118aa59fb68ff9be9f267acd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 16:40:08 -0700 +Subject: rcutorture: Correct name of use_softirq module parameter + +From: Paul E. McKenney + +[ Upstream commit b409afe0268faeb77267f028ea85f2d93438fced ] + +The BUSTED-BOOST and TREE03 scenarios specify a mythical tree.use_softirq +module parameter, which means a failure to get full test coverage. This +commit therefore corrects the name to rcutree.use_softirq. + +Fixes: e2b949d54392 ("rcutorture: Make TREE03 use real-time tree.use_softirq setting") +Signed-off-by: Paul E. McKenney +Reviewed-by: Joel Fernandes (Google) +Signed-off-by: Sasha Levin +--- + .../testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot | 2 +- + tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot b/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot +index f57720c52c0f9..84f6bb98ce993 100644 +--- a/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot ++++ b/tools/testing/selftests/rcutorture/configs/rcu/BUSTED-BOOST.boot +@@ -5,4 +5,4 @@ rcutree.gp_init_delay=3 + rcutree.gp_cleanup_delay=3 + rcutree.kthread_prio=2 + threadirqs +-tree.use_softirq=0 ++rcutree.use_softirq=0 +diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot b/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot +index 64f864f1f361f..8e50bfd4b710d 100644 +--- a/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot ++++ b/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot +@@ -4,4 +4,4 @@ rcutree.gp_init_delay=3 + rcutree.gp_cleanup_delay=3 + rcutree.kthread_prio=2 + threadirqs +-tree.use_softirq=0 ++rcutree.use_softirq=0 +-- +2.39.2 + diff --git a/queue-5.15/rdma-bnxt_re-avoid-calling-wake_up-threads-from-spin.patch b/queue-5.15/rdma-bnxt_re-avoid-calling-wake_up-threads-from-spin.patch new file mode 100644 index 00000000000..acd9bed7e82 --- /dev/null +++ b/queue-5.15/rdma-bnxt_re-avoid-calling-wake_up-threads-from-spin.patch @@ -0,0 +1,99 @@ +From f0a9e5b9f0de5ca752e28e3e2b6fc1e06bae7bb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 04:01:39 -0700 +Subject: RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context + +From: Kashyap Desai + +[ Upstream commit 3099bcdc19b701f732f638ee45679858c08559bb ] + +bnxt_qplib_service_creq can be called from interrupt or tasklet or +process context. So the function take irq variant of spin_lock. +But when wake_up is invoked with the lock held, it is putting the +calling context to sleep. + +[exception RIP: __wake_up_common+190] +RIP: ffffffffb7539d7e RSP: ffffa73300207ad8 RFLAGS: 00000083 +RAX: 0000000000000001 RBX: ffff91fa295f69b8 RCX: dead000000000200 +RDX: ffffa733344af940 RSI: ffffa73336527940 RDI: ffffa73336527940 +RBP: 000000000000001c R8: 0000000000000002 R9: 00000000000299c0 +R10: 0000017230de82c5 R11: 0000000000000002 R12: ffffa73300207b28 +R13: 0000000000000000 R14: ffffa733341bf928 R15: 0000000000000000 +ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + +Call the wakeup after releasing the lock. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Signed-off-by: Kashyap Desai +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1686308514-11996-3-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +index abeee7cc7dc6d..3b8cb46551bf2 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -299,7 +299,8 @@ static int bnxt_qplib_process_func_event(struct bnxt_qplib_rcfw *rcfw, + } + + static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw, +- struct creq_qp_event *qp_event) ++ struct creq_qp_event *qp_event, ++ u32 *num_wait) + { + struct creq_qp_error_notification *err_event; + struct bnxt_qplib_hwq *hwq = &rcfw->cmdq.hwq; +@@ -308,6 +309,7 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw, + u16 cbit, blocked = 0; + struct pci_dev *pdev; + unsigned long flags; ++ u32 wait_cmds = 0; + __le16 mcookie; + u16 cookie; + int rc = 0; +@@ -367,9 +369,10 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw, + crsqe->req_size = 0; + + if (!blocked) +- wake_up(&rcfw->cmdq.waitq); ++ wait_cmds++; + spin_unlock_irqrestore(&hwq->lock, flags); + } ++ *num_wait += wait_cmds; + return rc; + } + +@@ -383,6 +386,7 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t) + struct creq_base *creqe; + u32 sw_cons, raw_cons; + unsigned long flags; ++ u32 num_wakeup = 0; + + /* Service the CREQ until budget is over */ + spin_lock_irqsave(&hwq->lock, flags); +@@ -401,7 +405,8 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t) + switch (type) { + case CREQ_BASE_TYPE_QP_EVENT: + bnxt_qplib_process_qp_event +- (rcfw, (struct creq_qp_event *)creqe); ++ (rcfw, (struct creq_qp_event *)creqe, ++ &num_wakeup); + creq->stats.creq_qp_event_processed++; + break; + case CREQ_BASE_TYPE_FUNC_EVENT: +@@ -429,6 +434,8 @@ static void bnxt_qplib_service_creq(struct tasklet_struct *t) + rcfw->res->cctx, true); + } + spin_unlock_irqrestore(&hwq->lock, flags); ++ if (num_wakeup) ++ wake_up_nr(&rcfw->cmdq.waitq, num_wakeup); + } + + static irqreturn_t bnxt_qplib_creq_irq(int irq, void *dev_instance) +-- +2.39.2 + diff --git a/queue-5.15/rdma-bnxt_re-disable-kill-tasklet-only-if-it-is-enab.patch b/queue-5.15/rdma-bnxt_re-disable-kill-tasklet-only-if-it-is-enab.patch new file mode 100644 index 00000000000..8a59704eca8 --- /dev/null +++ b/queue-5.15/rdma-bnxt_re-disable-kill-tasklet-only-if-it-is-enab.patch @@ -0,0 +1,150 @@ +From a5b928193ea92a9eaed66fcb5fcb0d695eff5cb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 23:48:11 -0700 +Subject: RDMA/bnxt_re: Disable/kill tasklet only if it is enabled + +From: Selvin Xavier + +[ Upstream commit ab112ee7899d6171da5acd77a7ed7ae103f488de ] + +When the ulp hook to start the IRQ fails because the rings are not +available, tasklets are not enabled. In this case when the driver is +unloaded, driver calls CREQ tasklet_kill. This causes an indefinite hang +as the tasklet is not enabled. + +Driver shouldn't call tasklet_kill if it is not enabled. So using the +creq->requested and nq->requested flags to identify if both tasklets/irqs +are registered. Checking this flag while scheduling the tasklet from +ISR. Also, added a cleanup for disabling tasklet, in case request_irq +fails during start_irq. + +Check for return value for bnxt_qplib_rcfw_start_irq and in case the +bnxt_qplib_rcfw_start_irq fails, return bnxt_re_start_irq without +attempting to start NQ IRQs. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/1684478897-12247-2-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/main.c | 12 +++++++++--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 16 ++++++++++------ + drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 14 +++++++++----- + 3 files changed, 28 insertions(+), 14 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c +index 66268e41b470e..634e81b288454 100644 +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -331,15 +331,21 @@ static void bnxt_re_start_irq(void *handle, struct bnxt_msix_entry *ent) + for (indx = 0; indx < rdev->num_msix; indx++) + rdev->msix_entries[indx].vector = ent[indx].vector; + +- bnxt_qplib_rcfw_start_irq(rcfw, msix_ent[BNXT_RE_AEQ_IDX].vector, +- false); ++ rc = bnxt_qplib_rcfw_start_irq(rcfw, msix_ent[BNXT_RE_AEQ_IDX].vector, ++ false); ++ if (rc) { ++ ibdev_warn(&rdev->ibdev, "Failed to reinit CREQ\n"); ++ return; ++ } + for (indx = BNXT_RE_NQ_IDX ; indx < rdev->num_msix; indx++) { + nq = &rdev->nq[indx - 1]; + rc = bnxt_qplib_nq_start_irq(nq, indx - 1, + msix_ent[indx].vector, false); +- if (rc) ++ if (rc) { + ibdev_warn(&rdev->ibdev, "Failed to reinit NQ index %d\n", + indx - 1); ++ return; ++ } + } + } + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index b26a89187a192..9eba4b39c7032 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -404,6 +404,9 @@ static irqreturn_t bnxt_qplib_nq_irq(int irq, void *dev_instance) + + void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill) + { ++ if (!nq->requested) ++ return; ++ + tasklet_disable(&nq->nq_tasklet); + /* Mask h/w interrupt */ + bnxt_qplib_ring_nq_db(&nq->nq_db.dbinfo, nq->res->cctx, false); +@@ -411,11 +414,10 @@ void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill) + synchronize_irq(nq->msix_vec); + if (kill) + tasklet_kill(&nq->nq_tasklet); +- if (nq->requested) { +- irq_set_affinity_hint(nq->msix_vec, NULL); +- free_irq(nq->msix_vec, nq); +- nq->requested = false; +- } ++ ++ irq_set_affinity_hint(nq->msix_vec, NULL); ++ free_irq(nq->msix_vec, nq); ++ nq->requested = false; + } + + void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq) +@@ -454,8 +456,10 @@ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx, + + snprintf(nq->name, sizeof(nq->name), "bnxt_qplib_nq-%d", nq_indx); + rc = request_irq(nq->msix_vec, bnxt_qplib_nq_irq, 0, nq->name, nq); +- if (rc) ++ if (rc) { ++ tasklet_disable(&nq->nq_tasklet); + return rc; ++ } + + cpumask_clear(&nq->mask); + cpumask_set_cpu(nq_indx, &nq->mask); +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +index d2d39126f1852..2be30068574ce 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -637,6 +637,10 @@ void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill) + struct bnxt_qplib_creq_ctx *creq; + + creq = &rcfw->creq; ++ ++ if (!creq->requested) ++ return; ++ + tasklet_disable(&creq->creq_tasklet); + /* Mask h/w interrupts */ + bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, rcfw->res->cctx, false); +@@ -645,10 +649,8 @@ void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill) + if (kill) + tasklet_kill(&creq->creq_tasklet); + +- if (creq->requested) { +- free_irq(creq->msix_vec, rcfw); +- creq->requested = false; +- } ++ free_irq(creq->msix_vec, rcfw); ++ creq->requested = false; + } + + void bnxt_qplib_disable_rcfw_channel(struct bnxt_qplib_rcfw *rcfw) +@@ -694,8 +696,10 @@ int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector, + tasklet_enable(&creq->creq_tasklet); + rc = request_irq(creq->msix_vec, bnxt_qplib_creq_irq, 0, + "bnxt_qplib_creq", rcfw); +- if (rc) ++ if (rc) { ++ tasklet_disable(&creq->creq_tasklet); + return rc; ++ } + creq->requested = true; + + bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, rcfw->res->cctx, true); +-- +2.39.2 + diff --git a/queue-5.15/rdma-bnxt_re-fix-to-remove-an-unnecessary-log.patch b/queue-5.15/rdma-bnxt_re-fix-to-remove-an-unnecessary-log.patch new file mode 100644 index 00000000000..c84eb881d04 --- /dev/null +++ b/queue-5.15/rdma-bnxt_re-fix-to-remove-an-unnecessary-log.patch @@ -0,0 +1,44 @@ +From 734813309462394b364bc34799ca456303fb0831 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 23:48:15 -0700 +Subject: RDMA/bnxt_re: Fix to remove an unnecessary log + +From: Kalesh AP + +[ Upstream commit 43774bc156614346fe5dacabc8e8c229167f2536 ] + +During destroy_qp, driver sets the qp handle in the existing CQEs +belonging to the QP being destroyed to NULL. As a result, a poll_cq after +destroy_qp can report unnecessary messages. Remove this noise from system +logs. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/1684478897-12247-6-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index d6b7c0d1f6766..d44b6a5c90b57 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -2732,11 +2732,8 @@ static int bnxt_qplib_cq_process_terminal(struct bnxt_qplib_cq *cq, + + qp = (struct bnxt_qplib_qp *)((unsigned long) + le64_to_cpu(hwcqe->qp_handle)); +- if (!qp) { +- dev_err(&cq->hwq.pdev->dev, +- "FP: CQ Process terminal qp is NULL\n"); ++ if (!qp) + return -EINVAL; +- } + + /* Must block new posting of SQ and RQ */ + qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR; +-- +2.39.2 + diff --git a/queue-5.15/rdma-bnxt_re-fix-to-remove-unnecessary-return-labels.patch b/queue-5.15/rdma-bnxt_re-fix-to-remove-unnecessary-return-labels.patch new file mode 100644 index 00000000000..491856f66c9 --- /dev/null +++ b/queue-5.15/rdma-bnxt_re-fix-to-remove-unnecessary-return-labels.patch @@ -0,0 +1,66 @@ +From 63098989a749131bf091b107cdc64157c4b51325 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 23:48:12 -0700 +Subject: RDMA/bnxt_re: Fix to remove unnecessary return labels + +From: Kalesh AP + +[ Upstream commit 9b3ee47796f529e5bc31a355d6cb756d68a7079a ] + +If there is no cleanup needed then just return directly. This cleans up +the code and improve readability. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/1684478897-12247-3-git-send-email-selvin.xavier@broadcom.com +Reviewed-by: Kashyap Desai +Reviewed-by: Saravanan Vajravel +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index 9eba4b39c7032..b4b180652c0a0 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -1603,7 +1603,7 @@ static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp, + il_src = (void *)wqe->sg_list[indx].addr; + t_len += len; + if (t_len > qp->max_inline_data) +- goto bad; ++ return -ENOMEM; + while (len) { + if (pull_dst) { + pull_dst = false; +@@ -1627,8 +1627,6 @@ static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp, + } + + return t_len; +-bad: +- return -ENOMEM; + } + + static u32 bnxt_qplib_put_sges(struct bnxt_qplib_hwq *hwq, +@@ -2058,7 +2056,7 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq) + hwq_attr.sginfo = &cq->sg_info; + rc = bnxt_qplib_alloc_init_hwq(&cq->hwq, &hwq_attr); + if (rc) +- goto exit; ++ return rc; + + RCFW_CMD_PREP(req, CREATE_CQ, cmd_flags); + +@@ -2099,7 +2097,6 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq) + + fail: + bnxt_qplib_free_hwq(res, &cq->hwq); +-exit: + return rc; + } + +-- +2.39.2 + diff --git a/queue-5.15/rdma-bnxt_re-remove-a-redundant-check-inside-bnxt_re.patch b/queue-5.15/rdma-bnxt_re-remove-a-redundant-check-inside-bnxt_re.patch new file mode 100644 index 00000000000..ffff65c2818 --- /dev/null +++ b/queue-5.15/rdma-bnxt_re-remove-a-redundant-check-inside-bnxt_re.patch @@ -0,0 +1,54 @@ +From 03aac364ce647ad2dd0edc553b7a8f51a0980c07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 23:48:14 -0700 +Subject: RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid + +From: Kalesh AP + +[ Upstream commit b989f90cef0af48aa5679b6a75476371705ec53c ] + +The NULL check inside bnxt_re_update_gid() always return false. If +sgid_tbl->tbl is not allocated, then dev_init would have failed. + +Fixes: 5fac5b1b297f ("RDMA/bnxt_re: Add vlan tag for untagged RoCE traffic when PFC is configured") +Link: https://lore.kernel.org/r/1684478897-12247-5-git-send-email-selvin.xavier@broadcom.com +Reviewed-by: Saravanan Vajravel +Reviewed-by: Damodharam Ammepalli +Reviewed-by: Ajit Khaparde +Signed-off-by: Selvin Xavier +Signed-off-by: Kalesh AP +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/main.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c +index 634e81b288454..7b85eef113fc0 100644 +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -1179,12 +1179,6 @@ static int bnxt_re_update_gid(struct bnxt_re_dev *rdev) + if (!ib_device_try_get(&rdev->ibdev)) + return 0; + +- if (!sgid_tbl) { +- ibdev_err(&rdev->ibdev, "QPLIB: SGID table not allocated"); +- rc = -EINVAL; +- goto out; +- } +- + for (index = 0; index < sgid_tbl->active; index++) { + gid_idx = sgid_tbl->hw_id[index]; + +@@ -1202,7 +1196,7 @@ static int bnxt_re_update_gid(struct bnxt_re_dev *rdev) + rc = bnxt_qplib_update_sgid(sgid_tbl, &gid, gid_idx, + rdev->qplib_res.netdev->dev_addr); + } +-out: ++ + ib_device_put(&rdev->ibdev); + return rc; + } +-- +2.39.2 + diff --git a/queue-5.15/rdma-bnxt_re-use-unique-names-while-registering-inte.patch b/queue-5.15/rdma-bnxt_re-use-unique-names-while-registering-inte.patch new file mode 100644 index 00000000000..61a6ec8d59a --- /dev/null +++ b/queue-5.15/rdma-bnxt_re-use-unique-names-while-registering-inte.patch @@ -0,0 +1,157 @@ +From d803df15b5b71aeac79007f2feeaffc150a01de3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 23:48:13 -0700 +Subject: RDMA/bnxt_re: Use unique names while registering interrupts + +From: Kalesh AP + +[ Upstream commit ff2e4bfd162cf66a112a81509e419805add44d64 ] + +bnxt_re currently uses the names "bnxt_qplib_creq" and "bnxt_qplib_nq-0" +while registering IRQs. There is no way to distinguish the IRQs of +different device ports when there are multiple IB devices registered. +This could make the scenarios worse where one want to pin IRQs of a device +port to certain CPUs. + +Fixed the code to use unique names which has PCI BDF information while +registering interrupts like: "bnxt_re-nq-0@pci:0000:65:00.0" and +"bnxt_re-creq@pci:0000:65:00.1". + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/1684478897-12247-4-git-send-email-selvin.xavier@broadcom.com +Reviewed-by: Bhargava Chenna Marreddy +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 12 ++++++++++-- + drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 15 +++++++++++++-- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 1 + + 4 files changed, 25 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index b4b180652c0a0..d6b7c0d1f6766 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -417,6 +417,8 @@ void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill) + + irq_set_affinity_hint(nq->msix_vec, NULL); + free_irq(nq->msix_vec, nq); ++ kfree(nq->name); ++ nq->name = NULL; + nq->requested = false; + } + +@@ -443,6 +445,7 @@ void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq) + int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx, + int msix_vector, bool need_init) + { ++ struct bnxt_qplib_res *res = nq->res; + int rc; + + if (nq->requested) +@@ -454,9 +457,14 @@ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx, + else + tasklet_enable(&nq->nq_tasklet); + +- snprintf(nq->name, sizeof(nq->name), "bnxt_qplib_nq-%d", nq_indx); ++ nq->name = kasprintf(GFP_KERNEL, "bnxt_re-nq-%d@pci:%s", ++ nq_indx, pci_name(res->pdev)); ++ if (!nq->name) ++ return -ENOMEM; + rc = request_irq(nq->msix_vec, bnxt_qplib_nq_irq, 0, nq->name, nq); + if (rc) { ++ kfree(nq->name); ++ nq->name = NULL; + tasklet_disable(&nq->nq_tasklet); + return rc; + } +@@ -470,7 +478,7 @@ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx, + nq->msix_vec, nq_indx); + } + nq->requested = true; +- bnxt_qplib_ring_nq_db(&nq->nq_db.dbinfo, nq->res->cctx, true); ++ bnxt_qplib_ring_nq_db(&nq->nq_db.dbinfo, res->cctx, true); + + return rc; + } +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +index 0375019525431..f859710f9a7f4 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +@@ -471,7 +471,7 @@ typedef int (*srqn_handler_t)(struct bnxt_qplib_nq *nq, + struct bnxt_qplib_nq { + struct pci_dev *pdev; + struct bnxt_qplib_res *res; +- char name[32]; ++ char *name; + struct bnxt_qplib_hwq hwq; + struct bnxt_qplib_nq_db nq_db; + u16 ring_id; +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +index 2be30068574ce..d72f36d2bd496 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -650,6 +650,8 @@ void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill) + tasklet_kill(&creq->creq_tasklet); + + free_irq(creq->msix_vec, rcfw); ++ kfree(creq->irq_name); ++ creq->irq_name = NULL; + creq->requested = false; + } + +@@ -682,9 +684,11 @@ int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector, + bool need_init) + { + struct bnxt_qplib_creq_ctx *creq; ++ struct bnxt_qplib_res *res; + int rc; + + creq = &rcfw->creq; ++ res = rcfw->res; + + if (creq->requested) + return -EFAULT; +@@ -694,15 +698,22 @@ int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector, + tasklet_setup(&creq->creq_tasklet, bnxt_qplib_service_creq); + else + tasklet_enable(&creq->creq_tasklet); ++ ++ creq->irq_name = kasprintf(GFP_KERNEL, "bnxt_re-creq@pci:%s", ++ pci_name(res->pdev)); ++ if (!creq->irq_name) ++ return -ENOMEM; + rc = request_irq(creq->msix_vec, bnxt_qplib_creq_irq, 0, +- "bnxt_qplib_creq", rcfw); ++ creq->irq_name, rcfw); + if (rc) { ++ kfree(creq->irq_name); ++ creq->irq_name = NULL; + tasklet_disable(&creq->creq_tasklet); + return rc; + } + creq->requested = true; + +- bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, rcfw->res->cctx, true); ++ bnxt_qplib_ring_nq_db(&creq->creq_db.dbinfo, res->cctx, true); + + return 0; + } +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +index 0c6d0b70ce890..2acdec55a667e 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +@@ -174,6 +174,7 @@ struct bnxt_qplib_creq_ctx { + u16 ring_id; + int msix_vec; + bool requested; /*irq handler installed */ ++ char *irq_name; + }; + + /* RCFW Communication Channels */ +-- +2.39.2 + diff --git a/queue-5.15/rdma-bnxt_re-wraparound-mbox-producer-index.patch b/queue-5.15/rdma-bnxt_re-wraparound-mbox-producer-index.patch new file mode 100644 index 00000000000..8ed1f1bc9bc --- /dev/null +++ b/queue-5.15/rdma-bnxt_re-wraparound-mbox-producer-index.patch @@ -0,0 +1,55 @@ +From 77f43524437c6b0d62674ff03e12a92aaba1550a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 04:01:38 -0700 +Subject: RDMA/bnxt_re: wraparound mbox producer index + +From: Kashyap Desai + +[ Upstream commit 0af91306e17ef3d18e5f100aa58aa787869118af ] + +Driver is not handling the wraparound of the mbox producer index correctly. +Currently the wraparound happens once u32 max is reached. + +Bit 31 of the producer index register is special and should be set +only once for the first command. Because the producer index overflow +setting bit31 after a long time, FW goes to initialization sequence +and this causes FW hang. + +Fix is to wraparound the mbox producer index once it reaches u16 max. + +Fixes: cee0c7bba486 ("RDMA/bnxt_re: Refactor command queue management code") +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Signed-off-by: Kashyap Desai +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1686308514-11996-2-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +index d72f36d2bd496..abeee7cc7dc6d 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -181,7 +181,7 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw, struct cmdq_base *req, + } while (size > 0); + cmdq->seq_num++; + +- cmdq_prod = hwq->prod; ++ cmdq_prod = hwq->prod & 0xFFFF; + if (test_bit(FIRMWARE_FIRST_FLAG, &cmdq->flags)) { + /* The very first doorbell write + * is required to set this flag +@@ -599,7 +599,7 @@ int bnxt_qplib_alloc_rcfw_channel(struct bnxt_qplib_res *res, + rcfw->cmdq_depth = BNXT_QPLIB_CMDQE_MAX_CNT_8192; + + sginfo.pgsize = bnxt_qplib_cmdqe_page_size(rcfw->cmdq_depth); +- hwq_attr.depth = rcfw->cmdq_depth; ++ hwq_attr.depth = rcfw->cmdq_depth & 0x7FFFFFFF; + hwq_attr.stride = BNXT_QPLIB_CMDQE_UNITS; + hwq_attr.type = HWQ_TYPE_CTX; + if (bnxt_qplib_alloc_init_hwq(&cmdq->hwq, &hwq_attr)) { +-- +2.39.2 + diff --git a/queue-5.15/rdma-hns-fix-hns_roce_table_get-return-value.patch b/queue-5.15/rdma-hns-fix-hns_roce_table_get-return-value.patch new file mode 100644 index 00000000000..c8f1c572ca5 --- /dev/null +++ b/queue-5.15/rdma-hns-fix-hns_roce_table_get-return-value.patch @@ -0,0 +1,45 @@ +From 313507ed78c72a9109cc37e9d4ce66d342163c4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 20:16:40 +0800 +Subject: RDMA/hns: Fix hns_roce_table_get return value + +From: Chengchang Tang + +[ Upstream commit cf5b608fb0e369c473a8303cad6ddb386505e5b8 ] + +The return value of set_hem has been fixed to ENODEV, which will lead a +diagnostic information missing. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Link: https://lore.kernel.org/r/20230523121641.3132102-3-huangjunxian6@hisilicon.com +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hem.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c +index fa15d79eabb36..267474070f271 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c +@@ -597,11 +597,12 @@ int hns_roce_table_get(struct hns_roce_dev *hr_dev, + } + + /* Set HEM base address(128K/page, pa) to Hardware */ +- if (hr_dev->hw->set_hem(hr_dev, table, obj, HEM_HOP_STEP_DIRECT)) { ++ ret = hr_dev->hw->set_hem(hr_dev, table, obj, HEM_HOP_STEP_DIRECT); ++ if (ret) { + hns_roce_free_hem(hr_dev, table->hem[i]); + table->hem[i] = NULL; +- ret = -ENODEV; +- dev_err(dev, "set HEM base address to HW failed.\n"); ++ dev_err(dev, "set HEM base address to HW failed, ret = %d.\n", ++ ret); + goto out; + } + +-- +2.39.2 + diff --git a/queue-5.15/rdma-irdma-avoid-fortify-string-warning-in-irdma_clr.patch b/queue-5.15/rdma-irdma-avoid-fortify-string-warning-in-irdma_clr.patch new file mode 100644 index 00000000000..0df45e00fd0 --- /dev/null +++ b/queue-5.15/rdma-irdma-avoid-fortify-string-warning-in-irdma_clr.patch @@ -0,0 +1,64 @@ +From 8dd78d7c84fb6b92779b2f1437a2df0adf2b1c68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 13:18:45 +0200 +Subject: RDMA/irdma: avoid fortify-string warning in irdma_clr_wqes + +From: Arnd Bergmann + +[ Upstream commit b002760f877c0d91ecd3c78565b52f4bbac379dd ] + +Commit df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") triggers a +warning for fortified memset(): + +In function 'fortify_memset_chk', + inlined from 'irdma_clr_wqes' at drivers/infiniband/hw/irdma/uk.c:103:4: +include/linux/fortify-string.h:493:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] + 493 | __write_overflow_field(p_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The problem here isthat the inner array only has four 8-byte elements, so +clearing 4096 bytes overflows that. As this structure is part of an outer +array, change the code to pass a pointer to the irdma_qp_quanta instead, +and change the size argument for readability, matching the comment above +it. + +Fixes: 551c46edc769 ("RDMA/irdma: Add user/kernel shared libraries") +Link: https://lore.kernel.org/r/20230523111859.2197825-1-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Acked-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/uk.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/uk.c b/drivers/infiniband/hw/irdma/uk.c +index aecd64a7dbbaf..a348f0c010ab3 100644 +--- a/drivers/infiniband/hw/irdma/uk.c ++++ b/drivers/infiniband/hw/irdma/uk.c +@@ -94,16 +94,18 @@ static enum irdma_status_code irdma_nop_1(struct irdma_qp_uk *qp) + */ + void irdma_clr_wqes(struct irdma_qp_uk *qp, u32 qp_wqe_idx) + { +- __le64 *wqe; ++ struct irdma_qp_quanta *sq; + u32 wqe_idx; + + if (!(qp_wqe_idx & 0x7F)) { + wqe_idx = (qp_wqe_idx + 128) % qp->sq_ring.size; +- wqe = qp->sq_base[wqe_idx].elem; ++ sq = qp->sq_base + wqe_idx; + if (wqe_idx) +- memset(wqe, qp->swqe_polarity ? 0 : 0xFF, 0x1000); ++ memset(sq, qp->swqe_polarity ? 0 : 0xFF, ++ 128 * sizeof(*sq)); + else +- memset(wqe, qp->swqe_polarity ? 0xFF : 0, 0x1000); ++ memset(sq, qp->swqe_polarity ? 0xFF : 0, ++ 128 * sizeof(*sq)); + } + } + +-- +2.39.2 + diff --git a/queue-5.15/regulator-core-fix-more-error-checking-for-debugfs_c.patch b/queue-5.15/regulator-core-fix-more-error-checking-for-debugfs_c.patch new file mode 100644 index 00000000000..92094552ad9 --- /dev/null +++ b/queue-5.15/regulator-core-fix-more-error-checking-for-debugfs_c.patch @@ -0,0 +1,40 @@ +From d8aaf61492c29a405a7e17174b80d2b5ecd5bed1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 13:13:58 +0200 +Subject: regulator: core: Fix more error checking for debugfs_create_dir() + +From: Geert Uytterhoeven + +[ Upstream commit 2715bb11cfff964aa33946847f9527cfbd4874f5 ] + +In case of failure, debugfs_create_dir() does not return NULL, but an +error pointer. Most incorrect error checks were fixed, but the one in +create_regulator() was forgotten. + +Fix the remaining error check. + +Fixes: 2bf1c45be3b8f3a3 ("regulator: Fix error checking for debugfs_create_dir") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/ee980a108b5854dd8ce3630f8f673e784e057d17.1685013051.git.geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 211ab227b000c..77573569bc78a 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1874,7 +1874,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev, + + if (err != -EEXIST) + regulator->debugfs = debugfs_create_dir(supply_name, rdev->debugfs); +- if (!regulator->debugfs) { ++ if (IS_ERR(regulator->debugfs)) { + rdev_dbg(rdev, "Failed to create debugfs directory\n"); + } else { + debugfs_create_u32("uA_load", 0444, regulator->debugfs, +-- +2.39.2 + diff --git a/queue-5.15/regulator-core-streamline-debugfs-operations.patch b/queue-5.15/regulator-core-streamline-debugfs-operations.patch new file mode 100644 index 00000000000..f0e4314da76 --- /dev/null +++ b/queue-5.15/regulator-core-streamline-debugfs-operations.patch @@ -0,0 +1,100 @@ +From 81541f07090657dab606fcf22d023f4fec0ab32e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 13:13:59 +0200 +Subject: regulator: core: Streamline debugfs operations + +From: Geert Uytterhoeven + +[ Upstream commit 08880713ceec023dd94d634f1e8902728c385939 ] + +If CONFIG_DEBUG_FS is not set: + + regulator: Failed to create debugfs directory + ... + regulator-dummy: Failed to create debugfs directory + +As per the comments for debugfs_create_dir(), errors returned by this +function should be expected, and ignored: + + * If debugfs is not enabled in the kernel, the value -%ENODEV will be + * returned. + * + * NOTE: it's expected that most callers should _ignore_ the errors returned + * by this function. Other debugfs functions handle the fact that the "dentry" + * passed to them could be an error and they don't crash in that case. + * Drivers should generally work fine even if debugfs fails to init anyway. + +Adhere to the debugfs spirit, and streamline all operations by: + 1. Demoting the importance of the printed error messages to debug + level, like is already done in create_regulator(), + 2. Further ignoring any returned errors, as by design, all debugfs + functions are no-ops when passed an error pointer. + +Fixes: 2bf1c45be3b8f3a3 ("regulator: Fix error checking for debugfs_create_dir") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/2f8bb6e113359ddfab7b59e4d4274bd4c06d6d0a.1685013051.git.geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 30 +++++++++++++----------------- + 1 file changed, 13 insertions(+), 17 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 77573569bc78a..ebde10e744343 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1874,19 +1874,17 @@ static struct regulator *create_regulator(struct regulator_dev *rdev, + + if (err != -EEXIST) + regulator->debugfs = debugfs_create_dir(supply_name, rdev->debugfs); +- if (IS_ERR(regulator->debugfs)) { ++ if (IS_ERR(regulator->debugfs)) + rdev_dbg(rdev, "Failed to create debugfs directory\n"); +- } else { +- debugfs_create_u32("uA_load", 0444, regulator->debugfs, +- ®ulator->uA_load); +- debugfs_create_u32("min_uV", 0444, regulator->debugfs, +- ®ulator->voltage[PM_SUSPEND_ON].min_uV); +- debugfs_create_u32("max_uV", 0444, regulator->debugfs, +- ®ulator->voltage[PM_SUSPEND_ON].max_uV); +- debugfs_create_file("constraint_flags", 0444, +- regulator->debugfs, regulator, +- &constraint_flags_fops); +- } ++ ++ debugfs_create_u32("uA_load", 0444, regulator->debugfs, ++ ®ulator->uA_load); ++ debugfs_create_u32("min_uV", 0444, regulator->debugfs, ++ ®ulator->voltage[PM_SUSPEND_ON].min_uV); ++ debugfs_create_u32("max_uV", 0444, regulator->debugfs, ++ ®ulator->voltage[PM_SUSPEND_ON].max_uV); ++ debugfs_create_file("constraint_flags", 0444, regulator->debugfs, ++ regulator, &constraint_flags_fops); + + /* + * Check now if the regulator is an always on regulator - if +@@ -5193,10 +5191,8 @@ static void rdev_init_debugfs(struct regulator_dev *rdev) + } + + rdev->debugfs = debugfs_create_dir(rname, debugfs_root); +- if (IS_ERR(rdev->debugfs)) { +- rdev_warn(rdev, "Failed to create debugfs directory\n"); +- return; +- } ++ if (IS_ERR(rdev->debugfs)) ++ rdev_dbg(rdev, "Failed to create debugfs directory\n"); + + debugfs_create_u32("use_count", 0444, rdev->debugfs, + &rdev->use_count); +@@ -6104,7 +6100,7 @@ static int __init regulator_init(void) + + debugfs_root = debugfs_create_dir("regulator", NULL); + if (IS_ERR(debugfs_root)) +- pr_warn("regulator: Failed to create debugfs directory\n"); ++ pr_debug("regulator: Failed to create debugfs directory\n"); + + #ifdef CONFIG_DEBUG_FS + debugfs_create_file("supply_map", 0444, debugfs_root, NULL, +-- +2.39.2 + diff --git a/queue-5.15/riscv-uprobes-restore-thread.bad_cause.patch b/queue-5.15/riscv-uprobes-restore-thread.bad_cause.patch new file mode 100644 index 00000000000..ca2f18e5528 --- /dev/null +++ b/queue-5.15/riscv-uprobes-restore-thread.bad_cause.patch @@ -0,0 +1,47 @@ +From afda2916deaffb92fadf1e5723ba020eff081390 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Apr 2023 09:42:26 +0800 +Subject: riscv: uprobes: Restore thread.bad_cause + +From: Tiezhu Yang + +[ Upstream commit 58b1294dd1d65bb62f08dddbf418f954210c2057 ] + +thread.bad_cause is saved in arch_uprobe_pre_xol(), it should be restored +in arch_uprobe_{post,abort}_xol() accordingly, otherwise the save operation +is meaningless, this change is similar with x86 and powerpc. + +Signed-off-by: Tiezhu Yang +Acked-by: Oleg Nesterov +Reviewed-by: Guo Ren +Fixes: 74784081aac8 ("riscv: Add uprobes supported") +Link: https://lore.kernel.org/r/1682214146-3756-1-git-send-email-yangtiezhu@loongson.cn +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/probes/uprobes.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/riscv/kernel/probes/uprobes.c b/arch/riscv/kernel/probes/uprobes.c +index c976a21cd4bd5..194f166b2cc40 100644 +--- a/arch/riscv/kernel/probes/uprobes.c ++++ b/arch/riscv/kernel/probes/uprobes.c +@@ -67,6 +67,7 @@ int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs) + struct uprobe_task *utask = current->utask; + + WARN_ON_ONCE(current->thread.bad_cause != UPROBE_TRAP_NR); ++ current->thread.bad_cause = utask->autask.saved_cause; + + instruction_pointer_set(regs, utask->vaddr + auprobe->insn_size); + +@@ -102,6 +103,7 @@ void arch_uprobe_abort_xol(struct arch_uprobe *auprobe, struct pt_regs *regs) + { + struct uprobe_task *utask = current->utask; + ++ current->thread.bad_cause = utask->autask.saved_cause; + /* + * Task has received a fatal signal, so reset back to probbed + * address. +-- +2.39.2 + diff --git a/queue-5.15/rtnetlink-extend-rtext_filter_skip_stats-to-ifla_vf_.patch b/queue-5.15/rtnetlink-extend-rtext_filter_skip_stats-to-ifla_vf_.patch new file mode 100644 index 00000000000..1e842164650 --- /dev/null +++ b/queue-5.15/rtnetlink-extend-rtext_filter_skip_stats-to-ifla_vf_.patch @@ -0,0 +1,167 @@ +From 1d138b8b90dacad2ce0df80e3eb5545507ccb5e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jun 2023 13:51:08 +0300 +Subject: rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO + +From: Edwin Peer + +[ Upstream commit fa0e21fa44438a0e856d42224bfa24641d37b979 ] + +This filter already exists for excluding IPv6 SNMP stats. Extend its +definition to also exclude IFLA_VF_INFO stats in RTM_GETLINK. + +This patch constitutes a partial fix for a netlink attribute nesting +overflow bug in IFLA_VFINFO_LIST. By excluding the stats when the +requester doesn't need them, the truncation of the VF list is avoided. + +While it was technically only the stats added in commit c5a9f6f0ab40 +("net/core: Add drop counters to VF statistics") breaking the camel's +back, the appreciable size of the stats data should never have been +included without due consideration for the maximum number of VFs +supported by PCI. + +Fixes: 3b766cd83232 ("net/core: Add reading VF statistics through the PF netdevice") +Fixes: c5a9f6f0ab40 ("net/core: Add drop counters to VF statistics") +Signed-off-by: Edwin Peer +Cc: Edwin Peer +Signed-off-by: Gal Pressman +Link: https://lore.kernel.org/r/20230611105108.122586-1-gal@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/rtnetlink.c | 96 +++++++++++++++++++++++--------------------- + 1 file changed, 51 insertions(+), 45 deletions(-) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index bc187289bf64b..0ab558501290b 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -922,24 +922,27 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev, + nla_total_size(sizeof(struct ifla_vf_rate)) + + nla_total_size(sizeof(struct ifla_vf_link_state)) + + nla_total_size(sizeof(struct ifla_vf_rss_query_en)) + +- nla_total_size(0) + /* nest IFLA_VF_STATS */ +- /* IFLA_VF_STATS_RX_PACKETS */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_TX_PACKETS */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_RX_BYTES */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_TX_BYTES */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_BROADCAST */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_MULTICAST */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_RX_DROPPED */ +- nla_total_size_64bit(sizeof(__u64)) + +- /* IFLA_VF_STATS_TX_DROPPED */ +- nla_total_size_64bit(sizeof(__u64)) + + nla_total_size(sizeof(struct ifla_vf_trust))); ++ if (~ext_filter_mask & RTEXT_FILTER_SKIP_STATS) { ++ size += num_vfs * ++ (nla_total_size(0) + /* nest IFLA_VF_STATS */ ++ /* IFLA_VF_STATS_RX_PACKETS */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_TX_PACKETS */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_RX_BYTES */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_TX_BYTES */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_BROADCAST */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_MULTICAST */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_RX_DROPPED */ ++ nla_total_size_64bit(sizeof(__u64)) + ++ /* IFLA_VF_STATS_TX_DROPPED */ ++ nla_total_size_64bit(sizeof(__u64))); ++ } + return size; + } else + return 0; +@@ -1214,7 +1217,8 @@ static noinline_for_stack int rtnl_fill_stats(struct sk_buff *skb, + static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb, + struct net_device *dev, + int vfs_num, +- struct nlattr *vfinfo) ++ struct nlattr *vfinfo, ++ u32 ext_filter_mask) + { + struct ifla_vf_rss_query_en vf_rss_query_en; + struct nlattr *vf, *vfstats, *vfvlanlist; +@@ -1320,33 +1324,35 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb, + goto nla_put_vf_failure; + } + nla_nest_end(skb, vfvlanlist); +- memset(&vf_stats, 0, sizeof(vf_stats)); +- if (dev->netdev_ops->ndo_get_vf_stats) +- dev->netdev_ops->ndo_get_vf_stats(dev, vfs_num, +- &vf_stats); +- vfstats = nla_nest_start_noflag(skb, IFLA_VF_STATS); +- if (!vfstats) +- goto nla_put_vf_failure; +- if (nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_PACKETS, +- vf_stats.rx_packets, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_PACKETS, +- vf_stats.tx_packets, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_BYTES, +- vf_stats.rx_bytes, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_BYTES, +- vf_stats.tx_bytes, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_BROADCAST, +- vf_stats.broadcast, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_MULTICAST, +- vf_stats.multicast, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_DROPPED, +- vf_stats.rx_dropped, IFLA_VF_STATS_PAD) || +- nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_DROPPED, +- vf_stats.tx_dropped, IFLA_VF_STATS_PAD)) { +- nla_nest_cancel(skb, vfstats); +- goto nla_put_vf_failure; ++ if (~ext_filter_mask & RTEXT_FILTER_SKIP_STATS) { ++ memset(&vf_stats, 0, sizeof(vf_stats)); ++ if (dev->netdev_ops->ndo_get_vf_stats) ++ dev->netdev_ops->ndo_get_vf_stats(dev, vfs_num, ++ &vf_stats); ++ vfstats = nla_nest_start_noflag(skb, IFLA_VF_STATS); ++ if (!vfstats) ++ goto nla_put_vf_failure; ++ if (nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_PACKETS, ++ vf_stats.rx_packets, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_PACKETS, ++ vf_stats.tx_packets, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_BYTES, ++ vf_stats.rx_bytes, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_BYTES, ++ vf_stats.tx_bytes, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_BROADCAST, ++ vf_stats.broadcast, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_MULTICAST, ++ vf_stats.multicast, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_RX_DROPPED, ++ vf_stats.rx_dropped, IFLA_VF_STATS_PAD) || ++ nla_put_u64_64bit(skb, IFLA_VF_STATS_TX_DROPPED, ++ vf_stats.tx_dropped, IFLA_VF_STATS_PAD)) { ++ nla_nest_cancel(skb, vfstats); ++ goto nla_put_vf_failure; ++ } ++ nla_nest_end(skb, vfstats); + } +- nla_nest_end(skb, vfstats); + nla_nest_end(skb, vf); + return 0; + +@@ -1379,7 +1385,7 @@ static noinline_for_stack int rtnl_fill_vf(struct sk_buff *skb, + return -EMSGSIZE; + + for (i = 0; i < num_vfs; i++) { +- if (rtnl_fill_vfinfo(skb, dev, i, vfinfo)) ++ if (rtnl_fill_vfinfo(skb, dev, i, vfinfo, ext_filter_mask)) + return -EMSGSIZE; + } + +-- +2.39.2 + diff --git a/queue-5.15/samples-bpf-fix-buffer-overflow-in-tcp_basertt.patch b/queue-5.15/samples-bpf-fix-buffer-overflow-in-tcp_basertt.patch new file mode 100644 index 00000000000..810794a6582 --- /dev/null +++ b/queue-5.15/samples-bpf-fix-buffer-overflow-in-tcp_basertt.patch @@ -0,0 +1,36 @@ +From 073cd42c1db65ed5662ef91a1655a6f55efdf76b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 16:50:58 +0800 +Subject: samples/bpf: Fix buffer overflow in tcp_basertt + +From: Pengcheng Yang + +[ Upstream commit f4dea9689c5fea3d07170c2cb0703e216f1a0922 ] + +Using sizeof(nv) or strlen(nv)+1 is correct. + +Fixes: c890063e4404 ("bpf: sample BPF_SOCKET_OPS_BASE_RTT program") +Signed-off-by: Pengcheng Yang +Link: https://lore.kernel.org/r/1683276658-2860-1-git-send-email-yangpc@wangsu.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + samples/bpf/tcp_basertt_kern.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/samples/bpf/tcp_basertt_kern.c b/samples/bpf/tcp_basertt_kern.c +index 8dfe09a92feca..822b0742b8154 100644 +--- a/samples/bpf/tcp_basertt_kern.c ++++ b/samples/bpf/tcp_basertt_kern.c +@@ -47,7 +47,7 @@ int bpf_basertt(struct bpf_sock_ops *skops) + case BPF_SOCK_OPS_BASE_RTT: + n = bpf_getsockopt(skops, SOL_TCP, TCP_CONGESTION, + cong, sizeof(cong)); +- if (!n && !__builtin_memcmp(cong, nv, sizeof(nv)+1)) { ++ if (!n && !