From: Greg Kroah-Hartman Date: Thu, 28 Dec 2023 12:13:08 +0000 (+0000) Subject: 5.15-stable patches X-Git-Tag: v6.1.70~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cf02766e443212cde2ec55efc405d67bbbf7892f;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: drm-i915-reject-async-flips-with-bigjoiner.patch dt-bindings-nvmem-mxs-ocotp-document-fsl-ocotp.patch input-soc_button_array-add-mapping-for-airplane-mode-button.patch net-9p-avoid-freeing-uninit-memory-in-p9pdu_vreadf.patch net-ks8851-fix-tx-stall-caused-by-tx-buffer-overrun.patch net-rfkill-gpio-set-gpio-direction.patch --- diff --git a/queue-5.15/drm-i915-reject-async-flips-with-bigjoiner.patch b/queue-5.15/drm-i915-reject-async-flips-with-bigjoiner.patch new file mode 100644 index 00000000000..6fa17892310 --- /dev/null +++ b/queue-5.15/drm-i915-reject-async-flips-with-bigjoiner.patch @@ -0,0 +1,47 @@ +From 88a173e5dd05e788068e8fa20a8c37c44bd8f416 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Mon, 11 Dec 2023 10:11:34 +0200 +Subject: drm/i915: Reject async flips with bigjoiner +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 88a173e5dd05e788068e8fa20a8c37c44bd8f416 upstream. + +Currently async flips are busted when bigjoiner is in use. +As a short term fix simply reject async flips in that case. + +Cc: stable@vger.kernel.org +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9769 +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20231211081134.2698-1-ville.syrjala@linux.intel.com +Reviewed-by: Stanislav Lisovskiy +(cherry picked from commit e93bffc2ac0a833b42841f31fff955549d38ce98) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_display.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -9667,6 +9667,17 @@ static int intel_atomic_check_async(stru + } + } + ++ /* ++ * FIXME: Bigjoiner+async flip is busted currently. ++ * Remove this check once the issues are fixed. ++ */ ++ if (new_crtc_state->bigjoiner_pipes) { ++ drm_dbg_kms(&i915->drm, ++ "[CRTC:%d:%s] async flip disallowed with bigjoiner\n", ++ crtc->base.base.id, crtc->base.name); ++ return -EINVAL; ++ } ++ + for_each_oldnew_intel_plane_in_state(state, plane, old_plane_state, + new_plane_state, i) { + /* diff --git a/queue-5.15/dt-bindings-nvmem-mxs-ocotp-document-fsl-ocotp.patch b/queue-5.15/dt-bindings-nvmem-mxs-ocotp-document-fsl-ocotp.patch new file mode 100644 index 00000000000..c7cdfa41a68 --- /dev/null +++ b/queue-5.15/dt-bindings-nvmem-mxs-ocotp-document-fsl-ocotp.patch @@ -0,0 +1,58 @@ +From a2a8aefecbd0f87d6127951cef33b3def8439057 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Fri, 15 Dec 2023 11:13:57 +0000 +Subject: dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp + +From: Fabio Estevam + +commit a2a8aefecbd0f87d6127951cef33b3def8439057 upstream. + +Both imx23.dtsi and imx28.dtsi describe the OCOTP nodes in +the format: + +compatible = "fsl,imx28-ocotp", "fsl,ocotp"; + +Document the "fsl,ocotp" entry to fix the following schema +warning: + +efuse@8002c000: compatible: ['fsl,imx23-ocotp', 'fsl,ocotp'] is too long +from schema $id: http://devicetree.org/schemas/nvmem/mxs-ocotp.yaml# + +Fixes: 2c504460f502 ("dt-bindings: nvmem: Convert MXS OCOTP to json-schema") +Cc: +Signed-off-by: Fabio Estevam +Acked-by: Conor Dooley +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20231215111358.316727-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml ++++ b/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml +@@ -14,9 +14,11 @@ allOf: + + properties: + compatible: +- enum: +- - fsl,imx23-ocotp +- - fsl,imx28-ocotp ++ items: ++ - enum: ++ - fsl,imx23-ocotp ++ - fsl,imx28-ocotp ++ - const: fsl,ocotp + + "#address-cells": + const: 1 +@@ -40,7 +42,7 @@ additionalProperties: false + examples: + - | + ocotp: efuse@8002c000 { +- compatible = "fsl,imx28-ocotp"; ++ compatible = "fsl,imx28-ocotp", "fsl,ocotp"; + #address-cells = <1>; + #size-cells = <1>; + reg = <0x8002c000 0x2000>; diff --git a/queue-5.15/input-soc_button_array-add-mapping-for-airplane-mode-button.patch b/queue-5.15/input-soc_button_array-add-mapping-for-airplane-mode-button.patch new file mode 100644 index 00000000000..72fb79bd1d7 --- /dev/null +++ b/queue-5.15/input-soc_button_array-add-mapping-for-airplane-mode-button.patch @@ -0,0 +1,43 @@ +From ea3715941a9b7d816a1e9096ac0577900af2a69e Mon Sep 17 00:00:00 2001 +From: Christoffer Sandberg +Date: Fri, 22 Dec 2023 23:25:38 -0800 +Subject: Input: soc_button_array - add mapping for airplane mode button + +From: Christoffer Sandberg + +commit ea3715941a9b7d816a1e9096ac0577900af2a69e upstream. + +This add a mapping for the airplane mode button on the TUXEDO Pulse Gen3. + +While it is physically a key it behaves more like a switch, sending a key +down on first press and a key up on 2nd press. Therefor the switch event +is used here. Besides this behaviour it uses the HID usage-id 0xc6 +(Wireless Radio Button) and not 0xc8 (Wireless Radio Slider Switch), but +since neither 0xc6 nor 0xc8 are currently implemented at all in +soc_button_array this not to standard behaviour is not put behind a quirk +for the moment. + +Signed-off-by: Christoffer Sandberg +Signed-off-by: Werner Sembach +Link: https://lore.kernel.org/r/20231215171718.80229-1-wse@tuxedocomputers.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/misc/soc_button_array.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/input/misc/soc_button_array.c ++++ b/drivers/input/misc/soc_button_array.c +@@ -299,6 +299,11 @@ static int soc_button_parse_btn_desc(str + info->name = "power"; + info->event_code = KEY_POWER; + info->wakeup = true; ++ } else if (upage == 0x01 && usage == 0xc6) { ++ info->name = "airplane mode switch"; ++ info->event_type = EV_SW; ++ info->event_code = SW_RFKILL_ALL; ++ info->active_low = false; + } else if (upage == 0x01 && usage == 0xca) { + info->name = "rotation lock switch"; + info->event_type = EV_SW; diff --git a/queue-5.15/net-9p-avoid-freeing-uninit-memory-in-p9pdu_vreadf.patch b/queue-5.15/net-9p-avoid-freeing-uninit-memory-in-p9pdu_vreadf.patch new file mode 100644 index 00000000000..8ae6205a939 --- /dev/null +++ b/queue-5.15/net-9p-avoid-freeing-uninit-memory-in-p9pdu_vreadf.patch @@ -0,0 +1,82 @@ +From ff49bf1867578f23a5ffdd38f927f6e1e16796c4 Mon Sep 17 00:00:00 2001 +From: Fedor Pchelkin +Date: Wed, 6 Dec 2023 23:09:13 +0300 +Subject: net: 9p: avoid freeing uninit memory in p9pdu_vreadf + +From: Fedor Pchelkin + +commit ff49bf1867578f23a5ffdd38f927f6e1e16796c4 upstream. + +If some of p9pdu_readf() calls inside case 'T' in p9pdu_vreadf() fails, +the error path is not handled properly. *wnames or members of *wnames +array may be left uninitialized and invalidly freed. + +Initialize *wnames to NULL in beginning of case 'T'. Initialize the first +*wnames array element to NULL and nullify the failing *wnames element so +that the error path freeing loop stops on the first NULL element and +doesn't proceed further. + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: ace51c4dd2f9 ("9p: add new protocol support code") +Signed-off-by: Fedor Pchelkin +Message-ID: <20231206200913.16135-1-pchelkin@ispras.ru> +Cc: stable@vger.kernel.org +Reviewed-by: Simon Horman +Reviewed-by: Christian Schoenebeck +Signed-off-by: Dominique Martinet +Signed-off-by: Greg Kroah-Hartman +--- + net/9p/protocol.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/net/9p/protocol.c ++++ b/net/9p/protocol.c +@@ -230,6 +230,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int p + uint16_t *nwname = va_arg(ap, uint16_t *); + char ***wnames = va_arg(ap, char ***); + ++ *wnames = NULL; ++ + errcode = p9pdu_readf(pdu, proto_version, + "w", nwname); + if (!errcode) { +@@ -239,6 +241,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int p + GFP_NOFS); + if (!