__builtin_memcmp(cong, nv, sizeof(nv))) { + /* Set base_rtt to 80us */ + rv = 80; + } else if (n) { +-- +2.39.2 + diff --git a/queue-5.15/scsi-3w-xxxx-add-error-handling-for-initialization-f.patch b/queue-5.15/scsi-3w-xxxx-add-error-handling-for-initialization-f.patch new file mode 100644 index 00000000000..b188368f16d --- /dev/null +++ b/queue-5.15/scsi-3w-xxxx-add-error-handling-for-initialization-f.patch @@ -0,0 +1,47 @@ +From b750275b92759977c3d66aba2fd1275874bed476 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 22:12:55 +0800 +Subject: scsi: 3w-xxxx: Add error handling for initialization failure in + tw_probe() + +From: Yuchen Yang + +[ Upstream commit 2e2fe5ac695a00ab03cab4db1f4d6be07168ed9d ] + +Smatch complains that: + +tw_probe() warn: missing error code 'retval' + +This patch adds error checking to tw_probe() to handle initialization +failure. If tw_reset_sequence() function returns a non-zero value, the +function will return -EINVAL to indicate initialization failure. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yuchen Yang +Link: https://lore.kernel.org/r/20230505141259.7730-1-u202114568@hust.edu.cn +Reviewed-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/3w-xxxx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c +index 4ee485ab27148..678c8ca4f699c 100644 +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -2305,8 +2305,10 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + TW_DISABLE_INTERRUPTS(tw_dev); + + /* Initialize the card */ +- if (tw_reset_sequence(tw_dev)) ++ if (tw_reset_sequence(tw_dev)) { ++ retval = -EINVAL; + goto out_release_mem_region; ++ } + + /* Set host specific parameters */ + host->max_id = TW_MAX_UNITS; +-- +2.39.2 + diff --git a/queue-5.15/scsi-qedf-fix-null-dereference-in-error-handling.patch b/queue-5.15/scsi-qedf-fix-null-dereference-in-error-handling.patch new file mode 100644 index 00000000000..7b1f060666a --- /dev/null +++ b/queue-5.15/scsi-qedf-fix-null-dereference-in-error-handling.patch @@ -0,0 +1,47 @@ +From 09246f89873e44a17bb8379201a7e37e02a7714a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 May 2023 22:00:21 +0800 +Subject: scsi: qedf: Fix NULL dereference in error handling + +From: Jinhong Zhu + +[ Upstream commit f025312b089474a54e4859f3453771314d9e3d4f ] + +Smatch reported: + +drivers/scsi/qedf/qedf_main.c:3056 qedf_alloc_global_queues() +warn: missing unwind goto? + +At this point in the function, nothing has been allocated so we can return +directly. In particular the "qedf->global_queues" have not been allocated +so calling qedf_free_global_queues() will lead to a NULL dereference when +we check if (!gl[i]) and "gl" is NULL. + +Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") +Signed-off-by: Jinhong Zhu +Link: https://lore.kernel.org/r/20230502140022.2852-1-jinhongzhu@hust.edu.cn +Reviewed-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index fa49a3e52a9b5..cf10c1a60399e 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -3046,9 +3046,8 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf) + * addresses of our queues + */ + if (!qedf->p_cpuq) { +- status = -EINVAL; + QEDF_ERR(&qedf->dbg_ctx, "p_cpuq is NULL.\n"); +- goto mem_alloc_failure; ++ return -EINVAL; + } + + qedf->global_queues = kzalloc((sizeof(struct global_queue *) +-- +2.39.2 + diff --git a/queue-5.15/sctp-add-bpf_bypass_getsockopt-proto-callback.patch b/queue-5.15/sctp-add-bpf_bypass_getsockopt-proto-callback.patch new file mode 100644 index 00000000000..4caba749771 --- /dev/null +++ b/queue-5.15/sctp-add-bpf_bypass_getsockopt-proto-callback.patch @@ -0,0 +1,93 @@ +From 8af62ddacd308c1ce7f55cc8fdaa7d5a63fce756 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2023 15:25:06 +0200 +Subject: sctp: add bpf_bypass_getsockopt proto callback + +From: Alexander Mikhalitsyn + +[ Upstream commit 2598619e012cee5273a2821441b9a051ad931249 ] + +Implement ->bpf_bypass_getsockopt proto callback and filter out +SCTP_SOCKOPT_PEELOFF, SCTP_SOCKOPT_PEELOFF_FLAGS and SCTP_SOCKOPT_CONNECTX3 +socket options from running eBPF hook on them. + +SCTP_SOCKOPT_PEELOFF and SCTP_SOCKOPT_PEELOFF_FLAGS options do fd_install(), +and if BPF_CGROUP_RUN_PROG_GETSOCKOPT hook returns an error after success of +the original handler sctp_getsockopt(...), userspace will receive an error +from getsockopt syscall and will be not aware that fd was successfully +installed into a fdtable. + +As pointed by Marcelo Ricardo Leitner it seems reasonable to skip +bpf getsockopt hook for SCTP_SOCKOPT_CONNECTX3 sockopt too. +Because internaly, it triggers connect() and if error is masked +then userspace will be confused. + +This patch was born as a result of discussion around a new SCM_PIDFD interface: +https://lore.kernel.org/all/20230413133355.350571-3-aleksandr.mikhalitsyn@canonical.com/ + +Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks") +Cc: Daniel Borkmann +Cc: Christian Brauner +Cc: Stanislav Fomichev +Cc: Neil Horman +Cc: Marcelo Ricardo Leitner +Cc: Xin Long +Cc: linux-sctp@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Cc: netdev@vger.kernel.org +Suggested-by: Stanislav Fomichev +Acked-by: Stanislav Fomichev +Signed-off-by: Alexander Mikhalitsyn +Acked-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sctp/socket.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 2bbc81ddb9e08..ed35d4a4c5253 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -8287,6 +8287,22 @@ static int sctp_getsockopt(struct sock *sk, int level, int optname, + return retval; + } + ++static bool sctp_bpf_bypass_getsockopt(int level, int optname) ++{ ++ if (level == SOL_SCTP) { ++ switch (optname) { ++ case SCTP_SOCKOPT_PEELOFF: ++ case SCTP_SOCKOPT_PEELOFF_FLAGS: ++ case SCTP_SOCKOPT_CONNECTX3: ++ return true; ++ default: ++ return false; ++ } ++ } ++ ++ return false; ++} ++ + static int sctp_hash(struct sock *sk) + { + /* STUB */ +@@ -9655,6 +9671,7 @@ struct proto sctp_prot = { + .shutdown = sctp_shutdown, + .setsockopt = sctp_setsockopt, + .getsockopt = sctp_getsockopt, ++ .bpf_bypass_getsockopt = sctp_bpf_bypass_getsockopt, + .sendmsg = sctp_sendmsg, + .recvmsg = sctp_recvmsg, + .bind = sctp_bind, +@@ -9707,6 +9724,7 @@ struct proto sctpv6_prot = { + .shutdown = sctp_shutdown, + .setsockopt = sctp_setsockopt, + .getsockopt = sctp_getsockopt, ++ .bpf_bypass_getsockopt = sctp_bpf_bypass_getsockopt, + .sendmsg = sctp_sendmsg, + .recvmsg = sctp_recvmsg, + .bind = sctp_bind, +-- +2.39.2 + diff --git a/queue-5.15/selftests-bpf-fix-check_mtu-using-wrong-variable-typ.patch b/queue-5.15/selftests-bpf-fix-check_mtu-using-wrong-variable-typ.patch new file mode 100644 index 00000000000..05ab8bcd76e --- /dev/null +++ b/queue-5.15/selftests-bpf-fix-check_mtu-using-wrong-variable-typ.patch @@ -0,0 +1,42 @@ +From 32ba106c1266e5e75ce453e098a3943749052725 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 13:30:47 +0200 +Subject: selftests/bpf: Fix check_mtu using wrong variable type + +From: Jesper Dangaard Brouer + +[ Upstream commit 095641817e1bf6aa2560e025e47575188ee3edaf ] + +Dan Carpenter found via Smatch static checker, that unsigned 'mtu_lo' is +never less than zero. + +Variable mtu_lo should have been an 'int', because read_mtu_device_lo() +uses minus as error indications. + +Fixes: b62eba563229 ("selftests/bpf: Tests using bpf_check_mtu BPF-helper") +Reported-by: Dan Carpenter +Signed-off-by: Jesper Dangaard Brouer +Signed-off-by: Daniel Borkmann +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/bpf/168605104733.3636467.17945947801753092590.stgit@firesoul +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/check_mtu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/check_mtu.c b/tools/testing/selftests/bpf/prog_tests/check_mtu.c +index 012068f33a0a8..871971cdd7b75 100644 +--- a/tools/testing/selftests/bpf/prog_tests/check_mtu.c ++++ b/tools/testing/selftests/bpf/prog_tests/check_mtu.c +@@ -197,7 +197,7 @@ static void test_check_mtu_tc(__u32 mtu, __u32 ifindex) + + void test_check_mtu(void) + { +- __u32 mtu_lo; ++ int mtu_lo; + + if (test__start_subtest("bpf_check_mtu XDP-attach")) + test_check_mtu_xdp_attach(); +-- +2.39.2 + diff --git a/queue-5.15/selftests-rtnetlink-remove-netdevsim-device-after-ip.patch b/queue-5.15/selftests-rtnetlink-remove-netdevsim-device-after-ip.patch new file mode 100644 index 00000000000..582479948d8 --- /dev/null +++ b/queue-5.15/selftests-rtnetlink-remove-netdevsim-device-after-ip.patch @@ -0,0 +1,40 @@ +From ad8333bcc6cc521a9480cfc5c3431fbab6cfd1d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 23:03:34 +0200 +Subject: selftests: rtnetlink: remove netdevsim device after ipsec offload + test + +From: Sabrina Dubroca + +[ Upstream commit 5f789f103671fec3733ebe756e56adf15c90c21d ] + +On systems where netdevsim is built-in or loaded before the test +starts, kci_test_ipsec_offload doesn't remove the netdevsim device it +created during the test. + +Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe") +Signed-off-by: Sabrina Dubroca +Reviewed-by: Simon Horman +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/e1cb94f4f82f4eca4a444feec4488a1323396357.1687466906.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/rtnetlink.sh | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh +index c3a905923ef29..cbf166df57da7 100755 +--- a/tools/testing/selftests/net/rtnetlink.sh ++++ b/tools/testing/selftests/net/rtnetlink.sh +@@ -835,6 +835,7 @@ EOF + fi + + # clean up any leftovers ++ echo 0 > /sys/bus/netdevsim/del_device + $probed && rmmod netdevsim + + if [ $ret -ne 0 ]; then +-- +2.39.2 + diff --git a/queue-5.15/series b/queue-5.15/series index 3059f4ae167..c75930b6cec 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -1 +1,259 @@ netfilter-nf_tables-drop-map-element-references-from-preparation-phase.patch +fs-pipe-reveal-missing-function-protoypes.patch +x86-resctrl-only-show-tasks-pid-in-current-pid-names.patch +blk-iocost-use-spin_lock_irqsave-in-adjust_inuse_and.patch +md-raid10-check-slab-out-of-bounds-in-md_bitmap_get_.patch +md-raid10-fix-overflow-of-md-safe_mode_delay.patch +md-raid10-fix-wrong-setting-of-max_corr_read_errors.patch +md-raid10-fix-null-ptr-deref-of-mreplace-in-raid10_s.patch +md-raid10-fix-io-loss-while-replacement-replace-rdev.patch +irqchip-jcore-aic-fix-missing-allocation-of-irq-desc.patch +svcrdma-prevent-page-release-when-nothing-was-receiv.patch +posix-timers-prevent-rt-livelock-in-itimer_delete.patch +tracing-timer-add-missing-hrtimer-modes-to-decode_hr.patch +clocksource-drivers-cadence-ttc-fix-memory-leak-in-t.patch +pm-domains-fix-integer-overflow-issues-in-genpd_pars.patch +perf-arm-cmn-fix-dtc-reset.patch +powercap-rapl-fix-config_iosf_mbi-dependency.patch +arm-9303-1-kprobes-avoid-missing-declaration-warning.patch +cpufreq-intel_pstate-fix-energy_performance_preferen.patch +thermal-drivers-mediatek-relocate-driver-to-mediatek.patch +thermal-drivers-sun8i-fix-some-error-handling-paths-.patch +rcutorture-correct-name-of-use_softirq-module-parame.patch +rcuscale-always-log-error-message.patch +rcuscale-move-shutdown-from-wait_event-to-wait_event.patch +rcu-rcuscale-move-rcu_scale_-after-kfree_scale_clean.patch +rcu-rcuscale-stop-kfree_scale_thread-thread-s-after-.patch +kselftest-vdso-fix-accumulation-of-uninitialized-ret.patch +perf-ibs-fix-interface-via-core-pmu-events.patch +x86-mm-fix-__swp_entry_to_pte-for-xen-pv-guests.patch +locking-atomic-arm-fix-sync-ops.patch +evm-complete-description-of-evm_inode_setattr.patch +evm-fix-build-warnings.patch +ima-fix-build-warnings.patch +pstore-ram-add-check-for-kstrdup.patch +igc-enable-and-fix-rx-hash-usage-by-netstack.patch +wifi-ath9k-fix-ar9003-mac-hardware-hang-check-regist.patch +wifi-ath9k-avoid-referencing-uninit-memory-in-ath9k_.patch +libbpf-btf_dump_type_data_check_overflow-needs-to-co.patch +samples-bpf-fix-buffer-overflow-in-tcp_basertt.patch +spi-spi-geni-qcom-correct-cs_toggle-bit-in-spi_trans.patch +wifi-wilc1000-fix-for-absent-rsn-capabilities-wfa-te.patch +wifi-mwifiex-fix-the-size-of-a-memory-allocation-in-.patch +sctp-add-bpf_bypass_getsockopt-proto-callback.patch +libbpf-fix-offsetof-and-container_of-to-work-with-co.patch +bpf-don-t-efault-for-g-s-setsockopt-with-wrong-optle.patch +spi-dw-round-of-n_bytes-to-power-of-2.patch +nfc-llcp-fix-possible-use-of-uninitialized-variable-.patch +bpftool-jit-limited-misreported-as-negative-value-on.patch +regulator-core-fix-more-error-checking-for-debugfs_c.patch +regulator-core-streamline-debugfs-operations.patch +wifi-orinoco-fix-an-error-handling-path-in-spectrum_.patch +wifi-orinoco-fix-an-error-handling-path-in-orinoco_c.patch +wifi-atmel-fix-an-error-handling-path-in-atmel_probe.patch +wl3501_cs-use-eth_hw_addr_set.patch +wifi-move-from-strlcpy-with-unused-retval-to-strscpy.patch +wifi-wl3501_cs-fix-an-error-handling-path-in-wl3501_.patch +wifi-ray_cs-utilize-strnlen-in-parse_addr.patch +wifi-ray_cs-drop-useless-status-variable-in-parse_ad.patch +wifi-ray_cs-fix-an-error-handling-path-in-ray_probe.patch +wifi-ath9k-don-t-allow-to-overwrite-endpoint0-attrib.patch +selftests-bpf-fix-check_mtu-using-wrong-variable-typ.patch +wifi-rsi-do-not-configure-wowlan-in-shutdown-hook-if.patch +wifi-rsi-do-not-set-mmc_pm_keep_power-in-shutdown.patch +watchdog-perf-define-dummy-watchdog_update_hrtimer_t.patch +watchdog-perf-more-properly-prevent-false-positives-.patch +kexec-fix-a-memory-leak-in-crash_shrink_memory.patch +memstick-r592-make-memstick_debug_get_tpc_name-stati.patch +wifi-ath9k-fix-possible-stall-on-ath9k_txq_list_has_.patch +rtnetlink-extend-rtext_filter_skip_stats-to-ifla_vf_.patch +wifi-iwlwifi-pull-from-txqs-with-softirqs-disabled.patch +iwlwifi-don-t-dump_stack-when-we-get-an-unexpected-i.patch +wifi-iwlwifi-pcie-fix-null-pointer-dereference-in-iw.patch +wifi-cfg80211-rewrite-merging-of-inherited-elements.patch +mmc-core-support-zeroout-using-trim-for-emmc.patch +wifi-iwlwifi-mvm-indicate-hw-decrypt-for-beacon-prot.patch +wifi-ath9k-convert-msecs-to-jiffies-where-needed.patch +bpf-omit-superfluous-address-family-check-in-__bpf_s.patch +bpf-factor-out-socket-lookup-functions-for-the-tc-ho.patch +bpf-call-__bpf_sk_lookup-__bpf_skc_lookup-directly-v.patch +bpf-fix-bpf-socket-lookup-from-tc-xdp-to-respect-soc.patch +can-length-fix-bitstuffing-count.patch +igc-fix-race-condition-in-ptp-tx-code.patch +net-stmmac-fix-double-serdes-powerdown.patch +netlink-fix-potential-deadlock-in-netlink_set_err.patch +netlink-do-not-hard-code-device-address-lenth-in-fdb.patch +bonding-do-not-assume-skb-mac_header-is-set.patch +selftests-rtnetlink-remove-netdevsim-device-after-ip.patch +gtp-fix-use-after-free-in-__gtp_encap_destroy.patch +net-axienet-move-reset-before-64-bit-dma-detection.patch +sfc-fix-crash-when-reading-stats-while-nic-is-resett.patch +nfc-llcp-simplify-llcp_sock_connect-error-paths.patch +net-nfc-fix-use-after-free-caused-by-nfc_llcp_find_l.patch +lib-ts_bm-reset-initial-match-offset-for-every-block.patch +netfilter-conntrack-dccp-copy-entire-header-to-stack.patch +netfilter-nf_conntrack_sip-fix-the-ct_sip_parse_nume.patch +ipvlan-fix-return-value-of-ipvlan_queue_xmit.patch +netlink-add-__sock_i_ino-for-__netlink_diag_dump.patch +mmc-core-rewrite-mmc_fixup_device.patch +mmc-core-allow-to-match-the-device-tree-to-apply-qui.patch +mmc-add-mmc_quirk_broken_sd_cache-for-kingston-canva.patch +drm-amd-display-add-logging-for-display-mall-refresh.patch +radeon-avoid-double-free-in-ci_dpm_init.patch +drm-amd-display-explicitly-specify-update-type-per-p.patch +input-drv260x-sleep-between-polling-go-bit.patch +drm-bridge-tc358768-always-enable-hs-video-mode.patch +drm-bridge-tc358768-fix-pll-parameters-computation.patch +drm-bridge-tc358768-fix-pll-target-frequency.patch +drm-bridge-tc358768-fix-tclk_zerocnt-computation.patch +drm-bridge-tc358768-add-atomic_get_input_bus_fmts-im.patch +drm-bridge-tc358768-fix-tclk_trailcnt-computation.patch +drm-bridge-tc358768-fix-ths_zerocnt-computation.patch +drm-bridge-tc358768-fix-txtagocnt-computation.patch +drm-bridge-tc358768-fix-ths_trailcnt-computation.patch +drm-vram-helper-fix-function-names-in-vram-helper-do.patch +arm-dts-bcm5301x-drop-clock-names-from-the-spi-node.patch +arm-dts-meson8b-correct-uart_b-and-uart_c-clock-refe.patch +input-adxl34x-do-not-hardcode-interrupt-trigger-type.patch +drm-sun4i_tcon-use-devm_clk_get_enabled-in-sun4i_tco.patch +drm-panel-sharp-ls043t1le01-adjust-mode-settings.patch +arm-dts-stm32-move-ethernet-mac-eeprom-from-som-to-c.patch +bus-ti-sysc-fix-dispc-quirk-masking-bool-variables.patch +arm64-dts-microchip-sparx5-do-not-use-psci-on-refere.patch +clk-imx-scu-use-_safe-list-iterator-to-avoid-a-use-a.patch +rdma-bnxt_re-disable-kill-tasklet-only-if-it-is-enab.patch +rdma-bnxt_re-fix-to-remove-unnecessary-return-labels.patch +rdma-bnxt_re-use-unique-names-while-registering-inte.patch +rdma-bnxt_re-remove-a-redundant-check-inside-bnxt_re.patch +rdma-bnxt_re-fix-to-remove-an-unnecessary-log.patch +drm-msm-dsi-don-t-allow-enabling-14nm-vco-with-unpro.patch +drm-msm-disp-dpu-get-timing-engine-status-from-intf-.patch +drm-msm-dpu-set-dpu_data_hctl_en-for-in-intf_sc7180_.patch +arm-dts-gta04-move-model-property-out-of-pinctrl-nod.patch +arm64-dts-qcom-msm8916-correct-camss-unit-address.patch +arm64-dts-qcom-msm8994-correct-spmi-unit-address.patch +arm64-dts-qcom-msm8996-correct-camss-unit-address.patch +arm64-dts-qcom-sdm630-correct-camss-unit-address.patch +arm64-dts-qcom-sdm845-correct-camss-unit-address.patch +arm64-dts-qcom-db820c-move-blsp1_uart2-pin-states-to.patch +arm64-dts-qcom-apq8016-sbc-update-modem-and-wifi-fir.patch +arm64-dts-qcom-apq8016-sbc-clarify-firmware-names.patch +arm64-dts-qcom-apq8016-sbc-fix-mpps-state-names.patch +arm64-dts-qcom-drop-unneeded-extra-device-specific-i.patch +arm64-dts-qcom-apq8016-sbc-fix-regulator-constraints.patch +arm64-dts-qcom-apq8016-sbc-fix-1.8v-power-rail-on-ls.patch +drm-panel-simple-fix-active-size-for-ampire-am-48027.patch +arm-ep93xx-fix-missing-prototype-warnings.patch +arm-omap2-fix-missing-tick_broadcast-prototype.patch +arm64-dts-qcom-apq8096-fix-fixed-regulator-name-prop.patch +arm64-dts-mediatek-mt8183-add-mediatek-broken-save-r.patch +arm-dts-stm32-shorten-the-av96-hdmi-sound-card-name.patch +memory-brcmstb_dpfe-fix-testing-array-offset-after-u.patch +asoc-es8316-increment-max-value-for-alc-capture-targ.patch +asoc-es8316-do-not-set-rate-constraints-for-unsuppor.patch +arm-dts-meson8-correct-uart_b-and-uart_c-clock-refer.patch +soc-fsl-qe-fix-usb.c-build-errors.patch +rdma-irdma-avoid-fortify-string-warning-in-irdma_clr.patch +ib-hfi1-use-bitmap_zalloc-when-applicable.patch +ib-hfi1-fix-wrong-mmu_node-used-for-user-sdma-packet.patch +rdma-hns-fix-hns_roce_table_get-return-value.patch +arm-dts-iwg20d-q7-common-fix-backlight-pwm-specifier.patch +arm64-dts-renesas-ulcb-kf-remove-flow-control-for-sc.patch +fbdev-omapfb-lcd_mipid-fix-an-error-handling-path-in.patch +arm64-dts-ti-k3-j7200-fix-physical-address-of-pin.patch +arm-dts-stm32-fix-audio-routing-on-stm32mp15xx-dhcom.patch +arm-dts-stm32-fix-i2s-endpoint-format-property-for-s.patch +hwmon-gsc-hwmon-fix-fan-pwm-temperature-scaling.patch +hwmon-adm1275-allow-setting-sample-averaging.patch +hwmon-pmbus-adm1275-fix-problems-with-temperature-mo.patch +arm-dts-bcm5301x-fix-duplex-full-full-duplex.patch +mips-dts-ci20-fix-act8600-regulator-node-names.patch +drm-amdkfd-fix-potential-deallocation-of-previously-.patch +drm-amd-display-fix-artifacting-on-edp-panels-when-e.patch +drm-radeon-fix-possible-division-by-zero-errors.patch +amdgpu-validate-offset_in_bo-of-drm_amdgpu_gem_va.patch +drm-msm-a5xx-really-check-for-a510-in-a5xx_gpu_init.patch +rdma-bnxt_re-wraparound-mbox-producer-index.patch +rdma-bnxt_re-avoid-calling-wake_up-threads-from-spin.patch +clk-imx-clk-imx8mn-fix-memory-leak-in-imx8mn_clocks_.patch +clk-imx-clk-imx8mp-improve-error-handling-in-imx8mp_.patch +arm64-dts-qcom-sm8250-edo-panel-framebuffer-is-2.5k-.patch +clk-clocking-wizard-fix-oops-in-clk_wzrd_register_di.patch +clk-tegra-tegra124-emc-fix-potential-memory-leak.patch +alsa-ac97-fix-possible-null-dereference-in-snd_ac97_.patch +drm-msm-dpu-do-not-enable-color-management-if-dspps-.patch +drm-msm-dp-free-resources-after-unregistering-them.patch +arm64-dts-mediatek-add-cpufreq-nodes-for-mt8192.patch +arm64-dts-mediatek-mt8192-fix-cpus-capacity-dmips-mh.patch +drm-msm-dpu-correct-merge_3d-length.patch +clk-vc5-check-memory-returned-by-kasprintf.patch +clk-cdce925-check-return-value-of-kasprintf.patch +clk-si5341-return-error-if-one-synth-clock-registrat.patch +clk-si5341-check-return-value-of-devm_-kasprintf.patch +clk-si5341-free-unused-memory-on-probe-failure.patch +clk-keystone-sci-clk-check-return-value-of-kasprintf.patch +clk-ti-clkctrl-check-return-value-of-kasprintf.patch +clk-clocking-wizard-rename-nr-outputs-to-xlnx-nr-out.patch +clocking-wizard-support-higher-frequency-accuracy.patch +clk-clocking-wizard-check-return-value-of-devm_kaspr.patch +drivers-meson-secure-pwrc-always-enable-dma-domain.patch +ovl-update-of-dentry-revalidate-flags-after-copy-up.patch +asoc-imx-audmix-check-return-value-of-devm_kasprintf.patch +clk-fix-memory-leak-in-devm_clk_notifier_register.patch +mips-dts-ci20-add-parent-supplies-to-act8600-regulat.patch +mips-dts-ci20-raise-vddcore-voltage-to-1.125-volts.patch +pci-cadence-fix-gen2-link-retraining-process.patch +pci-vmd-reset-vmd-config-register-between-soft-reboo.patch +scsi-qedf-fix-null-dereference-in-error-handling.patch +pinctrl-bcm2835-handle-gpiochip_add_pin_range-errors.patch +pci-aspm-disable-aspm-on-mfd-function-removal-to-avo.patch +scsi-3w-xxxx-add-error-handling-for-initialization-f.patch +pci-pciehp-cancel-bringup-sequence-if-card-is-not-pr.patch +pci-ftpci100-release-the-clock-resources.patch +pci-add-pci_clear_master-stub-for-non-config_pci.patch +perf-bench-use-unbuffered-output-when-pipe-tee-ing-t.patch +perf-bench-add-missing-setlocale-call-to-allow-usage.patch +pinctrl-cherryview-return-correct-value-if-pin-in-pu.patch +kcsan-don-t-expect-64-bits-atomic-builtins-from-32-b.patch +powerpc-interrupt-don-t-read-msr-from-interrupt_exit.patch +powerpc-signal32-force-inlining-of-__unsafe_save_use.patch +perf-script-fix-allocation-of-evsel-priv-related-to-.patch +perf-dwarf-aux-fix-off-by-one-in-die_get_varname.patch +powerpc-64s-fix-vas-mm-use-after-free.patch +pinctrl-microchip-sgpio-check-return-value-of-devm_k.patch +pinctrl-at91-pio4-check-return-value-of-devm_kasprin.patch +powerpc-powernv-sriov-perform-null-check-on-iov-befo.patch +powerpc-simplify-ppc_save_regs.patch +powerpc-update-ppc_save_regs-to-save-current-r1-in-p.patch +riscv-uprobes-restore-thread.bad_cause.patch +powerpc-book3s64-mm-fix-directmap-stats-in-proc-memi.patch +powerpc-mm-dax-fix-the-condition-when-checking-if-al.patch +hwrng-virtio-add-an-internal-buffer.patch +hwrng-virtio-don-t-wait-on-cleanup.patch +hwrng-virtio-don-t-waste-entropy.patch +hwrng-virtio-always-add-a-pending-request.patch +hwrng-virtio-fix-race-on-data_avail-and-actual-data.patch +modpost-remove-broken-calculation-of-exception_table.patch +crypto-nx-fix-build-warnings-when-debug_fs-is-not-en.patch +modpost-fix-section-mismatch-message-for-r_arm_abs32.patch +modpost-fix-section-mismatch-message-for-r_arm_-pc24.patch +crypto-marvell-cesa-fix-type-mismatch-warning.patch +modpost-fix-off-by-one-in-is_executable_section.patch +arc-define-asm_nl-and-__align-_str-outside-ifdef-__a.patch +crypto-qat-honor-crypto_tfm_req_may_sleep-flag.patch +crypto-qat-replace-get_current_node-with-numa_node_i.patch +crypto-qat-use-reference-to-structure-in-dma_map_sin.patch +crypto-kpp-add-helper-to-set-reqsize.patch +crypto-qat-use-helper-to-set-reqsize.patch +crypto-qat-unmap-buffer-before-free-for-dh.patch +crypto-qat-unmap-buffers-before-free-for-rsa.patch +nfsv4.1-freeze-the-session-table-upon-receiving-nfs4.patch +smb3-do-not-send-lease-break-acknowledgment-if-all-f.patch +dax-fix-dax_mapping_release-use-after-free.patch +dax-introduce-alloc_dev_dax_id.patch +dax-kmem-pass-valid-argument-to-memory_group_registe.patch +hwrng-st-keep-clock-enabled-while-hwrng-is-registere.patch +kbuild-disable-gcov-for-.mod.o.patch +efi-libstub-disable-pci-dma-before-grabbing-the-efi-.patch +ksmbd-avoid-field-overflow-warning.patch +acpi-utils-fix-acpi_evaluate_dsm_typed-redefinition-.patch diff --git a/queue-5.15/sfc-fix-crash-when-reading-stats-while-nic-is-resett.patch b/queue-5.15/sfc-fix-crash-when-reading-stats-while-nic-is-resett.patch new file mode 100644 index 00000000000..a389ef0a118 --- /dev/null +++ b/queue-5.15/sfc-fix-crash-when-reading-stats-while-nic-is-resett.patch @@ -0,0 +1,70 @@ +From 7c7835043e5345e44f6601ec4cfab0a95e60d01c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 15:34:48 +0100 +Subject: sfc: fix crash when reading stats while NIC is resetting + +From: Edward Cree + +[ Upstream commit d1b355438b8325a486f087e506d412c4e852f37b ] + +efx_net_stats() (.ndo_get_stats64) can be called during an ethtool + selftest, during which time nic_data->mc_stats is NULL as the NIC has + been fini'd. In this case do not attempt to fetch the latest stats + from the hardware, else we will crash on a NULL dereference: + BUG: kernel NULL pointer dereference, address: 0000000000000038 + RIP efx_nic_update_stats + abridged calltrace: + efx_ef10_update_stats_pf + efx_net_stats + dev_get_stats + dev_seq_printf_stats +Skipping the read is safe, we will simply give out stale stats. +To ensure that the free in efx_ef10_fini_nic() does not race against + efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the + efx->stats_lock in fini_nic (it is already held across update_stats). + +Fixes: d3142c193dca ("sfc: refactor EF10 stats handling") +Reviewed-by: Pieter Jansen van Vuuren +Signed-off-by: Edward Cree +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index 302b97c2e617c..b20dbda37c7ef 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -1297,8 +1297,10 @@ static void efx_ef10_fini_nic(struct efx_nic *efx) + { + struct efx_ef10_nic_data *nic_data = efx->nic_data; + ++ spin_lock_bh(&efx->stats_lock); + kfree(nic_data->mc_stats); + nic_data->mc_stats = NULL; ++ spin_unlock_bh(&efx->stats_lock); + } + + static int efx_ef10_init_nic(struct efx_nic *efx) +@@ -1852,9 +1854,14 @@ static size_t efx_ef10_update_stats_pf(struct efx_nic *efx, u64 *full_stats, + + efx_ef10_get_stat_mask(efx, mask); + +- efx_nic_copy_stats(efx, nic_data->mc_stats); +- efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT, +- mask, stats, nic_data->mc_stats, false); ++ /* If NIC was fini'd (probably resetting), then we can't read ++ * updated stats right now. ++ */ ++ if (nic_data->mc_stats) { ++ efx_nic_copy_stats(efx, nic_data->mc_stats); ++ efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT, ++ mask, stats, nic_data->mc_stats, false); ++ } + + /* Update derived statistics */ + efx_nic_fix_nodesc_drop_stat(efx, +-- +2.39.2 + diff --git a/queue-5.15/smb3-do-not-send-lease-break-acknowledgment-if-all-f.patch b/queue-5.15/smb3-do-not-send-lease-break-acknowledgment-if-all-f.patch new file mode 100644 index 00000000000..7e4fc8415f5 --- /dev/null +++ b/queue-5.15/smb3-do-not-send-lease-break-acknowledgment-if-all-f.patch @@ -0,0 +1,66 @@ +From a8cfb6016f305062ff82affbe3e1691238b7bd3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Jun 2023 19:02:24 +0000 +Subject: SMB3: Do not send lease break acknowledgment if all file handles have + been closed + +From: Bharath SM + +[ Upstream commit da787d5b74983f7525d1eb4b9c0b4aff2821511a ] + +In case if all existing file handles are deferred handles and if all of +them gets closed due to handle lease break then we dont need to send +lease break acknowledgment to server, because last handle close will be +considered as lease break ack. +After closing deferred handels, we check for openfile list of inode, +if its empty then we skip sending lease break ack. + +Fixes: 59a556aebc43 ("SMB3: drop reference to cfile before sending oplock break") +Reviewed-by: Tom Talpey +Signed-off-by: Bharath SM +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/file.c | 25 ++++++++++++------------- + 1 file changed, 12 insertions(+), 13 deletions(-) + +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index bda1ffe6e41f8..4e4f73a90574b 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -4923,20 +4923,19 @@ void cifs_oplock_break(struct work_struct *work) + + _cifsFileInfo_put(cfile, false /* do not wait for ourself */, false); + /* +- * releasing stale oplock after recent reconnect of smb session using +- * a now incorrect file handle is not a data integrity issue but do +- * not bother sending an oplock release if session to server still is +- * disconnected since oplock already released by the server ++ * MS-SMB2 3.2.5.19.1 and 3.2.5.19.2 (and MS-CIFS 3.2.5.42) do not require ++ * an acknowledgment to be sent when the file has already been closed. ++ * check for server null, since can race with kill_sb calling tree disconnect. + */ +- if (!oplock_break_cancelled) { +- /* check for server null since can race with kill_sb calling tree disconnect */ +- if (tcon->ses && tcon->ses->server) { +- rc = tcon->ses->server->ops->oplock_response(tcon, persistent_fid, +- volatile_fid, net_fid, cinode); +- cifs_dbg(FYI, "Oplock release rc = %d\n", rc); +- } else +- pr_warn_once("lease break not sent for unmounted share\n"); +- } ++ spin_lock(&cinode->open_file_lock); ++ if (tcon->ses && tcon->ses->server && !oplock_break_cancelled && ++ !list_empty(&cinode->openFileList)) { ++ spin_unlock(&cinode->open_file_lock); ++ rc = tcon->ses->server->ops->oplock_response(tcon, persistent_fid, ++ volatile_fid, net_fid, cinode); ++ cifs_dbg(FYI, "Oplock release rc = %d\n", rc); ++ } else ++ spin_unlock(&cinode->open_file_lock); + + cifs_done_oplock_break(cinode); + } +-- +2.39.2 + diff --git a/queue-5.15/soc-fsl-qe-fix-usb.c-build-errors.patch b/queue-5.15/soc-fsl-qe-fix-usb.c-build-errors.patch new file mode 100644 index 00000000000..db090e9e193 --- /dev/null +++ b/queue-5.15/soc-fsl-qe-fix-usb.c-build-errors.patch @@ -0,0 +1,60 @@ +From 79d8fc3ec21272a231643a4a838a6d3aea7c15e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 May 2023 15:52:16 -0700 +Subject: soc/fsl/qe: fix usb.c build errors + +From: Randy Dunlap + +[ Upstream commit 7b1a78babd0d2cd27aa07255dee0c2d7ac0f31e3 ] + +Fix build errors in soc/fsl/qe/usb.c when QUICC_ENGINE is not set. +This happens when PPC_EP88XC is set, which selects CPM1 & CPM. +When CPM is set, USB_FSL_QE can be set without QUICC_ENGINE +being set. When USB_FSL_QE is set, QE_USB deafults to y, which +causes build errors when QUICC_ENGINE is not set. Making +QE_USB depend on QUICC_ENGINE prevents QE_USB from defaulting to y. + +Fixes these build errors: + +drivers/soc/fsl/qe/usb.o: in function `qe_usb_clock_set': +usb.c:(.text+0x1e): undefined reference to `qe_immr' +powerpc-linux-ld: usb.c:(.text+0x2a): undefined reference to `qe_immr' +powerpc-linux-ld: usb.c:(.text+0xbc): undefined reference to `qe_setbrg' +powerpc-linux-ld: usb.c:(.text+0xca): undefined reference to `cmxgcr_lock' +powerpc-linux-ld: usb.c:(.text+0xce): undefined reference to `cmxgcr_lock' + +Fixes: 5e41486c408e ("powerpc/QE: add support for QE USB clocks routing") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Link: https://lore.kernel.org/all/202301101500.pillNv6R-lkp@intel.com/ +Suggested-by: Michael Ellerman +Cc: Christophe Leroy +Cc: Leo Li +Cc: Masahiro Yamada +Cc: Nicolas Schier +Cc: Qiang Zhao +Cc: linuxppc-dev +Cc: linux-arm-kernel@lists.infradead.org +Cc: Kumar Gala +Acked-by: Nicolas Schier +Signed-off-by: Li Yang +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/qe/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/soc/fsl/qe/Kconfig b/drivers/soc/fsl/qe/Kconfig +index 357c5800b112f..7afa796dbbb89 100644 +--- a/drivers/soc/fsl/qe/Kconfig ++++ b/drivers/soc/fsl/qe/Kconfig +@@ -39,6 +39,7 @@ config QE_TDM + + config QE_USB + bool ++ depends on QUICC_ENGINE + default y if USB_FSL_QE + help + QE USB Controller support +-- +2.39.2 + diff --git a/queue-5.15/spi-dw-round-of-n_bytes-to-power-of-2.patch b/queue-5.15/spi-dw-round-of-n_bytes-to-power-of-2.patch new file mode 100644 index 00000000000..994ce993648 --- /dev/null +++ b/queue-5.15/spi-dw-round-of-n_bytes-to-power-of-2.patch @@ -0,0 +1,59 @@ +From 70259d0ff6639d1bf2cf955b63941b261ea32650 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 10:47:45 +0000 +Subject: spi: dw: Round of n_bytes to power of 2 + +From: Joy Chakraborty + +[ Upstream commit 9f34baf67e4d08908fd94ff29c825bb673295336 ] + +n_bytes variable in the driver represents the number of bytes per word +that needs to be sent/copied to fifo. Bits/word can be between 8 and 32 +bits from the client but in memory they are a power of 2, same is mentioned +in spi.h header: +" + * @bits_per_word: Data transfers involve one or more words; word sizes + * like eight or 12 bits are common. In-memory wordsizes are + * powers of two bytes (e.g. 20 bit samples use 32 bits). + * This may be changed by the device's driver, or left at the + * default (0) indicating protocol words are eight bit bytes. + * The spi_transfer.bits_per_word can override this for each transfer. +" + +Hence, round of n_bytes to a power of 2 to avoid values like 3 which +would generate unalligned/odd accesses to memory/fifo. + +* tested on Baikal-T1 based system with DW SPI-looped back interface +transferring a chunk of data with DFS:8,12,16. + +Fixes: a51acc2400d4 ("spi: dw: Add support for 32-bits max xfer size") +Suggested-by: Andy Shevchenko +--- + drivers/spi/spi-dw-core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-dw-core.c b/drivers/spi/spi-dw-core.c +index 59e22c6b4b201..8fc598f09a728 100644 +--- a/drivers/spi/spi-dw-core.c ++++ b/drivers/spi/spi-dw-core.c +@@ -416,7 +416,10 @@ static int dw_spi_transfer_one(struct spi_controller *master, + int ret; + + dws->dma_mapped = 0; +- dws->n_bytes = DIV_ROUND_UP(transfer->bits_per_word, BITS_PER_BYTE); ++ dws->n_bytes = ++ roundup_pow_of_two(DIV_ROUND_UP(transfer->bits_per_word, ++ BITS_PER_BYTE)); ++ + dws->tx = (void *)transfer->tx_buf; + dws->tx_len = transfer->len / dws->n_bytes; + dws->rx = transfer->rx_buf; +-- +2.39.2 + diff --git a/queue-5.15/spi-spi-geni-qcom-correct-cs_toggle-bit-in-spi_trans.patch b/queue-5.15/spi-spi-geni-qcom-correct-cs_toggle-bit-in-spi_trans.patch new file mode 100644 index 00000000000..a1ccbe3c3a0 --- /dev/null +++ b/queue-5.15/spi-spi-geni-qcom-correct-cs_toggle-bit-in-spi_trans.patch @@ -0,0 +1,44 @@ +From 362dba2b4e6b6226421181eec771ed0eedbcb258 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 14:12:08 +0530 +Subject: spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG + +From: Vijaya Krishna Nivarthi + +[ Upstream commit 5fd7c99ecf45c8ee8a9b1268f0ffc91cc6271da2 ] + +The CS_TOGGLE bit when set is supposed to instruct FW to +toggle CS line between words. The driver with intent of +disabling this behaviour has been unsetting BIT(0). This has +not caused any trouble so far because the original BIT(1) +is untouched and BIT(0) likely wasn't being used. + +Correct this to prevent a potential future bug. + +Signed-off-by: Vijaya Krishna Nivarthi +--- + drivers/spi/spi-geni-qcom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 2f51421e2a718..4b92f119955c7 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -32,7 +32,7 @@ + #define CS_DEMUX_OUTPUT_SEL GENMASK(3, 0) + + #define SE_SPI_TRANS_CFG 0x25c +-#define CS_TOGGLE BIT(0) ++#define CS_TOGGLE BIT(1) + + #define SE_SPI_WORD_LEN 0x268 + #define WORD_LEN_MSK GENMASK(9, 0) +-- +2.39.2 + diff --git a/queue-5.15/svcrdma-prevent-page-release-when-nothing-was-receiv.patch b/queue-5.15/svcrdma-prevent-page-release-when-nothing-was-receiv.patch new file mode 100644 index 00000000000..d0af7ca7e74 --- /dev/null +++ b/queue-5.15/svcrdma-prevent-page-release-when-nothing-was-receiv.patch @@ -0,0 +1,53 @@ +From 9b9a06b62fda6561f8db58e51f76edf265503e25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 10:10:20 -0400 +Subject: svcrdma: Prevent page release when nothing was received + +From: Chuck Lever + +[ Upstream commit baf6d18b116b7dc84ed5e212c3a89f17cdc3f28c ] + +I noticed that svc_rqst_release_pages() was still unnecessarily +releasing a page when svc_rdma_recvfrom() returns zero. + +Fixes: a53d5cb0646a ("svcrdma: Avoid releasing a page in svc_xprt_release()") +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c +index 3ad4291148a68..0377679678f93 100644 +--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c ++++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c +@@ -791,6 +791,12 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp) + struct svc_rdma_recv_ctxt *ctxt; + int ret; + ++ /* Prevent svc_xprt_release() from releasing pages in rq_pages ++ * when returning 0 or an error. ++ */ ++ rqstp->rq_respages = rqstp->rq_pages; ++ rqstp->rq_next_page = rqstp->rq_respages; ++ + rqstp->rq_xprt_ctxt = NULL; + + ctxt = NULL; +@@ -814,12 +820,6 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp) + DMA_FROM_DEVICE); + svc_rdma_build_arg_xdr(rqstp, ctxt); + +- /* Prevent svc_xprt_release from releasing pages in rq_pages +- * if we return 0 or an error. +- */ +- rqstp->rq_respages = rqstp->rq_pages; +- rqstp->rq_next_page = rqstp->rq_respages; +- + ret = svc_rdma_xdr_decode_req(&rqstp->rq_arg, ctxt); + if (ret < 0) + goto out_err; +-- +2.39.2 + diff --git a/queue-5.15/thermal-drivers-mediatek-relocate-driver-to-mediatek.patch b/queue-5.15/thermal-drivers-mediatek-relocate-driver-to-mediatek.patch new file mode 100644 index 00000000000..4a1f36fe646 --- /dev/null +++ b/queue-5.15/thermal-drivers-mediatek-relocate-driver-to-mediatek.patch @@ -0,0 +1,122 @@ +From 8bc1c324d593a8f351ca873d6f4c34c1a8bc7840 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 11:56:23 +0100 +Subject: thermal/drivers/mediatek: Relocate driver to mediatek folder + +From: Balsam CHIHI + +[ Upstream commit fad399ebdd67f602f306b524e6f62c3570943a48 ] + +Add MediaTek proprietary folder to upstream more thermal zone and cooler +drivers, relocate the original thermal controller driver to it, and rename it +as "auxadc_thermal.c" to show its purpose more clearly. + +Signed-off-by: Balsam CHIHI +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230209105628.50294-2-bchihi@baylibre.com +Signed-off-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: 86edac7d3888 ("Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe"") +Signed-off-by: Sasha Levin +--- + drivers/thermal/Kconfig | 14 ++++--------- + drivers/thermal/Makefile | 2 +- + drivers/thermal/mediatek/Kconfig | 21 +++++++++++++++++++ + drivers/thermal/mediatek/Makefile | 1 + + .../auxadc_thermal.c} | 2 +- + 5 files changed, 28 insertions(+), 12 deletions(-) + create mode 100644 drivers/thermal/mediatek/Kconfig + create mode 100644 drivers/thermal/mediatek/Makefile + rename drivers/thermal/{mtk_thermal.c => mediatek/auxadc_thermal.c} (99%) + +diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig +index d7f44deab5b1d..7a4ba50ba97d0 100644 +--- a/drivers/thermal/Kconfig ++++ b/drivers/thermal/Kconfig +@@ -401,16 +401,10 @@ config DA9062_THERMAL + zone. + Compatible with the DA9062 and DA9061 PMICs. + +-config MTK_THERMAL +- tristate "Temperature sensor driver for mediatek SoCs" +- depends on ARCH_MEDIATEK || COMPILE_TEST +- depends on HAS_IOMEM +- depends on NVMEM || NVMEM=n +- depends on RESET_CONTROLLER +- default y +- help +- Enable this option if you want to have support for thermal management +- controller present in Mediatek SoCs ++menu "Mediatek thermal drivers" ++depends on ARCH_MEDIATEK || COMPILE_TEST ++source "drivers/thermal/mediatek/Kconfig" ++endmenu + + config AMLOGIC_THERMAL + tristate "Amlogic Thermal Support" +diff --git a/drivers/thermal/Makefile b/drivers/thermal/Makefile +index 82fc3e616e54b..d02d011b825ac 100644 +--- a/drivers/thermal/Makefile ++++ b/drivers/thermal/Makefile +@@ -54,7 +54,7 @@ obj-y += st/ + obj-$(CONFIG_QCOM_TSENS) += qcom/ + obj-y += tegra/ + obj-$(CONFIG_HISI_THERMAL) += hisi_thermal.o +-obj-$(CONFIG_MTK_THERMAL) += mtk_thermal.o ++obj-y += mediatek/ + obj-$(CONFIG_GENERIC_ADC_THERMAL) += thermal-generic-adc.o + obj-$(CONFIG_UNIPHIER_THERMAL) += uniphier_thermal.o + obj-$(CONFIG_AMLOGIC_THERMAL) += amlogic_thermal.o +diff --git a/drivers/thermal/mediatek/Kconfig b/drivers/thermal/mediatek/Kconfig +new file mode 100644 +index 0000000000000..7558a847d4e92 +--- /dev/null ++++ b/drivers/thermal/mediatek/Kconfig +@@ -0,0 +1,21 @@ ++config MTK_THERMAL ++ tristate "MediaTek thermal drivers" ++ depends on THERMAL_OF ++ help ++ This is the option for MediaTek thermal software solutions. ++ Please enable corresponding options to get temperature ++ information from thermal sensors or turn on throttle ++ mechaisms for thermal mitigation. ++ ++if MTK_THERMAL ++ ++config MTK_SOC_THERMAL ++ tristate "AUXADC temperature sensor driver for MediaTek SoCs" ++ depends on HAS_IOMEM ++ help ++ Enable this option if you want to get SoC temperature ++ information for MediaTek platforms. ++ This driver configures thermal controllers to collect ++ temperature via AUXADC interface. ++ ++endif +diff --git a/drivers/thermal/mediatek/Makefile b/drivers/thermal/mediatek/Makefile +new file mode 100644 +index 0000000000000..53e86e30b26ff +--- /dev/null ++++ b/drivers/thermal/mediatek/Makefile +@@ -0,0 +1 @@ ++obj-$(CONFIG_MTK_SOC_THERMAL) += auxadc_thermal.o +diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mediatek/auxadc_thermal.c +similarity index 99% +rename from drivers/thermal/mtk_thermal.c +rename to drivers/thermal/mediatek/auxadc_thermal.c +index ede94eaddddae..60924f8f98e9e 100644 +--- a/drivers/thermal/mtk_thermal.c ++++ b/drivers/thermal/mediatek/auxadc_thermal.c +@@ -23,7 +23,7 @@ + #include + #include + +-#include "thermal_hwmon.h" ++#include "../thermal_hwmon.h" + + /* AUXADC Registers */ + #define AUXADC_CON1_SET_V 0x008 +-- +2.39.2 + diff --git a/queue-5.15/thermal-drivers-sun8i-fix-some-error-handling-paths-.patch b/queue-5.15/thermal-drivers-sun8i-fix-some-error-handling-paths-.patch new file mode 100644 index 00000000000..3bd3519a372 --- /dev/null +++ b/queue-5.15/thermal-drivers-sun8i-fix-some-error-handling-paths-.patch @@ -0,0 +1,144 @@ +From 70f66ca62d682d8e4477db09a0d92d53ed7f800e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 May 2023 20:46:05 +0200 +Subject: thermal/drivers/sun8i: Fix some error handling paths in + sun8i_ths_probe() + +From: Christophe JAILLET + +[ Upstream commit 89382022b370dfd34eaae9c863baa123fcd4d132 ] + +Should an error occur after calling sun8i_ths_resource_init() in the probe +function, some resources need to be released, as already done in the +.remove() function. + +Switch to the devm_clk_get_enabled() helper and add a new devm_action to +turn sun8i_ths_resource_init() into a fully managed function. + +Move the place where reset_control_deassert() is called so that the +recommended order of reset release/clock enable steps is kept. +A64 manual states that: + + 3.3.6.4. Gating and reset + + Make sure that the reset signal has been released before the release of + module clock gating; + +This fixes the issue and removes some LoC at the same time. + +Fixes: dccc5c3b6f30 ("thermal/drivers/sun8i: Add thermal driver for H6/H5/H3/A64/A83T/R40") +Signed-off-by: Christophe JAILLET +Acked-by: Maxime Ripard +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/a8ae84bd2dc4b55fe428f8e20f31438bf8bb6762.1684089931.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/thermal/sun8i_thermal.c | 55 +++++++++++---------------------- + 1 file changed, 18 insertions(+), 37 deletions(-) + +diff --git a/drivers/thermal/sun8i_thermal.c b/drivers/thermal/sun8i_thermal.c +index d9cd23cbb6717..cd464db064142 100644 +--- a/drivers/thermal/sun8i_thermal.c ++++ b/drivers/thermal/sun8i_thermal.c +@@ -319,6 +319,11 @@ static int sun8i_ths_calibrate(struct ths_device *tmdev) + return ret; + } + ++static void sun8i_ths_reset_control_assert(void *data) ++{ ++ reset_control_assert(data); ++} ++ + static int sun8i_ths_resource_init(struct ths_device *tmdev) + { + struct device *dev = tmdev->dev; +@@ -339,47 +344,35 @@ static int sun8i_ths_resource_init(struct ths_device *tmdev) + if (IS_ERR(tmdev->reset)) + return PTR_ERR(tmdev->reset); + +- tmdev->bus_clk = devm_clk_get(&pdev->dev, "bus"); ++ ret = reset_control_deassert(tmdev->reset); ++ if (ret) ++ return ret; ++ ++ ret = devm_add_action_or_reset(dev, sun8i_ths_reset_control_assert, ++ tmdev->reset); ++ if (ret) ++ return ret; ++ ++ tmdev->bus_clk = devm_clk_get_enabled(&pdev->dev, "bus"); + if (IS_ERR(tmdev->bus_clk)) + return PTR_ERR(tmdev->bus_clk); + } + + if (tmdev->chip->has_mod_clk) { +- tmdev->mod_clk = devm_clk_get(&pdev->dev, "mod"); ++ tmdev->mod_clk = devm_clk_get_enabled(&pdev->dev, "mod"); + if (IS_ERR(tmdev->mod_clk)) + return PTR_ERR(tmdev->mod_clk); + } + +- ret = reset_control_deassert(tmdev->reset); +- if (ret) +- return ret; +- +- ret = clk_prepare_enable(tmdev->bus_clk); +- if (ret) +- goto assert_reset; +- + ret = clk_set_rate(tmdev->mod_clk, 24000000); + if (ret) +- goto bus_disable; +- +- ret = clk_prepare_enable(tmdev->mod_clk); +- if (ret) +- goto bus_disable; ++ return ret; + + ret = sun8i_ths_calibrate(tmdev); + if (ret) +- goto mod_disable; ++ return ret; + + return 0; +- +-mod_disable: +- clk_disable_unprepare(tmdev->mod_clk); +-bus_disable: +- clk_disable_unprepare(tmdev->bus_clk); +-assert_reset: +- reset_control_assert(tmdev->reset); +- +- return ret; + } + + static int sun8i_h3_thermal_init(struct ths_device *tmdev) +@@ -530,17 +523,6 @@ static int sun8i_ths_probe(struct platform_device *pdev) + return 0; + } + +-static int sun8i_ths_remove(struct platform_device *pdev) +-{ +- struct ths_device *tmdev = platform_get_drvdata(pdev); +- +- clk_disable_unprepare(tmdev->mod_clk); +- clk_disable_unprepare(tmdev->bus_clk); +- reset_control_assert(tmdev->reset); +- +- return 0; +-} +- + static const struct ths_thermal_chip sun8i_a83t_ths = { + .sensor_num = 3, + .scale = 705, +@@ -642,7 +624,6 @@ MODULE_DEVICE_TABLE(of, of_ths_match); + + static struct platform_driver ths_driver = { + .probe = sun8i_ths_probe, +- .remove = sun8i_ths_remove, + .driver = { + .name = "sun8i-thermal", + .of_match_table = of_ths_match, +-- +2.39.2 + diff --git a/queue-5.15/tracing-timer-add-missing-hrtimer-modes-to-decode_hr.patch b/queue-5.15/tracing-timer-add-missing-hrtimer-modes-to-decode_hr.patch new file mode 100644 index 00000000000..4618ba13620 --- /dev/null +++ b/queue-5.15/tracing-timer-add-missing-hrtimer-modes-to-decode_hr.patch @@ -0,0 +1,47 @@ +From df57c5cde681df10f5a8a3826af1f2db5e29d908 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 16:38:54 +0200 +Subject: tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode(). + +From: Sebastian Andrzej Siewior + +[ Upstream commit 2951580ba6adb082bb6b7154a5ecb24e7c1f7569 ] + +The trace output for the HRTIMER_MODE_.*_HARD modes is seen as a number +since these modes are not decoded. The author was not aware of the fancy +decoding function which makes the life easier. + +Extend decode_hrtimer_mode() with the additional HRTIMER_MODE_.*_HARD +modes. + +Fixes: ae6683d815895 ("hrtimer: Introduce HARD expiry mode") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Reviewed-by: Mukesh Ojha +Acked-by: Steven Rostedt (Google) +Link: https://lore.kernel.org/r/20230418143854.8vHWQKLM@linutronix.de +Signed-off-by: Sasha Levin +--- + include/trace/events/timer.h | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h +index 1cf012de6442e..d49e44fcc10f2 100644 +--- a/include/trace/events/timer.h ++++ b/include/trace/events/timer.h +@@ -156,7 +156,11 @@ DEFINE_EVENT(timer_class, timer_cancel, + { HRTIMER_MODE_ABS_SOFT, "ABS|SOFT" }, \ + { HRTIMER_MODE_REL_SOFT, "REL|SOFT" }, \ + { HRTIMER_MODE_ABS_PINNED_SOFT, "ABS|PINNED|SOFT" }, \ +- { HRTIMER_MODE_REL_PINNED_SOFT, "REL|PINNED|SOFT" }) ++ { HRTIMER_MODE_REL_PINNED_SOFT, "REL|PINNED|SOFT" }, \ ++ { HRTIMER_MODE_ABS_HARD, "ABS|HARD" }, \ ++ { HRTIMER_MODE_REL_HARD, "REL|HARD" }, \ ++ { HRTIMER_MODE_ABS_PINNED_HARD, "ABS|PINNED|HARD" }, \ ++ { HRTIMER_MODE_REL_PINNED_HARD, "REL|PINNED|HARD" }) + + /** + * hrtimer_init - called when the hrtimer is initialized +-- +2.39.2 + diff --git a/queue-5.15/watchdog-perf-define-dummy-watchdog_update_hrtimer_t.patch b/queue-5.15/watchdog-perf-define-dummy-watchdog_update_hrtimer_t.patch new file mode 100644 index 00000000000..39634c7e3b5 --- /dev/null +++ b/queue-5.15/watchdog-perf-define-dummy-watchdog_update_hrtimer_t.patch @@ -0,0 +1,89 @@ +From 6c47d05e9930c3ee2c7a24fb200e3307e47ee030 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 10:18:25 -0700 +Subject: watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on + correct config + +From: Douglas Anderson + +[ Upstream commit 5e008df11c55228a86a1bae692cc2002503572c9 ] + +Patch series "watchdog/hardlockup: Add the buddy hardlockup detector", v5. + +This patch series adds the "buddy" hardlockup detector. In brief, the +buddy hardlockup detector can detect hardlockups without arch-level +support by having CPUs checkup on a "buddy" CPU periodically. + +Given the new design of this patch series, testing all combinations is +fairly difficult. I've attempted to make sure that all combinations of +CONFIG_ options are good, but it wouldn't surprise me if I missed +something. I apologize in advance and I'll do my best to fix any +problems that are found. + +This patch (of 18): + +The real watchdog_update_hrtimer_threshold() is defined in +kernel/watchdog_hld.c. That file is included if +CONFIG_HARDLOCKUP_DETECTOR_PERF and the function is defined in that file +if CONFIG_HARDLOCKUP_CHECK_TIMESTAMP. + +The dummy version of the function in "nmi.h" didn't get that quite right. +While this doesn't appear to be a huge deal, it's nice to make it +consistent. + +It doesn't break builds because CHECK_TIMESTAMP is only defined by x86 so +others don't get a double definition, and x86 uses perf lockup detector, +so it gets the out of line version. + +Link: https://lkml.kernel.org/r/20230519101840.v5.18.Ia44852044cdcb074f387e80df6b45e892965d4a1@changeid +Link: https://lkml.kernel.org/r/20230519101840.v5.1.I8cbb2f4fa740528fcfade4f5439b6cdcdd059251@changeid +Fixes: 7edaeb6841df ("kernel/watchdog: Prevent false positives with turbo modes") +Signed-off-by: Douglas Anderson +Reviewed-by: Nicholas Piggin +Reviewed-by: Petr Mladek +Cc: Andi Kleen +Cc: Catalin Marinas +Cc: Chen-Yu Tsai +Cc: Christophe Leroy +Cc: Daniel Thompson +Cc: "David S. Miller" +Cc: Guenter Roeck +Cc: Ian Rogers +Cc: Lecopzer Chen +Cc: Marc Zyngier +Cc: Mark Rutland +Cc: Masayoshi Mizuma +Cc: Matthias Kaehlcke +Cc: Michael Ellerman +Cc: Pingfan Liu +Cc: Randy Dunlap +Cc: "Ravi V. Shankar" +Cc: Ricardo Neri +Cc: Stephane Eranian +Cc: Stephen Boyd +Cc: Sumit Garg +Cc: Tzung-Bi Shih +Cc: Will Deacon +Cc: Colin Cross +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + include/linux/nmi.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/nmi.h b/include/linux/nmi.h +index f700ff2df074e..0db377ff8f608 100644 +--- a/include/linux/nmi.h ++++ b/include/linux/nmi.h +@@ -197,7 +197,7 @@ u64 hw_nmi_get_sample_period(int watchdog_thresh); + #endif + + #if defined(CONFIG_HARDLOCKUP_CHECK_TIMESTAMP) && \ +- defined(CONFIG_HARDLOCKUP_DETECTOR) ++ defined(CONFIG_HARDLOCKUP_DETECTOR_PERF) + void watchdog_update_hrtimer_threshold(u64 period); + #else + static inline void watchdog_update_hrtimer_threshold(u64 period) { } +-- +2.39.2 + diff --git a/queue-5.15/watchdog-perf-more-properly-prevent-false-positives-.patch b/queue-5.15/watchdog-perf-more-properly-prevent-false-positives-.patch new file mode 100644 index 00000000000..1ac54db6050 --- /dev/null +++ b/queue-5.15/watchdog-perf-more-properly-prevent-false-positives-.patch @@ -0,0 +1,84 @@ +From c1a698c2fe3f13b4a51f5835606cc6ce1d45865f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 10:18:26 -0700 +Subject: watchdog/perf: more properly prevent false positives with turbo modes + +From: Douglas Anderson + +[ Upstream commit 4379e59fe5665cfda737e45b8bf2f05321ef049c ] + +Currently, in the watchdog_overflow_callback() we first check to see if +the watchdog had been touched and _then_ we handle the workaround for +turbo mode. This order should be reversed. + +Specifically, "touching" the hardlockup detector's watchdog should avoid +lockups being detected for one period that should be roughly the same +regardless of whether we're running turbo or not. That means that we +should do the extra accounting for turbo _before_ we look at (and clear) +the global indicating that we've been touched. + +NOTE: this fix is made based on code inspection. I am not aware of any +reports where the old code would have generated false positives. That +being said, this order seems more correct and also makes it easier down +the line to share code with the "buddy" hardlockup detector. + +Link: https://lkml.kernel.org/r/20230519101840.v5.2.I843b0d1de3e096ba111a179f3adb16d576bef5c7@changeid +Fixes: 7edaeb6841df ("kernel/watchdog: Prevent false positives with turbo modes") +Signed-off-by: Douglas Anderson +Cc: Andi Kleen +Cc: Catalin Marinas +Cc: Chen-Yu Tsai +Cc: Christophe Leroy +Cc: Colin Cross +Cc: Daniel Thompson +Cc: "David S. Miller" +Cc: Guenter Roeck +Cc: Ian Rogers +Cc: Lecopzer Chen +Cc: Marc Zyngier +Cc: Mark Rutland +Cc: Masayoshi Mizuma +Cc: Matthias Kaehlcke +Cc: Michael Ellerman +Cc: Nicholas Piggin +Cc: Petr Mladek +Cc: Pingfan Liu +Cc: Randy Dunlap +Cc: "Ravi V. Shankar" +Cc: Ricardo Neri +Cc: Stephane Eranian +Cc: Stephen Boyd +Cc: Sumit Garg +Cc: Tzung-Bi Shih +Cc: Will Deacon +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + kernel/watchdog_hld.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c +index 247bf0b1582ca..1e8a49dc956e2 100644 +--- a/kernel/watchdog_hld.c ++++ b/kernel/watchdog_hld.c +@@ -114,14 +114,14 @@ static void watchdog_overflow_callback(struct perf_event *event, + /* Ensure the watchdog never gets throttled */ + event->hw.interrupts = 0; + ++ if (!watchdog_check_timestamp()) ++ return; ++ + if (__this_cpu_read(watchdog_nmi_touch) == true) { + __this_cpu_write(watchdog_nmi_touch, false); + return; + } + +- if (!watchdog_check_timestamp()) +- return; +- + /* check for a hardlockup + * This is done by making sure our timer interrupt + * is incrementing. The timer interrupt should have +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath9k-avoid-referencing-uninit-memory-in-ath9k_.patch b/queue-5.15/wifi-ath9k-avoid-referencing-uninit-memory-in-ath9k_.patch new file mode 100644 index 00000000000..b68fa9bf1cb --- /dev/null +++ b/queue-5.15/wifi-ath9k-avoid-referencing-uninit-memory-in-ath9k_.patch @@ -0,0 +1,58 @@ +From c6e754eeba9525dbe2e3b3ae23531eb1745b91d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 17:35:01 +0300 +Subject: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit f24292e827088bba8de7158501ac25a59b064953 ] + +For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid +uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should +validate pkt_len before accessing the SKB. + +For example, the obtained SKB may have been badly constructed with +pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr +but after being processed in ath9k_htc_rx_msg() and passed to +ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI +command header which should be located inside its data payload. + +Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit +memory can be referenced. + +Tested on Qualcomm Atheros Communications AR9271 802.11n . + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Reported-and-tested-by: syzbot+f2cb6e0ffdb961921e4d@syzkaller.appspotmail.com +Signed-off-by: Fedor Pchelkin +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230424183348.111355-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c +index 19345b8f7bfd5..d652c647d56b5 100644 +--- a/drivers/net/wireless/ath/ath9k/wmi.c ++++ b/drivers/net/wireless/ath/ath9k/wmi.c +@@ -221,6 +221,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb, + if (unlikely(wmi->stopped)) + goto free_skb; + ++ /* Validate the obtained SKB. */ ++ if (unlikely(skb->len < sizeof(struct wmi_cmd_hdr))) ++ goto free_skb; ++ + hdr = (struct wmi_cmd_hdr *) skb->data; + cmd_id = be16_to_cpu(hdr->command_id); + +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath9k-convert-msecs-to-jiffies-where-needed.patch b/queue-5.15/wifi-ath9k-convert-msecs-to-jiffies-where-needed.patch new file mode 100644 index 00000000000..6576fc8a9d3 --- /dev/null +++ b/queue-5.15/wifi-ath9k-convert-msecs-to-jiffies-where-needed.patch @@ -0,0 +1,51 @@ +From 23bd1e86461df5a9db40e07bb1c836e0256c8b44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 16:46:55 +0300 +Subject: wifi: ath9k: convert msecs to jiffies where needed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Antipov + +[ Upstream commit 2aa083acea9f61be3280184384551178f510ff51 ] + +Since 'ieee80211_queue_delayed_work()' expects timeout in +jiffies and not milliseconds, 'msecs_to_jiffies()' should +be used in 'ath_restart_work()' and '__ath9k_flush()'. + +Fixes: d63ffc45c5d3 ("ath9k: rename tx_complete_work to hw_check_work") +Signed-off-by: Dmitry Antipov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230613134655.248728-1-dmantipov@yandex.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index 98868f60a8c2f..9e6d088bd2818 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -203,7 +203,7 @@ void ath_cancel_work(struct ath_softc *sc) + void ath_restart_work(struct ath_softc *sc) + { + ieee80211_queue_delayed_work(sc->hw, &sc->hw_check_work, +- ATH_HW_CHECK_POLL_INT); ++ msecs_to_jiffies(ATH_HW_CHECK_POLL_INT)); + + if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9330(sc->sc_ah)) + ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work, +@@ -2239,7 +2239,7 @@ void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop, + } + + ieee80211_queue_delayed_work(hw, &sc->hw_check_work, +- ATH_HW_CHECK_POLL_INT); ++ msecs_to_jiffies(ATH_HW_CHECK_POLL_INT)); + } + + static bool ath9k_tx_frames_pending(struct ieee80211_hw *hw) +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath9k-don-t-allow-to-overwrite-endpoint0-attrib.patch b/queue-5.15/wifi-ath9k-don-t-allow-to-overwrite-endpoint0-attrib.patch new file mode 100644 index 00000000000..a265a7101d1 --- /dev/null +++ b/queue-5.15/wifi-ath9k-don-t-allow-to-overwrite-endpoint0-attrib.patch @@ -0,0 +1,54 @@ +From 2e13d26df49736a22eebff947ea2ae0922918d8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 18:03:17 +0300 +Subject: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit 061b0cb9327b80d7a0f63a33e7c3e2a91a71f142 ] + +A bad USB device is able to construct a service connection response +message with target endpoint being ENDPOINT0 which is reserved for +HTC_CTRL_RSVD_SVC and should not be modified to be used for any other +services. + +Reject such service connection responses. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Reported-by: syzbot+b68fbebe56d8362907e8@syzkaller.appspotmail.com +Signed-off-by: Fedor Pchelkin +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230516150427.79469-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_hst.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index fe62ff668f757..99667aba289df 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -114,7 +114,13 @@ static void htc_process_conn_rsp(struct htc_target *target, + + if (svc_rspmsg->status == HTC_SERVICE_SUCCESS) { + epid = svc_rspmsg->endpoint_id; +- if (epid < 0 || epid >= ENDPOINT_MAX) ++ ++ /* Check that the received epid for the endpoint to attach ++ * a new service is valid. ENDPOINT0 can't be used here as it ++ * is already reserved for HTC_CTRL_RSVD_SVC service and thus ++ * should not be modified. ++ */ ++ if (epid <= ENDPOINT0 || epid >= ENDPOINT_MAX) + return; + + service_id = be16_to_cpu(svc_rspmsg->service_id); +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath9k-fix-ar9003-mac-hardware-hang-check-regist.patch b/queue-5.15/wifi-ath9k-fix-ar9003-mac-hardware-hang-check-regist.patch new file mode 100644 index 00000000000..303b065d219 --- /dev/null +++ b/queue-5.15/wifi-ath9k-fix-ar9003-mac-hardware-hang-check-regist.patch @@ -0,0 +1,95 @@ +From c2c3baeb07de56bcbff01d0a88115dbc9a99a840 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 17:35:00 +0300 +Subject: wifi: ath9k: fix AR9003 mac hardware hang check register offset + calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Peter Seiderer + +[ Upstream commit 3e56c80931c7615250fe4bf83f93b57881969266 ] + +Fix ath9k_hw_verify_hang()/ar9003_hw_detect_mac_hang() register offset +calculation (do not overflow the shift for the second register/queues +above five, use the register layout described in the comments above +ath9k_hw_verify_hang() instead). + +Fixes: 222e04830ff0 ("ath9k: Fix MAC HW hang check for AR9003") + +Reported-by: Gregg Wonderly +Link: https://lore.kernel.org/linux-wireless/E3A9C354-0CB7-420C-ADEF-F0177FB722F4@seqtechllc.com/ +Signed-off-by: Peter Seiderer +Acked-by: Toke Høiland-Jørgensen +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230422212423.26065-1-ps.report@gmx.net +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/ar9003_hw.c | 27 ++++++++++++++-------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c +index 42f00a2a8c800..cf5648188459c 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c +@@ -1099,17 +1099,22 @@ static bool ath9k_hw_verify_hang(struct ath_hw *ah, unsigned int queue) + { + u32 dma_dbg_chain, dma_dbg_complete; + u8 dcu_chain_state, dcu_complete_state; ++ unsigned int dbg_reg, reg_offset; + int i; + +- for (i = 0; i < NUM_STATUS_READS; i++) { +- if (queue < 6) +- dma_dbg_chain = REG_READ(ah, AR_DMADBG_4); +- else +- dma_dbg_chain = REG_READ(ah, AR_DMADBG_5); ++ if (queue < 6) { ++ dbg_reg = AR_DMADBG_4; ++ reg_offset = queue * 5; ++ } else { ++ dbg_reg = AR_DMADBG_5; ++ reg_offset = (queue - 6) * 5; ++ } + ++ for (i = 0; i < NUM_STATUS_READS; i++) { ++ dma_dbg_chain = REG_READ(ah, dbg_reg); + dma_dbg_complete = REG_READ(ah, AR_DMADBG_6); + +- dcu_chain_state = (dma_dbg_chain >> (5 * queue)) & 0x1f; ++ dcu_chain_state = (dma_dbg_chain >> reg_offset) & 0x1f; + dcu_complete_state = dma_dbg_complete & 0x3; + + if ((dcu_chain_state != 0x6) || (dcu_complete_state != 0x1)) +@@ -1128,6 +1133,7 @@ static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah) + u8 dcu_chain_state, dcu_complete_state; + bool dcu_wait_frdone = false; + unsigned long chk_dcu = 0; ++ unsigned int reg_offset; + unsigned int i = 0; + + dma_dbg_4 = REG_READ(ah, AR_DMADBG_4); +@@ -1139,12 +1145,15 @@ static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah) + goto exit; + + for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) { +- if (i < 6) ++ if (i < 6) { + chk_dbg = dma_dbg_4; +- else ++ reg_offset = i * 5; ++ } else { + chk_dbg = dma_dbg_5; ++ reg_offset = (i - 6) * 5; ++ } + +- dcu_chain_state = (chk_dbg >> (5 * i)) & 0x1f; ++ dcu_chain_state = (chk_dbg >> reg_offset) & 0x1f; + if (dcu_chain_state == 0x6) { + dcu_wait_frdone = true; + chk_dcu |= BIT(i); +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath9k-fix-possible-stall-on-ath9k_txq_list_has_.patch b/queue-5.15/wifi-ath9k-fix-possible-stall-on-ath9k_txq_list_has_.patch new file mode 100644 index 00000000000..59f489801cd --- /dev/null +++ b/queue-5.15/wifi-ath9k-fix-possible-stall-on-ath9k_txq_list_has_.patch @@ -0,0 +1,111 @@ +From 463e2b724fdffe63ca2e53f26679a76ab27c4e49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 11:37:44 +0200 +Subject: wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Remi Pommarel + +[ Upstream commit 75086cc6dee046e3fbb3dba148b376d8802f83bc ] + +On EDMA capable hardware, ath9k_txq_list_has_key() can enter infinite +loop if it is called while all txq_fifos have packets that use different +key that the one we are looking for. Fix it by exiting the loop if all +txq_fifos have been checked already. + +Because this loop is called under spin_lock_bh() (see ath_txq_lock) it +causes the following rcu stall: + +rcu: INFO: rcu_sched self-detected stall on CPU +ath10k_pci 0000:01:00.0: failed to read temperature -11 +rcu: 1-....: (5254 ticks this GP) idle=189/1/0x4000000000000002 softirq=8442983/8442984 fqs=2579 + (t=5257 jiffies g=17983297 q=334) +Task dump for CPU 1: +task:hostapd state:R running task stack: 0 pid: 297 ppid: 289 flags:0x0000000a +Call trace: + dump_backtrace+0x0/0x170 + show_stack+0x1c/0x24 + sched_show_task+0x140/0x170 + dump_cpu_task+0x48/0x54 + rcu_dump_cpu_stacks+0xf0/0x134 + rcu_sched_clock_irq+0x8d8/0x9fc + update_process_times+0xa0/0xec + tick_sched_timer+0x5c/0xd0 + __hrtimer_run_queues+0x154/0x320 + hrtimer_interrupt+0x120/0x2f0 + arch_timer_handler_virt+0x38/0x44 + handle_percpu_devid_irq+0x9c/0x1e0 + handle_domain_irq+0x64/0x90 + gic_handle_irq+0x78/0xb0 + call_on_irq_stack+0x28/0x38 + do_interrupt_handler+0x54/0x5c + el1_interrupt+0x2c/0x4c + el1h_64_irq_handler+0x14/0x1c + el1h_64_irq+0x74/0x78 + ath9k_txq_has_key+0x1bc/0x250 [ath9k] + ath9k_set_key+0x1cc/0x3dc [ath9k] + drv_set_key+0x78/0x170 + ieee80211_key_replace+0x564/0x6cc + ieee80211_key_link+0x174/0x220 + ieee80211_add_key+0x11c/0x300 + nl80211_new_key+0x12c/0x330 + genl_family_rcv_msg_doit+0xbc/0x11c + genl_rcv_msg+0xd8/0x1c4 + netlink_rcv_skb+0x40/0x100 + genl_rcv+0x3c/0x50 + netlink_unicast+0x1ec/0x2c0 + netlink_sendmsg+0x198/0x3c0 + ____sys_sendmsg+0x210/0x250 + ___sys_sendmsg+0x78/0xc4 + __sys_sendmsg+0x4c/0x90 + __arm64_sys_sendmsg+0x28/0x30 + invoke_syscall.constprop.0+0x60/0x100 + do_el0_svc+0x48/0xd0 + el0_svc+0x14/0x50 + el0t_64_sync_handler+0xa8/0xb0 + el0t_64_sync+0x158/0x15c + +This rcu stall is hard to reproduce as is, but changing ATH_TXFIFO_DEPTH +from 8 to 2 makes it reasonably easy to reproduce. + +Fixes: ca2848022c12 ("ath9k: Postpone key cache entry deletion for TXQ frames reference it") +Signed-off-by: Remi Pommarel +Tested-by: Nicolas Escande +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230609093744.1985-1-repk@triplefau.lt +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/main.