*wnames) + errcode = -ENOMEM; ++ else ++ (*wnames)[0] = NULL; + } + + if (!errcode) { +@@ -250,8 +254,10 @@ p9pdu_vreadf(struct p9_fcall *pdu, int p + proto_version, + "s", + &(*wnames)[i]); +- if (errcode) ++ if (errcode) { ++ (*wnames)[i] = NULL; + break; ++ } + } + } + +@@ -259,11 +265,14 @@ p9pdu_vreadf(struct p9_fcall *pdu, int p + if (*wnames) { + int i; + +- for (i = 0; i < *nwname; i++) ++ for (i = 0; i < *nwname; i++) { ++ if (!(*wnames)[i]) ++ break; + kfree((*wnames)[i]); ++ } ++ kfree(*wnames); ++ *wnames = NULL; + } +- kfree(*wnames); +- *wnames = NULL; + } + } + break; diff --git a/queue-5.15/net-ks8851-fix-tx-stall-caused-by-tx-buffer-overrun.patch b/queue-5.15/net-ks8851-fix-tx-stall-caused-by-tx-buffer-overrun.patch new file mode 100644 index 00000000000..6ffbde9f469 --- /dev/null +++ b/queue-5.15/net-ks8851-fix-tx-stall-caused-by-tx-buffer-overrun.patch @@ -0,0 +1,234 @@ +From 3dc5d44545453de1de9c53cc529cc960a85933da Mon Sep 17 00:00:00 2001 +From: Ronald Wahl +Date: Thu, 14 Dec 2023 19:11:12 +0100 +Subject: net: ks8851: Fix TX stall caused by TX buffer overrun + +From: Ronald Wahl + +commit 3dc5d44545453de1de9c53cc529cc960a85933da upstream. + +There is a bug in the ks8851 Ethernet driver that more data is written +to the hardware TX buffer than actually available. This is caused by +wrong accounting of the free TX buffer space. + +The driver maintains a tx_space variable that represents the TX buffer +space that is deemed to be free. The ks8851_start_xmit_spi() function +adds an SKB to a queue if tx_space is large enough and reduces tx_space +by the amount of buffer space it will later need in the TX buffer and +then schedules a work item. If there is not enough space then the TX +queue is stopped. + +The worker function ks8851_tx_work() dequeues all the SKBs and writes +the data into the hardware TX buffer. The last packet will trigger an +interrupt after it was send. Here it is assumed that all data fits into +the TX buffer. + +In the interrupt routine (which runs asynchronously because it is a +threaded interrupt) tx_space is updated with the current value from the +hardware. Also the TX queue is woken up again. + +Now it could happen that after data was sent to the hardware and before +handling the TX interrupt new data is queued in ks8851_start_xmit_spi() +when the TX buffer space had still some space left. When the interrupt +is actually handled tx_space is updated from the hardware but now we +already have new SKBs queued that have not been written to the hardware +TX buffer yet. Since tx_space has been overwritten by the value from the +hardware the space is not accounted for. + +Now we have more data queued then buffer space available in the hardware +and ks8851_tx_work() will potentially overrun the hardware TX buffer. In +many cases it will still work because often the buffer is written out +fast enough so that no overrun occurs but for example if the peer +throttles us via flow control then an overrun may happen. + +This can be fixed in different ways. The most simple way would be to set +tx_space to 0 before writing data to the hardware TX buffer preventing +the queuing of more SKBs until the TX interrupt has been handled. I have +chosen a slightly more efficient (and still rather simple) way and +track the amount of data that is already queued and not yet written to +the hardware. When new SKBs are to be queued the already queued amount +of data is honoured when checking free TX buffer space. + +I tested this with a setup of two linked KS8851 running iperf3 between +the two in bidirectional mode. Before the fix I got a stall after some +minutes. With the fix I