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index e2791d45f5f59..98868f60a8c2f 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -850,7 +850,7 @@ static bool ath9k_txq_list_has_key(struct list_head *txq_list, u32 keyix) + static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix) + { + struct ath_hw *ah = sc->sc_ah; +- int i; ++ int i, j; + struct ath_txq *txq; + bool key_in_use = false; + +@@ -868,8 +868,9 @@ static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix) + if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) { + int idx = txq->txq_tailidx; + +- while (!key_in_use && +- !list_empty(&txq->txq_fifo[idx])) { ++ for (j = 0; !key_in_use && ++ !list_empty(&txq->txq_fifo[idx]) && ++ j < ATH_TXFIFO_DEPTH; j++) { + key_in_use = ath9k_txq_list_has_key( + &txq->txq_fifo[idx], keyix); + INCR(idx, ATH_TXFIFO_DEPTH); +-- +2.39.2 + diff --git a/queue-5.15/wifi-atmel-fix-an-error-handling-path-in-atmel_probe.patch b/queue-5.15/wifi-atmel-fix-an-error-handling-path-in-atmel_probe.patch new file mode 100644 index 00000000000..b04bfe596dc --- /dev/null +++ b/queue-5.15/wifi-atmel-fix-an-error-handling-path-in-atmel_probe.patch @@ -0,0 +1,59 @@ +From 83325cf309d327806fe886cb5884c76a8808abd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 May 2023 09:53:14 +0200 +Subject: wifi: atmel: Fix an error handling path in atmel_probe() + +From: Christophe JAILLET + +[ Upstream commit 6b92e4351a29af52c285fe235e6e4d1a75de04b2 ] + +Should atmel_config() fail, some resources need to be released as already +done in the remove function. + +While at it, remove a useless and erroneous comment. The probe is +atmel_probe(), not atmel_attach(). + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Christophe JAILLET +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1e65f174607a83348034197fa7d603bab10ba4a9.1684569156.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/atmel/atmel_cs.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/atmel/atmel_cs.c b/drivers/net/wireless/atmel/atmel_cs.c +index 453bb84cb3386..58bba9875d366 100644 +--- a/drivers/net/wireless/atmel/atmel_cs.c ++++ b/drivers/net/wireless/atmel/atmel_cs.c +@@ -72,6 +72,7 @@ struct local_info { + static int atmel_probe(struct pcmcia_device *p_dev) + { + struct local_info *local; ++ int ret; + + dev_dbg(&p_dev->dev, "atmel_attach()\n"); + +@@ -82,8 +83,16 @@ static int atmel_probe(struct pcmcia_device *p_dev) + + p_dev->priv = local; + +- return atmel_config(p_dev); +-} /* atmel_attach */ ++ ret = atmel_config(p_dev); ++ if (ret) ++ goto err_free_priv; ++ ++ return 0; ++ ++err_free_priv: ++ kfree(p_dev->priv); ++ return ret; ++} + + static void atmel_detach(struct pcmcia_device *link) + { +-- +2.39.2 + diff --git a/queue-5.15/wifi-cfg80211-rewrite-merging-of-inherited-elements.patch b/queue-5.15/wifi-cfg80211-rewrite-merging-of-inherited-elements.patch new file mode 100644 index 00000000000..5003eb8bb96 --- /dev/null +++ b/queue-5.15/wifi-cfg80211-rewrite-merging-of-inherited-elements.patch @@ -0,0 +1,290 @@ +From ab51901d46ab3b77ef8bd1cca739f8991d6791e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 09:54:03 +0300 +Subject: wifi: cfg80211: rewrite merging of inherited elements + +From: Benjamin Berg + +[ Upstream commit dfd9aa3e7a456d57b18021d66472ab7ff8373ab7 ] + +The cfg80211_gen_new_ie function merges the IEs using inheritance rules. +Rewrite this function to fix issues around inheritance rules. In +particular, vendor elements do not require any special handling, as they +are either all inherited or overridden by the subprofile. +Also, add fragmentation handling as this may be needed in some cases. + +This also changes the function to not require making a copy. The new +version could be optimized a bit by explicitly tracking which IEs have +been handled already rather than looking that up again every time. + +Note that a small behavioural change is the removal of the SSID special +handling. This should be fine for the MBSSID element, as the SSID must +be included in the subelement. + +Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning") +Signed-off-by: Benjamin Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230616094949.bc6152e146db.I2b5f3bc45085e1901e5b5192a674436adaf94748@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/scan.c | 213 ++++++++++++++++++++++++++------------------ + 1 file changed, 124 insertions(+), 89 deletions(-) + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index ef31e401d7914..a565476809f02 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -262,117 +262,152 @@ bool cfg80211_is_element_inherited(const struct element *elem, + } + EXPORT_SYMBOL(cfg80211_is_element_inherited); + +-static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen, +- const u8 *subelement, size_t subie_len, +- u8 *new_ie, gfp_t gfp) ++static size_t cfg80211_copy_elem_with_frags(const struct element *elem, ++ const u8 *ie, size_t ie_len, ++ u8 **pos, u8 *buf, size_t buf_len) + { +- u8 *pos, *tmp; +- const u8 *tmp_old, *tmp_new; +- const struct element *non_inherit_elem; +- u8 *sub_copy; ++ if (WARN_ON((u8 *)elem < ie || elem->data > ie + ie_len || ++ elem->data + elem->datalen > ie + ie_len)) ++ return 0; + +- /* copy subelement as we need to change its content to +- * mark an ie after it is processed. +- */ +- sub_copy = kmemdup(subelement, subie_len, gfp); +- if (!sub_copy) ++ if (elem->datalen + 2 > buf + buf_len - *pos) + return 0; + +- pos = &new_ie[0]; ++ memcpy(*pos, elem, elem->datalen + 2); ++ *pos += elem->datalen + 2; + +- /* set new ssid */ +- tmp_new = cfg80211_find_ie(WLAN_EID_SSID, sub_copy, subie_len); +- if (tmp_new) { +- memcpy(pos, tmp_new, tmp_new[1] + 2); +- pos += (tmp_new[1] + 2); ++ /* Finish if it is not fragmented */ ++ if (elem->datalen != 255) ++ return *pos - buf; ++ ++ ie_len = ie + ie_len - elem->data - elem->datalen; ++ ie = (const u8 *)elem->data + elem->datalen; ++ ++ for_each_element(elem, ie, ie_len) { ++ if (elem->id != WLAN_EID_FRAGMENT) ++ break; ++ ++ if (elem->datalen + 2 > buf + buf_len - *pos) ++ return 0; ++ ++ memcpy(*pos, elem, elem->datalen + 2); ++ *pos += elem->datalen + 2; ++ ++ if (elem->datalen != 255) ++ break; + } + +- /* get non inheritance list if exists */ +- non_inherit_elem = +- cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, +- sub_copy, subie_len); ++ return *pos - buf; ++} + +- /* go through IEs in ie (skip SSID) and subelement, +- * merge them into new_ie ++static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen, ++ const u8 *subie, size_t subie_len, ++ u8 *new_ie, size_t new_ie_len) ++{ ++ const struct element *non_inherit_elem, *parent, *sub; ++ u8 *pos = new_ie; ++ u8 id, ext_id; ++ unsigned int match_len; ++ ++ non_inherit_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, ++ subie, subie_len); ++ ++ /* We copy the elements one by one from the parent to the generated ++ * elements. ++ * If they are not inherited (included in subie or in the non ++ * inheritance element), then we copy all occurrences the first time ++ * we see this element type. + */ +- tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen); +- tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie; +- +- while (tmp_old + 2 - ie <= ielen && +- tmp_old + tmp_old[1] + 2 - ie <= ielen) { +- if (tmp_old[0] == 0) { +- tmp_old++; ++ for_each_element(parent, ie, ielen) { ++ if (parent->id == WLAN_EID_FRAGMENT) + continue; ++ ++ if (parent->id == WLAN_EID_EXTENSION) { ++ if (parent->datalen < 1) ++ continue; ++ ++ id = WLAN_EID_EXTENSION; ++ ext_id = parent->data[0]; ++ match_len = 1; ++ } else { ++ id = parent->id; ++ match_len = 0; + } + +- if (tmp_old[0] == WLAN_EID_EXTENSION) +- tmp = (u8 *)cfg80211_find_ext_ie(tmp_old[2], sub_copy, +- subie_len); +- else +- tmp = (u8 *)cfg80211_find_ie(tmp_old[0], sub_copy, +- subie_len); ++ /* Find first occurrence in subie */ ++ sub = cfg80211_find_elem_match(id, subie, subie_len, ++ &ext_id, match_len, 0); + +- if (!tmp) { +- const struct element *old_elem = (void *)tmp_old; ++ /* Copy from parent if not in subie and inherited */ ++ if (!sub && ++ cfg80211_is_element_inherited(parent, non_inherit_elem)) { ++ if (!cfg80211_copy_elem_with_frags(parent, ++ ie, ielen, ++ &pos, new_ie, ++ new_ie_len)) ++ return 0; + +- /* ie in old ie but not in subelement */ +- if (cfg80211_is_element_inherited(old_elem, +- non_inherit_elem)) { +- memcpy(pos, tmp_old, tmp_old[1] + 2); +- pos += tmp_old[1] + 2; +- } +- } else { +- /* ie in transmitting ie also in subelement, +- * copy from subelement and flag the ie in subelement +- * as copied (by setting eid field to WLAN_EID_SSID, +- * which is skipped anyway). +- * For vendor ie, compare OUI + type + subType to +- * determine if they are the same ie. +- */ +- if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) { +- if (tmp_old[1] >= 5 && tmp[1] >= 5 && +- !memcmp(tmp_old + 2, tmp + 2, 5)) { +- /* same vendor ie, copy from +- * subelement +- */ +- memcpy(pos, tmp, tmp[1] + 2); +- pos += tmp[1] + 2; +- tmp[0] = WLAN_EID_SSID; +- } else { +- memcpy(pos, tmp_old, tmp_old[1] + 2); +- pos += tmp_old[1] + 2; +- } +- } else { +- /* copy ie from subelement into new ie */ +- memcpy(pos, tmp, tmp[1] + 2); +- pos += tmp[1] + 2; +- tmp[0] = WLAN_EID_SSID; +- } ++ continue; + } + +- if (tmp_old + tmp_old[1] + 2 - ie == ielen) +- break; ++ /* Already copied if an earlier element had the same type */ ++ if (cfg80211_find_elem_match(id, ie, (u8 *)parent - ie, ++ &ext_id, match_len, 0)) ++ continue; + +- tmp_old += tmp_old[1] + 2; ++ /* Not inheriting, copy all similar elements from subie */ ++ while (sub) { ++ if (!cfg80211_copy_elem_with_frags(sub, ++ subie, subie_len, ++ &pos, new_ie, ++ new_ie_len)) ++ return 0; ++ ++ sub = cfg80211_find_elem_match(id, ++ sub->data + sub->datalen, ++ subie_len + subie - ++ (sub->data + ++ sub->datalen), ++ &ext_id, match_len, 0); ++ } + } + +- /* go through subelement again to check if there is any ie not +- * copied to new ie, skip ssid, capability, bssid-index ie ++ /* The above misses elements that are included in subie but not in the ++ * parent, so do a pass over subie and append those. ++ * Skip the non-tx BSSID caps and non-inheritance element. + */ +- tmp_new = sub_copy; +- while (tmp_new + 2 - sub_copy <= subie_len && +- tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) { +- if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP || +- tmp_new[0] == WLAN_EID_SSID)) { +- memcpy(pos, tmp_new, tmp_new[1] + 2); +- pos += tmp_new[1] + 2; ++ for_each_element(sub, subie, subie_len) { ++ if (sub->id == WLAN_EID_NON_TX_BSSID_CAP) ++ continue; ++ ++ if (sub->id == WLAN_EID_FRAGMENT) ++ continue; ++ ++ if (sub->id == WLAN_EID_EXTENSION) { ++ if (sub->datalen < 1) ++ continue; ++ ++ id = WLAN_EID_EXTENSION; ++ ext_id = sub->data[0]; ++ match_len = 1; ++ ++ if (ext_id == WLAN_EID_EXT_NON_INHERITANCE) ++ continue; ++ } else { ++ id = sub->id; ++ match_len = 0; + } +- if (tmp_new + tmp_new[1] + 2 - sub_copy == subie_len) +- break; +- tmp_new += tmp_new[1] + 2; ++ ++ /* Processed if one was included in the parent */ ++ if (cfg80211_find_elem_match(id, ie, ielen, ++ &ext_id, match_len, 0)) ++ continue; ++ ++ if (!cfg80211_copy_elem_with_frags(sub, subie, subie_len, ++ &pos, new_ie, new_ie_len)) ++ return 0; + } + +- kfree(sub_copy); + return pos - new_ie; + } + +@@ -2180,7 +2215,7 @@ static void cfg80211_parse_mbssid_data(struct wiphy *wiphy, + new_ie_len = cfg80211_gen_new_ie(ie, ielen, + profile, + profile_len, new_ie, +- gfp); ++ IEEE80211_MAX_DATA_LEN); + if (!new_ie_len) + continue; + +-- +2.39.2 + diff --git a/queue-5.15/wifi-iwlwifi-mvm-indicate-hw-decrypt-for-beacon-prot.patch b/queue-5.15/wifi-iwlwifi-mvm-indicate-hw-decrypt-for-beacon-prot.patch new file mode 100644 index 00000000000..80a28feb19e --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-mvm-indicate-hw-decrypt-for-beacon-prot.patch @@ -0,0 +1,60 @@ +From ccae933fa9f0e2a2d8b35ac20c4478394e6657b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 13:04:01 +0300 +Subject: wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection + +From: Johannes Berg + +[ Upstream commit 2db72b8a700943aa54dce0aabe6ff1b72b615162 ] + +We've already done the 'decryption' here, so tell +mac80211 it need not do it again. + +Fixes: b1fdc2505abc ("iwlwifi: mvm: advertise BIGTK client support if available") +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230620125813.a50cf68fbf2e.Ieceacbe3789d81ea02ae085ad8d1f8813a33c31b@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +index 49c28c96fdf28..411254e9e603f 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +@@ -302,7 +302,8 @@ static void iwl_mvm_get_signal_strength(struct iwl_mvm *mvm, + static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta, + struct ieee80211_hdr *hdr, + struct iwl_rx_mpdu_desc *desc, +- u32 status) ++ u32 status, ++ struct ieee80211_rx_status *stats) + { + struct iwl_mvm_sta *mvmsta; + struct iwl_mvm_vif *mvmvif; +@@ -331,8 +332,10 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta, + + /* good cases */ + if (likely(status & IWL_RX_MPDU_STATUS_MIC_OK && +- !(status & IWL_RX_MPDU_STATUS_REPLAY_ERROR))) ++ !(status & IWL_RX_MPDU_STATUS_REPLAY_ERROR))) { ++ stats->flag |= RX_FLAG_DECRYPTED; + return 0; ++ } + + if (!sta) + return -1; +@@ -401,7 +404,7 @@ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + + if (unlikely(ieee80211_is_mgmt(hdr->frame_control) && + !ieee80211_has_protected(hdr->frame_control))) +- return iwl_mvm_rx_mgmt_prot(sta, hdr, desc, status); ++ return iwl_mvm_rx_mgmt_prot(sta, hdr, desc, status, stats); + + if (!ieee80211_has_protected(hdr->frame_control) || + (status & IWL_RX_MPDU_STATUS_SEC_MASK) == +-- +2.39.2 + diff --git a/queue-5.15/wifi-iwlwifi-pcie-fix-null-pointer-dereference-in-iw.patch b/queue-5.15/wifi-iwlwifi-pcie-fix-null-pointer-dereference-in-iw.patch new file mode 100644 index 00000000000..edb07dcf6d3 --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-pcie-fix-null-pointer-dereference-in-iw.patch @@ -0,0 +1,57 @@ +From 565391679963ee9c8f41d31c52a58e6da360a665 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 12:41:32 +0300 +Subject: wifi: iwlwifi: pcie: fix NULL pointer dereference in + iwl_pcie_irq_rx_msix_handler() + +From: Anjaneyulu + +[ Upstream commit 1902f1953b8ba100ee8705cb8a6f1a9795550eca ] + +rxq can be NULL only when trans_pcie->rxq is NULL and entry->entry +is zero. For the case when entry->entry is not equal to 0, rxq +won't be NULL even if trans_pcie->rxq is NULL. Modify checker to +check for trans_pcie->rxq. + +Fixes: abc599efa67b ("iwlwifi: pcie: don't crash when rx queues aren't allocated in interrupt") +Signed-off-by: Anjaneyulu +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230614123446.5a5eb3889a4a.I375a1d58f16b48cd2044e7b7caddae512d7c86fd@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +index 8885b19fd8de6..6c6512158813b 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -1601,14 +1601,14 @@ irqreturn_t iwl_pcie_irq_rx_msix_handler(int irq, void *dev_id) + struct msix_entry *entry = dev_id; + struct iwl_trans_pcie *trans_pcie = iwl_pcie_get_trans_pcie(entry); + struct iwl_trans *trans = trans_pcie->trans; +- struct iwl_rxq *rxq = &trans_pcie->rxq[entry->entry]; ++ struct iwl_rxq *rxq; + + trace_iwlwifi_dev_irq_msix(trans->dev, entry, false, 0, 0); + + if (WARN_ON(entry->entry >= trans->num_rx_queues)) + return IRQ_NONE; + +- if (!rxq) { ++ if (!trans_pcie->rxq) { + if (net_ratelimit()) + IWL_ERR(trans, + "[%d] Got MSI-X interrupt before we have Rx queues\n", +@@ -1616,6 +1616,7 @@ irqreturn_t iwl_pcie_irq_rx_msix_handler(int irq, void *dev_id) + return IRQ_NONE; + } + ++ rxq = &trans_pcie->rxq[entry->entry]; + lock_map_acquire(&trans->sync_cmd_lockdep_map); + IWL_DEBUG_ISR(trans, "[%d] Got interrupt\n", entry->entry); + +-- +2.39.2 + diff --git a/queue-5.15/wifi-iwlwifi-pull-from-txqs-with-softirqs-disabled.patch b/queue-5.15/wifi-iwlwifi-pull-from-txqs-with-softirqs-disabled.patch new file mode 100644 index 00000000000..09a3f22bbb9 --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-pull-from-txqs-with-softirqs-disabled.patch @@ -0,0 +1,47 @@ +From b70e3e70a32cc4a7b7c79dbdb5ba5f2abc72cb8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 12:41:22 +0300 +Subject: wifi: iwlwifi: pull from TXQs with softirqs disabled + +From: Johannes Berg + +[ Upstream commit 96fb6f47db24a712d650b0a9b9074873f273fb0e ] + +In mac80211, it's required that we pull from TXQs by calling +ieee80211_tx_dequeue() only with softirqs disabled. However, +in iwl_mvm_queue_state_change() we're often called with them +enabled, e.g. from flush if anything was flushed, triggering +a mac80211 warning. + +Fix that by disabling the softirqs across the TX call. + +Fixes: cfbc6c4c5b91 ("iwlwifi: mvm: support mac80211 TXQs model") +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230614123446.0feef7fa81db.I4dd62542d955b40dd8f0af34fa4accb9d0d17c7e@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +index 3ee4b3ecd0c82..01f65c9789e72 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +@@ -1309,8 +1309,11 @@ static void iwl_mvm_queue_state_change(struct iwl_op_mode *op_mode, + else + set_bit(IWL_MVM_TXQ_STATE_STOP_FULL, &mvmtxq->state); + +- if (start && mvmsta->sta_state != IEEE80211_STA_NOTEXIST) ++ if (start && mvmsta->sta_state != IEEE80211_STA_NOTEXIST) { ++ local_bh_disable(); + iwl_mvm_mac_itxq_xmit(mvm->hw, txq); ++ local_bh_enable(); ++ } + } + + out: +-- +2.39.2 + diff --git a/queue-5.15/wifi-move-from-strlcpy-with-unused-retval-to-strscpy.patch b/queue-5.15/wifi-move-from-strlcpy-with-unused-retval-to-strscpy.patch new file mode 100644 index 00000000000..f047f20130a --- /dev/null +++ b/queue-5.15/wifi-move-from-strlcpy-with-unused-retval-to-strscpy.patch @@ -0,0 +1,413 @@ +From b6a205272571445ac1ce647ffdd2feb1f1470724 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 22:14:53 +0200 +Subject: wifi: move from strlcpy with unused retval to strscpy + +From: Wolfram Sang + +[ Upstream commit bf99f11df4de45fcba6f6c441b411a16bccaccf6 ] + +Follow the advice of the below link and prefer 'strscpy' in this +subsystem. Conversion is 1:1 because the return value is not used. +Generated by a coccinelle script. + +Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ +Signed-off-by: Wolfram Sang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220830201457.7984-2-wsa+renesas@sang-engineering.com +Stable-dep-of: 391af06a02e7 ("wifi: wl3501_cs: Fix an error handling path in wl3501_probe()") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/init.c | 2 +- + drivers/net/wireless/ath/carl9170/fw.c | 2 +- + drivers/net/wireless/ath/wil6210/main.c | 2 +- + drivers/net/wireless/ath/wil6210/netdev.c | 2 +- + drivers/net/wireless/ath/wil6210/wmi.c | 2 +- + drivers/net/wireless/atmel/atmel.c | 2 +- + drivers/net/wireless/broadcom/b43/leds.c | 2 +- + drivers/net/wireless/broadcom/b43legacy/leds.c | 2 +- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 8 ++++---- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 8 ++++---- + .../net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 2 +- + .../net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | 2 +- + drivers/net/wireless/intel/ipw2x00/ipw2100.c | 6 +++--- + drivers/net/wireless/intel/ipw2x00/ipw2200.c | 6 +++--- + drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 +- + drivers/net/wireless/intersil/hostap/hostap_ioctl.c | 2 +- + drivers/net/wireless/marvell/libertas/ethtool.c | 4 ++-- + drivers/net/wireless/microchip/wilc1000/mon.c | 2 +- + drivers/net/wireless/quantenna/qtnfmac/cfg80211.c | 2 +- + drivers/net/wireless/quantenna/qtnfmac/commands.c | 2 +- + drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c | 2 +- + drivers/net/wireless/wl3501_cs.c | 8 ++++---- + 22 files changed, 36 insertions(+), 36 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/init.c b/drivers/net/wireless/ath/ath6kl/init.c +index 9b5c7d8f2b95e..201e455540706 100644 +--- a/drivers/net/wireless/ath/ath6kl/init.c ++++ b/drivers/net/wireless/ath/ath6kl/init.c +@@ -1014,7 +1014,7 @@ static int ath6kl_fetch_fw_apin(struct ath6kl *ar, const char *name) + + switch (ie_id) { + case ATH6KL_FW_IE_FW_VERSION: +- strlcpy(ar->wiphy->fw_version, data, ++ strscpy(ar->wiphy->fw_version, data, + min(sizeof(ar->wiphy->fw_version), ie_len+1)); + + ath6kl_dbg(ATH6KL_DBG_BOOT, +diff --git a/drivers/net/wireless/ath/carl9170/fw.c b/drivers/net/wireless/ath/carl9170/fw.c +index 1ab09e1c9ec57..4c1aecd1163ce 100644 +--- a/drivers/net/wireless/ath/carl9170/fw.c ++++ b/drivers/net/wireless/ath/carl9170/fw.c +@@ -105,7 +105,7 @@ static void carl9170_fw_info(struct ar9170 *ar) + CARL9170FW_GET_MONTH(fw_date), + CARL9170FW_GET_DAY(fw_date)); + +- strlcpy(ar->hw->wiphy->fw_version, motd_desc->release, ++ strscpy(ar->hw->wiphy->fw_version, motd_desc->release, + sizeof(ar->hw->wiphy->fw_version)); + } + } +diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c +index 3ba5b2550a8c1..bb532c6866beb 100644 +--- a/drivers/net/wireless/ath/wil6210/main.c ++++ b/drivers/net/wireless/ath/wil6210/main.c +@@ -1305,7 +1305,7 @@ void wil_get_board_file(struct wil6210_priv *wil, char *buf, size_t len) + board_file = WIL_BOARD_FILE_NAME; + } + +- strlcpy(buf, board_file, len); ++ strscpy(buf, board_file, len); + } + + static int wil_get_bl_info(struct wil6210_priv *wil) +diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c +index 0913f0bf60e79..960e97cedcdf2 100644 +--- a/drivers/net/wireless/ath/wil6210/netdev.c ++++ b/drivers/net/wireless/ath/wil6210/netdev.c +@@ -445,7 +445,7 @@ int wil_if_add(struct wil6210_priv *wil) + + wil_dbg_misc(wil, "entered"); + +- strlcpy(wiphy->fw_version, wil->fw_version, sizeof(wiphy->fw_version)); ++ strscpy(wiphy->fw_version, wil->fw_version, sizeof(wiphy->fw_version)); + + rc = wiphy_register(wiphy); + if (rc < 0) { +diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c +index 2dc8406736f48..e3a94983faf1c 100644 +--- a/drivers/net/wireless/ath/wil6210/wmi.c ++++ b/drivers/net/wireless/ath/wil6210/wmi.c +@@ -780,7 +780,7 @@ static void wmi_evt_ready(struct wil6210_vif *vif, int id, void *d, int len) + return; /* FW load will fail after timeout */ + } + /* ignore MAC address, we already have it from the boot loader */ +- strlcpy(wiphy->fw_version, wil->fw_version, sizeof(wiphy->fw_version)); ++ strscpy(wiphy->fw_version, wil->fw_version, sizeof(wiphy->fw_version)); + + if (len > offsetof(struct wmi_ready_event, rfc_read_calib_result)) { + wil_dbg_wmi(wil, "rfc calibration result %d\n", +diff --git a/drivers/net/wireless/atmel/atmel.c b/drivers/net/wireless/atmel/atmel.c +index febce4e8b3dd3..2a40fda28a89b 100644 +--- a/drivers/net/wireless/atmel/atmel.c ++++ b/drivers/net/wireless/atmel/atmel.c +@@ -1518,7 +1518,7 @@ struct net_device *init_atmel_card(unsigned short irq, unsigned long port, + priv->firmware = NULL; + priv->firmware_type = fw_type; + if (firmware) /* module parameter */ +- strlcpy(priv->firmware_id, firmware, sizeof(priv->firmware_id)); ++ strscpy(priv->firmware_id, firmware, sizeof(priv->firmware_id)); + priv->bus_type = card_present ? BUS_TYPE_PCCARD : BUS_TYPE_PCI; + priv->station_state = STATION_STATE_DOWN; + priv->do_rx_crc = 0; +diff --git a/drivers/net/wireless/broadcom/b43/leds.c b/drivers/net/wireless/broadcom/b43/leds.c +index 982a772a9d879..bfe1be345844d 100644 +--- a/drivers/net/wireless/broadcom/b43/leds.c ++++ b/drivers/net/wireless/broadcom/b43/leds.c +@@ -118,7 +118,7 @@ static int b43_register_led(struct b43_wldev *dev, struct b43_led *led, + led->wl = dev->wl; + led->index = led_index; + led->activelow = activelow; +- strlcpy(led->name, name, sizeof(led->name)); ++ strscpy(led->name, name, sizeof(led->name)); + atomic_set(&led->state, 0); + + led->led_dev.name = led->name; +diff --git a/drivers/net/wireless/broadcom/b43legacy/leds.c b/drivers/net/wireless/broadcom/b43legacy/leds.c +index 38b5be3a84e2c..79e6fd205bfb7 100644 +--- a/drivers/net/wireless/broadcom/b43legacy/leds.c ++++ b/drivers/net/wireless/broadcom/b43legacy/leds.c +@@ -88,7 +88,7 @@ static int b43legacy_register_led(struct b43legacy_wldev *dev, + led->dev = dev; + led->index = led_index; + led->activelow = activelow; +- strlcpy(led->name, name, sizeof(led->name)); ++ strscpy(led->name, name, sizeof(led->name)); + + led->led_dev.name = led->name; + led->led_dev.default_trigger = default_trigger; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +index f29de630908d7..a964f9f0c4435 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +@@ -219,7 +219,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp) + &revinfo, sizeof(revinfo)); + if (err < 0) { + bphy_err(drvr, "retrieving revision info failed, %d\n", err); +- strlcpy(ri->chipname, "UNKNOWN", sizeof(ri->chipname)); ++ strscpy(ri->chipname, "UNKNOWN", sizeof(ri->chipname)); + } else { + ri->vendorid = le32_to_cpu(revinfo.vendorid); + ri->deviceid = le32_to_cpu(revinfo.deviceid); +@@ -273,7 +273,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp) + + /* locate firmware version number for ethtool */ + ptr = strrchr(buf, ' ') + 1; +- strlcpy(ifp->drvr->fwver, ptr, sizeof(ifp->drvr->fwver)); ++ strscpy(ifp->drvr->fwver, ptr, sizeof(ifp->drvr->fwver)); + + /* Query for 'clmver' to get CLM version info from firmware */ + memset(buf, 0, sizeof(buf)); +@@ -385,11 +385,11 @@ static void brcmf_mp_attach(void) + * if not set then if available use the platform data version. To make + * sure it gets initialized at all, always copy the module param version + */ +- strlcpy(brcmf_mp_global.firmware_path, brcmf_firmware_path, ++ strscpy(brcmf_mp_global.firmware_path, brcmf_firmware_path, + BRCMF_FW_ALTPATH_LEN); + if ((brcmfmac_pdata) && (brcmfmac_pdata->fw_alternative_path) && + (brcmf_mp_global.firmware_path[0] == '\0')) { +- strlcpy(brcmf_mp_global.firmware_path, ++ strscpy(brcmf_mp_global.firmware_path, + brcmfmac_pdata->fw_alternative_path, + BRCMF_FW_ALTPATH_LEN); + } +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +index f03fc6f1f8333..bdf1e494414bf 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -574,10 +574,10 @@ static void brcmf_ethtool_get_drvinfo(struct net_device *ndev, + + if (drvr->revinfo.result == 0) + brcmu_dotrev_str(drvr->revinfo.driverrev, drev); +- strlcpy(info->driver, KBUILD_MODNAME, sizeof(info->driver)); +- strlcpy(info->version, drev, sizeof(info->version)); +- strlcpy(info->fw_version, drvr->fwver, sizeof(info->fw_version)); +- strlcpy(info->bus_info, dev_name(drvr->bus_if->dev), ++ strscpy(info->driver, KBUILD_MODNAME, sizeof(info->driver)); ++ strscpy(info->version, drev, sizeof(info->version)); ++ strscpy(info->fw_version, drvr->fwver, sizeof(info->fw_version)); ++ strscpy(info->bus_info, dev_name(drvr->bus_if->dev), + sizeof(info->bus_info)); + } + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +index c54d8722e755c..7b2911f49cce3 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +@@ -783,7 +783,7 @@ brcmf_fw_alloc_request(u32 chip, u32 chiprev, + fwnames[j].path[0] = '\0'; + /* check if firmware path is provided by module parameter */ + if (brcmf_mp_global.firmware_path[0] != '\0') { +- strlcpy(fwnames[j].path, mp_path, ++ strscpy(fwnames[j].path, mp_path, + BRCMF_FW_NAME_LEN); + + if (end != '/') { +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c +index 19b0f318f93ed..50b4da0e9e15d 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c +@@ -688,7 +688,7 @@ static void brcmf_fws_macdesc_set_name(struct brcmf_fws_info *fws, + struct brcmf_fws_mac_descriptor *desc) + { + if (desc == &fws->desc.other) +- strlcpy(desc->name, "MAC-OTHER", sizeof(desc->name)); ++ strscpy(desc->name, "MAC-OTHER", sizeof(desc->name)); + else if (desc->mac_handle) + scnprintf(desc->name, sizeof(desc->name), "MAC-%d:%d", + desc->mac_handle, desc->interface_id); +diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2100.c b/drivers/net/wireless/intel/ipw2x00/ipw2100.c +index 47eb89b773cf7..4d5c1e142af11 100644 +--- a/drivers/net/wireless/intel/ipw2x00/ipw2100.c ++++ b/drivers/net/wireless/intel/ipw2x00/ipw2100.c +@@ -5907,8 +5907,8 @@ static void ipw_ethtool_get_drvinfo(struct net_device *dev, + struct ipw2100_priv *priv = libipw_priv(dev); + char fw_ver[64], ucode_ver[64]; + +- strlcpy(info->driver, DRV_NAME, sizeof(info->driver)); +- strlcpy(info->version, DRV_VERSION, sizeof(info->version)); ++ strscpy(info->driver, DRV_NAME, sizeof(info->driver)); ++ strscpy(info->version, DRV_VERSION, sizeof(info->version)); + + ipw2100_get_fwversion(priv, fw_ver, sizeof(fw_ver)); + ipw2100_get_ucodeversion(priv, ucode_ver, sizeof(ucode_ver)); +@@ -5916,7 +5916,7 @@ static void ipw_ethtool_get_drvinfo(struct net_device *dev, + snprintf(info->fw_version, sizeof(info->fw_version), "%s:%d:%s", + fw_ver, priv->eeprom_version, ucode_ver); + +- strlcpy(info->bus_info, pci_name(priv->pci_dev), ++ strscpy(info->bus_info, pci_name(priv->pci_dev), + sizeof(info->bus_info)); + } + +diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +index bb728fb24b8a4..706cd36a43055 100644 +--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c ++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +@@ -10427,8 +10427,8 @@ static void ipw_ethtool_get_drvinfo(struct net_device *dev, + char date[32]; + u32 len; + +- strlcpy(info->driver, DRV_NAME, sizeof(info->driver)); +- strlcpy(info->version, DRV_VERSION, sizeof(info->version)); ++ strscpy(info->driver, DRV_NAME, sizeof(info->driver)); ++ strscpy(info->version, DRV_VERSION, sizeof(info->version)); + + len = sizeof(vers); + ipw_get_ordinal(p, IPW_ORD_STAT_FW_VERSION, vers, &len); +@@ -10437,7 +10437,7 @@ static void ipw_ethtool_get_drvinfo(struct net_device *dev, + + snprintf(info->fw_version, sizeof(info->fw_version), "%s (%s)", + vers, date); +- strlcpy(info->bus_info, pci_name(p->pci_dev), ++ strscpy(info->bus_info, pci_name(p->pci_dev), + sizeof(info->bus_info)); + } + +diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +index 04c149ff745e9..00fa3c80a46f6 100644 +--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +@@ -3254,7 +3254,7 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr, + + if (count) { + char *p = buffer; +- strlcpy(buffer, buf, sizeof(buffer)); ++ strscpy(buffer, buf, sizeof(buffer)); + channel = simple_strtoul(p, NULL, 0); + if (channel) + params.channel = channel; +diff --git a/drivers/net/wireless/intersil/hostap/hostap_ioctl.c b/drivers/net/wireless/intersil/hostap/hostap_ioctl.c +index 0a376f112db9f..4e0a0c8816979 100644 +--- a/drivers/net/wireless/intersil/hostap/hostap_ioctl.c ++++ b/drivers/net/wireless/intersil/hostap/hostap_ioctl.c +@@ -3848,7 +3848,7 @@ static void prism2_get_drvinfo(struct net_device *dev, + iface = netdev_priv(dev); + local = iface->local; + +- strlcpy(info->driver, "hostap", sizeof(info->driver)); ++ strscpy(info->driver, "hostap", sizeof(info->driver)); + snprintf(info->fw_version, sizeof(info->fw_version), + "%d.%d.%d", (local->sta_fw_ver >> 16) & 0xff, + (local->sta_fw_ver >> 8) & 0xff, +diff --git a/drivers/net/wireless/marvell/libertas/ethtool.c b/drivers/net/wireless/marvell/libertas/ethtool.c +index d8e4f29b690d1..9f53308a99357 100644 +--- a/drivers/net/wireless/marvell/libertas/ethtool.c ++++ b/drivers/net/wireless/marvell/libertas/ethtool.c +@@ -20,8 +20,8 @@ static void lbs_ethtool_get_drvinfo(struct net_device *dev, + priv->fwrelease >> 16 & 0xff, + priv->fwrelease >> 8 & 0xff, + priv->fwrelease & 0xff); +- strlcpy(info->driver, "libertas", sizeof(info->driver)); +- strlcpy(info->version, lbs_driver_version, sizeof(info->version)); ++ strscpy(info->driver, "libertas", sizeof(info->driver)); ++ strscpy(info->version, lbs_driver_version, sizeof(info->version)); + } + + /* +diff --git a/drivers/net/wireless/microchip/wilc1000/mon.c b/drivers/net/wireless/microchip/wilc1000/mon.c +index b5a1b65c087ca..03b7229a0ff5a 100644 +--- a/drivers/net/wireless/microchip/wilc1000/mon.c ++++ b/drivers/net/wireless/microchip/wilc1000/mon.c +@@ -229,7 +229,7 @@ struct net_device *wilc_wfi_init_mon_interface(struct wilc *wl, + return NULL; + + wl->monitor_dev->type = ARPHRD_IEEE80211_RADIOTAP; +- strlcpy(wl->monitor_dev->name, name, IFNAMSIZ); ++ strscpy(wl->monitor_dev->name, name, IFNAMSIZ); + wl->monitor_dev->netdev_ops = &wilc_wfi_netdev_ops; + wl->monitor_dev->needs_free_netdev = true; + +diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c +index 84b15a655eab1..45ef582880d2c 100644 +--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c +@@ -1221,7 +1221,7 @@ int qtnf_wiphy_register(struct qtnf_hw_info *hw_info, struct qtnf_wmac *mac) + mac->macinfo.extended_capabilities_len; + } + +- strlcpy(wiphy->fw_version, hw_info->fw_version, ++ strscpy(wiphy->fw_version, hw_info->fw_version, + sizeof(wiphy->fw_version)); + wiphy->hw_version = hw_info->hw_version; + +diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c +index c68563c830981..e0ebe19ee2d8c 100644 +--- a/drivers/net/wireless/quantenna/qtnfmac/commands.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c +@@ -965,7 +965,7 @@ qtnf_cmd_resp_proc_hw_info(struct qtnf_bus *bus, + hwinfo->total_rx_chain, hwinfo->total_tx_chain, + hwinfo->fw_ver); + +- strlcpy(hwinfo->fw_version, bld_label, sizeof(hwinfo->fw_version)); ++ strscpy(hwinfo->fw_version, bld_label, sizeof(hwinfo->fw_version)); + hwinfo->hw_version = hw_ver; + + return 0; +diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c +index 49421d10e22bc..f7d95c9624a01 100644 +--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c ++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c +@@ -143,7 +143,7 @@ static int rtl8187_register_led(struct ieee80211_hw *dev, + led->dev = dev; + led->ledpin = ledpin; + led->is_radio = is_radio; +- strlcpy(led->name, name, sizeof(led->name)); ++ strscpy(led->name, name, sizeof(led->name)); + + led->led_dev.name = led->name; + led->led_dev.default_trigger = default_trigger; +diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c +index 7351a2c127adc..7fb2f95134760 100644 +--- a/drivers/net/wireless/wl3501_cs.c ++++ b/drivers/net/wireless/wl3501_cs.c +@@ -1441,7 +1441,7 @@ static void wl3501_detach(struct pcmcia_device *link) + static int wl3501_get_name(struct net_device *dev, struct iw_request_info *info, + union iwreq_data *wrqu, char *extra) + { +- strlcpy(wrqu->name, "IEEE 802.11-DS", sizeof(wrqu->name)); ++ strscpy(wrqu->name, "IEEE 802.11-DS", sizeof(wrqu->name)); + return 0; + } + +@@ -1652,7 +1652,7 @@ static int wl3501_set_nick(struct net_device *dev, struct iw_request_info *info, + + if (wrqu->data.length > sizeof(this->nick)) + return -E2BIG; +- strlcpy(this->nick, extra, wrqu->data.length); ++ strscpy(this->nick, extra, wrqu->data.length); + return 0; + } + +@@ -1661,7 +1661,7 @@ static int wl3501_get_nick(struct net_device *dev, struct iw_request_info *info, + { + struct wl3501_card *this = netdev_priv(dev); + +- strlcpy(extra, this->nick, 32); ++ strscpy(extra, this->nick, 32); + wrqu->data.length = strlen(extra); + return 0; + } +@@ -1965,7 +1965,7 @@ static int wl3501_config(struct pcmcia_device *link) + this->firmware_date[0] = '\0'; + this->rssi = 255; + this->chan = iw_default_channel(this->reg_domain); +- strlcpy(this->nick, "Planet WL3501", sizeof(this->nick)); ++ strscpy(this->nick, "Planet WL3501", sizeof(this->nick)); + spin_lock_init(&this->lock); + init_waitqueue_head(&this->wait); + netif_start_queue(dev); +-- +2.39.2 + diff --git a/queue-5.15/wifi-mwifiex-fix-the-size-of-a-memory-allocation-in-.patch b/queue-5.15/wifi-mwifiex-fix-the-size-of-a-memory-allocation-in-.patch new file mode 100644 index 00000000000..65f7e8ba72a --- /dev/null +++ b/queue-5.15/wifi-mwifiex-fix-the-size-of-a-memory-allocation-in-.patch @@ -0,0 +1,48 @@ +From 84c088e55db31535eb317db357e74fb67fcb353f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 May 2023 15:53:15 +0200 +Subject: wifi: mwifiex: Fix the size of a memory allocation in + mwifiex_ret_802_11_scan() + +From: Christophe JAILLET + +[ Upstream commit d9aef04fcfa81ee4fb2804a21a3712b7bbd936af ] + +The type of "mwifiex_adapter->nd_info" is "struct cfg80211_wowlan_nd_info", +not "struct cfg80211_wowlan_nd_match". + +Use struct_size() to ease the computation of the needed size. + +The current code over-allocates some memory, so is safe. +But it wastes 32 bytes. + +Fixes: 7d7f07d8c5d3 ("mwifiex: add wowlan net-detect support") +Signed-off-by: Christophe JAILLET +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/7a6074fb056d2181e058a3cc6048d8155c20aec7.1683371982.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/scan.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c +index 0b877f3f6b974..5ec8a42e7150a 100644 +--- a/drivers/net/wireless/marvell/mwifiex/scan.c ++++ b/drivers/net/wireless/marvell/mwifiex/scan.c +@@ -2199,9 +2199,9 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv, + + if (nd_config) { + adapter->nd_info = +- kzalloc(sizeof(struct cfg80211_wowlan_nd_match) + +- sizeof(struct cfg80211_wowlan_nd_match *) * +- scan_rsp->number_of_sets, GFP_ATOMIC); ++ kzalloc(struct_size(adapter->nd_info, matches, ++ scan_rsp->number_of_sets), ++ GFP_ATOMIC); + + if (adapter->nd_info) + adapter->nd_info->n_matches = scan_rsp->number_of_sets; +-- +2.39.2 + diff --git a/queue-5.15/wifi-orinoco-fix-an-error-handling-path-in-orinoco_c.patch b/queue-5.15/wifi-orinoco-fix-an-error-handling-path-in-orinoco_c.patch new file mode 100644 index 00000000000..00b42a9915d --- /dev/null +++ b/queue-5.15/wifi-orinoco-fix-an-error-handling-path-in-orinoco_c.patch @@ -0,0 +1,58 @@ +From 69a6d38bd2bf8c10c8dcbfd58e5b47cfe566448d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 May 2023 09:38:22 +0200 +Subject: wifi: orinoco: Fix an error handling path in orinoco_cs_probe() + +From: Christophe JAILLET + +[ Upstream commit 67a81d911c01225f426cc6bee2373df044c1a9b7 ] + +Should orinoco_cs_config() fail, some resources need to be released as +already done in the remove function. + +While at it, remove a useless and erroneous comment. The probe is +orinoco_cs_probe(), not orinoco_cs_attach(). + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Christophe JAILLET +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/e24735ce4d82901d5f7ea08419eea53bfdde3d65.1684568286.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intersil/orinoco/orinoco_cs.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_cs.c b/drivers/net/wireless/intersil/orinoco/orinoco_cs.c +index a956f965a1e5e..03bfd2482656c 100644 +--- a/drivers/net/wireless/intersil/orinoco/orinoco_cs.c ++++ b/drivers/net/wireless/intersil/orinoco/orinoco_cs.c +@@ -96,6 +96,7 @@ orinoco_cs_probe(struct pcmcia_device *link) + { + struct orinoco_private *priv; + struct orinoco_pccard *card; ++ int ret; + + priv = alloc_orinocodev(sizeof(*card), &link->dev, + orinoco_cs_hard_reset, NULL); +@@ -107,8 +108,16 @@ orinoco_cs_probe(struct pcmcia_device *link) + card->p_dev = link; + link->priv = priv; + +- return orinoco_cs_config(link); +-} /* orinoco_cs_attach */ ++ ret = orinoco_cs_config(link); ++ if (ret) ++ goto err_free_orinocodev; ++ ++ return 0; ++ ++err_free_orinocodev: ++ free_orinocodev(priv); ++ return ret; ++} + + static void orinoco_cs_detach(struct pcmcia_device *link) + { +-- +2.39.2 + diff --git a/queue-5.15/wifi-orinoco-fix-an-error-handling-path-in-spectrum_.patch b/queue-5.15/wifi-orinoco-fix-an-error-handling-path-in-spectrum_.patch new file mode 100644 index 00000000000..8f084037712 --- /dev/null +++ b/queue-5.15/wifi-orinoco-fix-an-error-handling-path-in-spectrum_.patch @@ -0,0 +1,59 @@ +From 3f2bffb486a3363f61cc73d8bd5f5c85a5ed7653 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 May 2023 09:29:46 +0200 +Subject: wifi: orinoco: Fix an error handling path in spectrum_cs_probe() + +From: Christophe JAILLET + +[ Upstream commit 925244325159824385209e3e0e3f91fa6bf0646c ] + +Should spectrum_cs_config() fail, some resources need to be released as +already done in the remove function. + +While at it, remove a useless and erroneous comment. The probe is +spectrum_cs_probe(), not spectrum_cs_attach(). + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Christophe JAILLET +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/c0bc0c21c58ca477fc5521607615bafbf2aef8eb.1684567733.