saw now issues anymore after hours. + +Fixes: 3ba81f3ece3c ("net: Micrel KS8851 SPI network driver") +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: Ben Dooks +Cc: Tristram Ha +Cc: netdev@vger.kernel.org +Cc: stable@vger.kernel.org # 5.10+ +Signed-off-by: Ronald Wahl +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20231214181112.76052-1-rwahl@gmx.de +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/micrel/ks8851.h | 3 ++ + drivers/net/ethernet/micrel/ks8851_common.c | 20 ++++++------- + drivers/net/ethernet/micrel/ks8851_spi.c | 42 ++++++++++++++++++---------- + 3 files changed, 40 insertions(+), 25 deletions(-) + +--- a/drivers/net/ethernet/micrel/ks8851.h ++++ b/drivers/net/ethernet/micrel/ks8851.h +@@ -350,6 +350,8 @@ union ks8851_tx_hdr { + * @rxd: Space for receiving SPI data, in DMA-able space. + * @txd: Space for transmitting SPI data, in DMA-able space. + * @msg_enable: The message flags controlling driver output (see ethtool). ++ * @tx_space: Free space in the hardware TX buffer (cached copy of KS_TXMIR). ++ * @queued_len: Space required in hardware TX buffer for queued packets in txq. + * @fid: Incrementing frame id tag. + * @rc_ier: Cached copy of KS_IER. + * @rc_ccr: Cached copy of KS_CCR. +@@ -399,6 +401,7 @@ struct ks8851_net { + struct work_struct rxctrl_work; + + struct sk_buff_head txq; ++ unsigned int queued_len; + + struct eeprom_93cx6 eeprom; + struct regulator *vdd_reg; +--- a/drivers/net/ethernet/micrel/ks8851_common.c ++++ b/drivers/net/ethernet/micrel/ks8851_common.c +@@ -361,16 +361,18 @@ static irqreturn_t ks8851_irq(int irq, v + handled |= IRQ_RXPSI; + + if (status & IRQ_TXI) { +- handled |= IRQ_TXI; ++ unsigned short tx_space = ks8851_rdreg16(ks, KS_TXMIR); + +- /* no lock here, tx queue should have been stopped */ ++ netif_dbg(ks, intr, ks->netdev, ++ "%s: txspace %d\n", __func__, tx_space); + +- /* update our idea of how much tx space is available to the +- * system */ +- ks->tx_space = ks8851_rdreg16(ks, KS_TXMIR); ++ spin_lock(&ks->statelock); ++ ks->tx_space = tx_space; ++ if (netif_queue_stopped(ks->netdev)) ++ netif_wake_queue(ks->netdev); ++ spin_unlock(&ks->statelock); + +- netif_dbg(ks, intr, ks->netdev, +- "%s: txspace %d\n", __func__, ks->tx_space); ++ handled |= IRQ_TXI; + } + + if (status & IRQ_RXI) +@@ -413,9 +415,6 @@ static irqreturn_t ks8851_irq(int irq, v + if (status & IRQ_LCI) + mii_check_link(&ks->mii); + +- if (status & IRQ_TXI) +- netif_wake_queue(ks->netdev); +- + return IRQ_HANDLED; + } + +@@ -499,6 +498,7 @@ static int ks8851_net_open(struct net_de + ks8851_wrreg16(ks, KS_ISR, ks->rc_ier); + ks8851_wrreg16(ks, KS_IER, ks->rc_ier); + ++ ks->queued_len = 0; + netif_start_queue(ks->netdev); + + netif_dbg(ks, ifup, ks->netdev, "network device up\n"); +--- a/drivers/net/ethernet/micrel/ks8851_spi.c ++++ b/drivers/net/ethernet/micrel/ks8851_spi.c +@@ -287,6 +287,18 @@ static void ks8851_wrfifo_spi(struct ks8 + } + + /** ++ * calc_txlen - calculate size of message to send packet ++ * @len: Length of data ++ * ++ * Returns the size of the TXFIFO message needed to send ++ * this packet. ++ */ ++static unsigned int calc_txlen(unsigned int len) ++{ ++ return ALIGN(len + 4, 4); ++} ++ ++/** + * ks8851_rx_skb_spi - receive skbuff + * @ks: The device state + * @skb: The skbuff +@@ -305,7 +317,9 @@ static void ks8851_rx_skb_spi(struct ks8 + */ + static void ks8851_tx_work(struct work_struct *work) + { ++ unsigned int dequeued_len = 0; + struct ks8851_net_spi *kss; ++ unsigned short tx_space; + struct ks8851_net *ks; + unsigned long flags; + struct sk_buff *txb; +@@ -322,6 +336,8 @@ static void ks8851_tx_work(struct work_s + last = skb_queue_empty(&ks->txq); + + if (txb) { ++ dequeued_len += calc_txlen(txb->len); ++ + ks8851_wrreg16_spi(ks, KS_RXQCR, + ks->rc_rxqcr | RXQCR_SDA); + ks8851_wrfifo_spi(ks, txb, last); +@@ -332,6 +348,13 @@ static void ks8851_tx_work(struct work_s + } + } + ++ tx_space = ks8851_rdreg16_spi(ks, KS_TXMIR); ++ ++ spin_lock(&ks->statelock); ++ ks->queued_len -= dequeued_len; ++ ks->tx_space = tx_space; ++ spin_unlock(&ks->statelock); ++ + ks8851_unlock_spi(ks, &flags); + } + +@@ -347,18 +370,6 @@ static void ks8851_flush_tx_work_spi(str + } + + /** +- * calc_txlen - calculate size of message to send packet +- * @len: Length of data +- * +- * Returns the size of the TXFIFO message needed to send +- * this packet. +- */ +-static unsigned int calc_txlen(unsigned int len) +-{ +- return ALIGN(len + 4, 4); +-} +- +-/** + * ks8851_start_xmit_spi - transmit packet using SPI + * @skb: The buffer to transmit + * @dev: The device used to transmit the packet. +@@ -386,16 +397,17 @@ static netdev_tx_t ks8851_start_xmit_spi + + spin_lock(&ks->statelock); + +- if (needed > ks->tx_space) { ++ if (ks->queued_len + needed > ks->tx_space) { + netif_stop_queue(dev); + ret = NETDEV_TX_BUSY; + } else { +- ks->tx_space -= needed; ++ ks->queued_len += needed; + skb_queue_tail(&ks->txq, skb); + } + + spin_unlock(&ks->statelock); +- schedule_work(&kss->tx_work); ++ if (ret == NETDEV_TX_OK) ++ schedule_work(&kss->tx_work); + + return ret; + } diff --git a/queue-5.15/net-rfkill-gpio-set-gpio-direction.patch b/queue-5.15/net-rfkill-gpio-set-gpio-direction.patch new file mode 100644 index 00000000000..ee605a1df9c --- /dev/null +++ b/queue-5.15/net-rfkill-gpio-set-gpio-direction.patch @@ -0,0 +1,45 @@ +From 23484d817082c3005252d8edfc8292c8a1006b5b Mon Sep 17 00:00:00 2001 +From: Rouven Czerwinski +Date: Thu, 7 Dec 2023 08:58:36 +0100 +Subject: net: rfkill: gpio: set GPIO direction + +From: Rouven Czerwinski + +commit 23484d817082c3005252d8edfc8292c8a1006b5b upstream. + +Fix the undefined usage of the GPIO consumer API after retrieving the +GPIO description with GPIO_ASIS. The API documentation mentions that +GPIO_ASIS won't set a GPIO direction and requires the user to set a +direction before using the GPIO. + +This can be confirmed on i.MX6 hardware, where rfkill-gpio is no longer +able to enabled/disable a device, presumably because the GPIO controller +was never configured for the output direction. + +Fixes: b2f750c3a80b ("net: rfkill: gpio: prevent value glitch during probe") +Cc: stable@vger.kernel.org +Signed-off-by: Rouven Czerwinski +Link: https://msgid.link/20231207075835.3091694-1-r.czerwinski@pengutronix.de +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/rfkill/rfkill-gpio.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/net/rfkill/rfkill-gpio.c ++++ b/net/rfkill/rfkill-gpio.c +@@ -116,6 +116,14 @@ static int rfkill_gpio_probe(struct plat + return -EINVAL; + } + ++ ret = gpiod_direction_output(rfkill->reset_gpio, true); ++ if (ret) ++ return ret; ++ ++ ret = gpiod_direction_output(rfkill->shutdown_gpio, true); ++ if (ret) ++ return ret; ++ + rfkill->rfkill_dev = rfkill_alloc(rfkill->name, &pdev->dev, + rfkill->type, &rfkill_gpio_ops, + rfkill); diff --git a/queue-5.15/series b/queue-5.15/series index 965769745a7..38e8a66692e 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -50,3 +50,9 @@ usb-serial-option-add-quectel-rm500q-r13-firmware-support.patch bluetooth-hci_event-fix-not-checking-if-hci_op_inquiry-has-been-sent.patch bluetooth-l2cap-send-reject-on-command-corrupted-request.patch bluetooth-mgmt-smp-fix-address-type-when-using-smp-over-bredr-le.patch +input-soc_button_array-add-mapping-for-airplane-mode-button.patch +net-9p-avoid-freeing-uninit-memory-in-p9pdu_vreadf.patch +net-rfkill-gpio-set-gpio-direction.patch +net-ks8851-fix-tx-stall-caused-by-tx-buffer-overrun.patch +dt-bindings-nvmem-mxs-ocotp-document-fsl-ocotp.patch +drm-i915-reject-async-flips-with-bigjoiner.patch