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intersil/orinoco/spectrum_cs.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intersil/orinoco/spectrum_cs.c b/drivers/net/wireless/intersil/orinoco/spectrum_cs.c +index 291ef97ed45ec..841d623c621ac 100644 +--- a/drivers/net/wireless/intersil/orinoco/spectrum_cs.c ++++ b/drivers/net/wireless/intersil/orinoco/spectrum_cs.c +@@ -157,6 +157,7 @@ spectrum_cs_probe(struct pcmcia_device *link) + { + struct orinoco_private *priv; + struct orinoco_pccard *card; ++ int ret; + + priv = alloc_orinocodev(sizeof(*card), &link->dev, + spectrum_cs_hard_reset, +@@ -169,8 +170,16 @@ spectrum_cs_probe(struct pcmcia_device *link) + card->p_dev = link; + link->priv = priv; + +- return spectrum_cs_config(link); +-} /* spectrum_cs_attach */ ++ ret = spectrum_cs_config(link); ++ if (ret) ++ goto err_free_orinocodev; ++ ++ return 0; ++ ++err_free_orinocodev: ++ free_orinocodev(priv); ++ return ret; ++} + + static void spectrum_cs_detach(struct pcmcia_device *link) + { +-- +2.39.2 + diff --git a/queue-5.15/wifi-ray_cs-drop-useless-status-variable-in-parse_ad.patch b/queue-5.15/wifi-ray_cs-drop-useless-status-variable-in-parse_ad.patch new file mode 100644 index 00000000000..af1e8378005 --- /dev/null +++ b/queue-5.15/wifi-ray_cs-drop-useless-status-variable-in-parse_ad.patch @@ -0,0 +1,53 @@ +From e449761674f72581d2c8ec5b10d18ec9e8b698ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 19:44:14 +0300 +Subject: wifi: ray_cs: Drop useless status variable in parse_addr() + +From: Andy Shevchenko + +[ Upstream commit 4dfc63c002a555a2c3c34d89009532ad803be876 ] + +The status variable assigned only once and used also only once. +Replace it's usage by actual value. + +Signed-off-by: Andy Shevchenko +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220603164414.48436-2-andriy.shevchenko@linux.intel.com +Stable-dep-of: 4f8d66a9fb2e ("wifi: ray_cs: Fix an error handling path in ray_probe()") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ray_cs.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c +index 98741b06707b6..81e0945fa443d 100644 +--- a/drivers/net/wireless/ray_cs.c ++++ b/drivers/net/wireless/ray_cs.c +@@ -1645,7 +1645,6 @@ static int parse_addr(char *in_str, UCHAR *out) + { + int i, k; + int len; +- int status; + + if (in_str == NULL) + return 0; +@@ -1654,7 +1653,6 @@ static int parse_addr(char *in_str, UCHAR *out) + return 0; + memset(out, 0, ADDRLEN); + +- status = 1; + i = 5; + + while (len > 0) { +@@ -1672,7 +1670,7 @@ static int parse_addr(char *in_str, UCHAR *out) + if (!i--) + break; + } +- return status; ++ return 1; + } + + /*===========================================================================*/ +-- +2.39.2 + diff --git a/queue-5.15/wifi-ray_cs-fix-an-error-handling-path-in-ray_probe.patch b/queue-5.15/wifi-ray_cs-fix-an-error-handling-path-in-ray_probe.patch new file mode 100644 index 00000000000..11e75b6cadc --- /dev/null +++ b/queue-5.15/wifi-ray_cs-fix-an-error-handling-path-in-ray_probe.patch @@ -0,0 +1,69 @@ +From ebfd66cc4ad34aaca935fb028a6dc74ac6fe4f01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 May 2023 10:13:22 +0200 +Subject: wifi: ray_cs: Fix an error handling path in ray_probe() + +From: Christophe JAILLET + +[ Upstream commit 4f8d66a9fb2edcd05c1e563456a55a08910bfb37 ] + +Should ray_config() fail, some resources need to be released as already +done in the remove function. + +While at it, remove a useless and erroneous comment. The probe is +ray_probe(), not ray_attach(). + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Christophe JAILLET +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/8c544d18084f8b37dd108e844f7e79e85ff708ff.1684570373.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ray_cs.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c +index 81e0945fa443d..96330a6c066be 100644 +--- a/drivers/net/wireless/ray_cs.c ++++ b/drivers/net/wireless/ray_cs.c +@@ -270,13 +270,14 @@ static int ray_probe(struct pcmcia_device *p_dev) + { + ray_dev_t *local; + struct net_device *dev; ++ int ret; + + dev_dbg(&p_dev->dev, "ray_attach()\n"); + + /* Allocate space for private device-specific data */ + dev = alloc_etherdev(sizeof(ray_dev_t)); + if (!dev) +- goto fail_alloc_dev; ++ return -ENOMEM; + + local = netdev_priv(dev); + local->finder = p_dev; +@@ -313,11 +314,16 @@ static int ray_probe(struct pcmcia_device *p_dev) + timer_setup(&local->timer, NULL, 0); + + this_device = p_dev; +- return ray_config(p_dev); ++ ret = ray_config(p_dev); ++ if (ret) ++ goto err_free_dev; ++ ++ return 0; + +-fail_alloc_dev: +- return -ENOMEM; +-} /* ray_attach */ ++err_free_dev: ++ free_netdev(dev); ++ return ret; ++} + + static void ray_detach(struct pcmcia_device *link) + { +-- +2.39.2 + diff --git a/queue-5.15/wifi-ray_cs-utilize-strnlen-in-parse_addr.patch b/queue-5.15/wifi-ray_cs-utilize-strnlen-in-parse_addr.patch new file mode 100644 index 00000000000..77bdfec6b15 --- /dev/null +++ b/queue-5.15/wifi-ray_cs-utilize-strnlen-in-parse_addr.patch @@ -0,0 +1,67 @@ +From f46712b5bb4deb381b2dbd2db144d26ff08f738c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 19:44:13 +0300 +Subject: wifi: ray_cs: Utilize strnlen() in parse_addr() + +From: Andy Shevchenko + +[ Upstream commit 9e8e9187673cb24324f9165dd47b2b28f60b0b10 ] + +Instead of doing simple operations and using an additional variable on stack, +utilize strnlen() and reuse len variable. + +Signed-off-by: Andy Shevchenko +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220603164414.48436-1-andriy.shevchenko@linux.intel.com +Stable-dep-of: 4f8d66a9fb2e ("wifi: ray_cs: Fix an error handling path in ray_probe()") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ray_cs.c | 16 +++++++--------- + 1 file changed, 7 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c +index f8409e93fe33e..98741b06707b6 100644 +--- a/drivers/net/wireless/ray_cs.c ++++ b/drivers/net/wireless/ray_cs.c +@@ -1643,31 +1643,29 @@ static void authenticate_timeout(struct timer_list *t) + /*===========================================================================*/ + static int parse_addr(char *in_str, UCHAR *out) + { ++ int i, k; + int len; +- int i, j, k; + int status; + + if (in_str == NULL) + return 0; +- if ((len = strlen(in_str)) < 2) ++ len = strnlen(in_str, ADDRLEN * 2 + 1) - 1; ++ if (len < 1) + return 0; + memset(out, 0, ADDRLEN); + + status = 1; +- j = len - 1; +- if (j > 12) +- j = 12; + i = 5; + +- while (j > 0) { +- if ((k = hex_to_bin(in_str[j--])) != -1) ++ while (len > 0) { ++ if ((k = hex_to_bin(in_str[len--])) != -1) + out[i] = k; + else + return 0; + +- if (j == 0) ++ if (len == 0) + break; +- if ((k = hex_to_bin(in_str[j--])) != -1) ++ if ((k = hex_to_bin(in_str[len--])) != -1) + out[i] += k << 4; + else + return 0; +-- +2.39.2 + diff --git a/queue-5.15/wifi-rsi-do-not-configure-wowlan-in-shutdown-hook-if.patch b/queue-5.15/wifi-rsi-do-not-configure-wowlan-in-shutdown-hook-if.patch new file mode 100644 index 00000000000..bb60363bf87 --- /dev/null +++ b/queue-5.15/wifi-rsi-do-not-configure-wowlan-in-shutdown-hook-if.patch @@ -0,0 +1,52 @@ +From b8a9c897afa41ae6902f8b56621418a9dd5fc621 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 May 2023 00:28:33 +0200 +Subject: wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled + +From: Marek Vasut + +[ Upstream commit b241e260820b68c09586e8a0ae0fc23c0e3215bd ] + +In case WoWlan was never configured during the operation of the system, +the hw->wiphy->wowlan_config will be NULL. rsi_config_wowlan() checks +whether wowlan_config is non-NULL and if it is not, then WARNs about it. +The warning is valid, as during normal operation the rsi_config_wowlan() +should only ever be called with non-NULL wowlan_config. In shutdown this +rsi_config_wowlan() should only ever be called if WoWlan was configured +before by the user. + +Add checks for non-NULL wowlan_config into the shutdown hook. While at it, +check whether the wiphy is also non-NULL before accessing wowlan_config . +Drop the single-use wowlan_config variable, just inline it into function +call. + +Fixes: 16bbc3eb8372 ("rsi: fix null pointer dereference during rsi_shutdown()") +Signed-off-by: Marek Vasut +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230527222833.273741-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rsi/rsi_91x_sdio.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c +index 9f16128e4ffab..3952c8baba181 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c +@@ -1463,10 +1463,8 @@ static void rsi_shutdown(struct device *dev) + + rsi_dbg(ERR_ZONE, "SDIO Bus shutdown =====>\n"); + +- if (hw) { +- struct cfg80211_wowlan *wowlan = hw->wiphy->wowlan_config; +- +- if (rsi_config_wowlan(adapter, wowlan)) ++ if (hw && hw->wiphy && hw->wiphy->wowlan_config) { ++ if (rsi_config_wowlan(adapter, hw->wiphy->wowlan_config)) + rsi_dbg(ERR_ZONE, "Failed to configure WoWLAN\n"); + } + +-- +2.39.2 + diff --git a/queue-5.15/wifi-rsi-do-not-set-mmc_pm_keep_power-in-shutdown.patch b/queue-5.15/wifi-rsi-do-not-set-mmc_pm_keep_power-in-shutdown.patch new file mode 100644 index 00000000000..d6937670460 --- /dev/null +++ b/queue-5.15/wifi-rsi-do-not-set-mmc_pm_keep_power-in-shutdown.patch @@ -0,0 +1,41 @@ +From 6e6f6474acc99b0e2f2cc4355a6a9fc0284d3cfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 May 2023 00:28:59 +0200 +Subject: wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown + +From: Marek Vasut + +[ Upstream commit e74f562328b03fbe9cf438f958464dff3a644dfc ] + +It makes no sense to set MMC_PM_KEEP_POWER in shutdown. The flag +indicates to the MMC subsystem to keep the slot powered on during +suspend, but in shutdown the slot should actually be powered off. +Drop this call. + +Fixes: 063848c3e155 ("rsi: sdio: Add WOWLAN support for S5 shutdown state") +Signed-off-by: Marek Vasut +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230527222859.273768-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rsi/rsi_91x_sdio.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c +index 3952c8baba181..670de56c69a26 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c +@@ -1479,9 +1479,6 @@ static void rsi_shutdown(struct device *dev) + if (sdev->write_fail) + rsi_dbg(INFO_ZONE, "###### Device is not ready #######\n"); + +- if (rsi_set_sdio_pm_caps(adapter)) +- rsi_dbg(INFO_ZONE, "Setting power management caps failed\n"); +- + rsi_dbg(INFO_ZONE, "***** RSI module shut down *****\n"); + } + +-- +2.39.2 + diff --git a/queue-5.15/wifi-wilc1000-fix-for-absent-rsn-capabilities-wfa-te.patch b/queue-5.15/wifi-wilc1000-fix-for-absent-rsn-capabilities-wfa-te.patch new file mode 100644 index 00000000000..c0b20878846 --- /dev/null +++ b/queue-5.15/wifi-wilc1000-fix-for-absent-rsn-capabilities-wfa-te.patch @@ -0,0 +1,55 @@ +From ede137d72c6ce8974f4650cdca51294408870db3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 18:10:20 +0000 +Subject: wifi: wilc1000: fix for absent RSN capabilities WFA testcase + +From: Amisha Patel + +[ Upstream commit 9ce4bb09123e9754996e358bd808d39f5d112899 ] + +Mandatory WFA testcase +CT_Security_WPA2Personal_STA_RSNEBoundsVerification-AbsentRSNCap, +performs bounds verfication on Beacon and/or Probe response frames. It +failed and observed the reason to be absence of cipher suite and AKM +suite in RSN information. To fix this, enable the RSN flag before extracting RSN +capabilities. + +Fixes: cd21d99e595e ("wifi: wilc1000: validate pairwise and authentication suite offsets") +Signed-off-by: Amisha Patel +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230421181005.4865-1-amisha.patel@microchip.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/microchip/wilc1000/hif.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c +index 3e5cc947b9b90..a7bca0475e1ee 100644 +--- a/drivers/net/wireless/microchip/wilc1000/hif.c ++++ b/drivers/net/wireless/microchip/wilc1000/hif.c +@@ -470,6 +470,9 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, + int rsn_ie_len = sizeof(struct element) + rsn_ie[1]; + int offset = 8; + ++ param->mode_802_11i = 2; ++ param->rsn_found = true; ++ + /* extract RSN capabilities */ + if (offset < rsn_ie_len) { + /* skip over pairwise suites */ +@@ -479,11 +482,8 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, + /* skip over authentication suites */ + offset += (rsn_ie[offset] * 4) + 2; + +- if (offset + 1 < rsn_ie_len) { +- param->mode_802_11i = 2; +- param->rsn_found = true; ++ if (offset + 1 < rsn_ie_len) + memcpy(param->rsn_cap, &rsn_ie[offset], 2); +- } + } + } + } +-- +2.39.2 + diff --git a/queue-5.15/wifi-wl3501_cs-fix-an-error-handling-path-in-wl3501_.patch b/queue-5.15/wifi-wl3501_cs-fix-an-error-handling-path-in-wl3501_.patch new file mode 100644 index 00000000000..d1a695578cd --- /dev/null +++ b/queue-5.15/wifi-wl3501_cs-fix-an-error-handling-path-in-wl3501_.patch @@ -0,0 +1,66 @@ +From 4138f15761224d08a3b14d79927eddbb6629c487 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 May 2023 10:05:08 +0200 +Subject: wifi: wl3501_cs: Fix an error handling path in wl3501_probe() + +From: Christophe JAILLET + +[ Upstream commit 391af06a02e7642039ac5f6c4b2c034ab0992b5d ] + +Should wl3501_config() fail, some resources need to be released as already +done in the remove function. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Christophe JAILLET +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/7cc9c9316489b7d69b36aeb0edd3123538500b41.1684569865.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/wl3501_cs.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c +index 7fb2f95134760..c45c4b7cbbaf1 100644 +--- a/drivers/net/wireless/wl3501_cs.c ++++ b/drivers/net/wireless/wl3501_cs.c +@@ -1862,6 +1862,7 @@ static int wl3501_probe(struct pcmcia_device *p_dev) + { + struct net_device *dev; + struct wl3501_card *this; ++ int ret; + + /* The io structure describes IO port mapping */ + p_dev->resource[0]->end = 16; +@@ -1873,8 +1874,7 @@ static int wl3501_probe(struct pcmcia_device *p_dev) + + dev = alloc_etherdev(sizeof(struct wl3501_card)); + if (!dev) +- goto out_link; +- ++ return -ENOMEM; + + dev->netdev_ops = &wl3501_netdev_ops; + dev->watchdog_timeo = 5 * HZ; +@@ -1887,9 +1887,15 @@ static int wl3501_probe(struct pcmcia_device *p_dev) + netif_stop_queue(dev); + p_dev->priv = dev; + +- return wl3501_config(p_dev); +-out_link: +- return -ENOMEM; ++ ret = wl3501_config(p_dev); ++ if (ret) ++ goto out_free_etherdev; ++ ++ return 0; ++ ++out_free_etherdev: ++ free_netdev(dev); ++ return ret; + } + + static int wl3501_config(struct pcmcia_device *link) +-- +2.39.2 + diff --git a/queue-5.15/wl3501_cs-use-eth_hw_addr_set.patch b/queue-5.15/wl3501_cs-use-eth_hw_addr_set.patch new file mode 100644 index 00000000000..1d8670b9530 --- /dev/null +++ b/queue-5.15/wl3501_cs-use-eth_hw_addr_set.patch @@ -0,0 +1,40 @@ +From b127eee2ca7a1b9f14b2527a92cff2b248b77281 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 16:50:20 -0700 +Subject: wl3501_cs: use eth_hw_addr_set() + +From: Jakub Kicinski + +[ Upstream commit 18774612246d036c04ce9fee7f67192f96f48725 ] + +Commit 406f42fa0d3c ("net-next: When a bond have a massive amount +of VLANs...") introduced a rbtree for faster Ethernet address look +up. To maintain netdev->dev_addr in this tree we need to make all +the writes to it got through appropriate helpers. + +Signed-off-by: Jakub Kicinski +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211018235021.1279697-15-kuba@kernel.org +Stable-dep-of: 391af06a02e7 ("wifi: wl3501_cs: Fix an error handling path in wl3501_probe()") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/wl3501_cs.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c +index cb71b73853f4e..7351a2c127adc 100644 +--- a/drivers/net/wireless/wl3501_cs.c ++++ b/drivers/net/wireless/wl3501_cs.c +@@ -1945,8 +1945,7 @@ static int wl3501_config(struct pcmcia_device *link) + goto failed; + } + +- for (i = 0; i < 6; i++) +- dev->dev_addr[i] = ((char *)&this->mac_addr)[i]; ++ eth_hw_addr_set(dev, this->mac_addr); + + /* print probe information */ + printk(KERN_INFO "%s: wl3501 @ 0x%3.3x, IRQ %d, " +-- +2.39.2 + diff --git a/queue-5.15/x86-mm-fix-__swp_entry_to_pte-for-xen-pv-guests.patch b/queue-5.15/x86-mm-fix-__swp_entry_to_pte-for-xen-pv-guests.patch new file mode 100644 index 00000000000..582a52881bd --- /dev/null +++ b/queue-5.15/x86-mm-fix-__swp_entry_to_pte-for-xen-pv-guests.patch @@ -0,0 +1,47 @@ +From eb0e05c8655a0d8415aefc182c3b2c57ec468938 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 13:32:59 +0100 +Subject: x86/mm: Fix __swp_entry_to_pte() for Xen PV guests + +From: Juergen Gross + +[ Upstream commit 0f88130e8a6fd185b0aeb5d8e286083735f2585a ] + +Normally __swp_entry_to_pte() is never called with a value translating +to a valid PTE. The only known exception is pte_swap_tests(), resulting +in a WARN splat in Xen PV guests, as __pte_to_swp_entry() did +translate the PFN of the valid PTE to a guest local PFN, while +__swp_entry_to_pte() doesn't do the opposite translation. + +Fix that by using __pte() in __swp_entry_to_pte() instead of open +coding the native variant of it. + +For correctness do the similar conversion for __swp_entry_to_pmd(). + +Fixes: 05289402d717 ("mm/debug_vm_pgtable: add tests validating arch helpers for core MM features") +Signed-off-by: Juergen Gross +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230306123259.12461-1-jgross@suse.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/pgtable_64.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h +index 56d0399a0cd16..dd520b44e89cc 100644 +--- a/arch/x86/include/asm/pgtable_64.h ++++ b/arch/x86/include/asm/pgtable_64.h +@@ -235,8 +235,8 @@ static inline void native_pgd_clear(pgd_t *pgd) + + #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val((pte)) }) + #define __pmd_to_swp_entry(pmd) ((swp_entry_t) { pmd_val((pmd)) }) +-#define __swp_entry_to_pte(x) ((pte_t) { .pte = (x).val }) +-#define __swp_entry_to_pmd(x) ((pmd_t) { .pmd = (x).val }) ++#define __swp_entry_to_pte(x) (__pte((x).val)) ++#define __swp_entry_to_pmd(x) (__pmd((x).val)) + + extern int kern_addr_valid(unsigned long addr); + extern void cleanup_highmap(void); +-- +2.39.2 + diff --git a/queue-5.15/x86-resctrl-only-show-tasks-pid-in-current-pid-names.patch b/queue-5.15/x86-resctrl-only-show-tasks-pid-in-current-pid-names.patch new file mode 100644 index 00000000000..f122f8cc501 --- /dev/null +++ b/queue-5.15/x86-resctrl-only-show-tasks-pid-in-current-pid-names.patch @@ -0,0 +1,55 @@ +From 04513aba0c03d267f14cf222f865071f57dc8c07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 14:04:48 +0800 +Subject: x86/resctrl: Only show tasks' pid in current pid namespace + +From: Shawn Wang + +[ Upstream commit 2997d94b5dd0e8b10076f5e0b6f18410c73e28bd ] + +When writing a task id to the "tasks" file in an rdtgroup, +rdtgroup_tasks_write() treats the pid as a number in the current pid +namespace. But when reading the "tasks" file, rdtgroup_tasks_show() shows +the list of global pids from the init namespace, which is confusing and +incorrect. + +To be more robust, let the "tasks" file only show pids in the current pid +namespace. + +Fixes: e02737d5b826 ("x86/intel_rdt: Add tasks files") +Signed-off-by: Shawn Wang +Signed-off-by: Borislav Petkov (AMD) +Acked-by: Reinette Chatre +Acked-by: Fenghua Yu +Tested-by: Reinette Chatre +Link: https://lore.kernel.org/all/20230116071246.97717-1-shawnwang@linux.alibaba.com/ +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/resctrl/rdtgroup.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/cpu/resctrl/rdtgroup.c b/arch/x86/kernel/cpu/resctrl/rdtgroup.c +index 421d31718fbd8..2ec16477eb3e1 100644 +--- a/arch/x86/kernel/cpu/resctrl/rdtgroup.c ++++ b/arch/x86/kernel/cpu/resctrl/rdtgroup.c +@@ -731,11 +731,15 @@ static ssize_t rdtgroup_tasks_write(struct kernfs_open_file *of, + static void show_rdt_tasks(struct rdtgroup *r, struct seq_file *s) + { + struct task_struct *p, *t; ++ pid_t pid; + + rcu_read_lock(); + for_each_process_thread(p, t) { +- if (is_closid_match(t, r) || is_rmid_match(t, r)) +- seq_printf(s, "%d\n", t->pid); ++ if (is_closid_match(t, r) || is_rmid_match(t, r)) { ++ pid = task_pid_vnr(t); ++ if (pid) ++ seq_printf(s, "%d\n", pid); ++ } + } + rcu_read_unlock(); + } +-- +2.39.2 +